fix: sidebar agent uses extension's activeTabUrl instead of stale Playwright URL

When the user navigates manually in headed Chrome, Playwright's page.url()
stays on the old page. The sidebar agent was using this stale URL in its
system prompt, causing it to navigate to the wrong page (e.g., Hacker News
instead of the user's current page).

The Chrome extension now captures the active tab URL via chrome.tabs.query()
and sends it as activeTabUrl in the /sidebar-command POST body. The server
prefers this over Playwright's URL. The URL is sanitized (http/https only,
control chars stripped, 2048 char limit) to prevent prompt injection.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

extension/background.js

@@ -194,17 +194,23 @@ chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => {
       sendResponse({ error: 'Not connected' });
       return true;
     }
-    fetch(`${base}/sidebar-command`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'Authorization': `Bearer ${authToken}`,
-      },
-      body: JSON.stringify({ message: msg.message }),
-    })
-      .then(r => r.json())
-      .then(data => sendResponse(data))
-      .catch(err => sendResponse({ error: err.message }));
+    // Capture the active tab's URL so the sidebar agent knows what page
+    // the user is actually looking at (Playwright's page.url() can be stale
+    // if the user navigated manually in headed mode).
+    chrome.tabs.query({ active: true, currentWindow: true }, (tabs) => {
+      const activeTabUrl = tabs?.[0]?.url || null;
+      fetch(`${base}/sidebar-command`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'Authorization': `Bearer ${authToken}`,
+        },
+        body: JSON.stringify({ message: msg.message, activeTabUrl }),
+      })
+        .then(r => r.json())
+        .then(data => sendResponse(data))
+        .catch(err => sendResponse({ error: err.message }));
+    });
     return true;
   }
 });