[jack-arturo]

Summary

Adds optional Clerk sign-in on top of Browser Hand. The toolbar popup still controls the local relay with or without an account. Sign-in, sign-up, sign-out, the account summary, and order history live on an extension page (account.html) opened from the popup.

No Clerk application or keys are in the repo. Setup is documented in the README and .env.example.

Changes

• Account page using @clerk/chrome-extension (ClerkProvider, SignIn, SignUp, UserButton, UserProfile) with Browser Hand appearance: ink #0B0A12, bone, cyan #7EE7FF, and the glove mark.
• Popup account row that mirrors a display-only chrome.storage snapshot (no tokens) and opens the account page. The background relay is unchanged and is not gated on sign-in.
• Typed order history (extension/account/orders.ts): sample orders until WXT_ORDER_HISTORY_URL is set, then a bearer-token HTTP source that does not fall back to samples on failure.
• npm run clerk:brand (@clerk/backend) merges chrome-extension://<id> into instance allowed_origins. With CLERK_APPLICATION_ID, it also calls the Platform API to set the application name to Browser Hand and upload the glove logo.
• Public keys are WXT_-prefixed and inlined at build time. CLERK_SECRET_KEY has no WXT_ prefix and is not bundled. .env stays gitignored.
• cookies is requested only when WXT_CLERK_SYNC_HOST is set. Extension-only sign-in uses storage.
• Typecheck fix: removed a duplicate debuggerUnavailableReason field on TabManager, and loosened two tab-group test assignments so tsc --noEmit is clean.

Test plan

• cd extension && npm run test:run — 107 tests passed
• cd extension && npx tsc --noEmit
• cd extension && npm run build — succeeds with no .env
• Rebuild with a dummy CLERK_SECRET_KEY and WXT_CLERK_PUBLISHABLE_KEY: the secret is absent from dist/; the publishable key is inlined only in the account chunk
• node extension/scripts/clerk-brand.mjs --dry-run plans chrome-extension://<id> and makes no API calls; a placeholder secret exits non-zero
• npm run doctor — not run; attach, CDP, and the relay were not changed
• Manual sign-in — needs a Clerk application, Native API enabled, keys in .env, a rebuild, and npm run clerk:brand

Notes for reviewers

Auth is additive. Missing or placeholder keys show setup instructions on the account page; the popup toggle keeps working.

Follow-ups before this can sign anyone in:

1. Create a Clerk application named Browser Hand and enable the Native API.
2. Copy .env.example to .env. Set WXT_CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY. Optionally set WXT_CLERK_FRONTEND_API.
3. npm run build:extension and reload the unpacked extension.
4. Put the id from chrome://extensions in CLERK_EXTENSION_ID and run npm run clerk:brand.
5. For emails and the hosted Account Portal, set CLERK_APPLICATION_ID (and CLERK_PLATFORM_SECRET_KEY if the Platform API token differs). A 401/403 means set the name and logo in Dashboard → Settings → Branding. In-extension components are themed either way.
6. Real orders: implement the GET contract in the README and set WXT_ORDER_HISTORY_URL. Verify the bearer token with verifyToken and ignore the userId query param as an authority.

The popup name stays stale until the account page has loaded once. The account bundle is large because Clerk's UI is bundled; the popup and background worker do not include it.