fix: prefer the focused frame, bound model length, drop dead flag

background/background.js

@@ -10,6 +10,17 @@ const COMMAND_ID = "ask-chatgpt";
 // A commands invocation confers activeTab (ext-commands.js grants it before
 // firing onCommand), so executeScript works with no host permission.
 //
+// Every frame keeps its own independent Selection, and a selection made in a
+// non-focused frame is not cleared when the user selects elsewhere. Without a
+// filter, a stale selection in an unfocused (possibly cross-origin) iframe
+// could win over — or be pulled alongside — the selection the user actually
+// made, with the winner among multiple non-empty results decided by an
+// executeScript ordering that isn't specified. The injected snippet is
+// therefore gated on document.hasFocus(), which is true for the focused
+// document and all of its ancestors: the top frame wins when the user
+// selected there, and an iframe's selection is only picked up when it is
+// itself the focused frame.
+//
 // Failure has three measured shapes, all handled here: a thrown
 // "Missing host permission for the tab", a thrown variant naming frames, and a
 // SILENT resolution to [null] on parent-process about: pages. Never index into
@@ -32,7 +43,7 @@ async function readSelection() {
   let results;
   try {
     results = await browser.tabs.executeScript(tabId, {
-      code: "window.getSelection().toString()",
+      code: "document.hasFocus() ? window.getSelection().toString() : ''",
       allFrames: true,
       matchAboutBlank: true,
     });