fix(stealth): move __tandem* globals into CDP isolated worlds

[hydro13]

The leak

Before this change, any page's JavaScript could detect Tandem with a single property check:

```js
Object.keys(window).filter(k => /^__tandem/.test(k))
// → ['__tandemScroll', '__tandemSelection', '__tandemFormFocus',
// '__tandemVisionActive', '__tandemSecurityAlert',
// '__tandemSecurityMonitorsActive']
```

That's a shared-signal fingerprint across every Tandem install — the stealth equivalent of the Date.now jitter shared-signal fixed in #168. Found during live MCP dogfooding on 2026-04-18.

The fix

Wingman Vision (scroll / selection / form-focus)

Nothing in this path hooks main-world prototypes — the listeners only read DOM state and report via CDP binding. Moved entirely to isolated world.

• `Page.addScriptToEvaluateOnNewDocument` now uses `worldName: 'TandemVision'`
• `Runtime.addBinding` scoped via `executionContextName: 'TandemVision'`
• Current-document injection explicitly creates the isolated world with `Page.createIsolatedWorld` on the top frame, then `Runtime.evaluate`s with the returned `contextId`
• `window.__tandemVisionActive` guard flag removed — replaced by a main-process `wingmanBindingsInstalled: Set` that guarantees `installWingmanBindings` only runs once per webContents

Net: page main world has no `__tandemScroll`, `__tandemSelection`, `__tandemFormFocus`, or `__tandemVisionActive`.

Security monitors (keylogger / wasm / clipboard / form-action)

These MUST run in main world — they hook `EventTarget.prototype.addEventListener`, `WebAssembly.instantiate`, `navigator.clipboard.readText`, and `HTMLFormElement.prototype.action`. An isolated-world copy would only hook that world's prototypes, which page JS never touches.

Hybrid architecture:

• Main-world monitor script: unchanged hooking logic, but replaces direct `__tandemSecurityAlert(...)` calls with `document.dispatchEvent(new CustomEvent('__tdm_sec_alert', { detail: JSON.stringify(data) }))`. The event type is non-branded; the event is only emitted when a known attack pattern fires, so its presence is conditional, not a static fingerprint.
• Isolated-world bridge (worldName: 'TandemSecurity'): listens for the CustomEvent, forwards `e.detail` to the `__tandemSecurityAlert` CDP binding. Binding scoped to the isolated world via `executionContextName`, so page JS can't see it.
• `window.__tandemSecurityMonitorsActive` guard flag removed — `state.monitorInjected` on the main process already prevents double injection.

Net: page main world has no `__tandemSecurityAlert` or `__tandemSecurityMonitorsActive`. The only main-world trace is the `__tdm_sec_alert` CustomEvent type, and only when an attack pattern actually fires.

Regression guard

NEW `src/security/tests/stealth-globals-regression.test.ts` — programmatically asserts:

1. Main-world monitor source contains zero `/__tandem\w*/` matches
2. Every `Runtime.addBinding` for a `__tandem*` name MUST include `executionContextName` matching `/^Tandem/`
3. The isolated-world bridge exists with worldName `'TandemSecurity'`
4. Main-world source uses `CustomEvent` / `dispatchEvent`, never a direct binding call

Future PRs that reintroduce a `__tandem*` global in main world will fail this test loud.

Updated existing tests

`src/security/tests/script-guard.test.ts` now asserts the new shape: binding scoping, two `Page.addScriptToEvaluateOnNewDocument` calls (monitor + bridge), main-world source has no `__tandem*`, and bridge exists with the correct worldName.

Verify

• `npm run verify`: 2758 tests pass (+ 5 new regression-guard cases)
• `check-consistency` green
• Existing `Runtime.bindingCalled` handling for `__tandemSecurityAlert` unchanged — main-process code still receives alerts exactly as before
• Post-merge live test in a real page: `Object.keys(window).filter(k => /__tandem/i.test(k))` returns `[]`

Context

• From `docs/superpowers/agent-experience-fix-plan.md` — PR 2 of 5
• Addresses Bug 3 in `docs/superpowers/tandem-bugs-to-fix.md`
• Follows the same shared-signal-removal pattern as fix(stealth): remove Date.now jitter + fix keypress interval + drop dead recordClick #168 (Date.now jitter)

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 66.66667% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/security/script-guard.ts	66.66%	3 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!