fix(extensions): resolve extension-relative URLs in windows.create

chrome.windows.create({ url: 'notification.html' }) from an extension
background (e.g. Rabby's detached signing window) was passed through to
impl.createWindow unresolved, producing a blank window (ERR_ABORTED).
tabs.create already resolves via validateExtensionUrl; windows.create now
does the same. Helper moved to api/common.ts to avoid a tabs<->windows
import cycle.

Claude-Session: https://claude.ai/code/session_01McBa3Lh2fTj1FyrjEiHGf3

Author: Aaron

packages/electron-chrome-extensions/src/browser/api/common.ts

@@ -36,6 +36,22 @@ export const getExtensionUrl = (extension: Electron.Extension, uri: string) => {
   } catch {}
 }
 
+export const validateExtensionUrl = (url: string, extension: Electron.Extension) => {
+  // Convert relative URLs to absolute if needed
+  try {
+    url = new URL(url, extension.url).href
+  } catch (e) {
+    throw new Error('Invalid URL')
+  }
+
+  // Prevent creating chrome://kill or other debug commands
+  if (url.startsWith('chrome:') || url.startsWith('javascript:')) {
+    throw new Error('Invalid URL')
+  }
+
+  return url
+}
+
 export const resolveExtensionPath = (
   extension: Electron.Extension,
   uri: string,

packages/electron-chrome-extensions/src/browser/api/tabs.ts

@@ -1,27 +1,17 @@
 import { ExtensionContext } from '../context'
 import { ExtensionEvent } from '../router'
-import { getAllWindows, matchesPattern, matchesTitlePattern, TabContents } from './common'
+import {
+  getAllWindows,
+  matchesPattern,
+  matchesTitlePattern,
+  validateExtensionUrl,
+  TabContents,
+} from './common'
 import { WindowsAPI } from './windows'
 import debug from 'debug'
 
 const d = debug('electron-chrome-extensions:tabs')
 
-const validateExtensionUrl = (url: string, extension: Electron.Extension) => {
-  // Convert relative URLs to absolute if needed
-  try {
-    url = new URL(url, extension.url).href
-  } catch (e) {
-    throw new Error('Invalid URL')
-  }
-
-  // Prevent creating chrome://kill or other debug commands
-  if (url.startsWith('chrome:') || url.startsWith('javascript:')) {
-    throw new Error('Invalid URL')
-  }
-
-  return url
-}
-
 export class TabsAPI {
   static TAB_ID_NONE = -1
   static WINDOW_ID_NONE = -1

packages/electron-chrome-extensions/src/browser/api/windows.ts

@@ -1,5 +1,6 @@
 import { ExtensionContext } from '../context'
 import { ExtensionEvent } from '../router'
+import { validateExtensionUrl } from './common'
 import debug from 'debug'
 
 const d = debug('electron-chrome-extensions:windows')
@@ -109,7 +110,16 @@ export class WindowsAPI {
   }
 
   private async create(event: ExtensionEvent, details: chrome.windows.CreateData) {
-    const win = await this.ctx.store.createWindow(event, details)
+    // Resolve extension-relative URLs (e.g. 'notification.html' from wallet
+    // extensions) against the calling extension, mirroring tabs.create.
+    let url = details.url
+    if (typeof url === 'string') {
+      url = validateExtensionUrl(url, event.extension)
+    } else if (Array.isArray(url)) {
+      url = url.map((u) => validateExtensionUrl(u, event.extension))
+    }
+
+    const win = await this.ctx.store.createWindow(event, { ...details, url })
     return this.getWindowDetails(win)
   }