fix(extension): support cross-origin media frames

docs/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to the KoalaSync browser extension and relay server.
 
 ---
 
+## [v3.1.2] — 2026-08-17
+
+This release adds generic control for HTML5 players inside cross-origin frames.
+It restores the intended Google Drive support, whose earlier workaround was
+developed on a separate branch but never merged into `main`, and covers nested
+external players such as YummyAnime without a site-specific host list.
+
+### Added
+- **Extension: Cross-origin player targeting** — Probes every accessible frame, elects the visible real player from video readiness, source, rendering, playback, controls, size and background-video signals, then injects and routes playback, force sync, heartbeat, chat and audio processing to that exact frame and document.
+- **Extension: Embedded-player recovery** — Re-elects the target when a player frame becomes hidden, loses its video, reloads or is replaced by another frame. Equally ranked frames without visibility evidence are rejected instead of controlling an arbitrary preload or ad.
+- **Testing: Cross-origin lifecycle E2E coverage** — Drives the packed Chromium extension through ordered play, pause and seek in a two-level external player; verifies hidden duplicate rejection, CSS visibility switches without a remote-command trigger, selected-frame document reloads and videos inserted late inside child frames.
+
+### Fixed
+- **Extension: Google Drive playback** — Detects Drive's current visible `youtube.googleapis.com/embed` player and keeps Drive's top-page title, URL and platform identity in debug output while controlling the embedded video.
+- **Extension: External anime players** — Supports same-origin wrappers whose real player is hosted on a different origin, including the current YummyAnime structure with a visible external player and hidden duplicate frames.
+- **Extension: Frame-specific message routing** — Sends remote commands, state reads, audio settings, host-control feedback, episode-lobby events and teardown only to the selected frame/document instead of assuming the top frame.
+- **Extension: Force Sync in embedded players** — Reads the current time through the background's selected-frame route, so Jump to Me no longer queries only the top document.
+
+### Changed
+- **Extension: Debug frame context** — Reports the selected frame ID and origin while preserving the selected tab's top-level URL and title. Google Drive is identified as Google Drive instead of the embedded YouTube API host.
+
 ## [v3.1.1] — 2026-08-15
 
 A single fix: the popup could get stuck at double width for the rest of a

docs/ROADMAP.md

@@ -49,14 +49,6 @@
 
 *Ideas and feature requests under evaluation.*
 
-### Cross-origin frame video detection and control
-
-- **Priority:** P3
-- **Category:** Compatibility / Embedded Players
-- **Background:** KoalaSync injects on demand into the selected tab's top frame. Since the same-origin frame walk shipped, the top-frame script also reaches players inside first-party iframes (`jkanime.net`-style `/jkplayer/` frames, `srcdoc` and `about:blank` frames that inherit the parent origin). What remains uncovered is the real `<video>` living inside a **cross-origin** iframe, where `contentDocument` is unreachable by design.
-- **Possible approach:** Add an opt-in frame bridge (`allFrames: true` injection) where child frames announce detected videos to the top frame, and the top frame routes remote play/pause/seek commands to the active child video. Needs a frame-election rule so ad frames cannot claim the session.
-- **Status:** Same-origin part completed; cross-origin frame bridge still open. Not needed for current Emby behavior.
-
 ### Sticky player selection
 
 - **Priority:** P3
@@ -90,6 +82,17 @@
 
 ---
 
+## ✅ Completed
+
+### Cross-origin frame video detection and control
+
+- **Priority:** P3
+- **Category:** Compatibility / Embedded Players
+- **Completed:** v3.1.2
+- **Outcome:** The background probes accessible frames, elects the visible HTML5 player without trusting child-frame claims, and routes injection, ordered commands, state, chat, audio and teardown to the selected document. Hidden equal candidates without visibility evidence are rejected. A tab-wide frame sentinel plus subframe-navigation events recover CSS visibility switches, document reloads, lazy video insertion and failed delivery. Google Drive and YummyAnime-style nested external players are covered by live topology inspection plus packed-Chromium E2E fixtures; live two-peer service runs remain tracked separately.
+
+---
+
 ## ❌ Rejected
 
 *Declined features with rationale — keeps decisions documented so they don't get re-debated.*

docs/TESTED_SERVICES.md

@@ -26,6 +26,8 @@ This document tracks which streaming platforms and media servers are supported b
 | **ARD / ZDF Mediathek** | Not tested | Not tested | Not tested | — | — | — | — |
 | **Vix** | ✅ Full | ✅ Full | ✅ Full | — | — | — | Everything works correctly. |
 | **JkAnime** | ✅ Full | ❌ | ❌ | 2026-08-14 | Shik3i | v3.1.0 | Player sits in a same-origin `/jkplayer/` iframe, so it needs the same-origin frame walk added in v3.1.0. No MediaSession metadata is exposed, and the page title carries no episode pattern (`… Futari 18 Sub Español …`). |
+| **Google Drive** | ⚠️ Partial | ✅ Full | ❌ N/A | 2026-08-17 | Shik3i / Codex | v3.1.2 | Live inspection confirms the visible `youtube.googleapis.com/embed` child topology; packed-Chromium fixtures cover exact-document control and recovery. A live two-peer Drive relay run is still pending. |
+| **YummyAnime** | ⚠️ Partial | ⚠️ Partial | ❌ | 2026-08-17 | Shik3i / Codex | v3.1.2 | Live inspection confirms the same-origin wrapper plus external `thealloha.club` player topology; packed-Chromium fixtures cover nested control and recovery. A live two-peer site run is still pending, and the page title lacks the selected episode. |
 
 ### Legend
 
@@ -71,4 +73,4 @@ Websites with heavily obfuscated custom players may require platform-specific wo
 
 Since v3.1.0 the content script walks **same-origin** frames, so a player wrapped in the site's own iframe is found and controlled without a site-specific workaround. This also covers `srcdoc` and `about:blank` frames, which inherit the parent origin.
 
-Frames on a **different origin** remain out of reach, because the browser blocks `contentDocument` access by design. Note that a subdomain counts as a different origin: a player served from `player.example.com` inside `example.com` is *not* reachable. Sites that embed their player from an external host (common for anime and sports streaming mirrors) fall into this category. Tracked on the roadmap as the cross-origin frame bridge.
+Since v3.1.2 the background can also inspect accessible **cross-origin** frames and inject KoalaSync into the exact frame/document containing the visible player. Frame election uses visibility and media signals so hidden preloads, trailers and ad players do not win accidentally. When browser site access for the external player origin is withheld, KoalaSync uses the existing website-access recovery flow instead of bypassing the browser permission.

docs/devops.md

@@ -19,6 +19,7 @@ When you push a Git tag matching `v*` (e.g., `v2.5.1`), the GitHub Actions relea
    - `extension/manifest.base.json`
    - `shared/constants.js` (updates `APP_VERSION`)
    - `package.json`
+   - `package-lock.json` (root package metadata)
    - `website/version.json`
    - `website/template.html` (updates `softwareVersion` schema)
    - `README.md` (updates badge and announcement banner)