Merge remote-tracking branch 'origin/main' into feature/textchat

# Conflicts:
#	extension/background.js
#	extension/popup.js

README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <a href="https://github.com/Shik3i/KoalaSync/actions/workflows/release.yml"><img src="https://github.com/Shik3i/KoalaSync/actions/workflows/release.yml/badge.svg" alt="Release Status"></a>
-  <a href="https://github.com/Shik3i/KoalaSync/releases"><img src="https://img.shields.io/badge/Release-v2.6.1-blue?logo=github" alt="GitHub release"></a>
+  <a href="https://github.com/Shik3i/KoalaSync/releases"><img src="https://img.shields.io/badge/Release-v2.6.4-blue?logo=github" alt="GitHub release"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue" alt="License"></a>
   <a href="https://addons.mozilla.org/de/firefox/addon/koalasync/"><img src="https://img.shields.io/badge/Firefox-Download-orange?logo=firefoxbrowser&logoColor=white" alt="Firefox Add-on"></a>
   <a href="https://chromewebstore.google.com/detail/koalasync/obbnmkmlaaddodakcbdljknjpagklifc"><img src="https://img.shields.io/badge/Chrome-Download-blue?logo=googlechrome&logoColor=white" alt="Chrome Extension"></a>
@@ -14,7 +14,7 @@
 
 <p align="center"><i>KoalaSync is a lightweight Browser Extension and Relay Server for synchronized video playback on almost any website with a video element—YouTube, Twitch, Netflix, Emby, Jellyfin, and beyond. Built with a focus on <b>Data Sovereignty</b> and <b>Performance</b>.</i></p>
 
-<p align="center"><a href="docs/CHANGELOG.md"><b>New v2.6.1 Release!</b> — See what's changed</a></p>
+<p align="center"><a href="docs/CHANGELOG.md"><b>New v2.6.4 Release!</b> — See what's changed</a></p>
 
 ### 🌟 Why KoalaSync?
 

docs/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to the KoalaSync browser extension and relay server.
 
 ---
 
+## [v2.6.4] — 2026-07-16
+
+### Changed
+- **Extension: Localized store metadata** — Renamed the public extension title to `Watch Party - KoalaSync` and added natural, store-ready descriptions for all 15 supported locales while preserving regional language variants.
+- **Extension: Locale-based manifest metadata** — The extension name and description now resolve through Chrome/Firefox `_locales` messages instead of being hardcoded in the manifest.
+
+### Fixed
+- **Build: Extension metadata validation** — Extension builds now fail clearly for invalid locale JSON, missing metadata, an incorrect extension title, or store titles and descriptions that exceed their character limits.
+
+## [v2.6.3] — 2026-07-15
+
+### Fixed
+- **Extension: Host-access recovery races** — Prevents stale permission grants, reinjection retries, closed tabs, and rapid target changes from reactivating or clearing the wrong video tab.
+- **Extension: Cross-browser host patterns** — Uses Firefox-compatible match patterns for local servers while preserving exact Chromium port scopes.
+- **Extension: Force-sync target integrity** — Keeps sampled playback time and acknowledgements bound to the selected tab during recovery and target changes.
+
+## [v2.6.2] — 2026-07-15
+
+### Added
+- **Website: Site-access recovery guide** — Added an English help page and a localized banner across every landing-page language.
+
+### Fixed
+- **Extension: Withheld website access recovery** — Detects browser-withheld host access, shows a localized allow-access action, requests only the selected website origin, and resumes the selected tab after access is granted.
+- **Extension: Target-tab reliability** — Hardened permission recovery against rapid tab changes, navigation, closed tabs, service-worker restoration, and stale pending state.
+- **Browser compatibility** — Uses Chrome's toolbar access request only when available, with a direct user-gesture permission fallback for Firefox and older Chromium browsers.
+
+---
+
 ## [v2.6.1] — 2026-07-15
 
 ### Fixed

extension/_locales/de/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Synchronisiere die Videowiedergabe auf YouTube, Netflix, Emby, Jellyfin und jeder HTML5-Seite in Echtzeit mit Freunden."
+    "message": "Erstelle private Watch Partys und synchronisiere Videos mit Freunden auf YouTube, Netflix, Jellyfin, Emby und fast jeder Website."
   }
 }

extension/_locales/en/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Synchronize video playback on YouTube, Netflix, Emby, Jellyfin, and any HTML5 site in real-time with friends."
+    "message": "Create private watch parties and sync videos with friends on YouTube, Netflix, Jellyfin, Emby, and almost any HTML5 website."
   }
 }

extension/_locales/es/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Mira videos junto a tus amigos en perfecta sincronización. Compatible con Netflix, YouTube, Twitch, Prime Video, Disney+ y cualquier reproductor HTML5."
+    "message": "Crea fiestas privadas y sincroniza vídeos con amigos en YouTube, Netflix, Jellyfin, Emby y casi cualquier sitio HTML5."
   }
 }

extension/_locales/fr/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Synchronisez la lecture vidéo sur YouTube, Netflix, Emby, Jellyfin et tout site HTML5 en temps réel avec vos amis."
+    "message": "Créez des watch parties privées et regardez en synchro entre amis sur YouTube, Netflix, Jellyfin, Emby et presque tout site HTML5."
   }
 }

extension/_locales/it/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Sincronizza la riproduzione video su YouTube, Netflix, Emby, Jellyfin e qualsiasi sito HTML5 in tempo reale con gli amici."
+    "message": "Crea watch party private e sincronizza i video con gli amici su YouTube, Netflix, Jellyfin, Emby e quasi ogni sito HTML5."
   }
 }

extension/_locales/ja/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "YouTube、Netflix、Emby、Jellyfin、その他HTML5サイトでの動画再生を友達とリアルタイムで同期します。"
+    "message": "プライベートなウォッチパーティーを作成し、YouTube、Netflix、Jellyfin、EmbyやほぼすべてのHTML5サイトで友達と動画を同期再生できます。"
   }
 }

extension/_locales/ko/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "YouTube, Netflix, Emby, Jellyfin 및 모든 HTML5 사이트에서 친구들과 실시간으로 비디오 재생을 동기화하세요."
+    "message": "비공개 Watch Party를 만들고 YouTube, Netflix, Jellyfin, Emby 및 거의 모든 HTML5 사이트에서 친구들과 영상을 동기화하세요."
   }
 }

extension/_locales/nl/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Synchroniseer video-afspelen op YouTube, Netflix, Emby, Jellyfin en elke HTML5-site in realtime met vrienden."
+    "message": "Maak privéwatchparty's en kijk synchroon met vrienden op YouTube, Netflix, Jellyfin, Emby en vrijwel elke HTML5-website."
   }
 }

extension/_locales/pl/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Synchronizuj odtwarzanie wideo na YouTube, Netflix, Emby, Jellyfin i dowolnej stronie HTML5 w czasie rzeczywistym ze znajomymi."
+    "message": "Twórz prywatne wspólne seanse i synchronizuj filmy ze znajomymi na YouTube, Netflix, Jellyfin, Emby i niemal każdej stronie HTML5."
   }
 }

extension/_locales/pt_BR/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Assista a vídeos junto com seus amigos em sincronia perfeita. Compatível com Netflix, YouTube, Twitch, Prime Video, Disney+ e qualquer player HTML5."
+    "message": "Crie watch parties privadas e sincronize vídeos com amigos no YouTube, Netflix, Jellyfin, Emby e em quase qualquer site HTML5."
   }
 }

extension/_locales/pt_PT/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Veja vídeos em conjunto com os seus amigos em sincronia perfeita. Compatível com Netflix, YouTube, Twitch, Prime Video, Disney+ e qualquer leitor HTML5."
+    "message": "Crie sessões privadas e veja vídeos sincronizados com amigos no YouTube, Netflix, Jellyfin, Emby e em quase qualquer site HTML5."
   }
 }

extension/_locales/ru/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Синхронизируйте воспроизведение видео на YouTube, Netflix, Emby, Jellyfin и любых HTML5-сайтах в реальном времени с друзьями."
+    "message": "Создавайте закрытые Watch Party и смотрите синхронно с друзьями на YouTube, Netflix, Jellyfin, Emby и почти любом сайте HTML5."
   }
 }

extension/_locales/tr/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "YouTube, Netflix, Emby, Jellyfin ve herhangi bir HTML5 sitesinde video oynatmayı arkadaşlarınızla gerçek zamanlı olarak senkronize edin."
+    "message": "Özel izleme partileri kurun; YouTube, Netflix, Jellyfin, Emby ve çoğu HTML5 sitesinde arkadaşlarınızla senkron izleyin."
   }
 }

extension/_locales/uk/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Синхронізуйте відтворення відео на YouTube, Netflix, Emby, Jellyfin і будь-якому сайті HTML5 у режимі реального часу з друзями."
+    "message": "Створюйте закриті Watch Party й дивіться синхронно з друзями на YouTube, Netflix, Jellyfin, Emby та майже будь-якому сайті HTML5."
   }
 }

extension/_locales/zh_CN/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "与朋友实时同步YouTube、Netflix、Emby、Jellyfin和任何HTML5网站上的视频播放。"
+    "message": "创建私人观影派对，与好友在 YouTube、Netflix、Jellyfin、Emby 及几乎任何 HTML5 视频网站同步观看。"
   }
 }

extension/background.js

@@ -7,6 +7,7 @@ import { initTabManager } from './modules/tab-manager.js';
 import { clearChatKeyCache, decryptChatMessage, encryptChatMessage, generateChatSecret, validateChatSecret } from './chat-crypto.js';
 import { buildChatRelayPayload, encodeSocketEvent } from './chat-wire.js';
 import { createChatSendLimiter, createLatestTaskQueue, normalizeRoomId } from './chat-session.js';
+import { HOST_ACCESS_REQUIRED_STATUS, normalizeTabId, inspectTabHostAccess, isHostAccessError, addTabHostAccessRequest, removeTabHostAccessRequest } from './host-access.js';
 import './page-api-seek-overrides.js';
 
 // --- Uninstall URL Initialization ---
@@ -64,6 +65,8 @@ let peerId = null; // initialized via getPeerId()
 let currentRoom = null;
 let currentTabId = null;
 let currentTabTitle = null; // New: for Smart Matching
+let targetActivationGeneration = 0;
+let activeTargetActivation = null;
 let logs = [];
 let history = []; // New: for Action History
 let storageInitialized = false;
@@ -191,8 +194,12 @@ function ensureState() {
             ], (data) => {
                 clearTimeout(storageTimeout);
                 if (data.expectedAcksCount !== undefined) expectedAcksCount = data.expectedAcksCount;
-                if (data.currentTabId !== undefined) currentTabId = data.currentTabId;
+                if (data.currentTabId !== undefined) currentTabId = normalizeTabId(data.currentTabId);
-                if (data.currentTabTitle !== undefined) currentTabTitle = data.currentTabTitle;
+                if (data.currentTabTitle !== undefined) {
+                    currentTabTitle = currentTabId !== null && typeof data.currentTabTitle === 'string'
+                        ? data.currentTabTitle
+                        : null;
+                }
                 // Merge data from storage with any early-arriving state
                 // New entries (added during boot) must stay at the top (index 0)
                 if (data.logs) logs = [...logs, ...data.logs].slice(0, 200);
@@ -545,7 +552,28 @@ function markRoomPotentiallyIdle() {
     }
 }
 
-function clearTargetTabForIdle() {
+function invalidateTargetActivations() {
+    targetActivationGeneration++;
+    activeTargetActivation = null;
+    return targetActivationGeneration;
+}
+
+function isCurrentTargetIdentity(tabId, generation) {
+    return normalizeTabId(currentTabId) === normalizeTabId(tabId)
+        && targetActivationGeneration === generation;
+}
+
+function clearTargetTabForIdle(expectedTabId = null, expectedGeneration = null) {
+    if (expectedTabId !== null && normalizeTabId(currentTabId) !== normalizeTabId(expectedTabId)) {
+        return false;
+    }
+    if (expectedGeneration !== null && targetActivationGeneration !== expectedGeneration) {
+        return false;
+    }
+
+    completeForceSyncBeforeTargetChange(null);
+    invalidateTargetActivations();
+    clearPendingTarget().catch(() => {});
     if (currentTabId) chrome.tabs.sendMessage(Number(currentTabId), { type: 'CHAT_DESTROY' }).catch(() => {});
     currentTabId = null;
     currentTabTitle = null;
@@ -553,8 +581,14 @@ function clearTargetTabForIdle() {
     if (currentRoom) {
         roomIdleSince = Date.now();
     }
-    chrome.storage.session.set({ currentTabId, currentTabTitle, roomIdleSince, lastContentHeartbeatAt }).catch(() => {});
+    chrome.storage.session.set({
+        currentTabId,
+        currentTabTitle,
+        roomIdleSince,
+        lastContentHeartbeatAt
+    }).catch(() => {});
     updateBadgeStatus();
+    return true;
 }
 
 async function leaveRoomAfterIdleGrace(reason) {
@@ -563,6 +597,7 @@ async function leaveRoomAfterIdleGrace(reason) {
     reconnectFailed = false;
     reconnectAttempts = 0;
     chrome.storage.session.set({ reconnectFailed: false, reconnectAttempts: 0, reconnectStartTime: null });
+    completeForceSyncBeforeTargetChange(null);
     emit(EVENTS.LEAVE_ROOM, { peerId });
     forceDisconnect();
     currentRoom = null;
@@ -575,11 +610,13 @@ async function leaveRoomAfterIdleGrace(reason) {
     // any stale guest-side HCM state (dialog/badge/desync) — H-2.
     broadcastControlMode();
     if (currentTabId) chrome.tabs.sendMessage(Number(currentTabId), { type: 'CHAT_DESTROY' }).catch(() => {});
+    invalidateTargetActivations();
     currentTabId = null;
     currentTabTitle = null;
     roomIdleSince = null;
     lastContentHeartbeatAt = null;
     clearEpisodeLobbyState();
+    await clearPendingTarget();
     await chrome.storage.session.set({
         currentRoom: null,
         currentTabId: null,
@@ -1536,6 +1573,16 @@ function executeForceSync() {
     addLog('Force Sync Executed', 'success');
 }
 
+function completeForceSyncBeforeTargetChange(nextTabId) {
+    if (!isForceSyncInitiator) return;
+    const selectedTabId = normalizeTabId(currentTabId);
+    const normalizedNextTabId = normalizeTabId(nextTabId);
+    if (selectedTabId !== null && selectedTabId === normalizedNextTabId) return;
+
+    addLog('Finishing Force Sync before target change', 'info');
+    executeForceSync();
+}
+
 // --- Episode Auto-Sync Lobby Functions ---
 function persistEpisodeLobby() {
     if (storageInitialized) chrome.storage.session.set({ episodeLobby });
@@ -1683,13 +1730,14 @@ function updateLastAction(action, senderId, timestamp = Date.now()) {
 async function routeToContent(action, payload) {
     if (!currentTabId) return;
 
-    const tabId = parseInt(currentTabId);
+    const tabId = normalizeTabId(currentTabId);
-    if (isNaN(tabId)) return;
+    if (tabId === null) return;
+    const targetGeneration = targetActivationGeneration;
 
     const actionTimestamp = payload?.actionTimestamp || Date.now();
     const commandSenderId = payload?.senderId || null;
 
-    _routeToContentInternal(tabId, action, payload, actionTimestamp, commandSenderId, 0);
+    _routeToContentInternal(tabId, action, payload, actionTimestamp, commandSenderId, 0, targetGeneration);
 }
 
 function getTabVideoState(tabId) {
@@ -1704,12 +1752,21 @@ function getTabVideoState(tabId) {
     });
 }
 
-async function getReadyTabVideoState(tabId) {
+async function getReadyTabVideoState(tabId, expectedGeneration = targetActivationGeneration) {
     let state = await getTabVideoState(tabId);
     if (!state || state.error) {
-        await injectContentScript(tabId);
+        const activation = await reactivateCurrentTarget(tabId, { expectedGeneration });
+        if (activation?.status !== 'ok') {
+            return { error: 'Target tab changed before content script recovery completed' };
+        }
         await new Promise(resolve => setTimeout(resolve, 250));
+        if (!isCurrentTargetIdentity(tabId, activation.generation)) {
+            return { error: 'Target tab changed before video state could be read' };
+        }
         state = await getTabVideoState(tabId);
+        if (!isCurrentTargetIdentity(tabId, activation.generation)) {
+            return { error: 'Target tab changed while video state was being read' };
+        }
     }
     return state;
 }
@@ -1830,51 +1887,533 @@ function setPageApiSeekEnabled(enabled) {
     window.KOALA_PAGE_API_SEEK_ENABLED = enabled === true;
 }
 
-async function injectContentScript(tabId) {
+function createHostAccessRequiredError(access, requestAdded, cause) {
+    const error = new Error(`Host access required for ${access.host || 'this website'}`);
+    error.code = HOST_ACCESS_REQUIRED_STATUS;
+    error.tabId = access.tab?.id || null;
+    error.host = access.host || null;
+    error.originPattern = access.originPattern || null;
+    error.requestAdded = requestAdded === true;
+    error.cause = cause;
+    return error;
+}
+
+function injectionFailureResponse(error) {
+    if (error?.code === HOST_ACCESS_REQUIRED_STATUS) {
+        return {
+            status: HOST_ACCESS_REQUIRED_STATUS,
+            tabId: error.tabId,
+            host: error.host,
+            originPattern: error.originPattern,
+            requestAdded: error.requestAdded === true
+        };
+    }
+    return { status: 'error', message: error?.message || 'Script injection failed' };
+}
+
+async function injectContentScript(tabId, { requestHostAccess = true } = {}) {
+    const normalizedTabId = normalizeTabId(tabId);
+    if (normalizedTabId === null) throw new Error('Invalid tab ID');
+    tabId = normalizedTabId;
     let needsPageApiSeek = false;
     let pageApiSeekReady = false;
+    let access = null;
     try {
-        const tab = await chrome.tabs.get(tabId);
+        access = await inspectTabHostAccess(chrome, tabId);
-        const url = tab?.url || '';
+        const url = access.url || '';
         needsPageApiSeek = shouldUsePageApiSeek(url);
     } catch (_e) {
         // Fall through to the generic content script injection.
     }
 
-    if (needsPageApiSeek) {
+    try {
-        try {
+        if (needsPageApiSeek) {
-            await chrome.scripting.executeScript({
+            try {
-                target: { tabId },
+                await chrome.scripting.executeScript({
-                world: 'MAIN',
+                    target: { tabId },
-                files: ['page-api-seek-overrides.js']
+                    world: 'MAIN',
-            });
+                    files: ['page-api-seek-overrides.js']
-            await chrome.scripting.executeScript({
+                });
-                target: { tabId },
+                await chrome.scripting.executeScript({
-                world: 'MAIN',
+                    target: { tabId },
-                func: installPageApiSeekBridge
+                    world: 'MAIN',
-            });
+                    func: installPageApiSeekBridge
-            pageApiSeekReady = true;
+                });
-        } catch (err) {
+                pageApiSeekReady = true;
-            addLog(`Page API seek bridge injection failed: ${err.message}`, 'warn');
+            } catch (err) {
+                addLog(`Page API seek bridge injection failed: ${err.message}`, 'warn');
+            }
         }
-    }
 
-    await chrome.scripting.executeScript({
+        await chrome.scripting.executeScript({
-        target: { tabId },
+            target: { tabId },
-        files: ['page-api-seek-overrides.js']
+            files: ['page-api-seek-overrides.js']
-    });
+        });
-    await chrome.scripting.executeScript({
+        await chrome.scripting.executeScript({
-        target: { tabId },
+            target: { tabId },
-        func: setPageApiSeekEnabled,
+            func: setPageApiSeekEnabled,
-        args: [pageApiSeekReady]
+            args: [pageApiSeekReady]
-    });
+        });
-    return chrome.scripting.executeScript({
+        return await chrome.scripting.executeScript({
-        target: { tabId },
+            target: { tabId },
-        files: ['chat-format.js', 'chat-overlay.js', 'content.js']
+            files: ['chat-format.js', 'chat-overlay.js', 'content.js']
+        });
+    } catch (error) {
+        // A temporary activeTab grant is intentionally allowed to win: even if
+        // permissions.contains() reports false, a successful injection above is
+        // valid. Only convert an actual injection failure into a host-access UX.
+        try {
+            // The tab may have crossed origins between the initial permission
+            // check and executeScript(). Always report/request the current URL.
+            access = await inspectTabHostAccess(chrome, tabId);
+        } catch (_inspectionError) {
+            access = null;
+        }
+        const accessIsMissing = access?.granted === false
+            || (access?.granted === null && isHostAccessError(error));
+        if (access?.originPattern && accessIsMissing) {
+            const requestAdded = requestHostAccess
+                ? await addTabHostAccessRequest(chrome, tabId, access.originPattern)
+                : false;
+            throw createHostAccessRequiredError(access, requestAdded, error);
+        }
+        throw error;
+    }
+}
+
+let pendingTargetMutation = Promise.resolve();
+
+const PENDING_TARGET_KEYS = [
+    'pendingTargetTabId',
+    'pendingTargetTabTitle',
+    'pendingTargetHost',
+    'pendingTargetOriginPattern',
+    'pendingTargetRequestId'
+];
+
+function createPendingTargetRequestId() {
+    return globalThis.crypto?.randomUUID?.()
+        || `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
+
+function emptyPendingTargetState() {
+    return {
+        pendingTargetTabId: null,
+        pendingTargetTabTitle: null,
+        pendingTargetHost: null,
+        pendingTargetOriginPattern: null,
+        pendingTargetRequestId: null
+    };
+}
+
+function mutatePendingTarget(operation) {
+    const result = pendingTargetMutation.catch(() => {}).then(operation);
+    pendingTargetMutation = result.catch(() => {});
+    return result;
+}
+
+async function readPendingTarget() {
+    return mutatePendingTarget(async () => {
+        const stored = await chrome.storage.session.get(PENDING_TARGET_KEYS);
+        const tabId = normalizeTabId(stored.pendingTargetTabId);
+        const originPattern = typeof stored.pendingTargetOriginPattern === 'string'
+            && stored.pendingTargetOriginPattern.length > 0
+            ? stored.pendingTargetOriginPattern
+            : null;
+
+        if (tabId === null || originPattern === null) {
+            if (Object.values(stored).some(value => value !== null && value !== undefined)) {
+                if (tabId !== null) {
+                    await removeTabHostAccessRequest(chrome, tabId, originPattern);
+                }
+                await chrome.storage.session.set(emptyPendingTargetState());
+            }
+            return null;
+        }
+
+        const requestId = typeof stored.pendingTargetRequestId === 'string'
+            && stored.pendingTargetRequestId.length > 0
+            ? stored.pendingTargetRequestId
+            : createPendingTargetRequestId();
+        if (stored.pendingTargetRequestId !== requestId) {
+            await chrome.storage.session.set({ pendingTargetRequestId: requestId });
+        }
+
+        return {
+            tabId,
+            tabTitle: typeof stored.pendingTargetTabTitle === 'string'
+                ? stored.pendingTargetTabTitle
+                : null,
+            host: typeof stored.pendingTargetHost === 'string'
+                ? stored.pendingTargetHost
+                : null,
+            originPattern,
+            requestId
+        };
     });
 }
 
-function _routeToContentInternal(tabId, action, payload, actionTimestamp, commandSenderId, retries) {
+async function rememberPendingTarget(tabId, tabTitle, error, expectedGeneration) {
+    return mutatePendingTarget(async () => {
+        if (targetActivationGeneration !== expectedGeneration) return null;
+        const previous = await chrome.storage.session.get(PENDING_TARGET_KEYS);
+        const previousTabId = normalizeTabId(previous.pendingTargetTabId);
+        const nextOriginPattern = error?.originPattern || null;
+        if (previousTabId !== null && (
+            previousTabId !== tabId
+            || previous.pendingTargetOriginPattern !== nextOriginPattern
+        )) {
+            await removeTabHostAccessRequest(
+                chrome,
+                previousTabId,
+                previous.pendingTargetOriginPattern || null
+            );
+        }
+        if (targetActivationGeneration !== expectedGeneration) return null;
+        const requestId = previousTabId === tabId
+            && previous.pendingTargetOriginPattern === nextOriginPattern
+            && typeof previous.pendingTargetRequestId === 'string'
+            && previous.pendingTargetRequestId.length > 0
+            ? previous.pendingTargetRequestId
+            : createPendingTargetRequestId();
+        await chrome.storage.session.set({
+            pendingTargetTabId: tabId,
+            pendingTargetTabTitle: typeof tabTitle === 'string' ? tabTitle : null,
+            pendingTargetHost: error?.host || null,
+            pendingTargetOriginPattern: nextOriginPattern,
+            pendingTargetRequestId: requestId
+        });
+        if (targetActivationGeneration !== expectedGeneration) {
+            const current = await chrome.storage.session.get(PENDING_TARGET_KEYS);
+            if (current.pendingTargetRequestId === requestId) {
+                await removeTabHostAccessRequest(chrome, tabId, nextOriginPattern);
+                await chrome.storage.session.set(emptyPendingTargetState());
+            }
+            return null;
+        }
+        return {
+            tabId,
+            tabTitle: typeof tabTitle === 'string' ? tabTitle : null,
+            host: error?.host || null,
+            originPattern: nextOriginPattern,
+            requestId
+        };
+    });
+}
+
+async function clearPendingTarget({ expectedRequestId = null, expectedTabId = null } = {}) {
+    return mutatePendingTarget(async () => {
+        const pending = await chrome.storage.session.get(PENDING_TARGET_KEYS);
+        const pendingTabId = normalizeTabId(pending.pendingTargetTabId);
+        if (expectedRequestId !== null && pending.pendingTargetRequestId !== expectedRequestId) {
+            return false;
+        }
+        if (expectedTabId !== null && pendingTabId !== normalizeTabId(expectedTabId)) {
+            return false;
+        }
+        if (pendingTabId !== null) {
+            await removeTabHostAccessRequest(
+                chrome,
+                pendingTabId,
+                pending.pendingTargetOriginPattern || null
+            );
+        }
+        await chrome.storage.session.set(emptyPendingTargetState());
+        return true;
+    });
+}
+
+async function activateTargetTab(tabId, tabTitle, {
+    requestHostAccess = true,
+    expectedGeneration = null,
+    expectedCurrentTabId = null
+} = {}) {
+    const selectedTabId = normalizeTabId(tabId);
+    if (selectedTabId === null) {
+        return { status: 'invalid_tab' };
+    }
+    if (expectedGeneration !== null && targetActivationGeneration !== expectedGeneration) {
+        return { status: 'superseded' };
+    }
+    if (expectedCurrentTabId !== null
+        && normalizeTabId(currentTabId) !== normalizeTabId(expectedCurrentTabId)) {
+        return { status: 'superseded' };
+    }
+
+    completeForceSyncBeforeTargetChange(selectedTabId);
+    const activationGeneration = ++targetActivationGeneration;
+    activeTargetActivation = { generation: activationGeneration, tabId: selectedTabId };
+    const previousTabId = normalizeTabId(currentTabId);
+
+    try {
+        try {
+            await injectContentScript(selectedTabId, { requestHostAccess });
+        } catch (error) {
+            if (activationGeneration !== targetActivationGeneration) {
+                if (error?.code === HOST_ACCESS_REQUIRED_STATUS
+                    && error.requestAdded === true
+                    && activeTargetActivation?.tabId !== selectedTabId) {
+                    await removeTabHostAccessRequest(
+                        chrome,
+                        selectedTabId,
+                        error.originPattern || null
+                    );
+                }
+                return { status: 'superseded' };
+            }
+            currentTabId = null;
+            currentTabTitle = null;
+            lastContentHeartbeatAt = null;
+            if (currentRoom) roomIdleSince = Date.now();
+            if (previousTabId) {
+                resetAudioProcessingInTab(previousTabId);
+                chrome.tabs.sendMessage(previousTabId, { type: 'CHAT_DESTROY' }).catch(() => {});
+            }
+            await chrome.storage.session.set({
+                currentTabId: null,
+                currentTabTitle: null,
+                roomIdleSince,
+                lastContentHeartbeatAt: null
+            });
+            if (activationGeneration !== targetActivationGeneration) {
+                return { status: 'superseded' };
+            }
+            updateBadgeStatus();
+
+            if (error?.code === HOST_ACCESS_REQUIRED_STATUS) {
+                const pending = await rememberPendingTarget(
+                    selectedTabId,
+                    tabTitle,
+                    error,
+                    activationGeneration
+                );
+                if (!pending || activationGeneration !== targetActivationGeneration) {
+                    return { status: 'superseded' };
+                }
+                chrome.runtime.sendMessage({
+                    type: 'TARGET_TAB_ACCESS_REQUIRED',
+                    requestId: pending.requestId,
+                    ...injectionFailureResponse(error)
+                }).catch(() => {});
+            } else {
+                await clearPendingTarget();
+                if (activationGeneration !== targetActivationGeneration) {
+                    return { status: 'superseded' };
+                }
+            }
+            throw error;
+        }
+
+        if (activationGeneration !== targetActivationGeneration) {
+            if (currentTabId !== selectedTabId) resetAudioProcessingInTab(selectedTabId);
+            return { status: 'superseded' };
+        }
+
+        await applyAudioSettingsToTab(selectedTabId);
+        if (activationGeneration !== targetActivationGeneration) {
+            if (currentTabId !== selectedTabId) resetAudioProcessingInTab(selectedTabId);
+            return { status: 'superseded' };
+        }
+        await removeTabHostAccessRequest(chrome, selectedTabId);
+        if (activationGeneration !== targetActivationGeneration) {
+            if (currentTabId !== selectedTabId) resetAudioProcessingInTab(selectedTabId);
+            return { status: 'superseded' };
+        }
+        await clearPendingTarget();
+        if (activationGeneration !== targetActivationGeneration) {
+            if (currentTabId !== selectedTabId) resetAudioProcessingInTab(selectedTabId);
+            return { status: 'superseded' };
+        }
+        currentTabId = selectedTabId;
+        currentTabTitle = typeof tabTitle === 'string' ? tabTitle : null;
+        lastContentHeartbeatAt = null;
+        if (currentRoom) roomIdleSince = Date.now();
+        if (previousTabId && previousTabId !== selectedTabId) {
+            resetAudioProcessingInTab(previousTabId);
+            chrome.tabs.sendMessage(previousTabId, { type: 'CHAT_DESTROY' }).catch(() => {});
+        }
+        await chrome.storage.session.set({
+            currentTabId,
+            currentTabTitle,
+            roomIdleSince,
+            lastContentHeartbeatAt
+        });
+        if (activationGeneration !== targetActivationGeneration) {
+            return { status: 'superseded' };
+        }
+        updateBadgeStatus();
+        return { status: 'ok', tabId: selectedTabId, generation: activationGeneration };
+    } finally {
+        if (activeTargetActivation?.generation === activationGeneration) {
+            activeTargetActivation = null;
+        }
+    }
+}
+
+async function reactivateCurrentTarget(tabId, { expectedGeneration = targetActivationGeneration } = {}) {
+    const selectedTabId = normalizeTabId(tabId);
+    if (selectedTabId === null || !isCurrentTargetIdentity(selectedTabId, expectedGeneration)) {
+        return { status: 'superseded' };
+    }
+    if (activeTargetActivation && activeTargetActivation.tabId !== selectedTabId) {
+        return { status: 'superseded' };
+    }
+    return activateTargetTab(selectedTabId, currentTabTitle, {
+        expectedGeneration,
+        expectedCurrentTabId: selectedTabId
+    });
+}
+
+async function retryPendingTarget({ expectedRequestId = null, requireGrantedAccess = false } = {}) {
+    let pending = await readPendingTarget();
+    if (!pending || (expectedRequestId !== null && pending.requestId !== expectedRequestId)) {
+        return null;
+    }
+    if (activeTargetActivation && activeTargetActivation.tabId !== pending.tabId) {
+        return { status: 'superseded' };
+    }
+
+    if (requireGrantedAccess) {
+        let access;
+        try {
+            access = await inspectTabHostAccess(chrome, pending.tabId);
+        } catch {
+            await clearPendingTarget({
+                expectedRequestId: pending.requestId,
+                expectedTabId: pending.tabId
+            });
+            return { status: 'invalid_tab' };
+        }
+        if (access.granted !== true || access.originPattern !== pending.originPattern) {
+            return { status: 'permission_not_granted' };
+        }
+        pending = await readPendingTarget();
+        if (!pending || pending.requestId !== expectedRequestId) {
+            return { status: 'superseded' };
+        }
+    }
+
+    try {
+        const expectedGeneration = targetActivationGeneration;
+        const response = await activateTargetTab(pending.tabId, pending.tabTitle, {
+            requestHostAccess: false,
+            expectedGeneration
+        });
+        if (response.status === 'ok') {
+            addLog(`Website access granted; selected tab ${pending.tabId}`, 'success');
+            chrome.runtime.sendMessage({
+                type: 'TARGET_TAB_READY',
+                tabId: pending.tabId,
+                requestId: pending.requestId
+            }).catch(() => {});
+        }
+        return response;
+    } catch (error) {
+        if (error?.code !== HOST_ACCESS_REQUIRED_STATUS) {
+            await clearPendingTarget({
+                expectedRequestId: pending.requestId,
+                expectedTabId: pending.tabId
+            });
+            addLog(`Pending tab activation failed: ${error.message}`, 'warn');
+        }
+        return injectionFailureResponse(error);
+    }
+}
+
+if (chrome.permissions?.onAdded?.addListener) {
+    chrome.permissions.onAdded.addListener((addedPermissions) => {
+        ensureState().then(async () => {
+            const pending = await readPendingTarget();
+            if (!pending) return;
+            const addedOrigins = Array.isArray(addedPermissions?.origins)
+                ? addedPermissions.origins
+                : [];
+            if (!addedOrigins.includes(pending.originPattern) && !addedOrigins.includes('<all_urls>')) {
+                return;
+            }
+            await retryPendingTarget({
+                expectedRequestId: pending.requestId,
+                requireGrantedAccess: true
+            });
+        }).catch(error => addLog(`Website access retry failed: ${error.message}`, 'warn'));
+    });
+}
+
+if (chrome.tabs?.onRemoved?.addListener) {
+    chrome.tabs.onRemoved.addListener((removedTabId) => {
+        ensureState().then(async () => {
+            const tabId = normalizeTabId(removedTabId);
+            if (tabId === null) return;
+            const pending = await readPendingTarget();
+            const isCurrent = normalizeTabId(currentTabId) === tabId;
+            const isPending = pending?.tabId === tabId;
+            const isActivating = activeTargetActivation?.tabId === tabId;
+            if (!isCurrent && !isPending && !isActivating) return;
+
+            const hasReplacementActivation = activeTargetActivation
+                && activeTargetActivation.tabId !== tabId;
+            if (isCurrent) completeForceSyncBeforeTargetChange(null);
+            if (isActivating || (isCurrent && !hasReplacementActivation)) {
+                invalidateTargetActivations();
+            }
+            if (isCurrent) {
+                currentTabId = null;
+                currentTabTitle = null;
+                lastContentHeartbeatAt = null;
+                if (currentRoom) roomIdleSince = Date.now();
+            }
+            if (isPending) {
+                await clearPendingTarget({
+                    expectedRequestId: pending.requestId,
+                    expectedTabId: tabId
+                });
+            }
+            await chrome.storage.session.set({
+                currentTabId,
+                currentTabTitle,
+                roomIdleSince,
+                lastContentHeartbeatAt
+            });
+            updateBadgeStatus();
+            chrome.runtime.sendMessage({ type: 'TARGET_TAB_CLEARED', tabId }).catch(() => {});
+            if (isCurrent) {
+                addLog('Target tab closed.', 'warn');
+                if (currentRoom) {
+                    const roomAtClose = currentRoom;
+                    getSettings().then(settings => {
+                        if (currentRoom !== roomAtClose) return;
+                        emit(EVENTS.PEER_STATUS, {
+                            peerId,
+                            playbackState: 'paused',
+                            currentTime: null,
+                            mediaTitle: null,
+                            username: settings.username,
+                            tabTitle: null
+                        });
+                        const me = currentRoom?.peers?.find(p => (p.peerId || p) === peerId);
+                        if (me && typeof me === 'object') {
+                            me.playbackState = 'paused';
+                            me.currentTime = null;
+                            me.mediaTitle = null;
+                            me.tabTitle = null;
+                            me.lastHeartbeat = Date.now();
+                            if (storageInitialized) {
+                                chrome.storage.session.set({ currentRoom });
+                            }
+                            chrome.runtime.sendMessage({
+                                type: 'PEER_UPDATE',
+                                peers: currentRoom.peers
+                            }).catch(() => {});
+                        }
+                    }).catch(() => {});
+                }
+            }
+        }).catch(error => addLog(`Closed target-tab cleanup failed: ${error.message}`, 'warn'));
+    });
+}
+
+function _routeToContentInternal(tabId, action, payload, actionTimestamp, commandSenderId, retries, targetGeneration) {
+    if (!isCurrentTargetIdentity(tabId, targetGeneration)) return;
     chrome.tabs.sendMessage(tabId, { 
         type: 'SERVER_COMMAND',
         action,
@@ -1882,20 +2421,30 @@ function _routeToContentInternal(tabId, action, payload, actionTimestamp, comman
         actionTimestamp,
         commandSenderId
     }).catch(err => {
+        if (!isCurrentTargetIdentity(tabId, targetGeneration)) return;
         if (retries >= 3) {
             addLog(`Content Script not responding in tab ${tabId} after ${retries} retries`, 'warn');
-            clearTargetTabForIdle();
+            clearTargetTabForIdle(tabId, targetGeneration);
             return;
         }
         if (err.message.includes('Receiving end does not exist') || err.message.includes('Extension context invalidated')) {
-            injectContentScript(tabId).then(() => {
+            reactivateCurrentTarget(tabId, { expectedGeneration: targetGeneration }).then(response => {
-                setTimeout(() => _routeToContentInternal(tabId, action, payload, actionTimestamp, commandSenderId, retries + 1), 500);
+                if (response?.status !== 'ok') return;
+                setTimeout(() => _routeToContentInternal(
+                    tabId,
+                    action,
+                    payload,
+                    actionTimestamp,
+                    commandSenderId,
+                    retries + 1,
+                    response.generation
+                ), 500);
             }).catch(_err => {
                 addLog(`Auto-reinject failed for tab ${tabId}`, 'warn');
             });
         } else {
             addLog(`Content Script not responding in tab ${tabId}`, 'warn');
-            clearTargetTabForIdle();
+            clearTargetTabForIdle(tabId, targetGeneration);
         }
     });
 }
@@ -2058,6 +2607,10 @@ async function handleAsyncMessage(message, sender, sendResponse) {
         connect();
         sendResponse({ status: 'ok' });
     } else if (message.type === 'GET_STATUS') {
+        if (message.retryPendingTarget === true) {
+            await retryPendingTarget();
+        }
+        const pendingTarget = await readPendingTarget();
         const isConnected = socket && socket.readyState === WebSocket.OPEN && isNamespaceJoined;
         const isReconnecting = !isConnected && reconnectAttempts > 0;
         let status = isConnected ? 'connected' : (isConnecting || (socket && socket.readyState === WebSocket.CONNECTING) ? 'connecting' : (isReconnecting ? 'reconnecting' : 'disconnected'));
@@ -2069,6 +2622,10 @@ async function handleAsyncMessage(message, sender, sendResponse) {
             peers: currentRoom ? currentRoom.peers : [],
             lastActionState,
             targetTabId: currentTabId,
+            pendingTargetTabId: pendingTarget?.tabId ?? null,
+            pendingTargetHost: pendingTarget?.host ?? null,
+            pendingTargetOriginPattern: pendingTarget?.originPattern ?? null,
+            pendingTargetRequestId: pendingTarget?.requestId ?? null,
             episodeLobby: episodeLobby,
             reconnectAttempts,
             reconnectSlowMode: reconnectFailed,
@@ -2212,6 +2769,10 @@ async function handleAsyncMessage(message, sender, sendResponse) {
         // "Solo" to the host (stale-badge split-brain).
         sendResponse({ controlMode, hostPeerId, controllers, amHost: amHost(), amController: amController(), desynced: hcmDesynced, hostControlSupported: serverSupports(CAPABILITIES.HOST_CONTROL), coHostSupported: serverSupports(CAPABILITIES.CO_HOST) });
     } else if (message.type === 'REQUEST_HOST_SYNC') {
+        if (sender.tab && normalizeTabId(currentTabId) !== normalizeTabId(sender.tab.id)) {
+            sendResponse({ status: 'ignored_unselected_tab', target: null });
+            return;
+        }
         // content.js resync: hand back the host's extrapolated current position.
         sendResponse({ target: getHostSyncTarget() });
     } else if (message.type === 'GET_HCM_STRINGS') {
@@ -2235,7 +2796,7 @@ async function handleAsyncMessage(message, sender, sendResponse) {
     } else if (message.type === 'HCM_DESYNC_STATE') {
         // content.js tells us whether the local user chose to watch on their own.
         // Only accept from the currently selected tab.
-        if (sender.tab && currentTabId && currentTabId !== sender.tab.id) {
+        if (sender.tab && normalizeTabId(currentTabId) !== normalizeTabId(sender.tab.id)) {
             sendResponse({ status: 'ignored_unselected_tab' });
             return;
         }
@@ -2247,6 +2808,7 @@ async function handleAsyncMessage(message, sender, sendResponse) {
         sendResponse({ status: 'ok' });
     } else if (message.type === 'LEAVE_ROOM') {
         webJoinCoordinator.invalidate();
+        completeForceSyncBeforeTargetChange(null);
         connectIntent = false;
         reconnectFailed = false;
         reconnectAttempts = 0;
@@ -2263,6 +2825,7 @@ async function handleAsyncMessage(message, sender, sendResponse) {
         // stale guest-side HCM state (dialog/badge/desync) — H-2/H-3.
         broadcastControlMode();
         if (currentTabId) chrome.tabs.sendMessage(Number(currentTabId), { type: 'CHAT_DESTROY' }).catch(() => {});
+        invalidateTargetActivations();
         currentTabId = null;
         currentTabTitle = null;
         roomIdleSince = null;
@@ -2277,6 +2840,7 @@ async function handleAsyncMessage(message, sender, sendResponse) {
 
         // Cancel any active episode lobby
         clearEpisodeLobbyState();
+        await clearPendingTarget();
 
         chrome.storage.session.set({ 
             currentRoom: null,
@@ -2432,6 +2996,13 @@ async function handleAsyncMessage(message, sender, sendResponse) {
             sendResponse({ status: 'error', message: err.message });
         });
     } else if (message.type === 'CONTENT_EVENT') {
+        if (!sender?.tab && message.expectedTabId !== undefined) {
+            const expectedTabId = normalizeTabId(message.expectedTabId);
+            if (expectedTabId === null || normalizeTabId(currentTabId) !== expectedTabId) {
+                sendResponse({ status: 'stale_target' });
+                return;
+            }
+        }
         const processEvent = async () => {
             // Host Control Mode (sender-side): a non-controller in host-only mode must
             // not drive the room. Don't broadcast; hand the action back to content.js so
@@ -2575,6 +3146,10 @@ async function handleAsyncMessage(message, sender, sendResponse) {
             });
         }
     } else if (message.type === 'FORCE_SYNC_ACK') {
+        if (sender.tab && normalizeTabId(currentTabId) !== normalizeTabId(sender.tab.id)) {
+            sendResponse({ status: 'ignored_unselected_tab' });
+            return;
+        }
         if (isForceSyncInitiator) {
             forceSyncAcks.add(peerId);
             chrome.storage.session.set({ forceSyncAcks: Array.from(forceSyncAcks) });
@@ -2599,6 +3174,10 @@ async function handleAsyncMessage(message, sender, sendResponse) {
         }
         sendResponse({ status: 'ok' });
     } else if (message.type === 'CMD_ACK') {
+        if (sender.tab && normalizeTabId(currentTabId) !== normalizeTabId(sender.tab.id)) {
+            sendResponse({ status: 'ignored_unselected_tab' });
+            return;
+        }
         const commandSenderId = message.commandSenderId;
         // Only ACK if the command sender is still a known peer in our room.
         // If we've already seen their PEER_STATUS 'left', skip the ACK — it would
@@ -2662,45 +3241,67 @@ async function handleAsyncMessage(message, sender, sendResponse) {
             sendResponse({ status: 'ok' });
         });
     } else if (message.type === 'INJECT_CONTENT_SCRIPT') {
-        const tabId = Number(message.tabId);
+        const tabId = normalizeTabId(message.tabId);
-        if (!Number.isInteger(tabId)) {
+        if (tabId === null) {
             sendResponse({ status: 'invalid_tab' });
             return true;
         }
 
-        injectContentScript(tabId).then(() => {
+        const expectedCurrentTabId = normalizeTabId(message.expectedCurrentTabId);
-            sendResponse({ status: 'ok' });
+        if (expectedCurrentTabId === null
+            || tabId !== expectedCurrentTabId
+            || normalizeTabId(currentTabId) !== expectedCurrentTabId) {
+            sendResponse({ status: 'stale_target' });
+            return true;
+        }
+
+        reactivateCurrentTarget(tabId, {
+            expectedGeneration: targetActivationGeneration
+        }).then(response => {
+            sendResponse(response);
         }).catch(err => {
             addLog(`Failed to inject into tab: ${err.message}`, 'warn');
-            sendResponse({ status: 'error', message: err.message });
+            sendResponse(injectionFailureResponse(err));
         });
         return true;
     } else if (message.type === 'SET_TARGET_TAB') {
-        const previousTabId = currentTabId;
+        if (message.tabId === null || message.tabId === undefined || message.tabId === '') {
-        currentTabId = message.tabId;
+            const previousTabId = currentTabId;
-        currentTabTitle = message.tabTitle;
+            completeForceSyncBeforeTargetChange(null);
-        lastContentHeartbeatAt = null;
+            invalidateTargetActivations();
-        if (currentRoom) {
+            currentTabId = null;
-            roomIdleSince = Date.now();
+            currentTabTitle = null;
+            lastContentHeartbeatAt = null;
+            if (currentRoom) roomIdleSince = Date.now();
+            if (previousTabId) {
+                resetAudioProcessingInTab(previousTabId);
+                chrome.tabs.sendMessage(Number(previousTabId), { type: 'CHAT_DESTROY' }).catch(() => {});
+            }
+            await clearPendingTarget();
+            await chrome.storage.session.set({
+                currentTabId: null,
+                currentTabTitle: null,
+                roomIdleSince,
+                lastContentHeartbeatAt: null
+            });
+            updateBadgeStatus();
+            sendResponse({ status: 'ok', tabId: null });
+            return;
         }
-        chrome.storage.session.set({ currentTabId, currentTabTitle, roomIdleSince, lastContentHeartbeatAt });
-        updateBadgeStatus();
 
-        if (previousTabId && previousTabId !== currentTabId) {
+        try {
-            resetAudioProcessingInTab(previousTabId);
+            const response = await activateTargetTab(message.tabId, message.tabTitle);
-            chrome.tabs.sendMessage(Number(previousTabId), { type: 'CHAT_DESTROY' }).catch(() => {});
+            if (response?.status === 'ok') {
+                chrome.runtime.sendMessage({
+                    type: 'TARGET_TAB_READY',
+                    tabId: response.tabId
+                }).catch(() => {});
+            }
+            sendResponse(response);
+        } catch (error) {
+            addLog(`Failed to select tab: ${error.message}`, 'warn');
+            sendResponse(injectionFailureResponse(error));
         }
-        
-        if (currentTabId) {
-            const selectedTabId = currentTabId;
-            injectContentScript(selectedTabId)
-                .then(() => applyAudioSettingsToTab(selectedTabId))
-                .catch(err => {
-                    addLog(`Failed to inject into tab: ${err.message}`, 'warn');
-                });
-        }
-        
-        sendResponse({ status: 'ok' });
     } else if (message.type === 'LOG') {
         addLog(`[Content] ${message.message}`, message.level || 'info');
         sendResponse({ status: 'ok' });
@@ -2883,21 +3484,8 @@ async function handleAsyncMessage(message, sender, sendResponse) {
 
 initTabManager({
     getCurrentTabId: () => currentTabId,
-    setCurrentTabId: (val) => { currentTabId = val; },
+    reactivateCurrentTarget,
-    setCurrentTabTitle: (val) => { currentTabTitle = val; },
+    ensureState
-    setLastContentHeartbeatAt: (val) => { lastContentHeartbeatAt = val; },
-    setRoomIdleSince: (val) => { roomIdleSince = val; },
-    getCurrentRoom: () => currentRoom,
-    getPeerId: () => peerId,
-    getStorageInitialized: () => storageInitialized,
-    updateBadgeStatus,
-    addLog,
-    getSettings,
-    emit,
-    applyAudioSettingsToTab,
-    injectContentScript,
-    ensureState,
-    EVENTS
 });
 
 // Initial Connect — only if user has an active room configuration

extension/chat-overlay-contract.test.mjs

@@ -1,8 +1,9 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { describe, expect, it } from 'vitest';
 
-const extensionDir = path.dirname(new URL(import.meta.url).pathname);
+const extensionDir = path.dirname(fileURLToPath(import.meta.url));
 const overlaySource = fs.readFileSync(path.join(extensionDir, 'chat-overlay.js'), 'utf8');
 const backgroundSource = fs.readFileSync(path.join(extensionDir, 'background.js'), 'utf8');
 const popupSource = fs.readFileSync(path.join(extensionDir, 'popup.js'), 'utf8');

extension/host-access.js

@@ -0,0 +1,194 @@
+export const HOST_ACCESS_REQUIRED_STATUS = 'host_permission_required';
+
+export function normalizeTabId(value) {
+    if (typeof value === 'number') {
+        return Number.isSafeInteger(value) && value > 0 ? value : null;
+    }
+    if (typeof value !== 'string') return null;
+
+    const normalized = value.trim();
+    if (!/^[1-9]\d*$/.test(normalized)) return null;
+    const tabId = Number(normalized);
+    return Number.isSafeInteger(tabId) ? tabId : null;
+}
+
+function browserSupportsPortMatchPatterns(chromeApi) {
+    // runtime.getBrowserInfo is a Firefox-only WebExtension API. Firefox does
+    // not accept ports in match patterns, while Chromium does.
+    return typeof chromeApi?.runtime?.getBrowserInfo !== 'function';
+}
+
+export function describeTabUrl(rawUrl, { includePort = true } = {}) {
+    if (typeof rawUrl !== 'string' || !rawUrl) return null;
+
+    try {
+        const url = new URL(rawUrl);
+        if (url.protocol === 'http:' || url.protocol === 'https:') {
+            const permissionHost = includePort ? url.host : url.hostname;
+            return {
+                url: rawUrl,
+                host: url.host,
+                originPattern: `${url.protocol}//${permissionHost}/*`
+            };
+        }
+        if (url.protocol === 'file:') {
+            return {
+                url: rawUrl,
+                host: 'local file',
+                originPattern: 'file:///*'
+            };
+        }
+    } catch (_e) {
+        // Invalid and browser-internal URLs cannot receive host access.
+    }
+
+    return null;
+}
+
+export async function inspectTabHostAccess(chromeApi, tabId) {
+    const tab = await chromeApi.tabs.get(tabId);
+    // executeScript targets the committed document. pendingUrl may already point
+    // at another origin while tab.url is still the document being injected into.
+    const descriptor = describeTabUrl(tab?.url || tab?.pendingUrl || '', {
+        includePort: browserSupportsPortMatchPatterns(chromeApi)
+    });
+    if (!descriptor) {
+        return {
+            tab,
+            url: tab?.url || '',
+            host: null,
+            originPattern: null,
+            granted: null
+        };
+    }
+
+    if (typeof chromeApi.permissions?.contains !== 'function') {
+        return { tab, ...descriptor, granted: null };
+    }
+
+    try {
+        const granted = await callBooleanPermissionMethod(
+            chromeApi,
+            'contains',
+            { origins: [descriptor.originPattern] },
+            { timeoutMs: 1000 }
+        );
+        return {
+            tab,
+            ...descriptor,
+            granted: granted === null ? null : granted === true
+        };
+    } catch (_e) {
+        // Permission inspection is advisory. The actual script injection below
+        // remains the source of truth, including temporary activeTab access.
+        return { tab, ...descriptor, granted: null };
+    }
+}
+
+function callBooleanPermissionMethod(chromeApi, methodName, request, { timeoutMs = null } = {}) {
+    const method = chromeApi.permissions?.[methodName];
+    if (typeof method !== 'function') return Promise.resolve(null);
+
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let timeout = null;
+        const clearSettlementTimeout = () => {
+            if (timeout !== null) {
+                clearTimeout(timeout);
+                timeout = null;
+            }
+        };
+        const finish = (value) => {
+            if (settled) return;
+            settled = true;
+            clearSettlementTimeout();
+            resolve(value === true ? true : value === false ? false : null);
+        };
+        const fail = (error) => {
+            if (settled) return;
+            settled = true;
+            clearSettlementTimeout();
+            reject(error instanceof Error ? error : new Error(String(error || 'Permission request failed')));
+        };
+        const callback = (value) => {
+            const lastError = chromeApi.runtime?.lastError;
+            if (lastError) {
+                fail(new Error(lastError.message || String(lastError)));
+                return;
+            }
+            finish(value);
+        };
+
+        if (Number.isFinite(timeoutMs) && timeoutMs > 0) {
+            timeout = setTimeout(() => finish(null), timeoutMs);
+        }
+
+        try {
+            const result = method.call(chromeApi.permissions, request, callback);
+            if (result && typeof result.then === 'function') {
+                result.then(finish, fail);
+            } else if (typeof result === 'boolean') {
+                finish(result);
+            }
+            // Callback-based Chromium/Firefox APIs return undefined and settle
+            // through callback. Promise-based implementations settle above.
+        } catch (error) {
+            fail(error);
+        }
+    });
+}
+
+export function requestOriginPermission(chromeApi, originPattern) {
+    if (typeof originPattern !== 'string' || !originPattern) {
+        return Promise.resolve(null);
+    }
+    return callBooleanPermissionMethod(
+        chromeApi,
+        'request',
+        { origins: [originPattern] },
+        { timeoutMs: 60000 }
+    ).catch(() => false);
+}
+
+export function isHostAccessError(error) {
+    const message = typeof error?.message === 'string' ? error.message : String(error || '');
+    return /host permission|permission to access (?:this|the|respective) host|cannot access contents of/i.test(message);
+}
+
+function hostAccessRequestDetails(tabId, originPattern) {
+    const request = { tabId };
+    if (typeof originPattern === 'string' && originPattern) {
+        request.pattern = originPattern;
+    }
+    return request;
+}
+
+export async function addTabHostAccessRequest(chromeApi, tabId, originPattern = null) {
+    if (typeof chromeApi.permissions?.addHostAccessRequest !== 'function') {
+        return false;
+    }
+
+    try {
+        await chromeApi.permissions.addHostAccessRequest(
+            hostAccessRequestDetails(tabId, originPattern)
+        );
+        return true;
+    } catch (_e) {
+        return false;
+    }
+}
+
+export async function removeTabHostAccessRequest(chromeApi, tabId, originPattern = null) {
+    if (typeof chromeApi.permissions?.removeHostAccessRequest !== 'function') {
+        return false;
+    }
+
+    try {
+        await chromeApi.permissions.removeHostAccessRequest(
+            hostAccessRequestDetails(tabId, originPattern)
+        );
+        return true;
+    } catch (_e) {
+        return false;
+    }
+}

extension/locales/de.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identität noch nicht geladen. Warte kurz und versuche es erneut.",
   "ERR_NO_PEERS_TIME": "Keine anderen Teilnehmer mit bekannter Zeit. Wechsle zu 'Zu mir springen'.",
   "ERR_NO_VIDEO_TAB": "Verbindung zum Video-Tab fehlgeschlagen.",
+  "SITE_ACCESS_REQUIRED": "Dein Browser blockiert KoalaSync auf {host}. Klicke unten auf „Zugriff erlauben“. Falls kein Dialog erscheint, erlaube KoalaSync in den Erweiterungs- oder Websiteberechtigungen für diese Seite.",
+  "BTN_RETRY_ACCESS": "Zugriff erlauben",
   "ERR_SELECT_VIDEO": "Bitte wähle zuerst ein Video aus!",
   "TOAST_INVITE_COPIED": "Einladungslink kopiert!",
   "TOAST_COPY_FAILED": "Kopieren in Zwischenablage fehlgeschlagen",

extension/locales/en.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identity not yet loaded. Wait a moment and try again.",
   "ERR_NO_PEERS_TIME": "No other peers with a known time. Switch to 'Jump to Me'.",
   "ERR_NO_VIDEO_TAB": "Could not connect to video tab.",
+  "SITE_ACCESS_REQUIRED": "Your browser is blocking KoalaSync on {host}. Click \"Allow access\" below. If no dialog appears, allow KoalaSync on this site in your extension or site permissions.",
+  "BTN_RETRY_ACCESS": "Allow access",
   "ERR_SELECT_VIDEO": "Please select a video first!",
   "TOAST_INVITE_COPIED": "Invite link copied!",
   "TOAST_COPY_FAILED": "Failed to copy to clipboard",

extension/locales/es.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identidad no cargada aún. Espera un momento e inténtalo de nuevo.",
   "ERR_NO_PEERS_TIME": "No hay otros participantes con posición conocida. Cambia a 'Traerlos a mi posición'.",
   "ERR_NO_VIDEO_TAB": "No se pudo conectar a la pestaña de video.",
+  "SITE_ACCESS_REQUIRED": "Tu navegador está bloqueando KoalaSync en {host}. Haz clic en «Permitir acceso». Si no aparece ningún diálogo, permite KoalaSync en este sitio desde los permisos de extensiones o del sitio.",
+  "BTN_RETRY_ACCESS": "Permitir acceso",
   "ERR_SELECT_VIDEO": "¡Selecciona un video primero!",
   "TOAST_INVITE_COPIED": "¡Enlace de invitación copiado!",
   "TOAST_COPY_FAILED": "Error al copiar al portapapeles",

extension/locales/fr.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identifiant non encore chargé. Veuillez patienter et réessayer.",
   "ERR_NO_PEERS_TIME": "Aucun autre membre avec une position connue. Basculez sur 'Les amener à moi'.",
   "ERR_NO_VIDEO_TAB": "Impossible de se connecter à l'onglet vidéo.",
+  "SITE_ACCESS_REQUIRED": "Votre navigateur bloque KoalaSync sur {host}. Cliquez sur « Autoriser l’accès ». Si aucune boîte de dialogue n’apparaît, autorisez KoalaSync sur ce site dans les permissions des extensions ou du site.",
+  "BTN_RETRY_ACCESS": "Autoriser l’accès",
   "ERR_SELECT_VIDEO": "Veuillez d'abord sélectionner une vidéo !",
   "TOAST_INVITE_COPIED": "Lien d'invitation copié !",
   "TOAST_COPY_FAILED": "Échec de la copie dans le presse-papiers",

extension/locales/it.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identità non ancora caricata. Attendi un momento.",
   "ERR_NO_PEERS_TIME": "Nessun altro partecipante con posizione nota. Passa a 'Portali alla mia posizione'.",
   "ERR_NO_VIDEO_TAB": "Impossibile connettersi alla scheda del video.",
+  "SITE_ACCESS_REQUIRED": "Il browser sta bloccando KoalaSync su {host}. Fai clic su «Consenti accesso». Se non appare alcuna finestra, consenti KoalaSync su questo sito nelle autorizzazioni dell’estensione o del sito.",
+  "BTN_RETRY_ACCESS": "Consenti accesso",
   "ERR_SELECT_VIDEO": "Seleziona prima un video!",
   "TOAST_INVITE_COPIED": "Link di invito copiato!",
   "TOAST_COPY_FAILED": "Impossibile copiare negli appunti",

extension/locales/ja.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "IDがまだロードされていません。しばらく待ってから再試行してください。",
   "ERR_NO_PEERS_TIME": "既知の時間を持つ他のメンバーがいません。「自分に合わせる」に切り替えてください。",
   "ERR_NO_VIDEO_TAB": "ビデオタブに接続できませんでした。",
+  "SITE_ACCESS_REQUIRED": "ブラウザーが {host} で KoalaSync をブロックしています。下の「アクセスを許可」をクリックしてください。ダイアログが表示されない場合は、拡張機能またはサイトの権限でこのサイトの KoalaSync を許可してください。",
+  "BTN_RETRY_ACCESS": "アクセスを許可",
   "ERR_SELECT_VIDEO": "最初にビデオを選択してください！",
   "TOAST_INVITE_COPIED": "招待リンクをコピーしました！",
   "TOAST_COPY_FAILED": "クリップボードへのコピーに失敗しました",

extension/locales/ko.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "ID가 아직 로드되지 않았습니다. 잠시 후 다시 시도해 주세요.",
   "ERR_NO_PEERS_TIME": "시간을 알고 있는 다른 피어가 없습니다. '나에게 이동'으로 전환하세요.",
   "ERR_NO_VIDEO_TAB": "비디오 탭에 연결할 수 없습니다.",
+  "SITE_ACCESS_REQUIRED": "브라우저가 {host}에서 KoalaSync를 차단하고 있습니다. 아래의 ‘액세스 허용’을 클릭하세요. 대화상자가 표시되지 않으면 확장 프로그램 또는 사이트 권한에서 이 사이트의 KoalaSync를 허용하세요.",
+  "BTN_RETRY_ACCESS": "액세스 허용",
   "ERR_SELECT_VIDEO": "먼저 비디오를 선택하세요!",
   "TOAST_INVITE_COPIED": "초대 링크가 복사되었습니다!",
   "TOAST_COPY_FAILED": "클립보드 복사에 실패했습니다",

extension/locales/nl.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identiteit nog niet geladen. Wacht een moment en probeer het opnieuw.",
   "ERR_NO_PEERS_TIME": "Geen andere deelnemers met een bekende tijd. Schakel over naar 'Spring naar mij'.",
   "ERR_NO_VIDEO_TAB": "Kon geen verbinding maken met videotabblad.",
+  "SITE_ACCESS_REQUIRED": "Je browser blokkeert KoalaSync op {host}. Klik hieronder op ‘Toegang toestaan’. Als er geen dialoog verschijnt, sta KoalaSync voor deze site toe via de extensie- of siterechten.",
+  "BTN_RETRY_ACCESS": "Toegang toestaan",
   "ERR_SELECT_VIDEO": "Selecteer eerst een video!",
   "TOAST_INVITE_COPIED": "Uitnodigingslink gekopieerd!",
   "TOAST_COPY_FAILED": "Kopiëren naar klembord mislukt",

extension/locales/pl.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Tożsamość nie została jeszcze załadowana. Odczekaj chwilę i spróbuj ponownie.",
   "ERR_NO_PEERS_TIME": "Brak innych uczestników ze znanym czasem. Przełącz na 'Skocz do mnie'.",
   "ERR_NO_VIDEO_TAB": "Nie można połączyć się z kartą wideo.",
+  "SITE_ACCESS_REQUIRED": "Przeglądarka blokuje KoalaSync na {host}. Kliknij poniżej „Zezwól na dostęp”. Jeśli nie pojawi się okno, zezwól KoalaSync na tej stronie w uprawnieniach rozszerzenia lub witryny.",
+  "BTN_RETRY_ACCESS": "Zezwól na dostęp",
   "ERR_SELECT_VIDEO": "Najpierw wybierz wideo!",
   "TOAST_INVITE_COPIED": "Link zaproszenia skopiowany!",
   "TOAST_COPY_FAILED": "Nie udało się skopiować do schowka",

extension/locales/pt-BR.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identidade não carregada ainda. Aguarde um momento.",
   "ERR_NO_PEERS_TIME": "Nenhum participante com posição conhecida. Mude para 'Trazer para a minha posição'.",
   "ERR_NO_VIDEO_TAB": "Não foi possível conectar à aba do vídeo.",
+  "SITE_ACCESS_REQUIRED": "Seu navegador está bloqueando o KoalaSync em {host}. Clique em «Permitir acesso» abaixo. Se nenhuma caixa de diálogo aparecer, permita o KoalaSync neste site nas permissões da extensão ou do site.",
+  "BTN_RETRY_ACCESS": "Permitir acesso",
   "ERR_SELECT_VIDEO": "Selecione um vídeo primeiro!",
   "TOAST_INVITE_COPIED": "Link de convite copiado!",
   "TOAST_COPY_FAILED": "Falha ao copiar para a área de transferência",

extension/locales/pt.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identidade ainda não carregada. Aguarde um momento.",
   "ERR_NO_PEERS_TIME": "Nenhum participante com hora conhecida. Mude para 'Trazer para a minha posição'.",
   "ERR_NO_VIDEO_TAB": "Não foi possível aceder ao separador do vídeo.",
+  "SITE_ACCESS_REQUIRED": "O seu navegador está a bloquear o KoalaSync em {host}. Clique em «Permitir acesso» abaixo. Se não aparecer uma caixa de diálogo, permita o KoalaSync neste site nas permissões da extensão ou do site.",
+  "BTN_RETRY_ACCESS": "Permitir acesso",
   "ERR_SELECT_VIDEO": "Selecione primeiro um vídeo!",
   "TOAST_INVITE_COPIED": "Link de convite copiado!",
   "TOAST_COPY_FAILED": "Falha ao copiar para a área de transferência",

extension/locales/ru.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Идентификатор еще не загружен. Подождите немного и повторите попытку.",
   "ERR_NO_PEERS_TIME": "Нет других участников с известной позицией плеера. Выберите 'Синхронизировать по мне'.",
   "ERR_NO_VIDEO_TAB": "Не удалось подключиться к вкладке с видео.",
+  "SITE_ACCESS_REQUIRED": "Браузер блокирует KoalaSync на {host}. Нажмите «Разрешить доступ» ниже. Если диалог не появится, разрешите KoalaSync для этого сайта в настройках расширения или разрешениях сайта.",
+  "BTN_RETRY_ACCESS": "Разрешить доступ",
   "ERR_SELECT_VIDEO": "Пожалуйста, сначала выберите вкладку с видео!",
   "TOAST_INVITE_COPIED": "Ссылка скопирована в буфер обмена!",
   "TOAST_COPY_FAILED": "Не удалось скопировать ссылку в буфер обмена",

extension/locales/tr.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Kimlik henüz yüklenmedi. Biraz bekleyin ve tekrar deneyin.",
   "ERR_NO_PEERS_TIME": "Bilinen bir zamanı olan başka bağlantı yok. 'Bana Atla' seçeneğine geçin.",
   "ERR_NO_VIDEO_TAB": "Video sekmesine bağlanılamadı.",
+  "SITE_ACCESS_REQUIRED": "Tarayıcınız {host} üzerinde KoalaSync'i engelliyor. Aşağıdaki “Erişime izin ver” düğmesine tıklayın. İletişim kutusu görünmezse uzantı veya site izinlerinden bu site için KoalaSync'e izin verin.",
+  "BTN_RETRY_ACCESS": "Erişime izin ver",
   "ERR_SELECT_VIDEO": "Lütfen önce bir video seçin!",
   "TOAST_INVITE_COPIED": "Davet bağlantısı kopyalandı!",
   "TOAST_COPY_FAILED": "Panoya kopyalanamadı",

extension/locales/uk.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Посвідчення особи ще не завантажено. Зачекайте хвилинку та повторіть спробу.",
   "ERR_NO_PEERS_TIME": "Немає інших аналогів із відомим часом. Переключіться на «Перейти до мене».",
   "ERR_NO_VIDEO_TAB": "Не вдалося підключитися до вкладки відео.",
+  "SITE_ACCESS_REQUIRED": "Браузер блокує KoalaSync на {host}. Натисніть «Дозволити доступ» нижче. Якщо діалог не з’явиться, дозвольте KoalaSync для цього сайту в налаштуваннях розширення або дозволах сайту.",
+  "BTN_RETRY_ACCESS": "Дозволити доступ",
   "ERR_SELECT_VIDEO": "Спочатку виберіть відео!",
   "TOAST_INVITE_COPIED": "Посилання на запрошення скопійовано!",
   "TOAST_COPY_FAILED": "Не вдалося скопіювати в буфер обміну",

extension/locales/zh.json

@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "身份尚未加载。稍等片刻，然后重试。",
   "ERR_NO_PEERS_TIME": "没有其他已知时间的同行。切换到“跳到我这里”。",
   "ERR_NO_VIDEO_TAB": "无法连接到视频选项卡。",
+  "SITE_ACCESS_REQUIRED": "浏览器正在阻止 KoalaSync 访问 {host}。请点击下方的“允许访问”。如果未显示对话框，请在扩展程序或网站权限中允许 KoalaSync 访问此网站。",
+  "BTN_RETRY_ACCESS": "允许访问",
   "ERR_SELECT_VIDEO": "请先选择视频！",
   "TOAST_INVITE_COPIED": "邀请链接已复制！",
   "TOAST_COPY_FAILED": "无法复制到剪贴板",

extension/manifest.base.json

@@ -1,9 +1,10 @@
 {
   "manifest_version": 3,
   "default_locale": "en",
-  "name": "KoalaSync",
+  "name": "__MSG_appName__",
-  "version": "2.6.1",
+  "short_name": "KoalaSync",
-  "description": "Synchronize video playback on YouTube, Netflix, Emby, Jellyfin, and any HTML5 site in real-time with friends.",
+  "version": "2.6.4",
+  "description": "__MSG_appDesc__",
   "permissions": [
     "storage",
     "tabs",

extension/modules/tab-manager.js

@@ -1,20 +1,7 @@
 export function initTabManager({
     getCurrentTabId,
-    setCurrentTabId,
+    reactivateCurrentTarget,
-    setCurrentTabTitle,
+    ensureState
-    setLastContentHeartbeatAt,
-    setRoomIdleSince,
-    getCurrentRoom,
-    getPeerId,
-    getStorageInitialized,
-    updateBadgeStatus,
-    addLog,
-    getSettings,
-    emit,
-    applyAudioSettingsToTab,
-    injectContentScript,
-    ensureState,
-    EVENTS
 }) {
     chrome.storage.onChanged.addListener(async (changes, area) => {
         if (area !== 'local' || !changes.audioSettings) return;
@@ -28,65 +15,14 @@ export function initTabManager({
         }).catch(() => {});
     });
 
-    chrome.tabs.onRemoved.addListener(async (tabId) => {
-        await ensureState();
-        if (tabId === getCurrentTabId()) {
-            const wasInRoom = !!getCurrentRoom();
-            setCurrentTabId(null);
-            setCurrentTabTitle(null);
-            setLastContentHeartbeatAt(null);
-            const now = Date.now();
-            setRoomIdleSince(now);
-            chrome.storage.session.set({
-                currentTabId: null,
-                currentTabTitle: null,
-                roomIdleSince: now,
-                lastContentHeartbeatAt: null
-            });
-            updateBadgeStatus();
-            addLog('Target tab closed.', 'warn');
-
-            if (wasInRoom) {
-                const roomAtClose = getCurrentRoom();
-                getSettings().then(settings => {
-                    if (getCurrentRoom() !== roomAtClose) return;
-
-                    emit(EVENTS.PEER_STATUS, {
-                        peerId: getPeerId(),
-                        playbackState: 'paused',
-                        currentTime: null,
-                        mediaTitle: null,
-                        username: settings.username,
-                        tabTitle: null
-                    });
-
-                    const room = getCurrentRoom();
-                    if (room && Array.isArray(room.peers)) {
-                        const me = room.peers.find(p => (p.peerId || p) === getPeerId());
-                        if (me && typeof me === 'object') {
-                            me.playbackState = 'paused';
-                            me.currentTime = null;
-                            me.mediaTitle = null;
-                            me.tabTitle = null;
-                            me.lastHeartbeat = Date.now();
-                            if (getStorageInitialized()) {
-                                chrome.storage.session.set({ currentRoom: room });
-                            }
-                            chrome.runtime.sendMessage({ type: 'PEER_UPDATE', peers: room.peers }).catch(() => {});
-                        }
-                    }
-                }).catch(() => {});
-            }
-        }
-    });
-
     chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, _tab) => {
         await ensureState();
-        const curTabId = getCurrentTabId();
+        const currentTabId = Number(getCurrentTabId());
-        if (curTabId && tabId === parseInt(curTabId) && changeInfo.status === 'complete') {
+        if (Number.isInteger(currentTabId)
-            injectContentScript(tabId)
+            && currentTabId > 0
-                .then(() => applyAudioSettingsToTab(tabId))
+            && tabId === currentTabId
-                .catch(() => {});
+            && changeInfo.status === 'complete') {
+            reactivateCurrentTarget(tabId).catch(() => {});
         }
     });
 }

extension/popup.html

@@ -453,6 +453,24 @@
             box-shadow: 0 8px 22px rgba(0, 0, 0, 0.08);
         }
 
+        .site-access-notice {
+            display: none;
+            margin-top: 8px;
+            margin-bottom: 0;
+            border-left: 4px solid var(--warning);
+            background: color-mix(in oklch, var(--warning), var(--card) 90%);
+            color: var(--text);
+            font-size: 11px;
+            line-height: 1.45;
+        }
+
+        .site-access-notice button {
+            width: auto;
+            margin-top: 8px;
+            padding: 6px 10px;
+            font-size: 11px;
+        }
+
         .peer-item {
             padding: 10px 0;
             border-bottom: 1px solid var(--border-strong);
@@ -1432,6 +1450,10 @@
                 Select your video here!
                 <div style="position: absolute; bottom: -4px; right: 20px; width: 8px; height: 8px; background: var(--accent); transform: rotate(45deg);"></div>
             </div>
+            <div id="siteAccessNotice" class="info-card site-access-notice" role="alert" aria-live="polite">
+                <div id="siteAccessMessage"></div>
+                <button id="siteAccessRetry" class="secondary" data-i18n="BTN_RETRY_ACCESS">Try again</button>
+            </div>
         </div>
         
         <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 4px;">

extension/popup.js

@@ -5,6 +5,7 @@ import { loadLocale, translateDOM, getMessage, getSystemLanguage } from './i18n.
 import { TITLE_PRIVACY_MODES, normalizeSendTabTitle, normalizeTabTitle } from './title-privacy.js';
 import { normalizeRoomId } from './chat-session.js';
 import './shared/invite-links.js';
+import { normalizeTabId, requestOriginPermission } from './host-access.js';
 
 let pendingInviteRoomId = '';
 let pendingInviteChatKey = '';
@@ -19,6 +20,9 @@ const elements = {
     contents: document.querySelectorAll('.tab-content'),
     copyInvite: document.getElementById('copyInvite'),
     targetTab: document.getElementById('targetTab'),
+    siteAccessNotice: document.getElementById('siteAccessNotice'),
+    siteAccessMessage: document.getElementById('siteAccessMessage'),
+    siteAccessRetry: document.getElementById('siteAccessRetry'),
     forceSyncBtn: document.getElementById('forceSyncBtn'),
     forceSyncMode: document.getElementById('forceSyncMode'),
     peerList: document.getElementById('peerList'),
@@ -396,7 +400,7 @@ async function init() {
     // Initial Status Check (status shows via GET_STATUS below)
 
     // Initial Status Check
-    chrome.runtime.sendMessage({ type: 'GET_STATUS' }, async (res) => {
+    chrome.runtime.sendMessage({ type: 'GET_STATUS', retryPendingTarget: true }, async (res) => {
         if (chrome.runtime.lastError) {
             console.warn('[Popup] Background not responding:', chrome.runtime.lastError.message);
             await populateTabs();
@@ -419,13 +423,24 @@ async function init() {
                 applyConnectionStatus('connecting');
             }
             
-            // Populate Tabs using the background's targetTabId
+            if (res.pendingTargetTabId) {
-            await populateTabs(res.peers, res.targetTabId);
+                showSiteAccessNotice(
+                    res.pendingTargetHost,
+                    res.pendingTargetOriginPattern,
+                    res.pendingTargetTabId
+                );
+            } else {
+                hideSiteAccessNotice();
+            }
+
+            // Keep a denied selection visible while Chrome waits for the user
+            // to grant access; it becomes active automatically after approval.
+            await populateTabs(res.peers, res.targetTabId || res.pendingTargetTabId);
 
             // Render lobby status if active
             if (res.episodeLobby) updateLobbyUI(res.episodeLobby, res.peers);
 
-            if (res.status === 'connected' && !res.targetTabId && localData.roomId) {
+            if (res.status === 'connected' && !res.targetTabId && !res.pendingTargetTabId && localData.roomId) {
                 const syncTabBtn = document.querySelector('.tab-btn[data-tab="tab-sync"]');
                 if (syncTabBtn) syncTabBtn.click();
                 showSelectVideoHint();
@@ -472,6 +487,10 @@ function toggleUIState(inRoom) {
 // --- Host Control Mode UI ---
 // True when we're a guest in a host-only room → remote-control buttons are locked.
 let hcmGuestLocked = false;
+let siteAccessBlocked = false;
+let siteAccessHost = null;
+let siteAccessOriginPattern = null;
+let siteAccessTabId = null;
 
 // Co-Host state mirrored for the peer-list renderer (promote/demote + role badges).
 let hcmAmOwner = false;
@@ -533,12 +552,15 @@ function updateHostControlUI(state) {
 }
 
 function setRemoteControlsLocked(locked) {
+    const effectiveLocked = locked || siteAccessBlocked;
     [elements.playBtn, elements.pauseBtn, elements.forceSyncBtn].forEach(btn => {
         if (!btn) return;
-        btn.disabled = locked;
+        btn.disabled = effectiveLocked;
-        btn.style.opacity = locked ? '0.5' : '';
+        btn.style.opacity = effectiveLocked ? '0.5' : '';
-        btn.style.cursor = locked ? 'not-allowed' : '';
+        btn.style.cursor = effectiveLocked ? 'not-allowed' : '';
-        btn.title = locked ? (getMessage('NOTICE_HOST_CONTROLS') || 'The host controls playback for everyone.') : '';
+        btn.title = siteAccessBlocked
+            ? (elements.siteAccessMessage?.textContent || getMessage('ERR_NO_VIDEO_TAB'))
+            : (locked ? (getMessage('NOTICE_HOST_CONTROLS') || 'The host controls playback for everyone.') : '');
     });
     // Always restore the default labels. The action handlers leave the text in a
     // transitional state ("Playing..." / "Pausing...") and the 2.5s safety reset
@@ -549,6 +571,88 @@ function setRemoteControlsLocked(locked) {
     if (elements.pauseBtn) elements.pauseBtn.textContent = getMessage('BTN_PAUSE') || 'Pause';
 }
 
+function showSiteAccessNotice(host, originPattern = null, tabId = null) {
+    siteAccessBlocked = true;
+    siteAccessHost = typeof host === 'string' && host.length > 0 ? host : 'website';
+    siteAccessOriginPattern = typeof originPattern === 'string' && originPattern.length > 0
+        ? originPattern
+        : null;
+    siteAccessTabId = normalizeTabId(tabId);
+    if (elements.siteAccessMessage) {
+        elements.siteAccessMessage.textContent = getMessage('SITE_ACCESS_REQUIRED', {
+            host: siteAccessHost
+        });
+    }
+    if (elements.siteAccessRetry) {
+        elements.siteAccessRetry.disabled = !siteAccessOriginPattern || siteAccessTabId === null;
+    }
+    if (elements.siteAccessNotice) elements.siteAccessNotice.style.display = 'block';
+    setRemoteControlsLocked(hcmGuestLocked);
+}
+
+function hideSiteAccessNotice() {
+    siteAccessBlocked = false;
+    siteAccessHost = null;
+    siteAccessOriginPattern = null;
+    siteAccessTabId = null;
+    if (elements.siteAccessRetry) elements.siteAccessRetry.disabled = false;
+    if (elements.siteAccessNotice) elements.siteAccessNotice.style.display = 'none';
+    setRemoteControlsLocked(hcmGuestLocked);
+}
+
+function handleTargetTabResponse(response) {
+    if (response?.status === 'host_permission_required') {
+        showSiteAccessNotice(response.host, response.originPattern, response.tabId);
+        return false;
+    }
+    if (response?.status === 'ok') {
+        hideSiteAccessNotice();
+        return true;
+    }
+    if (response?.status === 'superseded') return false;
+    showToast(response?.message || getMessage('ERR_NO_VIDEO_TAB'), 'error', 5000);
+    return false;
+}
+
+function selectTargetTab(tabId, tabTitle) {
+    return new Promise(resolve => {
+        chrome.runtime.sendMessage({ type: 'SET_TARGET_TAB', tabId, tabTitle }, response => {
+            if (chrome.runtime.lastError) {
+                showToast(chrome.runtime.lastError.message || getMessage('ERR_NO_VIDEO_TAB'), 'error', 5000);
+                resolve(false);
+                return;
+            }
+            resolve(handleTargetTabResponse(response));
+        });
+    });
+}
+
+async function refreshTargetAccessState() {
+    const status = await new Promise(resolve => {
+        chrome.runtime.sendMessage({ type: 'GET_STATUS' }, response => {
+            if (chrome.runtime.lastError) {
+                resolve(null);
+                return;
+            }
+            resolve(response || null);
+        });
+    });
+    if (!status) return;
+    if (status.pendingTargetTabId) {
+        showSiteAccessNotice(
+            status.pendingTargetHost,
+            status.pendingTargetOriginPattern,
+            status.pendingTargetTabId
+        );
+    } else {
+        hideSiteAccessNotice();
+    }
+    await populateTabs(
+        status.peers,
+        status.targetTabId ?? status.pendingTargetTabId ?? null
+    );
+}
+
 if (elements.hostControlToggle) {
     elements.hostControlToggle.addEventListener('change', () => {
         const mode = elements.hostControlToggle.checked ? 'host-only' : 'everyone';
@@ -1012,7 +1116,7 @@ async function populateTabs(providedPeers = null, providedTargetTabId = null) {
             if (populateTabsToken !== token) return;
             currentTargetTabId = null;
         } else {
-            currentTargetTabId = status?.targetTabId;
+            currentTargetTabId = status?.targetTabId || status?.pendingTargetTabId;
         }
     }
  
@@ -1132,7 +1236,7 @@ async function populateTabs(providedPeers = null, providedTargetTabId = null) {
         if (matchOpt && elements.targetTab.options.length > 1) {
             elements.targetTab.value = matchOpt.value;
             const tabTitle = matchOpt.dataset.originalTitle || null;
-            chrome.runtime.sendMessage({ type: 'SET_TARGET_TAB', tabId: parseInt(matchOpt.value), tabTitle });
+            selectTargetTab(parseInt(matchOpt.value), tabTitle);
         }
     }
 }
@@ -1465,7 +1569,16 @@ if (elements.langSelector) {
                 const data = await chrome.storage.local.get(['roomId', 'password', 'chatKey', 'useCustomServer', 'serverUrl']);
                 updateUI(data.roomId, data.password, data.useCustomServer, data.serverUrl, data.chatKey);
                 
-                await populateTabs(res.peers, res.targetTabId);
+                if (res.pendingTargetTabId) {
+                    showSiteAccessNotice(
+                        res.pendingTargetHost,
+                        res.pendingTargetOriginPattern,
+                        res.pendingTargetTabId
+                    );
+                } else {
+                    hideSiteAccessNotice();
+                }
+                await populateTabs(res.peers, res.targetTabId || res.pendingTargetTabId);
                 if (res.episodeLobby) updateLobbyUI(res.episodeLobby, res.peers);
             } else {
                 applyConnectionStatus('disconnected');
@@ -1766,18 +1879,48 @@ elements.retryBtn.addEventListener('click', () => {
     chrome.runtime.sendMessage({ type: 'RETRY_CONNECT' });
 });
 
-elements.targetTab.addEventListener('change', () => {
+elements.targetTab.addEventListener('change', async () => {
     const hint = document.getElementById('targetTabHint');
     if (hint) hint.style.display = 'none';
 
     const val = elements.targetTab.value;
     const tabId = val ? parseInt(val) : null;
     const tabTitle = elements.targetTab.options[elements.targetTab.selectedIndex]?.dataset.originalTitle || null;
-    chrome.runtime.sendMessage({ type: 'SET_TARGET_TAB', tabId, tabTitle });
+    await selectTargetTab(tabId, tabTitle);
 });
 
+if (elements.siteAccessRetry) {
+    elements.siteAccessRetry.addEventListener('click', async () => {
+        const tabId = normalizeTabId(elements.targetTab.value);
+        const tabTitle = elements.targetTab.options[elements.targetTab.selectedIndex]?.dataset.originalTitle || null;
+        if (tabId === null || siteAccessTabId !== tabId || !siteAccessOriginPattern) {
+            showToast(getMessage('ERR_SELECT_VIDEO'), 'warning');
+            return;
+        }
+        const requestedOriginPattern = siteAccessOriginPattern;
+        const requestedTabId = siteAccessTabId;
+        elements.siteAccessRetry.disabled = true;
+        elements.targetTab.disabled = true;
+        try {
+            const granted = await requestOriginPermission(chrome, requestedOriginPattern);
+            if (granted !== true) return;
+            const selectedTabId = normalizeTabId(elements.targetTab.value);
+            // permissions.onAdded may already have completed activation, or a
+            // newer selection may have replaced this request while it was open.
+            if (!siteAccessBlocked || selectedTabId !== tabId
+                || siteAccessTabId !== requestedTabId
+                || siteAccessOriginPattern !== requestedOriginPattern) return;
+            await selectTargetTab(tabId, tabTitle);
+        } finally {
+            elements.siteAccessRetry.disabled = siteAccessBlocked
+                && (!siteAccessOriginPattern || siteAccessTabId === null);
+            elements.targetTab.disabled = false;
+        }
+    });
+}
+
 elements.forceSyncBtn.addEventListener('click', async () => {
-    if (hcmGuestLocked) return; // guest in host-only room — backstop (M-2/L-3)
+    if (hcmGuestLocked || siteAccessBlocked) return; // host/site-access backstop
     if (elements.forceSyncBtn.disabled) return;
     
     const originalText = elements.forceSyncBtn.textContent;
@@ -1788,6 +1931,11 @@ elements.forceSyncBtn.addEventListener('click', async () => {
         elements.forceSyncBtn.disabled = false;
         return;
     }
+    const tabId = normalizeTabId(status.targetTabId);
+    if (tabId === null) {
+        elements.forceSyncBtn.disabled = false;
+        return;
+    }
 
     const mode = elements.forceSyncMode.value;
     let targetTime = null;
@@ -1823,23 +1971,33 @@ elements.forceSyncBtn.addEventListener('click', async () => {
         // Don't unlock a button that's locked because we became a guest mid-flight —
         // hcmGuestLocked is the source of truth for the lock state, and the next
         // CONTROL_MODE update restores the correct label.
-        if (!forceSyncDone && !hcmGuestLocked) {
+        if (!forceSyncDone && !hcmGuestLocked && !siteAccessBlocked) {
             elements.forceSyncBtn.disabled = false;
             elements.forceSyncBtn.textContent = originalText;
         }
     };
     forceSyncResetTimer = setTimeout(forceSyncReset, syncTimeoutMs);
-    const tabId = parseInt(status.targetTabId);
 
     const failForceSyncTime = () => {
+        if (forceSyncDone) return;
         if (forceSyncResetTimer) { clearTimeout(forceSyncResetTimer); forceSyncResetTimer = null; }
         showError(getMessage('ERR_NO_VIDEO_TAB'));
         forceSyncDone = true;
-        elements.forceSyncBtn.disabled = false;
+        if (!hcmGuestLocked && !siteAccessBlocked) elements.forceSyncBtn.disabled = false;
         elements.forceSyncBtn.textContent = originalText;
     };
 
-    const sendForceSync = (time) => {
+    const targetIsStillCurrent = () => new Promise(resolve => {
+        chrome.runtime.sendMessage({ type: 'GET_STATUS' }, currentStatus => {
+            if (chrome.runtime.lastError) {
+                resolve(false);
+                return;
+            }
+            resolve(normalizeTabId(currentStatus?.targetTabId) === tabId);
+        });
+    });
+
+    const sendForceSync = async (time) => {
         if (time === null || time === undefined) {
             failForceSyncTime();
             return;
@@ -1849,15 +2007,28 @@ elements.forceSyncBtn.addEventListener('click', async () => {
             failForceSyncTime();
             return;
         }
+        if (!(await targetIsStillCurrent())) {
+            failForceSyncTime();
+            return;
+        }
         chrome.runtime.sendMessage({
             type: 'CONTENT_EVENT',
             action: EVENTS.FORCE_SYNC_PREPARE,
+            expectedTabId: tabId,
             payload: { targetTime: target }
+        }, response => {
+            if (chrome.runtime.lastError || response?.status === 'stale_target') {
+                failForceSyncTime();
+            }
         });
     };
 
     if (mode === 'jump-to-me') {
-        const retryQueryTime = () => {
+        const retryQueryTime = async () => {
+            if (!(await targetIsStillCurrent())) {
+                failForceSyncTime();
+                return;
+            }
             chrome.tabs.sendMessage(tabId, { action: 'get_current_time' }, (retryResponse) => {
                 if (chrome.runtime.lastError || !retryResponse || !Number.isFinite(retryResponse.currentTime)) {
                     failForceSyncTime();
@@ -1872,8 +2043,19 @@ elements.forceSyncBtn.addEventListener('click', async () => {
                 return;
             }
             if (chrome.runtime.lastError || !response) {
-                chrome.runtime.sendMessage({ type: 'INJECT_CONTENT_SCRIPT', tabId }, (injectResponse) => {
+                chrome.runtime.sendMessage({
+                    type: 'INJECT_CONTENT_SCRIPT',
+                    tabId,
+                    expectedCurrentTabId: tabId
+                }, (injectResponse) => {
                     if (chrome.runtime.lastError || !injectResponse || injectResponse.status !== 'ok') {
+                        if (injectResponse?.status === 'host_permission_required') {
+                            showSiteAccessNotice(
+                                injectResponse.host,
+                                injectResponse.originPattern,
+                                injectResponse.tabId
+                            );
+                        }
                         failForceSyncTime();
                         return;
                     }
@@ -1889,7 +2071,7 @@ elements.forceSyncBtn.addEventListener('click', async () => {
 });
 
 elements.playBtn.addEventListener('click', () => {
-    if (hcmGuestLocked) return; // guest in host-only room — backstop
+    if (hcmGuestLocked || siteAccessBlocked) return; // host/site-access backstop
     if (!elements.targetTab.value) {
         showToast(getMessage('ERR_SELECT_VIDEO'), 'warning');
         return;
@@ -1903,12 +2085,12 @@ elements.playBtn.addEventListener('click', () => {
     }, (response) => {
         if (response && response.status === 'ok_solo') {
             elements.playBtn.textContent = getMessage('BTN_PLAY');
-            elements.playBtn.disabled = false;
+            if (!hcmGuestLocked && !siteAccessBlocked) elements.playBtn.disabled = false;
         }
     });
     // Safety reset: restore button after 2.5s in case no peers respond
     setTimeout(() => {
-        if (elements.playBtn.disabled && !hcmGuestLocked) {
+        if (elements.playBtn.disabled && !hcmGuestLocked && !siteAccessBlocked) {
             elements.playBtn.textContent = getMessage('BTN_PLAY');
             elements.playBtn.disabled = false;
         }
@@ -1916,7 +2098,7 @@ elements.playBtn.addEventListener('click', () => {
 });
 
 elements.pauseBtn.addEventListener('click', () => {
-    if (hcmGuestLocked) return; // guest in host-only room — backstop
+    if (hcmGuestLocked || siteAccessBlocked) return; // host/site-access backstop
     if (!elements.targetTab.value) {
         showToast(getMessage('ERR_SELECT_VIDEO'), 'warning');
         return;
@@ -1930,12 +2112,12 @@ elements.pauseBtn.addEventListener('click', () => {
     }, (response) => {
         if (response && response.status === 'ok_solo') {
             elements.pauseBtn.textContent = getMessage('BTN_PAUSE');
-            elements.pauseBtn.disabled = false;
+            if (!hcmGuestLocked && !siteAccessBlocked) elements.pauseBtn.disabled = false;
         }
     });
     // Safety reset: restore button after 2.5s in case no peers respond
     setTimeout(() => {
-        if (elements.pauseBtn.disabled && !hcmGuestLocked) {
+        if (elements.pauseBtn.disabled && !hcmGuestLocked && !siteAccessBlocked) {
             elements.pauseBtn.textContent = getMessage('BTN_PAUSE');
             elements.pauseBtn.disabled = false;
         }
@@ -2100,7 +2282,7 @@ chrome.runtime.onMessage.addListener((msg) => {
                     if (state.acks && state.acks.length >= peerCount) {
                         btn.textContent = getMessage('BTN_STATE_SYNCED');
                         setTimeout(() => {
-                            btn.disabled = false;
+                            if (!hcmGuestLocked && !siteAccessBlocked) btn.disabled = false;
                             btn.textContent = state.action === 'play' ? getMessage('BTN_PLAY') : getMessage('BTN_PAUSE');
                         }, 2000);
                     }
@@ -2115,7 +2297,7 @@ chrome.runtime.onMessage.addListener((msg) => {
                 forceSyncResetTimer = null;
             }
             if (elements.forceSyncBtn) {
-                elements.forceSyncBtn.disabled = false;
+                if (!hcmGuestLocked && !siteAccessBlocked) elements.forceSyncBtn.disabled = false;
                 elements.forceSyncBtn.textContent = getMessage('BTN_STATE_SYNCED');
                 setTimeout(() => {
                     elements.forceSyncBtn.textContent = getMessage('BTN_SYNC');
@@ -2167,6 +2349,12 @@ chrome.runtime.onMessage.addListener((msg) => {
                 }
             });
         }
+    } else if (msg.type === 'TARGET_TAB_READY') {
+        refreshTargetAccessState().catch(() => {});
+    } else if (msg.type === 'TARGET_TAB_ACCESS_REQUIRED') {
+        refreshTargetAccessState().catch(() => {});
+    } else if (msg.type === 'TARGET_TAB_CLEARED') {
+        refreshTargetAccessState().catch(() => {});
     } else if (msg.type === 'PING_UPDATE') {
         updatePingDisplay(msg.ping);
     } else if (msg.type === 'HISTORY_UPDATE') {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "koalasync",
-  "version": "2.6.1",
+  "version": "2.6.4",
   "description": "KoalaSync Build Scripts",
   "private": true,
   "type": "module",

scripts/build-extension.cjs

@@ -6,6 +6,59 @@ const rootDir = path.join(__dirname, '..');
 const extDir = path.join(rootDir, 'extension');
 const distDir = path.join(rootDir, 'dist');
 const baseManifestPath = path.join(extDir, 'manifest.base.json');
+const localesDir = path.join(extDir, '_locales');
+const requiredAppName = 'Watch Party - KoalaSync';
+const maxAppNameLength = 75;
+const maxAppDescLength = 132;
+
+function countUnicodeCharacters(value) {
+  return Array.from(value).length;
+}
+
+function validateExtensionMetadata() {
+  const localeDirectories = fs.readdirSync(localesDir, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => entry.name)
+    .sort();
+
+  for (const locale of localeDirectories) {
+    const messagesPath = path.join(localesDir, locale, 'messages.json');
+    let messages;
+
+    try {
+      messages = JSON.parse(fs.readFileSync(messagesPath, 'utf8'));
+    } catch (error) {
+      throw new Error(`CRITICAL: Invalid locale JSON at _locales/${locale}/messages.json: ${error.message}`);
+    }
+
+    if (!messages || typeof messages !== 'object' || Array.isArray(messages)) {
+      throw new Error(`CRITICAL: _locales/${locale}/messages.json must contain a JSON object`);
+    }
+
+    for (const key of ['appName', 'appDesc']) {
+      if (!messages[key] || typeof messages[key].message !== 'string' || messages[key].message.trim().length === 0) {
+        throw new Error(`CRITICAL: _locales/${locale}/messages.json is missing a valid ${key}.message`);
+      }
+    }
+
+    const appNameLength = countUnicodeCharacters(messages.appName.message);
+    const appDescLength = countUnicodeCharacters(messages.appDesc.message);
+
+    if (appNameLength > maxAppNameLength) {
+      throw new Error(`CRITICAL: _locales/${locale}/messages.json appName.message is ${appNameLength} characters; maximum is ${maxAppNameLength}`);
+    }
+    if (messages.appName.message !== requiredAppName) {
+      throw new Error(`CRITICAL: _locales/${locale}/messages.json appName.message must exactly equal "${requiredAppName}"`);
+    }
+    if (appDescLength > maxAppDescLength) {
+      throw new Error(`CRITICAL: _locales/${locale}/messages.json appDesc.message is ${appDescLength} characters; maximum is ${maxAppDescLength}`);
+    }
+  }
+
+  console.log(`✓ Validated localized extension metadata for ${localeDirectories.length} locales`);
+}
+
+validateExtensionMetadata();
 
 // Ensure dist directory exists
 if (fs.existsSync(distDir)) {

scripts/test-host-access.mjs

@@ -0,0 +1,180 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { cwd } from 'node:process';
+import {
+    HOST_ACCESS_REQUIRED_STATUS,
+    addTabHostAccessRequest,
+    describeTabUrl,
+    inspectTabHostAccess,
+    isHostAccessError,
+    normalizeTabId,
+    removeTabHostAccessRequest,
+    requestOriginPermission
+} from '../extension/host-access.js';
+
+assert.equal(HOST_ACCESS_REQUIRED_STATUS, 'host_permission_required');
+assert.equal(normalizeTabId(null), null);
+assert.equal(normalizeTabId(undefined), null);
+assert.equal(normalizeTabId(''), null);
+assert.equal(normalizeTabId(0), null);
+assert.equal(normalizeTabId('42'), 42);
+assert.equal(normalizeTabId(true), null);
+assert.equal(normalizeTabId([42]), null);
+assert.equal(normalizeTabId('42.5'), null);
+assert.equal(normalizeTabId(' 42 '), 42);
+assert.equal(normalizeTabId(Number.MAX_SAFE_INTEGER + 1), null);
+assert.deepEqual(describeTabUrl('https://emby.example:8443/web/index.html'), {
+    url: 'https://emby.example:8443/web/index.html',
+    host: 'emby.example:8443',
+    originPattern: 'https://emby.example:8443/*'
+});
+assert.deepEqual(describeTabUrl('http://localhost:8096/web/'), {
+    url: 'http://localhost:8096/web/',
+    host: 'localhost:8096',
+    originPattern: 'http://localhost:8096/*'
+});
+assert.deepEqual(describeTabUrl('http://localhost:8096/web/', { includePort: false }), {
+    url: 'http://localhost:8096/web/',
+    host: 'localhost:8096',
+    originPattern: 'http://localhost/*'
+});
+assert.equal(describeTabUrl('chrome://extensions/'), null);
+assert.equal(describeTabUrl('not a url'), null);
+
+let containsRequest = null;
+const deniedChrome = {
+    tabs: {
+        get: async tabId => ({ id: tabId, url: 'https://video.example/watch' })
+    },
+    permissions: {
+        contains: async request => {
+            containsRequest = request;
+            return false;
+        }
+    }
+};
+const access = await inspectTabHostAccess(deniedChrome, 42);
+assert.equal(access.granted, false);
+assert.equal(access.host, 'video.example');
+assert.deepEqual(containsRequest, { origins: ['https://video.example/*'] });
+
+let firefoxContainsRequest = null;
+const firefoxChrome = {
+    runtime: { getBrowserInfo: async () => ({ name: 'Firefox' }) },
+    tabs: {
+        get: async tabId => ({
+            id: tabId,
+            url: 'http://localhost:8096/web/',
+            pendingUrl: 'https://different.example/loading'
+        })
+    },
+    permissions: {
+        contains: async request => {
+            firefoxContainsRequest = request;
+            return false;
+        }
+    }
+};
+const firefoxAccess = await inspectTabHostAccess(firefoxChrome, 42);
+assert.equal(firefoxAccess.host, 'localhost:8096');
+assert.equal(firefoxAccess.originPattern, 'http://localhost/*');
+assert.deepEqual(firefoxContainsRequest, { origins: ['http://localhost/*'] });
+
+const unknownPermissionChrome = {
+    runtime: {},
+    tabs: {
+        get: async tabId => ({ id: tabId, url: 'https://video.example/watch' })
+    },
+    permissions: {
+        contains: (_request, callback) => { callback(undefined); }
+    }
+};
+assert.equal((await inspectTabHostAccess(unknownPermissionChrome, 42)).granted, null);
+
+let requestedTabId = null;
+const requestChrome = {
+    permissions: {
+        addHostAccessRequest: async request => { requestedTabId = request; }
+    }
+};
+assert.equal(await addTabHostAccessRequest(requestChrome, 42, 'https://video.example/*'), true);
+assert.deepEqual(requestedTabId, { tabId: 42, pattern: 'https://video.example/*' });
+assert.equal(await addTabHostAccessRequest({ permissions: {} }, 42), false);
+
+let removedTabId = null;
+const removeRequestChrome = {
+    permissions: {
+        removeHostAccessRequest: async request => { removedTabId = request; }
+    }
+};
+assert.equal(await removeTabHostAccessRequest(removeRequestChrome, 42, 'https://video.example/*'), true);
+assert.deepEqual(removedTabId, { tabId: 42, pattern: 'https://video.example/*' });
+assert.equal(await removeTabHostAccessRequest({ permissions: {} }, 42), false);
+
+assert.equal(isHostAccessError(new Error('Missing host permission for the tab')), true);
+assert.equal(isHostAccessError(new Error('No tab with id: 42')), false);
+const callbackPermissionChrome = {
+    runtime: {},
+    permissions: {
+        request: (_request, callback) => { callback(true); }
+    }
+};
+assert.equal(await requestOriginPermission(callbackPermissionChrome, 'https://video.example/*'), true);
+assert.equal(await requestOriginPermission({ permissions: {} }, 'https://video.example/*'), null);
+
+const background = fs.readFileSync(path.join(cwd(), 'extension', 'background.js'), 'utf8');
+const popup = fs.readFileSync(path.join(cwd(), 'extension', 'popup.js'), 'utf8');
+const popupHtml = fs.readFileSync(path.join(cwd(), 'extension', 'popup.html'), 'utf8');
+const tabManager = fs.readFileSync(path.join(cwd(), 'extension', 'modules', 'tab-manager.js'), 'utf8');
+
+assert.match(background, /await activateTargetTab\(message\.tabId, message\.tabTitle\)/,
+    'SET_TARGET_TAB must await successful activation before acknowledging it');
+assert.match(background, /addTabHostAccessRequest\(chrome, tabId, access\.originPattern\)/,
+    'failed injection must register Chrome host-access request');
+assert.match(background, /retryPendingTarget\(\)/,
+    'pending target must resume after the user grants access');
+assert.match(background, /activationGeneration !== targetActivationGeneration/,
+    'stale concurrent tab activations must not overwrite the newest selection');
+assert.match(background, /pendingTargetRequestId/,
+    'pending access recovery must use an identity token');
+assert.match(background, /addedOrigins\.includes\(pending\.originPattern\)/,
+    'unrelated permission grants must not activate a pending target');
+assert.match(background, /isCurrentTargetIdentity\(tabId, targetGeneration\)/,
+    'stale content-routing retries must not reactivate an old target');
+assert.match(background, /message\.expectedTabId/,
+    'popup playback events must be rejected after their target changes');
+assert.match(background, /completeForceSyncBeforeTargetChange\(selectedTabId\)/,
+    'a target switch must finish an in-flight force sync on the old target');
+assert.match(background, /FORCE_SYNC_ACK'[\s\S]*ignored_unselected_tab/,
+    'stale content scripts must not acknowledge force sync for a new target');
+const activateTargetBody = background.slice(
+    background.indexOf('async function activateTargetTab'),
+    background.indexOf('async function retryPendingTarget')
+);
+assert.ok(
+    activateTargetBody.indexOf('await injectContentScript') < activateTargetBody.indexOf('currentTabId = selectedTabId'),
+    'a tab must not become current until its content script injection succeeds'
+);
+assert.match(background, /removeTabHostAccessRequest\([\s\S]*pendingTabId/,
+    'clearing a pending target must also clear Chrome toolbar access requests');
+assert.match(popup, /response\?\.status === 'host_permission_required'/,
+    'popup must render the structured host-access failure');
+assert.match(popup, /requestOriginPermission\(chrome, requestedOriginPattern\)/,
+    'retry button must request withheld host access directly');
+assert.match(popup, /expectedCurrentTabId: tabId/,
+    'manual reinjection must be tied to the selected target identity');
+assert.match(popup, /expectedTabId: tabId/,
+    'force sync must be tied to the tab whose time was sampled');
+assert.doesNotMatch(tabManager, /injectContentScript/,
+    'tab reload recovery must use the guarded background activation path');
+assert.equal(
+    (background.match(/tabs\.onRemoved\.addListener/g) || []).length
+        + (tabManager.match(/tabs\.onRemoved\.addListener/g) || []).length,
+    1,
+    'target-tab closure must have exactly one state owner'
+);
+assert.match(popupHtml, /id="siteAccessNotice"/,
+    'popup must contain a persistent site-access notice');
+
+console.log('host access recovery tests passed');

scripts/verify-release.mjs

@@ -20,6 +20,7 @@ const checks = [
   ['content video finder', 'node', ['scripts/test-content-video-finder.cjs']],
   ['audio settings', 'node', ['scripts/test-audio-settings.mjs']],
   ['popup refresh cooldown', 'node', ['scripts/test-popup-refresh-cooldown.mjs']],
+  ['host access recovery', 'node', ['scripts/test-host-access.mjs']],
   ['server syntax index', 'node', ['-c', 'server/index.js']],
   ['server syntax ops', 'node', ['-c', 'server/ops.js']],
   ['server syntax rate-limiter', 'node', ['-c', 'server/rate-limiter.js']],

shared/constants.js

@@ -7,7 +7,7 @@
  */
 
 export const PROTOCOL_VERSION = "1.0.0";
-export const APP_VERSION = "2.6.1";
+export const APP_VERSION = "2.6.4";
 
 export const OFFICIAL_SERVER_URL = 'wss://syncserver.koalastuff.net';
 export const OFFICIAL_LANDING_PAGE_URL = 'https://sync.koalastuff.net';

website/app.js

@@ -1,6 +1,14 @@
 // KoalaSync Landing Page Logic
 
 document.addEventListener('DOMContentLoaded', () => {
+    const siteAccessBanner = document.querySelector('.site-access-banner');
+    const siteAccessBannerDismiss = document.querySelector('.site-access-banner-dismiss');
+    if (siteAccessBanner && siteAccessBannerDismiss) {
+        siteAccessBannerDismiss.addEventListener('click', () => {
+            siteAccessBanner.hidden = true;
+        });
+    }
+
     // Mockup Video Title Randomization on Load
     const SERIES_NAMES = [
         'Stranger Things',

website/build.cjs

@@ -235,6 +235,7 @@ async function compile() {
         'styles/hero.css',
         'styles/landing-primary.css',
         'styles/legal.css',
+        'styles/support.css',
         'styles/landing-controls.css',
         'styles/join-spinner.css',
         'styles/landing-sections.css',
@@ -522,6 +523,7 @@ async function compile() {
         { src: 'join.html', dest: 'join.html' },
         { src: 'imprint.html', dest: 'imprint.html' },
         { src: 'privacy.html', dest: 'privacy.html' },
+        { src: 'site-access-help.html', dest: 'site-access-help.html' },
         { src: 'impressum-de.html', dest: 'de/impressum.html' },
         { src: 'datenschutz-de.html', dest: 'de/datenschutz.html' },
         { src: 'impressum.html', dest: 'impressum.html' },
@@ -734,6 +736,12 @@ function generateSitemap(wwwDir) {
     <changefreq>monthly</changefreq>
     <priority>0.3</priority>
   </url>
+  <url>
+    <loc>https://sync.koalastuff.net/site-access-help.html</loc>
+    <lastmod>${today}</lastmod>
+    <changefreq>weekly</changefreq>
+    <priority>0.8</priority>
+  </url>
   <url>
     <loc>https://sync.koalastuff.net/de/impressum</loc>
     <lastmod>${today}</lastmod>

website/llms.txt

@@ -78,7 +78,7 @@ Compatibility depends on each website's player implementation and can change whe
 
 ## Technical information
 
-- Current website release: 2.6.1
+- Current website release: 2.6.4
 - License: MIT
 - Extension runtime: dependency-free browser extension code
 - Relay: Node.js with Socket.IO-compatible WebSocket messaging

website/locales/de.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Starte eine Watch Party auf Netflix, Emby, Jellyfin, YouTube, Twitch und fast jedem HTML5-Video. Open Source, datenschutzfreundlich und ohne Konto.",
   "NAV_FEATURES": "Funktionen",
   "NAV_HOW_IT_WORKS": "So funktioniert's",
+  "SUPPORT_BANNER_TEXT": "KoalaSync kann nicht auf deine Videoseite zugreifen?",
+  "SUPPORT_BANNER_CTA": "Websitezugriff reparieren",
+  "SUPPORT_BANNER_DISMISS": "Hinweis schließen",
   "HERO_TITLE": "Mach jedes Video zur <span class='hero-highlight'>Watch Party</span>.",
   "HERO_SUBTITLE": "Dein Kino-Abend auf Distanz, ohne Lags. Kein Account, kein Tracking, keine Werbung. Einfach Link teilen und gemeinsam Play drücken.",
   "HERO_MASCOT_ALT": "Ein niedlicher Koala steht da und schaut nach unten auf die Download-Buttons",

website/locales/en.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Host a watch party on Netflix, Emby, Jellyfin, YouTube, Twitch and almost any HTML5 video. Open source, privacy-first, and account-free.",
   "NAV_FEATURES": "Features",
   "NAV_HOW_IT_WORKS": "How it works",
+  "SUPPORT_BANNER_TEXT": "KoalaSync cannot access your video site?",
+  "SUPPORT_BANNER_CTA": "Fix website access",
+  "SUPPORT_BANNER_DISMISS": "Dismiss notification",
   "HERO_TITLE": "Turn any video into a <span class='hero-highlight'>watch party</span>.",
   "HERO_SUBTITLE": "Your remote movie night without lags. No account, no tracking, no ads. Just share a link and press play together.",
   "HERO_MASCOT_ALT": "A cute koala standing and looking down at the download buttons",

website/locales/es.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Organiza una watch party en Netflix, Emby, Jellyfin, YouTube, Twitch y casi cualquier vídeo HTML5. Open source, privada y sin cuenta.",
   "NAV_FEATURES": "Características",
   "NAV_HOW_IT_WORKS": "Cómo funciona",
+  "SUPPORT_BANNER_TEXT": "¿KoalaSync no puede acceder al sitio del vídeo?",
+  "SUPPORT_BANNER_CTA": "Reparar acceso al sitio",
+  "SUPPORT_BANNER_DISMISS": "Cerrar aviso",
   "HERO_TITLE": "Convierte cualquier vídeo en una <span class='hero-highlight'>watch party</span>.",
   "HERO_SUBTITLE": "Tu noche de cine a distancia, sin retrasos. Sin cuenta, sin rastreo, sin anuncios. Comparte un enlace y dale al play juntos.",
   "HERO_MASCOT_ALT": "Un lindo koala de pie mirando hacia abajo a los botones de descarga",

website/locales/fr.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Organisez une watch party sur Netflix, Emby, Jellyfin, YouTube, Twitch et presque toute vidéo HTML5. Open source, privé et sans compte.",
   "NAV_FEATURES": "Fonctionnalités",
   "NAV_HOW_IT_WORKS": "Comment ça marche",
+  "SUPPORT_BANNER_TEXT": "KoalaSync n’accède pas à votre site vidéo ?",
+  "SUPPORT_BANNER_CTA": "Réparer l’accès au site",
+  "SUPPORT_BANNER_DISMISS": "Fermer l’avertissement",
   "HERO_TITLE": "Transformez n'importe quelle vidéo en <span class='hero-highlight'>watch party</span>.",
   "HERO_SUBTITLE": "Votre soirée ciné à distance, sans décalage. Pas de compte, pas de tracking, pas de pub. Partagez un lien et lancez la lecture ensemble.",
   "HERO_MASCOT_ALT": "Un koala mignon debout et regardant vers le bas les boutons de téléchargement",

website/locales/it.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Avvia una watch party su Netflix, Emby, Jellyfin, YouTube, Twitch e quasi ogni video HTML5. Open source, privata e senza account.",
   "NAV_FEATURES": "Funzionalità",
   "NAV_HOW_IT_WORKS": "Come Funziona",
+  "SUPPORT_BANNER_TEXT": "KoalaSync non riesce ad accedere al sito video?",
+  "SUPPORT_BANNER_CTA": "Ripristina l’accesso al sito",
+  "SUPPORT_BANNER_DISMISS": "Chiudi avviso",
   "HERO_TITLE": "Trasforma qualsiasi video in una <span class='hero-highlight'>watch party</span>.",
   "HERO_SUBTITLE": "La tua serata film a distanza, senza lag. Niente account, niente tracciamento, niente pubblicità. Condividi un link e premete play insieme.",
   "HERO_MASCOT_ALT": "Un simpatico koala che guarda i pulsanti di download",

website/locales/ja.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Netflix、Emby、Jellyfin、YouTube、Twitch、ほぼすべてのHTML5動画でウォッチパーティーを開催。オープンソース、プライバシー重視、アカウント不要。",
   "NAV_FEATURES": "機能",
   "NAV_HOW_IT_WORKS": "仕組み",
+  "SUPPORT_BANNER_TEXT": "KoalaSync が動画サイトにアクセスできませんか？",
+  "SUPPORT_BANNER_CTA": "サイトアクセスを修復",
+  "SUPPORT_BANNER_DISMISS": "通知を閉じる",
   "HERO_TITLE": "どんな動画も<span class='hero-highlight'>ウォッチパーティー</span>に。",
   "HERO_SUBTITLE": "離れていても一緒に映画ナイト。アカウント不要、トラッキングなし、広告なし。リンクを共有して、一緒に再生するだけ。",
   "HERO_MASCOT_ALT": "ダウンロードボタンを見下ろしているかわいいコアラ",

website/locales/ko.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Netflix, Emby, Jellyfin, YouTube, Twitch 및 거의 모든 HTML5 영상에서 워치 파티를 열어보세요. 오픈소스, 개인정보 보호 중심, 계정 불필요.",
   "NAV_FEATURES": "특징",
   "NAV_HOW_IT_WORKS": "작동 방식",
+  "SUPPORT_BANNER_TEXT": "KoalaSync가 동영상 사이트에 액세스할 수 없나요?",
+  "SUPPORT_BANNER_CTA": "사이트 액세스 복구",
+  "SUPPORT_BANNER_DISMISS": "알림 닫기",
   "HERO_TITLE": "어떤 영상이든 <span class='hero-highlight'>워치 파티</span>로.",
   "HERO_SUBTITLE": "지연 없는 원격 영화의 밤. 계정 없음, 추적 없음, 광고 없음. 링크만 공유하고 함께 재생하세요.",
   "HERO_MASCOT_ALT": "다운로드 버튼을 내려다보고 서 있는 귀여운 코알라",

website/locales/nl.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Start een watch party op Netflix, Emby, Jellyfin, YouTube, Twitch en bijna elke HTML5-video. Open source, privacyvriendelijk en zonder account.",
   "NAV_FEATURES": "Functies",
   "NAV_HOW_IT_WORKS": "Hoe het werkt",
+  "SUPPORT_BANNER_TEXT": "Heeft KoalaSync geen toegang tot je videosite?",
+  "SUPPORT_BANNER_CTA": "Websitetoegang herstellen",
+  "SUPPORT_BANNER_DISMISS": "Melding sluiten",
   "HERO_TITLE": "Maak van elke video een <span class='hero-highlight'>watch party</span>.",
   "HERO_SUBTITLE": "Jouw filmavond op afstand, zonder vertraging. Geen account, geen tracking, geen advertenties. Deel een link en druk samen op play.",
   "HERO_MASCOT_ALT": "Een schattige koala die staat en naar beneden kijkt naar de downloadknoppen",

website/locales/pl.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Zorganizuj watch party na Netflix, Emby, Jellyfin, YouTube, Twitch i prawie każdym wideo HTML5. Open source, prywatnie i bez konta.",
   "NAV_FEATURES": "Funkcje",
   "NAV_HOW_IT_WORKS": "Jak to działa",
+  "SUPPORT_BANNER_TEXT": "KoalaSync nie ma dostępu do strony z filmem?",
+  "SUPPORT_BANNER_CTA": "Napraw dostęp do strony",
+  "SUPPORT_BANNER_DISMISS": "Zamknij powiadomienie",
   "HERO_TITLE": "Zamień dowolne wideo w <span class='hero-highlight'>watch party</span>.",
   "HERO_SUBTITLE": "Twój zdalny wieczór filmowy bez opóźnień. Bez konta, bez śledzenia, bez reklam. Udostępnij link i naciśnijcie play razem.",
   "HERO_MASCOT_ALT": "Uroczy koala stojący i patrzący w dół na przyciski pobierania",

website/locales/pt-BR.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Crie uma watch party na Netflix, Emby, Jellyfin, YouTube, Twitch e quase qualquer vídeo HTML5. Open source, privado e sem conta.",
   "NAV_FEATURES": "Recursos",
   "NAV_HOW_IT_WORKS": "Como Funciona",
+  "SUPPORT_BANNER_TEXT": "O KoalaSync não consegue acessar o site do vídeo?",
+  "SUPPORT_BANNER_CTA": "Corrigir acesso ao site",
+  "SUPPORT_BANNER_DISMISS": "Fechar aviso",
   "HERO_TITLE": "Transforme qualquer vídeo em uma <span class='hero-highlight'>watch party</span>.",
   "HERO_SUBTITLE": "Sua sessão de cinema à distância, sem atrasos. Sem conta, sem rastreamento, sem anúncios. Compartilhe um link e deem play juntos.",
   "HERO_MASCOT_ALT": "Um coala fofo olhando para os botões de download",

website/locales/pt.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Cria uma watch party na Netflix, Emby, Jellyfin, YouTube, Twitch e quase qualquer vídeo HTML5. Open source, privado e sem conta.",
   "NAV_FEATURES": "Funcionalidades",
   "NAV_HOW_IT_WORKS": "Como Funciona",
+  "SUPPORT_BANNER_TEXT": "O KoalaSync não consegue aceder ao site do vídeo?",
+  "SUPPORT_BANNER_CTA": "Corrigir acesso ao site",
+  "SUPPORT_BANNER_DISMISS": "Fechar aviso",
   "HERO_TITLE": "Transforma qualquer vídeo numa <span class='hero-highlight'>watch party</span>.",
   "HERO_SUBTITLE": "A tua noite de cinema à distância, sem atrasos. Sem conta, sem rastreio, sem anúncios. Partilha um link e carreguem no play juntos.",
   "HERO_MASCOT_ALT": "Um coala fofo a olhar para os botões de download",

website/locales/ru.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Запускайте watch party в Netflix, Emby, Jellyfin, YouTube, Twitch и почти любом HTML5-видео. Open source, приватно и без аккаунта.",
   "NAV_FEATURES": "Функции",
   "NAV_HOW_IT_WORKS": "Как это работает",
+  "SUPPORT_BANNER_TEXT": "KoalaSync не может получить доступ к сайту с видео?",
+  "SUPPORT_BANNER_CTA": "Исправить доступ к сайту",
+  "SUPPORT_BANNER_DISMISS": "Закрыть уведомление",
   "HERO_TITLE": "Преврати любое видео в <span class='hero-highlight'>watch party</span>.",
   "HERO_SUBTITLE": "Ваш киновечер на расстоянии, без задержек. Без аккаунта, без слежки, без рекламы. Просто поделитесь ссылкой и нажмите play вместе.",
   "HERO_MASCOT_ALT": "Милый коала стоит и смотрит вниз на кнопки загрузки",

website/locales/tr.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Netflix, Emby, Jellyfin, YouTube, Twitch ve neredeyse tüm HTML5 videolarında watch party başlatın. Açık kaynak, gizlilik odaklı ve hesapsız.",
   "NAV_FEATURES": "Özellikler",
   "NAV_HOW_IT_WORKS": "Nasıl Çalışır",
+  "SUPPORT_BANNER_TEXT": "KoalaSync video sitesine erişemiyor mu?",
+  "SUPPORT_BANNER_CTA": "Site erişimini düzelt",
+  "SUPPORT_BANNER_DISMISS": "Bildirimi kapat",
   "HERO_TITLE": "Herhangi bir videoyu <span class='hero-highlight'>watch party</span>'ye dönüştür.",
   "HERO_SUBTITLE": "Gecikmesiz uzaktan film gecen. Hesap yok, takip yok, reklam yok. Sadece bir bağlantı paylaş ve birlikte oynatın.",
   "HERO_MASCOT_ALT": "İndirme düğmelerine bakan sevimli bir koala",

website/locales/uk.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "Запускайте watch party у Netflix, Emby, Jellyfin, YouTube, Twitch і майже будь-якому HTML5-відео. Open source, приватно й без акаунта.",
   "NAV_FEATURES": "особливості",
   "NAV_HOW_IT_WORKS": "Як це працює",
+  "SUPPORT_BANNER_TEXT": "KoalaSync не має доступу до сайту з відео?",
+  "SUPPORT_BANNER_CTA": "Виправити доступ до сайту",
+  "SUPPORT_BANNER_DISMISS": "Закрити сповіщення",
   "HERO_TITLE": "Перетвори будь-яке відео на <span class='hero-highlight'>watch party</span>.",
   "HERO_SUBTITLE": "Ваш кіновечір на відстані, без затримок. Без акаунта, без стеження, без реклами. Просто поділіться посиланням і натисніть play разом.",
   "HERO_MASCOT_ALT": "Мила коала стоїть і дивиться вниз на кнопки завантаження",

website/locales/zh.json

@@ -14,6 +14,9 @@
   "TWITTER_DESCRIPTION": "在 Netflix、Emby、Jellyfin、YouTube、Twitch 和几乎任意 HTML5 视频上发起一起看派对。开源、重视隐私、无需账号。",
   "NAV_FEATURES": "特征",
   "NAV_HOW_IT_WORKS": "它是如何运作的",
+  "SUPPORT_BANNER_TEXT": "KoalaSync 无法访问视频网站？",
+  "SUPPORT_BANNER_CTA": "修复网站访问权限",
+  "SUPPORT_BANNER_DISMISS": "关闭提示",
   "HERO_TITLE": "把任意视频变成<span class='hero-highlight'>一起看派对</span>。",
   "HERO_SUBTITLE": "远程电影之夜，毫无延迟。无需账号、无跟踪、无广告。分享链接，一起播放。",
   "HERO_MASCOT_ALT": "一只可爱的考拉站着，低头看着下载按钮",

website/site-access-help.html

@@ -0,0 +1,146 @@
+<!DOCTYPE html>
+<html lang="en" class="lang-en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>KoalaSync Cannot Access Your Video Site? Fix Website Access</title>
+    <meta name="description" content="Restore KoalaSync website access immediately in Chrome, Edge, Brave, Opera, or Vivaldi when a video tab cannot be linked or controlled.">
+    <meta name="robots" content="index, follow">
+    <link rel="preload" href="style.min.css" as="style">
+    <link rel="stylesheet" href="style.min.css">
+    <link rel="icon" type="image/png" sizes="32x32" href="assets/favicon-32x32.png">
+    <link rel="canonical" href="https://sync.koalastuff.net/site-access-help.html">
+    <link rel="alternate" hreflang="en" href="https://sync.koalastuff.net/site-access-help.html">
+    <link rel="alternate" hreflang="x-default" href="https://sync.koalastuff.net/site-access-help.html">
+    <meta property="og:type" content="website">
+    <meta property="og:url" content="https://sync.koalastuff.net/site-access-help.html">
+    <meta property="og:title" content="Fix KoalaSync website access">
+    <meta property="og:description" content="Quick browser-specific steps for reconnecting KoalaSync to a video tab.">
+    <meta property="og:image" content="https://sync.koalastuff.net/assets/og-image.png">
+    <meta name="theme-color" content="#10190e">
+    <script type="application/ld+json">
+    {
+      "@context": "https://schema.org",
+      "@type": "TechArticle",
+      "headline": "Fix KoalaSync website access",
+      "description": "Restore KoalaSync access when a browser blocks the extension on a video website.",
+      "inLanguage": "en",
+      "url": "https://sync.koalastuff.net/site-access-help.html",
+      "isPartOf": {
+        "@type": "WebSite",
+        "name": "KoalaSync",
+        "url": "https://sync.koalastuff.net/"
+      }
+    }
+    </script>
+    <script src="lang-init.min.js"></script>
+</head>
+<body class="support-page">
+    <div class="scroll-progress-bar"></div>
+    <a class="skip-link" href="#main-content">Skip to troubleshooting</a>
+
+    <nav>
+        <div class="container nav-content">
+            <a class="logo-area" href="./" aria-label="KoalaSync home">
+                <img class="nav-logo-img" src="assets/NewLogoIcon_128.webp" srcset="assets/NewLogoIcon_64.webp 64w, assets/NewLogoIcon_128.webp 128w, assets/NewLogoIcon.webp 256w" sizes="64px" alt="KoalaSync logo" width="64" height="64">
+                <span>KoalaSync</span>
+            </a>
+            <div class="nav-links" id="primary-nav" role="navigation" aria-label="Primary">
+                <a href="./">Home</a>
+                <a href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener">GitHub</a>
+            </div>
+            <div class="nav-right">
+                <button class="theme-toggle" id="theme-toggle" type="button" aria-label="Toggle light or dark theme" title="Toggle light or dark theme">
+                    <svg class="theme-icon-sun" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" width="18" height="18" aria-hidden="true"><circle cx="12" cy="12" r="4"/><path d="M12 2v2M12 20v2M4.93 4.93l1.41 1.41M17.66 17.66l1.41 1.41M2 12h2M20 12h2M6.34 17.66l-1.41 1.41M19.07 4.93l-1.41 1.41"/></svg>
+                    <svg class="theme-icon-moon" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" width="18" height="18" aria-hidden="true"><path d="M12 3a6 6 0 0 0 9 9 9 9 0 1 1-9-9Z"/></svg>
+                </button>
+                <button class="hamburger" aria-label="Toggle navigation menu" aria-expanded="false" aria-controls="primary-nav">
+                    <svg viewBox="0 0 24 24" width="24" height="24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" aria-hidden="true"><line x1="3" y1="6" x2="21" y2="6"/><line x1="3" y1="12" x2="21" y2="12"/><line x1="3" y1="18" x2="21" y2="18"/></svg>
+                </button>
+            </div>
+        </div>
+    </nav>
+
+    <main id="main-content" class="support-content">
+        <header class="support-hero">
+            <span class="support-status">KoalaSync cannot see your video</span>
+            <h1>KoalaSync opens, but your video does nothing?</h1>
+            <p class="support-lead">Chrome may have switched off KoalaSync for that video website. You can still look connected to a room, but KoalaSync cannot see or control the video until you allow access again.</p>
+        </header>
+
+        <section class="support-card" aria-labelledby="quick-fix-title">
+            <span class="support-eyebrow">Fix it now — no update required</span>
+            <h2 id="quick-fix-title">Turn KoalaSync back on for the video website</h2>
+            <ol class="support-steps">
+                <li>Leave the video website open.</li>
+                <li>Look at the top-right of the browser, next to the long box that shows the website address. Click the <strong>Extensions</strong> button (usually a puzzle-piece icon). If you cannot see it, open the three-dot menu first and choose <strong>Extensions</strong>.</li>
+                <li>Look for <strong>Access requested</strong>. Click <strong>KoalaSync</strong> underneath it to allow access.</li>
+                <li>If you do not see <strong>Access requested</strong>, find KoalaSync in the same menu, open its three-dot menu, choose <strong>This can read and change site data</strong>, then choose <strong>On this site</strong>. You can also choose <strong>On all sites</strong> if you want KoalaSync to work automatically on every supported website.</li>
+                <li>Return to the video and click the browser’s reload button (the circular arrow).</li>
+                <li>Open KoalaSync and select the video tab again.</li>
+            </ol>
+            <p>You do not need to wait for a KoalaSync update. These steps work immediately.</p>
+            <p><a class="support-link" href="https://support.google.com/chrome/answer/2664769?hl=en#:~:text=Let%20extensions%20read%20and%20change%20site%20data" target="_blank" rel="noopener">Open Google’s official step-by-step instructions for changing an extension’s website access</a></p>
+        </section>
+
+        <div class="support-callout" role="note">
+            <span class="support-callout-icon" aria-hidden="true">i</span>
+            <div>
+                <strong>KoalaSync did not add a new kind of permission.</strong>
+                <p>Chrome changed how it handles an extension’s existing access to websites. This change can switch KoalaSync off for a website even though KoalaSync itself was not updated. Allowing KoalaSync on the video website turns it back on.</p>
+            </div>
+        </div>
+
+        <section class="support-card" aria-labelledby="chromium-title">
+            <span class="support-eyebrow">Chrome, Edge, Brave, Opera, Vivaldi</span>
+            <h2 id="chromium-title">Where to click</h2>
+            <ol>
+                <li>Keep the video tab open so the browser knows which website you want to allow.</li>
+                <li>Open the <strong>Extensions</strong> menu at the top-right of the browser.</li>
+                <li>Under <strong>Access requested</strong>, click <strong>KoalaSync</strong>.</li>
+                <li>If your browser shows the older menu, open KoalaSync’s three-dot menu and choose <strong>This can read and change site data</strong> → <strong>On this site</strong>.</li>
+                <li>Reload the video page, open KoalaSync, and select that tab again.</li>
+            </ol>
+        </section>
+
+        <section class="support-card" aria-labelledby="why-title">
+            <span class="support-eyebrow">Why this suddenly happened</span>
+            <h2 id="why-title">Chrome changed this without a KoalaSync update</h2>
+            <p>Chrome is gradually giving people a new extensions menu. It can arrive on one computer today and on another computer later. That is why KoalaSync can suddenly stop working in one browser while it still works in another.</p>
+            <p>Your room can still show as connected because the room connection and access to the video are two separate things. KoalaSync cannot control the video until Chrome allows it on that website again.</p>
+        </section>
+
+        <section class="support-card" aria-labelledby="still-title">
+            <span class="support-eyebrow">Still not working?</span>
+            <h2 id="still-title">Run these checks in order</h2>
+            <ul>
+                <li>Update KoalaSync in both browsers. Friends using different releases should update before testing again.</li>
+                <li>Reload the video page after granting access. An already-open page may still have the old blocked state.</li>
+                <li>Open KoalaSync and reselect the exact tab containing the player.</li>
+                <li>Confirm the debug report says <strong>Video Found</strong>. A page without a standard player may need site-specific support.</li>
+                <li>Temporarily test without another extension that also modifies the player.</li>
+                <li>If it still fails, collect a debug report from each participant before leaving the room.</li>
+            </ul>
+        </section>
+
+        <div class="support-actions">
+            <a class="btn btn-primary" href="./">Back to KoalaSync</a>
+            <a class="btn btn-secondary" href="https://github.com/Shik3i/KoalaSync/issues" target="_blank" rel="noopener">Report a reproducible issue</a>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <p class="footer-ram">Rooms are ephemeral and stored in RAM.</p>
+            <p class="footer-copyright">&copy; 2026 KoalaSync. Open source under the MIT License.</p>
+            <div class="footer-links">
+                <a href="imprint.html">Legal notice</a>
+                <a href="privacy.html">Privacy</a>
+                <a href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener">GitHub</a>
+            </div>
+        </div>
+    </footer>
+
+    <script src="app.min.js"></script>
+</body>
+</html>

website/styles/foundation.css

@@ -92,6 +92,116 @@
     transform: scale(1.05);
 }
 
+.site-access-banner {
+    position: fixed;
+    top: 89px;
+    left: 0;
+    width: 100%;
+    z-index: 900;
+    border-block: 1px solid color-mix(in oklch, var(--accent) 42%, transparent);
+    background: color-mix(in oklch, var(--accent) 16%, var(--bg));
+    box-shadow: 0 10px 30px rgba(0, 0, 0, 0.16);
+    transition: top 0.3s ease;
+}
+
+nav.nav-scrolled + .site-access-banner {
+    top: 59px;
+}
+
+.site-access-banner-inner {
+    position: relative;
+    min-height: 50px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.75rem;
+    color: var(--text);
+    font-size: 0.9rem;
+    font-weight: 650;
+    text-align: center;
+    padding-right: 4rem;
+    padding-left: 4rem;
+}
+
+.site-access-banner-icon {
+    flex: 0 0 auto;
+    display: inline-grid;
+    place-items: center;
+    width: 1.5rem;
+    height: 1.5rem;
+    border-radius: 999px;
+    background: var(--accent);
+    color: var(--text-on-green);
+    font-size: 0.9rem;
+    font-weight: 900;
+}
+
+.site-access-banner-link {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.35rem;
+    color: var(--accent);
+    font-weight: 800;
+    text-decoration: underline;
+    text-underline-offset: 0.18em;
+    white-space: nowrap;
+}
+
+.site-access-banner-link:hover {
+    color: var(--text);
+}
+
+.site-access-banner-dismiss {
+    position: absolute;
+    right: 2rem;
+    top: 50%;
+    transform: translateY(-50%);
+    display: inline-grid;
+    place-items: center;
+    width: 2rem;
+    height: 2rem;
+    padding: 0;
+    border: 0;
+    border-radius: 999px;
+    background: transparent;
+    color: var(--text-muted);
+    cursor: pointer;
+}
+
+.site-access-banner-dismiss:hover,
+.site-access-banner-dismiss:focus-visible {
+    background: color-mix(in oklch, var(--accent) 18%, transparent);
+    color: var(--text);
+}
+
+@media (max-width: 768px) {
+    .site-access-banner {
+        top: 73px;
+    }
+
+    nav.nav-scrolled + .site-access-banner {
+        top: 59px;
+    }
+
+    .site-access-banner-inner {
+        min-height: 64px;
+        padding: 0.65rem 3rem 0.65rem 1rem;
+        gap: 0.5rem;
+        flex-wrap: wrap;
+        font-size: 0.8rem;
+    }
+
+    .site-access-banner-icon {
+        width: 1.3rem;
+        height: 1.3rem;
+        font-size: 0.75rem;
+    }
+
+    .site-access-banner-dismiss {
+        right: 0.75rem;
+    }
+}
+
 * {
     margin: 0;
     padding: 0;

website/styles/support.css

@@ -0,0 +1,242 @@
+/* --- Site-access troubleshooting page --- */
+.support-page {
+    min-height: 100vh;
+}
+
+.support-page::before {
+    content: '';
+    position: fixed;
+    inset: 0;
+    z-index: -1;
+    pointer-events: none;
+    background:
+        radial-gradient(circle at 15% 8%, color-mix(in oklch, var(--accent) 15%, transparent), transparent 32rem),
+        radial-gradient(circle at 85% 30%, color-mix(in oklch, var(--accent-terracotta) 10%, transparent), transparent 30rem);
+}
+
+.support-content {
+    width: min(980px, calc(100% - 2rem));
+    margin: 0 auto;
+    padding: 9rem 0 4rem;
+}
+
+.support-hero {
+    max-width: 760px;
+    margin: 0 auto 2rem;
+    text-align: center;
+}
+
+.support-eyebrow,
+.support-status {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.45rem;
+    border: 1px solid color-mix(in oklch, var(--accent) 35%, transparent);
+    border-radius: 999px;
+    background: color-mix(in oklch, var(--accent) 12%, var(--card));
+    color: var(--accent);
+    padding: 0.4rem 0.8rem;
+    font-size: 0.78rem;
+    font-weight: 800;
+    letter-spacing: 0.04em;
+    text-transform: uppercase;
+}
+
+.support-status::before {
+    content: '';
+    width: 0.55rem;
+    height: 0.55rem;
+    border-radius: 999px;
+    background: var(--accent);
+    box-shadow: 0 0 0 0.3rem color-mix(in oklch, var(--accent) 16%, transparent);
+}
+
+.support-hero h1 {
+    margin: 1rem 0;
+    color: var(--text);
+    font-size: clamp(2.35rem, 6vw, 4.3rem);
+    line-height: 1.05;
+    letter-spacing: -0.045em;
+}
+
+.support-lead {
+    color: var(--text-muted);
+    font-size: clamp(1rem, 2vw, 1.18rem);
+    line-height: 1.75;
+}
+
+.support-card,
+.support-callout {
+    border: 1px solid var(--card-border);
+    border-radius: 22px;
+    background: var(--card-surface);
+    box-shadow: 0 18px 55px rgba(0, 0, 0, 0.15);
+    backdrop-filter: blur(14px);
+}
+
+.support-card {
+    padding: clamp(1.35rem, 4vw, 2.25rem);
+}
+
+.support-content > .support-card + .support-card,
+.support-grid + .support-card,
+.support-card + .support-grid,
+.support-callout + .support-card {
+    margin-top: 1.25rem;
+}
+
+.support-card h2,
+.support-card h3 {
+    color: var(--text);
+    line-height: 1.25;
+}
+
+.support-card h2 {
+    margin: 0 0 0.8rem;
+    font-size: clamp(1.35rem, 3vw, 1.75rem);
+}
+
+.support-card > .support-eyebrow {
+    display: flex;
+    width: fit-content;
+    margin: 0 0 1rem;
+}
+
+.support-card h3 {
+    margin-bottom: 0.55rem;
+    font-size: 1.05rem;
+}
+
+.support-card p,
+.support-card li,
+.support-callout p {
+    color: var(--text-muted);
+}
+
+.support-card p + p,
+.support-card p + ul,
+.support-card p + ol,
+.support-card ul + p,
+.support-card ol + p {
+    margin-top: 0.85rem;
+}
+
+.support-card ul,
+.support-card ol {
+    padding-left: 1.2rem;
+}
+
+.support-card li + li {
+    margin-top: 0.6rem;
+}
+
+.support-grid {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 1.25rem;
+    margin-top: 1.25rem;
+}
+
+.support-steps {
+    list-style: none;
+    padding: 0 !important;
+    counter-reset: support-step;
+}
+
+.support-steps li {
+    position: relative;
+    min-height: 2.4rem;
+    padding-left: 3.2rem;
+    counter-increment: support-step;
+}
+
+.support-steps li::before {
+    content: counter(support-step);
+    position: absolute;
+    top: -0.15rem;
+    left: 0;
+    display: grid;
+    place-items: center;
+    width: 2.2rem;
+    height: 2.2rem;
+    border-radius: 12px;
+    background: var(--accent);
+    color: var(--text-on-green);
+    font-weight: 900;
+}
+
+.support-callout {
+    display: grid;
+    grid-template-columns: auto minmax(0, 1fr);
+    gap: 1rem;
+    align-items: start;
+    margin: 1.25rem 0;
+    padding: 1.25rem;
+    border-color: color-mix(in oklch, var(--accent) 40%, transparent);
+    background: color-mix(in oklch, var(--accent) 10%, var(--card-surface));
+}
+
+.support-callout-icon {
+    display: grid;
+    place-items: center;
+    width: 2rem;
+    height: 2rem;
+    border-radius: 999px;
+    background: var(--accent);
+    color: var(--text-on-green);
+    font-weight: 900;
+}
+
+.support-callout strong {
+    display: block;
+    margin-bottom: 0.3rem;
+    color: var(--text);
+}
+
+.support-link {
+    color: var(--accent);
+    font-weight: 700;
+    text-decoration: underline;
+    text-underline-offset: 0.18em;
+}
+
+.support-link:hover {
+    color: var(--text);
+}
+
+.support-actions {
+    display: flex;
+    justify-content: center;
+    gap: 0.8rem;
+    flex-wrap: wrap;
+    margin-top: 2rem;
+}
+
+.support-actions .btn {
+    min-width: 180px;
+}
+
+html.theme-light .support-card,
+html.theme-light .support-callout {
+    background-color: var(--card-surface);
+    box-shadow: 0 18px 45px rgba(44, 62, 37, 0.1);
+}
+
+@media (max-width: 720px) {
+    .support-content {
+        width: min(100% - 1rem, 980px);
+        padding-top: 7.5rem;
+    }
+
+    .support-grid {
+        grid-template-columns: 1fr;
+    }
+
+    .support-card {
+        border-radius: 18px;
+    }
+
+    .support-callout {
+        grid-template-columns: 1fr;
+    }
+}

website/template.html

@@ -116,7 +116,7 @@
         "priceCurrency": "EUR"
       },
       "description": "{{SCHEMA_APP_DESC}}",
-      "softwareVersion": "2.6.1",
+      "softwareVersion": "2.6.4",
       "license": "https://opensource.org/licenses/MIT",
       "sameAs": "https://github.com/Shik3i/KoalaSync",
       "image": "https://sync.koalastuff.net/assets/NewLogoIcon.webp",
@@ -360,6 +360,22 @@
         </div>
     </nav>
 
+    <aside class="site-access-banner" aria-labelledby="site-access-banner-text">
+        <div class="container site-access-banner-inner">
+            <span class="site-access-banner-icon" aria-hidden="true">!</span>
+            <span id="site-access-banner-text">{{SUPPORT_BANNER_TEXT}}</span>
+            <a href="/site-access-help.html" class="site-access-banner-link">
+                <span>{{SUPPORT_BANNER_CTA}}</span>
+            </a>
+            <button class="site-access-banner-dismiss" type="button" aria-label="{{SUPPORT_BANNER_DISMISS}}">
+                <svg viewBox="0 0 24 24" width="18" height="18" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" aria-hidden="true">
+                    <line x1="6" y1="6" x2="18" y2="18" />
+                    <line x1="18" y1="6" x2="6" y2="18" />
+                </svg>
+            </button>
+        </div>
+    </aside>
+
     <main id="main-content">
     <header class="hero" id="top">
         <div class="container hero-grid">

website/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "2.6.1",
+  "version": "2.6.4",
-  "date": "2026-07-15T03:57:56Z"
+  "date": "2026-07-16T09:51:25Z"
 }