perf(server): optimize failedAuthAttempts LRU eviction to O(1)

AI_INIT.md

@@ -106,7 +106,8 @@ Before starting any task, committing, or pushing, you **MUST** run `git pull --r
 ### Releasing a New Version (CRITICAL WORKFLOW FOR AI AGENTS)
 > [!CAUTION]
 > **AI AGENTS MUST FOLLOW THIS EXACT SEQUENCE WHEN RELEASING A NEW VERSION OR TAGGING.**
-> The CI pipeline automatically injects the version from the git tag into `manifest.base.json`, `shared/constants.js`, and `package.json`. You do NOT need to manually bump version numbers.
+> 
+> **🚫 NO MANUAL VERSION BUMPING**: You MUST **NEVER** manually modify the version strings in `package.json`, `extension/manifest.base.json`, or `website/version.json`. The GitHub Actions CI pipeline automatically extracts the version from the git tag (e.g. `v2.0.5` -> `2.0.5`), injects it into all target files, and commits the updates back to `main` with `[skip ci]`. Manual bumps will cause merge conflicts and build failures.
 > - **Website Versioning**: **NEVER** manually modify the version fallback strings in `website/index.html`. The website dynamically fetches the latest version and release date from `website/version.json` at runtime using `website/app.js`. Manual bumps in the HTML file are completely redundant and should be avoided.
 1. **MANDATORY SYNTAX & LINT CHECKS**: Before staging, committing, or pushing any changes, you **MUST** run both checks on every modified JavaScript file:
    - **Syntax Validation**: Run `node -c` on every single modified JavaScript file (e.g., `node -c extension/background.js` and `node -c extension/content.js`). **NEVER** commit or push code that fails this check.

CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to the KoalaSync browser extension and relay server.
 
 ---
 
+## [v2.0.6] — 2026-06-03
+
+### Performance & Security Hardening
+- Optimized failed authentication attempts cache eviction algorithm to $O(1)$ by exploiting Javascript `Map` insertion-order properties. This completely removes the previous array copying and sorting bottleneck, neutralizing a potential main-thread blocking DoS vector under heavy brute-force password traffic.
+
+---
+
 ## [v2.0.5] — 2026-06-03
 
 ### Security & Hardening

README.md

@@ -12,7 +12,7 @@
   <a href="https://chromewebstore.google.com/detail/koalasync/obbnmkmlaaddodakcbdljknjpagklifc"><img src="https://img.shields.io/badge/Chrome-Download-blue?logo=googlechrome&logoColor=white" alt="Chrome Extension"></a>
 </p>
 
-<p align="center"><a href="CHANGELOG.md"><b>New v2.0.2 Release!</b> — See what's changed</a></p>
+<p align="center"><a href="CHANGELOG.md"><b>New v2.0.6 Release!</b> — See what's changed</a></p>
 
 <p align="center"><i>KoalaSync is a lightweight Browser Extension and Relay Server for synchronized video playback on almost any website with a video element—YouTube, Twitch, Netflix, Emby, Jellyfin, and beyond. Built with a focus on <b>Data Sovereignty</b> and <b>Performance</b>.</i></p>
 

docs/ROADMAP.md

@@ -13,3 +13,10 @@ Dieses Dokument erfasst zukünftige technische Pläne und Optimierungen für das
 * **Geplante Lösung**: 
   - Umstellung auf eine echte, $O(1)$-basierte LRU-Cache-Datenstruktur (z. B. doppelt verkettete Liste in Kombination mit einer Map).
   - Alternativ: Ein vereinfachtes zeitbasiertes Ablauf-Verfahren oder ein schrittweises Löschen von Segmenten (Chunk-Eviction), um Blockaden des Main-Threads vollständig auszuschließen.
+
+### 2. Aufteilung großer JavaScript-Dateien (> 800 Zeilen) in kleinere Module
+* **Kategorie**: Wartbarkeit / AI-Kontext-Optimierung
+* **Hintergrund**: Einige Kern-Dateien wie `background.js` und `popup.js` sind stark angewachsen und überschreiten 800 Zeilen. Dies erschwert das manuelle Debugging und verbraucht unnötig viel Kontextfenster bei AI-Modellen.
+* **Geplante Lösung**: 
+  - Strukturierte Aufteilung der Logik in separate, fokussierte Module (z. B. UI-Renderer, Message-Router, Storage-Manager, Socket-Client).
+  - Nutzung von ES-Modulen zur sauberen Strukturierung und besseren Wiederverwendbarkeit.

docs/SYNC_GUIDE.md

@@ -31,7 +31,7 @@ The build script performs the following actions:
 The system enforces a strict `protocolVersion` check during the `JOIN_ROOM` handshake. 
 - The version is defined in `shared/constants.js`.
 - If the extension and server versions mismatch, the server will reject the connection with an `Incompatible protocol version` error.
-- **Always run the build script** after bumping the version number to ensure both components are updated.
+- **Never manually bump version numbers**. The CI pipeline automatically injects the version from the git tag into `manifest.base.json`, `shared/constants.js`, and `package.json` during release builds. Run the build script to synchronize other constant updates.
 
 > [!CAUTION]
 > **NEVER** edit the files inside `extension/shared/` directly. They will be overwritten the next time the build script is run. Always edit the files in the root `shared/` directory and then run the build script.

server/index.js

@@ -149,17 +149,19 @@ function recordAuthFailure(ip, roomId) {
         for (const [key, record] of failedAuthAttempts.entries()) {
             if (now - record.lastAttempt > 15 * 60 * 1000) {
                 failedAuthAttempts.delete(key);
+            } else {
+                break; // Since entries are insertion-ordered by time, all subsequent entries are newer
             }
         }
         
-        // 2. If still over 50k, perform LRU-style eviction on the oldest 10,000 entries
+        // 2. If still over 50k, perform LRU-style eviction on the oldest 10,000 entries (first items in Map order)
         if (failedAuthAttempts.size > 50000) {
-            log('SECURITY', 'failedAuthAttempts size exceeded 50000. Performing LRU-style eviction.');
-            const sortedEntries = Array.from(failedAuthAttempts.entries())
-                .sort((a, b) => a[1].lastAttempt - b[1].lastAttempt);
-            
-            for (let i = 0; i < 10000 && i < sortedEntries.length; i++) {
-                failedAuthAttempts.delete(sortedEntries[i][0]);
+            log('SECURITY', 'failedAuthAttempts size exceeded 50000. Performing insertion-order eviction.');
+            for (const [key] of failedAuthAttempts.entries()) {
+                if (failedAuthAttempts.size <= 40000) {
+                    break;
+                }
+                failedAuthAttempts.delete(key);
             }
         }
     }
@@ -167,6 +169,7 @@ function recordAuthFailure(ip, roomId) {
     const record = failedAuthAttempts.get(key) || { count: 0, lastAttempt: 0 };
     record.count++;
     record.lastAttempt = Date.now();
+    failedAuthAttempts.delete(key); // Remove first to update insertion order (moves key to the end of iteration)
     failedAuthAttempts.set(key, record);
 }
 

website/version.json

@@ -1,4 +1,4 @@
 {
   "version": "2.0.5",
-  "date": "2026-06-03T09:32:00Z"
+  "date": "2026-06-03T09:34:22Z"
 }

website/www/version.json

@@ -1,4 +1,4 @@
 {
   "version": "2.0.5",
-  "date": "2026-06-03T09:32:00Z"
+  "date": "2026-06-03T09:34:22Z"
 }