fix(extension): harden chat and target tab lifecycle

Prepare v3.0.0: encrypted text chat and runtime updates

.github/workflows/beta-server-image.yml

@@ -6,9 +6,9 @@ name: Beta Server Image
 #
 # Tags produced (on ghcr.io/<owner>/<repo>):
 #   - beta                         moving channel pointer to the newest build
-#   - <branch-slug>                e.g. feature-host-control-mode
+#   - <branch-slug>                e.g. feature-textchat
 #   - sha-<short-commit>           immutable, pin to an exact build
-#   - <custom>                     only on manual run, e.g. hostcontrol01
+#   - <custom>                     only on manual run, e.g. chatbeta01
 # Never ':latest' (flavor: latest=false).
 #
 # Remove this workflow once the feature is merged & released the normal way.
@@ -16,11 +16,11 @@ name: Beta Server Image
 on:
   push:
     branches:
-      - feature/host-control-mode
+      - feature/textchat
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Extra immutable tag for this build (e.g. hostcontrol01). Optional.'
+        description: 'Extra immutable tag for this build (e.g. chatbeta01). Optional.'
         required: false
         default: ''
 
@@ -37,6 +37,27 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: 'npm'
+          cache-dependency-path: |
+            package-lock.json
+            server/package-lock.json
+
+      - name: Install root dependencies
+        run: npm ci
+
+      - name: Install server dependencies
+        run: npm ci
+        working-directory: server
+
+      - name: Run verification suite
+        run: npm run verify
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4

.github/workflows/ci.yml

@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
 
       - name: Set up Node.js
         uses: actions/setup-node@v6

.github/workflows/release.yml

@@ -72,6 +72,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
 
       - name: Set up Node.js
         uses: actions/setup-node@v6
@@ -109,7 +111,11 @@ jobs:
           sed -i "s/\"softwareVersion\": \".*\"/\"softwareVersion\": \"$VERSION\"/" website/template.html
           echo "  ✓ website/template.html -> softwareVersion $VERSION"
 
-          # 6. README.md — version badge & banner
+          # 6. website/llms.txt — machine-readable release metadata
+          sed -i "s/Current website release: .*/Current website release: $VERSION/" website/llms.txt
+          echo "  ✓ website/llms.txt -> $VERSION"
+
+          # 7. README.md — version badge & banner
           sed -i "s|Release-v[0-9]\+\.[0-9]\+\.[0-9]\+-blue|Release-v$VERSION-blue|g" README.md
           sed -i "s/New v[0-9]\+\.[0-9]\+\.[0-9]\+ Release/New v$VERSION Release/g" README.md
           echo "  ✓ README.md -> v$VERSION"
@@ -120,7 +126,7 @@ jobs:
         run: |
           git config --local user.email "action@github.com"
           git config --local user.name "GitHub Action"
-          git add extension/manifest.base.json shared/constants.js package.json website/version.json website/template.html README.md
+          git add extension/manifest.base.json shared/constants.js package.json website/version.json website/template.html website/llms.txt README.md
           git commit -m "chore(release): update versions to $GITHUB_REF_NAME [skip ci]" || echo "No changes to commit"
           git push origin HEAD:main
         env:
@@ -131,6 +137,12 @@ jobs:
           npm ci
           npm run build:extension
 
+      - name: Generate extension checksums
+        run: |
+          cd dist
+          sha256sum koalasync-chrome.zip koalasync-firefox.zip > SHA256SUMS
+          cat SHA256SUMS
+
       - name: Generate artifact attestation for extensions
         uses: actions/attest@v4
         with:
@@ -152,6 +164,7 @@ jobs:
           files: |
             dist/koalasync-chrome.zip
             dist/koalasync-firefox.zip
+            dist/SHA256SUMS
           name: Release ${{ github.ref_name }}
           generate_release_notes: true
           draft: false

CONTRIBUTING.md

@@ -22,7 +22,7 @@ Please note that by participating in this project, you agree to abide by our [Co
 
 ### Prerequisites
 
-- **Node.js** v18+
+- **Node.js** v20.9+
 - **Docker** (for local relay server testing)
 
 ### Quick Start

README.md

@@ -6,15 +6,16 @@
 
 <p align="center">
   <a href="https://github.com/Shik3i/KoalaSync/actions/workflows/release.yml"><img src="https://github.com/Shik3i/KoalaSync/actions/workflows/release.yml/badge.svg" alt="Release Status"></a>
-  <a href="https://github.com/Shik3i/KoalaSync/releases"><img src="https://img.shields.io/badge/Release-v2.6.0-blue?logo=github" alt="GitHub release"></a>
+  <a href="https://github.com/Shik3i/KoalaSync/releases"><img src="https://img.shields.io/badge/Release-v3.0.1-blue?logo=github" alt="GitHub release"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue" alt="License"></a>
   <a href="https://addons.mozilla.org/de/firefox/addon/koalasync/"><img src="https://img.shields.io/badge/Firefox-Download-orange?logo=firefoxbrowser&logoColor=white" alt="Firefox Add-on"></a>
   <a href="https://chromewebstore.google.com/detail/koalasync/obbnmkmlaaddodakcbdljknjpagklifc"><img src="https://img.shields.io/badge/Chrome-Download-blue?logo=googlechrome&logoColor=white" alt="Chrome Extension"></a>
+  <a href="https://microsoftedge.microsoft.com/addons/detail/koalasync/gefnlpeoagcjfbmmfjjildkmofekbibg"><img src="https://img.shields.io/badge/Edge-Download-0078D7?logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA1MTIgNTEyIj48IS0tISBGb250IEF3ZXNvbWUgRnJlZSA3LjMuMSBieSBAZm9udGF3ZXNvbWUgLSBodHRwczovL2ZvbnRhd2Vzb21lLmNvbSBMaWNlbnNlIC0gaHR0cHM6Ly9mb250YXdlc29tZS5jb20vbGljZW5zZS9mcmVlIChJY29uczogQ0MgQlkgNC4wLCBGb250czogU0lMIE9GTCAxLjEsIENvZGU6IE1JVCBMaWNlbnNlKSBDb3B5cmlnaHQgMjAyNiBGb250aWNvbnMsIEluYy4gLS0%2BPHBhdGggZmlsbD0iI2ZmZiIgZD0iTTEyMC4xIDM3LjRjNDEtMjUuMiA4Ny42LTM4LjIgMTM0LjktMzcuNCAxNjggMCAyNTcgMTIzLjggMjU3IDIxOS41LS4xIDMyLjctMTMgNjMuOS0zNS45IDg3LjItMjIuOSAyMy4yLTU0IDM2LjUtODYuNyAzNy03NS4yIDAtOTEuNS0yMy4xLTkxLjUtMzIgMC0zLjggMS4yLTYuMiA0LjgtOS40bDEtMS4yIC40LTEuNmMxMC41LTExLjUgMTUuOS0yNi4yIDE1LjktNDEuNiAwLTc4LjctODIuMi0xNDIuNy0xODQtMTQyLjctMzcuNS0uMy03NC41IDguOS0xMDcuNSAyNi45IDI3LTU3LjUgODIuNy05Ny42IDkxLjMtMTAzLjggLjgtLjYgLjMtLjggLjMtLjh6bTE1LjYgMzE4LjFjLTEuNCAzMCA0LjYgNjAgMTYuNCA4Ny4yIDEzLjYgMjYuNCAzMi43IDUxIDU2LjUgNjkuMy01OS41LTExLjUtMTExLjUtNDMuOS0xNDkuNC04OS4zLTM4LjEtNDYuNC01OS4yLTEwNC4zLTU5LjItMTY0LjggMC01MS4yIDYyLjQtOTQuNCAxMzYtOTQuNCAzNi42LS42IDcyLjQgMTAuOSAxMDEuOCAzMi43bC0zLjYgMS4yYy01MS41IDE3LjYtOTguNSA5MC43LTk4LjUgMTU4LjF6TTQ2OS44IDQwMGwtLjcgLjFjLTExLjggMTguOC0yNS45IDM1LjEtNDIuMiA0OS41LTMwLjggMjgtNjguMSA0NS41LTEwOC44IDQ5LjktMTguNiAuMy0zNi44LTMuMi01My44LTExLjQtMjUuNi0xMC4zLTQ3LjEtMzAtNjEuNi01My0xNC40LTIzLjktMjEuMS01MS43LTE5LTc5LjYtLjYtMjAuMSA1LjQtNDAuMyAxNS01OC4yIDEzLjkgMzMuMSAzNy41IDYxLjMgNjcuNiA4MC44czY1LjUgMjkuNSAxMDEuNCAyOC42YzMxIC4zIDYyLjEtNi43IDkwLjItMjAuNWwxLjktLjljMy45LTIuMyA3LjctMy45IDExLjYgMCA0LjUgNC45IDEuOCA5LjItMS4yIDE0LS4yIC4yLS4zIC41LS40IC43eiIvPjwvc3ZnPg%3D%3D" alt="Microsoft Edge Add-on"></a>
 </p>
 
 <p align="center"><i>KoalaSync is a lightweight Browser Extension and Relay Server for synchronized video playback on almost any website with a video element—YouTube, Twitch, Netflix, Emby, Jellyfin, and beyond. Built with a focus on <b>Data Sovereignty</b> and <b>Performance</b>.</i></p>
 
-<p align="center"><a href="docs/CHANGELOG.md"><b>New v2.6.0 Release!</b> — See what's changed</a></p>
+<p align="center"><a href="docs/CHANGELOG.md"><b>New v3.0.1 Release!</b> — See what's changed</a></p>
 
 ### 🌟 Why KoalaSync?
 
@@ -46,9 +47,10 @@ The easiest and safest way to install KoalaSync is directly through the official
 <p>
   <a href="https://chromewebstore.google.com/detail/koalasync/obbnmkmlaaddodakcbdljknjpagklifc"><img src="https://img.shields.io/badge/Chrome-Download-blue?logo=googlechrome&logoColor=white&style=for-the-badge" alt="Chrome Extension"></a>
   <a href="https://addons.mozilla.org/de/firefox/addon/koalasync/"><img src="https://img.shields.io/badge/Firefox-Download-orange?logo=firefoxbrowser&logoColor=white&style=for-the-badge" alt="Firefox Add-on"></a>
+  <a href="https://microsoftedge.microsoft.com/addons/detail/koalasync/gefnlpeoagcjfbmmfjjildkmofekbibg"><img src="https://img.shields.io/badge/Edge-Download-0078D7?logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA1MTIgNTEyIj48IS0tISBGb250IEF3ZXNvbWUgRnJlZSA3LjMuMSBieSBAZm9udGF3ZXNvbWUgLSBodHRwczovL2ZvbnRhd2Vzb21lLmNvbSBMaWNlbnNlIC0gaHR0cHM6Ly9mb250YXdlc29tZS5jb20vbGljZW5zZS9mcmVlIChJY29uczogQ0MgQlkgNC4wLCBGb250czogU0lMIE9GTCAxLjEsIENvZGU6IE1JVCBMaWNlbnNlKSBDb3B5cmlnaHQgMjAyNiBGb250aWNvbnMsIEluYy4gLS0%2BPHBhdGggZmlsbD0iI2ZmZiIgZD0iTTEyMC4xIDM3LjRjNDEtMjUuMiA4Ny42LTM4LjIgMTM0LjktMzcuNCAxNjggMCAyNTcgMTIzLjggMjU3IDIxOS41LS4xIDMyLjctMTMgNjMuOS0zNS45IDg3LjItMjIuOSAyMy4yLTU0IDM2LjUtODYuNyAzNy03NS4yIDAtOTEuNS0yMy4xLTkxLjUtMzIgMC0zLjggMS4yLTYuMiA0LjgtOS40bDEtMS4yIC40LTEuNmMxMC41LTExLjUgMTUuOS0yNi4yIDE1LjktNDEuNiAwLTc4LjctODIuMi0xNDIuNy0xODQtMTQyLjctMzcuNS0uMy03NC41IDguOS0xMDcuNSAyNi45IDI3LTU3LjUgODIuNy05Ny42IDkxLjMtMTAzLjggLjgtLjYgLjMtLjggLjMtLjh6bTE1LjYgMzE4LjFjLTEuNCAzMCA0LjYgNjAgMTYuNCA4Ny4yIDEzLjYgMjYuNCAzMi43IDUxIDU2LjUgNjkuMy01OS41LTExLjUtMTExLjUtNDMuOS0xNDkuNC04OS4zLTM4LjEtNDYuNC01OS4yLTEwNC4zLTU5LjItMTY0LjggMC01MS4yIDYyLjQtOTQuNCAxMzYtOTQuNCAzNi42LS42IDcyLjQgMTAuOSAxMDEuOCAzMi43bC0zLjYgMS4yYy01MS41IDE3LjYtOTguNSA5MC43LTk4LjUgMTU4LjF6TTQ2OS44IDQwMGwtLjcgLjFjLTExLjggMTguOC0yNS45IDM1LjEtNDIuMiA0OS41LTMwLjggMjgtNjguMSA0NS41LTEwOC44IDQ5LjktMTguNiAuMy0zNi44LTMuMi01My44LTExLjQtMjUuNi0xMC4zLTQ3LjEtMzAtNjEuNi01My0xNC40LTIzLjktMjEuMS01MS43LTE5LTc5LjYtLjYtMjAuMSA1LjQtNDAuMyAxNS01OC4yIDEzLjkgMzMuMSAzNy41IDYxLjMgNjcuNiA4MC44czY1LjUgMjkuNSAxMDEuNCAyOC42YzMxIC4zIDYyLjEtNi43IDkwLjItMjAuNWwxLjktLjljMy45LTIuMyA3LjctMy45IDExLjYgMCA0LjUgNC45IDEuOCA5LjItMS4yIDE0LS4yIC4yLS4zIC41LS40IC43eiIvPjwvc3ZnPg%3D%3D&style=for-the-badge" alt="Microsoft Edge Add-on"></a>
 </p>
 
-*(For manual offline installation: Download the latest `.zip` from the [Releases](https://github.com/Shik3i/KoalaSync/releases) page and load it as an "Unpacked Extension" in Developer Mode).*
+*(For manual offline installation: Download the latest `.zip` from the [Releases](https://github.com/Shik3i/KoalaSync/releases) page, extract it, and load the extracted browser package using your browser's developer or manual extension installation process.)*
 
 **How to use:**
 1. **Create a Room:** Click the Koala icon in your browser and hit `+ Create New Room`.
@@ -110,7 +112,14 @@ To verify your relay is reachable from outside, visit `https://your-domain.com`
 
 #### Supply Chain Security (v2.2.2+)
 
-All official release artifacts (Docker images and extension binaries) are published with signed [artifact attestations](https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations) to prove they were built from this repository's source code.
+Extension ZIPs attached to GitHub Releases and Docker images published to GitHub Container Registry receive signed [artifact attestations](https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations). These attestations connect an artifact's exact digest to this repository, its release tag and commit, and the public GitHub Actions workflow that built it.
+
+Each new GitHub Release also includes `SHA256SUMS` for a quick checksum comparison:
+```bash
+sha256sum --check SHA256SUMS
+```
+
+Checksums detect a changed or incomplete download. Signed provenance additionally verifies where the artifact came from and which workflow built it. Neither check guarantees that the software contains no bugs or vulnerabilities. These attestations cover the GitHub release ZIPs and GHCR images; they do not by themselves prove that browser-store packages are byte-for-byte identical.
 
 **Verify a Docker image:**
 ```bash

docs/CHANGELOG.md

@@ -4,6 +4,77 @@ All notable changes to the KoalaSync browser extension and relay server.
 
 ---
 
+## [v3.0.2] — 2026-07-31
+
+### Added
+- **Extension: Quick reactions** — Adds six encrypted one-click reactions with a local choice between chat-only display and bounded falling reactions over the video.
+- **Extension: Resilient chat activity** — Keeps a bounded per-room browser-session timeline for play, pause, seek, force-sync, join, and leave rows so overlay reinjection no longer loses them.
+
+### Changed
+- **Extension: Real dock behavior** — Anchors the collapsed Koala chat launcher to the selected side, reserves a page column in normal and fullscreen layouts, and clips viewport-bound page layers away from the open dock; detached mode remains freely movable.
+- **Extension: Koala chat launcher** — Replaces the generic speech-bubble emoji with the KoalaSync extension icon plus a chat marker.
+- **Extension: Reliable long chat sends** — Accepts up to 5000 Unicode code points, splits them into at most ten compatible 500-codepoint messages, waits for each relay echo before clearing text, and suppresses chat notifications while the selected video tab is focused.
+
+### Fixed
+- **Extension: Strict target-tab lifecycle** — Fully deactivates playback, audio, heartbeat, observer, seek-bridge, and chat code before changing targets, cleans up superseded injections, and limits website-bridge status delivery to the KoalaSync site instead of broadcasting to every open tab.
+- **Extension: Tab switching and page restore** — Keeps ordinary tab changes idle and injection-free, makes selecting the same target idempotent, blocks delayed callbacks after teardown, and restores the existing target cleanly after Firefox back/forward-cache suspension.
+
+## [v3.0.1] — 2026-07-26
+
+### Added
+- **Extension: Google Drive workaround** — Detects and controls videos opened on `drive.google.com` through the site-specific embedded-player path.
+- **Extension: Chat event messages** — Optionally shows timestamped room and playback events in chat while keeping chat-message notifications enabled by default and event notifications disabled by default.
+
+### Fixed
+- **Extension: Chat interactions** — Prevents video-player keyboard shortcuts while typing, makes the floating chat draggable, restores left/right docking, updates unread notifications, and keeps chat timestamps visible.
+- **Extension: Embedded-player selection** — Avoids selecting a stale hidden media frame when multiple nested frames are temporarily ambiguous.
+- **Extension: Popup layout** — Moves the video-selection hint lower and reduces its glow.
+- **Website and extension copy** — Corrects malformed translations, separates chat and playback notification labels, removes stale version references and unsupported comparison claims, and accurately documents encrypted live chat and operational logging.
+
+## [v3.0.0] — 2026-07-26
+
+### Added
+- **Extension: Optional encrypted room chat** — Rooms now support live-only, end-to-end encrypted text messages. Chat is disabled and hidden by default and can be enabled explicitly in the extension options.
+- **Extension: Persistent room chat key** — Every room generates and retains a chat key even while chat is disabled, so chat can be enabled later without creating a new room.
+- **Extension: Floating player chat** — When enabled, chat is available from a floating control over the selected player and opens in an overlay without replacing the synchronized video.
+- **Extension: Dedicated chat settings** — Chat now has its own settings section for enablement, left/right/free-floating placement, compact/standard/large/custom sizing, and bubble-versus-open startup behavior.
+
+### Security
+- **Ciphertext-only relay** — The relay receives and forwards encrypted message payloads without storing chat history or accepting client-supplied plaintext, sender identities, timestamps, or message IDs as authoritative.
+- **Backward-compatible rollout** — Versioned `chat-v1` capabilities ensure old non-chat extensions never receive unknown chat events, while current extensions continue to work with older chatless relay versions.
+
+### Changed
+- **Build dependencies** — Updated the supported build and validation toolchain and refreshed compatible transitive dependencies.
+- **Relay container runtime** — Moved the production container from end-of-life Node.js 20 to Node.js 24 LTS and made production dependency installation deterministic with `npm ci --omit=dev`.
+
+## [v2.6.4] — 2026-07-16
+
+### Changed
+- **Extension: Localized store metadata** — Renamed the public extension title to `Watch Party - KoalaSync` and added natural, store-ready descriptions for all 15 supported locales while preserving regional language variants.
+- **Extension: Locale-based manifest metadata** — The extension name and description now resolve through Chrome/Firefox `_locales` messages instead of being hardcoded in the manifest.
+
+### Fixed
+- **Build: Extension metadata validation** — Extension builds now fail clearly for invalid locale JSON, missing metadata, an incorrect extension title, or store titles and descriptions that exceed their character limits.
+
+## [v2.6.3] — 2026-07-15
+
+### Fixed
+- **Extension: Host-access recovery races** — Prevents stale permission grants, reinjection retries, closed tabs, and rapid target changes from reactivating or clearing the wrong video tab.
+- **Extension: Cross-browser host patterns** — Uses Firefox-compatible match patterns for local servers while preserving exact Chromium port scopes.
+- **Extension: Force-sync target integrity** — Keeps sampled playback time and acknowledgements bound to the selected tab during recovery and target changes.
+
+## [v2.6.2] — 2026-07-15
+
+### Added
+- **Website: Site-access recovery guide** — Added an English help page and a localized banner across every landing-page language.
+
+### Fixed
+- **Extension: Withheld website access recovery** — Detects browser-withheld host access, shows a localized allow-access action, requests only the selected website origin, and resumes the selected tab after access is granted.
+- **Extension: Target-tab reliability** — Hardened permission recovery against rapid tab changes, navigation, closed tabs, service-worker restoration, and stale pending state.
+- **Browser compatibility** — Uses Chrome's toolbar access request only when available, with a direct user-gesture permission fallback for Firefox and older Chromium browsers.
+
+---
+
 ## [v2.6.1] — 2026-07-15
 
 ### Fixed

docs/CHAT.md

@@ -0,0 +1,105 @@
+# Ephemeral end-to-end encrypted chat
+
+KoalaSync chat is an optional, live-only text channel rendered on the selected
+streaming tab. It is not a messenger and does not add chat UI to the extension
+popup.
+
+## Security boundary
+
+- The relay receives ciphertext only and never receives the chat secret.
+- The relay stores no messages in RAM or on disk and sends no backlog.
+- A late joiner sees only messages sent after joining.
+- Room authentication is unchanged. The room password remains separate from the
+  chat secret and continues to be sent to the relay during `join_room`.
+- Message timing and ciphertext length remain visible to the relay. Same-room
+  replay is accepted by the threat model.
+
+## Invite format and key lifecycle
+
+New invitations use a named fragment format:
+
+```text
+#j2:r=<roomId>&p=<password>&k=<base64url-secret>[&u=<relayUrl>]
+```
+
+The room creator generates 16 random bytes and encodes them as 22 unpadded
+base64url characters. URL fragments are not sent in HTTP requests. The website
+parses the fragment and passes structured fields through `bridge.js` to the
+extension. `chatKey` must never be included in a relay event.
+
+Legacy `#join:` links remain supported and join normally without chat. Manual
+room/password entry also joins without chat. The extension clears any prior chat
+secret when joining without a key, switching rooms, or leaving.
+
+Deployment order is website first, extension second. An old extension ignores the
+additional structured `chatKey` field and continues joining normally.
+
+## Cryptography
+
+- Secret: 16 cryptographically random bytes.
+- KDF: HKDF-SHA256 with `roomId` as salt and a fixed KoalaSync chat info label.
+- Encryption: AES-256-GCM using WebCrypto.
+- IV: fresh random 12-byte value for every message, prepended to the ciphertext.
+- AAD: `${roomId}|${senderId}`.
+- The derived `CryptoKey` is cached once per active room.
+
+The relay stamps `id`, `senderId`, and `timestamp` on the ciphertext envelope.
+Changing `senderId` causes AES-GCM authentication to fail because the receiver uses
+the stamped value as AAD.
+
+## Client policy
+
+- Maximum plaintext length per relay message: 500 Unicode code points.
+- The composer accepts up to 5000 Unicode code points and sends them sequentially
+  as at most ten independently encrypted `chat-v1` messages.
+- Decrypted text is untrusted. Escape HTML before applying the supported limited
+  Markdown formatting.
+- Quick reactions use the same encrypted message path as text. They remain readable
+  by current chat clients without adding a relay-visible reaction event.
+- No read receipts and no typing indicators.
+- The local message DOM is bounded; this is presentation state, not server history.
+
+## Overlay behavior
+
+- Default dock: right.
+- Live modes: right, left, and detached.
+- Detached mode is draggable and moderately resizable. Size and position are stored
+  per origin and clamped to the current viewport.
+- Left and right modes anchor the launcher to the selected edge and reserve a
+  full-height page column while the panel is open. Detached mode is the only freely
+  movable launcher.
+- Docking keeps a reserved column on narrow pages and in fullscreen instead of
+  silently falling back to an overlay.
+- The overlay uses a Shadow DOM. Docking changes root-page or fullscreen-container
+  width and margins while the dock is open and clips viewport-bound page layers to
+  the remaining page column. The overrides stop applying when chat is detached or
+  closed, and the injected style element is removed when chat is destroyed.
+- On `fullscreenchange`, its host moves into `document.fullscreenElement` and remains
+  visible.
+- Six encrypted quick reactions are available from the composer. Users can keep them
+  in chat or additionally show a bounded falling-emoji animation over the video.
+- Playback and room activity is retained in a bounded per-room browser-session
+  timeline so overlay reinjection does not lose command rows. It is not relay history.
+- It follows all eucalyptus, cyber, and graphite light/dark theme combinations.
+- Without a key, the panel stays closed and a disabled chat control explains that a
+  current invite link is required.
+- Chat display is a local option and defaults to off. Enabling or disabling it never
+  deletes the room chat secret, so it can be enabled later without creating a room.
+- Without the relay `chat` capability, no chat control is shown.
+- System notifications are suppressed while the selected video tab and its browser
+  window are focused.
+- A send succeeds only after the relay echoes the authenticated ciphertext back to
+  the sender. Unconfirmed and remaining split messages stay in the composer.
+
+## Mixed-version rollout
+
+- New extensions announce `chat-v1` in `join_room.clientCapabilities`.
+- Old non-chat extensions omit the optional field and receive no `chat_message`
+  events. Their playback and room protocol remains unchanged.
+- The first chat beta omitted the capability. When it sends one valid v1 chat
+  frame, the relay treats that socket as chat-capable for the rest of the
+  connection.
+- New extensions accept the first beta's unversioned server `chat` capability as
+  well as `chat-v1`, so a server-first or extension-first rollout degrades safely.
+
+Peer removal and role management are outside chat scope.

docs/PROTOCOL.md

@@ -11,6 +11,19 @@ the event names defined in `shared/constants.js`.
   object payload.
 - The relay caps incoming Socket.IO message size at 4 KB.
 
+## Invite fragments
+
+Current invitations use named URL-fragment fields:
+
+```text
+#j2:r=<roomId>&p=<password>&k=<base64url-chat-secret>[&u=<relayUrl>]
+```
+
+The fragment is parsed by the website and forwarded to the extension as structured
+fields. `k` is client-only and must never appear in a relay payload. Legacy
+`#join:<roomId>:<password>[:1:<relayUrl>]` fragments remain valid but provide no chat
+secret.
+
 ## Connection Handshake
 
 The Socket.IO handshake must include:
@@ -41,6 +54,7 @@ Payload:
   "password": "string, max 128, optional",
   "tabTitle": "string, max 100, optional",
   "mediaTitle": "string, max 100, optional",
+  "clientCapabilities": ["chat-v1"],
   "protocolVersion": "string, max 16"
 }
 ```
@@ -69,13 +83,56 @@ Payload:
   "hostPeerId": "string or null",
   "controlMode": "everyone | host-only",
   "controllers": ["peerId"],
-  "capabilities": ["host-control", "co-host"]
+  "capabilities": ["host-control", "co-host", "chat", "chat-v1"]
 }
 ```
 
 `room_data` is sent to the joining socket. It is not the general broadcast used
 for every later room update.
 
+## Ephemeral encrypted chat
+
+Relays advertise chat support with `"chat-v1"` in `room_data.capabilities` and keep
+the initial beta's `"chat"` flag during the transition. New clients announce
+`"chat-v1"` in optional `join_room.clientCapabilities` (at most the first 16 entries
+are inspected; unknown or malformed values are ignored). Old clients omit the field
+and continue using the pre-chat protocol unchanged.
+
+The relay sends `chat_message` only to sockets that announced `"chat-v1"`. As a
+transition for the first chat beta, a socket that sends a valid v1 ciphertext is
+marked capable for the rest of that connection. This prevents old non-chat
+extensions from receiving unknown events while preserving the first beta's send
+path.
+
+### `chat_message`
+
+Client to relay:
+
+```json
+{ "ciphertext": "<unpadded-base64url>" }
+```
+
+`ciphertext` contains a 12-byte AES-GCM IV followed by ciphertext and the 16-byte
+authentication tag. The relay validates only canonical base64url and byte bounds.
+It cannot inspect plaintext.
+
+Relay to every chat-capable current room peer, including the sender:
+
+```json
+{
+  "id": "<server-generated UUID>",
+  "senderId": "<server-stamped peer ID>",
+  "timestamp": 1710000000000,
+  "ciphertext": "<unpadded-base64url>"
+}
+```
+
+Client-provided `id`, `senderId`, `timestamp`, or plaintext fields are discarded.
+The relay keeps no message collection and `room_data` contains no chat history.
+Messages are limited to 10 per socket per 10 seconds in addition to the global event
+budget. There are no typing, read-receipt, history, or chat-specific peer-management
+events.
+
 ## Room Leave
 
 ### `leave_room` (client -> server)
@@ -365,5 +422,7 @@ If sender and target are still in the same room, the relay emits:
 
 - `host-control`
 - `co-host`
+- `chat`
+- `chat-v1`
 
 Clients should treat a missing or unknown capabilities list as unsupported.

docs/ROADMAP.md

@@ -30,6 +30,84 @@
 
 *Prioritized for upcoming phases.*
 
+### v3.0 — Modern Room Chat
+
+- **Release date:** Not scheduled
+- **Priority:** P1
+- **Category:** Social / Communication / Privacy
+- **Status:** Planned. This is a roadmap target, not a release announcement.
+- **Existing foundation:** Opt-in, live-only end-to-end encrypted room chat; a floating
+  Koala launcher over the selected player opens a dockable, detachable, resizable
+  overlay. Quick reactions can stay in chat or fall over the video, and a bounded
+  browser-session activity timeline survives overlay reinjection. The relay stores no
+  chat history and mixed extension versions use capability-gated delivery.
+
+#### Core experience
+
+- Floating bubble with an accessible unread badge (`1`, `2`, `3`, …, `99+`), cleared
+  only when the chat is actually viewed.
+- Subtle new-message pulse with reduced-motion support; no animation or sound while
+  muted or during Do Not Disturb.
+- Drag-and-snap bubble positioning, remembered per site, with reset-to-default.
+- Dock left/right, detached overlay, compact mode, fullscreen-safe placement, responsive
+  narrow-player layout, and keyboard-only operation.
+- Per-room mute, mention-only mode, notification sound controls, browser notifications,
+  and a visible mute state.
+- Unread state survives overlay close/reopen and tab focus changes, but room messages
+  remain memory-only unless a future storage option is explicitly enabled.
+
+#### Messaging
+
+- Replies with quoted context, per-message reaction counters, a full emoji picker,
+  mentions, and typing indicators.
+- Edit and delete own messages with clear local tombstones; no silent mutation.
+- Delivery states (`sending`, `sent`, `failed`, `retry`) with idempotent retries and
+  duplicate suppression after reconnects.
+- Message timestamps, date separators, jump-to-latest, unread divider, search within
+  the current live session, copy, and selectable text.
+- Link detection with safe external opening, explicit scheme allowlist, and no automatic
+  previews or remote-media loading.
+- Optional image/GIF/file sharing only after encrypted size limits, malware-risk UX,
+  relay bandwidth limits, and privacy behavior are designed and tested.
+
+#### Presence, safety, and control
+
+- Online/reconnecting status, join/leave events, and room-member presence without
+  exposing IP addresses or cross-room identity.
+- Local mute/block, host moderation controls, slow mode, spam limits, and configurable
+  maximum message length.
+- Optional read receipts and activity indicators default off; never infer or expose
+  viewing behavior without explicit consent.
+- Clear live-only/no-history explanation, encrypted-chat indicator, room-key fingerprint,
+  and key-rotation/rejoin UX.
+
+#### Reliability and compatibility
+
+- Versioned chat capabilities for every new wire feature; unknown fields/events remain
+  harmless to older extensions and old non-chat clients receive no chat traffic.
+- Server-first and extension-first rollout tests, including current, first-chat-beta,
+  old non-chat, reconnect, duplicate-frame, and malformed-capability clients.
+- Bounded queues, payloads, unread counters, typing events, reactions, and attachment
+  metadata; backpressure and rate limits on both client and relay.
+- Real Chrome and Firefox extension E2E coverage for bubble, unread count, overlay,
+  fullscreen, reconnect, and mixed-version rooms before v3.0 can ship.
+
+#### Accessibility and localization
+
+- Screen-reader announcements that do not read every busy-room message by default.
+- Complete focus management, logical tab order, Escape behavior, high contrast,
+  zoom/reflow, reduced motion, and touch target coverage.
+- All chat UI, notification text, moderation states, and errors localized across every
+  supported locale before release.
+
+#### Explicit non-goals for the first v3.0 release
+
+- No server-readable plaintext.
+- No mandatory accounts, public room directory, advertising, tracking, or presence
+  across rooms.
+- No unencrypted server-side history. Any future encrypted history requires a separate
+  threat model, retention controls, export/delete behavior, and explicit opt-in.
+
 ### 2. Invite link with target URL for auto-redirect
 
 - **Priority:** P2
@@ -49,17 +127,6 @@
 
 *Ideas and feature requests under evaluation.*
 
-### In-room chat overlay (like TeleParty)
-
-- **Priority:** P3
-- **Category:** Social / Communication
-- **Background:** A collapsible chat panel to the right of the video (or as an overlay) allowing text-based communication with everyone in the room.
-- **Why backlog (still uncertain):**
-  - **Use case:** No strong personal need — with chat, latency matters less than with voice; async communication tolerates a few seconds of delay.
-  - **Complexity:** Relatively large feature (UI + message persistence + possibly history).
-  - **Legal/moderation:** Unclear what moderation requirements would apply if users can exchange chat messages. Could be relevant depending on jurisdiction.
-- **Status:** Under evaluation, may come later.
-
 ### Cross-frame video detection and control
 
 - **Priority:** P3

docs/chat-e2e-prompt.md

@@ -0,0 +1,346 @@
+# E2E-verschlüsselter In-Page-Chat für KoalaSync
+
+## Auftrag
+
+Baue einen privacy-first, Ende-zu-Ende-verschlüsselten Text-Chat, der direkt auf der
+Streaming-Seite neben dem Video sitzt. Neuer Branch von `main`, Vorschlag
+`feature/chat-e2e`.
+
+### Harte Anforderungen
+
+1. **Der Server darf Nachrichten nie lesen können.** Schlüssel nur clientseitig, der
+   Relay sieht ausschließlich Ciphertext.
+2. **Der Server speichert keine Nachrichten.** Reines Live-Relay, kein RAM-Backlog,
+   keine History. Wer zu spät kommt, verpasst den bisherigen Chat. Das ist gewollt.
+3. **Chat läuft auf der Streaming-Seite**, nicht im Extension-Popup.
+4. **Themes werden respektiert** (3 Paletten x light/dark).
+5. **Keine Read Receipts.** Bewusst gestrichen.
+6. **Volle Abwärtskompatibilität**: alte Extensions müssen weiter normal joinen können.
+
+### Bedrohungsmodell (bestimmt alle Krypto-Entscheidungen)
+
+Das hier ist eine Video-Sync-Extension mit optionalem, flüchtigem Chat, **keine
+sicherheitskritische Messenger-App**. Ziel ist: ein bösartiger Betreiber eines
+Custom-Relays soll nicht einfach mitlesen können. Ob etwas mit sehr viel Aufwand
+theoretisch knackbar wäre, ist egal.
+
+Daraus folgt, und das ist bindend:
+- **Usability und Performance haben Vorrang** vor kryptografischer Maximalhärte.
+- Raum-Passwörter sind kurz, zufällig generiert (z.B. `0XUK3C`) und ständig neu. Wer
+  eines knackt, kann trollen (`play`/`pause` senden). Nervig, nicht kritisch. Deshalb
+  nutzt der Server bewusst simples SHA256/HMAC statt bcrypt. **Diese Linie beibehalten,
+  nicht "verbessern".**
+- Der globale `SERVER_SALT` ist bekannt und kein Issue. Räume sind flüchtig, es gibt
+  keine Datenbank.
+
+### Explizite Nicht-Ziele
+
+- Kein Chat-Tab im Popup. Nicht als Fallback, nicht übergangsweise.
+- Keine serverseitige `chatHistory` in irgendeiner Form.
+- **Die Auth nicht anfassen.** Das Klartext-Passwort an den Relay ist bewusst so und
+  wird nicht umgebaut (Begründung unten).
+- `website/` Theme-Redesign auf `main` nicht anfassen.
+
+---
+
+## Krypto-Design (entschieden, nicht neu diskutieren)
+
+### Woher der Schlüssel kommt
+
+Das Raum-Passwort ist **unbrauchbar** als Schlüsselmaterial: der Client sendet es im
+Klartext an den Relay (`join_room` -> `payload.password`, `server/index.js:349`), der
+Server HMACt es erst selbst (`hashPassword`, Zeile 52-55). Der Server könnte jeden
+daraus abgeleiteten Schlüssel mitberechnen.
+
+Es zu ändern würde auch nichts bringen: Raum-Passwörter haben ~31 Bit Entropie
+(6 Zeichen A-Z0-9). Ein bösartiger Server könnte sie offline durchprobieren und den
+Chat-Schlüssel ableiten.
+
+**Lösung: ein eigenes, zufälliges Secret im URL-Fragment.** Fragmente werden nie an
+einen Server gesendet, und das Secret hat volle Entropie per Konstruktion. Der
+Einladungslink transportiert bereits heute das Passwort im Fragment, der Mechanismus
+existiert also schon.
+
+### Primitive
+
+- **16 zufällige Bytes** (128 Bit), base64url, 22 Zeichen. Beispiel:
+  `R5Ti1nxp0crfAFHf3gVncw`
+- Ableitung: **HKDF-SHA256**(secret, salt=roomId) -> AES-256-GCM-Key.
+  **Kein PBKDF2, kein Stretching.** Slow KDFs existieren nur, um schwache
+  Menschen-Passwörter zu strecken. Das Secret ist zufällig mit voller Entropie, HKDF
+  ist ein einziger HMAC (Mikrosekunden). Das ist dieselbe Logik wie sha256-statt-bcrypt
+  beim Server.
+- **Key genau einmal pro Raum ableiten und den `CryptoKey` cachen.** Nicht pro
+  Nachricht neu ableiten oder importieren.
+- Pro Nachricht: **zufälliger 12-Byte-IV**, dem Ciphertext vorangestellt.
+- Alles über **WebCrypto**, keine Fremdabhängigkeit.
+
+### AAD: senderId gegen Umetikettierung binden (Pflicht)
+
+`senderId` wird vom Server gestempelt und liegt damit **außerhalb** des Ciphertexts.
+Ohne Gegenmaßnahme kann ein bösartiger Relay Alices Ciphertext als Bob weiterreichen.
+Das ist exakt der Angreifer, gegen den dieses Feature gebaut wird.
+
+Deshalb: **AES-GCM mit AAD** verschlüsseln.
+```
+AAD = `${roomId}|${senderId}`     // senderId = eigene peerId beim Verschlüsseln,
+                                  // envelope.senderId beim Entschlüsseln
+```
+Etikettiert der Server um, schlägt die Auth-Tag-Prüfung fehl und die Nachricht wird
+verworfen. Kostet null Performance und bindet die Nachricht zusätzlich an den Raum
+(kein Cross-Room-Replay).
+
+Bewusst **nicht** abgedeckt und akzeptiert: Nachrichtenlängen und Timing bleiben für den
+Server sichtbar (kein Padding). Ein Relay kann eine Nachricht innerhalb desselben Raums
+erneut abspielen. Für das Bedrohungsmodell irrelevant.
+
+### Sanitization wandert auf den Client (Pflicht)
+
+Der Server sieht nur noch Ciphertext und **kann Text nicht mehr prüfen**. Die Bedrohung
+verschwindet dadurch nicht, sie verschiebt sich: entschlüsselter Text stammt von einem
+**Peer, der den Key besitzt**.
+
+- Entschlüsselter Text ist **untrusted input**. Vor dem Rendern zwingend durch
+  `escapeChatHtml`/`formatChatText` (escapen, dann Markdown). Niemals rohes `innerHTML`.
+- Die Längengrenze (500 Codepoints) muss der **Client** durchsetzen, vor dem
+  Verschlüsseln. Der Server kann nur noch Bytes zählen.
+- **Bestehende Schranke beachten:** `maxHttpBufferSize: 4096` (`server/index.js:142`)
+  gilt global pro Socket-Nachricht. Nachgerechnet: 500 Codepoints als 4-Byte-Emoji
+  ergeben 2000 B Klartext, +16 B GCM-Tag +12 B IV = 2028 B, base64 = 2704 Zeichen,
+  socket.io-Frame = **2731 B**. Passt, Headroom 1365 B. Bei 700 Codepoints wären es
+  3799 B. Wer die Zeichengrenze anhebt, muss diese Rechnung neu machen, sonst reißt das
+  Limit.
+
+---
+
+## Link-Format und Abwärtskompatibilität (entschieden)
+
+### Warum das alte Format nicht erweiterbar ist
+
+Aktuell (`popup.js:559-563`):
+```
+offiziell:  #join:<roomId>:<password>
+custom:     #join:<roomId>:<password>:1:<encodedUrl>
+```
+
+Der Extension-Parser (`popup.js:1294-1313`) nimmt `roomId` von vorne, das Paar
+`(flag, url)` von hinten, und **alles dazwischen ist das Passwort** (`parts.join(':')`).
+Es gibt keine Position, die er verwirft. Verifiziert durch Ausführen der echten Parser
+gegen echte Links:
+
+| Link | Alte Extension | Alte Website |
+|---|---|---|
+| `#join:SILENT-EAGLE-90:30PXPD:1:wss%3A%2F%2F…` (Kontrolle) | `password:"30PXPD"` OK | `serverFlag:"1"` OK |
+| Key inline: `…:30PXPD:<KEY>:1:wss%3A%2F%2F…` | `password:"30PXPD:R5Ti1nxp…"` **korrumpiert** | `serverFlag:"R5Ti…"`, `serverUrl:"1"` -> **falscher Server** |
+
+Zwei verschiedene, irreführende Fehler aus derselben Zeile. Deshalb: neues Präfix.
+
+### Neues Format
+
+```
+#j2:r=<roomId>&p=<password>&k=<key>[&u=<encodedRelayUrl>]
+```
+
+- `URLSearchParams`, kein positionales Parsen. Behebt nebenbei einen bestehenden Bug:
+  heute zerschießt ein Doppelpunkt im Passwort den Website-Parser (`parts[2]`), während
+  der Extension-Parser (`parts.join(':')`) damit klarkommt.
+- **`s=1` entfällt.** Es existierte nur wegen des positionalen Parsens. Mit benannten
+  Parametern gilt: `u` vorhanden bedeutet Custom Relay.
+- Das Präfix darf `#join:` **nicht als Teilstring enthalten**, sonst greift
+  `includes('#join:')` in alten Extensions doch.
+
+Beispiele:
+```
+offiziell: …/join.html#j2:r=SAPPHIRE-DUCK-49&p=0XUK3C&k=R5Ti1nxp0crfAFHf3gVncw
+custom:    …/join.html#j2:r=SILENT-EAGLE-90&p=30PXPD&k=R5Ti1nxp0crfAFHf3gVncw
+                          &u=wss%3A%2F%2Fsync.shik3i.net
+```
+
+### Warum das alte Extensions nicht bricht
+
+**Die Website ist der Hauptpfad, nicht die Extension.** `website/app.js:452-458` parst
+das Fragment selbst, prüft via `document.documentElement.dataset.koalasyncInstalled`
+(gesetzt von `bridge.js:9`), ob die Extension da ist, und dispatcht dann automatisch
+(`app.js:515-526`, "AUTO-TRIGGER JOIN") ein `KOALASYNC_JOIN_REQUEST` mit fertig
+geparsten, **strukturierten Feldern**. `bridge.js` reicht es als `WEB_JOIN_REQUEST` an
+den background weiter. In diesem Pfad liest die Extension die URL nie an.
+
+Altes `bridge.js` destrukturiert nur, was es kennt:
+```js
+const { roomId, password, useCustomServer, serverUrl } = e.detail;
+```
+Ein zusätzliches `chatKey` fällt dort stillschweigend auf den Boden.
+
+**Daraus folgt die Deploy-Reihenfolge: Website zuerst.** Sie ist die einzige Stelle, die
+das neue Format kennen muss, und sie ist sofort deploybar. Die Extension darf beliebig
+hinterherhinken (Store-Review, Update-Zyklen der Nutzer).
+
+| Kombination | Ergebnis |
+|---|---|
+| Neue Website + neue Ext | Join + Chat |
+| Neue Website + alte Ext | Join normal, kein Chat, `chatKey` ignoriert |
+| Neue Ext + alter `#join:`-Link | Join, kein Key, Chat aus. Legacy-Parser bleibt erhalten |
+| Alte Website + neuer Link | Präfix unbekannt, Join-Seite tot. **Existiert nach dem Website-Deploy nicht mehr** |
+
+`checkInviteLink()` (`popup.js:1289`) ist nur der Komfort-Pfad "Popup auf der Join-Seite
+öffnen und Felder vorausfüllen". Bei `#j2:` greift er in alten Extensions nicht mehr,
+das Feld bleibt leer statt falsch befüllt. Die neue Extension muss dort **beide**
+Formate parsen (`#j2:` und Legacy `#join:`).
+
+**`history.replaceState` auf das Legacy-Format: nicht tun.** Naheliegende Idee, um das
+Autofill alter Extensions zu retten, aber ein Eigentor: es entfernt `k` aus der
+Adressleiste. Nutzer kopieren die URL aus der Adressleiste, um sie weiterzuteilen. Der
+weitergegebene Link joint dann zwar, hat aber stillschweigend keinen Chat mehr. Der
+Fragment-Inhalt muss unangetastet bleiben.
+
+### Lebenszyklus des Keys
+
+- **Erzeugt wird er vom Raum-Ersteller**, einmal, beim Anlegen des Raums. Er lebt im
+  background neben `roomId`/`password` und geht in den Invite-Link.
+- **Er darf niemals in einem Relay-Payload landen.** Nicht in `join_room`, nirgends.
+  Dafür einen Test schreiben, der alle ausgehenden Events gegen den Key prüft.
+- **Krypto gehört in den background**, nicht in den content script. Der Key wird damit
+  gar nicht erst in den Kontext einer fremden Seite ausgeliefert. Das Overlay schickt
+  Klartext an den background und bekommt Klartext zurück, verschlüsselt wird
+  ausschließlich dort.
+- **Kanten, die korrekt fallen müssen:**
+  - Raum-Ersteller hat eine **alte** Extension: es existiert kein Key, niemand chattet.
+    Korrektes Verhalten, kein Fehlerfall.
+  - Ein Peer mit **alter** Extension teilt den Invite aus seinem eigenen Popup: der Link
+    trägt keinen Key. Wer darüber joint, chattet nicht, während die anderen chatten.
+  - Jemand tippt Raum und Passwort **manuell**: kein Key, kein Chat.
+  - Relay **ohne** Chat-Capability: Chat-UI gar nicht erst anzeigen.
+
+---
+
+## Vorgeschichte
+
+Vorgängerbranch `feature/soonTMChat` (Stand `c706513`) ist **verworfen**, bleibt als
+Referenz liegen. Gründe:
+
+- Chat lag nur im Popup. Ein Chrome-Popup schließt beim Fokusverlust, man kann nicht
+  gleichzeitig Video schauen und chatten. Strukturell unbrauchbar.
+- Der Server speicherte bis zu 500 Klartext-Nachrichten pro Raum und schickte jedem
+  Joiner das Backlog.
+- Verifizierter Folgebug: wer einen Raum mit >120 Nachrichten Historie betrat, wurde
+  **rausgeworfen**. `renderChatHistory()` feuerte eine ungebündelte `chat_read`-Quittung
+  pro Nachricht und riss `CHAT_READ_RATE_LIMIT` (120/10s). Reproduziert bei
+  `CHAT_HISTORY_LIMIT=200`, dokumentiert erlaubt sind 500.
+
+**Lehre: kein ungebündeltes Event-pro-Nachricht-Muster. Jedes Client-Verhalten gegen die
+Rate-Limits gegenrechnen, bevor es eingebaut wird.**
+
+### Wiederverwendbar (per `git checkout feature/soonTMChat -- <pfad>`, kritisch prüfen)
+
+| Datei | Was | Einschränkung |
+|---|---|---|
+| `extension/chat.js` | `escapeChatHtml`, `formatChatText`, `insertEmoji`, `createTypingTracker`, `createRemoteTypingTracker` | reine Funktionen, storage-frei, getestet. `createReceiptTracker` weglassen |
+| `extension/chat.test.mjs` | Unit-Tests | Receipt-Tests weg |
+| `extension/locales/*.json` | `CHAT_*`-Keys, 15 Sprachen | Receipt-Keys weg, neue Keys für Overlay nötig |
+| `server/chat.js` | `sanitizeChatUsername`, `canKickPeer` | `sanitizeChatText`/`createChatMessage` greifen auf Klartext zu, bei E2E unmöglich. `parseChatHistoryLimit`, `appendChatHistory`, `canRelayReadReceipt` entfallen |
+| `server/rate-limiter.js` | `checkChatMessageRate` (10/10s) | `checkChatReadRate` entfällt |
+| `shared/constants.js` | `CAPABILITIES.CHAT`, Event-Namen | **muss neu hinzu.** main kennt nur `HOST_CONTROL` und `CO_HOST` (`shared/constants.js:78`, `server/index.js:174`) |
+
+**Server-Design, das überleben soll:** Der Server vergab Message-ID, `senderId` und
+`timestamp` selbst und ignorierte Client-Angaben (Spoofing-Schutz). Bleibt richtig, auch
+wenn der Text jetzt Ciphertext ist.
+
+---
+
+## Technische Randbedingungen
+
+### Overlay-Kontext
+
+- `content.js` wird **programmatisch** injiziert:
+  `chrome.scripting.executeScript({ target: {tabId}, files: ['content.js'] })`
+  (`background.js:1775`). Nicht über `manifest.content_scripts`, dort steht nur
+  `bridge.js` für `https://sync.koalastuff.net/*`.
+- `host_permissions: ["<all_urls>"]`, MV3.
+- Das Overlay lebt im DOM fremder Seiten (Netflix, YouTube, Emby, Jellyfin).
+  **Shadow DOM ist Pflicht**, sonst bluten fremde Styles rein und umgekehrt.
+- Die Theme-Variablen aus `popup.html` existieren im Page-Kontext **nicht** und müssen
+  in den Shadow Root injiziert werden.
+- **Risiko, vorab prüfen:** Netflix-Vollbild ist ein eigener Fullscreen-Element-Kontext.
+  Ein Overlay im normalen DOM verschwindet dort möglicherweise. Das kann die
+  Positionierung grundlegend beeinflussen.
+
+### Performance auf der Host-Seite
+
+Das Video ist das Produkt, der Chat ist Beiwerk. Ein Overlay, das die Wiedergabe ruckeln
+lässt, ist schlechter als kein Overlay.
+
+- Nur im **Ziel-Tab** injizieren (`currentTabId` im background), nicht auf jeder Seite.
+- `position: fixed`, eigener Compositing-Layer, **kein Eingriff in das Layout der
+  Host-Seite**. Kein Layout-Thrashing, keine erzwungenen Reflows während der Wiedergabe.
+- Nachrichtenliste beim Rendern nicht unbegrenzt wachsen lassen (DOM-Knoten deckeln).
+
+### Firefox
+
+`scripts/build-extension.cjs:199` baut ein eigenes **Firefox-Target**, und `bridge.js`
+enthält bereits Firefox-spezifisches `cloneInto`-Handling für CustomEvent-Details
+(isolierte Welten in FF MV3). Overlay, Shadow DOM und WebCrypto müssen dort ebenfalls
+laufen. Neue Website-zu-Extension-Felder (`chatKey`) gehen durch dieselbe
+`cloneInto`-Stelle.
+
+### Theme-System (aus `main`, verbindlich)
+
+- `extension/theme-init.js` setzt auf `<html>`: `data-theme` (`light`/`dark`),
+  `data-palette` (`eucalyptus`/`cyber`/`graphite`), Klasse `theme-light`.
+- Quelle: `chrome.storage.local`, Keys `themeMode` und `themePalette`, plus
+  `chrome.storage.onChanged` für Live-Updates. Das Overlay nutzt denselben Mechanismus
+  im Shadow Root.
+- **Kein `prefers-color-scheme`** für Theme-Farben. Das System ist explizit, nur der
+  Modus `system` liest die OS-Präferenz und das erledigt `theme-init.js`.
+- Tokens: `--bg`, `--card`, `--surface-alt`, `--surface-deep`, `--accent`, `--text`,
+  `--text-muted`, `--border-soft`, `--border-strong`, `--text-on-green`.
+  Text auf `--accent` immer `--text-on-green`, nie `white`.
+- Getönte `oklch`-Schatten sind pro Palette hartcodiert und brauchen
+  `html[data-palette=...]`-Overrides. Neutrale Schwarz-Alpha-Schatten sind
+  palettenunabhängig und der einfachere Weg.
+- Bekannte Alt-Last, nicht Aufgabe dieses Branches: `--text-on-green` auf `--accent`
+  erreicht in eucalyptus/light 3.76 und cyber/dark 4.24, unter WCAG AA.
+
+### Qualitäts-Gates
+
+- `npm run lint`, `npx vitest run`, `npm run verify` müssen grün sein.
+- i18n: alle 15 Sprachen in `extension/locales/`, `en` ist Baseline-Fallback. Keine
+  hartcodierten UI-Strings, `getMessage(key, { placeholder })` aus `i18n.js`.
+- Bei einem Release-Tag: Eintrag in `docs/CHANGELOG.md`.
+- Keine Em-Dashes in nutzersichtbaren Texten.
+
+---
+
+## Offene Punkte (mit dem Nutzer klären, nicht selbst entscheiden)
+
+1. **Overlay-Positionierung**: fest andockbar rechts/links, oder frei verschiebbar?
+   Position pro Seite in `chrome.storage.local` merken? Verhalten im Vollbild?
+2. **Peers ohne Key**: Chat-UI ganz ausblenden mit Hinweis, oder anzeigen und
+   Nachrichten als "nicht lesbar" markieren? (Die Fälle, in denen das eintritt, stehen
+   oben unter Lebenszyklus.)
+3. **Metadaten**: Username bleibt heute für den Server sichtbar (er sanitized ihn).
+   Mitverschlüsseln? Typing-Indikatoren verraten dem Server, wer wann aktiv ist.
+   Behalten, verschlüsseln oder streichen?
+4. **Kick-Funktion**: `canKickPeer` existiert (Host/Controller-Rechte). Behalten?
+5. **Nachrichtenlängen-Limit**: 500 Codepoints beibehalten, oder angesichts des
+   4096-B-Frames anders wählen?
+
+---
+
+## Vorgehen
+
+1. Offene Punkte klären.
+2. Krypto- und Linkformat-Design in `docs/CHAT.md` festhalten. Das bestehende Dokument
+   beschreibt das verworfene Konzept und wird neu geschrieben. Chat-Events in
+   `docs/PROTOCOL.md` ergänzen.
+3. Website-Parser (`#j2:`, Legacy `#join:` weiter unterstützen) und Bridge-Feld
+   `chatKey` zuerst, weil davon die Abwärtskompatibilität hängt.
+4. Dann Relay (reines Relay ohne Storage), dann Krypto im background, dann Overlay, dann
+   i18n, dann Tests.
+5. **Verifizieren, nicht annehmen:**
+   - Overlay auf mindestens zwei echten Seiten in allen 6 Theme-Kombinationen, nicht nur
+     in einer isolierten HTML-Datei.
+   - Chrome **und** Firefox-Build.
+   - Ein Test, der beweist, dass der Key in keinem ausgehenden Relay-Payload vorkommt.
+   - Ein Test, der eine umetikettierte Nachricht (fremde `senderId`) als ungültig
+     zurückweist (AAD-Bindung).
+   - Alte Extension gegen neue Website: Join funktioniert weiter, Chat ist stumm.

docs/devops.md

@@ -24,7 +24,7 @@ When you push a Git tag matching `v*` (e.g., `v2.5.1`), the GitHub Actions relea
    - `README.md` (updates badge and announcement banner)
    - `website/sitemap.xml` (updates `lastmod` dates)
 3. **Commits and pushes** these version updates back to the `main` branch automatically with the commit message `chore(release): update versions to vX.X.X [skip ci]`.
-4. **Builds the extension** for both Chrome and Firefox and publishes the zipped archives.
+4. **Builds the extension** for both Chrome and Firefox and publishes the zipped archives with a `SHA256SUMS` checksum file and signed provenance attestations.
 5. **Builds the website** and uploads website artifacts.
 6. **Builds and publishes** the Docker image for the relay server to the GitHub Container Registry (`ghcr.io`).
 

examples/Caddyfile.example

@@ -96,4 +96,3 @@ syncserver.koalastuff.net {
 	encode zstd gzip
 	reverse_proxy KoalaSync:3000
 }
-

extension/_locales/de/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Synchronisiere die Videowiedergabe auf YouTube, Netflix, Emby, Jellyfin und jeder HTML5-Seite in Echtzeit mit Freunden."
+    "message": "Erstelle private Watch Partys und synchronisiere Videos mit Freunden auf YouTube, Netflix, Jellyfin, Emby und fast jeder Website."
   }
 }

extension/_locales/en/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Synchronize video playback on YouTube, Netflix, Emby, Jellyfin, and any HTML5 site in real-time with friends."
+    "message": "Create private watch parties and sync videos with friends on YouTube, Netflix, Jellyfin, Emby, and almost any HTML5 website."
   }
 }

extension/_locales/es/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Mira videos junto a tus amigos en perfecta sincronización. Compatible con Netflix, YouTube, Twitch, Prime Video, Disney+ y cualquier reproductor HTML5."
+    "message": "Crea fiestas privadas y sincroniza vídeos con amigos en YouTube, Netflix, Jellyfin, Emby y casi cualquier sitio HTML5."
   }
 }

extension/_locales/fr/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Synchronisez la lecture vidéo sur YouTube, Netflix, Emby, Jellyfin et tout site HTML5 en temps réel avec vos amis."
+    "message": "Créez des watch parties privées et regardez en synchro entre amis sur YouTube, Netflix, Jellyfin, Emby et presque tout site HTML5."
   }
 }

extension/_locales/it/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Sincronizza la riproduzione video su YouTube, Netflix, Emby, Jellyfin e qualsiasi sito HTML5 in tempo reale con gli amici."
+    "message": "Crea watch party private e sincronizza i video con gli amici su YouTube, Netflix, Jellyfin, Emby e quasi ogni sito HTML5."
   }
 }

extension/_locales/ja/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "YouTube、Netflix、Emby、Jellyfin、その他HTML5サイトでの動画再生を友達とリアルタイムで同期します。"
+    "message": "プライベートなウォッチパーティーを作成し、YouTube、Netflix、Jellyfin、EmbyやほぼすべてのHTML5サイトで友達と動画を同期再生できます。"
   }
 }

extension/_locales/ko/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "YouTube, Netflix, Emby, Jellyfin 및 모든 HTML5 사이트에서 친구들과 실시간으로 비디오 재생을 동기화하세요."
+    "message": "비공개 Watch Party를 만들고 YouTube, Netflix, Jellyfin, Emby 및 거의 모든 HTML5 사이트에서 친구들과 영상을 동기화하세요."
   }
 }

extension/_locales/nl/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Synchroniseer video-afspelen op YouTube, Netflix, Emby, Jellyfin en elke HTML5-site in realtime met vrienden."
+    "message": "Maak privéwatchparty's en kijk synchroon met vrienden op YouTube, Netflix, Jellyfin, Emby en vrijwel elke HTML5-website."
   }
 }

extension/_locales/pl/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Synchronizuj odtwarzanie wideo na YouTube, Netflix, Emby, Jellyfin i dowolnej stronie HTML5 w czasie rzeczywistym ze znajomymi."
+    "message": "Twórz prywatne wspólne seanse i synchronizuj filmy ze znajomymi na YouTube, Netflix, Jellyfin, Emby i niemal każdej stronie HTML5."
   }
 }

extension/_locales/pt_BR/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Assista a vídeos junto com seus amigos em sincronia perfeita. Compatível com Netflix, YouTube, Twitch, Prime Video, Disney+ e qualquer player HTML5."
+    "message": "Crie watch parties privadas e sincronize vídeos com amigos no YouTube, Netflix, Jellyfin, Emby e em quase qualquer site HTML5."
   }
 }

extension/_locales/pt_PT/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Veja vídeos em conjunto com os seus amigos em sincronia perfeita. Compatível com Netflix, YouTube, Twitch, Prime Video, Disney+ e qualquer leitor HTML5."
+    "message": "Crie sessões privadas e veja vídeos sincronizados com amigos no YouTube, Netflix, Jellyfin, Emby e em quase qualquer site HTML5."
   }
 }

extension/_locales/ru/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Синхронизируйте воспроизведение видео на YouTube, Netflix, Emby, Jellyfin и любых HTML5-сайтах в реальном времени с друзьями."
+    "message": "Создавайте закрытые Watch Party и смотрите синхронно с друзьями на YouTube, Netflix, Jellyfin, Emby и почти любом сайте HTML5."
   }
 }

extension/_locales/tr/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "YouTube, Netflix, Emby, Jellyfin ve herhangi bir HTML5 sitesinde video oynatmayı arkadaşlarınızla gerçek zamanlı olarak senkronize edin."
+    "message": "Özel izleme partileri kurun; YouTube, Netflix, Jellyfin, Emby ve çoğu HTML5 sitesinde arkadaşlarınızla senkron izleyin."
   }
 }

extension/_locales/uk/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "Синхронізуйте відтворення відео на YouTube, Netflix, Emby, Jellyfin і будь-якому сайті HTML5 у режимі реального часу з друзями."
+    "message": "Створюйте закриті Watch Party й дивіться синхронно з друзями на YouTube, Netflix, Jellyfin, Emby та майже будь-якому сайті HTML5."
   }
 }

extension/_locales/zh_CN/messages.json

@@ -1,8 +1,8 @@
 {
   "appName": {
-    "message": "KoalaSync"
+    "message": "Watch Party - KoalaSync"
   },
   "appDesc": {
-    "message": "与朋友实时同步YouTube、Netflix、Emby、Jellyfin和任何HTML5网站上的视频播放。"
+    "message": "创建私人观影派对，与好友在 YouTube、Netflix、Jellyfin、Emby 及几乎任何 HTML5 视频网站同步观看。"
   }
 }

extension/bridge.js

@@ -11,11 +11,12 @@ document.documentElement.dataset.koalasyncInstalled = 'true';
 // 2. Listen for Join Requests from the Website
 window.addEventListener('KOALASYNC_JOIN_REQUEST', (e) => {
     if (!e || !e.detail) return;
-    const { roomId, password, useCustomServer, serverUrl } = e.detail;
+    const { roomId, password, chatKey, useCustomServer, serverUrl } = e.detail;
     chrome.runtime.sendMessage({ 
         type: 'WEB_JOIN_REQUEST', 
         roomId, 
         password,
+        chatKey,
         useCustomServer,
         serverUrl
     }).catch(() => {});

extension/chat-activity.js

@@ -0,0 +1,57 @@
+const ALLOWED_ACTIONS = new Set([
+    'play',
+    'pause',
+    'seek',
+    'force_sync_prepare',
+    'force_sync_execute',
+    'joined',
+    'left'
+]);
+
+export function createChatActivityStore(limit = 100) {
+    const maxEntries = Number.isInteger(limit) && limit > 0 ? limit : 100;
+    let entries = [];
+
+    function normalize(value) {
+        if (!value || !ALLOWED_ACTIONS.has(value.action) || typeof value.senderId !== 'string' || !value.senderId) {
+            return null;
+        }
+        const timestamp = Number(value.timestamp);
+        if (!Number.isFinite(timestamp)) return null;
+        const id = typeof value.id === 'string' && value.id
+            ? value.id
+            : `${value.action}:${value.senderId}:${timestamp}`;
+        return {
+            id,
+            action: value.action,
+            senderId: value.senderId,
+            username: typeof value.username === 'string' ? value.username : '',
+            timestamp
+        };
+    }
+
+    return {
+        add(value) {
+            const entry = normalize(value);
+            if (!entry || entries.some(candidate => candidate.id === entry.id)) return null;
+            entries.push(entry);
+            if (entries.length > maxEntries) entries = entries.slice(-maxEntries);
+            return { ...entry };
+        },
+        clear() {
+            entries = [];
+        },
+        restore(values) {
+            entries = [];
+            for (const value of Array.isArray(values) ? values : []) {
+                const entry = normalize(value);
+                if (!entry || entries.some(candidate => candidate.id === entry.id)) continue;
+                entries.push(entry);
+            }
+            entries = entries.slice(-maxEntries);
+        },
+        snapshot() {
+            return entries.map(entry => ({ ...entry }));
+        }
+    };
+}

extension/chat-activity.test.mjs

@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest';
+import { createChatActivityStore } from './chat-activity.js';
+
+describe('chat activity store', () => {
+    it('deduplicates commands and retains only the newest bounded entries', () => {
+        const store = createChatActivityStore(2);
+        expect(store.add({ action: 'play', senderId: 'a', timestamp: 1 })).toMatchObject({ id: 'play:a:1' });
+        expect(store.add({ action: 'play', senderId: 'a', timestamp: 1 })).toBeNull();
+        store.add({ action: 'pause', senderId: 'b', username: 'Bear', timestamp: 2 });
+        store.add({ action: 'seek', senderId: 'a', timestamp: 3 });
+
+        expect(store.snapshot()).toEqual([
+            { id: 'pause:b:2', action: 'pause', senderId: 'b', username: 'Bear', timestamp: 2 },
+            { id: 'seek:a:3', action: 'seek', senderId: 'a', username: '', timestamp: 3 }
+        ]);
+    });
+
+    it('restores only valid activity without sharing mutable references', () => {
+        const store = createChatActivityStore();
+        store.restore([
+            { id: 'joined:b:4', action: 'joined', senderId: 'b', username: 'Koala', timestamp: 4 },
+            { action: 'unknown', senderId: 'b', timestamp: 5 },
+            { action: 'left', senderId: '', timestamp: 6 }
+        ]);
+
+        const snapshot = store.snapshot();
+        snapshot[0].username = 'Changed';
+        expect(store.snapshot()).toEqual([
+            { id: 'joined:b:4', action: 'joined', senderId: 'b', username: 'Koala', timestamp: 4 }
+        ]);
+    });
+});

extension/chat-crypto.js

@@ -0,0 +1,122 @@
+const CHAT_INFO = 'KoalaSync E2E Chat v1';
+const SECRET_BYTES = 16;
+const IV_BYTES = 12;
+const MIN_ENCRYPTED_BYTES = 29;
+const MAX_ENCRYPTED_BYTES = 2028;
+
+let cachedKeyPromise = null;
+let cachedRoomId = '';
+let cachedSecret = '';
+let cacheGeneration = 0;
+
+function bytesToBase64Url(bytes) {
+    let binary = '';
+    for (const byte of bytes) binary += String.fromCharCode(byte);
+    return globalThis.btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+
+function base64UrlToBytes(value) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1) return null;
+    const padded = value.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - value.length % 4) % 4);
+    try {
+        const binary = globalThis.atob(padded);
+        const bytes = Uint8Array.from(binary, char => char.charCodeAt(0));
+        return bytesToBase64Url(bytes) === value ? bytes : null;
+    } catch (_) {
+        return null;
+    }
+}
+
+export function generateChatSecret(cryptoImpl = globalThis.crypto) {
+    const bytes = new Uint8Array(SECRET_BYTES);
+    cryptoImpl.getRandomValues(bytes);
+    return bytesToBase64Url(bytes);
+}
+
+export function validateChatSecret(value) {
+    const bytes = base64UrlToBytes(value);
+    return bytes?.length === SECRET_BYTES ? value : '';
+}
+
+export function countCodePoints(value) {
+    return [...String(value ?? '')].length;
+}
+
+export function normalizeOutgoingChatText(value) {
+    if (typeof value !== 'string') throw new TypeError('Chat message must be text');
+    const text = value.trim();
+    if (!text) throw new TypeError('Chat message must not be empty');
+    if (countCodePoints(text) > 500) throw new RangeError('Chat message exceeds 500 Unicode code points');
+    return text;
+}
+
+export function clearChatKeyCache() {
+    cacheGeneration++;
+    cachedKeyPromise = null;
+    cachedRoomId = '';
+    cachedSecret = '';
+}
+
+export async function deriveChatKey(roomId, secret, cryptoImpl = globalThis.crypto) {
+    const validSecret = validateChatSecret(secret);
+    if (!roomId || !validSecret) throw new TypeError('Valid roomId and chat secret are required');
+    if (cachedKeyPromise && cachedRoomId === roomId && cachedSecret === validSecret) return cachedKeyPromise;
+
+    const encoder = new globalThis.TextEncoder();
+    const generation = cacheGeneration;
+    const keyPromise = (async () => {
+        const material = await cryptoImpl.subtle.importKey(
+            'raw', base64UrlToBytes(validSecret), { name: 'HKDF' }, false, ['deriveKey']
+        );
+        return cryptoImpl.subtle.deriveKey({
+            name: 'HKDF',
+            hash: 'SHA-256',
+            salt: encoder.encode(roomId),
+            info: encoder.encode(CHAT_INFO)
+        }, material, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+    })();
+    cachedKeyPromise = keyPromise;
+    cachedRoomId = roomId;
+    cachedSecret = validSecret;
+    try {
+        return await keyPromise;
+    } catch (error) {
+        if (generation === cacheGeneration && cachedKeyPromise === keyPromise) clearChatKeyCache();
+        throw error;
+    }
+}
+
+export async function encryptChatMessage({ text, roomId, senderId, secret }, cryptoImpl = globalThis.crypto) {
+    const plaintext = normalizeOutgoingChatText(text);
+    if (!senderId) throw new TypeError('senderId is required');
+    const key = await deriveChatKey(roomId, secret, cryptoImpl);
+    const encoder = new globalThis.TextEncoder();
+    const iv = new Uint8Array(IV_BYTES);
+    cryptoImpl.getRandomValues(iv);
+    const encrypted = new Uint8Array(await cryptoImpl.subtle.encrypt({
+        name: 'AES-GCM',
+        iv,
+        additionalData: encoder.encode(`${roomId}|${senderId}`)
+    }, key, encoder.encode(plaintext)));
+    const envelope = new Uint8Array(iv.length + encrypted.length);
+    envelope.set(iv);
+    envelope.set(encrypted, iv.length);
+    return bytesToBase64Url(envelope);
+}
+
+export async function decryptChatMessage({ ciphertext, roomId, senderId, secret }, cryptoImpl = globalThis.crypto) {
+    if (!senderId) throw new TypeError('senderId is required');
+    const bytes = base64UrlToBytes(ciphertext);
+    if (!bytes || bytes.length < MIN_ENCRYPTED_BYTES || bytes.length > MAX_ENCRYPTED_BYTES) {
+        throw new TypeError('Invalid chat ciphertext');
+    }
+    const key = await deriveChatKey(roomId, secret, cryptoImpl);
+    const encoder = new globalThis.TextEncoder();
+    const plaintext = await cryptoImpl.subtle.decrypt({
+        name: 'AES-GCM',
+        iv: bytes.slice(0, IV_BYTES),
+        additionalData: encoder.encode(`${roomId}|${senderId}`)
+    }, key, bytes.slice(IV_BYTES));
+    const text = new globalThis.TextDecoder('utf-8', { fatal: true }).decode(plaintext);
+    return normalizeOutgoingChatText(text);
+}

extension/chat-crypto.test.mjs

@@ -0,0 +1,114 @@
+import { webcrypto } from 'node:crypto';
+import { Buffer } from 'node:buffer';
+import { afterEach, describe, expect, it } from 'vitest';
+import {
+    clearChatKeyCache,
+    countCodePoints,
+    decryptChatMessage,
+    deriveChatKey,
+    encryptChatMessage,
+    generateChatSecret,
+    normalizeOutgoingChatText,
+    validateChatSecret
+} from './chat-crypto.js';
+
+afterEach(clearChatKeyCache);
+
+describe('chat crypto', () => {
+    it('generates canonical 128-bit secrets', () => {
+        const secret = generateChatSecret(webcrypto);
+        expect(secret).toMatch(/^[A-Za-z0-9_-]{22}$/);
+        expect(validateChatSecret(secret)).toBe(secret);
+        expect(validateChatSecret(`${secret}=`)).toBe('');
+    });
+
+    it('round-trips Unicode with a cached room key and fresh IVs', async () => {
+        const secret = generateChatSecret(webcrypto);
+        const firstKey = await deriveChatKey('ROOM-1', secret, webcrypto);
+        const secondKey = await deriveChatKey('ROOM-1', secret, webcrypto);
+        expect(secondKey).toBe(firstKey);
+
+        const input = { text: 'Hello 🐨 **world**', roomId: 'ROOM-1', senderId: 'alice', secret };
+        const first = await encryptChatMessage(input, webcrypto);
+        const second = await encryptChatMessage(input, webcrypto);
+        expect(second).not.toBe(first);
+        await expect(decryptChatMessage({ ciphertext: first, ...input }, webcrypto)).resolves.toBe(input.text);
+    });
+
+    it('deduplicates in-flight key derivations without restoring a cleared cache', async () => {
+        const secret = generateChatSecret(webcrypto);
+        let deriveCalls = 0;
+        let releaseDerive;
+        const delayedCrypto = {
+            ...webcrypto,
+            subtle: {
+                importKey: (...args) => webcrypto.subtle.importKey(...args),
+                deriveKey: async (...args) => {
+                    deriveCalls++;
+                    await new Promise(resolve => { releaseDerive = resolve; });
+                    return webcrypto.subtle.deriveKey(...args);
+                }
+            }
+        };
+        const first = deriveChatKey('ROOM-1', secret, delayedCrypto);
+        const second = deriveChatKey('ROOM-1', secret, delayedCrypto);
+        await Promise.resolve();
+        expect(deriveCalls).toBe(1);
+        clearChatKeyCache();
+        releaseDerive();
+        await Promise.all([first, second]);
+        const fresh = deriveChatKey('ROOM-1', secret, webcrypto);
+        expect(fresh).not.toBe(first);
+        await fresh;
+    });
+
+    it('rejects relabeling, cross-room replay, and the wrong secret', async () => {
+        const secret = generateChatSecret(webcrypto);
+        const ciphertext = await encryptChatMessage({ text: 'secret', roomId: 'ROOM-1', senderId: 'alice', secret }, webcrypto);
+        clearChatKeyCache();
+        await expect(decryptChatMessage({ ciphertext, roomId: 'ROOM-1', senderId: 'bob', secret }, webcrypto)).rejects.toThrow();
+        clearChatKeyCache();
+        await expect(decryptChatMessage({ ciphertext, roomId: 'ROOM-2', senderId: 'alice', secret }, webcrypto)).rejects.toThrow();
+        clearChatKeyCache();
+        await expect(decryptChatMessage({ ciphertext, roomId: 'ROOM-1', senderId: 'alice', secret: generateChatSecret(webcrypto) }, webcrypto)).rejects.toThrow();
+    });
+
+    it('enforces 500 Unicode code points before encryption', () => {
+        expect(countCodePoints('😀'.repeat(500))).toBe(500);
+        expect(normalizeOutgoingChatText(`  ${'😀'.repeat(500)}  `)).toBe('😀'.repeat(500));
+        expect(() => normalizeOutgoingChatText('😀'.repeat(501))).toThrow(RangeError);
+        expect(() => normalizeOutgoingChatText('   ')).toThrow(TypeError);
+    });
+
+    it('keeps the worst-case 500-codepoint payload within the relay byte bound', async () => {
+        const secret = generateChatSecret(webcrypto);
+        const ciphertext = await encryptChatMessage({
+            text: '😀'.repeat(500), roomId: 'ROOM-1', senderId: 'alice', secret
+        }, webcrypto);
+        const bytes = Buffer.from(ciphertext, 'base64url');
+        expect(bytes).toHaveLength(2028);
+    });
+
+    it('rejects non-canonical plaintext and malformed UTF-8 after authentication', async () => {
+        const secret = generateChatSecret(webcrypto);
+        const roomId = 'ROOM-1';
+        const senderId = 'alice';
+        const key = await deriveChatKey(roomId, secret, webcrypto);
+        const encoder = new globalThis.TextEncoder();
+
+        async function encryptRaw(plaintext) {
+            const iv = webcrypto.getRandomValues(new Uint8Array(12));
+            const encrypted = new Uint8Array(await webcrypto.subtle.encrypt({
+                name: 'AES-GCM',
+                iv,
+                additionalData: encoder.encode(`${roomId}|${senderId}`)
+            }, key, plaintext));
+            return Buffer.concat([Buffer.from(iv), Buffer.from(encrypted)]).toString('base64url');
+        }
+
+        const whitespace = await encryptRaw(encoder.encode('   '));
+        await expect(decryptChatMessage({ ciphertext: whitespace, roomId, senderId, secret }, webcrypto)).rejects.toThrow(TypeError);
+        const malformed = await encryptRaw(Uint8Array.of(0xff));
+        await expect(decryptChatMessage({ ciphertext: malformed, roomId, senderId, secret }, webcrypto)).rejects.toThrow();
+    });
+});

extension/chat-format.js

@@ -0,0 +1,69 @@
+(function exposeChatFormat(root) {
+    function escapeChatHtml(value) {
+        return String(value ?? '')
+            .replace(/&/g, '&')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#039;');
+    }
+
+    function formatChatText(value) {
+        return escapeChatHtml(value)
+            .replace(/\*\*([^*\n]+)\*\*/g, '<strong>$1</strong>')
+            .replace(/\*([^*\n]+)\*/g, '<em>$1</em>');
+    }
+
+    function tokenizeChatText(value) {
+        const text = String(value ?? '');
+        const tokens = [];
+        const pattern = /\*\*([^*\n]+)\*\*|\*([^*\n]+)\*/g;
+        let cursor = 0;
+        let match;
+        while ((match = pattern.exec(text)) !== null) {
+            if (match.index > cursor) tokens.push({ type: 'text', text: text.slice(cursor, match.index) });
+            tokens.push({ type: match[1] !== undefined ? 'strong' : 'em', text: match[1] ?? match[2] });
+            cursor = pattern.lastIndex;
+        }
+        if (cursor < text.length) tokens.push({ type: 'text', text: text.slice(cursor) });
+        return tokens;
+    }
+
+    function splitChatText(value, maxCodePoints = 500, maxChunks = 10) {
+        if (!Number.isInteger(maxCodePoints) || maxCodePoints < 1 || !Number.isInteger(maxChunks) || maxChunks < 1) {
+            throw new TypeError('Chat chunk limits must be positive integers');
+        }
+        let remaining = [...String(value ?? '').trim()];
+        if (remaining.length === 0) return [];
+        if (remaining.length > maxCodePoints * maxChunks) {
+            throw new RangeError('Chat composer text exceeds the chunk limit');
+        }
+
+        const chunks = [];
+        while (remaining.length > 0) {
+            if (remaining.length <= maxCodePoints) {
+                chunks.push(remaining.join('').trim());
+                break;
+            }
+
+            const remainingSlots = maxChunks - chunks.length;
+            const minimumSplit = Math.max(1, remaining.length - (remainingSlots - 1) * maxCodePoints);
+            let splitAt = maxCodePoints;
+            for (let index = maxCodePoints - 1; index >= minimumSplit; index--) {
+                if (/\s/u.test(remaining[index])) {
+                    splitAt = index;
+                    break;
+                }
+            }
+
+            const chunk = remaining.slice(0, splitAt).join('').trim();
+            remaining = remaining.slice(splitAt);
+            while (remaining.length > 0 && /\s/u.test(remaining[0])) remaining.shift();
+            if (chunk) chunks.push(chunk);
+        }
+
+        return chunks;
+    }
+
+    root.KoalaSyncChatFormat = Object.freeze({ escapeChatHtml, formatChatText, tokenizeChatText, splitChatText });
+})(globalThis);

extension/chat-format.test.mjs

@@ -0,0 +1,43 @@
+import { beforeAll, describe, expect, it } from 'vitest';
+
+beforeAll(async () => {
+    await import('./chat-format.js');
+});
+
+describe('chat formatting', () => {
+    it('escapes executable HTML before applying limited Markdown', () => {
+        const result = globalThis.KoalaSyncChatFormat.formatChatText('<img src=x onerror=alert(1)> **bold** *italic*');
+        expect(result).toBe('&lt;img src=x onerror=alert(1)&gt; <strong>bold</strong> <em>italic</em>');
+        expect(result).not.toContain('<img');
+    });
+
+    it('tokenizes only text, strong, and emphasis nodes', () => {
+        expect(globalThis.KoalaSyncChatFormat.tokenizeChatText('<script>x</script> **bold** *italic*')).toEqual([
+            { type: 'text', text: '<script>x</script> ' },
+            { type: 'strong', text: 'bold' },
+            { type: 'text', text: ' ' },
+            { type: 'em', text: 'italic' }
+        ]);
+    });
+
+    it('splits up to 5000 Unicode code points into at most ten ordered chat-v1 messages', () => {
+        const split = globalThis.KoalaSyncChatFormat.splitChatText;
+        expect(split('hello world', 500, 10)).toEqual(['hello world']);
+
+        const emojiChunks = split('😀'.repeat(1001), 500, 10);
+        expect(emojiChunks.map(chunk => [...chunk].length)).toEqual([500, 500, 1]);
+
+        const maximumChunks = split('x'.repeat(5000), 500, 10);
+        expect(maximumChunks).toHaveLength(10);
+        expect(maximumChunks.every(chunk => [...chunk].length === 500)).toBe(true);
+        expect(maximumChunks.join('')).toBe('x'.repeat(5000));
+
+        expect(() => split('x'.repeat(5001), 500, 10)).toThrow(RangeError);
+    });
+
+    it('prefers whitespace boundaries without creating more chunks than the limit allows', () => {
+        const split = globalThis.KoalaSyncChatFormat.splitChatText;
+        const chunks = split(`${'a'.repeat(420)} ${'b'.repeat(179)}`, 500, 10);
+        expect(chunks).toEqual(['a'.repeat(420), 'b'.repeat(179)]);
+    });
+});

extension/chat-overlay-contract.test.mjs

@@ -0,0 +1,215 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+
+const extensionDir = path.dirname(fileURLToPath(import.meta.url));
+const overlaySource = fs.readFileSync(path.join(extensionDir, 'chat-overlay.js'), 'utf8');
+const backgroundSource = fs.readFileSync(path.join(extensionDir, 'background.js'), 'utf8');
+const popupSource = fs.readFileSync(path.join(extensionDir, 'popup.js'), 'utf8');
+const manifestSource = fs.readFileSync(path.join(extensionDir, 'manifest.base.json'), 'utf8');
+const buildSource = fs.readFileSync(path.join(extensionDir, '..', 'scripts', 'build-extension.cjs'), 'utf8');
+const localeDir = path.join(extensionDir, 'locales');
+const chatKeys = [
+    'LABEL_CHAT_ENABLED',
+    'LABEL_CHAT_ENABLED_TOOLTIP',
+    'CHAT_TITLE',
+    'CHAT_LIVE_ONLY',
+    'CHAT_OPEN',
+    'CHAT_CLOSE',
+    'CHAT_DOCK_LEFT',
+    'CHAT_DOCK_RIGHT',
+    'CHAT_DETACHED',
+    'CHAT_PLACEHOLDER',
+    'CHAT_SEND',
+    'CHAT_MISSING_KEY',
+    'CHAT_TOO_LONG',
+    'CHAT_SEND_FAILED',
+    'CHAT_EMPTY',
+    'LABEL_CHAT_REACTION_DISPLAY',
+    'LABEL_CHAT_REACTION_DISPLAY_TOOLTIP',
+    'OPTION_CHAT_REACTIONS_CHAT',
+    'OPTION_CHAT_REACTIONS_VIDEO',
+    'CHAT_QUICK_REACTIONS'
+];
+
+describe('chat overlay contract', () => {
+    it('skips SVG and other non-HTML documents before creating the overlay host', () => {
+        const documentGuard = "document.documentElement?.namespaceURI !== 'http://www.w3.org/1999/xhtml'";
+        expect(overlaySource).toContain(documentGuard);
+        expect(overlaySource.indexOf(documentGuard)).toBeLessThan(overlaySource.indexOf("document.createElement('div')"));
+        expect(() => vm.runInNewContext(overlaySource, {
+            document: { documentElement: { namespaceURI: 'http://www.w3.org/2000/svg' } }
+        })).not.toThrow();
+    });
+
+    it('isolates the overlay and never renders markup as HTML', () => {
+        expect(overlaySource).toContain("attachShadow({ mode: 'open' })");
+        expect(overlaySource).not.toMatch(/\.innerHTML\s*=|insertAdjacentHTML|\.outerHTML\s*=/);
+        expect(overlaySource).toContain('document.createTextNode(token.text)');
+    });
+
+    it('injects formatting and overlay code only with the selected-tab content script', () => {
+        expect(backgroundSource).toContain("files: ['chat-format.js', 'chat-overlay.js', 'content.js']");
+        expect(overlaySource).toContain("const storageKey = `chatOverlayLayout:${location.origin}`");
+        expect(overlaySource).toContain('document.fullscreenElement || document.documentElement');
+    });
+
+    it('supports all layout and theme combinations with bounded message DOM', () => {
+        expect(overlaySource).toContain("['left', 'right', 'detached']");
+        expect(overlaySource).toContain('!layout.detachedInitialized');
+        expect(overlaySource).toContain('const rect = panel.getBoundingClientRect()');
+        expect(overlaySource).not.toContain('contentRect');
+        expect(overlaySource).toContain("#app[data-palette=\"cyber\"][data-theme=\"light\"]");
+        expect(overlaySource).toContain("#app[data-palette=\"graphite\"][data-theme=\"light\"]");
+        expect(overlaySource).toContain('const MAX_MESSAGES = 200');
+        expect(overlaySource).toContain('while (messages.querySelectorAll(\'.message\').length > MAX_MESSAGES)');
+        expect(overlaySource).toContain('Math.max(1, window.innerWidth)');
+        expect(overlaySource).toContain('min(${MIN_WIDTH}px, calc(100vw - 16px))');
+    });
+
+    it('blocks page playback shortcuts while the chat composer owns keyboard input', () => {
+        expect(overlaySource).toContain("for (const eventName of ['keydown', 'keyup', 'keypress'])");
+        expect(overlaySource).toContain('window.addEventListener(eventName, stopPageKeyboardShortcut, true)');
+        expect(overlaySource).toContain('path.includes(textarea)');
+        expect(overlaySource).toContain('event.stopImmediatePropagation()');
+        expect(overlaySource).toContain('window.removeEventListener(eventName, stopPageKeyboardShortcut, true)');
+    });
+
+    it('keeps the launcher draggable only in detached mode and anchors dock launchers', () => {
+        expect(overlaySource).toContain("launcher.addEventListener('pointerdown'");
+        expect(overlaySource).toMatch(/launcher\.addEventListener\('pointerdown'[\s\S]*layout\.mode !== 'detached'/);
+        expect(overlaySource).toContain("launcher.addEventListener('pointermove'");
+        expect(overlaySource).toContain('layout.launcherX = launcherDrag.x + deltaX');
+        expect(overlaySource).toContain('layout.launcherY = launcherDrag.y + deltaY');
+        expect(overlaySource).toContain('suppressLauncherClick = launcherDrag.moved');
+        expect(overlaySource).toContain("launcher.classList.toggle('docked-left'");
+        expect(overlaySource).toContain("launcher.classList.toggle('docked-right'");
+    });
+
+    it('reserves page space for real left and right dock modes', () => {
+        expect(overlaySource).toContain("const PAGE_DOCK_ATTRIBUTE = 'data-koalasync-chat-dock'");
+        expect(overlaySource).toContain('width: calc(100% - var(${PAGE_DOCK_WIDTH})) !important');
+        expect(overlaySource).toContain('margin-left: var(${PAGE_DOCK_WIDTH}) !important');
+        expect(overlaySource).toContain('margin-right: var(${PAGE_DOCK_WIDTH}) !important');
+        expect(overlaySource).toContain('html[${PAGE_DOCK_ATTRIBUTE}] > body');
+        expect(overlaySource).toContain('clip-path: inset(0) !important');
+        expect(overlaySource).toContain('contain: layout paint !important');
+        expect(overlaySource).toContain('> :not(#koalasync-chat-overlay-host)');
+        expect(overlaySource).toContain('const target = document.fullscreenElement || document.documentElement');
+        expect(overlaySource).toContain('pageDockTarget = target');
+        expect(overlaySource).not.toContain('DOCK_MIN_PAGE_WIDTH');
+        expect(overlaySource).toContain('applyPageDock(layout.mode, dockWidth)');
+        expect(overlaySource).toContain('clearPageDock()');
+    });
+
+    it('counts unread remote messages on the bubble and clears the badge when opened', () => {
+        expect(overlaySource).toContain("const unreadBadge = element('span', 'unread')");
+        expect(overlaySource).toContain('if (!opened && !own) setUnreadCount(unreadCount + 1)');
+        expect(overlaySource).toMatch(/if \(opened\) \{\s*setUnreadCount\(0\)/);
+        expect(overlaySource).toContain("unreadBadge.classList.toggle('visible', unreadCount > 0)");
+        expect(backgroundSource).toMatch(/received\.senderId !== peerId[\s\S]*showChatNotification\([\s\S]*senderPeer\.username[\s\S]*received\.senderId/);
+        expect(backgroundSource).toContain("chrome.notifications.create(`chat_${Date.now()}`");
+        expect(backgroundSource).toContain('getTabForNotification(targetTabId)');
+        expect(backgroundSource).toContain('getWindowForNotification(tab.windowId)');
+        expect(backgroundSource).toContain('shouldShowChatNotification({ enabled, targetTabId, tab, windowInfo })');
+    });
+
+    it('renders timestamped room activity and keeps activity notifications opt-in', () => {
+        expect(overlaySource).toContain("if (message?.type === 'CHAT_EVENT') appendEvent(message.event)");
+        expect(overlaySource).toContain("const time = element('time', 'time')");
+        expect(overlaySource).toContain("date.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' })");
+        expect(overlaySource).toContain('if (!opened && context.eventNotifications) setUnreadCount(unreadCount + 1)');
+        expect(backgroundSource).toContain("eventNotifications: localeData.browserNotifications === true");
+        expect(backgroundSource).toContain("sendChatActivity(message.action, peerId, timestamp)");
+        expect(backgroundSource).toContain("sendChatActivity(event, data.senderId, data.actionTimestamp)");
+        expect(backgroundSource).toContain("sendChatActivity('joined', data.peerId, Date.now())");
+        expect(backgroundSource).toContain("sendChatActivity('left', data.peerId, Date.now())");
+        expect(backgroundSource).toContain('activity: chatActivityStore.snapshot()');
+        expect(overlaySource).toContain('renderedActivityIds.has(event.id)');
+        expect(overlaySource).toContain('const MAX_RENDERED_ACTIVITY_IDS = 200');
+        expect(overlaySource).toContain('while (renderedActivityIdOrder.length > MAX_RENDERED_ACTIVITY_IDS)');
+        expect(overlaySource).toContain('renderedActivityIds.delete(renderedActivityIdOrder.shift())');
+    });
+
+    it('uses the KoalaSync icon and offers bounded encrypted quick reactions', () => {
+        expect(overlaySource).toContain("const LAUNCHER_ICON_DATA_URL = 'data:image/png;base64,");
+        expect(overlaySource).toContain('launcherIcon.src = LAUNCHER_ICON_DATA_URL');
+        expect(manifestSource).not.toContain('web_accessible_resources');
+        expect(overlaySource).toContain("const QUICK_REACTIONS = Object.freeze(['❤️', '😂', '😮', '😢', '👏', '🔥'])");
+        expect(overlaySource).toContain("messageRuntime({ type: 'CHAT_SEND', text: chunk })");
+        expect(overlaySource).toContain("chatReactionDisplay !== 'video'");
+        expect(overlaySource).toContain('MAX_REACTION_PARTICLES - reactionLayer.childElementCount');
+        expect(overlaySource).toContain('reducedMotion.matches');
+    });
+
+    it('splits a 5000-codepoint composer value into at most ten acknowledged chat-v1 messages', () => {
+        expect(overlaySource).toContain('const MAX_MESSAGE_CODE_POINTS = 500');
+        expect(overlaySource).toContain('const MAX_CHAT_CHUNKS = 10');
+        expect(overlaySource).toContain('MAX_MESSAGE_CODE_POINTS * MAX_CHAT_CHUNKS');
+        expect(overlaySource).toContain('KoalaSyncChatFormat?.splitChatText(');
+        expect(overlaySource).toMatch(/for \(const chunk of chunks\)[\s\S]*messageRuntime\(\{ type: 'CHAT_SEND', text: chunk \}\)/);
+        expect(overlaySource).toContain("textarea.value = chunks.slice(completedChunks).join('\\n')");
+        expect(backgroundSource).toContain('const echoPromise = chatEchoTracker.waitFor(ciphertext)');
+        expect(backgroundSource).toContain('chatEchoTracker.acknowledge(received.ciphertext)');
+        expect(backgroundSource).toContain("status: acknowledged ? 'ok' : 'unconfirmed'");
+    });
+
+    it('excludes test-only modules from production extension artifacts', () => {
+        expect(buildSource).toContain("/\\.test\\.[cm]?js$/u.test(item)");
+    });
+
+    it('guards async refresh/send work and clears all composer state on room reset', () => {
+        expect(overlaySource).toContain('generation !== refreshGeneration');
+        expect(overlaySource).toContain('if (sending || !context?.enabled) return');
+        expect(overlaySource).toContain("clearComposerValue && textarea.value.trim() === text");
+        expect(overlaySource).toMatch(/CHAT_RESET[\s\S]*resetComposer\(\)/);
+        expect(overlaySource).toContain('setTimeout(() => finish(null), timeoutMs)');
+        expect(backgroundSource).toContain('chatReceiveQueue = chatReceiveQueue.catch(() => {}).then');
+        expect(backgroundSource).toContain("status: 'rate_limited'");
+        expect(overlaySource).toContain('function setLocalStorage(values)');
+        expect(overlaySource).toMatch(/chrome\.storage\.local\.get\([\s\S]*data => \{\s*if \(destroyed\) return;/);
+        expect(overlaySource).toContain("if (destroyed || area !== 'local') return");
+    });
+
+    it('keeps chat hidden by default without discarding the room chat key', () => {
+        expect(popupSource).toContain('localData.chatEnabled === true');
+        expect(backgroundSource).toContain('chatEnabled: data.chatEnabled === true');
+        expect(backgroundSource).toContain('clientCapabilities: CLIENT_CAPABILITIES');
+        expect(overlaySource).toContain('all:initial;display:none;position:fixed');
+        expect(overlaySource).toContain("host.style.display = supported && optedIn ? '' : 'none'");
+        expect(overlaySource).toContain('supported && optedIn && hasKey && connected');
+        expect(popupSource).toContain("chrome.storage.local.set({ chatEnabled: elements.chatEnabled.checked })");
+        expect(popupSource).toMatch(/if \(isCreating\) \{[\s\S]*?type: 'CREATE_CHAT_KEY'[\s\S]*?chatKey = normalizeChatKey/);
+        expect(popupSource).not.toMatch(/chatEnabled[\s\S]{0,120}chatKey:\s*''/);
+    });
+
+    it('keeps unavailable chat controls discoverable to assistive technology', () => {
+        expect(overlaySource).toContain("launcher.setAttribute('aria-disabled'");
+        expect(overlaySource).not.toContain('launcher.disabled =');
+        expect(overlaySource).toContain("launcher.setAttribute('aria-describedby', launcherHint.id)");
+        expect(overlaySource).toContain("textarea.setAttribute('aria-describedby', 'chat-composer-count chat-composer-status')");
+        expect(overlaySource).toContain("status.setAttribute('role', 'status')");
+    });
+
+    it('creates a chat key for both generated-room entry points', () => {
+        expect(popupSource).toContain('let pendingRoomCreation = false');
+        expect(popupSource).toContain('const isCreating = pendingRoomCreation || !roomIdInput');
+        expect(popupSource).toMatch(/function handleCreateRoom\(\)[\s\S]*pendingRoomCreation = true[\s\S]*elements\.joinBtn\.click\(\)/);
+        expect(popupSource).toContain("type: 'CREATE_CHAT_KEY'");
+    });
+
+    it('contains every chat string in all 15 extension locales', () => {
+        const localeFiles = fs.readdirSync(localeDir).filter(file => file.endsWith('.json')).sort();
+        expect(localeFiles).toHaveLength(15);
+        for (const file of localeFiles) {
+            const messages = JSON.parse(fs.readFileSync(path.join(localeDir, file), 'utf8'));
+            for (const key of chatKeys) {
+                expect(messages[key], `${file}: ${key}`).toBeTypeOf('string');
+                expect(messages[key], `${file}: ${key}`).not.toBe('');
+                expect(messages[key], `${file}: ${key}`).not.toMatch(/[—–]/);
+            }
+        }
+    });
+});

extension/chat-overlay.js

@@ -0,0 +1,998 @@
+(function initKoalaSyncChatOverlay() {
+    if (document.documentElement?.namespaceURI !== 'http://www.w3.org/1999/xhtml') return;
+
+    if (window.koalaSyncChatOverlay?.refresh) {
+        window.koalaSyncChatOverlay.refresh();
+        return;
+    }
+
+    const MAX_MESSAGES = 200;
+    const MIN_WIDTH = 300;
+    const MIN_HEIGHT = 320;
+    const DEFAULT_WIDTH = 360;
+    const DEFAULT_HEIGHT = 520;
+    const LAUNCHER_SIZE = 48;
+    const EDGE_INSET = 8;
+    const MAX_MESSAGE_CODE_POINTS = 500;
+    const MAX_CHAT_CHUNKS = 10;
+    const MAX_COMPOSER_CODE_POINTS = MAX_MESSAGE_CODE_POINTS * MAX_CHAT_CHUNKS;
+    const PAGE_DOCK_ATTRIBUTE = 'data-koalasync-chat-dock';
+    const PAGE_DOCK_WIDTH = '--koalasync-chat-dock-width';
+    const QUICK_REACTIONS = Object.freeze(['❤️', '😂', '😮', '😢', '👏', '🔥']);
+    const MAX_REACTION_PARTICLES = 36;
+    const MAX_RENDERED_ACTIVITY_IDS = 200;
+    const LAUNCHER_ICON_DATA_URL = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAnsSURBVGhD7VlbbBtZGfZyF7cFJBrPjGdsz8W3Tnwb23HSdM3SXZFuBNUu21C6Tanapk3dNM390sS5NGna7IUXFoTElpdVn5HgofAKSCAegG2FhLQFVruoK3gAJARiKeSg74zP+PiMnYRukXjoL/2yPXPO+b//ev5zHAg8pIf0kNqSafZ9sKurEikWe2P5/H4pEAi8RxwDOnz48HsLhe6c4/QMhxTrG6FQ7LuhkPVjNWS9pirWLVWN/1RT4zdVxfpWJlMad5yuXqwtrgOqVCrvg0ysl8+XO8vl8qfEMdsSFnCcfVoknHpFUxP/kIIRIgWjRJb0rWik846lp76SSlU+GggEHnEc51FdT52IhFO/lyWdKLJJQorLimxwjN8uy7KB9bbUUPzPppkaz2Qqn8BapVLp47puj4a1xFvBjsgW5IEV2dzSI/YP0+lCLpVKfUDE20SO43xYVazrUjDyVwgKhSwSjdjE0NMkrCVISLGoIsFg9Je2XfyqFIz+phVQVwGe2Tt+rPusY4/2pq7bXw92hG/JsrGF5+FwkiTiDjGNDFFDMTpOkiL3FMX8Tj0S/NTV9ZilqbHXYUmAHRsbJqurM+Tq1UWPa7UJUijshxI+gFCYZ/pM0v1cBy56CsZ5/PE+srIy3SRzfX2eTE+PkEg4RedrauIvuVxPoQk83KipsdtYJJ/tIWtr82RjY4FcuXKJfrLF2O+JiarrDcGisJxl5sjJk8+R8fGzZGZmhMzOjpCJiWEyNDRI0naZRCN7fYrDylNT58m1a7Um8AyDK3eRPPnEQSpXkc03SqX9UQo+nX7yI4psfR/W2N97gC6CCQwwvLCyMkXW1ua85+Dz1VOeJ/SoTebnxz2hvNKteGlpmhh6hnoAa5w9e6JpDqzOy2XPge3Qoaddj4ViP+/t7f1kIJ0u9kmS/k9D7/QG4XNxcYxUq8fIuXPPkTNnjpDh4aPk0qVRDySEaGqCupdXbDfMLLuwME6Vx1rMu7OzVSoXMs+e/TL9DixsLsYhJ2VJ/7dp2scCmpq4CSswIMwStdo4uXDhBF2EMZSYmal649jYnSwuhgabw8/HmtPTw9RgkMPkXbx4sikXMQ4eRNhpWvK1ALIbCly+POtZAgNhCViBWQKL4fvQ0JfoOBHQdtxKAZERKszTrYyGMczz+ERSI5QCkqTfgQLBjghVAgMRKuIi7Hu1OugT/iAYoGD9VjLxfX7ejRAoIElRmj+aGn8zkExmR6HAvu7PeqEhhg6/kFhawczC+GQsjtkNwwt8+PBKQDmMAb4jR464VU+NbwbUUPx7UGB+/qIXPsvLkzT2eOBw79TUcJPA3YLdzRiWE8gD3gOQe/78cVqRNjeX6diVlRnqAVWN/ySgyObr0ObyZZSrhgVZMjF+N6HDK7AbL6HyMOOxHMRzKID9APsU3aEV8y6q0A3UclWNk1OnBuuDFihgAGdxiaQWBb0b3k4BxDvveSiE6MCcavUUCWtJNwe0xM0AOj5FsX4FJWJW3itpcNnk5BkaSnNzIzuWygfJkIVCMj5+moYU8o6FWCJeoJunGrJ+ncmUS3Q3dhzn/VoofgeawT1gfsHtrHU/43Y7Hu8REfhEgiPMsXkqsnEXmJv6IUnSX0Iyo9dAv7K5ueJNFhdmvLFRI+vr/uf8+42NJZpb4jv3/dK288Gu/BpKJg0btPbBPeGvNYEHZbPoRhNvS8HoO3ARGrNUskC37aWlKd/CX/j8Ia/DtFOlOiDXzUtLk9QItDOl3W2SNnXsPcYePNjvdazxmONbH9ZGO20aaYoFmGRJfyesJu86TndCxE8pm+39dLHYO+T24G6HGQxGvBjkBdS7Qjce1bhn5eXlKd+Bhp4tFIv2PsyqbCd135nk2jV4qrE+NiycRxodr0kOHOh7ERhF3E2Uz3d/joHD5GBH2Acev91YdBUAGPYun9vHnRcaBxk8gzdbKQCDtQpVhA1vCMvqXBTx+iib7X6WtxxiTlwcCqDXZwqMjAx55ReHoQbw5kMPLMrmT06eY2FB54vgwUxJhsUw9l4V8foony8/zWuNM7GogKgM+45Q410uKgCwrfKpFUMmcsebSxXoXBXx+iiX6z3AhLIDB2vydmIkamsF3N9Ya2LinG9eK4Zh2HmYKZDPl8dEvD7CxoakZAdzhNDc3Khn6e28gTOzP/5dZhWJeWC7dcCrq7OcAu562WzpWRGvj9Lp7j1sq3ZDKEqOHRvwtvKdBLfLAT5Z+XXarbewMOGbXyh02yJeH2GHi4RTuI/xXAfLoSL09x+iluGFimAuXDjNeaD5lmJw8EiTAiJ4/nc+11uf564V7Ij+acd7IUaalvxjKytSS0g6scwsWVtzW28RDD4XFye9sWB4cWTkDHnhhVVvTLtdnr1jVmdGUBTzZRFnWwop5i/aKUAXpHFuED3auAhg/PzzyxQA+qnFxQnK+I53UKCV5XnG3NOnjzcSH/KC+t/K5Yop4mxLsmze9ANvKABGjqB75S0PxvYPxaamqrR3xw5bq02STrtEb/nYoYTn9fVL9B5pYOCLpK+vv2mThAIhxfpRpVL5kIizLSmScd0PvG59JKMaJ9PT7kWUaM3BY+5xD+fW+p2qZ02+52Fz5+YueuW6UYIb3sd1YzpdOili3JbkoH5FtDhjCMIVDHO3qAAYpRKXZLhrgtUBHFWF3/Qwd2ZmtAGe44YCBprC277WeSfS9eSoB5irIsylKJULC2NtFWAWxvtWIQNGtwlPMhm44EKlayjgshqy7mFvEjFuS4lE+hlWPtFey5L+VmODchk1fXLyvK/RE3OilZKYMzDwTBNYVC7kwt5UwfVKXT5YVWI38B+EiLMt2XaxIEvRe7JsvJHNdvfkcl1pRTaaSisTAMuxE5wImmdeOWyKSHY+5nHbxt6jctWv8l0vqLFblQr9T2J3hIy37Xw/fxcPJWTZuM1CyuO6ZxDvuLVG1WkVNkwxAC13PVY/TzTCc3l5xpsHD7GbB/peMX/rOE882ozyPiif7zEi4dTPqHd8VYPFbIyWUZTYnu7PkKee6ie23UU3P/dk5Z+DdWo1994HjN0+mSh4BsIBvqen52MinvsiXMdHo4lxRTaoEgDAGj++1IrcANyiNEs6zQFYf35+jCY37+GQEvvBf12JdiL88RdWE6/KUvQPimxsiWD9oP3K8N+PHh2g+dQ8jzaT/7Lt4oAo/4EQKkOxWAzqenI6GtmLSoU/5nwgPPD1qhIJp/6uqYnr+VzPi/gTr2kMG+c+21IUc73dv6MPlODiUmlfJpstHw+H4yuSpL8sy/qrcjB6QwpGv61I5kuZTGkkmy1X8I9kfdojdjI3rCjm7yhYrgGUZePtiJao4Y9HQdT/J3V2OofCWvKbYTX+SiKRrXJKPqSH9L+k/wCILgNgmPdaeAAAAABJRU5ErkJggg==';
+    const SIZE_PRESETS = Object.freeze({
+        compact: Object.freeze({ width: 320, height: 400 }),
+        standard: Object.freeze({ width: DEFAULT_WIDTH, height: DEFAULT_HEIGHT }),
+        large: Object.freeze({ width: 440, height: 640 })
+    });
+    const storageKey = `chatOverlayLayout:${location.origin}`;
+    const systemTheme = window.matchMedia('(prefers-color-scheme: light)');
+    let context = null;
+    let opened = false;
+    let destroyed = false;
+    let saveTimer = null;
+    let applyingLayout = false;
+    let preferencesLoaded = false;
+    let startStateApplied = false;
+    let refreshGeneration = 0;
+    let sendGeneration = 0;
+    let sending = false;
+    let unreadCount = 0;
+    let layout = {
+        mode: 'right',
+        x: 24,
+        y: 72,
+        width: DEFAULT_WIDTH,
+        height: DEFAULT_HEIGHT,
+        customWidth: DEFAULT_WIDTH,
+        customHeight: DEFAULT_HEIGHT,
+        detachedInitialized: false,
+        launcherX: null,
+        launcherY: null,
+        launcherInitialized: false
+    };
+    let chatPosition = 'right';
+    let chatSize = 'standard';
+    let chatStartMode = 'bubble';
+    let chatReactionDisplay = 'chat';
+    let themeMode = 'system';
+    let themePalette = 'eucalyptus';
+    let pageDockTarget = null;
+    const reducedMotion = window.matchMedia('(prefers-reduced-motion: reduce)');
+    const renderedActivityIds = new Set();
+    const renderedActivityIdOrder = [];
+
+    const host = document.createElement('div');
+    host.id = 'koalasync-chat-overlay-host';
+    host.style.cssText = 'all:initial;display:none;position:fixed;inset:0;z-index:2147483647;pointer-events:none;contain:layout style paint;transform:translateZ(0);';
+    const shadow = host.attachShadow({ mode: 'open' });
+    const style = document.createElement('style');
+    style.textContent = `
+        :host { all: initial; }
+        * { box-sizing: border-box; }
+        #app {
+            --bg: oklch(0.205 0.025 155); --card: oklch(0.30 0.035 150);
+            --surface-alt: oklch(0.265 0.032 150); --surface-deep: oklch(0.205 0.025 155);
+            --accent: oklch(0.73 0.13 155); --accent-hover: oklch(0.79 0.12 155);
+            --text: oklch(0.96 0.01 90); --text-muted: oklch(0.78 0.02 90);
+            --border-soft: oklch(0.88 0.025 145 / 0.09); --border-strong: oklch(0.39 0.038 145);
+            --text-on-green: oklch(0.14 0.02 90); --danger: oklch(0.63 0.18 25);
+            position: fixed; inset: 0; pointer-events: none; color: var(--text);
+            font: 14px/1.45 -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+        }
+        #app[data-theme="light"] {
+            --bg: oklch(0.935 0.018 110); --card: oklch(0.995 0.006 100);
+            --surface-alt: oklch(0.91 0.022 115); --surface-deep: oklch(0.935 0.018 110);
+            --accent: oklch(0.52 0.13 155); --accent-hover: oklch(0.45 0.12 155);
+            --text: oklch(0.21 0.03 140); --text-muted: oklch(0.43 0.03 135);
+            --border-soft: oklch(0.28 0.035 140 / 0.10); --border-strong: oklch(0.73 0.035 125);
+            --text-on-green: oklch(0.16 0.03 140);
+        }
+        #app[data-palette="cyber"] {
+            --bg: oklch(0.185 0.04 265); --card: oklch(0.285 0.05 265);
+            --surface-alt: oklch(0.25 0.048 265); --surface-deep: oklch(0.185 0.04 265);
+            --accent: oklch(0.59 0.20 275); --accent-hover: oklch(0.69 0.17 275);
+            --text: oklch(0.97 0.012 265); --text-muted: oklch(0.74 0.03 265);
+            --border-soft: oklch(0.9 0.03 265 / 0.10); --border-strong: oklch(0.42 0.05 265);
+            --text-on-green: oklch(0.99 0.006 275);
+        }
+        #app[data-palette="cyber"][data-theme="light"] {
+            --bg: oklch(0.945 0.014 265); --card: oklch(0.995 0.005 265);
+            --surface-alt: oklch(0.915 0.02 265); --surface-deep: oklch(0.945 0.014 265);
+            --accent: oklch(0.53 0.21 275); --accent-hover: oklch(0.46 0.20 275);
+            --text: oklch(0.26 0.05 265); --text-muted: oklch(0.48 0.045 265);
+            --border-soft: oklch(0.30 0.05 265 / 0.12); --border-strong: oklch(0.79 0.03 265);
+            --text-on-green: oklch(0.99 0.005 275);
+        }
+        #app[data-palette="graphite"] {
+            --bg: oklch(0.165 0.004 260); --card: oklch(0.255 0.005 260);
+            --surface-alt: oklch(0.225 0.005 260); --surface-deep: oklch(0.165 0.004 260);
+            --accent: oklch(0.93 0.006 260); --accent-hover: oklch(0.99 0.003 260);
+            --text: oklch(0.97 0.003 260); --text-muted: oklch(0.72 0.005 260);
+            --border-soft: oklch(0.92 0.008 260 / 0.11); --border-strong: oklch(0.42 0.006 260);
+            --text-on-green: oklch(0.20 0.004 260);
+        }
+        #app[data-palette="graphite"][data-theme="light"] {
+            --bg: oklch(0.928 0.003 260); --card: oklch(1 0 0);
+            --surface-alt: oklch(0.90 0.004 260); --surface-deep: oklch(0.928 0.003 260);
+            --accent: oklch(0.28 0.006 260); --accent-hover: oklch(0.18 0.005 260);
+            --text: oklch(0.22 0.005 260); --text-muted: oklch(0.46 0.006 260);
+            --border-soft: oklch(0.20 0.006 260 / 0.13); --border-strong: oklch(0.77 0.004 260);
+            --text-on-green: oklch(0.98 0.002 260);
+        }
+        button, textarea { font: inherit; }
+        button { color: inherit; }
+        .launcher {
+             position: fixed; width: 48px; height: 48px; border: 1px solid var(--border-strong);
+             border-radius: 16px; background: var(--card); color: var(--text); cursor: pointer;
+             pointer-events: auto; box-shadow: 0 10px 28px rgb(0 0 0 / .32);
+             touch-action: none; user-select: none;
+         }
+         .launcher.docked-left { left: 0 !important; right: auto !important; border-left: 0; border-radius: 0 16px 16px 0; }
+         .launcher.docked-right { left: auto !important; right: 0 !important; border-right: 0; border-radius: 16px 0 0 16px; }
+         .launcher:hover:not([aria-disabled="true"]) { border-color: var(--accent); transform: translateY(-1px); }
+         .launcher[aria-disabled="true"] { cursor: not-allowed; opacity: .58; }
+         .launcher-icon { display: block; width: 36px; height: 36px; margin: auto; pointer-events: none; }
+         .launcher-bubble-mark {
+             position: absolute; right: 3px; bottom: 3px; width: 15px; height: 12px;
+             border: 2px solid var(--card); border-radius: 7px; background: var(--accent); pointer-events: none;
+         }
+         .launcher-bubble-mark::after {
+             content: ""; position: absolute; right: 0; bottom: -4px;
+             width: 5px; height: 5px; background: var(--accent); clip-path: polygon(0 0, 100% 0, 100% 100%);
+         }
+         .unread {
+             position: absolute; top: -7px; right: -7px; display: none; min-width: 22px; height: 22px;
+             align-items: center; justify-content: center; padding: 0 6px; border: 2px solid var(--card);
+             border-radius: 999px; background: var(--danger); color: white; font-size: 11px; font-weight: 800;
+             line-height: 1; pointer-events: none;
+         }
+         .unread.visible { display: flex; }
+         .panel {
+            position: fixed; display: none; flex-direction: column; overflow: hidden;
+            min-width: min(${MIN_WIDTH}px, calc(100vw - 16px)); min-height: min(${MIN_HEIGHT}px, calc(100vh - 16px)); max-width: calc(100vw - 16px);
+            max-height: calc(100vh - 16px); pointer-events: auto; color: var(--text);
+            background: var(--card); border: 1px solid var(--border-strong); border-radius: 18px;
+            box-shadow: 0 18px 55px rgb(0 0 0 / .38); transform: translateZ(0);
+         }
+         .panel.open { display: flex; }
+         .panel.docked { border-radius: 0; max-height: 100vh; }
+         .header { display: flex; align-items: center; gap: 10px; padding: 12px; border-bottom: 1px solid var(--border-soft); user-select: none; }
+        .header.detached { cursor: move; }
+        .heading { min-width: 0; flex: 1; }
+        .title { font-size: 14px; font-weight: 760; }
+        .subtitle { color: var(--text-muted); font-size: 11px; }
+        .modes { display: flex; gap: 4px; }
+        .icon-button { width: 30px; height: 30px; border: 1px solid var(--border-soft); border-radius: 9px; background: var(--surface-alt); cursor: pointer; }
+        .icon-button:hover, .icon-button.active { border-color: var(--accent); color: var(--accent); }
+        .messages { flex: 1; min-height: 0; overflow-y: auto; padding: 12px; background: var(--bg); overscroll-behavior: contain; }
+        .empty { color: var(--text-muted); text-align: center; padding: 32px 12px; font-size: 12px; }
+        .message { margin-bottom: 11px; overflow-wrap: anywhere; }
+        .meta { display: flex; align-items: baseline; gap: 7px; margin-bottom: 2px; }
+        .sender { color: var(--accent); font-weight: 700; font-size: 12px; }
+        .time { color: var(--text-muted); font-size: 10px; }
+         .body { white-space: pre-wrap; color: var(--text); }
+         .event-message {
+             display: flex; align-items: center; justify-content: center; gap: 7px; margin: 8px 0;
+             color: var(--text-muted); font-size: 11px; text-align: center;
+         }
+         .event-message::before, .event-message::after { content: ""; flex: 1; height: 1px; background: var(--border-soft); }
+         .event-text { max-width: 78%; }
+        .composer { padding: 10px; border-top: 1px solid var(--border-soft); background: var(--card); }
+        .quick-reactions { display: flex; align-items: center; gap: 5px; margin-bottom: 8px; }
+        .reaction-button {
+            width: 34px; height: 30px; border: 1px solid var(--border-soft); border-radius: 9px;
+            background: var(--surface-alt); cursor: pointer; font-size: 18px; line-height: 1;
+        }
+        .reaction-button:hover:not(:disabled), .reaction-button:focus-visible { border-color: var(--accent); transform: translateY(-1px); }
+        .reaction-button:disabled { opacity: .5; cursor: wait; }
+        textarea { width: 100%; min-height: 62px; max-height: 132px; resize: vertical; border: 1px solid var(--border-strong); border-radius: 11px; padding: 9px; background: var(--surface-deep); color: var(--text); outline: none; }
+        textarea:focus { border-color: var(--accent); }
+        textarea::placeholder { color: var(--text-muted); }
+        .composer-row { display: flex; align-items: center; gap: 8px; margin-top: 7px; }
+        .count { flex: 1; color: var(--text-muted); font-size: 10px; }
+        .status { color: var(--danger); font-size: 10px; min-height: 14px; }
+        .send { border: 0; border-radius: 10px; padding: 8px 13px; background: var(--accent); color: var(--text-on-green); font-weight: 750; cursor: pointer; }
+        .send:hover:not(:disabled) { background: var(--accent-hover); }
+        .send:disabled { opacity: .55; cursor: wait; }
+        .reaction-layer { position: fixed; inset: 0; overflow: hidden; pointer-events: none; z-index: 1; }
+        .reaction-particle {
+            position: absolute; top: -12vh; font-size: clamp(24px, 4vw, 48px);
+            filter: drop-shadow(0 4px 7px rgb(0 0 0 / .35));
+            animation: reaction-fall var(--reaction-duration) cubic-bezier(.22,.62,.45,1) var(--reaction-delay) forwards;
+        }
+        .launcher, .panel { z-index: 2; }
+        @keyframes reaction-fall {
+            0% { transform: translate3d(0, -8vh, 0) rotate(var(--reaction-start-rotation)); opacity: 0; }
+            12% { opacity: 1; }
+            100% { transform: translate3d(var(--reaction-drift), 116vh, 0) rotate(var(--reaction-end-rotation)); opacity: .92; }
+        }
+        .visually-hidden { position: absolute !important; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0, 0, 0, 0); white-space: nowrap; border: 0; }
+        @media (max-width: 520px) { .panel { max-width: calc(100vw - 12px); } }
+        @media (prefers-reduced-motion: reduce) {
+            * { transition: none !important; }
+            .reaction-particle { animation: none !important; display: none !important; }
+        }
+    `;
+
+    function element(tag, className, text) {
+        const node = document.createElement(tag);
+        if (className) node.className = className;
+        if (text !== undefined) node.textContent = text;
+        return node;
+    }
+
+    const app = element('div');
+    app.id = 'app';
+    const launcher = element('button', 'launcher');
+    launcher.type = 'button';
+    const launcherIcon = element('img', 'launcher-icon');
+    launcherIcon.src = LAUNCHER_ICON_DATA_URL;
+    launcherIcon.alt = '';
+    const launcherBubbleMark = element('span', 'launcher-bubble-mark');
+    launcherBubbleMark.setAttribute('aria-hidden', 'true');
+    const unreadBadge = element('span', 'unread');
+    unreadBadge.setAttribute('aria-hidden', 'true');
+    launcher.append(launcherIcon, launcherBubbleMark, unreadBadge);
+    const launcherHint = element('span', 'visually-hidden');
+    launcherHint.id = 'chat-launcher-hint';
+    const panel = element('section', 'panel');
+    panel.setAttribute('role', 'dialog');
+    const header = element('header', 'header');
+    const heading = element('div', 'heading');
+    const title = element('div', 'title');
+    const subtitle = element('div', 'subtitle');
+    heading.append(title, subtitle);
+    const modes = element('div', 'modes');
+    const leftButton = element('button', 'icon-button', '←');
+    const detachedButton = element('button', 'icon-button', '✥');
+    const rightButton = element('button', 'icon-button', '→');
+    const closeButton = element('button', 'icon-button', '×');
+    for (const button of [leftButton, detachedButton, rightButton, closeButton]) button.type = 'button';
+    modes.append(leftButton, detachedButton, rightButton, closeButton);
+    header.append(heading, modes);
+    const messages = element('div', 'messages');
+    messages.setAttribute('aria-live', 'polite');
+    const empty = element('div', 'empty');
+    messages.append(empty);
+    const composer = element('form', 'composer');
+    const quickReactions = element('div', 'quick-reactions');
+    quickReactions.setAttribute('role', 'group');
+    const reactionButtons = QUICK_REACTIONS.map(reaction => {
+        const button = element('button', 'reaction-button', reaction);
+        button.type = 'button';
+        button.dataset.reaction = reaction;
+        quickReactions.append(button);
+        return button;
+    });
+    const textareaLabel = element('label', 'visually-hidden');
+    textareaLabel.htmlFor = 'chat-composer-input';
+    const textarea = element('textarea');
+    textarea.id = 'chat-composer-input';
+    textarea.setAttribute('aria-describedby', 'chat-composer-count chat-composer-status');
+    const composerRow = element('div', 'composer-row');
+    const count = element('span', 'count', `0/${MAX_COMPOSER_CODE_POINTS}`);
+    count.id = 'chat-composer-count';
+    const sendButton = element('button', 'send');
+    sendButton.type = 'submit';
+    composerRow.append(count, sendButton);
+    const status = element('div', 'status');
+    status.id = 'chat-composer-status';
+    status.setAttribute('role', 'status');
+    composer.append(quickReactions, textareaLabel, textarea, composerRow, status);
+    panel.append(header, messages, composer);
+    const reactionLayer = element('div', 'reaction-layer');
+    reactionLayer.setAttribute('aria-hidden', 'true');
+    app.append(reactionLayer, launcherHint, launcher, panel);
+    shadow.append(style, app);
+    document.documentElement.append(host);
+    const pageDockStyle = document.createElement('style');
+    pageDockStyle.id = 'koalasync-chat-page-dock-style';
+    pageDockStyle.textContent = `
+        html[${PAGE_DOCK_ATTRIBUTE}] {
+            box-sizing: border-box !important;
+            width: calc(100% - var(${PAGE_DOCK_WIDTH})) !important;
+            max-width: calc(100% - var(${PAGE_DOCK_WIDTH})) !important;
+            overflow-x: clip !important;
+        }
+        html[${PAGE_DOCK_ATTRIBUTE}="left"] {
+            margin-left: var(${PAGE_DOCK_WIDTH}) !important;
+            margin-right: 0 !important;
+        }
+        html[${PAGE_DOCK_ATTRIBUTE}="right"] {
+            margin-left: 0 !important;
+            margin-right: var(${PAGE_DOCK_WIDTH}) !important;
+        }
+        html[${PAGE_DOCK_ATTRIBUTE}] > body {
+            width: 100% !important;
+            max-width: 100% !important;
+            min-height: 100vh !important;
+            overflow-x: clip !important;
+            clip-path: inset(0) !important;
+            contain: layout paint !important;
+        }
+        [${PAGE_DOCK_ATTRIBUTE}]:not(html) > :not(#koalasync-chat-overlay-host) {
+            box-sizing: border-box !important;
+            width: calc(100% - var(${PAGE_DOCK_WIDTH})) !important;
+            max-width: calc(100% - var(${PAGE_DOCK_WIDTH})) !important;
+            overflow-x: clip !important;
+            clip-path: inset(0) !important;
+            contain: layout paint !important;
+        }
+        [${PAGE_DOCK_ATTRIBUTE}="left"]:not(html) > :not(#koalasync-chat-overlay-host) {
+            margin-left: var(${PAGE_DOCK_WIDTH}) !important;
+            margin-right: 0 !important;
+        }
+        [${PAGE_DOCK_ATTRIBUTE}="right"]:not(html) > :not(#koalasync-chat-overlay-host) {
+            margin-left: 0 !important;
+            margin-right: var(${PAGE_DOCK_WIDTH}) !important;
+        }
+    `;
+    document.documentElement.append(pageDockStyle);
+
+    function messageRuntime(payload, timeoutMs = 5000) {
+        return new Promise(resolve => {
+            let settled = false;
+            const finish = response => {
+                if (settled) return;
+                settled = true;
+                clearTimeout(timeout);
+                resolve(response || null);
+            };
+            const timeout = setTimeout(() => finish(null), timeoutMs);
+            try {
+                chrome.runtime.sendMessage(payload, response => {
+                    if (chrome.runtime.lastError) finish(null);
+                    else finish(response);
+                });
+            } catch (_) {
+                finish(null);
+            }
+        });
+    }
+
+    function setLocalStorage(values) {
+        if (destroyed) return;
+        try {
+            const result = chrome.storage.local.set(values);
+            if (result?.catch) result.catch(() => {});
+        } catch (_) {
+            // Extension context was invalidated while the page remained open.
+        }
+    }
+
+    function strings() {
+        return context?.strings || {};
+    }
+
+    function applyStrings() {
+        const text = strings();
+        title.textContent = text.title || '';
+        subtitle.textContent = text.liveOnly || '';
+        launcher.setAttribute('aria-label', text.open || '');
+        const unavailableHint = context?.supported && !context?.hasKey
+            ? (text.missingKey || '')
+            : context?.supported && !context?.connected ? (text.sendFailed || '') : '';
+        launcher.title = unavailableHint || text.open || '';
+        launcherHint.textContent = unavailableHint;
+        if (unavailableHint) launcher.setAttribute('aria-describedby', launcherHint.id);
+        else launcher.removeAttribute('aria-describedby');
+        panel.setAttribute('aria-label', text.title || '');
+        textarea.placeholder = text.placeholder || '';
+        textareaLabel.textContent = text.placeholder || text.title || '';
+        sendButton.textContent = text.send || '';
+        empty.textContent = text.empty || '';
+        leftButton.title = text.dockLeft || '';
+        detachedButton.title = text.detached || '';
+        rightButton.title = text.dockRight || '';
+        closeButton.title = text.close || '';
+        leftButton.setAttribute('aria-label', text.dockLeft || '');
+        detachedButton.setAttribute('aria-label', text.detached || '');
+        rightButton.setAttribute('aria-label', text.dockRight || '');
+        closeButton.setAttribute('aria-label', text.close || '');
+        quickReactions.setAttribute('aria-label', text.quickReactions || text.title || '');
+        for (const button of reactionButtons) {
+            const label = `${text.quickReactions || text.title || ''} ${button.dataset.reaction}`.trim();
+            button.title = label;
+            button.setAttribute('aria-label', label);
+        }
+        applyUnreadCount();
+    }
+
+    function applyTheme() {
+        const light = themeMode === 'light' || (themeMode === 'system' && systemTheme.matches);
+        app.dataset.theme = light ? 'light' : 'dark';
+        app.dataset.palette = ['eucalyptus', 'cyber', 'graphite'].includes(themePalette) ? themePalette : 'eucalyptus';
+    }
+
+    function viewportBounds() {
+        return { width: Math.max(1, window.innerWidth), height: Math.max(1, window.innerHeight) };
+    }
+
+    function normalizePosition(value) {
+        return ['left', 'right', 'detached'].includes(value) ? value : 'right';
+    }
+
+    function normalizeSize(value) {
+        return ['compact', 'standard', 'large', 'custom'].includes(value) ? value : 'standard';
+    }
+
+    function preferredSize() {
+        return SIZE_PRESETS[chatSize] || {
+            width: Number(layout.customWidth) || DEFAULT_WIDTH,
+            height: Number(layout.customHeight) || DEFAULT_HEIGHT
+        };
+    }
+
+    function clampLauncher() {
+        const viewport = viewportBounds();
+        const maxX = Math.max(0, viewport.width - LAUNCHER_SIZE - EDGE_INSET);
+        const maxY = Math.max(0, viewport.height - LAUNCHER_SIZE - EDGE_INSET);
+        layout.launcherX = Math.min(Math.max(Number(layout.launcherX) || EDGE_INSET, EDGE_INSET), maxX);
+        layout.launcherY = Math.min(Math.max(Number(layout.launcherY) || EDGE_INSET, EDGE_INSET), maxY);
+    }
+
+    function initializeLauncher() {
+        if (layout.launcherInitialized) return;
+        const viewport = viewportBounds();
+        layout.launcherX = chatPosition === 'left'
+            ? Math.min(16, Math.max(EDGE_INSET, viewport.width - LAUNCHER_SIZE - EDGE_INSET))
+            : Math.max(EDGE_INSET, viewport.width - LAUNCHER_SIZE - 16);
+        layout.launcherY = Math.max(EDGE_INSET, Math.round(viewport.height / 2 - LAUNCHER_SIZE / 2));
+        layout.launcherInitialized = true;
+        clampLauncher();
+    }
+
+    function clearPageDock() {
+        const targets = new Set([pageDockTarget, document.documentElement].filter(Boolean));
+        for (const target of targets) {
+            target.removeAttribute(PAGE_DOCK_ATTRIBUTE);
+            target.style.removeProperty(PAGE_DOCK_WIDTH);
+        }
+        pageDockTarget = null;
+    }
+
+    function applyPageDock(side, width) {
+        if (!opened) {
+            clearPageDock();
+            return;
+        }
+        const target = document.fullscreenElement || document.documentElement;
+        if (pageDockTarget && pageDockTarget !== target) clearPageDock();
+        pageDockTarget = target;
+        target.setAttribute(PAGE_DOCK_ATTRIBUTE, side);
+        target.style.setProperty(PAGE_DOCK_WIDTH, `${width}px`);
+    }
+
+    function applyUnreadCount() {
+        unreadBadge.textContent = unreadCount > 99 ? '99+' : String(unreadCount);
+        unreadBadge.classList.toggle('visible', unreadCount > 0);
+        const openLabel = strings().open || '';
+        launcher.setAttribute('aria-label', unreadCount > 0 ? `${openLabel} (${unreadCount})` : openLabel);
+    }
+
+    function setUnreadCount(next) {
+        unreadCount = Math.max(0, Number.isFinite(next) ? Math.trunc(next) : 0);
+        applyUnreadCount();
+    }
+
+    function clampDetached() {
+        const viewport = viewportBounds();
+        const maxWidth = Math.max(1, Math.min(600, viewport.width - 16));
+        const maxHeight = Math.max(1, viewport.height - 16);
+        const horizontalInset = Math.min(8, Math.max(0, Math.floor((viewport.width - 1) / 2)));
+        const verticalInset = Math.min(8, Math.max(0, Math.floor((viewport.height - 1) / 2)));
+        layout.width = Math.min(Math.max(Number(layout.width) || DEFAULT_WIDTH, Math.min(MIN_WIDTH, maxWidth)), maxWidth);
+        layout.height = Math.min(Math.max(Number(layout.height) || DEFAULT_HEIGHT, Math.min(MIN_HEIGHT, maxHeight)), maxHeight);
+        layout.x = Math.min(Math.max(Number(layout.x) || horizontalInset, horizontalInset), Math.max(horizontalInset, viewport.width - layout.width - horizontalInset));
+        layout.y = Math.min(Math.max(Number(layout.y) || verticalInset, verticalInset), Math.max(verticalInset, viewport.height - layout.height - verticalInset));
+    }
+
+    function saveLayout() {
+        if (saveTimer) clearTimeout(saveTimer);
+        saveTimer = setTimeout(() => {
+            saveTimer = null;
+            setLocalStorage({ [storageKey]: layout });
+        }, 150);
+    }
+
+    function applyLayout() {
+        if (destroyed) return;
+        applyingLayout = true;
+        const size = preferredSize();
+        launcher.classList.toggle('docked-left', layout.mode === 'left');
+        launcher.classList.toggle('docked-right', layout.mode === 'right');
+        if (layout.mode === 'detached') {
+            initializeLauncher();
+            clampLauncher();
+            launcher.style.left = `${layout.launcherX}px`;
+            launcher.style.right = 'auto';
+            launcher.style.top = `${layout.launcherY}px`;
+        } else {
+            launcher.style.left = layout.mode === 'left' ? '0' : 'auto';
+            launcher.style.right = layout.mode === 'right' ? '0' : 'auto';
+            launcher.style.top = `${Math.max(0, Math.round(window.innerHeight / 2 - LAUNCHER_SIZE / 2))}px`;
+        }
+        panel.style.right = 'auto';
+        panel.style.left = 'auto';
+        panel.style.bottom = 'auto';
+        panel.style.resize = 'none';
+        panel.classList.toggle('docked', layout.mode !== 'detached');
+        header.classList.toggle('detached', layout.mode === 'detached');
+        leftButton.classList.toggle('active', layout.mode === 'left');
+        detachedButton.classList.toggle('active', layout.mode === 'detached');
+        rightButton.classList.toggle('active', layout.mode === 'right');
+        if (layout.mode === 'detached') {
+            clearPageDock();
+            clampDetached();
+            panel.style.left = `${layout.x}px`;
+            panel.style.top = `${layout.y}px`;
+            panel.style.width = `${layout.width}px`;
+            panel.style.height = `${layout.height}px`;
+            panel.style.resize = 'both';
+        } else {
+            const viewport = viewportBounds();
+            const dockWidth = Math.max(1, Math.min(size.width, viewport.width - 16));
+            panel.style.top = '0';
+            panel.style.bottom = '0';
+            panel.style.width = `${dockWidth}px`;
+            panel.style.height = `${viewport.height}px`;
+            panel.style[layout.mode] = '0';
+            applyPageDock(layout.mode, dockWidth);
+        }
+        globalThis.queueMicrotask(() => { applyingLayout = false; });
+    }
+
+    function setMode(mode, persistPreference = true) {
+        mode = normalizePosition(mode);
+        if (mode === 'detached' && !layout.detachedInitialized) {
+            const size = preferredSize();
+            layout.x = Math.max(8, Math.round((window.innerWidth - size.width) / 2));
+            layout.y = Math.max(8, Math.round((window.innerHeight - size.height) / 2));
+            layout.detachedInitialized = true;
+        }
+        chatPosition = mode;
+        layout.mode = mode;
+        applyLayout();
+        saveLayout();
+        if (persistPreference) setLocalStorage({ chatPosition: mode });
+    }
+
+    function setSize(size, persistPreference = true) {
+        chatSize = normalizeSize(size);
+        const preset = SIZE_PRESETS[chatSize];
+        if (preset) {
+            layout.width = preset.width;
+            layout.height = preset.height;
+        } else {
+            layout.width = Number(layout.customWidth) || DEFAULT_WIDTH;
+            layout.height = Number(layout.customHeight) || DEFAULT_HEIGHT;
+        }
+        if (layout.mode === 'detached') clampDetached();
+        applyLayout();
+        saveLayout();
+        if (persistPreference) setLocalStorage({ chatSize });
+    }
+
+    function setOpened(next) {
+        opened = !!next && !!context?.enabled;
+        panel.classList.toggle('open', opened);
+        launcher.style.display = opened ? 'none' : '';
+        if (opened) {
+            setUnreadCount(0);
+            textarea.focus();
+            messages.scrollTop = messages.scrollHeight;
+        }
+        applyLayout();
+    }
+
+    function applyContext(next) {
+        const previousRoomId = context?.roomId;
+        context = next || null;
+        const supported = !!context?.supported;
+        const optedIn = !!context?.enabled;
+        const hasKey = !!context?.hasKey;
+        const connected = !!context?.connected;
+        context = context ? { ...context, enabled: supported && optedIn && hasKey && connected } : null;
+        if (previousRoomId && previousRoomId !== context?.roomId) {
+            clearMessages();
+            startStateApplied = false;
+        }
+        host.style.display = supported && optedIn ? '' : 'none';
+        launcher.setAttribute('aria-disabled', String(!context?.enabled));
+        if (!optedIn) startStateApplied = false;
+        if (!context?.enabled) {
+            setOpened(false);
+        } else if (preferencesLoaded && !startStateApplied) {
+            startStateApplied = true;
+            setOpened(chatStartMode === 'open');
+        }
+        applyStrings();
+        applyLayout();
+        if (context?.enabled && Array.isArray(context.activity)) {
+            for (const event of context.activity) appendEvent(event);
+        }
+    }
+
+    async function refresh() {
+        if (destroyed) return;
+        const generation = ++refreshGeneration;
+        const next = await messageRuntime({ type: 'GET_CHAT_CONTEXT' });
+        if (destroyed || generation !== refreshGeneration) return;
+        applyContext(next);
+    }
+
+    function appendMessage(message) {
+        if (!context?.enabled || !message || typeof message.text !== 'string') return;
+        if (empty.isConnected) empty.remove();
+        const wrapper = element('article', 'message');
+        const meta = element('div', 'meta');
+        const own = message.senderId === context.peerId;
+        if (!opened && !own) setUnreadCount(unreadCount + 1);
+        const sender = element('span', 'sender', own ? (strings().you || '') : (message.username || message.senderId || ''));
+        const time = element('time', 'time');
+        const date = new Date(message.timestamp);
+        time.textContent = Number.isFinite(date.getTime()) ? date.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' }) : '';
+        meta.append(sender, time);
+        const body = element('div', 'body');
+        const tokens = globalThis.KoalaSyncChatFormat?.tokenizeChatText(message.text) || [{ type: 'text', text: message.text }];
+        for (const token of tokens) {
+            const node = token.type === 'strong' ? document.createElement('strong') : token.type === 'em' ? document.createElement('em') : document.createTextNode(token.text);
+            if (node.nodeType === 1) node.textContent = token.text;
+            body.append(node);
+        }
+        wrapper.append(meta, body);
+        messages.append(wrapper);
+        while (messages.querySelectorAll('.message').length > MAX_MESSAGES) messages.querySelector('.message')?.remove();
+        messages.scrollTop = messages.scrollHeight;
+        if (QUICK_REACTIONS.includes(message.text.trim())) triggerReactionRain(message.text.trim());
+    }
+
+    function appendEvent(event) {
+        if (!context?.enabled || !event || typeof event.action !== 'string') return;
+        if (typeof event.id === 'string' && renderedActivityIds.has(event.id)) return;
+        const own = event.senderId === context.peerId;
+        const displayName = own ? (strings().you || '') : (event.username || event.senderId || '');
+        const labels = {
+            play: strings().eventPlay,
+            pause: strings().eventPause,
+            seek: strings().eventSeek,
+            force_sync_prepare: strings().eventForcePrepare,
+            force_sync_execute: strings().eventForceExecute
+        };
+        let eventText = '';
+        if (event.action === 'joined' || event.action === 'left') {
+            const template = event.action === 'joined' ? strings().eventJoined : strings().eventLeft;
+            eventText = (template || '{name}').replace('{name}', displayName);
+        } else if (labels[event.action]) {
+            eventText = (strings().eventAction || '{name} {action}')
+                .replace('{name}', displayName)
+                .replace('{action}', labels[event.action]);
+        }
+        if (!eventText) return;
+        if (typeof event.id === 'string') {
+            renderedActivityIds.add(event.id);
+            renderedActivityIdOrder.push(event.id);
+            while (renderedActivityIdOrder.length > MAX_RENDERED_ACTIVITY_IDS) {
+                renderedActivityIds.delete(renderedActivityIdOrder.shift());
+            }
+        }
+
+        if (empty.isConnected) empty.remove();
+        if (!opened && context.eventNotifications) setUnreadCount(unreadCount + 1);
+        const wrapper = element('article', 'message event-message');
+        const body = element('span', 'event-text', eventText);
+        const time = element('time', 'time');
+        const date = new Date(event.timestamp);
+        time.textContent = Number.isFinite(date.getTime()) ? date.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' }) : '';
+        wrapper.append(body, time);
+        messages.append(wrapper);
+        while (messages.querySelectorAll('.message').length > MAX_MESSAGES) messages.querySelector('.message')?.remove();
+        messages.scrollTop = messages.scrollHeight;
+    }
+
+    function clearMessages() {
+        messages.replaceChildren(empty);
+        renderedActivityIds.clear();
+        renderedActivityIdOrder.length = 0;
+        setUnreadCount(0);
+    }
+
+    function triggerReactionRain(reaction) {
+        if (chatReactionDisplay !== 'video' || reducedMotion.matches || !QUICK_REACTIONS.includes(reaction)) return;
+        const available = Math.max(0, MAX_REACTION_PARTICLES - reactionLayer.childElementCount);
+        const particleCount = Math.min(10, available);
+        for (let index = 0; index < particleCount; index++) {
+            const particle = element('span', 'reaction-particle', reaction);
+            particle.style.left = `${4 + Math.random() * 88}%`;
+            particle.style.setProperty('--reaction-duration', `${2.8 + Math.random() * 1.6}s`);
+            particle.style.setProperty('--reaction-delay', `${Math.random() * .7}s`);
+            particle.style.setProperty('--reaction-drift', `${-45 + Math.random() * 90}px`);
+            particle.style.setProperty('--reaction-start-rotation', `${-35 + Math.random() * 70}deg`);
+            particle.style.setProperty('--reaction-end-rotation', `${-160 + Math.random() * 320}deg`);
+            particle.addEventListener('animationend', () => particle.remove(), { once: true });
+            reactionLayer.append(particle);
+        }
+    }
+
+    function updateComposerState() {
+        const length = [...textarea.value].length;
+        count.textContent = `${length}/${MAX_COMPOSER_CODE_POINTS}`;
+        count.style.color = length > MAX_COMPOSER_CODE_POINTS ? 'var(--danger)' : '';
+        status.textContent = length > MAX_COMPOSER_CODE_POINTS ? (strings().tooLong || '') : '';
+        return length;
+    }
+
+    function resetComposer() {
+        sendGeneration++;
+        sending = false;
+        textarea.value = '';
+        updateComposerState();
+        status.textContent = '';
+        sendButton.disabled = false;
+        for (const button of reactionButtons) button.disabled = false;
+    }
+
+    let launcherDrag = null;
+    let suppressLauncherClick = false;
+    launcher.addEventListener('click', event => {
+        if (suppressLauncherClick && event.detail !== 0) {
+            suppressLauncherClick = false;
+            return;
+        }
+        suppressLauncherClick = false;
+        setOpened(true);
+    });
+    launcher.addEventListener('pointerdown', event => {
+        if (layout.mode !== 'detached') return;
+        launcherDrag = {
+            pointerId: event.pointerId,
+            startX: event.clientX,
+            startY: event.clientY,
+            x: layout.launcherX,
+            y: layout.launcherY,
+            moved: false
+        };
+        launcher.setPointerCapture(event.pointerId);
+    });
+    launcher.addEventListener('pointermove', event => {
+        if (!launcherDrag || event.pointerId !== launcherDrag.pointerId) return;
+        const deltaX = event.clientX - launcherDrag.startX;
+        const deltaY = event.clientY - launcherDrag.startY;
+        if (Math.hypot(deltaX, deltaY) >= 4) launcherDrag.moved = true;
+        layout.launcherX = launcherDrag.x + deltaX;
+        layout.launcherY = launcherDrag.y + deltaY;
+        clampLauncher();
+        launcher.style.left = `${layout.launcherX}px`;
+        launcher.style.top = `${layout.launcherY}px`;
+    });
+    launcher.addEventListener('pointerup', event => {
+        if (!launcherDrag || event.pointerId !== launcherDrag.pointerId) return;
+        suppressLauncherClick = launcherDrag.moved;
+        launcherDrag = null;
+        saveLayout();
+    });
+    launcher.addEventListener('pointercancel', () => {
+        launcherDrag = null;
+        suppressLauncherClick = false;
+    });
+    closeButton.addEventListener('click', () => setOpened(false));
+    leftButton.addEventListener('click', () => setMode('left'));
+    detachedButton.addEventListener('click', () => setMode('detached'));
+    rightButton.addEventListener('click', () => setMode('right'));
+
+    textarea.addEventListener('input', updateComposerState);
+    const stopPageKeyboardShortcut = event => {
+        const path = typeof event.composedPath === 'function' ? event.composedPath() : [];
+        if (!path.includes(textarea) && !path.includes(composer)) return;
+        if (event.type === 'keydown' && event.key === 'Enter' && !event.shiftKey) {
+            event.preventDefault();
+            if (!sending) composer.requestSubmit();
+        }
+        event.stopImmediatePropagation();
+    };
+    for (const eventName of ['keydown', 'keyup', 'keypress']) {
+        window.addEventListener(eventName, stopPageKeyboardShortcut, true);
+    }
+    async function sendChatText(text, clearComposerValue = false) {
+        if (sending || !context?.enabled) return;
+        text = String(text || '').trim();
+        if (!text) return;
+        if ([...text].length > MAX_COMPOSER_CODE_POINTS) {
+            status.textContent = strings().tooLong || '';
+            return;
+        }
+        let chunks;
+        try {
+            chunks = globalThis.KoalaSyncChatFormat?.splitChatText(
+                text,
+                MAX_MESSAGE_CODE_POINTS,
+                MAX_CHAT_CHUNKS
+            );
+        } catch (_) {
+            status.textContent = strings().tooLong || '';
+            return;
+        }
+        if (!Array.isArray(chunks) || chunks.length === 0) return;
+        const generation = ++sendGeneration;
+        sending = true;
+        sendButton.disabled = true;
+        for (const button of reactionButtons) button.disabled = true;
+        status.textContent = '';
+        let completedChunks = 0;
+        let response = null;
+        for (const chunk of chunks) {
+            response = await messageRuntime({ type: 'CHAT_SEND', text: chunk });
+            if (destroyed || generation !== sendGeneration) return;
+            if (response?.status !== 'ok') break;
+            completedChunks++;
+        }
+        sending = false;
+        sendButton.disabled = false;
+        for (const button of reactionButtons) button.disabled = false;
+        if (completedChunks === chunks.length) {
+            if (clearComposerValue && textarea.value.trim() === text) {
+                textarea.value = '';
+                updateComposerState();
+            }
+        } else {
+            if (clearComposerValue && textarea.value.trim() === text) {
+                textarea.value = chunks.slice(completedChunks).join('\n');
+                updateComposerState();
+            }
+            status.textContent = response?.status === 'too_long' ? (strings().tooLong || '') : (strings().sendFailed || '');
+        }
+    }
+    composer.addEventListener('submit', async event => {
+        event.preventDefault();
+        await sendChatText(textarea.value, true);
+    });
+    for (const button of reactionButtons) {
+        button.addEventListener('click', () => sendChatText(button.dataset.reaction));
+    }
+
+    let drag = null;
+    header.addEventListener('pointerdown', event => {
+        if (layout.mode !== 'detached' || event.target.closest('button')) return;
+        drag = { pointerId: event.pointerId, startX: event.clientX, startY: event.clientY, x: layout.x, y: layout.y };
+        header.setPointerCapture(event.pointerId);
+    });
+    header.addEventListener('pointermove', event => {
+        if (!drag || event.pointerId !== drag.pointerId) return;
+        layout.x = drag.x + event.clientX - drag.startX;
+        layout.y = drag.y + event.clientY - drag.startY;
+        clampDetached();
+        applyLayout();
+    });
+    header.addEventListener('pointerup', event => {
+        if (!drag || event.pointerId !== drag.pointerId) return;
+        drag = null;
+        saveLayout();
+    });
+
+    const resizeObserver = new globalThis.ResizeObserver(() => {
+        if (applyingLayout || layout.mode !== 'detached') return;
+        const rect = panel.getBoundingClientRect();
+        if (!opened || !rect?.width || !rect.height) return;
+        if (Math.abs(rect.width - layout.width) < 1 && Math.abs(rect.height - layout.height) < 1) return;
+        layout.width = rect.width;
+        layout.height = rect.height;
+        layout.customWidth = rect.width;
+        layout.customHeight = rect.height;
+        if (chatSize !== 'custom') {
+            chatSize = 'custom';
+            setLocalStorage({ chatSize });
+        }
+        clampDetached();
+        saveLayout();
+    });
+    resizeObserver.observe(panel);
+
+    function moveIntoFullscreen() {
+        const parent = document.fullscreenElement || document.documentElement;
+        if (parent && host.parentNode !== parent) parent.append(host);
+        globalThis.requestAnimationFrame(applyLayout);
+    }
+
+    function handleResize() {
+        clampLauncher();
+        applyLayout();
+        saveLayout();
+        if (layout.mode === 'detached') {
+            clampDetached();
+        }
+    }
+
+    function handleSystemTheme() {
+        if (themeMode === 'system') applyTheme();
+    }
+
+    function handleStorage(changes, area) {
+        if (destroyed || area !== 'local') return;
+        if (changes.themeMode) themeMode = changes.themeMode.newValue || 'system';
+        if (changes.themePalette) themePalette = changes.themePalette.newValue || 'eucalyptus';
+        if (changes.themeMode || changes.themePalette) applyTheme();
+        if (changes.chatPosition) setMode(changes.chatPosition.newValue, false);
+        if (changes.chatSize) setSize(changes.chatSize.newValue, false);
+        if (changes.chatStartMode) {
+            chatStartMode = changes.chatStartMode.newValue === 'open' ? 'open' : 'bubble';
+            if (context?.enabled) {
+                startStateApplied = true;
+                setOpened(chatStartMode === 'open');
+            }
+        }
+        if (changes.chatReactionDisplay) {
+            chatReactionDisplay = changes.chatReactionDisplay.newValue === 'video' ? 'video' : 'chat';
+        }
+        if (changes.locale) refresh();
+    }
+
+    function handleRuntime(message) {
+        if (message?.type === 'CHAT_MESSAGE') appendMessage(message.message);
+        if (message?.type === 'CHAT_EVENT') appendEvent(message.event);
+        if (message?.type === 'CHAT_CONTEXT_UPDATE' || message?.type === 'CONNECTION_STATUS') refresh();
+        if (message?.type === 'CHAT_RESET') {
+            clearMessages();
+            resetComposer();
+            refresh();
+        }
+        if (message?.type === 'CHAT_DESTROY' || message?.type === 'TARGET_DEACTIVATE') destroy();
+    }
+
+    function destroy() {
+        if (destroyed) return;
+        destroyed = true;
+        refreshGeneration++;
+        sendGeneration++;
+        if (saveTimer) clearTimeout(saveTimer);
+        resizeObserver.disconnect();
+        clearPageDock();
+        pageDockStyle.remove();
+        for (const eventName of ['keydown', 'keyup', 'keypress']) {
+            window.removeEventListener(eventName, stopPageKeyboardShortcut, true);
+        }
+        document.removeEventListener('fullscreenchange', moveIntoFullscreen);
+        window.removeEventListener('resize', handleResize);
+        systemTheme.removeEventListener('change', handleSystemTheme);
+        try { chrome.storage.onChanged.removeListener(handleStorage); } catch (_) { /* invalidated context */ }
+        try { chrome.runtime.onMessage.removeListener(handleRuntime); } catch (_) { /* invalidated context */ }
+        host.remove();
+        window.koalaSyncChatOverlay = null;
+    }
+
+    document.addEventListener('fullscreenchange', moveIntoFullscreen);
+    window.addEventListener('resize', handleResize, { passive: true });
+    systemTheme.addEventListener('change', handleSystemTheme);
+    chrome.storage.onChanged.addListener(handleStorage);
+    chrome.runtime.onMessage.addListener(handleRuntime);
+    chrome.storage.local.get([storageKey, 'themeMode', 'themePalette', 'chatPosition', 'chatSize', 'chatStartMode', 'chatReactionDisplay'], data => {
+        if (destroyed) return;
+        const storedLayout = data[storageKey];
+        if (storedLayout && typeof storedLayout === 'object') {
+            layout = { ...layout, ...storedLayout };
+            layout.customWidth = Number(storedLayout.customWidth) || Number(storedLayout.width) || DEFAULT_WIDTH;
+            layout.customHeight = Number(storedLayout.customHeight) || Number(storedLayout.height) || DEFAULT_HEIGHT;
+        }
+        chatPosition = normalizePosition(data.chatPosition);
+        chatSize = normalizeSize(data.chatSize);
+        chatStartMode = data.chatStartMode === 'open' ? 'open' : 'bubble';
+        chatReactionDisplay = data.chatReactionDisplay === 'video' ? 'video' : 'chat';
+        layout.mode = chatPosition;
+        if (layout.mode === 'detached') layout.detachedInitialized = true;
+        const preset = SIZE_PRESETS[chatSize];
+        if (preset) {
+            layout.width = preset.width;
+            layout.height = preset.height;
+        }
+        themeMode = data.themeMode || 'system';
+        themePalette = data.themePalette || 'eucalyptus';
+        preferencesLoaded = true;
+        applyTheme();
+        applyLayout();
+        refresh();
+    });
+
+    window.koalaSyncChatOverlay = { refresh, destroy };
+})();

extension/chat-session.js

@@ -0,0 +1,111 @@
+export const MAX_ROOM_ID_LENGTH = 64;
+export const CHAT_SEND_LIMIT = 10;
+export const CHAT_SEND_WINDOW_MS = 10000;
+export const CHAT_ECHO_TIMEOUT_MS = 4000;
+
+export function normalizeRoomId(value) {
+    if (typeof value !== 'string') return '';
+    return value.trim().replace(/[^a-zA-Z0-9\-]/g, '').slice(0, MAX_ROOM_ID_LENGTH);
+}
+
+export function createChatSendLimiter({
+    limit = CHAT_SEND_LIMIT,
+    windowMs = CHAT_SEND_WINDOW_MS,
+    now = () => Date.now()
+} = {}) {
+    let timestamps = [];
+
+    return {
+        take() {
+            const current = now();
+            timestamps = timestamps.filter(timestamp => current - timestamp < windowMs);
+            if (timestamps.length >= limit) {
+                return {
+                    allowed: false,
+                    retryAfterMs: Math.max(1, windowMs - (current - timestamps[0]))
+                };
+            }
+            timestamps.push(current);
+            return { allowed: true, retryAfterMs: 0 };
+        },
+        reset() {
+            timestamps = [];
+        }
+    };
+}
+
+export function createChatEchoTracker({
+    timeoutMs = CHAT_ECHO_TIMEOUT_MS,
+    setTimer = globalThis.setTimeout,
+    clearTimer = globalThis.clearTimeout
+} = {}) {
+    const pending = new Map();
+
+    function settle(ciphertext, acknowledged) {
+        const entry = pending.get(ciphertext);
+        if (!entry) return false;
+        pending.delete(ciphertext);
+        clearTimer(entry.timer);
+        entry.resolve(acknowledged);
+        return true;
+    }
+
+    return {
+        waitFor(ciphertext) {
+            if (typeof ciphertext !== 'string' || !ciphertext) return Promise.resolve(false);
+            settle(ciphertext, false);
+            return new Promise(resolve => {
+                const timer = setTimer(() => {
+                    pending.delete(ciphertext);
+                    resolve(false);
+                }, timeoutMs);
+                pending.set(ciphertext, { resolve, timer });
+            });
+        },
+        acknowledge(ciphertext) {
+            return settle(ciphertext, true);
+        },
+        cancel(ciphertext) {
+            return settle(ciphertext, false);
+        },
+        reset() {
+            for (const ciphertext of [...pending.keys()]) settle(ciphertext, false);
+        }
+    };
+}
+
+export function shouldShowChatNotification({ enabled, targetTabId, tab, windowInfo }) {
+    if (!enabled) return false;
+    const normalizedTargetTabId = Number(targetTabId);
+    const targetIsFocused = Number.isInteger(normalizedTargetTabId)
+        && tab?.id === normalizedTargetTabId
+        && tab.active === true
+        && Number.isInteger(tab.windowId)
+        && windowInfo?.id === tab.windowId
+        && windowInfo.focused === true;
+    return !targetIsFocused;
+}
+
+export function createLatestTaskQueue() {
+    let generation = 0;
+    let tail = Promise.resolve();
+
+    return {
+        invalidate() {
+            generation++;
+        },
+        async run(task) {
+            const requestGeneration = ++generation;
+            const previous = tail;
+            let release;
+            tail = new Promise(resolve => { release = resolve; });
+            await previous.catch(() => {});
+            const isCurrent = () => requestGeneration === generation;
+            try {
+                return await task(isCurrent);
+            } finally {
+                release();
+            }
+        }
+    };
+}

extension/chat-session.test.mjs

@@ -0,0 +1,97 @@
+import { describe, expect, it } from 'vitest';
+import { CHAT_MESSAGE_RATE_LIMIT } from '../server/rate-limiter.js';
+import {
+    CHAT_ECHO_TIMEOUT_MS,
+    CHAT_SEND_LIMIT,
+    createChatEchoTracker,
+    createChatSendLimiter,
+    createLatestTaskQueue,
+    MAX_ROOM_ID_LENGTH,
+    normalizeRoomId,
+    shouldShowChatNotification
+} from './chat-session.js';
+
+describe('chat session boundaries', () => {
+    it('matches the relay room ID sanitizer and length limit', () => {
+        expect(normalizeRoomId('  ROOM_!42  ')).toBe('ROOM42');
+        expect(normalizeRoomId('A'.repeat(MAX_ROOM_ID_LENGTH + 10))).toBe('A'.repeat(MAX_ROOM_ID_LENGTH));
+        expect(normalizeRoomId(null)).toBe('');
+    });
+
+    it('allows ten-message client bursts without exceeding the relay threshold', () => {
+        expect(CHAT_SEND_LIMIT).toBe(CHAT_MESSAGE_RATE_LIMIT);
+        let current = 1000;
+        const limiter = createChatSendLimiter({ now: () => current });
+        for (let index = 0; index < CHAT_SEND_LIMIT; index++) {
+            expect(limiter.take()).toEqual({ allowed: true, retryAfterMs: 0 });
+        }
+        expect(limiter.take()).toEqual({ allowed: false, retryAfterMs: 10000 });
+        current += 10000;
+        expect(limiter.take()).toEqual({ allowed: true, retryAfterMs: 0 });
+        limiter.reset();
+        expect(limiter.take()).toEqual({ allowed: true, retryAfterMs: 0 });
+    });
+
+    it('waits for the matching relay echo and clears pending sends on reset or timeout', async () => {
+        const timers = new Map();
+        let nextTimerId = 1;
+        const tracker = createChatEchoTracker({
+            setTimer(callback, timeoutMs) {
+                const id = nextTimerId++;
+                timers.set(id, { callback, timeoutMs });
+                return id;
+            },
+            clearTimer(id) {
+                timers.delete(id);
+            }
+        });
+
+        const acknowledged = tracker.waitFor('ciphertext-1');
+        expect(tracker.acknowledge('ciphertext-1')).toBe(true);
+        await expect(acknowledged).resolves.toBe(true);
+
+        const reset = tracker.waitFor('ciphertext-2');
+        tracker.reset();
+        await expect(reset).resolves.toBe(false);
+
+        const timedOut = tracker.waitFor('ciphertext-3');
+        const timeout = [...timers.values()][0];
+        expect(timeout.timeoutMs).toBe(CHAT_ECHO_TIMEOUT_MS);
+        timeout.callback();
+        await expect(timedOut).resolves.toBe(false);
+    });
+
+    it('suppresses chat notifications only while the target tab and its window are focused', () => {
+        const focused = {
+            enabled: true,
+            targetTabId: 7,
+            tab: { id: 7, active: true, windowId: 3 },
+            windowInfo: { id: 3, focused: true }
+        };
+        expect(shouldShowChatNotification(focused)).toBe(false);
+        expect(shouldShowChatNotification({ ...focused, windowInfo: { id: 3, focused: false } })).toBe(true);
+        expect(shouldShowChatNotification({ ...focused, tab: { id: 7, active: false, windowId: 3 } })).toBe(true);
+        expect(shouldShowChatNotification({ ...focused, targetTabId: 8 })).toBe(true);
+        expect(shouldShowChatNotification({ ...focused, enabled: false })).toBe(false);
+    });
+
+    it('serializes join work and prevents an older request from winning storage races', async () => {
+        const queue = createLatestTaskQueue();
+        let releaseFirst;
+        const writes = [];
+        const first = queue.run(async isCurrent => {
+            await new Promise(resolve => { releaseFirst = resolve; });
+            if (isCurrent()) writes.push('first');
+            return { status: isCurrent() ? 'ok' : 'superseded' };
+        });
+        await new Promise(resolve => setTimeout(resolve, 0));
+        const second = queue.run(async isCurrent => {
+            if (isCurrent()) writes.push('second');
+            return { status: 'ok' };
+        });
+        releaseFirst();
+        await expect(first).resolves.toEqual({ status: 'superseded' });
+        await expect(second).resolves.toEqual({ status: 'ok' });
+        expect(writes).toEqual(['second']);
+    });
+});

extension/chat-wire.js

@@ -0,0 +1,11 @@
+export function buildChatRelayPayload(ciphertext) {
+    return { ciphertext };
+}
+
+export function encodeSocketEvent(event, data, forbiddenSecret = '') {
+    const payload = JSON.stringify([event, data]);
+    if (forbiddenSecret && payload.includes(forbiddenSecret)) {
+        throw new Error('Refusing to send chat secret to relay');
+    }
+    return `42${payload}`;
+}

extension/chat-wire.test.mjs

@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest';
+import { buildChatRelayPayload, encodeSocketEvent } from './chat-wire.js';
+
+describe('chat wire boundary', () => {
+    const secret = 'R5Ti1nxp0crfAFHf3gVncw';
+
+    it('sends only ciphertext for chat messages', () => {
+        expect(buildChatRelayPayload('ciphertext')).toEqual({ ciphertext: 'ciphertext' });
+    });
+
+    it('rejects the secret anywhere in any outgoing relay event', () => {
+        for (const [event, payload] of [
+            ['join_room', { roomId: 'ROOM', password: 'PASS', chatKey: secret }],
+            ['peer_status', { status: 'heartbeat', nested: { secret } }],
+            ['chat_message', { ciphertext: `prefix-${secret}-suffix` }]
+        ]) {
+            expect(() => encodeSocketEvent(event, payload, secret)).toThrow('Refusing to send chat secret');
+        }
+        expect(encodeSocketEvent('join_room', { roomId: 'ROOM', password: 'PASS' }, secret)).not.toContain(secret);
+    });
+});

extension/content.js

@@ -12,7 +12,34 @@
 
     // Injection Guard: Check if already injected AND context is valid
 
-    try {
+    try {
+
+        if (window.koalaSyncInjected && chrome.runtime.id) {
+
+            return;
+
+        }
+
+    } catch (_e) {
+
+        // Context invalidated, proceed with re-injection
+
+    }
+
+    window.koalaSyncInjected = true;
+    let destroyed = false;
+    const lifecycleTimeouts = new Set();
+    const seekPollTimers = new Set();
+    const attachedVideos = new Set();
+
+    function scheduleLifecycleTimeout(callback, delay) {
+        const timer = setTimeout(() => {
+            lifecycleTimeouts.delete(timer);
+            if (!destroyed) callback();
+        }, delay);
+        lifecycleTimeouts.add(timer);
+        return timer;
+    }
 
     function runtimeMessage(message, callback) {
         if (destroyed) return Promise.resolve(undefined);
@@ -62,15 +89,16 @@
 
     // Each entry is a per-type timer (key = 'playing'|'paused'|'seek').
 
+    // While a timer exists, matching native events are consumed and not relayed.
+
+    // Timers self-clean after 300ms if the native event never fires.
+
+    let _suppressTimers = {};
+
+
+
     function _setSuppress(state) {
-    // While a timer exists, matching native events are consumed and not relayed.
-
-    // Timers self-clean after 300ms if the native event never fires.
-
-    let _suppressTimers = {};
-
-
-
+
         if (_suppressTimers[state]) clearTimeout(_suppressTimers[state]);
 
         _suppressTimers[state] = setTimeout(() => {
@@ -210,17 +238,20 @@
         if (!Number.isFinite(targetTime)) return targetTime;
         const siteTimeline = getSiteQuirkTimeline(video);
         if (!siteTimeline) return targetTime;
-        if (!siteTimeline) return targetTime;
+        const nativeTarget = siteTimeline.nativeStart + targetTime * siteTimeline.nativeScale;
+        const max = Number.isFinite(siteTimeline.end) ? siteTimeline.end : nativeTarget;
         const min = Number.isFinite(siteTimeline.start) ? siteTimeline.start : 0;
         return Math.max(min, Math.min(max, nativeTarget));
     }
 
     function shouldUsePageApiSeek() {
-
-    function shouldUsePageApiSeek() {
-        return window.KOALA_PAGE_API_SEEK_ENABLED === true &&
-            typeof window.koalaFindPageApiSeekProvider === 'function' &&
-            !!window.koalaFindPageApiSeekProvider(window.location.hostname);
+        return window.KOALA_PAGE_API_SEEK_ENABLED === true &&
+            typeof window.koalaFindPageApiSeekProvider === 'function' &&
+            !!window.koalaFindPageApiSeekProvider(window.location.hostname);
+    }
+
+    function seekVideo(video, targetTime) {
+        // Prefer a precise page-level seek API when available (Netflix, Disney+);
         // for those players the DOM/button seek path is imprecise or impossible.
         if (shouldUsePageApiSeek()) {
             expectedSeekTime = targetTime;
@@ -234,8 +265,9 @@
 
     // --- Play/Pause Coalescing (leading + trailing) ---
 
-
-
+    // Media players (HLS/DASH, ad insertion, ABR/quality switches, source swaps,
+
+    // page teardown) fire bursts of native play/pause events within a few hundred
 
     // ms. Relaying each as a distinct command spams peers and the relay.
 
@@ -320,9 +352,9 @@
 
     // --- Host Control Mode (guest-side) ---
 
-        }
+    // When a room is in 'host-only' mode and we're a guest, a deliberate local
 
-    });
+    // pause/seek must not drive the room (background/server already drop it). Here
 
     // we handle the *local* UX: snap back to the host's position, or — if the user
 
@@ -355,7 +387,7 @@
 
         body:   'Only the host can control playback in this room. Keep watching together, or watch on your own?',
 
-
+        stay:   'Stay in sync',
 
         solo:   'Watch on my own',
 
@@ -457,7 +489,7 @@
 
     }
 
-
+
 
     // Snap the local player back to the host's current position/state.
 
@@ -466,7 +498,7 @@
         if (hcmDesynced) return; // user opted out — never yank them back automatically
 
         hcmSnapBackCooldownUntil = Date.now() + HCM_SNAP_BACK_COOLDOWN_MS;
-
+
         const video = findVideo();
 
         if (!video) return;
@@ -480,14 +512,16 @@
         // Adopt the host's play/pause state — but ONLY if we actually know it.
 
         // Defaulting to PLAY when the state is unknown would auto-resume a paused
-        if (target && Number.isFinite(target.targetTime)) {
-
-            tryMediaAction(EVENTS.SEEK, { targetTime: target.targetTime });
-
-        }
-
+
+        // video against the host's real state (H-1).
+
+        if (target && target.playbackState === 'paused') {
+
+            tryMediaAction(EVENTS.PAUSE);
+
+        } else if (target && target.playbackState === 'playing') {
 
-
+            tryMediaAction(EVENTS.PLAY);
 
         }
 
@@ -518,12 +552,12 @@
                     else reportLog('Host-only: resync requested but host state unavailable', 'warn');
 
                     return;
-        let attempts = 0;
+
                 }
 
                 hcmSnapBackToHost(res.target);
 
-
+            });
 
         };
 
@@ -786,7 +820,7 @@
         hcmShowBadge();
 
     }
-        hcmDesynced = true;
+
 
 
     function hcmExitDesync() {
@@ -810,7 +844,7 @@
 
     }
 
-        hcmRemoveBadge();
+
 
     function hcmShowBadge() {
 
@@ -923,36 +957,52 @@
 
         // Scan likely media hosts even when light-DOM videos exist; many players
 
-
-
-
-    function reportLog(message, level = 'info') {
-
-        chrome.runtime.sendMessage({ type: 'LOG', message, level }).catch(() => {});
-
-    }
-
-
+        // expose a tiny preview/ad video outside Shadow DOM and the real player inside.
+
+        const potentialHosts = root.querySelectorAll('[id*="player" i], [class*="player" i], [id*="video" i], [class*="video" i], [id*="media" i], [class*="media" i], [id*="stream" i], [class*="stream" i], ytd-player, netflix-player, emby-player, jellyfin-player, video-player');
+
+        for (const el of potentialHosts) {
+
+            if (el.shadowRoot) {
+
+                const found = findVideo(el.shadowRoot);
+
+                if (found) candidates.push(found);
+
+            }
+
+        }
+
+
 
         if (candidates.length === 0) return null;
 
 
 
         // Multiple videos found → pick the best one
-
-        const candidates = Array.from(root.querySelectorAll('video'));
-
-
-
-        // Scan likely media hosts even when light-DOM videos exist; many players
-
-        // expose a tiny preview/ad video outside Shadow DOM and the real player inside.
-
-        const potentialHosts = root.querySelectorAll('[id*="player" i], [class*="player" i], [id*="video" i], [class*="video" i], [id*="media" i], [class*="media" i], [id*="stream" i], [class*="stream" i], ytd-player, netflix-player, emby-player, jellyfin-player, video-player');
+
+        if (candidates.length === 1) return candidates[0];
+
+
+
+        let best = null;
+
+        let bestScore = -1;
+
+        for (const v of candidates) {
+
+            if (v.tagName !== 'VIDEO') continue;
+
             // Score: visible area + bonus for unmuted + bonus for longer duration
 
-
+            const area = (v.videoWidth || v.offsetWidth || 0) * (v.videoHeight || v.offsetHeight || 0);
 
+            const unmutedBonus = v.muted ? 0 : 100000;
+
+            const durationBonus = (v.duration && isFinite(v.duration) ? v.duration : 0) * 100;
+
+            const score = area + unmutedBonus + durationBonus;
+
             if (score > bestScore) {
 
                 bestScore = score;
@@ -1019,7 +1069,7 @@
 
             ...safeSettings,
 
-
+            compressor: {
 
                 ...DEFAULT_AUDIO_SETTINGS.compressor,
 
@@ -1037,7 +1087,7 @@
 
         };
 
-
+    }
 
 
 
@@ -1045,15 +1095,15 @@
 
         if (!audioCtx) {
 
-
+            try {
 
                 const AudioContextClass = window.AudioContext || window.webkitAudioContext;
 
-
+                if (!AudioContextClass) return null;
 
                 audioCtx = new AudioContextClass({ latencyHint: 'interactive' });
 
-
+            } catch (e) {
 
                 reportLog(`Audio Processing unavailable: ${e.message}`, 'warn');
 
@@ -1071,7 +1121,7 @@
 
         return audioCtx;
 
-
+    }
 
 
 
@@ -1082,7 +1132,7 @@
             audioCtx.close().catch(() => {});
 
             audioCtx = null;
-        if (!audioCtx) {
+
         }
 
         audioChains = new WeakMap();
@@ -1265,14 +1315,16 @@
 
             : null;
 
-
+    }
+
 
 
     // Extract a canonical episode identifier from a title string.
 
     // Handles: S01E01, S1E1, S01 - E01, Season 1 Episode 1, "Folge 5", "Episode 5", "Ep. 5", "#5"
-
-        chain.compressor.release.value = params.release ?? 0.300;
+
+    // Returns null if no episode pattern found.
+
     // --- SHARED_EPISODE_UTILS_INJECT_START ---
 
     // This block is automatically replaced by /scripts/build-extension.cjs
@@ -1280,7 +1332,7 @@
 
         if (!title || typeof title !== 'string') return null;
 
-            rampGain(chain.dryGain, 0, t);
+        const se = title.match(/S(?:eason\s*)?(\d+)[^a-zA-Z0-9]*E(?:pisode\s*)?(\d+)/i);
 
         if (se) return `S${String(se[1]).padStart(2, '0')}E${String(se[2]).padStart(2, '0')}`;
 
@@ -1308,8 +1360,9 @@
 
         if (idA || idB) return false;
 
-    // Extract a canonical episode identifier from a title string.
-
+        return titleA === titleB;
+
+    }
 
     // --- SHARED_EPISODE_UTILS_INJECT_END ---
 
@@ -1373,42 +1426,64 @@
 
     function onEpisodeTransition(newTitle) {
 
-        return idA !== idB;             // Both parseable → only block if different
+        // Debounce: prevent duplicate fires from multiple signals
+
         if (episodeTransitionDebounce) return;
 
         episodeTransitionDebounce = setTimeout(() => {
-    function checkEpisodeTransition() {
-
-        const currentTitle = getMediaTitle();
-
+
+            episodeTransitionDebounce = null;
+
+        }, 2000);
+
+
+
+        reportLog(`Episode transition detected: "${newTitle}"`, 'info');
+
+
+
+        // EC-12: a new episode dissolves any solo/desync state — the guest rejoins
+
+        // the room for the fresh content rather than staying stuck on the old one.
 
         if (hcmDesynced) hcmReset();
-        const current = video ? getSyncCurrentTime(video) : null;
-        // Only trigger if: we had a previous title, the title changed,
-
-        // a video exists, and we're near the start of new content.
-
-        if (lastKnownMediaTitle && currentTitle
-
-            && !sameEpisode(currentTitle, lastKnownMediaTitle)
-            && extractEpisodeId(currentTitle) !== null
+
+
+
+        // Do NOT pause here. We notify background.js first.
+
+        // Background checks the setting; if enabled it creates a lobby
+
+        // and sends back PAUSE_FOR_LOBBY so we only freeze if the feature is on.
+
+        runtimeMessage({
+            type: 'EPISODE_CHANGED',
 
             payload: { newTitle }
 
         }).catch(() => {});
 
     }
-
-            onEpisodeTransition(currentTitle);
-
-        }
-
-
-
-        // Always track the latest known title
-
-        if (currentTitle) lastKnownMediaTitle = currentTitle;
-
+
+    function checkAndReportLobbyReady(expectedTitle) {
+
+        const video = findVideo();
+
+        const currentTitle = getMediaTitle();
+
+        const current = video ? getSyncCurrentTime(video) : null;
+        if (video && currentTitle && sameEpisode(currentTitle, expectedTitle)
+
+            && current !== null && video.readyState >= 1) {
+
+            if (current >= 5) {
+                expectedSeekTime = 0;
+                video.currentTime = 0;
+            }
+            // Match! Pause at start and report ready.
+
+            if (!video.paused) {
+
                 _setSuppress('paused');
 
                 video.pause();
@@ -1475,8 +1550,9 @@
     }
 
 
-
-                video.pause();
+
+
+
     function stopLobbyPoll() {
 
         _pendingLobbyTitle = null;
@@ -1492,9 +1568,10 @@
     }
 
 
-            return true;
-
-        }
+
+    function getPlayerActionFixes() {
+        return [
+            {
                 name: 'youtube-player-buttons',
                 urls: ['youtube.com'],
                 playPauseButtonSelector: '.ytp-play-button'
@@ -1509,8 +1586,9 @@
 
     function getActivePlayerActionFix() {
         return getPlayerActionFixes().find(fix => matchesPlayerUrls(fix.urls)) || null;
-
-        // NOTE: Do NOT pause here. Three callers reach this function:
+    }
+
+    function tryPlayerActionFix(fix, action, video, data) {
         if (!fix) return false;
         const button = document.querySelector(fix.playPauseButtonSelector);
         if (!button) return false;
@@ -1532,8 +1610,9 @@
         if (!video) return;
 
 
-        lobbyPollTimer = setInterval(() => {
-
+        if (action === EVENTS.SEEK) {
+
+            const target = data ? (data.targetTime !== undefined ? data.targetTime : data.currentTime) : undefined;
 
             if (!Number.isFinite(target)) {
 
@@ -1552,12 +1631,13 @@
             const actionFix = getActivePlayerActionFix();
             if (tryPlayerActionFix(actionFix, action, video, data)) {
                 return;
-            lobbyPollTimer = null;
-
+            }
+
+            // Fallback for native HTML5
             if (action === EVENTS.PLAY) {
 
                 _setSuppress('playing');
-
+
                 video.play().catch((e) => {
 
                     reportLog(`Playback prevented: ${e.message}`, 'warn');
@@ -1579,18 +1659,22 @@
     } catch (e) {
 
             reportLog(`Media Action Error: ${e.message}`, 'error');
-    function tryPlayerActionFix(fix, action, video, data) {
-        if (!fix) return false;
-        const button = document.querySelector(fix.playPauseButtonSelector);
-        if (!button) return false;
-
+
+        }
+
+    }
+
+
+
     // --- Helper: Wait until video is ready for playback (buffered & seeked) ---
 
     function pollSeekReady(targetTime, timeoutMs = 8000) {
-            button.click();
-        }
-        if (action === EVENTS.SEEK) {
-            seekVideo(video, data.targetTime, data.delta);
+        return new Promise((resolve) => {
+            const interval = 150;
+            let elapsed = 0;
+            const timer = setInterval(() => {
+                if (destroyed) {
+                    clearInterval(timer);
                     seekPollTimers.delete(timer);
                     resolve(false);
                     return;
@@ -1599,30 +1683,104 @@
                 if (!video) {
                     clearInterval(timer);
                     seekPollTimers.delete(timer);
-
-
-        if (action === EVENTS.SEEK) {
+                    resolve(false);
+                    return;
+                }
+
 
 
-
-            if (!Number.isFinite(target)) {
-
-                reportLog(`Media Action Error: Invalid seek payload - ${JSON.stringify(data)}`, 'error');
+                elapsed += interval;
+
+                const current = getSyncCurrentTime(video);
+                const timeDiff = current !== null ? Math.abs(current - targetTime) : Infinity;
                 const ready = video.readyState >= 3 && timeDiff < 2.0;
                 if (ready) {
-
-            }
-
-            data = { ...data, targetTime: target };
+                    clearInterval(timer);
+                    seekPollTimers.delete(timer);
+                    resolve(true);
+                } else if (elapsed >= timeoutMs) {
+                    clearInterval(timer);
+                    seekPollTimers.delete(timer);
+                    resolve(false);
+                }
+            }, interval);
+            seekPollTimers.add(timer);
+        });
+    }
+
+
+    // Listen for commands from background.js
+
+    function handleRuntimeMessage(message, sender, sendResponse) {
+        if (!message) return;
+        if (message.type === 'TARGET_DEACTIVATE') {
+            destroyContentScript();
+            sendResponse({ ok: true });
+            return true;
+        }
+        if (destroyed) return;
+        if (message.action === 'get_current_time') {
+            const video = findVideo();
+            sendResponse({ currentTime: video ? getSyncCurrentTime(video) : null });
+            return true;
+        }
+
+
+        if (message.action === 'APPLY_AUDIO_SETTINGS') {
+
+            _audioProcessingAllowed = true;
+
+            _audioSettings = mergeAudioSettings(message.settings);
+
+            const video = findVideo();
+
+            if (video) applyAudioSettings(video, _audioSettings);
+
+            sendResponse({ ok: true });
+
+            return true;
+
+        }
+
+
+
+        if (message.action === 'RESET_AUDIO_PROCESSING') {
+
+            _audioProcessingAllowed = false;
+
+            bypassCurrentAudioProcessing();
+
+            sendResponse({ ok: true });
+
+            return true;
+
+        }
+
+
+
+        // Host Control Mode: room mode/role changed.
+
+        if (message.type === 'CONTROL_MODE') {
+
+            const wasGated = hcmIsGuestGated();
+
+            const prevHostPeerId = hcmHostPeerId;
+
+            hcmControlMode = message.controlMode || 'everyone';
+
+            hcmAmController = !!message.amController;
+
+            hcmHostPeerId = message.hostPeerId || null;
+
             // Reset guest-side state when leaving the gated state, OR when the
 
             // host identity changes (room switch, host-leave fallback, missed
 
-        try {
+            // teardown broadcast) — clears stale desync so a rejoin starts clean (H-3).
 
             const hostChanged = prevHostPeerId !== null && hcmHostPeerId !== prevHostPeerId;
-                return;
-            }
+
+            if ((wasGated && !hcmIsGuestGated()) || hostChanged) hcmReset();
 
             sendResponse({ ok: true });
 
@@ -1631,8 +1789,8 @@
         }
 
 
-                    reportLog(`Playback prevented: ${e.message}`, 'warn');
-
+
+        // Host Control Mode: background blocked our local action — handle UX locally.
 
         if (message.type === 'HOST_BLOCKED') {
 
@@ -1647,8 +1805,8 @@
 
 
         // Background asks for an immediate state push (e.g. the first peer just
-    } catch (e) {
-
+
+        // joined while we were solo) so the newcomer syncs without waiting.
 
         if (message.type === 'REQUEST_HEARTBEAT') {
 

extension/host-access.js

@@ -0,0 +1,194 @@
+export const HOST_ACCESS_REQUIRED_STATUS = 'host_permission_required';
+
+export function normalizeTabId(value) {
+    if (typeof value === 'number') {
+        return Number.isSafeInteger(value) && value > 0 ? value : null;
+    }
+    if (typeof value !== 'string') return null;
+
+    const normalized = value.trim();
+    if (!/^[1-9]\d*$/.test(normalized)) return null;
+    const tabId = Number(normalized);
+    return Number.isSafeInteger(tabId) ? tabId : null;
+}
+
+function browserSupportsPortMatchPatterns(chromeApi) {
+    // runtime.getBrowserInfo is a Firefox-only WebExtension API. Firefox does
+    // not accept ports in match patterns, while Chromium does.
+    return typeof chromeApi?.runtime?.getBrowserInfo !== 'function';
+}
+
+export function describeTabUrl(rawUrl, { includePort = true } = {}) {
+    if (typeof rawUrl !== 'string' || !rawUrl) return null;
+
+    try {
+        const url = new URL(rawUrl);
+        if (url.protocol === 'http:' || url.protocol === 'https:') {
+            const permissionHost = includePort ? url.host : url.hostname;
+            return {
+                url: rawUrl,
+                host: url.host,
+                originPattern: `${url.protocol}//${permissionHost}/*`
+            };
+        }
+        if (url.protocol === 'file:') {
+            return {
+                url: rawUrl,
+                host: 'local file',
+                originPattern: 'file:///*'
+            };
+        }
+    } catch (_e) {
+        // Invalid and browser-internal URLs cannot receive host access.
+    }
+
+    return null;
+}
+
+export async function inspectTabHostAccess(chromeApi, tabId) {
+    const tab = await chromeApi.tabs.get(tabId);
+    // executeScript targets the committed document. pendingUrl may already point
+    // at another origin while tab.url is still the document being injected into.
+    const descriptor = describeTabUrl(tab?.url || tab?.pendingUrl || '', {
+        includePort: browserSupportsPortMatchPatterns(chromeApi)
+    });
+    if (!descriptor) {
+        return {
+            tab,
+            url: tab?.url || '',
+            host: null,
+            originPattern: null,
+            granted: null
+        };
+    }
+
+    if (typeof chromeApi.permissions?.contains !== 'function') {
+        return { tab, ...descriptor, granted: null };
+    }
+
+    try {
+        const granted = await callBooleanPermissionMethod(
+            chromeApi,
+            'contains',
+            { origins: [descriptor.originPattern] },
+            { timeoutMs: 1000 }
+        );
+        return {
+            tab,
+            ...descriptor,
+            granted: granted === null ? null : granted === true
+        };
+    } catch (_e) {
+        // Permission inspection is advisory. The actual script injection below
+        // remains the source of truth, including temporary activeTab access.
+        return { tab, ...descriptor, granted: null };
+    }
+}
+
+function callBooleanPermissionMethod(chromeApi, methodName, request, { timeoutMs = null } = {}) {
+    const method = chromeApi.permissions?.[methodName];
+    if (typeof method !== 'function') return Promise.resolve(null);
+
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let timeout = null;
+        const clearSettlementTimeout = () => {
+            if (timeout !== null) {
+                clearTimeout(timeout);
+                timeout = null;
+            }
+        };
+        const finish = (value) => {
+            if (settled) return;
+            settled = true;
+            clearSettlementTimeout();
+            resolve(value === true ? true : value === false ? false : null);
+        };
+        const fail = (error) => {
+            if (settled) return;
+            settled = true;
+            clearSettlementTimeout();
+            reject(error instanceof Error ? error : new Error(String(error || 'Permission request failed')));
+        };
+        const callback = (value) => {
+            const lastError = chromeApi.runtime?.lastError;
+            if (lastError) {
+                fail(new Error(lastError.message || String(lastError)));
+                return;
+            }
+            finish(value);
+        };
+
+        if (Number.isFinite(timeoutMs) && timeoutMs > 0) {
+            timeout = setTimeout(() => finish(null), timeoutMs);
+        }
+
+        try {
+            const result = method.call(chromeApi.permissions, request, callback);
+            if (result && typeof result.then === 'function') {
+                result.then(finish, fail);
+            } else if (typeof result === 'boolean') {
+                finish(result);
+            }
+            // Callback-based Chromium/Firefox APIs return undefined and settle
+            // through callback. Promise-based implementations settle above.
+        } catch (error) {
+            fail(error);
+        }
+    });
+}
+
+export function requestOriginPermission(chromeApi, originPattern) {
+    if (typeof originPattern !== 'string' || !originPattern) {
+        return Promise.resolve(null);
+    }
+    return callBooleanPermissionMethod(
+        chromeApi,
+        'request',
+        { origins: [originPattern] },
+        { timeoutMs: 60000 }
+    ).catch(() => false);
+}
+
+export function isHostAccessError(error) {
+    const message = typeof error?.message === 'string' ? error.message : String(error || '');
+    return /host permission|permission to access (?:this|the|respective) host|cannot access contents of/i.test(message);
+}
+
+function hostAccessRequestDetails(tabId, originPattern) {
+    const request = { tabId };
+    if (typeof originPattern === 'string' && originPattern) {
+        request.pattern = originPattern;
+    }
+    return request;
+}
+
+export async function addTabHostAccessRequest(chromeApi, tabId, originPattern = null) {
+    if (typeof chromeApi.permissions?.addHostAccessRequest !== 'function') {
+        return false;
+    }
+
+    try {
+        await chromeApi.permissions.addHostAccessRequest(
+            hostAccessRequestDetails(tabId, originPattern)
+        );
+        return true;
+    } catch (_e) {
+        return false;
+    }
+}
+
+export async function removeTabHostAccessRequest(chromeApi, tabId, originPattern = null) {
+    if (typeof chromeApi.permissions?.removeHostAccessRequest !== 'function') {
+        return false;
+    }
+
+    try {
+        await chromeApi.permissions.removeHostAccessRequest(
+            hostAccessRequestDetails(tabId, originPattern)
+        );
+        return true;
+    } catch (_e) {
+        return false;
+    }
+}

extension/locales/de.json

@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "Weiter",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "Zum nächsten Schritt gehen",
   "ONBOARDING_1_TITLE": "Willkommen bei KoalaSync!",
-  "ONBOARDING_1_TEXT": "Schau Videos in perfekter Synchronität zusammen — egal wo ihr seid. Machen wir eine kurze Tour!",
+  "ONBOARDING_1_TEXT": "Schaut Videos gemeinsam, egal wo ihr seid. Hier ist eine kurze Einführung.",
   "ONBOARDING_2_TITLE": "1. Raum erstellen",
   "ONBOARDING_2_TEXT": "Hier geht's los. Erstelle einen Raum und teile den Einladungslink mit deinen Freunden.",
   "ONBOARDING_3_TITLE": "2. Video auswählen",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identität noch nicht geladen. Warte kurz und versuche es erneut.",
   "ERR_NO_PEERS_TIME": "Keine anderen Teilnehmer mit bekannter Zeit. Wechsle zu 'Zu mir springen'.",
   "ERR_NO_VIDEO_TAB": "Verbindung zum Video-Tab fehlgeschlagen.",
+  "SITE_ACCESS_REQUIRED": "Dein Browser blockiert KoalaSync auf {host}. Klicke unten auf „Zugriff erlauben“. Falls kein Dialog erscheint, erlaube KoalaSync in den Erweiterungs- oder Websiteberechtigungen für diese Seite.",
+  "BTN_RETRY_ACCESS": "Zugriff erlauben",
   "ERR_SELECT_VIDEO": "Bitte wähle zuerst ein Video aus!",
   "TOAST_INVITE_COPIED": "Einladungslink kopiert!",
   "TOAST_COPY_FAILED": "Kopieren in Zwischenablage fehlgeschlagen",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Zeitüberschreitung — nicht alle Teilnehmer haben die Episode geladen",
   "LOBBY_CANCEL_USER": "Vom Benutzer abgebrochen",
   "NOTIF_ERROR_TITLE": "KoalaSync-Fehler",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "KoalaSync unterstützen",
   "FOOTER_REVIEW": "★ Bewerten",
   "FOOTER_SUPPORT_PROMPT": "Gefällt dir KoalaSync? Hinterlasse eine Bewertung!",
   "LABEL_AUDIO_PROCESSING": "Audio-Verarbeitung",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "Profil & Aussehen",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "Ändere deinen Benutzernamen, dein Design und deine Spracheinstellungen.",
   "LABEL_SETTINGS_GROUP_SYNC": "Wiedergabe & Sync",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Passe Wiedergabe-, Benachrichtigungs- und Audioeinstellungen an."
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Passe Wiedergabe-, Benachrichtigungs- und Audioeinstellungen an.",
+  "LABEL_CHAT_ENABLED": "Raum-Chat aktivieren",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "Verschlüsselten Raum-Chat im ausgewählten Video-Tab anzeigen.",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "Darstellung und Position des verschlüsselten Raum-Chats festlegen.",
+  "CHAT_SETTINGS_NOTE": "Optional und Ende-zu-Ende verschlüsselt. Nachrichten sind nur live sichtbar und werden vom Relay nicht gespeichert.",
+  "LABEL_CHAT_POSITION": "Position",
+  "LABEL_CHAT_POSITION_TOOLTIP": "Lege fest, wo der Chat am ausgewählten Player angezeigt wird.",
+  "LABEL_CHAT_SIZE": "Overlay-Größe",
+  "LABEL_CHAT_SIZE_TOOLTIP": "Wähle die Standardgröße des Chat-Overlays.",
+  "OPTION_CHAT_SIZE_COMPACT": "Kompakt",
+  "OPTION_CHAT_SIZE_STANDARD": "Standard",
+  "OPTION_CHAT_SIZE_LARGE": "Groß",
+  "OPTION_CHAT_SIZE_CUSTOM": "Letzte eigene Größe",
+  "LABEL_CHAT_START_MODE": "Startansicht",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "Lege fest, ob der Chat als schwebende Blase oder geöffnetes Overlay startet.",
+  "OPTION_CHAT_START_BUBBLE": "Schwebende Chatblase",
+  "OPTION_CHAT_START_OPEN": "Geöffnetes Overlay",
+  "LABEL_CHAT_REACTION_DISPLAY": "Schnellreaktionen",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "Lege fest, ob Schnellreaktionen nur im Chat oder zusätzlich über dem Video erscheinen.",
+  "OPTION_CHAT_REACTIONS_CHAT": "Nur im Chat",
+  "OPTION_CHAT_REACTIONS_VIDEO": "Chat und Video",
+  "CHAT_QUICK_REACTIONS": "Schnellreaktionen",
+  "CHAT_TITLE": "Raum-Chat",
+  "CHAT_LIVE_ONLY": "Nur live. Kein Verlauf.",
+  "CHAT_OPEN": "Raum-Chat öffnen",
+  "CHAT_CLOSE": "Chat schließen",
+  "CHAT_DOCK_LEFT": "Chat links andocken",
+  "CHAT_DOCK_RIGHT": "Chat rechts andocken",
+  "CHAT_DETACHED": "Chat frei positionieren",
+  "CHAT_PLACEHOLDER": "Nachricht schreiben...",
+  "CHAT_SEND": "Senden",
+  "CHAT_MISSING_KEY": "Chat ist nur über einen aktuellen Einladungslink verfügbar.",
+  "CHAT_TOO_LONG": "Maximal 5000 Zeichen.",
+  "CHAT_SEND_FAILED": "Nachricht konnte nicht gesendet werden.",
+  "CHAT_EMPTY": "Noch keine Nachrichten. Der Chat ist nur live.",
+  "LABEL_CHAT_NOTIFICATIONS": "Chat-Benachrichtigungen",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "Zeigt neue Raum-Chatnachrichten als Systembenachrichtigung, wenn der Video-Tab nicht fokussiert ist.",
+  "LABEL_EVENT_NOTIFICATIONS": "Wiedergabe- & Raumbenachrichtigungen",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "Zeigt Systembenachrichtigungen, wenn jemand beitritt, den Raum verlässt, abspielt oder pausiert.",
+  "DEBUG_SECTION_VIDEO_DETECTION": "Videoerkennung",
+  "DEBUG_VIDEO_NOT_FOUND": "KEIN VIDEOELEMENT GEFUNDEN",
+  "DEBUG_SECTION_MEDIA_SESSION": "Media Session API",
+  "DEBUG_VIDEO_HINT": "Läuft gerade ein Video? KoalaSync erkennt Browser-Videoelemente, nachdem das Medium geladen wurde.",
+  "DEBUG_SECTION_PLAYBACK": "Wiedergabe",
+  "DEBUG_STATE_PAUSED": "PAUSIERT",
+  "DEBUG_STATE_PLAYING": "LÄUFT",
+  "DEBUG_SECTION_PROPERTIES": "Eigenschaften",
+  "DEBUG_SECTION_DIMENSIONS": "Abmessungen",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = Videoelement ist ausgeblendet oder noch nicht geladen",
+  "DEBUG_SECTION_MEDIA_ERROR": "Medienfehler",
+  "DEBUG_SECTION_DETECTION": "Erkennung",
+  "DEBUG_SECTION_IDENTIFICATION": "Identifikation",
+  "DEBUG_SECTION_MEDIA_SOURCE": "Medienquelle",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "Datenattribute",
+  "DEBUG_YES": "JA",
+  "DEBUG_NO": "NEIN",
+  "DEBUG_YES_CHECKED": "JA (geprüft)",
+  "DEBUG_NA": "k. A."
 }

extension/locales/en.json

@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "Next",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "Go to next step",
   "ONBOARDING_1_TITLE": "Welcome to KoalaSync!",
-  "ONBOARDING_1_TEXT": "Watch videos together in perfect sync — no matter where you are. Let's take a quick tour!",
+  "ONBOARDING_1_TEXT": "Watch videos together wherever you are. Here is a quick tour.",
   "ONBOARDING_2_TITLE": "1. Create a Room",
   "ONBOARDING_2_TEXT": "Start here. Create a room and share the invite link with your friends.",
   "ONBOARDING_3_TITLE": "2. Select Video",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identity not yet loaded. Wait a moment and try again.",
   "ERR_NO_PEERS_TIME": "No other peers with a known time. Switch to 'Jump to Me'.",
   "ERR_NO_VIDEO_TAB": "Could not connect to video tab.",
+  "SITE_ACCESS_REQUIRED": "Your browser is blocking KoalaSync on {host}. Click \"Allow access\" below. If no dialog appears, allow KoalaSync on this site in your extension or site permissions.",
+  "BTN_RETRY_ACCESS": "Allow access",
   "ERR_SELECT_VIDEO": "Please select a video first!",
   "TOAST_INVITE_COPIED": "Invite link copied!",
   "TOAST_COPY_FAILED": "Failed to copy to clipboard",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "Profile & Appearance",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "Change your username, theme, and language preferences.",
   "LABEL_SETTINGS_GROUP_SYNC": "Playback & Sync",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Customize playback, notifications, and audio preferences."
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Customize playback, notifications, and audio preferences.",
+  "LABEL_CHAT_ENABLED": "Enable Room Chat",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "Show encrypted room chat on the selected video tab.",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "Configure encrypted room chat appearance and placement.",
+  "CHAT_SETTINGS_NOTE": "Optional and end-to-end encrypted. Messages are live only and are not stored by the relay.",
+  "LABEL_CHAT_POSITION": "Position",
+  "LABEL_CHAT_POSITION_TOOLTIP": "Choose where chat is attached to the selected player.",
+  "LABEL_CHAT_SIZE": "Overlay size",
+  "LABEL_CHAT_SIZE_TOOLTIP": "Choose the default size of the chat overlay.",
+  "OPTION_CHAT_SIZE_COMPACT": "Compact",
+  "OPTION_CHAT_SIZE_STANDARD": "Standard",
+  "OPTION_CHAT_SIZE_LARGE": "Large",
+  "OPTION_CHAT_SIZE_CUSTOM": "Last custom size",
+  "LABEL_CHAT_START_MODE": "Start as",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "Choose whether chat starts as a floating bubble or an open overlay.",
+  "OPTION_CHAT_START_BUBBLE": "Floating bubble",
+  "OPTION_CHAT_START_OPEN": "Open overlay",
+  "LABEL_CHAT_REACTION_DISPLAY": "Quick reactions",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "Choose whether quick reactions stay in chat or also fall over the video.",
+  "OPTION_CHAT_REACTIONS_CHAT": "Chat only",
+  "OPTION_CHAT_REACTIONS_VIDEO": "Chat and video",
+  "CHAT_QUICK_REACTIONS": "Quick reactions",
+  "CHAT_TITLE": "Room Chat",
+  "CHAT_LIVE_ONLY": "Live only. No history.",
+  "CHAT_OPEN": "Open room chat",
+  "CHAT_CLOSE": "Close chat",
+  "CHAT_DOCK_LEFT": "Dock chat left",
+  "CHAT_DOCK_RIGHT": "Dock chat right",
+  "CHAT_DETACHED": "Detach chat",
+  "CHAT_PLACEHOLDER": "Write a message...",
+  "CHAT_SEND": "Send",
+  "CHAT_MISSING_KEY": "Chat is available only through a current invite link.",
+  "CHAT_TOO_LONG": "Maximum 5000 characters.",
+  "CHAT_SEND_FAILED": "Message could not be sent.",
+  "CHAT_EMPTY": "No messages yet. Chat is live only.",
+  "LABEL_CHAT_NOTIFICATIONS": "Chat Notifications",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "Shows a system notification for new room-chat messages when the video tab is not focused.",
+  "LABEL_EVENT_NOTIFICATIONS": "Playback & Room Notifications",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "Shows system notifications when someone joins, leaves, plays, or pauses.",
+  "DEBUG_SECTION_VIDEO_DETECTION": "Video Detection",
+  "DEBUG_VIDEO_NOT_FOUND": "NO VIDEO ELEMENT FOUND",
+  "DEBUG_SECTION_MEDIA_SESSION": "Media Session API",
+  "DEBUG_VIDEO_HINT": "Is a video currently playing? KoalaSync detects browser video elements after the media has loaded.",
+  "DEBUG_SECTION_PLAYBACK": "Playback",
+  "DEBUG_STATE_PAUSED": "PAUSED",
+  "DEBUG_STATE_PLAYING": "PLAYING",
+  "DEBUG_SECTION_PROPERTIES": "Properties",
+  "DEBUG_SECTION_DIMENSIONS": "Dimensions",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = video element is hidden or not loaded yet",
+  "DEBUG_SECTION_MEDIA_ERROR": "Media Error",
+  "DEBUG_SECTION_DETECTION": "Detection",
+  "DEBUG_SECTION_IDENTIFICATION": "Identification",
+  "DEBUG_SECTION_MEDIA_SOURCE": "Media Source",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "Data Attributes",
+  "DEBUG_YES": "YES",
+  "DEBUG_NO": "NO",
+  "DEBUG_YES_CHECKED": "YES (checked)",
+  "DEBUG_NA": "n/a"
 }

extension/locales/es.json

@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "Siguiente",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "Ir al siguiente paso",
   "ONBOARDING_1_TITLE": "¡Bienvenido a KoalaSync!",
-  "ONBOARDING_1_TEXT": "Mira videos junto a tus amigos en perfecta sincronización, sin importar dónde estén. ¡Hagamos un recorrido rápido!",
+  "ONBOARDING_1_TEXT": "Ved vídeos juntos estéis donde estéis. Aquí tienes un recorrido rápido.",
   "ONBOARDING_2_TITLE": "1. Crear una sala",
   "ONBOARDING_2_TEXT": "Comienza aquí. Crea una sala y comparte el enlace de invitación con tus amigos.",
   "ONBOARDING_3_TITLE": "2. Seleccionar video",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identidad no cargada aún. Espera un momento e inténtalo de nuevo.",
   "ERR_NO_PEERS_TIME": "No hay otros participantes con posición conocida. Cambia a 'Traerlos a mi posición'.",
   "ERR_NO_VIDEO_TAB": "No se pudo conectar a la pestaña de video.",
+  "SITE_ACCESS_REQUIRED": "Tu navegador está bloqueando KoalaSync en {host}. Haz clic en «Permitir acceso». Si no aparece ningún diálogo, permite KoalaSync en este sitio desde los permisos de extensiones o del sitio.",
+  "BTN_RETRY_ACCESS": "Permitir acceso",
   "ERR_SELECT_VIDEO": "¡Selecciona un video primero!",
   "TOAST_INVITE_COPIED": "¡Enlace de invitación copiado!",
   "TOAST_COPY_FAILED": "Error al copiar al portapapeles",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Tiempo de espera agotado: no todos los participantes cargaron el episodio",
   "LOBBY_CANCEL_USER": "Cancelado por el usuario",
   "NOTIF_ERROR_TITLE": "Error de KoalaSync",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "Apoyar KoalaSync",
   "FOOTER_REVIEW": "★ Valorar",
   "FOOTER_SUPPORT_PROMPT": "¿Te gusta KoalaSync? ¡Deja una reseña!",
   "LABEL_AUDIO_PROCESSING": "Procesamiento de audio",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "Perfil y Apariencia",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "Cambia tu nombre de usuario, tema y preferencias de idioma.",
   "LABEL_SETTINGS_GROUP_SYNC": "Reproducción y Sincronización",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Personaliza la reproducción, las notificaciones y las preferencias de audio."
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Personaliza la reproducción, las notificaciones y las preferencias de audio.",
+  "LABEL_CHAT_ENABLED": "Activar chat de la sala",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "Mostrar el chat cifrado de la sala en la pestaña de vídeo seleccionada.",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "Configura la apariencia y la posición del chat cifrado de la sala.",
+  "CHAT_SETTINGS_NOTE": "Opcional y cifrado de extremo a extremo. Los mensajes solo se muestran en directo y el relé no los almacena.",
+  "LABEL_CHAT_POSITION": "Posición",
+  "LABEL_CHAT_POSITION_TOOLTIP": "Elige dónde se acopla el chat al reproductor seleccionado.",
+  "LABEL_CHAT_SIZE": "Tamaño de la superposición",
+  "LABEL_CHAT_SIZE_TOOLTIP": "Elige el tamaño predeterminado de la superposición del chat.",
+  "OPTION_CHAT_SIZE_COMPACT": "Compacto",
+  "OPTION_CHAT_SIZE_STANDARD": "Estándar",
+  "OPTION_CHAT_SIZE_LARGE": "Grande",
+  "OPTION_CHAT_SIZE_CUSTOM": "Último tamaño personalizado",
+  "LABEL_CHAT_START_MODE": "Iniciar como",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "Elige si el chat comienza como una burbuja flotante o una superposición abierta.",
+  "OPTION_CHAT_START_BUBBLE": "Burbuja flotante",
+  "OPTION_CHAT_START_OPEN": "Superposición abierta",
+  "LABEL_CHAT_REACTION_DISPLAY": "Reacciones rápidas",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "Elige si las reacciones rápidas aparecen solo en el chat o también sobre el vídeo.",
+  "OPTION_CHAT_REACTIONS_CHAT": "Solo chat",
+  "OPTION_CHAT_REACTIONS_VIDEO": "Chat y vídeo",
+  "CHAT_QUICK_REACTIONS": "Reacciones rápidas",
+  "CHAT_TITLE": "Chat de la sala",
+  "CHAT_LIVE_ONLY": "Solo en directo. Sin historial.",
+  "CHAT_OPEN": "Abrir chat de la sala",
+  "CHAT_CLOSE": "Cerrar chat",
+  "CHAT_DOCK_LEFT": "Acoplar chat a la izquierda",
+  "CHAT_DOCK_RIGHT": "Acoplar chat a la derecha",
+  "CHAT_DETACHED": "Separar chat",
+  "CHAT_PLACEHOLDER": "Escribe un mensaje...",
+  "CHAT_SEND": "Enviar",
+  "CHAT_MISSING_KEY": "El chat solo está disponible mediante un enlace de invitación actual.",
+  "CHAT_TOO_LONG": "Máximo 5000 caracteres.",
+  "CHAT_SEND_FAILED": "No se pudo enviar el mensaje.",
+  "CHAT_EMPTY": "Aún no hay mensajes. El chat solo es en directo.",
+  "LABEL_CHAT_NOTIFICATIONS": "Notificaciones del chat",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "Muestra una notificación del sistema para mensajes nuevos cuando la pestaña de vídeo no está activa.",
+  "LABEL_EVENT_NOTIFICATIONS": "Notificaciones de reproducción y sala",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "Muestra notificaciones cuando alguien entra, sale, reproduce o pausa.",
+  "DEBUG_SECTION_VIDEO_DETECTION": "Detección de vídeo",
+  "DEBUG_VIDEO_NOT_FOUND": "NO SE ENCONTRÓ NINGÚN ELEMENTO DE VÍDEO",
+  "DEBUG_SECTION_MEDIA_SESSION": "API Media Session",
+  "DEBUG_VIDEO_HINT": "¿Hay un vídeo reproduciéndose? KoalaSync detecta elementos de vídeo cuando el contenido está cargado.",
+  "DEBUG_SECTION_PLAYBACK": "Reproducción",
+  "DEBUG_STATE_PAUSED": "EN PAUSA",
+  "DEBUG_STATE_PLAYING": "REPRODUCIENDO",
+  "DEBUG_SECTION_PROPERTIES": "Propiedades",
+  "DEBUG_SECTION_DIMENSIONS": "Dimensiones",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = el elemento de vídeo está oculto o aún no se ha cargado",
+  "DEBUG_SECTION_MEDIA_ERROR": "Error multimedia",
+  "DEBUG_SECTION_DETECTION": "Detección",
+  "DEBUG_SECTION_IDENTIFICATION": "Identificación",
+  "DEBUG_SECTION_MEDIA_SOURCE": "Fuente multimedia",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "Atributos de datos",
+  "DEBUG_YES": "SÍ",
+  "DEBUG_NO": "NO",
+  "DEBUG_YES_CHECKED": "SÍ (comprobado)",
+  "DEBUG_NA": "n/d"
 }

extension/locales/fr.json

@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "Suivant",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "Étape suivante",
   "ONBOARDING_1_TITLE": "Bienvenue sur KoalaSync !",
-  "ONBOARDING_1_TEXT": "Regardez des vidéos en parfaite synchronisation — où que vous soyez. Faisons un petit tour !",
+  "ONBOARDING_1_TEXT": "Regardez des vidéos ensemble où que vous soyez. Voici une présentation rapide.",
   "ONBOARDING_2_TITLE": "1. Créer un salon",
   "ONBOARDING_2_TEXT": "Commencez ici. Créez un salon et partagez le lien d'invitation avec vos amis.",
   "ONBOARDING_3_TITLE": "2. Choisir une vidéo",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identifiant non encore chargé. Veuillez patienter et réessayer.",
   "ERR_NO_PEERS_TIME": "Aucun autre membre avec une position connue. Basculez sur 'Les amener à moi'.",
   "ERR_NO_VIDEO_TAB": "Impossible de se connecter à l'onglet vidéo.",
+  "SITE_ACCESS_REQUIRED": "Votre navigateur bloque KoalaSync sur {host}. Cliquez sur « Autoriser l’accès ». Si aucune boîte de dialogue n’apparaît, autorisez KoalaSync sur ce site dans les permissions des extensions ou du site.",
+  "BTN_RETRY_ACCESS": "Autoriser l’accès",
   "ERR_SELECT_VIDEO": "Veuillez d'abord sélectionner une vidéo !",
   "TOAST_INVITE_COPIED": "Lien d'invitation copié !",
   "TOAST_COPY_FAILED": "Échec de la copie dans le presse-papiers",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Délai dépassé — tous les membres n'ont pas chargé l'épisode",
   "LOBBY_CANCEL_USER": "Annulé par l'utilisateur",
   "NOTIF_ERROR_TITLE": "Erreur KoalaSync",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "Soutenir KoalaSync",
   "FOOTER_REVIEW": "★ Évaluer",
   "FOOTER_SUPPORT_PROMPT": "Tu aimes KoalaSync? Laisse un avis!",
   "LABEL_AUDIO_PROCESSING": "Traitement audio",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "Profil & Apparence",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "Modifiez votre nom d'utilisateur, votre thème et vos préférences linguistiques.",
   "LABEL_SETTINGS_GROUP_SYNC": "Lecture & Sync",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Personnalisez la lecture, les notifications et les préférences audio."
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Personnalisez la lecture, les notifications et les préférences audio.",
+  "LABEL_CHAT_ENABLED": "Activer le chat du salon",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "Afficher le chat chiffré du salon dans l'onglet vidéo sélectionné.",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "Configurez l'apparence et l'emplacement du chat chiffré du salon.",
+  "CHAT_SETTINGS_NOTE": "Facultatif et chiffré de bout en bout. Les messages sont uniquement en direct et ne sont pas stockés par le relais.",
+  "LABEL_CHAT_POSITION": "Position",
+  "LABEL_CHAT_POSITION_TOOLTIP": "Choisissez où le chat est ancré au lecteur sélectionné.",
+  "LABEL_CHAT_SIZE": "Taille de la fenêtre",
+  "LABEL_CHAT_SIZE_TOOLTIP": "Choisissez la taille par défaut de la fenêtre de chat.",
+  "OPTION_CHAT_SIZE_COMPACT": "Compacte",
+  "OPTION_CHAT_SIZE_STANDARD": "Standard",
+  "OPTION_CHAT_SIZE_LARGE": "Grande",
+  "OPTION_CHAT_SIZE_CUSTOM": "Dernière taille personnalisée",
+  "LABEL_CHAT_START_MODE": "Affichage initial",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "Choisissez si le chat démarre sous forme de bulle flottante ou de fenêtre ouverte.",
+  "OPTION_CHAT_START_BUBBLE": "Bulle flottante",
+  "OPTION_CHAT_START_OPEN": "Fenêtre ouverte",
+  "LABEL_CHAT_REACTION_DISPLAY": "Réactions rapides",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "Choisissez si les réactions rapides restent dans le chat ou tombent aussi sur la vidéo.",
+  "OPTION_CHAT_REACTIONS_CHAT": "Chat uniquement",
+  "OPTION_CHAT_REACTIONS_VIDEO": "Chat et vidéo",
+  "CHAT_QUICK_REACTIONS": "Réactions rapides",
+  "CHAT_TITLE": "Chat du salon",
+  "CHAT_LIVE_ONLY": "En direct uniquement. Aucun historique.",
+  "CHAT_OPEN": "Ouvrir le chat du salon",
+  "CHAT_CLOSE": "Fermer le chat",
+  "CHAT_DOCK_LEFT": "Ancrer le chat à gauche",
+  "CHAT_DOCK_RIGHT": "Ancrer le chat à droite",
+  "CHAT_DETACHED": "Détacher le chat",
+  "CHAT_PLACEHOLDER": "Écrire un message...",
+  "CHAT_SEND": "Envoyer",
+  "CHAT_MISSING_KEY": "Le chat est disponible uniquement via un lien d'invitation actuel.",
+  "CHAT_TOO_LONG": "5000 caractères maximum.",
+  "CHAT_SEND_FAILED": "Le message n'a pas pu être envoyé.",
+  "CHAT_EMPTY": "Aucun message. Le chat est uniquement en direct.",
+  "LABEL_CHAT_NOTIFICATIONS": "Notifications du chat",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "Affiche une notification système pour les nouveaux messages lorsque l’onglet vidéo n’est pas actif.",
+  "LABEL_EVENT_NOTIFICATIONS": "Notifications de lecture et de salon",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "Affiche des notifications quand une personne arrive, part, lance ou met en pause.",
+  "DEBUG_SECTION_VIDEO_DETECTION": "Détection vidéo",
+  "DEBUG_VIDEO_NOT_FOUND": "AUCUN ÉLÉMENT VIDÉO DÉTECTÉ",
+  "DEBUG_SECTION_MEDIA_SESSION": "API Media Session",
+  "DEBUG_VIDEO_HINT": "Une vidéo est-elle en cours de lecture ? KoalaSync détecte les éléments vidéo une fois le média chargé.",
+  "DEBUG_SECTION_PLAYBACK": "Lecture",
+  "DEBUG_STATE_PAUSED": "EN PAUSE",
+  "DEBUG_STATE_PLAYING": "EN LECTURE",
+  "DEBUG_SECTION_PROPERTIES": "Propriétés",
+  "DEBUG_SECTION_DIMENSIONS": "Dimensions",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = l’élément vidéo est masqué ou pas encore chargé",
+  "DEBUG_SECTION_MEDIA_ERROR": "Erreur multimédia",
+  "DEBUG_SECTION_DETECTION": "Détection",
+  "DEBUG_SECTION_IDENTIFICATION": "Identification",
+  "DEBUG_SECTION_MEDIA_SOURCE": "Source multimédia",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "Attributs de données",
+  "DEBUG_YES": "OUI",
+  "DEBUG_NO": "NON",
+  "DEBUG_YES_CHECKED": "OUI (vérifié)",
+  "DEBUG_NA": "n/d"
 }

extension/locales/it.json

@@ -34,7 +34,7 @@
   "BTN_REFRESH_TOOLTIP": "Aggiorna l'elenco delle stanze",
   "PUBLIC_ROOMS_REFRESHING": "Aggiornamento...",
   "BTN_REFRESH_COOLDOWN": "ATTENDI {seconds}s",
-  "BTN_REFRESH_COOLDOWN_TOOLTIP": "Riprova tra {seconds}s.",
+  "BTN_REFRESH_COOLDOWN_TOOLTIP": "L’elenco delle stanze è in attesa. Riprova tra {seconds}s.",
   "PUBLIC_ROOMS_REFRESHING_COOLDOWN": "Aggiornamento in corso. Disponibile tra {seconds}s.",
   "LABEL_ACTIVE_ROOM": "Stanza Attiva",
   "LABEL_ACTIVE_ROOM_TOOLTIP": "La stanza a cui sei connesso",
@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "Avanti",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "Vai al passaggio successivo",
   "ONBOARDING_1_TITLE": "Benvenuto in KoalaSync!",
-  "ONBOARDING_1_TEXT": "Guarda i video insieme ai tuoi amici in perfetta sincronia. Facciamo un breve tour!",
+  "ONBOARDING_1_TEXT": "Guarda video insieme ovunque vi troviate. Ecco una breve panoramica.",
   "ONBOARDING_2_TITLE": "1. Crea una Stanza",
   "ONBOARDING_2_TEXT": "Inizia da qui. Crea una stanza e condividi il link con i tuoi amici.",
   "ONBOARDING_3_TITLE": "2. Seleziona Video",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identità non ancora caricata. Attendi un momento.",
   "ERR_NO_PEERS_TIME": "Nessun altro partecipante con posizione nota. Passa a 'Portali alla mia posizione'.",
   "ERR_NO_VIDEO_TAB": "Impossibile connettersi alla scheda del video.",
+  "SITE_ACCESS_REQUIRED": "Il browser sta bloccando KoalaSync su {host}. Fai clic su «Consenti accesso». Se non appare alcuna finestra, consenti KoalaSync su questo sito nelle autorizzazioni dell’estensione o del sito.",
+  "BTN_RETRY_ACCESS": "Consenti accesso",
   "ERR_SELECT_VIDEO": "Seleziona prima un video!",
   "TOAST_INVITE_COPIED": "Link di invito copiato!",
   "TOAST_COPY_FAILED": "Impossibile copiare negli appunti",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Tempo scaduto: caricamento incompleto per alcuni partecipanti",
   "LOBBY_CANCEL_USER": "Annullato dall'utente",
   "NOTIF_ERROR_TITLE": "Errore KoalaSync",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "Sostieni KoalaSync",
   "FOOTER_REVIEW": "★ Valutaci",
   "FOOTER_SUPPORT_PROMPT": "Ti piace KoalaSync? Lascia una recensione!",
   "LABEL_AUDIO_PROCESSING": "Elaborazione Audio",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "Profilo & Aspetto",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "Modifica il tuo nome utente, tema e preferenze di lingua.",
   "LABEL_SETTINGS_GROUP_SYNC": "Riproduzione & Sync",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Personalizza la riproduzione, le notifiche e le preferenze audio."
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Personalizza la riproduzione, le notifiche e le preferenze audio.",
+  "LABEL_CHAT_ENABLED": "Attiva chat della stanza",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "Mostra la chat crittografata della stanza nella scheda video selezionata.",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "Configura l'aspetto e la posizione della chat crittografata della stanza.",
+  "CHAT_SETTINGS_NOTE": "Opzionale e crittografata end-to-end. I messaggi sono solo in diretta e non vengono memorizzati dal relay.",
+  "LABEL_CHAT_POSITION": "Posizione",
+  "LABEL_CHAT_POSITION_TOOLTIP": "Scegli dove agganciare la chat al lettore selezionato.",
+  "LABEL_CHAT_SIZE": "Dimensione overlay",
+  "LABEL_CHAT_SIZE_TOOLTIP": "Scegli la dimensione predefinita dell'overlay della chat.",
+  "OPTION_CHAT_SIZE_COMPACT": "Compatto",
+  "OPTION_CHAT_SIZE_STANDARD": "Standard",
+  "OPTION_CHAT_SIZE_LARGE": "Grande",
+  "OPTION_CHAT_SIZE_CUSTOM": "Ultima dimensione personalizzata",
+  "LABEL_CHAT_START_MODE": "Avvio come",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "Scegli se la chat si avvia come bolla mobile o overlay aperto.",
+  "OPTION_CHAT_START_BUBBLE": "Bolla fluttuante",
+  "OPTION_CHAT_START_OPEN": "Overlay aperto",
+  "LABEL_CHAT_REACTION_DISPLAY": "Reazioni rapide",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "Scegli se le reazioni rapide restano nella chat o cadono anche sul video.",
+  "OPTION_CHAT_REACTIONS_CHAT": "Solo chat",
+  "OPTION_CHAT_REACTIONS_VIDEO": "Chat e video",
+  "CHAT_QUICK_REACTIONS": "Reazioni rapide",
+  "CHAT_TITLE": "Chat della stanza",
+  "CHAT_LIVE_ONLY": "Solo in diretta. Nessuna cronologia.",
+  "CHAT_OPEN": "Apri la chat della stanza",
+  "CHAT_CLOSE": "Chiudi chat",
+  "CHAT_DOCK_LEFT": "Aggancia chat a sinistra",
+  "CHAT_DOCK_RIGHT": "Aggancia chat a destra",
+  "CHAT_DETACHED": "Sgancia chat",
+  "CHAT_PLACEHOLDER": "Scrivi un messaggio...",
+  "CHAT_SEND": "Invia",
+  "CHAT_MISSING_KEY": "La chat è disponibile solo tramite un link di invito attuale.",
+  "CHAT_TOO_LONG": "Massimo 5000 caratteri.",
+  "CHAT_SEND_FAILED": "Impossibile inviare il messaggio.",
+  "CHAT_EMPTY": "Nessun messaggio. La chat è solo in diretta.",
+  "LABEL_CHAT_NOTIFICATIONS": "Notifiche chat",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "Mostra una notifica di sistema per i nuovi messaggi quando la scheda video non è attiva.",
+  "LABEL_EVENT_NOTIFICATIONS": "Notifiche di riproduzione e stanza",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "Mostra notifiche quando qualcuno entra, esce, avvia o mette in pausa.",
+  "DEBUG_SECTION_VIDEO_DETECTION": "Rilevamento video",
+  "DEBUG_VIDEO_NOT_FOUND": "NESSUN ELEMENTO VIDEO TROVATO",
+  "DEBUG_SECTION_MEDIA_SESSION": "API Media Session",
+  "DEBUG_VIDEO_HINT": "È in riproduzione un video? KoalaSync rileva gli elementi video dopo il caricamento del contenuto.",
+  "DEBUG_SECTION_PLAYBACK": "Riproduzione",
+  "DEBUG_STATE_PAUSED": "IN PAUSA",
+  "DEBUG_STATE_PLAYING": "IN RIPRODUZIONE",
+  "DEBUG_SECTION_PROPERTIES": "Proprietà",
+  "DEBUG_SECTION_DIMENSIONS": "Dimensioni",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = elemento video nascosto o non ancora caricato",
+  "DEBUG_SECTION_MEDIA_ERROR": "Errore multimediale",
+  "DEBUG_SECTION_DETECTION": "Rilevamento",
+  "DEBUG_SECTION_IDENTIFICATION": "Identificazione",
+  "DEBUG_SECTION_MEDIA_SOURCE": "Sorgente multimediale",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "Attributi dati",
+  "DEBUG_YES": "SÌ",
+  "DEBUG_NO": "NO",
+  "DEBUG_YES_CHECKED": "SÌ (verificato)",
+  "DEBUG_NA": "n/d"
 }

extension/locales/ja.json

@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "次へ",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "次のステップに進む",
   "ONBOARDING_1_TITLE": "KoalaSyncへようこそ！",
-  "ONBOARDING_1_TEXT": "どこにいても、完璧に同期してビデオを一緒に楽しめます。簡単なツアーを始めましょう！",
+  "ONBOARDING_1_TEXT": "離れた場所から一緒に動画を視聴できます。簡単に機能を紹介します。",
   "ONBOARDING_2_TITLE": "1. ルームの作成",
   "ONBOARDING_2_TEXT": "ここからスタート。ルームを作成し、招待リンクを友達に共有します。",
   "ONBOARDING_3_TITLE": "2. ビデオの選択",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "IDがまだロードされていません。しばらく待ってから再試行してください。",
   "ERR_NO_PEERS_TIME": "既知の時間を持つ他のメンバーがいません。「自分に合わせる」に切り替えてください。",
   "ERR_NO_VIDEO_TAB": "ビデオタブに接続できませんでした。",
+  "SITE_ACCESS_REQUIRED": "ブラウザーが {host} で KoalaSync をブロックしています。下の「アクセスを許可」をクリックしてください。ダイアログが表示されない場合は、拡張機能またはサイトの権限でこのサイトの KoalaSync を許可してください。",
+  "BTN_RETRY_ACCESS": "アクセスを許可",
   "ERR_SELECT_VIDEO": "最初にビデオを選択してください！",
   "TOAST_INVITE_COPIED": "招待リンクをコピーしました！",
   "TOAST_COPY_FAILED": "クリップボードへのコピーに失敗しました",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "タイムアウト — 一部のメンバーがエピソードを読み込めませんでした",
   "LOBBY_CANCEL_USER": "ユーザーによってキャンセルされました",
   "NOTIF_ERROR_TITLE": "KoalaSyncエラー",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "KoalaSyncを支援",
   "FOOTER_REVIEW": "★ 評価する",
   "FOOTER_SUPPORT_PROMPT": "KoalaSyncはいかが？レビューを書いてください！",
   "LABEL_AUDIO_PROCESSING": "オーディオ処理",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "プロフィールと外観",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "ユーザー名、テーマ、言語設定を変更します。",
   "LABEL_SETTINGS_GROUP_SYNC": "再生と同期",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "再生、通知、オーディオ設定をカスタマイズします。"
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "再生、通知、オーディオ設定をカスタマイズします。",
+  "LABEL_CHAT_ENABLED": "ルームチャットを有効化",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "選択した動画タブに暗号化されたルームチャットを表示します。",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "暗号化されたルームチャットの外観と位置を設定します。",
+  "CHAT_SETTINGS_NOTE": "任意で利用でき、エンドツーエンドで暗号化されます。メッセージはリアルタイムのみで、リレーには保存されません。",
+  "LABEL_CHAT_POSITION": "位置",
+  "LABEL_CHAT_POSITION_TOOLTIP": "選択したプレーヤーのどこにチャットを配置するか選択します。",
+  "LABEL_CHAT_SIZE": "オーバーレイサイズ",
+  "LABEL_CHAT_SIZE_TOOLTIP": "チャットオーバーレイの標準サイズを選択します。",
+  "OPTION_CHAT_SIZE_COMPACT": "コンパクト",
+  "OPTION_CHAT_SIZE_STANDARD": "標準",
+  "OPTION_CHAT_SIZE_LARGE": "大",
+  "OPTION_CHAT_SIZE_CUSTOM": "前回のカスタムサイズ",
+  "LABEL_CHAT_START_MODE": "開始表示",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "フローティングバブルまたは開いたオーバーレイで開始するか選択します。",
+  "OPTION_CHAT_START_BUBBLE": "フローティングバブル",
+  "OPTION_CHAT_START_OPEN": "開いたオーバーレイ",
+  "LABEL_CHAT_REACTION_DISPLAY": "クイックリアクション",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "クイックリアクションをチャットだけに表示するか、動画上にも降らせるかを選択します。",
+  "OPTION_CHAT_REACTIONS_CHAT": "チャットのみ",
+  "OPTION_CHAT_REACTIONS_VIDEO": "チャットと動画",
+  "CHAT_QUICK_REACTIONS": "クイックリアクション",
+  "CHAT_TITLE": "ルームチャット",
+  "CHAT_LIVE_ONLY": "ライブのみ。履歴はありません。",
+  "CHAT_OPEN": "ルームチャットを開く",
+  "CHAT_CLOSE": "チャットを閉じる",
+  "CHAT_DOCK_LEFT": "チャットを左に固定",
+  "CHAT_DOCK_RIGHT": "チャットを右に固定",
+  "CHAT_DETACHED": "チャットを切り離す",
+  "CHAT_PLACEHOLDER": "メッセージを入力...",
+  "CHAT_SEND": "送信",
+  "CHAT_MISSING_KEY": "チャットは最新の招待リンクからのみ利用できます。",
+  "CHAT_TOO_LONG": "最大5000文字です。",
+  "CHAT_SEND_FAILED": "メッセージを送信できませんでした。",
+  "CHAT_EMPTY": "まだメッセージはありません。チャットはライブのみです。",
+  "LABEL_CHAT_NOTIFICATIONS": "チャット通知",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "動画タブがアクティブでないとき、新しいルームチャットをシステム通知で表示します。",
+  "LABEL_EVENT_NOTIFICATIONS": "再生とルームの通知",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "参加、退出、再生、一時停止をシステム通知で表示します。",
+  "DEBUG_SECTION_VIDEO_DETECTION": "動画検出",
+  "DEBUG_VIDEO_NOT_FOUND": "動画要素が見つかりません",
+  "DEBUG_SECTION_MEDIA_SESSION": "Media Session API",
+  "DEBUG_VIDEO_HINT": "動画を再生していますか？メディアの読み込み後にKoalaSyncが動画要素を検出します。",
+  "DEBUG_SECTION_PLAYBACK": "再生",
+  "DEBUG_STATE_PAUSED": "一時停止",
+  "DEBUG_STATE_PLAYING": "再生中",
+  "DEBUG_SECTION_PROPERTIES": "プロパティ",
+  "DEBUG_SECTION_DIMENSIONS": "サイズ",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = 動画要素が非表示、または未読み込みです",
+  "DEBUG_SECTION_MEDIA_ERROR": "メディアエラー",
+  "DEBUG_SECTION_DETECTION": "検出",
+  "DEBUG_SECTION_IDENTIFICATION": "識別情報",
+  "DEBUG_SECTION_MEDIA_SOURCE": "メディアソース",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "データ属性",
+  "DEBUG_YES": "はい",
+  "DEBUG_NO": "いいえ",
+  "DEBUG_YES_CHECKED": "はい（確認済み）",
+  "DEBUG_NA": "なし"
 }

extension/locales/ko.json

@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "다음",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "다음 단계로 이동",
   "ONBOARDING_1_TITLE": "KoalaSync에 오신 것을 환영합니다!",
-  "ONBOARDING_1_TEXT": "어디에 있든 완벽하게 동기화된 비디오를 함께 시청하세요. 간단히 둘러볼까요!",
+  "ONBOARDING_1_TEXT": "어디서든 함께 비디오를 시청하세요. 주요 기능을 간단히 살펴봅니다.",
   "ONBOARDING_2_TITLE": "1. 방 만들기",
   "ONBOARDING_2_TEXT": "여기서 시작하세요. 방을 만들고 친구들에게 초대 링크를 공유하세요.",
   "ONBOARDING_3_TITLE": "2. 비디오 선택",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "ID가 아직 로드되지 않았습니다. 잠시 후 다시 시도해 주세요.",
   "ERR_NO_PEERS_TIME": "시간을 알고 있는 다른 피어가 없습니다. '나에게 이동'으로 전환하세요.",
   "ERR_NO_VIDEO_TAB": "비디오 탭에 연결할 수 없습니다.",
+  "SITE_ACCESS_REQUIRED": "브라우저가 {host}에서 KoalaSync를 차단하고 있습니다. 아래의 ‘액세스 허용’을 클릭하세요. 대화상자가 표시되지 않으면 확장 프로그램 또는 사이트 권한에서 이 사이트의 KoalaSync를 허용하세요.",
+  "BTN_RETRY_ACCESS": "액세스 허용",
   "ERR_SELECT_VIDEO": "먼저 비디오를 선택하세요!",
   "TOAST_INVITE_COPIED": "초대 링크가 복사되었습니다!",
   "TOAST_COPY_FAILED": "클립보드 복사에 실패했습니다",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "시간 초과 — 모든 피어가 에피소드를 로드하지 못했습니다",
   "LOBBY_CANCEL_USER": "사용자에 의해 취소됨",
   "NOTIF_ERROR_TITLE": "KoalaSync 오류",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "KoalaSync 후원",
   "FOOTER_REVIEW": "★ 평가하기",
   "FOOTER_SUPPORT_PROMPT": "KoalaSync가 마음에 드세요? 리뷰를 남겨주세요!",
   "LABEL_AUDIO_PROCESSING": "오디오 처리",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "프로필 및 테마",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "사용자 이름, 테마 및 언어 설정을 변경합니다.",
   "LABEL_SETTINGS_GROUP_SYNC": "재생 및 동기화",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "재생, 알림 및 오디오 설정을 맞춤설정합니다."
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "재생, 알림 및 오디오 설정을 맞춤설정합니다.",
+  "LABEL_CHAT_ENABLED": "방 채팅 사용",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "선택한 동영상 탭에 암호화된 방 채팅을 표시합니다.",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "암호화된 방 채팅의 모양과 위치를 설정합니다.",
+  "CHAT_SETTINGS_NOTE": "선택 기능이며 종단 간 암호화됩니다. 메시지는 실시간으로만 표시되고 릴레이에 저장되지 않습니다.",
+  "LABEL_CHAT_POSITION": "위치",
+  "LABEL_CHAT_POSITION_TOOLTIP": "선택한 플레이어에서 채팅을 고정할 위치를 선택합니다.",
+  "LABEL_CHAT_SIZE": "오버레이 크기",
+  "LABEL_CHAT_SIZE_TOOLTIP": "채팅 오버레이의 기본 크기를 선택합니다.",
+  "OPTION_CHAT_SIZE_COMPACT": "작게",
+  "OPTION_CHAT_SIZE_STANDARD": "표준",
+  "OPTION_CHAT_SIZE_LARGE": "크게",
+  "OPTION_CHAT_SIZE_CUSTOM": "마지막 사용자 지정 크기",
+  "LABEL_CHAT_START_MODE": "시작 화면",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "플로팅 버블 또는 열린 오버레이로 시작할지 선택합니다.",
+  "OPTION_CHAT_START_BUBBLE": "플로팅 채팅 버블",
+  "OPTION_CHAT_START_OPEN": "열린 오버레이",
+  "LABEL_CHAT_REACTION_DISPLAY": "빠른 반응",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "빠른 반응을 채팅에만 표시하거나 동영상 위에도 떨어지게 할지 선택합니다.",
+  "OPTION_CHAT_REACTIONS_CHAT": "채팅만",
+  "OPTION_CHAT_REACTIONS_VIDEO": "채팅 및 동영상",
+  "CHAT_QUICK_REACTIONS": "빠른 반응",
+  "CHAT_TITLE": "방 채팅",
+  "CHAT_LIVE_ONLY": "실시간 전용. 기록 없음.",
+  "CHAT_OPEN": "방 채팅 열기",
+  "CHAT_CLOSE": "채팅 닫기",
+  "CHAT_DOCK_LEFT": "채팅을 왼쪽에 고정",
+  "CHAT_DOCK_RIGHT": "채팅을 오른쪽에 고정",
+  "CHAT_DETACHED": "채팅 분리",
+  "CHAT_PLACEHOLDER": "메시지를 입력하세요...",
+  "CHAT_SEND": "보내기",
+  "CHAT_MISSING_KEY": "채팅은 최신 초대 링크를 통해서만 사용할 수 있습니다.",
+  "CHAT_TOO_LONG": "최대 5000자입니다.",
+  "CHAT_SEND_FAILED": "메시지를 보낼 수 없습니다.",
+  "CHAT_EMPTY": "아직 메시지가 없습니다. 채팅은 실시간 전용입니다.",
+  "LABEL_CHAT_NOTIFICATIONS": "채팅 알림",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "비디오 탭이 활성 상태가 아닐 때 새 방 채팅 메시지를 시스템 알림으로 표시합니다.",
+  "LABEL_EVENT_NOTIFICATIONS": "재생 및 방 알림",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "참여, 퇴장, 재생 또는 일시정지를 시스템 알림으로 표시합니다.",
+  "DEBUG_SECTION_VIDEO_DETECTION": "비디오 감지",
+  "DEBUG_VIDEO_NOT_FOUND": "비디오 요소를 찾지 못했습니다",
+  "DEBUG_SECTION_MEDIA_SESSION": "Media Session API",
+  "DEBUG_VIDEO_HINT": "비디오가 재생 중인가요? 미디어가 로드된 후 KoalaSync가 비디오 요소를 감지합니다.",
+  "DEBUG_SECTION_PLAYBACK": "재생",
+  "DEBUG_STATE_PAUSED": "일시정지",
+  "DEBUG_STATE_PLAYING": "재생 중",
+  "DEBUG_SECTION_PROPERTIES": "속성",
+  "DEBUG_SECTION_DIMENSIONS": "크기",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = 비디오 요소가 숨겨져 있거나 아직 로드되지 않음",
+  "DEBUG_SECTION_MEDIA_ERROR": "미디어 오류",
+  "DEBUG_SECTION_DETECTION": "감지",
+  "DEBUG_SECTION_IDENTIFICATION": "식별 정보",
+  "DEBUG_SECTION_MEDIA_SOURCE": "미디어 소스",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "데이터 속성",
+  "DEBUG_YES": "예",
+  "DEBUG_NO": "아니요",
+  "DEBUG_YES_CHECKED": "예(확인됨)",
+  "DEBUG_NA": "없음"
 }

extension/locales/nl.json

@@ -82,7 +82,7 @@
   "LABEL_LAST_ACTIVITY": "Laatste activiteitsstatus",
   "LABEL_LAST_ACTIVITY_TOOLTIP": "Toont de meest recente afspeel-, pauzeer- of zoekopdracht",
   "NO_RECENT_COMMANDS": "Geen recente commando's",
-  "LOBBY_HEADER": "EPISODE LOBBY",
+  "LOBBY_HEADER": "AFLEVERINGSLOBBY",
   "LOBBY_WAITING_FOR": "🎬 Wachten op: \"{title}\"",
   "LOBBY_WAITING_PEERS": "Wachten op deelnemers...",
   "BTN_SKIP_PLAY": "Overslaan & toch afspelen",
@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "Volgende",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "Ga naar de volgende stap",
   "ONBOARDING_1_TITLE": "Welkom bij KoalaSync!",
-  "ONBOARDING_1_TEXT": "Bekijk video's samen in perfecte synchronisatie — waar u ook bent. Laten we een snelle rondleiding nemen!",
+  "ONBOARDING_1_TEXT": "Bekijk samen video’s, waar je ook bent. Hier volgt een korte rondleiding.",
   "ONBOARDING_2_TITLE": "1. Kamer maken",
   "ONBOARDING_2_TEXT": "Begin hier. Maak een kamer en deel de uitnodigingslink met uw vrienden.",
   "ONBOARDING_3_TITLE": "2. Selecteer video",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identiteit nog niet geladen. Wacht een moment en probeer het opnieuw.",
   "ERR_NO_PEERS_TIME": "Geen andere deelnemers met een bekende tijd. Schakel over naar 'Spring naar mij'.",
   "ERR_NO_VIDEO_TAB": "Kon geen verbinding maken met videotabblad.",
+  "SITE_ACCESS_REQUIRED": "Je browser blokkeert KoalaSync op {host}. Klik hieronder op ‘Toegang toestaan’. Als er geen dialoog verschijnt, sta KoalaSync voor deze site toe via de extensie- of siterechten.",
+  "BTN_RETRY_ACCESS": "Toegang toestaan",
   "ERR_SELECT_VIDEO": "Selecteer eerst een video!",
   "TOAST_INVITE_COPIED": "Uitnodigingslink gekopieerd!",
   "TOAST_COPY_FAILED": "Kopiëren naar klembord mislukt",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Time-out — niet alle deelnemers hebben de aflevering geladen",
   "LOBBY_CANCEL_USER": "Geannuleerd door gebruiker",
   "NOTIF_ERROR_TITLE": "KoalaSync-fout",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "Steun KoalaSync",
   "FOOTER_REVIEW": "★ Beoordelen",
   "FOOTER_SUPPORT_PROMPT": "Vind je KoalaSync leuk? Laat een review achter!",
   "LABEL_AUDIO_PROCESSING": "Audioverwerking",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "Profiel & Weergave",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "Wijzig uw gebruikersnaam, thema en taalvoorkeuren.",
   "LABEL_SETTINGS_GROUP_SYNC": "Afspelen & Sync",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Pas afspelen, meldingen en audiovoorkeuren aan."
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Pas afspelen, meldingen en audiovoorkeuren aan.",
+  "LABEL_CHAT_ENABLED": "Kamerchat inschakelen",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "Versleutelde kamerchat tonen in het geselecteerde videotabblad.",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "Pas het uiterlijk en de positie van de versleutelde kamerchat aan.",
+  "CHAT_SETTINGS_NOTE": "Optioneel en end-to-end versleuteld. Berichten zijn alleen live en worden niet door de relay opgeslagen.",
+  "LABEL_CHAT_POSITION": "Positie",
+  "LABEL_CHAT_POSITION_TOOLTIP": "Kies waar de chat aan de geselecteerde speler wordt gekoppeld.",
+  "LABEL_CHAT_SIZE": "Overlaygrootte",
+  "LABEL_CHAT_SIZE_TOOLTIP": "Kies de standaardgrootte van de chatoverlay.",
+  "OPTION_CHAT_SIZE_COMPACT": "Compact",
+  "OPTION_CHAT_SIZE_STANDARD": "Standaard",
+  "OPTION_CHAT_SIZE_LARGE": "Groot",
+  "OPTION_CHAT_SIZE_CUSTOM": "Laatste aangepaste grootte",
+  "LABEL_CHAT_START_MODE": "Start als",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "Kies of de chat start als zwevende knop of als geopende overlay.",
+  "OPTION_CHAT_START_BUBBLE": "Zwevende chatknop",
+  "OPTION_CHAT_START_OPEN": "Geopende overlay",
+  "LABEL_CHAT_REACTION_DISPLAY": "Snelle reacties",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "Kies of snelle reacties alleen in de chat of ook over de video verschijnen.",
+  "OPTION_CHAT_REACTIONS_CHAT": "Alleen chat",
+  "OPTION_CHAT_REACTIONS_VIDEO": "Chat en video",
+  "CHAT_QUICK_REACTIONS": "Snelle reacties",
+  "CHAT_TITLE": "Kamerchat",
+  "CHAT_LIVE_ONLY": "Alleen live. Geen geschiedenis.",
+  "CHAT_OPEN": "Kamerchat openen",
+  "CHAT_CLOSE": "Chat sluiten",
+  "CHAT_DOCK_LEFT": "Chat links vastzetten",
+  "CHAT_DOCK_RIGHT": "Chat rechts vastzetten",
+  "CHAT_DETACHED": "Chat losmaken",
+  "CHAT_PLACEHOLDER": "Schrijf een bericht...",
+  "CHAT_SEND": "Verzenden",
+  "CHAT_MISSING_KEY": "Chat is alleen beschikbaar via een actuele uitnodigingslink.",
+  "CHAT_TOO_LONG": "Maximaal 5000 tekens.",
+  "CHAT_SEND_FAILED": "Bericht kon niet worden verzonden.",
+  "CHAT_EMPTY": "Nog geen berichten. Chat is alleen live.",
+  "LABEL_CHAT_NOTIFICATIONS": "Chatmeldingen",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "Toont een systeemmelding voor nieuwe chatberichten wanneer het videotabblad niet actief is.",
+  "LABEL_EVENT_NOTIFICATIONS": "Afspeel- en kamermeldingen",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "Toont meldingen wanneer iemand deelneemt, vertrekt, afspeelt of pauzeert.",
+  "DEBUG_SECTION_VIDEO_DETECTION": "Videodetectie",
+  "DEBUG_VIDEO_NOT_FOUND": "GEEN VIDEO-ELEMENT GEVONDEN",
+  "DEBUG_SECTION_MEDIA_SESSION": "Media Session API",
+  "DEBUG_VIDEO_HINT": "Wordt er een video afgespeeld? KoalaSync detecteert video-elementen nadat de media is geladen.",
+  "DEBUG_SECTION_PLAYBACK": "Afspelen",
+  "DEBUG_STATE_PAUSED": "GEPAUZEERD",
+  "DEBUG_STATE_PLAYING": "WORDT AFGESPEELD",
+  "DEBUG_SECTION_PROPERTIES": "Eigenschappen",
+  "DEBUG_SECTION_DIMENSIONS": "Afmetingen",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = video-element is verborgen of nog niet geladen",
+  "DEBUG_SECTION_MEDIA_ERROR": "Mediafout",
+  "DEBUG_SECTION_DETECTION": "Detectie",
+  "DEBUG_SECTION_IDENTIFICATION": "Identificatie",
+  "DEBUG_SECTION_MEDIA_SOURCE": "Mediabron",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "Data-attributen",
+  "DEBUG_YES": "JA",
+  "DEBUG_NO": "NEE",
+  "DEBUG_YES_CHECKED": "JA (gecontroleerd)",
+  "DEBUG_NA": "n.v.t."
 }

extension/locales/pl.json

@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "Dalej",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "Przejdź do następnego kroku",
   "ONBOARDING_1_TITLE": "Witaj w KoalaSync!",
-  "ONBOARDING_1_TEXT": "Oglądaj filmy w idealnej synchronizacji — bez względu na to, gdzie jesteś. Zróbmy szybką wycieczkę!",
+  "ONBOARDING_1_TEXT": "Oglądajcie filmy razem, gdziekolwiek jesteście. Oto krótkie wprowadzenie.",
   "ONBOARDING_2_TITLE": "1. Utwórz pokój",
   "ONBOARDING_2_TEXT": "Zacznij tutaj. Utwórz pokój i udostępnij link zaproszenia znajomym.",
   "ONBOARDING_3_TITLE": "2. Wybierz wideo",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Tożsamość nie została jeszcze załadowana. Odczekaj chwilę i spróbuj ponownie.",
   "ERR_NO_PEERS_TIME": "Brak innych uczestników ze znanym czasem. Przełącz na 'Skocz do mnie'.",
   "ERR_NO_VIDEO_TAB": "Nie można połączyć się z kartą wideo.",
+  "SITE_ACCESS_REQUIRED": "Przeglądarka blokuje KoalaSync na {host}. Kliknij poniżej „Zezwól na dostęp”. Jeśli nie pojawi się okno, zezwól KoalaSync na tej stronie w uprawnieniach rozszerzenia lub witryny.",
+  "BTN_RETRY_ACCESS": "Zezwól na dostęp",
   "ERR_SELECT_VIDEO": "Najpierw wybierz wideo!",
   "TOAST_INVITE_COPIED": "Link zaproszenia skopiowany!",
   "TOAST_COPY_FAILED": "Nie udało się skopiować do schowka",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Limit czasu — nie wszyscy uczestnicy załadowali odcinek",
   "LOBBY_CANCEL_USER": "Anulowane przez użytkownika",
   "NOTIF_ERROR_TITLE": "Błąd KoalaSync",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "Wesprzyj KoalaSync",
   "FOOTER_REVIEW": "★ Oceń",
   "FOOTER_SUPPORT_PROMPT": "Podoba Ci się KoalaSync? Zostaw recenzję!",
   "LABEL_AUDIO_PROCESSING": "Przetwarzanie dźwięku",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "Profil i Wygląd",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "Zmień swoją nazwę użytkownika, motyw i preferencje językowe.",
   "LABEL_SETTINGS_GROUP_SYNC": "Odtwarzanie i Sync",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Dostosuj odtwarzanie, powiadomienia i preferencje audio."
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Dostosuj odtwarzanie, powiadomienia i preferencje audio.",
+  "LABEL_CHAT_ENABLED": "Włącz czat pokoju",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "Pokaż zaszyfrowany czat pokoju na wybranej karcie wideo.",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "Skonfiguruj wygląd i położenie zaszyfrowanego czatu pokoju.",
+  "CHAT_SETTINGS_NOTE": "Opcjonalny i szyfrowany od końca do końca. Wiadomości są tylko na żywo i nie są przechowywane przez serwer pośredniczący.",
+  "LABEL_CHAT_POSITION": "Położenie",
+  "LABEL_CHAT_POSITION_TOOLTIP": "Wybierz, gdzie czat ma być przypięty do wybranego odtwarzacza.",
+  "LABEL_CHAT_SIZE": "Rozmiar nakładki",
+  "LABEL_CHAT_SIZE_TOOLTIP": "Wybierz domyślny rozmiar nakładki czatu.",
+  "OPTION_CHAT_SIZE_COMPACT": "Kompaktowy",
+  "OPTION_CHAT_SIZE_STANDARD": "Standardowy",
+  "OPTION_CHAT_SIZE_LARGE": "Duży",
+  "OPTION_CHAT_SIZE_CUSTOM": "Ostatni własny rozmiar",
+  "LABEL_CHAT_START_MODE": "Uruchom jako",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "Wybierz, czy czat ma startować jako pływający przycisk, czy otwarta nakładka.",
+  "OPTION_CHAT_START_BUBBLE": "Pływający przycisk",
+  "OPTION_CHAT_START_OPEN": "Otwarta nakładka",
+  "LABEL_CHAT_REACTION_DISPLAY": "Szybkie reakcje",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "Wybierz, czy szybkie reakcje mają być tylko na czacie, czy również spadać na wideo.",
+  "OPTION_CHAT_REACTIONS_CHAT": "Tylko czat",
+  "OPTION_CHAT_REACTIONS_VIDEO": "Czat i wideo",
+  "CHAT_QUICK_REACTIONS": "Szybkie reakcje",
+  "CHAT_TITLE": "Czat pokoju",
+  "CHAT_LIVE_ONLY": "Tylko na żywo. Bez historii.",
+  "CHAT_OPEN": "Otwórz czat pokoju",
+  "CHAT_CLOSE": "Zamknij czat",
+  "CHAT_DOCK_LEFT": "Przypnij czat po lewej",
+  "CHAT_DOCK_RIGHT": "Przypnij czat po prawej",
+  "CHAT_DETACHED": "Odłącz czat",
+  "CHAT_PLACEHOLDER": "Napisz wiadomość...",
+  "CHAT_SEND": "Wyślij",
+  "CHAT_MISSING_KEY": "Czat jest dostępny tylko przez aktualny link zaproszenia.",
+  "CHAT_TOO_LONG": "Maksymalnie 5000 znaków.",
+  "CHAT_SEND_FAILED": "Nie udało się wysłać wiadomości.",
+  "CHAT_EMPTY": "Brak wiadomości. Czat działa tylko na żywo.",
+  "LABEL_CHAT_NOTIFICATIONS": "Powiadomienia czatu",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "Pokazuje powiadomienie systemowe o nowej wiadomości, gdy karta wideo nie jest aktywna.",
+  "LABEL_EVENT_NOTIFICATIONS": "Powiadomienia o odtwarzaniu i pokoju",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "Pokazuje powiadomienia, gdy ktoś dołącza, wychodzi, odtwarza lub wstrzymuje.",
+  "DEBUG_SECTION_VIDEO_DETECTION": "Wykrywanie wideo",
+  "DEBUG_VIDEO_NOT_FOUND": "NIE ZNALEZIONO ELEMENTU WIDEO",
+  "DEBUG_SECTION_MEDIA_SESSION": "API Media Session",
+  "DEBUG_VIDEO_HINT": "Czy wideo jest odtwarzane? KoalaSync wykrywa elementy wideo po załadowaniu multimediów.",
+  "DEBUG_SECTION_PLAYBACK": "Odtwarzanie",
+  "DEBUG_STATE_PAUSED": "WSTRZYMANE",
+  "DEBUG_STATE_PLAYING": "ODTWARZANIE",
+  "DEBUG_SECTION_PROPERTIES": "Właściwości",
+  "DEBUG_SECTION_DIMENSIONS": "Wymiary",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = element wideo jest ukryty lub jeszcze niezaładowany",
+  "DEBUG_SECTION_MEDIA_ERROR": "Błąd multimediów",
+  "DEBUG_SECTION_DETECTION": "Wykrywanie",
+  "DEBUG_SECTION_IDENTIFICATION": "Identyfikacja",
+  "DEBUG_SECTION_MEDIA_SOURCE": "Źródło multimediów",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "Atrybuty danych",
+  "DEBUG_YES": "TAK",
+  "DEBUG_NO": "NIE",
+  "DEBUG_YES_CHECKED": "TAK (sprawdzono)",
+  "DEBUG_NA": "brak"
 }

extension/locales/pt-BR.json

@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "Próximo",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "Ir para o próximo passo",
   "ONBOARDING_1_TITLE": "Bem-vindo ao KoalaSync!",
-  "ONBOARDING_1_TEXT": "Assista a vídeos com seus amigos em perfeita sincronia, não importa onde estejam. Vamos fazer um tour rápido!",
+  "ONBOARDING_1_TEXT": "Assista a vídeos com outras pessoas, onde vocês estiverem. Veja uma apresentação rápida.",
   "ONBOARDING_2_TITLE": "1. Criar uma sala",
   "ONBOARDING_2_TEXT": "Comece aqui. Crie uma sala e compartilhe o link de convite com seus amigos.",
   "ONBOARDING_3_TITLE": "2. Selecionar vídeo",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identidade não carregada ainda. Aguarde um momento.",
   "ERR_NO_PEERS_TIME": "Nenhum participante com posição conhecida. Mude para 'Trazer para a minha posição'.",
   "ERR_NO_VIDEO_TAB": "Não foi possível conectar à aba do vídeo.",
+  "SITE_ACCESS_REQUIRED": "Seu navegador está bloqueando o KoalaSync em {host}. Clique em «Permitir acesso» abaixo. Se nenhuma caixa de diálogo aparecer, permita o KoalaSync neste site nas permissões da extensão ou do site.",
+  "BTN_RETRY_ACCESS": "Permitir acesso",
   "ERR_SELECT_VIDEO": "Selecione um vídeo primeiro!",
   "TOAST_INVITE_COPIED": "Link de convite copiado!",
   "TOAST_COPY_FAILED": "Falha ao copiar para a área de transferência",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Tempo limite — nem todos carregaram o episódio",
   "LOBBY_CANCEL_USER": "Cancelado pelo usuário",
   "NOTIF_ERROR_TITLE": "Erro no KoalaSync",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "Apoie o KoalaSync",
   "FOOTER_REVIEW": "★ Avaliar",
   "FOOTER_SUPPORT_PROMPT": "Gostou do KoalaSync? Deixe uma avaliação!",
   "LABEL_AUDIO_PROCESSING": "Processamento de áudio",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "Perfil e Aparência",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "Altere o seu nome de usuário, tema e preferências de idioma.",
   "LABEL_SETTINGS_GROUP_SYNC": "Reprodução e Sincronização",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Personalize a reprodução, as notificações e as preferências de áudio."
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Personalize a reprodução, as notificações e as preferências de áudio.",
+  "LABEL_CHAT_ENABLED": "Ativar chat da sala",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "Mostrar o chat criptografado da sala na guia de vídeo selecionada.",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "Configure a aparência e a posição do chat criptografado da sala.",
+  "CHAT_SETTINGS_NOTE": "Opcional e criptografado de ponta a ponta. As mensagens são apenas ao vivo e não são armazenadas pelo relay.",
+  "LABEL_CHAT_POSITION": "Posição",
+  "LABEL_CHAT_POSITION_TOOLTIP": "Escolha onde o chat fica fixado no player selecionado.",
+  "LABEL_CHAT_SIZE": "Tamanho da sobreposição",
+  "LABEL_CHAT_SIZE_TOOLTIP": "Escolha o tamanho padrão da sobreposição do chat.",
+  "OPTION_CHAT_SIZE_COMPACT": "Compacto",
+  "OPTION_CHAT_SIZE_STANDARD": "Padrão",
+  "OPTION_CHAT_SIZE_LARGE": "Grande",
+  "OPTION_CHAT_SIZE_CUSTOM": "Último tamanho personalizado",
+  "LABEL_CHAT_START_MODE": "Iniciar como",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "Escolha se o chat começa como uma bolha flutuante ou uma sobreposição aberta.",
+  "OPTION_CHAT_START_BUBBLE": "Bolha flutuante",
+  "OPTION_CHAT_START_OPEN": "Sobreposição aberta",
+  "LABEL_CHAT_REACTION_DISPLAY": "Reações rápidas",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "Escolha se as reações rápidas ficam apenas no chat ou também caem sobre o vídeo.",
+  "OPTION_CHAT_REACTIONS_CHAT": "Somente chat",
+  "OPTION_CHAT_REACTIONS_VIDEO": "Chat e vídeo",
+  "CHAT_QUICK_REACTIONS": "Reações rápidas",
+  "CHAT_TITLE": "Chat da sala",
+  "CHAT_LIVE_ONLY": "Somente ao vivo. Sem histórico.",
+  "CHAT_OPEN": "Abrir chat da sala",
+  "CHAT_CLOSE": "Fechar chat",
+  "CHAT_DOCK_LEFT": "Fixar chat à esquerda",
+  "CHAT_DOCK_RIGHT": "Fixar chat à direita",
+  "CHAT_DETACHED": "Desanexar chat",
+  "CHAT_PLACEHOLDER": "Escreva uma mensagem...",
+  "CHAT_SEND": "Enviar",
+  "CHAT_MISSING_KEY": "O chat está disponível apenas por um link de convite atual.",
+  "CHAT_TOO_LONG": "Máximo de 5000 caracteres.",
+  "CHAT_SEND_FAILED": "Não foi possível enviar a mensagem.",
+  "CHAT_EMPTY": "Ainda não há mensagens. O chat é somente ao vivo.",
+  "LABEL_CHAT_NOTIFICATIONS": "Notificações do chat",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "Mostra uma notificação do sistema para novas mensagens quando a aba do vídeo não está ativa.",
+  "LABEL_EVENT_NOTIFICATIONS": "Notificações de reprodução e sala",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "Mostra notificações quando alguém entra, sai, reproduz ou pausa.",
+  "DEBUG_SECTION_VIDEO_DETECTION": "Detecção de vídeo",
+  "DEBUG_VIDEO_NOT_FOUND": "NENHUM ELEMENTO DE VÍDEO ENCONTRADO",
+  "DEBUG_SECTION_MEDIA_SESSION": "API Media Session",
+  "DEBUG_VIDEO_HINT": "Há um vídeo sendo reproduzido? O KoalaSync detecta elementos de vídeo após o carregamento da mídia.",
+  "DEBUG_SECTION_PLAYBACK": "Reprodução",
+  "DEBUG_STATE_PAUSED": "PAUSADO",
+  "DEBUG_STATE_PLAYING": "REPRODUZINDO",
+  "DEBUG_SECTION_PROPERTIES": "Propriedades",
+  "DEBUG_SECTION_DIMENSIONS": "Dimensões",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = elemento de vídeo oculto ou ainda não carregado",
+  "DEBUG_SECTION_MEDIA_ERROR": "Erro de mídia",
+  "DEBUG_SECTION_DETECTION": "Detecção",
+  "DEBUG_SECTION_IDENTIFICATION": "Identificação",
+  "DEBUG_SECTION_MEDIA_SOURCE": "Fonte de mídia",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "Atributos de dados",
+  "DEBUG_YES": "SIM",
+  "DEBUG_NO": "NÃO",
+  "DEBUG_YES_CHECKED": "SIM (verificado)",
+  "DEBUG_NA": "n/d"
 }

extension/locales/pt.json

@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "Seguinte",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "Ir para o passo seguinte",
   "ONBOARDING_1_TITLE": "Bem-vindo ao KoalaSync!",
-  "ONBOARDING_1_TEXT": "Veja vídeos em conjunto com os seus amigos em sincronia perfeita. Vamos fazer uma breve visita guiada!",
+  "ONBOARDING_1_TEXT": "Vê vídeos com outras pessoas, onde quer que estejam. Aqui tens uma breve apresentação.",
   "ONBOARDING_2_TITLE": "1. Criar uma Sala",
   "ONBOARDING_2_TEXT": "Comece aqui. Crie uma sala e partilhe o link de convite com os seus amigos.",
   "ONBOARDING_3_TITLE": "2. Selecionar Vídeo",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Identidade ainda não carregada. Aguarde um momento.",
   "ERR_NO_PEERS_TIME": "Nenhum participante com hora conhecida. Mude para 'Trazer para a minha posição'.",
   "ERR_NO_VIDEO_TAB": "Não foi possível aceder ao separador do vídeo.",
+  "SITE_ACCESS_REQUIRED": "O seu navegador está a bloquear o KoalaSync em {host}. Clique em «Permitir acesso» abaixo. Se não aparecer uma caixa de diálogo, permita o KoalaSync neste site nas permissões da extensão ou do site.",
+  "BTN_RETRY_ACCESS": "Permitir acesso",
   "ERR_SELECT_VIDEO": "Selecione primeiro um vídeo!",
   "TOAST_INVITE_COPIED": "Link de convite copiado!",
   "TOAST_COPY_FAILED": "Falha ao copiar para a área de transferência",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Tempo limite — alguns participantes não carregaram o episódio",
   "LOBBY_CANCEL_USER": "Cancelado pelo utilizador",
   "NOTIF_ERROR_TITLE": "Erro no KoalaSync",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "Apoiar o KoalaSync",
   "FOOTER_REVIEW": "★ Avaliar",
   "FOOTER_SUPPORT_PROMPT": "Gostas do KoalaSync? Deixa uma avaliação!",
   "LABEL_AUDIO_PROCESSING": "Processamento de Áudio",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "Perfil e Aparência",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "Altere o seu nome de utilizador, tema e preferências de idioma.",
   "LABEL_SETTINGS_GROUP_SYNC": "Reprodução e Sincronização",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Personalize a reprodução, as notificações e as preferências de áudio."
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Personalize a reprodução, as notificações e as preferências de áudio.",
+  "LABEL_CHAT_ENABLED": "Ativar chat da sala",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "Mostrar o chat encriptado da sala no separador de vídeo selecionado.",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "Configure o aspeto e a posição do chat encriptado da sala.",
+  "CHAT_SETTINGS_NOTE": "Opcional e encriptado de ponta a ponta. As mensagens são apenas em direto e não são guardadas pelo relay.",
+  "LABEL_CHAT_POSITION": "Posição",
+  "LABEL_CHAT_POSITION_TOOLTIP": "Escolha onde o chat fica fixado no leitor selecionado.",
+  "LABEL_CHAT_SIZE": "Tamanho da sobreposição",
+  "LABEL_CHAT_SIZE_TOOLTIP": "Escolha o tamanho predefinido da sobreposição do chat.",
+  "OPTION_CHAT_SIZE_COMPACT": "Compacto",
+  "OPTION_CHAT_SIZE_STANDARD": "Padrão",
+  "OPTION_CHAT_SIZE_LARGE": "Grande",
+  "OPTION_CHAT_SIZE_CUSTOM": "Último tamanho personalizado",
+  "LABEL_CHAT_START_MODE": "Iniciar como",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "Escolha se o chat começa como uma bolha flutuante ou uma sobreposição aberta.",
+  "OPTION_CHAT_START_BUBBLE": "Bolha flutuante",
+  "OPTION_CHAT_START_OPEN": "Sobreposição aberta",
+  "LABEL_CHAT_REACTION_DISPLAY": "Reações rápidas",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "Escolha se as reações rápidas ficam apenas no chat ou também caem sobre o vídeo.",
+  "OPTION_CHAT_REACTIONS_CHAT": "Apenas chat",
+  "OPTION_CHAT_REACTIONS_VIDEO": "Chat e vídeo",
+  "CHAT_QUICK_REACTIONS": "Reações rápidas",
+  "CHAT_TITLE": "Chat da sala",
+  "CHAT_LIVE_ONLY": "Apenas em direto. Sem histórico.",
+  "CHAT_OPEN": "Abrir chat da sala",
+  "CHAT_CLOSE": "Fechar chat",
+  "CHAT_DOCK_LEFT": "Fixar chat à esquerda",
+  "CHAT_DOCK_RIGHT": "Fixar chat à direita",
+  "CHAT_DETACHED": "Desanexar chat",
+  "CHAT_PLACEHOLDER": "Escreva uma mensagem...",
+  "CHAT_SEND": "Enviar",
+  "CHAT_MISSING_KEY": "O chat está disponível apenas através de um link de convite atual.",
+  "CHAT_TOO_LONG": "Máximo de 5000 caracteres.",
+  "CHAT_SEND_FAILED": "Não foi possível enviar a mensagem.",
+  "CHAT_EMPTY": "Ainda não há mensagens. O chat funciona apenas em direto.",
+  "LABEL_CHAT_NOTIFICATIONS": "Notificações do chat",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "Mostra uma notificação do sistema para novas mensagens quando o separador do vídeo não está ativo.",
+  "LABEL_EVENT_NOTIFICATIONS": "Notificações de reprodução e sala",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "Mostra notificações quando alguém entra, sai, reproduz ou pausa.",
+  "DEBUG_SECTION_VIDEO_DETECTION": "Deteção de vídeo",
+  "DEBUG_VIDEO_NOT_FOUND": "NENHUM ELEMENTO DE VÍDEO ENCONTRADO",
+  "DEBUG_SECTION_MEDIA_SESSION": "API Media Session",
+  "DEBUG_VIDEO_HINT": "Está algum vídeo em reprodução? O KoalaSync deteta elementos de vídeo após o carregamento do conteúdo.",
+  "DEBUG_SECTION_PLAYBACK": "Reprodução",
+  "DEBUG_STATE_PAUSED": "EM PAUSA",
+  "DEBUG_STATE_PLAYING": "A REPRODUZIR",
+  "DEBUG_SECTION_PROPERTIES": "Propriedades",
+  "DEBUG_SECTION_DIMENSIONS": "Dimensões",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = elemento de vídeo oculto ou ainda não carregado",
+  "DEBUG_SECTION_MEDIA_ERROR": "Erro multimédia",
+  "DEBUG_SECTION_DETECTION": "Deteção",
+  "DEBUG_SECTION_IDENTIFICATION": "Identificação",
+  "DEBUG_SECTION_MEDIA_SOURCE": "Fonte multimédia",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "Atributos de dados",
+  "DEBUG_YES": "SIM",
+  "DEBUG_NO": "NÃO",
+  "DEBUG_YES_CHECKED": "SIM (verificado)",
+  "DEBUG_NA": "n/d"
 }

extension/locales/ru.json

@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "Далее",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "Перейти к следующему шагу",
   "ONBOARDING_1_TITLE": "Добро пожаловать в KoalaSync!",
-  "ONBOARDING_1_TEXT": "Смотрите видео в идеальной синхронизации вместе — где бы вы ни находились. Давайте проведем небольшую экскурсию!",
+  "ONBOARDING_1_TEXT": "Смотрите видео вместе, где бы вы ни находились. Вот краткий обзор.",
   "ONBOARDING_2_TITLE": "1. Создайте комнату",
   "ONBOARDING_2_TEXT": "Начните здесь. Создайте комнату и поделитесь ссылкой-приглашением со своими друзьями.",
   "ONBOARDING_3_TITLE": "2. Выберите видео",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Идентификатор еще не загружен. Подождите немного и повторите попытку.",
   "ERR_NO_PEERS_TIME": "Нет других участников с известной позицией плеера. Выберите 'Синхронизировать по мне'.",
   "ERR_NO_VIDEO_TAB": "Не удалось подключиться к вкладке с видео.",
+  "SITE_ACCESS_REQUIRED": "Браузер блокирует KoalaSync на {host}. Нажмите «Разрешить доступ» ниже. Если диалог не появится, разрешите KoalaSync для этого сайта в настройках расширения или разрешениях сайта.",
+  "BTN_RETRY_ACCESS": "Разрешить доступ",
   "ERR_SELECT_VIDEO": "Пожалуйста, сначала выберите вкладку с видео!",
   "TOAST_INVITE_COPIED": "Ссылка скопирована в буфер обмена!",
   "TOAST_COPY_FAILED": "Не удалось скопировать ссылку в буфер обмена",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Время ожидания истекло — не все участники загрузили серию",
   "LOBBY_CANCEL_USER": "Отменено пользователем",
   "NOTIF_ERROR_TITLE": "Ошибка KoalaSync",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "Поддержать KoalaSync",
   "FOOTER_REVIEW": "★ Оценить",
   "FOOTER_SUPPORT_PROMPT": "Нравится KoalaSync? Оставьте отзыв!",
   "LABEL_AUDIO_PROCESSING": "Обработка звука",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "Профиль и Оформление",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "Измените имя пользователя, тему и настройки языка.",
   "LABEL_SETTINGS_GROUP_SYNC": "Воспроизведение и Синхронизация",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Настройте воспроизведение, уведомления и параметры звука."
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Настройте воспроизведение, уведомления и параметры звука.",
+  "LABEL_CHAT_ENABLED": "Включить чат комнаты",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "Показывать зашифрованный чат комнаты на выбранной вкладке с видео.",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "Настройте внешний вид и расположение зашифрованного чата комнаты.",
+  "CHAT_SETTINGS_NOTE": "Необязательный чат со сквозным шифрованием. Сообщения доступны только в реальном времени и не сохраняются ретранслятором.",
+  "LABEL_CHAT_POSITION": "Положение",
+  "LABEL_CHAT_POSITION_TOOLTIP": "Выберите, где чат будет закреплён на выбранном проигрывателе.",
+  "LABEL_CHAT_SIZE": "Размер окна",
+  "LABEL_CHAT_SIZE_TOOLTIP": "Выберите стандартный размер окна чата.",
+  "OPTION_CHAT_SIZE_COMPACT": "Компактный",
+  "OPTION_CHAT_SIZE_STANDARD": "Стандартный",
+  "OPTION_CHAT_SIZE_LARGE": "Большой",
+  "OPTION_CHAT_SIZE_CUSTOM": "Последний пользовательский размер",
+  "LABEL_CHAT_START_MODE": "Начальный вид",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "Выберите, запускать чат как плавающую кнопку или открытое окно.",
+  "OPTION_CHAT_START_BUBBLE": "Плавающая кнопка",
+  "OPTION_CHAT_START_OPEN": "Открытое окно",
+  "LABEL_CHAT_REACTION_DISPLAY": "Быстрые реакции",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "Выберите, показывать быстрые реакции только в чате или также поверх видео.",
+  "OPTION_CHAT_REACTIONS_CHAT": "Только чат",
+  "OPTION_CHAT_REACTIONS_VIDEO": "Чат и видео",
+  "CHAT_QUICK_REACTIONS": "Быстрые реакции",
+  "CHAT_TITLE": "Чат комнаты",
+  "CHAT_LIVE_ONLY": "Только в реальном времени. Без истории.",
+  "CHAT_OPEN": "Открыть чат комнаты",
+  "CHAT_CLOSE": "Закрыть чат",
+  "CHAT_DOCK_LEFT": "Закрепить чат слева",
+  "CHAT_DOCK_RIGHT": "Закрепить чат справа",
+  "CHAT_DETACHED": "Открепить чат",
+  "CHAT_PLACEHOLDER": "Напишите сообщение...",
+  "CHAT_SEND": "Отправить",
+  "CHAT_MISSING_KEY": "Чат доступен только по актуальной ссылке-приглашению.",
+  "CHAT_TOO_LONG": "Не более 5000 символов.",
+  "CHAT_SEND_FAILED": "Не удалось отправить сообщение.",
+  "CHAT_EMPTY": "Сообщений пока нет. Чат работает только в реальном времени.",
+  "LABEL_CHAT_NOTIFICATIONS": "Уведомления чата",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "Показывает системное уведомление о новых сообщениях, когда вкладка с видео не активна.",
+  "LABEL_EVENT_NOTIFICATIONS": "Уведомления о воспроизведении и комнате",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "Показывает уведомления, когда кто-то входит, выходит, запускает или приостанавливает видео.",
+  "DEBUG_SECTION_VIDEO_DETECTION": "Обнаружение видео",
+  "DEBUG_VIDEO_NOT_FOUND": "ВИДЕОЭЛЕМЕНТ НЕ НАЙДЕН",
+  "DEBUG_SECTION_MEDIA_SESSION": "API Media Session",
+  "DEBUG_VIDEO_HINT": "Видео сейчас воспроизводится? KoalaSync обнаруживает видеоэлементы после загрузки контента.",
+  "DEBUG_SECTION_PLAYBACK": "Воспроизведение",
+  "DEBUG_STATE_PAUSED": "ПАУЗА",
+  "DEBUG_STATE_PLAYING": "ВОСПРОИЗВЕДЕНИЕ",
+  "DEBUG_SECTION_PROPERTIES": "Свойства",
+  "DEBUG_SECTION_DIMENSIONS": "Размеры",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = видеоэлемент скрыт или ещё не загружен",
+  "DEBUG_SECTION_MEDIA_ERROR": "Ошибка медиа",
+  "DEBUG_SECTION_DETECTION": "Обнаружение",
+  "DEBUG_SECTION_IDENTIFICATION": "Идентификация",
+  "DEBUG_SECTION_MEDIA_SOURCE": "Источник медиа",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "Атрибуты данных",
+  "DEBUG_YES": "ДА",
+  "DEBUG_NO": "НЕТ",
+  "DEBUG_YES_CHECKED": "ДА (проверено)",
+  "DEBUG_NA": "н/д"
 }

extension/locales/tr.json

@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "İleri",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "Bir sonraki adıma git",
   "ONBOARDING_1_TITLE": "KoalaSync'e Hoş Geldiniz!",
-  "ONBOARDING_1_TEXT": "Nerede olursanız olun videoları mükemmel bir senkronizasyonla birlikte izleyin. Hızlı bir tura çıkalım!",
+  "ONBOARDING_1_TEXT": "Nerede olursanız olun videoları birlikte izleyin. İşte kısa bir tanıtım.",
   "ONBOARDING_2_TITLE": "1. Oda Oluştur",
   "ONBOARDING_2_TEXT": "Buradan başlayın. Bir oda oluşturun ve davet bağlantısını arkadaşlarınızla paylaşın.",
   "ONBOARDING_3_TITLE": "2. Video Seç",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Kimlik henüz yüklenmedi. Biraz bekleyin ve tekrar deneyin.",
   "ERR_NO_PEERS_TIME": "Bilinen bir zamanı olan başka bağlantı yok. 'Bana Atla' seçeneğine geçin.",
   "ERR_NO_VIDEO_TAB": "Video sekmesine bağlanılamadı.",
+  "SITE_ACCESS_REQUIRED": "Tarayıcınız {host} üzerinde KoalaSync'i engelliyor. Aşağıdaki “Erişime izin ver” düğmesine tıklayın. İletişim kutusu görünmezse uzantı veya site izinlerinden bu site için KoalaSync'e izin verin.",
+  "BTN_RETRY_ACCESS": "Erişime izin ver",
   "ERR_SELECT_VIDEO": "Lütfen önce bir video seçin!",
   "TOAST_INVITE_COPIED": "Davet bağlantısı kopyalandı!",
   "TOAST_COPY_FAILED": "Panoya kopyalanamadı",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Zaman aşımı — tüm bağlantılar bölümü yüklemedi",
   "LOBBY_CANCEL_USER": "Kullanıcı tarafından iptal edildi",
   "NOTIF_ERROR_TITLE": "KoalaSync Hatası",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "KoalaSync’i destekle",
   "FOOTER_REVIEW": "★ Değerlendir",
   "FOOTER_SUPPORT_PROMPT": "KoalaSync'i beğendin mi? Bir yorum bırak!",
   "LABEL_AUDIO_PROCESSING": "Ses işleme",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "Profil ve Görünüm",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "Kullanıcı adınızı, temanızı ve dil tercihlerinizi değiştirin.",
   "LABEL_SETTINGS_GROUP_SYNC": "Oynatma ve Eşitleme",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Oynatma, bildirim ve ses tercihlerini özelleştirin."
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Oynatma, bildirim ve ses tercihlerini özelleştirin.",
+  "LABEL_CHAT_ENABLED": "Oda sohbetini etkinleştir",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "Şifreli oda sohbetini seçili video sekmesinde göster.",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "Şifreli oda sohbetinin görünümünü ve konumunu yapılandırın.",
+  "CHAT_SETTINGS_NOTE": "İsteğe bağlı ve uçtan uca şifrelidir. Mesajlar yalnızca canlıdır ve aktarıcı tarafından saklanmaz.",
+  "LABEL_CHAT_POSITION": "Konum",
+  "LABEL_CHAT_POSITION_TOOLTIP": "Sohbetin seçili oynatıcıda nereye sabitleneceğini seçin.",
+  "LABEL_CHAT_SIZE": "Kaplama boyutu",
+  "LABEL_CHAT_SIZE_TOOLTIP": "Sohbet kaplamasının varsayılan boyutunu seçin.",
+  "OPTION_CHAT_SIZE_COMPACT": "Kompakt",
+  "OPTION_CHAT_SIZE_STANDARD": "Standart",
+  "OPTION_CHAT_SIZE_LARGE": "Büyük",
+  "OPTION_CHAT_SIZE_CUSTOM": "Son özel boyut",
+  "LABEL_CHAT_START_MODE": "Başlangıç görünümü",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "Sohbetin kayan balon veya açık kaplama olarak başlamasını seçin.",
+  "OPTION_CHAT_START_BUBBLE": "Kayan sohbet balonu",
+  "OPTION_CHAT_START_OPEN": "Açık kaplama",
+  "LABEL_CHAT_REACTION_DISPLAY": "Hızlı tepkiler",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "Hızlı tepkilerin yalnızca sohbette mi yoksa videonun üzerinde de mi görüneceğini seçin.",
+  "OPTION_CHAT_REACTIONS_CHAT": "Yalnızca sohbet",
+  "OPTION_CHAT_REACTIONS_VIDEO": "Sohbet ve video",
+  "CHAT_QUICK_REACTIONS": "Hızlı tepkiler",
+  "CHAT_TITLE": "Oda Sohbeti",
+  "CHAT_LIVE_ONLY": "Yalnızca canlı. Geçmiş yok.",
+  "CHAT_OPEN": "Oda sohbetini aç",
+  "CHAT_CLOSE": "Sohbeti kapat",
+  "CHAT_DOCK_LEFT": "Sohbeti sola sabitle",
+  "CHAT_DOCK_RIGHT": "Sohbeti sağa sabitle",
+  "CHAT_DETACHED": "Sohbeti ayır",
+  "CHAT_PLACEHOLDER": "Bir mesaj yazın...",
+  "CHAT_SEND": "Gönder",
+  "CHAT_MISSING_KEY": "Sohbet yalnızca güncel bir davet bağlantısıyla kullanılabilir.",
+  "CHAT_TOO_LONG": "En fazla 5000 karakter.",
+  "CHAT_SEND_FAILED": "Mesaj gönderilemedi.",
+  "CHAT_EMPTY": "Henüz mesaj yok. Sohbet yalnızca canlıdır.",
+  "LABEL_CHAT_NOTIFICATIONS": "Sohbet bildirimleri",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "Video sekmesi etkin değilken yeni oda mesajlarını sistem bildirimi olarak gösterir.",
+  "LABEL_EVENT_NOTIFICATIONS": "Oynatma ve oda bildirimleri",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "Biri katıldığında, ayrıldığında, oynattığında veya duraklattığında bildirim gösterir.",
+  "DEBUG_SECTION_VIDEO_DETECTION": "Video algılama",
+  "DEBUG_VIDEO_NOT_FOUND": "VİDEO ÖĞESİ BULUNAMADI",
+  "DEBUG_SECTION_MEDIA_SESSION": "Media Session API",
+  "DEBUG_VIDEO_HINT": "Şu anda video oynatılıyor mu? KoalaSync medya yüklendikten sonra video öğelerini algılar.",
+  "DEBUG_SECTION_PLAYBACK": "Oynatma",
+  "DEBUG_STATE_PAUSED": "DURAKLATILDI",
+  "DEBUG_STATE_PLAYING": "OYNATILIYOR",
+  "DEBUG_SECTION_PROPERTIES": "Özellikler",
+  "DEBUG_SECTION_DIMENSIONS": "Boyutlar",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = video öğesi gizli veya henüz yüklenmedi",
+  "DEBUG_SECTION_MEDIA_ERROR": "Medya hatası",
+  "DEBUG_SECTION_DETECTION": "Algılama",
+  "DEBUG_SECTION_IDENTIFICATION": "Tanımlama",
+  "DEBUG_SECTION_MEDIA_SOURCE": "Medya kaynağı",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "Veri öznitelikleri",
+  "DEBUG_YES": "EVET",
+  "DEBUG_NO": "HAYIR",
+  "DEBUG_YES_CHECKED": "EVET (kontrol edildi)",
+  "DEBUG_NA": "yok"
 }

extension/locales/uk.json

@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "Далі",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "Перейти до наступного кроку",
   "ONBOARDING_1_TITLE": "Ласкаво просимо до KoalaSync!",
-  "ONBOARDING_1_TEXT": "Дивіться відео разом у ідеальній синхронізації — де б ви не були. Давайте зробимо короткий тур!",
+  "ONBOARDING_1_TEXT": "Дивіться відео разом, де б ви не були. Ось короткий огляд.",
   "ONBOARDING_2_TITLE": "1. Створіть кімнату",
   "ONBOARDING_2_TEXT": "Почніть тут. Створіть кімнату та поділіться посиланням запрошення з друзями.",
   "ONBOARDING_3_TITLE": "2. Виберіть Відео",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "Посвідчення особи ще не завантажено. Зачекайте хвилинку та повторіть спробу.",
   "ERR_NO_PEERS_TIME": "Немає інших аналогів із відомим часом. Переключіться на «Перейти до мене».",
   "ERR_NO_VIDEO_TAB": "Не вдалося підключитися до вкладки відео.",
+  "SITE_ACCESS_REQUIRED": "Браузер блокує KoalaSync на {host}. Натисніть «Дозволити доступ» нижче. Якщо діалог не з’явиться, дозвольте KoalaSync для цього сайту в налаштуваннях розширення або дозволах сайту.",
+  "BTN_RETRY_ACCESS": "Дозволити доступ",
   "ERR_SELECT_VIDEO": "Спочатку виберіть відео!",
   "TOAST_INVITE_COPIED": "Посилання на запрошення скопійовано!",
   "TOAST_COPY_FAILED": "Не вдалося скопіювати в буфер обміну",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Тайм-аут — не всі вузли завантажили епізод",
   "LOBBY_CANCEL_USER": "Скасовано користувачем",
   "NOTIF_ERROR_TITLE": "Помилка KoalaSync",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "Підтримати KoalaSync",
   "FOOTER_REVIEW": "★ Оцініть нас",
   "FOOTER_SUPPORT_PROMPT": "Подобається KoalaSync? Залиште відгук!",
   "LABEL_AUDIO_PROCESSING": "Обробка аудіо",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "Профіль та Вигляд",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "Змініть ім'я користувача, тему та мовні налаштування.",
   "LABEL_SETTINGS_GROUP_SYNC": "Відтворення та Синхронізація",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Налаштуйте відтворення, сповіщення та параметри звуку."
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "Налаштуйте відтворення, сповіщення та параметри звуку.",
+  "LABEL_CHAT_ENABLED": "Увімкнути чат кімнати",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "Показувати зашифрований чат кімнати на вибраній вкладці з відео.",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "Налаштуйте вигляд і розташування зашифрованого чату кімнати.",
+  "CHAT_SETTINGS_NOTE": "Необов'язковий чат із наскрізним шифруванням. Повідомлення доступні лише наживо й не зберігаються ретранслятором.",
+  "LABEL_CHAT_POSITION": "Розташування",
+  "LABEL_CHAT_POSITION_TOOLTIP": "Виберіть, де чат буде закріплено на вибраному програвачі.",
+  "LABEL_CHAT_SIZE": "Розмір вікна",
+  "LABEL_CHAT_SIZE_TOOLTIP": "Виберіть стандартний розмір вікна чату.",
+  "OPTION_CHAT_SIZE_COMPACT": "Компактний",
+  "OPTION_CHAT_SIZE_STANDARD": "Стандартний",
+  "OPTION_CHAT_SIZE_LARGE": "Великий",
+  "OPTION_CHAT_SIZE_CUSTOM": "Останній власний розмір",
+  "LABEL_CHAT_START_MODE": "Початковий вигляд",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "Виберіть, запускати чат як плаваючу кнопку чи відкрите вікно.",
+  "OPTION_CHAT_START_BUBBLE": "Плаваюча кнопка",
+  "OPTION_CHAT_START_OPEN": "Відкрите вікно",
+  "LABEL_CHAT_REACTION_DISPLAY": "Швидкі реакції",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "Виберіть, показувати швидкі реакції лише в чаті чи також поверх відео.",
+  "OPTION_CHAT_REACTIONS_CHAT": "Лише чат",
+  "OPTION_CHAT_REACTIONS_VIDEO": "Чат і відео",
+  "CHAT_QUICK_REACTIONS": "Швидкі реакції",
+  "CHAT_TITLE": "Чат кімнати",
+  "CHAT_LIVE_ONLY": "Лише наживо. Без історії.",
+  "CHAT_OPEN": "Відкрити чат кімнати",
+  "CHAT_CLOSE": "Закрити чат",
+  "CHAT_DOCK_LEFT": "Закріпити чат ліворуч",
+  "CHAT_DOCK_RIGHT": "Закріпити чат праворуч",
+  "CHAT_DETACHED": "Від'єднати чат",
+  "CHAT_PLACEHOLDER": "Напишіть повідомлення...",
+  "CHAT_SEND": "Надіслати",
+  "CHAT_MISSING_KEY": "Чат доступний лише за актуальним посиланням-запрошенням.",
+  "CHAT_TOO_LONG": "Не більше 5000 символів.",
+  "CHAT_SEND_FAILED": "Не вдалося надіслати повідомлення.",
+  "CHAT_EMPTY": "Повідомлень ще немає. Чат працює лише наживо.",
+  "LABEL_CHAT_NOTIFICATIONS": "Сповіщення чату",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "Показує системне сповіщення про нові повідомлення, коли вкладка з відео неактивна.",
+  "LABEL_EVENT_NOTIFICATIONS": "Сповіщення про відтворення та кімнату",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "Показує сповіщення, коли хтось приєднується, виходить, запускає або призупиняє відео.",
+  "DEBUG_SECTION_VIDEO_DETECTION": "Виявлення відео",
+  "DEBUG_VIDEO_NOT_FOUND": "ВІДЕОЕЛЕМЕНТ НЕ ЗНАЙДЕНО",
+  "DEBUG_SECTION_MEDIA_SESSION": "API Media Session",
+  "DEBUG_VIDEO_HINT": "Відео зараз відтворюється? KoalaSync виявляє відеоелементи після завантаження медіа.",
+  "DEBUG_SECTION_PLAYBACK": "Відтворення",
+  "DEBUG_STATE_PAUSED": "ПРИЗУПИНЕНО",
+  "DEBUG_STATE_PLAYING": "ВІДТВОРЮЄТЬСЯ",
+  "DEBUG_SECTION_PROPERTIES": "Властивості",
+  "DEBUG_SECTION_DIMENSIONS": "Розміри",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = відеоелемент прихований або ще не завантажений",
+  "DEBUG_SECTION_MEDIA_ERROR": "Помилка медіа",
+  "DEBUG_SECTION_DETECTION": "Виявлення",
+  "DEBUG_SECTION_IDENTIFICATION": "Ідентифікація",
+  "DEBUG_SECTION_MEDIA_SOURCE": "Джерело медіа",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "Атрибути даних",
+  "DEBUG_YES": "ТАК",
+  "DEBUG_NO": "НІ",
+  "DEBUG_YES_CHECKED": "ТАК (перевірено)",
+  "DEBUG_NA": "н/д"
 }

extension/locales/zh.json

@@ -134,7 +134,7 @@
   "BTN_ONBOARDING_NEXT": "下一个",
   "BTN_ONBOARDING_NEXT_TOOLTIP": "进入下一步",
   "ONBOARDING_1_TITLE": "欢迎来到KoalaSync！",
-  "ONBOARDING_1_TEXT": "无论您身在何处，都能完美同步地一起观看视频。让我们快速浏览一下吧！",
+  "ONBOARDING_1_TEXT": "无论身在何处，都可以一起看视频。下面是快速介绍。",
   "ONBOARDING_2_TITLE": "1. 创建房间",
   "ONBOARDING_2_TEXT": "从这里开始。创建一个房间并与您的朋友分享邀请链接。",
   "ONBOARDING_3_TITLE": "2. 选择视频",
@@ -148,6 +148,8 @@
   "ERR_IDENTITY_NOT_LOADED": "身份尚未加载。稍等片刻，然后重试。",
   "ERR_NO_PEERS_TIME": "没有其他已知时间的同行。切换到“跳到我这里”。",
   "ERR_NO_VIDEO_TAB": "无法连接到视频选项卡。",
+  "SITE_ACCESS_REQUIRED": "浏览器正在阻止 KoalaSync 访问 {host}。请点击下方的“允许访问”。如果未显示对话框，请在扩展程序或网站权限中允许 KoalaSync 访问此网站。",
+  "BTN_RETRY_ACCESS": "允许访问",
   "ERR_SELECT_VIDEO": "请先选择视频！",
   "TOAST_INVITE_COPIED": "邀请链接已复制！",
   "TOAST_COPY_FAILED": "无法复制到剪贴板",
@@ -202,7 +204,7 @@
   "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "超时——并非所有同行都加载了该剧集",
   "LOBBY_CANCEL_USER": "已被用户取消",
   "NOTIF_ERROR_TITLE": "KoalaSync 错误",
-  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_SUPPORT": "支持 KoalaSync",
   "FOOTER_REVIEW": "★ 评价我们",
   "FOOTER_SUPPORT_PROMPT": "喜欢 KoalaSync 吗？留下评论！",
   "LABEL_AUDIO_PROCESSING": "音频处理",
@@ -243,5 +245,62 @@
   "LABEL_SETTINGS_GROUP_PROFILE": "个人资料与外观",
   "LABEL_SETTINGS_GROUP_PROFILE_TOOLTIP": "更改您的用户名、主题和语言首选项。",
   "LABEL_SETTINGS_GROUP_SYNC": "播放与同步",
-  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "自定义播放、通知和音频首选项。"
+  "LABEL_SETTINGS_GROUP_SYNC_TOOLTIP": "自定义播放、通知和音频首选项。",
+  "LABEL_CHAT_ENABLED": "启用房间聊天",
+  "LABEL_CHAT_ENABLED_TOOLTIP": "在选定的视频标签页中显示加密的房间聊天。",
+  "LABEL_SETTINGS_GROUP_CHAT_TOOLTIP": "配置加密房间聊天的外观和位置。",
+  "CHAT_SETTINGS_NOTE": "可选并采用端到端加密。消息仅实时显示，且不会由中继服务器存储。",
+  "LABEL_CHAT_POSITION": "位置",
+  "LABEL_CHAT_POSITION_TOOLTIP": "选择聊天在当前播放器上的固定位置。",
+  "LABEL_CHAT_SIZE": "浮层大小",
+  "LABEL_CHAT_SIZE_TOOLTIP": "选择聊天浮层的默认大小。",
+  "OPTION_CHAT_SIZE_COMPACT": "紧凑",
+  "OPTION_CHAT_SIZE_STANDARD": "标准",
+  "OPTION_CHAT_SIZE_LARGE": "大",
+  "OPTION_CHAT_SIZE_CUSTOM": "上次自定义大小",
+  "LABEL_CHAT_START_MODE": "启动方式",
+  "LABEL_CHAT_START_MODE_TOOLTIP": "选择以悬浮气泡或打开的浮层启动聊天。",
+  "OPTION_CHAT_START_BUBBLE": "悬浮聊天气泡",
+  "OPTION_CHAT_START_OPEN": "打开浮层",
+  "LABEL_CHAT_REACTION_DISPLAY": "快捷回应",
+  "LABEL_CHAT_REACTION_DISPLAY_TOOLTIP": "选择快捷回应仅显示在聊天中，或同时飘落在视频上。",
+  "OPTION_CHAT_REACTIONS_CHAT": "仅聊天",
+  "OPTION_CHAT_REACTIONS_VIDEO": "聊天和视频",
+  "CHAT_QUICK_REACTIONS": "快捷回应",
+  "CHAT_TITLE": "房间聊天",
+  "CHAT_LIVE_ONLY": "仅实时显示，无历史记录。",
+  "CHAT_OPEN": "打开房间聊天",
+  "CHAT_CLOSE": "关闭聊天",
+  "CHAT_DOCK_LEFT": "将聊天固定在左侧",
+  "CHAT_DOCK_RIGHT": "将聊天固定在右侧",
+  "CHAT_DETACHED": "浮动聊天",
+  "CHAT_PLACEHOLDER": "输入消息...",
+  "CHAT_SEND": "发送",
+  "CHAT_MISSING_KEY": "聊天仅可通过当前邀请链接使用。",
+  "CHAT_TOO_LONG": "最多5000个字符。",
+  "CHAT_SEND_FAILED": "无法发送消息。",
+  "CHAT_EMPTY": "暂无消息。聊天仅实时显示。",
+  "LABEL_CHAT_NOTIFICATIONS": "聊天通知",
+  "LABEL_CHAT_NOTIFICATIONS_TOOLTIP": "视频标签页未激活时，以系统通知显示新的房间聊天消息。",
+  "LABEL_EVENT_NOTIFICATIONS": "播放与房间通知",
+  "LABEL_EVENT_NOTIFICATIONS_TOOLTIP": "有人加入、离开、播放或暂停时显示系统通知。",
+  "DEBUG_SECTION_VIDEO_DETECTION": "视频检测",
+  "DEBUG_VIDEO_NOT_FOUND": "未找到视频元素",
+  "DEBUG_SECTION_MEDIA_SESSION": "Media Session API",
+  "DEBUG_VIDEO_HINT": "当前是否正在播放视频？媒体加载后，KoalaSync 才能检测视频元素。",
+  "DEBUG_SECTION_PLAYBACK": "播放",
+  "DEBUG_STATE_PAUSED": "已暂停",
+  "DEBUG_STATE_PLAYING": "播放中",
+  "DEBUG_SECTION_PROPERTIES": "属性",
+  "DEBUG_SECTION_DIMENSIONS": "尺寸",
+  "DEBUG_DIMENSIONS_HINT": "0×0 = 视频元素已隐藏或尚未加载",
+  "DEBUG_SECTION_MEDIA_ERROR": "媒体错误",
+  "DEBUG_SECTION_DETECTION": "检测",
+  "DEBUG_SECTION_IDENTIFICATION": "标识",
+  "DEBUG_SECTION_MEDIA_SOURCE": "媒体来源",
+  "DEBUG_SECTION_DATA_ATTRIBUTES": "数据属性",
+  "DEBUG_YES": "是",
+  "DEBUG_NO": "否",
+  "DEBUG_YES_CHECKED": "是（已检查）",
+  "DEBUG_NA": "无"
 }

extension/manifest.base.json

@@ -1,9 +1,10 @@
 {
   "manifest_version": 3,
   "default_locale": "en",
-  "name": "KoalaSync",
-  "version": "2.6.0",
-  "description": "Synchronize video playback on YouTube, Netflix, Emby, Jellyfin, and any HTML5 site in real-time with friends.",
+  "name": "__MSG_appName__",
+  "short_name": "KoalaSync",
+  "version": "3.0.1",
+  "description": "__MSG_appDesc__",
   "permissions": [
     "storage",
     "tabs",

extension/modules/tab-manager.js

@@ -1,20 +1,7 @@
 export function initTabManager({
     getCurrentTabId,
-    setCurrentTabId,
-    setCurrentTabTitle,
-    setLastContentHeartbeatAt,
-    setRoomIdleSince,
-    getCurrentRoom,
-    getPeerId,
-    getStorageInitialized,
-    updateBadgeStatus,
-    addLog,
-    getSettings,
-    emit,
-    applyAudioSettingsToTab,
-    injectContentScript,
-    ensureState,
-    EVENTS
+    reactivateCurrentTarget,
+    ensureState
 }) {
     chrome.storage.onChanged.addListener(async (changes, area) => {
         if (area !== 'local' || !changes.audioSettings) return;
@@ -28,65 +15,14 @@ export function initTabManager({
         }).catch(() => {});
     });
 
-    chrome.tabs.onRemoved.addListener(async (tabId) => {
-        await ensureState();
-        if (tabId === getCurrentTabId()) {
-            const wasInRoom = !!getCurrentRoom();
-            setCurrentTabId(null);
-            setCurrentTabTitle(null);
-            setLastContentHeartbeatAt(null);
-            const now = Date.now();
-            setRoomIdleSince(now);
-            chrome.storage.session.set({
-                currentTabId: null,
-                currentTabTitle: null,
-                roomIdleSince: now,
-                lastContentHeartbeatAt: null
-            });
-            updateBadgeStatus();
-            addLog('Target tab closed.', 'warn');
-
-            if (wasInRoom) {
-                const roomAtClose = getCurrentRoom();
-                getSettings().then(settings => {
-                    if (getCurrentRoom() !== roomAtClose) return;
-
-                    emit(EVENTS.PEER_STATUS, {
-                        peerId: getPeerId(),
-                        playbackState: 'paused',
-                        currentTime: null,
-                        mediaTitle: null,
-                        username: settings.username,
-                        tabTitle: null
-                    });
-
-                    const room = getCurrentRoom();
-                    if (room && Array.isArray(room.peers)) {
-                        const me = room.peers.find(p => (p.peerId || p) === getPeerId());
-                        if (me && typeof me === 'object') {
-                            me.playbackState = 'paused';
-                            me.currentTime = null;
-                            me.mediaTitle = null;
-                            me.tabTitle = null;
-                            me.lastHeartbeat = Date.now();
-                            if (getStorageInitialized()) {
-                                chrome.storage.session.set({ currentRoom: room });
-                            }
-                            chrome.runtime.sendMessage({ type: 'PEER_UPDATE', peers: room.peers }).catch(() => {});
-                        }
-                    }
-                }).catch(() => {});
-            }
-        }
-    });
-
     chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, _tab) => {
         await ensureState();
-        const curTabId = getCurrentTabId();
-        if (curTabId && tabId === parseInt(curTabId) && changeInfo.status === 'complete') {
-            injectContentScript(tabId)
-                .then(() => applyAudioSettingsToTab(tabId))
-                .catch(() => {});
+        const currentTabId = Number(getCurrentTabId());
+        if (Number.isInteger(currentTabId)
+            && currentTabId > 0
+            && tabId === currentTabId
+            && changeInfo.status === 'complete') {
+            reactivateCurrentTarget(tabId).catch(() => {});
         }
     });
 }

extension/popup.html

@@ -453,6 +453,24 @@
             box-shadow: 0 8px 22px rgba(0, 0, 0, 0.08);
         }
 
+        .site-access-notice {
+            display: none;
+            margin-top: 8px;
+            margin-bottom: 0;
+            border-left: 4px solid var(--warning);
+            background: color-mix(in oklch, var(--warning), var(--card) 90%);
+            color: var(--text);
+            font-size: 11px;
+            line-height: 1.45;
+        }
+
+        .site-access-notice button {
+            width: auto;
+            margin-top: 8px;
+            padding: 6px 10px;
+            font-size: 11px;
+        }
+
         .peer-item {
             padding: 10px 0;
             border-bottom: 1px solid var(--border-strong);
@@ -1146,12 +1164,12 @@
             color: var(--accent);
             opacity: 1;
         }
-        .tab-btn[data-tab="tab-dev"],
+        /* Only the opt-in Dev tab is de-emphasized. tab-dev is the user-facing
+           "Status" tab and must match the other tabs. */
         #devToolsTabBtn {
             color: color-mix(in oklch, var(--text-muted), transparent 18%);
             font-size: 11px;
         }
-        .tab-btn[data-tab="tab-dev"].active,
         #devToolsTabBtn.active {
             color: var(--text-on-green);
         }
@@ -1197,6 +1215,12 @@
             line-height: 1.45;
             text-align: left;
         }
+        [data-chat-setting] {
+            transition: opacity 0.2s;
+        }
+        [data-chat-setting].is-disabled {
+            opacity: 0.5;
+        }
         .settings-issue-link {
             margin: 8px 0 2px;
             padding-top: 9px;
@@ -1353,7 +1377,7 @@
             <!-- Room credentials — distinct group below the server picker. -->
             <div class="form-group">
                 <label for="roomId" title="The unique identifier for your sync room" data-i18n="LABEL_ROOM_ID" data-i18n-title="LABEL_ROOM_ID_TOOLTIP">Room ID</label>
-                <input type="text" id="roomId" data-i18n-placeholder="PLACEHOLDER_ROOM_ID" data-i18n-title="PLACEHOLDER_ROOM_ID_TOOLTIP" placeholder="Enter Room ID" title="The unique ID of the room you want to join">
+                <input type="text" id="roomId" maxlength="64" data-i18n-placeholder="PLACEHOLDER_ROOM_ID" data-i18n-title="PLACEHOLDER_ROOM_ID_TOOLTIP" placeholder="Enter Room ID" title="The unique ID of the room you want to join">
             </div>
             <div class="form-group">
                 <label for="password" title="Optional password to restrict room access" data-i18n="LABEL_PASSWORD" data-i18n-title="LABEL_PASSWORD_TOOLTIP">Password (Optional)</label>
@@ -1432,6 +1456,10 @@
                 Select your video here!
                 <div style="position: absolute; bottom: -4px; right: 20px; width: 8px; height: 8px; background: var(--accent); transform: rotate(45deg);"></div>
             </div>
+            <div id="siteAccessNotice" class="info-card site-access-notice" role="alert" aria-live="polite">
+                <div id="siteAccessMessage"></div>
+                <button id="siteAccessRetry" class="secondary" data-i18n="BTN_RETRY_ACCESS">Try again</button>
+            </div>
         </div>
         
         <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 4px;">
@@ -1593,6 +1621,66 @@
             </div>
         </details>
 
+        <details class="form-group" name="settings-accordion">
+            <summary title="Configure encrypted room chat appearance and placement." data-i18n="CHAT_TITLE" data-i18n-title="LABEL_SETTINGS_GROUP_CHAT_TOOLTIP">Room Chat</summary>
+            <div class="details-content">
+                <p class="settings-note" data-i18n="CHAT_SETTINGS_NOTE">Optional and end-to-end encrypted. Messages are live only and are not stored by the relay.</p>
+                <div class="settings-row">
+                    <label for="chatEnabled" title="Show encrypted room chat on the selected video tab." data-i18n="LABEL_CHAT_ENABLED" data-i18n-title="LABEL_CHAT_ENABLED_TOOLTIP">Enable Room Chat</label>
+                    <label class="toggle-switch">
+                        <input type="checkbox" id="chatEnabled">
+                        <span class="slider"></span>
+                    </label>
+                </div>
+                <div class="settings-row" data-chat-setting>
+                    <label for="chatNotifications" title="Shows a system notification for new room-chat messages when the video tab is not focused." data-i18n="LABEL_CHAT_NOTIFICATIONS" data-i18n-title="LABEL_CHAT_NOTIFICATIONS_TOOLTIP">Chat Notifications</label>
+                    <label class="toggle-switch">
+                        <input type="checkbox" id="chatNotifications">
+                        <span class="slider"></span>
+                    </label>
+                </div>
+                <div class="settings-row" data-chat-setting>
+                    <label for="chatPosition" title="Choose where chat is attached to the selected player." data-i18n="LABEL_CHAT_POSITION" data-i18n-title="LABEL_CHAT_POSITION_TOOLTIP">Position</label>
+                    <span class="settings-select">
+                        <select id="chatPosition" class="settings-control">
+                            <option value="right" data-i18n="CHAT_DOCK_RIGHT">Dock chat right</option>
+                            <option value="left" data-i18n="CHAT_DOCK_LEFT">Dock chat left</option>
+                            <option value="detached" data-i18n="CHAT_DETACHED">Detach chat</option>
+                        </select>
+                    </span>
+                </div>
+                <div class="settings-row" data-chat-setting>
+                    <label for="chatSize" title="Choose the default size of the chat overlay." data-i18n="LABEL_CHAT_SIZE" data-i18n-title="LABEL_CHAT_SIZE_TOOLTIP">Overlay size</label>
+                    <span class="settings-select">
+                        <select id="chatSize" class="settings-control">
+                            <option value="compact" data-i18n="OPTION_CHAT_SIZE_COMPACT">Compact</option>
+                            <option value="standard" data-i18n="OPTION_CHAT_SIZE_STANDARD">Standard</option>
+                            <option value="large" data-i18n="OPTION_CHAT_SIZE_LARGE">Large</option>
+                            <option value="custom" data-i18n="OPTION_CHAT_SIZE_CUSTOM">Last custom size</option>
+                        </select>
+                    </span>
+                </div>
+                <div class="settings-row" data-chat-setting>
+                    <label for="chatStartMode" title="Choose whether chat starts as a floating bubble or an open overlay." data-i18n="LABEL_CHAT_START_MODE" data-i18n-title="LABEL_CHAT_START_MODE_TOOLTIP">Start as</label>
+                    <span class="settings-select">
+                        <select id="chatStartMode" class="settings-control">
+                            <option value="bubble" data-i18n="OPTION_CHAT_START_BUBBLE">Floating bubble</option>
+                            <option value="open" data-i18n="OPTION_CHAT_START_OPEN">Open overlay</option>
+                        </select>
+                    </span>
+                </div>
+                <div class="settings-row" data-chat-setting>
+                    <label for="chatReactionDisplay" title="Choose whether quick reactions stay in chat or also fall over the video." data-i18n="LABEL_CHAT_REACTION_DISPLAY" data-i18n-title="LABEL_CHAT_REACTION_DISPLAY_TOOLTIP">Quick reactions</label>
+                    <span class="settings-select">
+                        <select id="chatReactionDisplay" class="settings-control">
+                            <option value="chat" data-i18n="OPTION_CHAT_REACTIONS_CHAT">Chat only</option>
+                            <option value="video" data-i18n="OPTION_CHAT_REACTIONS_VIDEO">Chat and video</option>
+                        </select>
+                    </span>
+                </div>
+            </div>
+        </details>
+
         <details class="form-group" name="settings-accordion">
             <summary title="Customize playback, notifications, and audio preferences." data-i18n="LABEL_SETTINGS_GROUP_SYNC" data-i18n-title="LABEL_SETTINGS_GROUP_SYNC_TOOLTIP">Playback &amp; Sync</summary>
             <div class="details-content">
@@ -1618,7 +1706,7 @@
                     </label>
                 </div>
                 <div class="settings-row">
-                    <label for="browserNotifications" title="Shows native system notifications when someone joins/leaves or plays/pauses." data-i18n="LABEL_NOTIFICATIONS" data-i18n-title="LABEL_NOTIFICATIONS_TOOLTIP">Browser Notifications</label>
+                    <label for="browserNotifications" title="Shows system notifications when someone joins, leaves, plays, or pauses." data-i18n="LABEL_EVENT_NOTIFICATIONS" data-i18n-title="LABEL_EVENT_NOTIFICATIONS_TOOLTIP">Playback &amp; Room Notifications</label>
                     <label class="toggle-switch">
                         <input type="checkbox" id="browserNotifications">
                         <span class="slider"></span>
@@ -1660,7 +1748,7 @@
 
         <label title="Technical details about the currently selected video element" data-i18n="LABEL_VIDEO_DEBUG" data-i18n-title="LABEL_VIDEO_DEBUG_TOOLTIP">Video Debug Info</label>
         <div id="videoDebug" class="info-card" style="font-size: 10px; font-family: monospace; color: var(--text-muted); max-height: 250px; overflow-y: auto; line-height: 1.4;">
-            No tab selected or video detected.
+            <span data-i18n="VIDEO_DEBUG_EMPTY">No tab selected or video detected.</span>
         </div>
 
         <div style="display:flex; justify-content:space-between; align-items:center; margin-bottom: 8px;">

extension/popup.js

@@ -3,13 +3,26 @@ import { BLACKLIST_DOMAINS } from './shared/blacklist.js';
 import { getAvatarForName, generateUsername, USERNAME_ADJECTIVES, USERNAME_NOUNS } from './shared/names.js';
 import { loadLocale, translateDOM, getMessage, getSystemLanguage } from './i18n.js';
 import { TITLE_PRIVACY_MODES, normalizeSendTabTitle, normalizeTabTitle } from './title-privacy.js';
+import { normalizeRoomId } from './chat-session.js';
+import './shared/invite-links.js';
+import { normalizeTabId, requestOriginPermission } from './host-access.js';
 
+let pendingInviteRoomId = '';
+let pendingInviteChatKey = '';
+let pendingRoomCreation = false;
+
+function normalizeChatKey(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9_-]{21}[AQgw]$/.test(value) ? value : '';
+}
 
 const elements = {
     tabs: document.querySelectorAll('.tabs .tab-btn'),
     contents: document.querySelectorAll('.tab-content'),
     copyInvite: document.getElementById('copyInvite'),
     targetTab: document.getElementById('targetTab'),
+    siteAccessNotice: document.getElementById('siteAccessNotice'),
+    siteAccessMessage: document.getElementById('siteAccessMessage'),
+    siteAccessRetry: document.getElementById('siteAccessRetry'),
     forceSyncBtn: document.getElementById('forceSyncBtn'),
     forceSyncMode: document.getElementById('forceSyncMode'),
     peerList: document.getElementById('peerList'),
@@ -55,6 +68,12 @@ const elements = {
     playBtn: document.getElementById('playBtn'),
     pauseBtn: document.getElementById('pauseBtn'),
     autoSyncNextEpisode: document.getElementById('autoSyncNextEpisode'),
+    chatEnabled: document.getElementById('chatEnabled'),
+    chatNotifications: document.getElementById('chatNotifications'),
+    chatPosition: document.getElementById('chatPosition'),
+    chatSize: document.getElementById('chatSize'),
+    chatStartMode: document.getElementById('chatStartMode'),
+    chatReactionDisplay: document.getElementById('chatReactionDisplay'),
     sendTabTitle: document.getElementById('sendTabTitle'),
     mediaTitlePrivacyMode: document.getElementById('mediaTitlePrivacyMode'),
     episodeLobbyCard: document.getElementById('episodeLobbyCard'),
@@ -324,7 +343,7 @@ function setRoomRefreshCooldown() {
 async function init() {
     // Local-only by design — settings and room credentials never come from
     // storage.sync (only onboardingComplete + dismissedHints live there).
-    const localData = await chrome.storage.local.get(['serverUrl', 'useCustomServer', 'roomId', 'password', 'username', 'filterNoise', 'autoSyncNextEpisode', 'sendTabTitle', 'mediaTitlePrivacyMode', 'titlePrivacyMode', 'forceSyncMode', 'browserNotifications', 'autoCopyInvite', 'locale', 'audioSettings', 'activeTab', 'themeMode', 'themePalette']);
+    const localData = await chrome.storage.local.get(['serverUrl', 'useCustomServer', 'roomId', 'password', 'chatKey', 'chatEnabled', 'chatNotifications', 'chatPosition', 'chatSize', 'chatStartMode', 'chatReactionDisplay', 'username', 'filterNoise', 'autoSyncNextEpisode', 'sendTabTitle', 'mediaTitlePrivacyMode', 'titlePrivacyMode', 'forceSyncMode', 'browserNotifications', 'autoCopyInvite', 'locale', 'audioSettings', 'activeTab', 'themeMode', 'themePalette']);
 
     let activeLang = localData.locale;
     if (!activeLang) {
@@ -349,12 +368,19 @@ async function init() {
     }
     
     elements.serverUrl.value = localData.serverUrl || '';
-    elements.roomId.value = localData.roomId || '';
+    elements.roomId.value = normalizeRoomId(localData.roomId);
     elements.password.value = localData.password || '';
     elements.username.value = username;
     syncDevToolsVisibility();
     if (elements.filterNoise) elements.filterNoise.checked = localData.filterNoise !== false;
     if (elements.autoSyncNextEpisode) elements.autoSyncNextEpisode.checked = localData.autoSyncNextEpisode !== false;
+    if (elements.chatEnabled) elements.chatEnabled.checked = localData.chatEnabled === true;
+    if (elements.chatNotifications) elements.chatNotifications.checked = localData.chatNotifications !== false;
+    if (elements.chatPosition) elements.chatPosition.value = ['left', 'detached'].includes(localData.chatPosition) ? localData.chatPosition : 'right';
+    if (elements.chatSize) elements.chatSize.value = ['compact', 'large', 'custom'].includes(localData.chatSize) ? localData.chatSize : 'standard';
+    if (elements.chatStartMode) elements.chatStartMode.value = localData.chatStartMode === 'open' ? 'open' : 'bubble';
+    if (elements.chatReactionDisplay) elements.chatReactionDisplay.value = localData.chatReactionDisplay === 'video' ? 'video' : 'chat';
+    syncChatSettingsState();
     const legacyTitlePrivacyMode = Object.values(TITLE_PRIVACY_MODES).includes(localData.titlePrivacyMode) ? localData.titlePrivacyMode : TITLE_PRIVACY_MODES.FULL;
     const mediaTitlePrivacyMode = Object.values(TITLE_PRIVACY_MODES).includes(localData.mediaTitlePrivacyMode) ? localData.mediaTitlePrivacyMode : legacyTitlePrivacyMode;
     if (elements.sendTabTitle) elements.sendTabTitle.checked = normalizeSendTabTitle(localData.sendTabTitle, legacyTitlePrivacyMode);
@@ -380,14 +406,14 @@ async function init() {
     }
 
     toggleUIState(!!localData.roomId);
-    updateUI(localData.roomId, localData.password, localData.useCustomServer, localData.serverUrl);
+    updateUI(localData.roomId, localData.password, localData.useCustomServer, localData.serverUrl, localData.chatKey);
     refreshLogs();
     refreshHistory();
 
     // Initial Status Check (status shows via GET_STATUS below)
 
     // Initial Status Check
-    chrome.runtime.sendMessage({ type: 'GET_STATUS' }, async (res) => {
+    chrome.runtime.sendMessage({ type: 'GET_STATUS', retryPendingTarget: true }, async (res) => {
         if (chrome.runtime.lastError) {
             console.warn('[Popup] Background not responding:', chrome.runtime.lastError.message);
             await populateTabs();
@@ -410,13 +436,24 @@ async function init() {
                 applyConnectionStatus('connecting');
             }
             
-            // Populate Tabs using the background's targetTabId
-            await populateTabs(res.peers, res.targetTabId);
+            if (res.pendingTargetTabId) {
+                showSiteAccessNotice(
+                    res.pendingTargetHost,
+                    res.pendingTargetOriginPattern,
+                    res.pendingTargetTabId
+                );
+            } else {
+                hideSiteAccessNotice();
+            }
+
+            // Keep a denied selection visible while Chrome waits for the user
+            // to grant access; it becomes active automatically after approval.
+            await populateTabs(res.peers, res.targetTabId || res.pendingTargetTabId);
 
             // Render lobby status if active
             if (res.episodeLobby) updateLobbyUI(res.episodeLobby, res.peers);
 
-            if (res.status === 'connected' && !res.targetTabId && localData.roomId) {
+            if (res.status === 'connected' && !res.targetTabId && !res.pendingTargetTabId && localData.roomId) {
                 const syncTabBtn = document.querySelector('.tab-btn[data-tab="tab-sync"]');
                 if (syncTabBtn) syncTabBtn.click();
                 showSelectVideoHint();
@@ -463,6 +500,10 @@ function toggleUIState(inRoom) {
 // --- Host Control Mode UI ---
 // True when we're a guest in a host-only room → remote-control buttons are locked.
 let hcmGuestLocked = false;
+let siteAccessBlocked = false;
+let siteAccessHost = null;
+let siteAccessOriginPattern = null;
+let siteAccessTabId = null;
 
 // Co-Host state mirrored for the peer-list renderer (promote/demote + role badges).
 let hcmAmOwner = false;
@@ -524,12 +565,15 @@ function updateHostControlUI(state) {
 }
 
 function setRemoteControlsLocked(locked) {
+    const effectiveLocked = locked || siteAccessBlocked;
     [elements.playBtn, elements.pauseBtn, elements.forceSyncBtn].forEach(btn => {
         if (!btn) return;
-        btn.disabled = locked;
-        btn.style.opacity = locked ? '0.5' : '';
-        btn.style.cursor = locked ? 'not-allowed' : '';
-        btn.title = locked ? (getMessage('NOTICE_HOST_CONTROLS') || 'The host controls playback for everyone.') : '';
+        btn.disabled = effectiveLocked;
+        btn.style.opacity = effectiveLocked ? '0.5' : '';
+        btn.style.cursor = effectiveLocked ? 'not-allowed' : '';
+        btn.title = siteAccessBlocked
+            ? (elements.siteAccessMessage?.textContent || getMessage('ERR_NO_VIDEO_TAB'))
+            : (locked ? (getMessage('NOTICE_HOST_CONTROLS') || 'The host controls playback for everyone.') : '');
     });
     // Always restore the default labels. The action handlers leave the text in a
     // transitional state ("Playing..." / "Pausing...") and the 2.5s safety reset
@@ -540,6 +584,88 @@ function setRemoteControlsLocked(locked) {
     if (elements.pauseBtn) elements.pauseBtn.textContent = getMessage('BTN_PAUSE') || 'Pause';
 }
 
+function showSiteAccessNotice(host, originPattern = null, tabId = null) {
+    siteAccessBlocked = true;
+    siteAccessHost = typeof host === 'string' && host.length > 0 ? host : 'website';
+    siteAccessOriginPattern = typeof originPattern === 'string' && originPattern.length > 0
+        ? originPattern
+        : null;
+    siteAccessTabId = normalizeTabId(tabId);
+    if (elements.siteAccessMessage) {
+        elements.siteAccessMessage.textContent = getMessage('SITE_ACCESS_REQUIRED', {
+            host: siteAccessHost
+        });
+    }
+    if (elements.siteAccessRetry) {
+        elements.siteAccessRetry.disabled = !siteAccessOriginPattern || siteAccessTabId === null;
+    }
+    if (elements.siteAccessNotice) elements.siteAccessNotice.style.display = 'block';
+    setRemoteControlsLocked(hcmGuestLocked);
+}
+
+function hideSiteAccessNotice() {
+    siteAccessBlocked = false;
+    siteAccessHost = null;
+    siteAccessOriginPattern = null;
+    siteAccessTabId = null;
+    if (elements.siteAccessRetry) elements.siteAccessRetry.disabled = false;
+    if (elements.siteAccessNotice) elements.siteAccessNotice.style.display = 'none';
+    setRemoteControlsLocked(hcmGuestLocked);
+}
+
+function handleTargetTabResponse(response) {
+    if (response?.status === 'host_permission_required') {
+        showSiteAccessNotice(response.host, response.originPattern, response.tabId);
+        return false;
+    }
+    if (response?.status === 'ok') {
+        hideSiteAccessNotice();
+        return true;
+    }
+    if (response?.status === 'superseded') return false;
+    showToast(response?.message || getMessage('ERR_NO_VIDEO_TAB'), 'error', 5000);
+    return false;
+}
+
+function selectTargetTab(tabId, tabTitle) {
+    return new Promise(resolve => {
+        chrome.runtime.sendMessage({ type: 'SET_TARGET_TAB', tabId, tabTitle }, response => {
+            if (chrome.runtime.lastError) {
+                showToast(chrome.runtime.lastError.message || getMessage('ERR_NO_VIDEO_TAB'), 'error', 5000);
+                resolve(false);
+                return;
+            }
+            resolve(handleTargetTabResponse(response));
+        });
+    });
+}
+
+async function refreshTargetAccessState() {
+    const status = await new Promise(resolve => {
+        chrome.runtime.sendMessage({ type: 'GET_STATUS' }, response => {
+            if (chrome.runtime.lastError) {
+                resolve(null);
+                return;
+            }
+            resolve(response || null);
+        });
+    });
+    if (!status) return;
+    if (status.pendingTargetTabId) {
+        showSiteAccessNotice(
+            status.pendingTargetHost,
+            status.pendingTargetOriginPattern,
+            status.pendingTargetTabId
+        );
+    } else {
+        hideSiteAccessNotice();
+    }
+    await populateTabs(
+        status.peers,
+        status.targetTabId ?? status.pendingTargetTabId ?? null
+    );
+}
+
 if (elements.hostControlToggle) {
     elements.hostControlToggle.addEventListener('change', () => {
         const mode = elements.hostControlToggle.checked ? 'host-only' : 'everyone';
@@ -552,15 +678,20 @@ if (elements.hostControlToggle) {
     });
 }
 
-function updateUI(roomId, password, useCustomServer = false, serverUrl = '') {
+function updateUI(roomId, password, useCustomServer = false, serverUrl = '', chatKey = '') {
     const inRoom = !!roomId;
     toggleUIState(inRoom);
     if (inRoom) {
-        let invite = `${OFFICIAL_LANDING_PAGE_URL}/join.html#join:${roomId}:${password}`;
-        if (useCustomServer) {
-            const encodedUrl = encodeURIComponent(serverUrl || '');
-            invite += `:1:${encodedUrl}`;
-        }
+        const validChatKey = normalizeChatKey(chatKey);
+        let invite = validChatKey
+            ? `${OFFICIAL_LANDING_PAGE_URL}/join.html${globalThis.KoalaSyncInviteLinks.buildJ2Hash({
+                roomId,
+                password,
+                chatKey: validChatKey,
+                serverUrl: useCustomServer ? serverUrl : ''
+            })}`
+            : `${OFFICIAL_LANDING_PAGE_URL}/join.html#join:${roomId}:${password}`;
+        if (!validChatKey && useCustomServer) invite += `:1:${encodeURIComponent(serverUrl || '')}`;
         elements.inviteLink.value = invite;
         
         if (window.justCreatedRoom) {
@@ -998,7 +1129,7 @@ async function populateTabs(providedPeers = null, providedTargetTabId = null) {
             if (populateTabsToken !== token) return;
             currentTargetTabId = null;
         } else {
-            currentTargetTabId = status?.targetTabId;
+            currentTargetTabId = status?.targetTabId || status?.pendingTargetTabId;
         }
     }
  
@@ -1118,7 +1249,7 @@ async function populateTabs(providedPeers = null, providedTargetTabId = null) {
         if (matchOpt && elements.targetTab.options.length > 1) {
             elements.targetTab.value = matchOpt.value;
             const tabTitle = matchOpt.dataset.originalTitle || null;
-            chrome.runtime.sendMessage({ type: 'SET_TARGET_TAB', tabId: parseInt(matchOpt.value), tabTitle });
+            selectTargetTab(parseInt(matchOpt.value), tabTitle);
         }
     }
 }
@@ -1289,41 +1420,21 @@ function updateRoomList(rooms) {
 function checkInviteLink() {
     chrome.tabs.query({ active: true, currentWindow: true }, (tabs) => {
         const tab = tabs[0];
-        if (tab && tab.url && tab.url.startsWith(OFFICIAL_LANDING_PAGE_URL + '/') && tab.url.includes('#join:')) {
+        if (tab && tab.url && tab.url.startsWith(OFFICIAL_LANDING_PAGE_URL + '/')) {
             try {
-                const rawHash = tab.url.split('#join:')[1];
-                if (!rawHash) return;
-                const parts = rawHash.split(':');
-                if (parts.length >= 2) {
-                    const roomId = parts.shift();
-                    let useCustomServer = false;
-                    let serverUrl = '';
+                const invite = globalThis.KoalaSyncInviteLinks.parseInviteHash(new URL(tab.url).hash);
+                if (!invite) return;
+                elements.roomId.value = normalizeRoomId(invite.roomId);
+                elements.password.value = invite.password;
+                pendingInviteRoomId = elements.roomId.value;
+                pendingInviteChatKey = normalizeChatKey(invite.chatKey);
 
-                    const last = parts[parts.length - 1];
-                    const secondToLast = parts[parts.length - 2];
-                    const decodedLast = decodeURIComponent(last || '');
-                    const isCustom = secondToLast === '1' && (decodedLast.startsWith('ws://') || decodedLast.startsWith('wss://'));
-                    const isOfficial = secondToLast === '0' && last === '';
+                elements.serverUrl.value = invite.serverUrl;
+                setServerMode(invite.useCustomServer);
+                chrome.storage.local.set({ serverUrl: invite.serverUrl, useCustomServer: invite.useCustomServer });
 
-                    if (parts.length >= 3 && (isCustom || isOfficial)) {
-                        serverUrl = decodeURIComponent(parts.pop());
-                        useCustomServer = parts.pop() === '1';
-                    }
-
-                    const password = parts.join(':');
-
-                    elements.roomId.value = roomId;
-                    elements.password.value = password;
-                    
-                    if (serverUrl || useCustomServer) {
-                        elements.serverUrl.value = serverUrl;
-                        setServerMode(useCustomServer);
-                        chrome.storage.local.set({ serverUrl, useCustomServer });
-                    }
-
-                    elements.joinBtn.style.boxShadow = '0 0 15px var(--accent)';
-                    setTimeout(() => elements.joinBtn.style.boxShadow = '', 2000);
-                }
+                elements.joinBtn.style.boxShadow = '0 0 15px var(--accent)';
+                setTimeout(() => elements.joinBtn.style.boxShadow = '', 2000);
             } catch (_e) {
                 // Malformed invite link, ignore
             }
@@ -1358,6 +1469,51 @@ elements.autoSyncNextEpisode.addEventListener('change', () => {
     chrome.storage.local.set({ autoSyncNextEpisode: elements.autoSyncNextEpisode.checked });
 });
 
+function syncChatSettingsState() {
+    const enabled = elements.chatEnabled?.checked === true;
+    for (const control of [elements.chatNotifications, elements.chatPosition, elements.chatSize, elements.chatStartMode, elements.chatReactionDisplay]) {
+        if (control) control.disabled = !enabled;
+    }
+    document.querySelectorAll('[data-chat-setting]').forEach(row => {
+        row.classList.toggle('is-disabled', !enabled);
+        row.setAttribute('aria-disabled', String(!enabled));
+    });
+}
+
+if (elements.chatEnabled) {
+    elements.chatEnabled.addEventListener('change', () => {
+        syncChatSettingsState();
+        chrome.storage.local.set({ chatEnabled: elements.chatEnabled.checked });
+    });
+}
+if (elements.chatNotifications) {
+    elements.chatNotifications.addEventListener('change', () => {
+        chrome.storage.local.set({ chatNotifications: elements.chatNotifications.checked });
+    });
+}
+if (elements.chatPosition) {
+    elements.chatPosition.addEventListener('change', () => {
+        const chatPosition = ['left', 'detached'].includes(elements.chatPosition.value) ? elements.chatPosition.value : 'right';
+        chrome.storage.local.set({ chatPosition });
+    });
+}
+if (elements.chatSize) {
+    elements.chatSize.addEventListener('change', () => {
+        const chatSize = ['compact', 'large', 'custom'].includes(elements.chatSize.value) ? elements.chatSize.value : 'standard';
+        chrome.storage.local.set({ chatSize });
+    });
+}
+if (elements.chatStartMode) {
+    elements.chatStartMode.addEventListener('change', () => {
+        chrome.storage.local.set({ chatStartMode: elements.chatStartMode.value === 'open' ? 'open' : 'bubble' });
+    });
+}
+if (elements.chatReactionDisplay) {
+    elements.chatReactionDisplay.addEventListener('change', () => {
+        chrome.storage.local.set({ chatReactionDisplay: elements.chatReactionDisplay.value === 'video' ? 'video' : 'chat' });
+    });
+}
+
 if (elements.sendTabTitle) {
     elements.sendTabTitle.addEventListener('change', () => {
         chrome.storage.local.set({ sendTabTitle: elements.sendTabTitle.checked }, () => {
@@ -1468,15 +1624,24 @@ if (elements.langSelector) {
                 lastKnownPeers = res.peers || [];
                 if (res.lastActionState) updateLastActionUI(res.lastActionState, res.peers);
                 
-                const data = await chrome.storage.local.get(['roomId', 'password', 'useCustomServer', 'serverUrl']);
-                updateUI(data.roomId, data.password, data.useCustomServer, data.serverUrl);
+                const data = await chrome.storage.local.get(['roomId', 'password', 'chatKey', 'useCustomServer', 'serverUrl']);
+                updateUI(data.roomId, data.password, data.useCustomServer, data.serverUrl, data.chatKey);
                 
-                await populateTabs(res.peers, res.targetTabId);
+                if (res.pendingTargetTabId) {
+                    showSiteAccessNotice(
+                        res.pendingTargetHost,
+                        res.pendingTargetOriginPattern,
+                        res.pendingTargetTabId
+                    );
+                } else {
+                    hideSiteAccessNotice();
+                }
+                await populateTabs(res.peers, res.targetTabId || res.pendingTargetTabId);
                 if (res.episodeLobby) updateLobbyUI(res.episodeLobby, res.peers);
             } else {
                 applyConnectionStatus('disconnected');
-                const data = await chrome.storage.local.get(['roomId', 'password', 'useCustomServer', 'serverUrl']);
-                updateUI(data.roomId, data.password, data.useCustomServer, data.serverUrl);
+                const data = await chrome.storage.local.get(['roomId', 'password', 'chatKey', 'useCustomServer', 'serverUrl']);
+                updateUI(data.roomId, data.password, data.useCustomServer, data.serverUrl, data.chatKey);
                 await populateTabs();
             }
         });
@@ -1604,7 +1769,12 @@ function showError(msg) {
 
 // --- Action Handlers ---
 elements.roomId.addEventListener('input', () => {
-    elements.roomId.value = elements.roomId.value.replace(/[^a-zA-Z0-9\-]/g, '');
+    elements.roomId.value = normalizeRoomId(elements.roomId.value);
+    pendingRoomCreation = false;
+    if (pendingInviteRoomId && elements.roomId.value !== pendingInviteRoomId) {
+        pendingInviteRoomId = '';
+        pendingInviteChatKey = '';
+    }
 });
 
 elements.joinBtn.addEventListener('click', async () => {
@@ -1615,8 +1785,8 @@ elements.joinBtn.addEventListener('click', async () => {
         isProcessingConnection = false;
         return;
     }
-    const roomIdInput = elements.roomId.value.trim();
-    const isCreating = !roomIdInput;
+    const roomIdInput = normalizeRoomId(elements.roomId.value);
+    const isCreating = pendingRoomCreation || !roomIdInput;
     
     elements.joinBtn.disabled = true;
     elements.joinBtn.textContent = isCreating ? getMessage('BTN_STATE_CREATING') : getMessage('BTN_STATE_JOINING');
@@ -1676,17 +1846,34 @@ elements.joinBtn.addEventListener('click', async () => {
         self.crypto.getRandomValues(array);
         password = Array.from(array, byte => chars[byte % chars.length]).join('');
         elements.password.value = password;
-        window.justCreatedRoom = true;
     }
+    let chatKey = roomId === pendingInviteRoomId ? pendingInviteChatKey : '';
+    if (isCreating) {
+        const created = await new Promise(resolve => chrome.runtime.sendMessage({ type: 'CREATE_CHAT_KEY' }, resolve));
+        chatKey = normalizeChatKey(created?.chatKey);
+        if (!chatKey) {
+            pendingRoomCreation = false;
+            elements.joinBtn.disabled = false;
+            elements.joinBtn.textContent = getMessage('BTN_JOIN_ROOM');
+            if (joinBtnTimeout) { clearTimeout(joinBtnTimeout); joinBtnTimeout = null; }
+            isProcessingConnection = false;
+            showError(getMessage('CHAT_SEND_FAILED'));
+            return;
+        }
+    }
+    if (isCreating) window.justCreatedRoom = true;
+    pendingInviteRoomId = '';
+    pendingInviteChatKey = '';
+    pendingRoomCreation = false;
 
-    await chrome.storage.local.set({ serverUrl, roomId, password, useCustomServer: useCustom });
+    await chrome.storage.local.set({ serverUrl, roomId, password, chatKey, useCustomServer: useCustom });
     elements.roomId.value = roomId;
 
     // Tell background to connect
     chrome.runtime.sendMessage({ type: 'CONNECT' });
     
     // UI Feedback: Immediately switch state for better responsiveness
-    updateUI(roomId, password, useCustom, serverUrl);
+    updateUI(roomId, password, useCustom, serverUrl, chatKey);
 });
 
 elements.leaveBtn.addEventListener('click', async () => {
@@ -1694,7 +1881,7 @@ elements.leaveBtn.addEventListener('click', async () => {
     isProcessingConnection = true;
     clearConnectionErrorTimer();
     chrome.runtime.sendMessage({ type: 'LEAVE_ROOM' });
-    await chrome.storage.local.set({ roomId: '', password: '' });
+    await chrome.storage.local.set({ roomId: '', password: '', chatKey: '' });
     elements.roomId.value = '';
     elements.password.value = '';
     lastKnownPeers = [];
@@ -1720,6 +1907,7 @@ function handleCreateRoom() {
     const password = secureGenerateId();
     elements.roomId.value = roomId;
     elements.password.value = password;
+    pendingRoomCreation = true;
     window.justCreatedRoom = true;
     
     // Auto-connect
@@ -1749,18 +1937,48 @@ elements.retryBtn.addEventListener('click', () => {
     chrome.runtime.sendMessage({ type: 'RETRY_CONNECT' });
 });
 
-elements.targetTab.addEventListener('change', () => {
+elements.targetTab.addEventListener('change', async () => {
     const hint = document.getElementById('targetTabHint');
     if (hint) hint.style.display = 'none';
 
     const val = elements.targetTab.value;
     const tabId = val ? parseInt(val) : null;
     const tabTitle = elements.targetTab.options[elements.targetTab.selectedIndex]?.dataset.originalTitle || null;
-    chrome.runtime.sendMessage({ type: 'SET_TARGET_TAB', tabId, tabTitle });
+    await selectTargetTab(tabId, tabTitle);
 });
 
+if (elements.siteAccessRetry) {
+    elements.siteAccessRetry.addEventListener('click', async () => {
+        const tabId = normalizeTabId(elements.targetTab.value);
+        const tabTitle = elements.targetTab.options[elements.targetTab.selectedIndex]?.dataset.originalTitle || null;
+        if (tabId === null || siteAccessTabId !== tabId || !siteAccessOriginPattern) {
+            showToast(getMessage('ERR_SELECT_VIDEO'), 'warning');
+            return;
+        }
+        const requestedOriginPattern = siteAccessOriginPattern;
+        const requestedTabId = siteAccessTabId;
+        elements.siteAccessRetry.disabled = true;
+        elements.targetTab.disabled = true;
+        try {
+            const granted = await requestOriginPermission(chrome, requestedOriginPattern);
+            if (granted !== true) return;
+            const selectedTabId = normalizeTabId(elements.targetTab.value);
+            // permissions.onAdded may already have completed activation, or a
+            // newer selection may have replaced this request while it was open.
+            if (!siteAccessBlocked || selectedTabId !== tabId
+                || siteAccessTabId !== requestedTabId
+                || siteAccessOriginPattern !== requestedOriginPattern) return;
+            await selectTargetTab(tabId, tabTitle);
+        } finally {
+            elements.siteAccessRetry.disabled = siteAccessBlocked
+                && (!siteAccessOriginPattern || siteAccessTabId === null);
+            elements.targetTab.disabled = false;
+        }
+    });
+}
+
 elements.forceSyncBtn.addEventListener('click', async () => {
-    if (hcmGuestLocked) return; // guest in host-only room — backstop (M-2/L-3)
+    if (hcmGuestLocked || siteAccessBlocked) return; // host/site-access backstop
     if (elements.forceSyncBtn.disabled) return;
     
     const originalText = elements.forceSyncBtn.textContent;
@@ -1771,6 +1989,11 @@ elements.forceSyncBtn.addEventListener('click', async () => {
         elements.forceSyncBtn.disabled = false;
         return;
     }
+    const tabId = normalizeTabId(status.targetTabId);
+    if (tabId === null) {
+        elements.forceSyncBtn.disabled = false;
+        return;
+    }
 
     const mode = elements.forceSyncMode.value;
     let targetTime = null;
@@ -1806,23 +2029,33 @@ elements.forceSyncBtn.addEventListener('click', async () => {
         // Don't unlock a button that's locked because we became a guest mid-flight —
         // hcmGuestLocked is the source of truth for the lock state, and the next
         // CONTROL_MODE update restores the correct label.
-        if (!forceSyncDone && !hcmGuestLocked) {
+        if (!forceSyncDone && !hcmGuestLocked && !siteAccessBlocked) {
             elements.forceSyncBtn.disabled = false;
             elements.forceSyncBtn.textContent = originalText;
         }
     };
     forceSyncResetTimer = setTimeout(forceSyncReset, syncTimeoutMs);
-    const tabId = parseInt(status.targetTabId);
 
     const failForceSyncTime = () => {
+        if (forceSyncDone) return;
         if (forceSyncResetTimer) { clearTimeout(forceSyncResetTimer); forceSyncResetTimer = null; }
         showError(getMessage('ERR_NO_VIDEO_TAB'));
         forceSyncDone = true;
-        elements.forceSyncBtn.disabled = false;
+        if (!hcmGuestLocked && !siteAccessBlocked) elements.forceSyncBtn.disabled = false;
         elements.forceSyncBtn.textContent = originalText;
     };
 
-    const sendForceSync = (time) => {
+    const targetIsStillCurrent = () => new Promise(resolve => {
+        chrome.runtime.sendMessage({ type: 'GET_STATUS' }, currentStatus => {
+            if (chrome.runtime.lastError) {
+                resolve(false);
+                return;
+            }
+            resolve(normalizeTabId(currentStatus?.targetTabId) === tabId);
+        });
+    });
+
+    const sendForceSync = async (time) => {
         if (time === null || time === undefined) {
             failForceSyncTime();
             return;
@@ -1832,15 +2065,28 @@ elements.forceSyncBtn.addEventListener('click', async () => {
             failForceSyncTime();
             return;
         }
+        if (!(await targetIsStillCurrent())) {
+            failForceSyncTime();
+            return;
+        }
         chrome.runtime.sendMessage({
             type: 'CONTENT_EVENT',
             action: EVENTS.FORCE_SYNC_PREPARE,
+            expectedTabId: tabId,
             payload: { targetTime: target }
+        }, response => {
+            if (chrome.runtime.lastError || response?.status === 'stale_target') {
+                failForceSyncTime();
+            }
         });
     };
 
     if (mode === 'jump-to-me') {
-        const retryQueryTime = () => {
+        const retryQueryTime = async () => {
+            if (!(await targetIsStillCurrent())) {
+                failForceSyncTime();
+                return;
+            }
             chrome.tabs.sendMessage(tabId, { action: 'get_current_time' }, (retryResponse) => {
                 if (chrome.runtime.lastError || !retryResponse || !Number.isFinite(retryResponse.currentTime)) {
                     failForceSyncTime();
@@ -1855,8 +2101,19 @@ elements.forceSyncBtn.addEventListener('click', async () => {
                 return;
             }
             if (chrome.runtime.lastError || !response) {
-                chrome.runtime.sendMessage({ type: 'INJECT_CONTENT_SCRIPT', tabId }, (injectResponse) => {
+                chrome.runtime.sendMessage({
+                    type: 'INJECT_CONTENT_SCRIPT',
+                    tabId,
+                    expectedCurrentTabId: tabId
+                }, (injectResponse) => {
                     if (chrome.runtime.lastError || !injectResponse || injectResponse.status !== 'ok') {
+                        if (injectResponse?.status === 'host_permission_required') {
+                            showSiteAccessNotice(
+                                injectResponse.host,
+                                injectResponse.originPattern,
+                                injectResponse.tabId
+                            );
+                        }
                         failForceSyncTime();
                         return;
                     }
@@ -1872,7 +2129,7 @@ elements.forceSyncBtn.addEventListener('click', async () => {
 });
 
 elements.playBtn.addEventListener('click', () => {
-    if (hcmGuestLocked) return; // guest in host-only room — backstop
+    if (hcmGuestLocked || siteAccessBlocked) return; // host/site-access backstop
     if (!elements.targetTab.value) {
         showToast(getMessage('ERR_SELECT_VIDEO'), 'warning');
         return;
@@ -1886,12 +2143,12 @@ elements.playBtn.addEventListener('click', () => {
     }, (response) => {
         if (response && response.status === 'ok_solo') {
             elements.playBtn.textContent = getMessage('BTN_PLAY');
-            elements.playBtn.disabled = false;
+            if (!hcmGuestLocked && !siteAccessBlocked) elements.playBtn.disabled = false;
         }
     });
     // Safety reset: restore button after 2.5s in case no peers respond
     setTimeout(() => {
-        if (elements.playBtn.disabled && !hcmGuestLocked) {
+        if (elements.playBtn.disabled && !hcmGuestLocked && !siteAccessBlocked) {
             elements.playBtn.textContent = getMessage('BTN_PLAY');
             elements.playBtn.disabled = false;
         }
@@ -1899,7 +2156,7 @@ elements.playBtn.addEventListener('click', () => {
 });
 
 elements.pauseBtn.addEventListener('click', () => {
-    if (hcmGuestLocked) return; // guest in host-only room — backstop
+    if (hcmGuestLocked || siteAccessBlocked) return; // host/site-access backstop
     if (!elements.targetTab.value) {
         showToast(getMessage('ERR_SELECT_VIDEO'), 'warning');
         return;
@@ -1913,12 +2170,12 @@ elements.pauseBtn.addEventListener('click', () => {
     }, (response) => {
         if (response && response.status === 'ok_solo') {
             elements.pauseBtn.textContent = getMessage('BTN_PAUSE');
-            elements.pauseBtn.disabled = false;
+            if (!hcmGuestLocked && !siteAccessBlocked) elements.pauseBtn.disabled = false;
         }
     });
     // Safety reset: restore button after 2.5s in case no peers respond
     setTimeout(() => {
-        if (elements.pauseBtn.disabled && !hcmGuestLocked) {
+        if (elements.pauseBtn.disabled && !hcmGuestLocked && !siteAccessBlocked) {
             elements.pauseBtn.textContent = getMessage('BTN_PAUSE');
             elements.pauseBtn.disabled = false;
         }
@@ -2083,7 +2340,7 @@ chrome.runtime.onMessage.addListener((msg) => {
                     if (state.acks && state.acks.length >= peerCount) {
                         btn.textContent = getMessage('BTN_STATE_SYNCED');
                         setTimeout(() => {
-                            btn.disabled = false;
+                            if (!hcmGuestLocked && !siteAccessBlocked) btn.disabled = false;
                             btn.textContent = state.action === 'play' ? getMessage('BTN_PLAY') : getMessage('BTN_PAUSE');
                         }, 2000);
                     }
@@ -2098,7 +2355,7 @@ chrome.runtime.onMessage.addListener((msg) => {
                 forceSyncResetTimer = null;
             }
             if (elements.forceSyncBtn) {
-                elements.forceSyncBtn.disabled = false;
+                if (!hcmGuestLocked && !siteAccessBlocked) elements.forceSyncBtn.disabled = false;
                 elements.forceSyncBtn.textContent = getMessage('BTN_STATE_SYNCED');
                 setTimeout(() => {
                     elements.forceSyncBtn.textContent = getMessage('BTN_SYNC');
@@ -2145,11 +2402,17 @@ chrome.runtime.onMessage.addListener((msg) => {
                 applyConnectionStatus(msg.status);
                 if (res && res.reconnectAttempts !== undefined) {
                     if (elements.connText) {
-                        elements.connText.textContent = `Reconnecting... (${res.reconnectAttempts})`;
+                        elements.connText.textContent = `${getMessage('STATUS_RECONNECTING')} (${res.reconnectAttempts})`;
                     }
                 }
             });
         }
+    } else if (msg.type === 'TARGET_TAB_READY') {
+        refreshTargetAccessState().catch(() => {});
+    } else if (msg.type === 'TARGET_TAB_ACCESS_REQUIRED') {
+        refreshTargetAccessState().catch(() => {});
+    } else if (msg.type === 'TARGET_TAB_CLEARED') {
+        refreshTargetAccessState().catch(() => {});
     } else if (msg.type === 'PING_UPDATE') {
         updatePingDisplay(msg.ping);
     } else if (msg.type === 'HISTORY_UPDATE') {
@@ -2167,15 +2430,15 @@ chrome.runtime.onMessage.addListener((msg) => {
 
         if (msg.success) {
             // Final confirmation of join from background
-            chrome.storage.local.get(['roomId', 'password', 'useCustomServer', 'serverUrl'], (data) => {
-                updateUI(data.roomId, data.password, data.useCustomServer, data.serverUrl);
+            chrome.storage.local.get(['roomId', 'password', 'chatKey', 'useCustomServer', 'serverUrl'], (data) => {
+                updateUI(data.roomId, data.password, data.useCustomServer, data.serverUrl, data.chatKey);
                 const syncTabBtn = document.querySelector('.tab-btn[data-tab="tab-sync"]');
                 if (syncTabBtn) syncTabBtn.click();
                 showSelectVideoHint();
             });
         } else {
             // Join failed: reset UI state
-            chrome.storage.local.set({ roomId: '', password: '' });
+            chrome.storage.local.set({ roomId: '', password: '', chatKey: '' });
             elements.roomId.value = '';
             elements.password.value = '';
             updateUI(null, null);
@@ -2461,35 +2724,35 @@ function refreshDebugInfo() {
 
                 if (!state.found) {
                     // No video found — show diagnostic info
-                    addSection('Video Detection');
+                    addSection(getMessage('DEBUG_SECTION_VIDEO_DETECTION'));
                     const notFound = document.createElement('div');
                     notFound.style.cssText = 'color: var(--status-error-text); font-weight: 700; margin-bottom: 8px;';
-                    notFound.textContent = 'NO VIDEO ELEMENT FOUND';
+                    notFound.textContent = getMessage('DEBUG_VIDEO_NOT_FOUND');
                     elements.videoDebug.appendChild(notFound);
 
                     addField('Platform', state.platform || '?', 'var(--accent)');
                     addField('Page Title', state.pageTitle || '?');
                     addField('URL', state.url || '?');
                     addField('Video Tags', String(state.videoCount || 0));
-                    addField('Shadow DOM', state.inShadowDom ? 'YES (checked)' : 'NO');
+                    addField('Shadow DOM', state.inShadowDom ? getMessage('DEBUG_YES_CHECKED') : getMessage('DEBUG_NO'));
 
                     if (state.metadata) {
-                        addSection('Media Session API');
-                        addField('Title', state.metadata.title || 'n/a');
-                        addField('Artist', state.metadata.artist || 'n/a');
-                        addField('Album', state.metadata.album || 'n/a');
+                        addSection(getMessage('DEBUG_SECTION_MEDIA_SESSION'));
+                        addField('Title', state.metadata.title || getMessage('DEBUG_NA'));
+                        addField('Artist', state.metadata.artist || getMessage('DEBUG_NA'));
+                        addField('Album', state.metadata.album || getMessage('DEBUG_NA'));
                     }
 
                     const hint = document.createElement('div');
                     hint.style.cssText = 'margin-top: 12px; padding: 8px; background: color-mix(in oklch, var(--warning), transparent 88%); border-left: 3px solid var(--warning); border-radius: 4px; font-size: 10px; color: var(--text);';
-                    hint.textContent = 'Is a video currently playing? The extension only detects <video> elements. Ensure media is actively loaded on the page.';
+                    hint.textContent = getMessage('DEBUG_VIDEO_HINT');
                     elements.videoDebug.appendChild(hint);
                     return;
                 }
 
                 // Video found — full debug
-                addSection('Playback');
-                addField('State', state.paused ? 'PAUSED' : 'PLAYING', state.paused ? 'var(--text-muted)' : 'var(--status-success-text)');
+                addSection(getMessage('DEBUG_SECTION_PLAYBACK'));
+                addField('State', state.paused ? getMessage('DEBUG_STATE_PAUSED') : getMessage('DEBUG_STATE_PLAYING'), state.paused ? 'var(--text-muted)' : 'var(--status-success-text)');
                 addField('Time', `${state.currentTime.toFixed(2)}s / ${(state.duration || 0).toFixed(2)}s`);
                 addField('ReadyState', `${state.readyState} (${state.readyStateLabel || '?'})`,
                     state.readyState >= 3 ? 'var(--status-success-text)' : 'var(--status-warning-text)');
@@ -2508,7 +2771,7 @@ function refreshDebugInfo() {
                     const buttons = Array.isArray(quirk.seekButtons) ? quirk.seekButtons.slice(0, 4).join(' | ') : '';
                     if (buttons) addField(`${label} Buttons`, buttons);
                 }
-                addSection('Properties');
+                addSection(getMessage('DEBUG_SECTION_PROPERTIES'));
                 addField('Seeking', String(state.seeking));
                 addField('Ended', String(state.ended));
                 addField('Loop', String(state.loop));
@@ -2516,45 +2779,45 @@ function refreshDebugInfo() {
                 addField('Volume', String(state.volume));
                 addField('Speed', `${state.playbackRate}x`);
 
-                addSection('Dimensions');
+                addSection(getMessage('DEBUG_SECTION_DIMENSIONS'));
                 const dimsOk = state.videoWidth > 0 && state.videoHeight > 0;
                 addField('Resolution', `${state.videoWidth}x${state.videoHeight}`, dimsOk ? 'var(--status-success-text)' : 'var(--status-error-text)');
                 if (!dimsOk) {
                     const dimHint = document.createElement('div');
                     dimHint.style.cssText = 'color: var(--status-warning-text); font-size: 10px; margin: 2px 0 6px 12px;';
-                    dimHint.textContent = '0x0 = video element hidden or not yet loaded';
+                    dimHint.textContent = getMessage('DEBUG_DIMENSIONS_HINT');
                     elements.videoDebug.appendChild(dimHint);
                 }
 
                 if (state.error) {
-                    addSection('Media Error');
+                    addSection(getMessage('DEBUG_SECTION_MEDIA_ERROR'));
                     addField('Code', String(state.error.code), 'var(--status-error-text)');
                     addField('Message', state.error.message || '?', 'var(--status-error-text)');
                 }
 
-                addSection('Detection');
+                addSection(getMessage('DEBUG_SECTION_DETECTION'));
                 addField('Platform', state.platform || '?', 'var(--accent)');
                 addField('Video Count', String(state.videoCount || 0));
-                addField('Shadow DOM', state.inShadowDom ? 'YES' : 'NO');
+                addField('Shadow DOM', state.inShadowDom ? getMessage('DEBUG_YES') : getMessage('DEBUG_NO'));
 
-                addSection('Identification');
+                addSection(getMessage('DEBUG_SECTION_IDENTIFICATION'));
                 addField('URL', state.url);
                 addField('ID', state.id);
                 addField('CLASS', state.className);
 
-                addSection('Media Source');
+                addSection(getMessage('DEBUG_SECTION_MEDIA_SOURCE'));
                 addField('CurrentSrc', state.currentSrc);
                 addField('Src', state.src);
 
                 if (state.metadata) {
-                    addSection('Media Session API');
-                    addField('Title', state.metadata.title || 'n/a');
-                    addField('Artist', state.metadata.artist || 'n/a');
-                    addField('Album', state.metadata.album || 'n/a');
+                    addSection(getMessage('DEBUG_SECTION_MEDIA_SESSION'));
+                    addField('Title', state.metadata.title || getMessage('DEBUG_NA'));
+                    addField('Artist', state.metadata.artist || getMessage('DEBUG_NA'));
+                    addField('Album', state.metadata.album || getMessage('DEBUG_NA'));
                 }
 
                 if (state.dataAttributes && Object.keys(state.dataAttributes).length > 0) {
-                    addSection('Data Attributes');
+                    addSection(getMessage('DEBUG_SECTION_DATA_ATTRIBUTES'));
                     for (const [key, val] of Object.entries(state.dataAttributes)) {
                         addField(key.replace('data-', '').toUpperCase(), val);
                     }

extension/target-tab-lifecycle.test.mjs

@@ -0,0 +1,70 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+
+const extensionDir = path.dirname(fileURLToPath(import.meta.url));
+const backgroundSource = fs.readFileSync(path.join(extensionDir, 'background.js'), 'utf8');
+const contentSource = fs.readFileSync(path.join(extensionDir, 'content.js'), 'utf8');
+const overlaySource = fs.readFileSync(path.join(extensionDir, 'chat-overlay.js'), 'utf8');
+
+describe('target tab lifecycle', () => {
+    it('injects playback and chat scripts only into the explicitly selected tab', () => {
+        expect(backgroundSource).not.toContain('chrome.tabs.onActivated');
+        expect(backgroundSource).not.toContain('chrome.tabs.query({})');
+        expect(backgroundSource).toContain("target: { tabId }");
+        expect(backgroundSource).toContain("files: ['chat-format.js', 'chat-overlay.js', 'content.js']");
+        expect(backgroundSource).toContain("chrome.tabs.query({ url: 'https://sync.koalastuff.net/*' })");
+
+        const activationStart = backgroundSource.indexOf('async function activateTargetTab');
+        const activationEnd = backgroundSource.indexOf('async function reactivateCurrentTarget', activationStart);
+        const activationSource = backgroundSource.slice(activationStart, activationEnd);
+        expect(activationSource.indexOf('await deactivateTargetTab(previousTabId)'))
+            .toBeLessThan(activationSource.indexOf('await injectContentScript(selectedTabId'));
+        expect(activationSource).toContain('previousTabId !== selectedTabId');
+        expect(contentSource).toContain('if (window.koalaSyncInjected && chrome.runtime.id)');
+        expect(overlaySource).toContain('if (window.koalaSyncChatOverlay?.refresh)');
+    });
+
+    it('fully deactivates old and superseded target injections', () => {
+        expect(backgroundSource).toContain("chrome.tabs.sendMessage(normalizedTabId, { type: 'TARGET_DEACTIVATE' })");
+        expect(backgroundSource.match(/await deactivateTargetTab\(selectedTabId\)/g)?.length).toBeGreaterThanOrEqual(4);
+        expect(contentSource).toContain("if (message.type === 'TARGET_DEACTIVATE')");
+        expect(overlaySource).toContain("message?.type === 'TARGET_DEACTIVATE'");
+    });
+
+    it('tears down every persistent content-script resource', () => {
+        expect(contentSource).toContain('function destroyContentScript()');
+        expect(contentSource).toContain('observer.disconnect()');
+        expect(contentSource).toContain('keepAlivePort.disconnect()');
+        expect(contentSource).toContain('for (const video of attachedVideos)');
+        expect(contentSource).toContain("document.removeEventListener('visibilitychange', handleVisibilityChange)");
+        expect(contentSource).toContain("window.removeEventListener('pagehide', handlePageHide)");
+        expect(contentSource).toContain("window.removeEventListener('pageshow', handlePageShow)");
+        expect(contentSource).toContain('chrome.storage.onChanged.removeListener(handleStorageChanged)');
+        expect(contentSource).toContain('chrome.runtime.onMessage.removeListener(handleRuntimeMessage)');
+        expect(contentSource).toContain('window.koalaSyncInjected = false');
+    });
+
+    it('stops the MAIN-world seek bridge when its target is deactivated', () => {
+        expect(backgroundSource).toContain('const timelineInterval = setInterval');
+        expect(backgroundSource).toContain('clearInterval(timelineInterval)');
+        expect(backgroundSource).toContain("window.removeEventListener('message', handleBridgeMessage)");
+        expect(contentSource).toContain("kind: 'destroy'");
+    });
+
+    it('self-cleans instead of throwing when an extension reload invalidates the context', () => {
+        expect(contentSource).toContain('if (!chrome.runtime?.id)');
+        expect(contentSource).toContain('destroyContentScript()');
+        expect(contentSource).toContain('return chrome.runtime.sendMessage(message, callback) || Promise.resolve(undefined)');
+        expect(contentSource).toContain('function handleVisibilityChange()');
+    });
+
+    it('suspends background work for bfcache and restores it without duplicate injection', () => {
+        expect(contentSource).toContain('pageSuspended = true');
+        expect(contentSource).toContain('if (destroyed || pageSuspended) return');
+        expect(contentSource).toContain('if (!destroyed && !pageSuspended) scheduleLifecycleTimeout(connectKeepAlivePort, 1000)');
+        expect(contentSource).toMatch(/function handlePageShow\(event\)[\s\S]*if \(!event\.persisted\) return;[\s\S]*pageSuspended = false/);
+        expect(contentSource).toMatch(/function handlePageShow\(event\)[\s\S]*observer\.observe\(document\.documentElement[\s\S]*setupListeners\(\)[\s\S]*connectKeepAlivePort\(\)/);
+    });
+});

package.json

@@ -1,9 +1,12 @@
 {
   "name": "koalasync",
-  "version": "2.6.0",
+  "version": "3.0.1",
   "description": "KoalaSync Build Scripts",
   "private": true,
   "type": "module",
+  "engines": {
+    "node": ">=20.9.0"
+  },
   "scripts": {
     "build:extension": "node scripts/build-extension.cjs",
     "indexnow": "node website/submit-indexnow.cjs",
@@ -15,17 +18,22 @@
     "verify": "node scripts/verify-release.mjs"
   },
   "devDependencies": {
-    "@playwright/test": "^1.61.1",
-    "@vitest/coverage-v8": "^4.1.9",
+    "@playwright/test": "^1.62.0",
+    "@vitest/coverage-v8": "^4.1.10",
     "addons-linter": "^10.9.0",
-    "archiver": "^7.0.1",
+    "archiver": "^8.0.0",
     "esbuild": "^0.28.1",
-    "eslint": "^10.4.0",
+    "eslint": "^10.8.0",
     "eslint-plugin-no-unsanitized": "^4.1.5",
-    "fs-extra": "^11.2.0",
+    "fs-extra": "^11.4.0",
     "htmlnano": "^3.4.0",
-    "sharp": "^0.34.5",
-    "svgo": "^4.0.1",
-    "vitest": "^4.1.9"
+    "sharp": "^0.35.3",
+    "svgo": "^4.0.2",
+    "vitest": "^4.1.10"
+  },
+  "overrides": {
+    "brace-expansion": "5.0.8",
+    "fast-uri": "3.1.4",
+    "postcss": "8.5.18"
   }
 }

scripts/build-extension.cjs

@@ -1,11 +1,63 @@
 const fs = require('fs');
 const path = require('path');
-const archiver = require('archiver');
 
 const rootDir = path.join(__dirname, '..');
 const extDir = path.join(rootDir, 'extension');
 const distDir = path.join(rootDir, 'dist');
 const baseManifestPath = path.join(extDir, 'manifest.base.json');
+const localesDir = path.join(extDir, '_locales');
+const requiredAppName = 'Watch Party - KoalaSync';
+const maxAppNameLength = 75;
+const maxAppDescLength = 132;
+
+function countUnicodeCharacters(value) {
+  return Array.from(value).length;
+}
+
+function validateExtensionMetadata() {
+  const localeDirectories = fs.readdirSync(localesDir, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => entry.name)
+    .sort();
+
+  for (const locale of localeDirectories) {
+    const messagesPath = path.join(localesDir, locale, 'messages.json');
+    let messages;
+
+    try {
+      messages = JSON.parse(fs.readFileSync(messagesPath, 'utf8'));
+    } catch (error) {
+      throw new Error(`CRITICAL: Invalid locale JSON at _locales/${locale}/messages.json: ${error.message}`);
+    }
+
+    if (!messages || typeof messages !== 'object' || Array.isArray(messages)) {
+      throw new Error(`CRITICAL: _locales/${locale}/messages.json must contain a JSON object`);
+    }
+
+    for (const key of ['appName', 'appDesc']) {
+      if (!messages[key] || typeof messages[key].message !== 'string' || messages[key].message.trim().length === 0) {
+        throw new Error(`CRITICAL: _locales/${locale}/messages.json is missing a valid ${key}.message`);
+      }
+    }
+
+    const appNameLength = countUnicodeCharacters(messages.appName.message);
+    const appDescLength = countUnicodeCharacters(messages.appDesc.message);
+
+    if (appNameLength > maxAppNameLength) {
+      throw new Error(`CRITICAL: _locales/${locale}/messages.json appName.message is ${appNameLength} characters; maximum is ${maxAppNameLength}`);
+    }
+    if (messages.appName.message !== requiredAppName) {
+      throw new Error(`CRITICAL: _locales/${locale}/messages.json appName.message must exactly equal "${requiredAppName}"`);
+    }
+    if (appDescLength > maxAppDescLength) {
+      throw new Error(`CRITICAL: _locales/${locale}/messages.json appDesc.message is ${appDescLength} characters; maximum is ${maxAppDescLength}`);
+    }
+  }
+
+  console.log(`✓ Validated localized extension metadata for ${localeDirectories.length} locales`);
+}
+
+validateExtensionMetadata();
 
 // Ensure dist directory exists
 if (fs.existsSync(distDir)) {
@@ -22,7 +74,7 @@ if (!fs.existsSync(extSharedDir)) {
   fs.mkdirSync(extSharedDir, { recursive: true });
 }
 
-const sharedFiles = ['constants.js', 'blacklist.js', 'names.js', 'README.md'];
+const sharedFiles = ['constants.js', 'blacklist.js', 'names.js', 'invite-links.js', 'README.md'];
 for (const file of sharedFiles) {
   const src = path.join(masterSharedDir, file);
   const dest = path.join(extSharedDir, file);
@@ -31,7 +83,7 @@ for (const file of sharedFiles) {
   }
   fs.copyFileSync(src, dest);
 }
-console.log('✓ constants.js, blacklist.js, names.js, and README.md synced to extension/shared/');
+console.log('✓ shared runtime files synced to extension/shared/');
 
 // Read the base manifest
 const baseManifest = JSON.parse(fs.readFileSync(baseManifestPath, 'utf8'));
@@ -43,7 +95,7 @@ function replaceRequiredBlock(content, pattern, replacement, description) {
   return content.replace(pattern, replacement);
 }
 
-// Helper to copy files, ignoring manifest.json and manifest.base.json
+// Helper to copy runtime files, ignoring source manifests and test-only modules
 // Also injects shared constants into content.js
 function copyExtensionFiles(targetDir, browserName) {
   fs.mkdirSync(targetDir, { recursive: true });
@@ -68,7 +120,7 @@ function copyExtensionFiles(targetDir, browserName) {
   
   const items = fs.readdirSync(extDir);
   for (const item of items) {
-    if (item === 'manifest.json' || item === 'manifest.base.json') continue;
+    if (item === 'manifest.json' || item === 'manifest.base.json' || /\.test\.[cm]?js$/u.test(item)) continue;
     
     const srcPath = path.join(extDir, item);
     const destPath = path.join(targetDir, item);
@@ -149,18 +201,18 @@ function copyExtensionFiles(targetDir, browserName) {
 }
 
 // Helper to zip a directory
-function zipDirectory(sourceDir, outPath) {
+async function zipDirectory(sourceDir, outPath) {
+  const { ZipArchive } = await import('archiver');
   return new Promise((resolve, reject) => {
-    const archive = archiver('zip', { zlib: { level: 9 } });
+    const archive = new ZipArchive({ zlib: { level: 9 } });
     const stream = fs.createWriteStream(outPath);
 
-    archive
-      .directory(sourceDir, false)
-      .on('error', err => reject(err))
-      .pipe(stream);
-
+    archive.on('error', reject);
     stream.on('close', () => resolve());
-    archive.finalize();
+    stream.on('error', reject);
+    archive.pipe(stream);
+    archive.directory(sourceDir, false);
+    void archive.finalize().catch(reject);
   });
 }
 

scripts/test-chat-settings.mjs

@@ -0,0 +1,69 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const [popupHtml, popupJs, overlayJs, backgroundJs] = await Promise.all([
+    readFile(path.join(repoRoot, 'extension', 'popup.html'), 'utf8'),
+    readFile(path.join(repoRoot, 'extension', 'popup.js'), 'utf8'),
+    readFile(path.join(repoRoot, 'extension', 'chat-overlay.js'), 'utf8'),
+    readFile(path.join(repoRoot, 'extension', 'background.js'), 'utf8')
+]);
+
+function detailsSection(marker) {
+    const markerIndex = popupHtml.indexOf(marker);
+    assert.notEqual(markerIndex, -1, `missing settings marker: ${marker}`);
+    const start = popupHtml.lastIndexOf('<details', markerIndex);
+    const end = popupHtml.indexOf('</details>', markerIndex);
+    assert.ok(start >= 0 && end > markerIndex, `invalid details section: ${marker}`);
+    return popupHtml.slice(start, end + '</details>'.length);
+}
+
+const chatSection = detailsSection('data-i18n="CHAT_TITLE"');
+const syncSection = detailsSection('data-i18n="LABEL_SETTINGS_GROUP_SYNC"');
+
+for (const id of ['chatEnabled', 'chatNotifications', 'chatPosition', 'chatSize', 'chatStartMode', 'chatReactionDisplay']) {
+    assert.match(chatSection, new RegExp(`id="${id}"`), `${id} belongs in the dedicated chat settings section`);
+}
+assert.doesNotMatch(syncSection, /id="chatEnabled"/, 'chat enablement must not remain under Playback & Sync');
+
+for (const value of ['right', 'left', 'detached']) {
+    assert.match(chatSection, new RegExp(`<option value="${value}"`), `chat position supports ${value}`);
+}
+for (const value of ['compact', 'standard', 'large', 'custom']) {
+    assert.match(chatSection, new RegExp(`<option value="${value}"`), `chat size supports ${value}`);
+}
+for (const value of ['bubble', 'open']) {
+    assert.match(chatSection, new RegExp(`<option value="${value}"`), `chat start mode supports ${value}`);
+}
+for (const value of ['chat', 'video']) {
+    assert.match(chatSection, new RegExp(`<option value="${value}"`), `chat reaction display supports ${value}`);
+}
+
+for (const key of ['chatEnabled', 'chatNotifications', 'chatPosition', 'chatSize', 'chatStartMode', 'chatReactionDisplay']) {
+    assert.match(popupJs, new RegExp(`chrome\\.storage\\.local\\.set\\(\\{ ${key}`), `popup persists ${key}`);
+    assert.ok(backgroundJs.includes(`'${key}'`), `legacy sync purge includes ${key}`);
+}
+for (const key of ['chatPosition', 'chatSize', 'chatStartMode', 'chatReactionDisplay']) {
+    assert.ok(overlayJs.includes(`'${key}'`), `overlay reads ${key}`);
+}
+assert.match(backgroundJs, /chatEnabled:\s*data\.chatEnabled === true/, 'background reads chatEnabled with an off-by-default contract');
+assert.match(backgroundJs, /chatNotifications:\s*data\.chatNotifications !== false/, 'chat message notifications default on');
+assert.match(popupJs, /elements\.chatNotifications\.checked = localData\.chatNotifications !== false/, 'popup shows chat notifications on by default');
+assert.match(popupJs, /elements\.browserNotifications\.checked = localData\.browserNotifications === true/, 'activity notifications remain off by default');
+assert.match(overlayJs, /context\?\.enabled/, 'overlay consumes chat enablement from the validated background context');
+
+assert.match(overlayJs, /SIZE_PRESETS[\s\S]*compact[\s\S]*standard[\s\S]*large/, 'overlay defines all size presets');
+assert.match(
+    overlayJs,
+    /} else {\s*layout\.width = Number\(layout\.customWidth\) \|\| DEFAULT_WIDTH;\s*layout\.height = Number\(layout\.customHeight\) \|\| DEFAULT_HEIGHT;/,
+    'custom size restores its dedicated dimensions'
+);
+assert.match(overlayJs, /layout\.customWidth = rect\.width[\s\S]*layout\.customHeight = rect\.height/, 'detached resize updates the custom-size snapshot');
+assert.match(overlayJs, /changes\.chatPosition[\s\S]*setMode/, 'position changes apply live');
+assert.match(overlayJs, /changes\.chatSize[\s\S]*setSize/, 'size changes apply live');
+assert.match(overlayJs, /changes\.chatStartMode[\s\S]*setOpened/, 'startup-mode changes apply live');
+assert.match(overlayJs, /changes\.chatReactionDisplay[\s\S]*chatReactionDisplay/, 'reaction display changes apply live');
+
+console.log('chat settings tests passed');

scripts/test-host-access.mjs

@@ -0,0 +1,180 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { cwd } from 'node:process';
+import {
+    HOST_ACCESS_REQUIRED_STATUS,
+    addTabHostAccessRequest,
+    describeTabUrl,
+    inspectTabHostAccess,
+    isHostAccessError,
+    normalizeTabId,
+    removeTabHostAccessRequest,
+    requestOriginPermission
+} from '../extension/host-access.js';
+
+assert.equal(HOST_ACCESS_REQUIRED_STATUS, 'host_permission_required');
+assert.equal(normalizeTabId(null), null);
+assert.equal(normalizeTabId(undefined), null);
+assert.equal(normalizeTabId(''), null);
+assert.equal(normalizeTabId(0), null);
+assert.equal(normalizeTabId('42'), 42);
+assert.equal(normalizeTabId(true), null);
+assert.equal(normalizeTabId([42]), null);
+assert.equal(normalizeTabId('42.5'), null);
+assert.equal(normalizeTabId(' 42 '), 42);
+assert.equal(normalizeTabId(Number.MAX_SAFE_INTEGER + 1), null);
+assert.deepEqual(describeTabUrl('https://emby.example:8443/web/index.html'), {
+    url: 'https://emby.example:8443/web/index.html',
+    host: 'emby.example:8443',
+    originPattern: 'https://emby.example:8443/*'
+});
+assert.deepEqual(describeTabUrl('http://localhost:8096/web/'), {
+    url: 'http://localhost:8096/web/',
+    host: 'localhost:8096',
+    originPattern: 'http://localhost:8096/*'
+});
+assert.deepEqual(describeTabUrl('http://localhost:8096/web/', { includePort: false }), {
+    url: 'http://localhost:8096/web/',
+    host: 'localhost:8096',
+    originPattern: 'http://localhost/*'
+});
+assert.equal(describeTabUrl('chrome://extensions/'), null);
+assert.equal(describeTabUrl('not a url'), null);
+
+let containsRequest = null;
+const deniedChrome = {
+    tabs: {
+        get: async tabId => ({ id: tabId, url: 'https://video.example/watch' })
+    },
+    permissions: {
+        contains: async request => {
+            containsRequest = request;
+            return false;
+        }
+    }
+};
+const access = await inspectTabHostAccess(deniedChrome, 42);
+assert.equal(access.granted, false);
+assert.equal(access.host, 'video.example');
+assert.deepEqual(containsRequest, { origins: ['https://video.example/*'] });
+
+let firefoxContainsRequest = null;
+const firefoxChrome = {
+    runtime: { getBrowserInfo: async () => ({ name: 'Firefox' }) },
+    tabs: {
+        get: async tabId => ({
+            id: tabId,
+            url: 'http://localhost:8096/web/',
+            pendingUrl: 'https://different.example/loading'
+        })
+    },
+    permissions: {
+        contains: async request => {
+            firefoxContainsRequest = request;
+            return false;
+        }
+    }
+};
+const firefoxAccess = await inspectTabHostAccess(firefoxChrome, 42);
+assert.equal(firefoxAccess.host, 'localhost:8096');
+assert.equal(firefoxAccess.originPattern, 'http://localhost/*');
+assert.deepEqual(firefoxContainsRequest, { origins: ['http://localhost/*'] });
+
+const unknownPermissionChrome = {
+    runtime: {},
+    tabs: {
+        get: async tabId => ({ id: tabId, url: 'https://video.example/watch' })
+    },
+    permissions: {
+        contains: (_request, callback) => { callback(undefined); }
+    }
+};
+assert.equal((await inspectTabHostAccess(unknownPermissionChrome, 42)).granted, null);
+
+let requestedTabId = null;
+const requestChrome = {
+    permissions: {
+        addHostAccessRequest: async request => { requestedTabId = request; }
+    }
+};
+assert.equal(await addTabHostAccessRequest(requestChrome, 42, 'https://video.example/*'), true);
+assert.deepEqual(requestedTabId, { tabId: 42, pattern: 'https://video.example/*' });
+assert.equal(await addTabHostAccessRequest({ permissions: {} }, 42), false);
+
+let removedTabId = null;
+const removeRequestChrome = {
+    permissions: {
+        removeHostAccessRequest: async request => { removedTabId = request; }
+    }
+};
+assert.equal(await removeTabHostAccessRequest(removeRequestChrome, 42, 'https://video.example/*'), true);
+assert.deepEqual(removedTabId, { tabId: 42, pattern: 'https://video.example/*' });
+assert.equal(await removeTabHostAccessRequest({ permissions: {} }, 42), false);
+
+assert.equal(isHostAccessError(new Error('Missing host permission for the tab')), true);
+assert.equal(isHostAccessError(new Error('No tab with id: 42')), false);
+const callbackPermissionChrome = {
+    runtime: {},
+    permissions: {
+        request: (_request, callback) => { callback(true); }
+    }
+};
+assert.equal(await requestOriginPermission(callbackPermissionChrome, 'https://video.example/*'), true);
+assert.equal(await requestOriginPermission({ permissions: {} }, 'https://video.example/*'), null);
+
+const background = fs.readFileSync(path.join(cwd(), 'extension', 'background.js'), 'utf8');
+const popup = fs.readFileSync(path.join(cwd(), 'extension', 'popup.js'), 'utf8');
+const popupHtml = fs.readFileSync(path.join(cwd(), 'extension', 'popup.html'), 'utf8');
+const tabManager = fs.readFileSync(path.join(cwd(), 'extension', 'modules', 'tab-manager.js'), 'utf8');
+
+assert.match(background, /await activateTargetTab\(message\.tabId, message\.tabTitle\)/,
+    'SET_TARGET_TAB must await successful activation before acknowledging it');
+assert.match(background, /addTabHostAccessRequest\(chrome, tabId, access\.originPattern\)/,
+    'failed injection must register Chrome host-access request');
+assert.match(background, /retryPendingTarget\(\)/,
+    'pending target must resume after the user grants access');
+assert.match(background, /activationGeneration !== targetActivationGeneration/,
+    'stale concurrent tab activations must not overwrite the newest selection');
+assert.match(background, /pendingTargetRequestId/,
+    'pending access recovery must use an identity token');
+assert.match(background, /addedOrigins\.includes\(pending\.originPattern\)/,
+    'unrelated permission grants must not activate a pending target');
+assert.match(background, /isCurrentTargetIdentity\(tabId, targetGeneration\)/,
+    'stale content-routing retries must not reactivate an old target');
+assert.match(background, /message\.expectedTabId/,
+    'popup playback events must be rejected after their target changes');
+assert.match(background, /completeForceSyncBeforeTargetChange\(selectedTabId\)/,
+    'a target switch must finish an in-flight force sync on the old target');
+assert.match(background, /FORCE_SYNC_ACK'[\s\S]*ignored_unselected_tab/,
+    'stale content scripts must not acknowledge force sync for a new target');
+const activateTargetBody = background.slice(
+    background.indexOf('async function activateTargetTab'),
+    background.indexOf('async function retryPendingTarget')
+);
+assert.ok(
+    activateTargetBody.indexOf('await injectContentScript') < activateTargetBody.indexOf('currentTabId = selectedTabId'),
+    'a tab must not become current until its content script injection succeeds'
+);
+assert.match(background, /removeTabHostAccessRequest\([\s\S]*pendingTabId/,
+    'clearing a pending target must also clear Chrome toolbar access requests');
+assert.match(popup, /response\?\.status === 'host_permission_required'/,
+    'popup must render the structured host-access failure');
+assert.match(popup, /requestOriginPermission\(chrome, requestedOriginPattern\)/,
+    'retry button must request withheld host access directly');
+assert.match(popup, /expectedCurrentTabId: tabId/,
+    'manual reinjection must be tied to the selected target identity');
+assert.match(popup, /expectedTabId: tabId/,
+    'force sync must be tied to the tab whose time was sampled');
+assert.doesNotMatch(tabManager, /injectContentScript/,
+    'tab reload recovery must use the guarded background activation path');
+assert.equal(
+    (background.match(/tabs\.onRemoved\.addListener/g) || []).length
+        + (tabManager.match(/tabs\.onRemoved\.addListener/g) || []).length,
+    1,
+    'target-tab closure must have exactly one state owner'
+);
+assert.match(popupHtml, /id="siteAccessNotice"/,
+    'popup must contain a persistent site-access notice');
+
+console.log('host access recovery tests passed');

scripts/test-server-ws.mjs

@@ -1,4 +1,5 @@
 import assert from 'node:assert/strict';
+import { Buffer } from 'node:buffer';
 import http from 'node:http';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
@@ -22,7 +23,10 @@ async function c() {
 function s(ws, evt, d={}) { ws.send(`42${JSON.stringify([evt,d])}`); }
 function a(ws) { if (ws._m.length) { const r=ws._m.shift(); return r.startsWith('42') ? JSON.parse(r.substring(2)) : r; } return new Promise((resolve, reject) => { const t=setTimeout(()=>reject(Error('timeout')),3e3); const h=(d)=>{clearTimeout(t);ws.removeListener('message',h);const r=d.toString();resolve(r.startsWith('42')?JSON.parse(r.substring(2)):r);};ws.on('message',h);}); }
 async function w(ws, evt, ms=3000) { const st=Date.now(); while(Date.now()-st<ms) { for(let i=0;i<ws._m.length;i++){const r=ws._m[i];ws._m.splice(i,1);if(r.startsWith('42')){try{const[e]=JSON.parse(r.substring(2));if(e===evt)return e}catch{/* skip */}}} await new Promise(r=>setTimeout(r,50));} throw Error(`wait:${evt}`); }
-async function j(ws, rid, pid, pw=null) { s(ws,'join_room',{roomId:rid,peerId:pid,password:pw,protocolVersion:'1.0.0'}); assert.equal((await a(ws))[0],'room_data'); }
+async function j(ws, rid, pid, pw=null, clientCapabilities=undefined) {
+    s(ws,'join_room',{roomId:rid,peerId:pid,password:pw,protocolVersion:'1.0.0',clientCapabilities});
+    assert.equal((await a(ws))[0],'room_data');
+}
 function close() { clients.forEach(w=>{try{w.close()}catch{/* ignore */}}); clients.length=0; }
 // Test suite opens >10 connections/min — clear the IP connection counter so the
 // connection rate limiter doesn't mask test failures (test-only, never at runtime).
@@ -70,6 +74,70 @@ try {
     assert.equal(capEv, 'room_data');
     assert.ok(Array.isArray(capData.capabilities) && capData.capabilities.includes('host-control'),
         'ROOM_DATA advertises the host-control capability');
+    assert.ok(capData.capabilities.includes('chat'), 'ROOM_DATA advertises the chat capability');
+    assert.ok(capData.capabilities.includes('chat-v1'), 'ROOM_DATA advertises the versioned chat capability');
+    assert.equal(capData.chatHistory, undefined, 'ROOM_DATA never contains chat history');
+    close();
+    resetConnectionRate();
+
+    // --- Encrypted chat is a live-only canonical relay ---
+    const chatRoom = 'chat-'+Date.now();
+    const chat1 = await c(), chat2 = await c();
+    await j(chat1, chatRoom, 'alice', null, ['chat-v1']);
+    await j(chat2, chatRoom, 'bob', null, ['chat-v1']);
+    chat1._m.length = chat2._m.length = 0;
+    const ciphertext = Buffer.alloc(64, 7).toString('base64url');
+    s(chat1, 'chat_message', {
+        ciphertext,
+        id: 'spoofed-id', senderId: 'mallory', timestamp: 1, text: 'plaintext'
+    });
+    const [chat1Event, chat1Data] = await a(chat1);
+    const [chat2Event, chat2Data] = await a(chat2);
+    assert.equal(chat1Event, 'chat_message', 'sender receives canonical chat envelope');
+    assert.equal(chat2Event, 'chat_message', 'peer receives canonical chat envelope');
+    assert.deepEqual(chat2Data, chat1Data, 'all peers receive the same canonical envelope');
+    assert.equal(chat1Data.senderId, 'alice', 'relay stamps senderId');
+    assert.equal(chat1Data.ciphertext, ciphertext, 'relay preserves ciphertext');
+    assert.equal(chat1Data.text, undefined, 'relay drops plaintext fields');
+    assert.notEqual(chat1Data.id, 'spoofed-id', 'relay replaces client IDs');
+    assert.ok(Number.isFinite(chat1Data.timestamp) && chat1Data.timestamp > 1, 'relay stamps timestamp');
+
+    const late = await c();
+    s(late, 'join_room', { roomId: chatRoom, peerId: 'late', protocolVersion: '1.0.0' });
+    const [lateEvent, lateRoomData] = await a(late);
+    assert.equal(lateEvent, 'room_data');
+    assert.equal(lateRoomData.chatHistory, undefined, 'late joiner gets no chat backlog');
+    assert.equal(late._m.some(raw => raw.includes('chat_message')), false, 'late joiner receives no old message');
+    close();
+    resetConnectionRate();
+
+    // --- Mixed rollout: old non-chat clients never receive unknown chat events ---
+    const mixedChatRoom = 'chat-mixed-'+Date.now();
+    const newChat = await c(), oldNoChat = await c();
+    await j(newChat, mixedChatRoom, 'new-chat', null, ['chat-v1', 'chat-v1', 'future-chat', 42]);
+    await j(oldNoChat, mixedChatRoom, 'old-no-chat', null, ['chat-v2']);
+    newChat._m.length = oldNoChat._m.length = 0;
+    s(newChat, 'chat_message', { ciphertext });
+    await w(newChat, 'chat_message');
+    let oldReceivedChat = false;
+    try { await w(oldNoChat, 'chat_message', 500); oldReceivedChat = true; } catch { /* expected */ }
+    assert.equal(oldReceivedChat, false, 'old client receives no unknown chat event');
+
+    // The same old client remains fully usable for the pre-chat protocol.
+    newChat._m.length = oldNoChat._m.length = 0;
+    s(oldNoChat, 'play', { currentTime: 12 });
+    await w(newChat, 'play');
+    s(newChat, 'pause', { currentTime: 13 });
+    await w(oldNoChat, 'pause');
+
+    // First chat beta compatibility: sending a valid chat frame dynamically
+    // proves receive support even when that beta omitted clientCapabilities.
+    const firstBeta = await c();
+    await j(firstBeta, mixedChatRoom, 'first-beta');
+    firstBeta._m.length = newChat._m.length = 0;
+    s(firstBeta, 'chat_message', { ciphertext });
+    await w(firstBeta, 'chat_message');
+    await w(newChat, 'chat_message');
     close();
     resetConnectionRate();
 

scripts/test-website-locales.mjs

@@ -22,6 +22,39 @@ const localeFiles = fs.readdirSync(localesDir)
 
 let hasError = false;
 
+const encryptedChatComparisonKeys = [
+  'ALT_TELEPARTY_INTRO',
+  'ALT_TELEPARTY_WHEN_TELE_BODY',
+  'ALT_TELEPARTY_MAIN_DIFF_BODY',
+  'ALT_TELEPARTY_LIMITS_BODY',
+  'ALT_TELEPARTY_SUMMARY_BODY',
+  'ALT_SCREEN_LIMITS_BODY',
+  'ALT_W2G_MAIN_DIFF_BODY',
+  'ALT_W2G_LIMITS_BODY',
+  'ALT_W2G_SUMMARY_BODY',
+  'ALT_SCENER_INTRO',
+  'ALT_SCENER_MAIN_DIFF_BODY',
+  'ALT_SCENER_LIMITS_BODY',
+  'ALT_KOSMI_LIMITS_BODY',
+  'ALT_TWOSEVEN_LIMITS_BODY'
+];
+const staleChatClaims = /does not currently have a built-in chat|has no built-in chat|no built-in chat box overlay|no built-in chat or webcam|no built-in chat or voice/i;
+for (const key of encryptedChatComparisonKeys) {
+  const value = enDict[key];
+  if (typeof value !== 'string' || !value.includes('end-to-end encrypted')) {
+    hasError = true;
+    console.error(`❌ English comparison key ${key} must describe KoalaSync's end-to-end encrypted chat.`);
+  }
+  if (staleChatClaims.test(value)) {
+    hasError = true;
+    console.error(`❌ English comparison key ${key} still claims that KoalaSync has no built-in text chat.`);
+  }
+}
+if (!enDict.ALT_TWOSEVEN_LIMITS_BODY.includes('floating and dockable')) {
+  hasError = true;
+  console.error('❌ TwoSeven comparison must describe KoalaSync text chat as floating and dockable.');
+}
+
 console.log(`Auditing website i18n locales using ${enKeys.length} baseline keys from en.json...\n`);
 
 for (const file of localeFiles) {

scripts/test-website-theme.mjs

@@ -12,11 +12,17 @@ const demoCss = fs.readFileSync(path.join(repoRoot, 'website', 'styles', 'demo.c
 const landingPrimaryCss = fs.readFileSync(path.join(repoRoot, 'website', 'styles', 'landing-primary.css'), 'utf8');
 const legalCss = fs.readFileSync(path.join(repoRoot, 'website', 'styles', 'legal.css'), 'utf8');
 const joinPage = fs.readFileSync(path.join(repoRoot, 'website', 'join.html'), 'utf8');
+const helpPage = fs.readFileSync(path.join(repoRoot, 'website', 'help.html'), 'utf8');
+const siteAccessHelpPage = fs.readFileSync(path.join(repoRoot, 'website', 'site-access-help.html'), 'utf8');
+const websiteBuild = fs.readFileSync(path.join(repoRoot, 'website', 'build.cjs'), 'utf8');
 const imprintPage = fs.readFileSync(path.join(repoRoot, 'website', 'imprint.html'), 'utf8');
 const germanImprintPage = fs.readFileSync(path.join(repoRoot, 'website', 'impressum-de.html'), 'utf8');
+const privacyPage = fs.readFileSync(path.join(repoRoot, 'website', 'privacy.html'), 'utf8');
+const germanPrivacyPage = fs.readFileSync(path.join(repoRoot, 'website', 'datenschutz-de.html'), 'utf8');
 const alternativesIndex = fs.readFileSync(path.join(repoRoot, 'website', 'alternatives', 'index.html'), 'utf8');
 const alternativesCss = fs.readFileSync(path.join(repoRoot, 'website', 'styles', 'alternatives.css'), 'utf8');
 const llmsText = fs.readFileSync(path.join(repoRoot, 'website', 'llms.txt'), 'utf8');
+const websiteVersion = JSON.parse(fs.readFileSync(path.join(repoRoot, 'website', 'version.json'), 'utf8')).version;
 const mockupStart = template.indexOf('<div class="extension-mockup">');
 const mockupEnd = template.indexOf('<div class="demo-invite-fly"', mockupStart);
 
@@ -25,6 +31,32 @@ if (mockupStart === -1 || mockupEnd === -1) {
 }
 
 const mockup = template.slice(mockupStart, mockupEnd);
+
+const privacyChatContracts = [
+  [privacyPage, 'English', [
+    'end-to-end encrypted in the browser extension before transmission',
+    '256-bit AES-GCM key',
+    'the relay does not receive the chat secret',
+    'does not create a server-side chat history',
+    'maximum of 200 visible message or activity entries',
+    "browser's notification API"
+  ]],
+  [germanPrivacyPage, 'German', [
+    'vor der Übertragung Ende-zu-Ende verschlüsselt',
+    '256-Bit-Schlüssel für AES-GCM',
+    'der Relay das Chat-Secret nicht erhält',
+    'keine serverseitige Chat-Historie',
+    'höchstens 200 Nachrichten- oder Aktivitätseinträge',
+    'Benachrichtigungs-API des Browsers'
+  ]]
+];
+for (const [page, language, statements] of privacyChatContracts) {
+  for (const statement of statements) {
+    if (!page.includes(statement)) {
+      throw new Error(`${language} privacy policy is missing encrypted-chat disclosure: ${statement}`);
+    }
+  }
+}
 const themeSensitiveControls = [
   ['video selector', /<select[^>]+id="demo-video-select"[^>]+>/],
   ['sync target', /<div[^>]+class="mock-input"[^>]+title="Choose sync target"[^>]*>/],
@@ -63,6 +95,60 @@ for (const section of requiredLlmsSections) {
 if (/\bWebRTC\b|\bport 54000\b|peer-to-peer by design/i.test(llmsText)) {
   throw new Error('llms.txt must describe the current WebSocket relay architecture without obsolete WebRTC or port claims');
 }
+if (!llmsText.includes('- built-in voice, video or webcam chat') || llmsText.includes('- built-in text, voice or webcam chat')) {
+  throw new Error('llms.txt must distinguish built-in encrypted text chat from unsupported voice, video or webcam chat');
+}
+if (!llmsText.includes(`Current website release: ${websiteVersion}`)) {
+  throw new Error(`llms.txt release must match website/version.json (${websiteVersion})`);
+}
+const requiredSupportSocialMetadata = [
+  '<link rel="canonical" href="https://sync.koalastuff.net/site-access-help">',
+  'name="twitter:card" content="summary_large_image"',
+  'name="twitter:title"',
+  'name="twitter:description"',
+  'name="twitter:image"',
+  '"datePublished"',
+  '"dateModified"',
+  '"mainEntityOfPage"'
+];
+for (const metadata of requiredSupportSocialMetadata) {
+  if (!siteAccessHelpPage.includes(metadata)) {
+    throw new Error(`site-access-help.html is missing SEO metadata: ${metadata}`);
+  }
+}
+const requiredHelpMetadata = [
+  '<link rel="canonical" href="https://sync.koalastuff.net/help">',
+  'type="text/markdown" href="https://sync.koalastuff.net/llms.txt"',
+  'name="twitter:card" content="summary_large_image"',
+  'property="og:image:alt"',
+  'name="twitter:image:alt"',
+  '"@type": ["CollectionPage", "FAQPage"]',
+  '"@type": "BreadcrumbList"',
+  '"datePublished"',
+  '"dateModified"'
+];
+for (const metadata of requiredHelpMetadata) {
+  if (!helpPage.includes(metadata)) {
+    throw new Error(`help.html is missing SEO/AEO metadata: ${metadata}`);
+  }
+}
+if (!llmsText.includes('[Help Center](https://sync.koalastuff.net/help)')
+    || !llmsText.includes('[Website access guide](https://sync.koalastuff.net/site-access-help)')) {
+  throw new Error('llms.txt must expose the Help Center and website-access guide');
+}
+if (!websiteBuild.includes("['log', '-1', '--format=%cs', '--', ...sourceFiles]")
+    || !websiteBuild.includes("lastmod(['website/help.html', 'website/styles/support.css', 'website/app.js'])")
+    || !websiteBuild.includes("lastmod(['website/site-access-help.html', 'website/app.js'])")
+    || !websiteBuild.includes("['rev-parse', '--is-shallow-repository']")
+    || !websiteBuild.includes("['diff', '--name-only', '--']")
+    || !websiteBuild.includes("['diff', '--cached', '--name-only', '--']")
+    || !websiteBuild.includes("['ls-files', '--others', '--exclude-standard', '--']")
+    || !websiteBuild.includes('sourceFiles.some(file => dirtySourceFiles.has(file))')) {
+  throw new Error('Sitemap lastmod values must come from the mapped source files in Git');
+}
+if (websiteBuild.includes('<changefreq>') || websiteBuild.includes('<priority>')) {
+  throw new Error('Sitemap must not emit ignored changefreq or priority hints');
+}
 const documentedRelayUrls = [...llmsText.matchAll(/`(wss:\/\/[^`\s]+)`/g)].map(([, value]) => new URL(value));
 const hasCanonicalPublicRelay = documentedRelayUrls.some((url) => (
   url.protocol === 'wss:' &&
@@ -97,7 +183,6 @@ for (const value of requiredSelfHostingValues) {
 if ((selfHostingExamples.match(/localhost:3000/g) || []).length !== 2 || selfHostingExamples.includes('KoalaSync:3000')) {
   throw new Error('Both Caddy examples must match the compose loopback port binding');
 }
-
 const landingStylesheet = landingStylesheets[0][0];
 if (!/href="\{\{ASSET_PATH\}\}landing\.min\.css"/.test(landingStylesheet)) {
   throw new Error('Landing stylesheet must use the landing.min.css build placeholder');
@@ -151,11 +236,9 @@ if (!/\.legal-inline-link\s*\{[^}]*text-decoration:\s*underline/s.test(legalCss)
   throw new Error('Legal prose links must use a non-color underline cue');
 }
 for (const [name, page] of [['imprint.html', imprintPage], ['impressum-de.html', germanImprintPage]]) {
-  if ((page.match(/class="legal-inline-link"/g) || []).length !== 3) {
-    throw new Error(`${name} must mark all three prose links as legal-inline-link`);
-  }
-  if ((page.match(/class="legal-inline-label"/g) || []).length !== 2 || /opacity:\s*0\.6/.test(page)) {
-    throw new Error(`${name} contact labels must use full-opacity theme text`);
+  if (!/rel="canonical" href="https:\/\/koalastuff\.net\/legal"/.test(page)
+      || !/href="https:\/\/koalastuff\.net\/legal"/.test(page)) {
+    throw new Error(`${name} must point to the central KoalaStuff legal notice`);
   }
 }
 
@@ -176,6 +259,7 @@ if (!/animation:\s*none\s*!important/.test(reducedMotionRule)) {
 console.log('Extension mockup theme-sensitive text uses theme-aware colors');
 console.log('Landing CSS is render-blocking, single-request, and cascade-stable');
 console.log('Landing head discovers a complete and architecture-accurate llms.txt');
+console.log('Support-page social metadata and Git-derived sitemap dates remain truthful');
 console.log('Website self-hosting examples include production secrets and consistent networking');
 console.log('Foreground film birds use complete, always-on wing and glide animations');
 console.log('All Getting Started mockups define explicit light-theme surfaces');

scripts/verify-release.mjs

@@ -20,6 +20,8 @@ const checks = [
   ['content video finder', 'node', ['scripts/test-content-video-finder.cjs']],
   ['audio settings', 'node', ['scripts/test-audio-settings.mjs']],
   ['popup refresh cooldown', 'node', ['scripts/test-popup-refresh-cooldown.mjs']],
+  ['chat settings', 'node', ['scripts/test-chat-settings.mjs']],
+  ['host access recovery', 'node', ['scripts/test-host-access.mjs']],
   ['server syntax index', 'node', ['-c', 'server/index.js']],
   ['server syntax ops', 'node', ['-c', 'server/ops.js']],
   ['server syntax rate-limiter', 'node', ['-c', 'server/rate-limiter.js']],

server/Dockerfile

@@ -1,15 +1,16 @@
-FROM node:20-alpine
+FROM node:24-alpine
 WORKDIR /app
 
 # Copy shared protocol first
-COPY shared/ ./shared/
+COPY --chown=node:node shared/ ./shared/
 
 # Copy server
-COPY server/package*.json ./server/
-RUN cd server && npm install --production
-COPY server/ ./server/
+COPY --chown=node:node server/package*.json ./server/
+RUN cd server && npm ci --omit=dev
+COPY --chown=node:node server/ ./server/
 
 WORKDIR /app/server
+USER node
 EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

server/chat.js

@@ -0,0 +1,24 @@
+import { randomUUID } from 'node:crypto';
+
+export const CHAT_CIPHERTEXT_MAX_BYTES = 2028;
+export const CHAT_CIPHERTEXT_MIN_BYTES = 29;
+
+export function normalizeChatCiphertext(value) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1) return null;
+    const bytes = Buffer.from(value, 'base64url');
+    if (bytes.length < CHAT_CIPHERTEXT_MIN_BYTES || bytes.length > CHAT_CIPHERTEXT_MAX_BYTES) return null;
+    if (bytes.toString('base64url') !== value) return null;
+    return value;
+}
+
+export function createChatEnvelope(data, senderId, now = Date.now, createId = randomUUID) {
+    if (!data || typeof data !== 'object' || typeof senderId !== 'string' || !senderId) return null;
+    const ciphertext = normalizeChatCiphertext(data.ciphertext);
+    if (!ciphertext) return null;
+    return {
+        id: createId(),
+        senderId,
+        timestamp: now(),
+        ciphertext
+    };
+}

server/chat.test.mjs

@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest';
+import { Buffer } from 'node:buffer';
+import {
+    CHAT_CIPHERTEXT_MAX_BYTES,
+    createChatEnvelope,
+    normalizeChatCiphertext
+} from './chat.js';
+
+const encoded = (length) => Buffer.alloc(length, 7).toString('base64url');
+
+describe('encrypted chat relay envelopes', () => {
+    it('accepts canonical base64url within the encrypted message bounds', () => {
+        expect(normalizeChatCiphertext(encoded(29))).toBe(encoded(29));
+        expect(normalizeChatCiphertext(encoded(CHAT_CIPHERTEXT_MAX_BYTES))).toBe(encoded(CHAT_CIPHERTEXT_MAX_BYTES));
+    });
+
+    it('rejects malformed, padded, too-small, and oversized payloads', () => {
+        expect(normalizeChatCiphertext('<script>')).toBeNull();
+        expect(normalizeChatCiphertext(`${encoded(29)}=`)).toBeNull();
+        expect(normalizeChatCiphertext(encoded(28))).toBeNull();
+        expect(normalizeChatCiphertext(encoded(CHAT_CIPHERTEXT_MAX_BYTES + 1))).toBeNull();
+        expect(normalizeChatCiphertext('A')).toBeNull();
+    });
+
+    it('stamps authoritative metadata and keeps only ciphertext from the sender', () => {
+        const ciphertext = encoded(64);
+        const envelope = createChatEnvelope({
+            ciphertext,
+            id: 'spoofed',
+            senderId: 'mallory',
+            timestamp: 1,
+            text: 'plaintext must not survive'
+        }, 'alice', () => 1234, () => 'server-id');
+
+        expect(envelope).toEqual({
+            id: 'server-id',
+            senderId: 'alice',
+            timestamp: 1234,
+            ciphertext
+        });
+        expect(JSON.stringify(envelope)).not.toContain('plaintext');
+    });
+});

server/index.js

@@ -5,6 +5,7 @@ import { Server } from 'socket.io';
 import crypto from 'crypto';
 import dotenv from 'dotenv';
 import { EVENTS, OFFICIAL_SERVER_TOKEN, PROTOCOL_VERSION, CONTROL_MODES, CAPABILITIES } from '../shared/constants.js';
+import { createChatEnvelope } from './chat.js';
 import {
     buildHealthPayload,
     checkCooldown,
@@ -19,6 +20,7 @@ import {
     connectionCounts,
     failedAuthAttempts,
     eventCounts,
+    chatMessageCounts,
     healthCounts,
     adminMetricsAuthCounts,
     roomListCooldowns,
@@ -28,6 +30,7 @@ import {
     recordAuthFailure,
     checkConnectionRate,
     checkEventRate,
+    checkChatMessageRate,
     checkHealthRate,
     checkAdminMetricsAuthRate,
     checkLeaveRoomRate,
@@ -171,7 +174,26 @@ const HOST_ONLY_GATED_EVENTS = new Set([
 // Features this relay supports, advertised to clients in ROOM_DATA so they can
 // enable matching UI/behavior only when the server actually backs it. Append a
 // flag here when a new server-gated feature ships (e.g. co-host promotion).
-const SERVER_CAPABILITIES = [CAPABILITIES.HOST_CONTROL, CAPABILITIES.CO_HOST];
+const SERVER_CAPABILITIES = [
+    CAPABILITIES.HOST_CONTROL,
+    CAPABILITIES.CO_HOST,
+    CAPABILITIES.CHAT,
+    CAPABILITIES.CHAT_V1
+];
+
+function normalizeClientCapabilities(value) {
+    if (!Array.isArray(value)) return [];
+    return [...new Set(value.slice(0, 16)
+        .filter(capability => typeof capability === 'string')
+        .map(capability => capability.substring(0, 32))
+        .filter(capability => capability === CAPABILITIES.CHAT_V1)
+    )];
+}
+
+function clientSupportsChat(socket) {
+    return Array.isArray(socket?.data?.clientCapabilities) &&
+        socket.data.clientCapabilities.includes(CAPABILITIES.CHAT_V1);
+}
 
 // M-4: minimum interval between CONTROL_MODE changes per room. Stops a rapidly
 // toggling host from thrashing every guest's UI (locked/unlocked/locked...) and
@@ -353,6 +375,7 @@ io.on('connection', (socket) => {
         const username = typeof payload.username  === 'string' ? payload.username.substring(0, 30)  : null;
         const tabTitle = typeof payload.tabTitle  === 'string' ? payload.tabTitle.substring(0, 100) : null;
         const mediaTitle = typeof payload.mediaTitle === 'string' ? payload.mediaTitle.substring(0, 100) : null;
+        const clientCapabilities = normalizeClientCapabilities(payload.clientCapabilities);
 
         if (!roomId || !peerId) return; // Guard: empty or invalid after sanitization
 
@@ -367,6 +390,7 @@ io.on('connection', (socket) => {
             // Cleanup old room if re-joining
             const oldMapping = socketToRoom.get(socket.id);
             if (oldMapping && oldMapping.roomId === roomId && oldMapping.peerId === peerId) {
+                socket.data.clientCapabilities = clientCapabilities;
                 return; // Already in this room with same peerId, ignore to prevent spam
             }
             if (oldMapping && oldMapping.roomId !== roomId) {
@@ -490,6 +514,7 @@ io.on('connection', (socket) => {
             }
 
             socket.join(roomId);
+            socket.data.clientCapabilities = clientCapabilities;
             room.peers.add(socket.id);
             room.peerIds.set(socket.id, peerId);
             room.peerData.set(socket.id, { 
@@ -844,8 +869,45 @@ io.on('connection', (socket) => {
         }
     });
 
+    socket.on(EVENTS.CHAT_MESSAGE, (data) => {
+        try {
+            if (!checkEventRate(socket.id) || !checkChatMessageRate(socket.id)) {
+                log('SECURITY', `Encrypted chat rate limit exceeded for socket: ${socket.id}`);
+                socket.disconnect(true);
+                return;
+            }
+
+            const mapping = socketToRoom.get(socket.id);
+            if (!mapping) return;
+            const room = rooms.get(mapping.roomId);
+            if (!room) return;
+
+            const envelope = createChatEnvelope(data, mapping.peerId);
+            if (!envelope) return;
+            // Transitional compatibility: the first chat beta did not announce
+            // clientCapabilities. Successfully sending a canonical chat frame is
+            // sufficient proof that this socket understands the v1 receive event.
+            if (!clientSupportsChat(socket)) {
+                socket.data.clientCapabilities = [
+                    ...(socket.data.clientCapabilities || []),
+                    CAPABILITIES.CHAT_V1
+                ];
+            }
+            room.lastActivity = Date.now();
+            for (const socketId of room.peers) {
+                const recipient = io.sockets.sockets.get(socketId);
+                if (clientSupportsChat(recipient)) {
+                    recipient.emit(EVENTS.CHAT_MESSAGE, envelope);
+                }
+            }
+        } catch (err) {
+            log('ERROR', `CHAT_MESSAGE handler error: ${err.message}`);
+        }
+    });
+
     socket.on('disconnect', () => {
         eventCounts.delete(socket.id);
+        chatMessageCounts.delete(socket.id);
         roomListCooldowns.delete(socket.id);
         leaveRoomCounts.delete(socket.id);
         const mapping = socketToRoom.get(socket.id);

server/package-lock.json

@@ -30,12 +30,12 @@
       }
     },
     "node_modules/@types/node": {
-      "version": "25.6.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.6.0.tgz",
-      "integrity": "sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==",
+      "version": "26.1.1",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz",
+      "integrity": "sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==",
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~7.19.0"
+        "undici-types": "~8.3.0"
       }
     },
     "node_modules/@types/ws": {
@@ -70,20 +70,20 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz",
-      "integrity": "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
+      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
       "license": "MIT",
       "dependencies": {
         "bytes": "^3.1.2",
-        "content-type": "^1.0.5",
+        "content-type": "^2.0.0",
         "debug": "^4.4.3",
-        "http-errors": "^2.0.0",
-        "iconv-lite": "^0.7.0",
+        "http-errors": "^2.0.1",
+        "iconv-lite": "^0.7.2",
         "on-finished": "^2.4.1",
-        "qs": "^6.14.1",
-        "raw-body": "^3.0.1",
-        "type-is": "^2.0.1"
+        "qs": "^6.15.2",
+        "raw-body": "^3.0.2",
+        "type-is": "^2.1.0"
       },
       "engines": {
         "node": ">=18"
@@ -93,6 +93,19 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/body-parser/node_modules/content-type": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/bytes": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
@@ -347,9 +360,9 @@
       }
     },
     "node_modules/es-object-atoms": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0"
@@ -526,9 +539,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
-      "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -558,9 +571,9 @@
       }
     },
     "node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
+      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
@@ -604,12 +617,16 @@
       }
     },
     "node_modules/media-typer": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz",
-      "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.1.tgz",
+      "integrity": "sha512-yz3xRaG20c6/BOzvYoDaGtPmGscs7YivItZEEqe6GbwNfHuxu9YNmvnEkMzKldAGY4/80pRcQRZSEnhquk9XuQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/merge-descriptors": {
@@ -739,12 +756,13 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.15.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
-      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+      "version": "6.15.3",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
+      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.1.0"
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
       },
       "engines": {
         "node": ">=0.6"
@@ -754,12 +772,16 @@
       }
     },
     "node_modules/range-parser": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
-      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz",
+      "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/raw-body": {
@@ -851,14 +873,14 @@
       "license": "ISC"
     },
     "node_modules/side-channel": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
-      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3",
-        "side-channel-list": "^1.0.0",
+        "object-inspect": "^1.13.4",
+        "side-channel-list": "^1.0.1",
         "side-channel-map": "^1.0.1",
         "side-channel-weakmap": "^1.0.2"
       },
@@ -951,9 +973,9 @@
       }
     },
     "node_modules/socket.io-parser": {
-      "version": "4.2.6",
-      "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.6.tgz",
-      "integrity": "sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg==",
+      "version": "4.2.7",
+      "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.7.tgz",
+      "integrity": "sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==",
       "license": "MIT",
       "dependencies": {
         "@socket.io/component-emitter": "~3.1.0",
@@ -1025,23 +1047,40 @@
       }
     },
     "node_modules/type-is": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz",
-      "integrity": "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
+      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
       "license": "MIT",
       "dependencies": {
-        "content-type": "^1.0.5",
+        "content-type": "^2.0.0",
         "media-typer": "^1.1.0",
         "mime-types": "^3.0.0"
       },
       "engines": {
-        "node": ">= 0.6"
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/type-is/node_modules/content-type": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/undici-types": {
-      "version": "7.19.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.19.2.tgz",
-      "integrity": "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==",
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
+      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
       "license": "MIT"
     },
     "node_modules/unpipe": {
@@ -1069,9 +1108,9 @@
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "8.21.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
-      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
+      "version": "8.21.1",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",
+      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

server/rate-limiter.js

@@ -12,6 +12,8 @@ export const CONNECTION_RATE_LIMIT = 10;           // max new connections per IP
 export const CONNECTION_RATE_WINDOW_MS = 60000;    // 1 minute
 export const EVENT_RATE_LIMIT = 50;                // max relayed events per socket per window
 export const EVENT_RATE_WINDOW_MS = 10000;         // 10 seconds
+export const CHAT_MESSAGE_RATE_LIMIT = 10;         // max encrypted chat messages per socket per window
+export const CHAT_MESSAGE_RATE_WINDOW_MS = 10000;  // 10 seconds
 export const HEALTH_RATE_WINDOW_MS = 60000;        // 1 minute
 export const ADMIN_METRICS_AUTH_WINDOW_MS = 60000; // 1 minute
 export const LEAVE_ROOM_RATE_LIMIT = 10;           // max LEAVE_ROOM events per socket per window
@@ -20,6 +22,7 @@ export const LEAVE_ROOM_RATE_WINDOW_MS = 60000;    // 1 minute
 export const connectionCounts = new Map(); // ip -> { count, resetTime }
 export const failedAuthAttempts = new Map(); // Map<IP+RoomID, {count, lastAttempt}>
 export const eventCounts = new Map(); // socketId -> { count, resetTime }
+export const chatMessageCounts = new Map(); // socketId -> { count, resetTime }
 export const healthCounts = new Map(); // ip -> { count, resetTime }
 export const adminMetricsAuthCounts = new Map(); // ip -> { count, resetTime }
 export const roomListCooldowns = new Map(); // socketId -> last allowed timestamp
@@ -28,6 +31,7 @@ export const leaveRoomCounts = new Map();    // socketId -> { count, resetTime }
 export const rateLimitDenied = {
     connections: 0,
     events: 0,
+    chatMessages: 0,
     health: 0,
     adminMetricsAuth: 0,
     roomList: 0,
@@ -104,6 +108,17 @@ export function checkEventRate(socketId) {
     return false;
 }
 
+export function checkChatMessageRate(socketId) {
+    const now = Date.now();
+    const entry = chatMessageCounts.get(socketId) || { count: 0, resetTime: now + CHAT_MESSAGE_RATE_WINDOW_MS };
+    if (now > entry.resetTime) { entry.count = 0; entry.resetTime = now + CHAT_MESSAGE_RATE_WINDOW_MS; }
+    entry.count++;
+    chatMessageCounts.set(socketId, entry);
+    if (entry.count <= CHAT_MESSAGE_RATE_LIMIT) return true;
+    rateLimitDenied.chatMessages++;
+    return false;
+}
+
 export function checkHealthRate(ip) {
     const now = Date.now();
     const entry = healthCounts.get(ip) || { count: 0, resetTime: now + HEALTH_RATE_WINDOW_MS };
@@ -163,6 +178,11 @@ export function startRateLimitCleanup(io) {
                 eventCounts.delete(socketId);
             }
         }
+        for (const [socketId, entry] of chatMessageCounts.entries()) {
+            if (now > entry.resetTime || !io.sockets.sockets.has(socketId)) {
+                chatMessageCounts.delete(socketId);
+            }
+        }
         for (const [socketId, entry] of leaveRoomCounts.entries()) {
             if (now > entry.resetTime || !io.sockets.sockets.has(socketId)) {
                 leaveRoomCounts.delete(socketId);
@@ -189,6 +209,7 @@ export function clearRateLimitMaps() {
     connectionCounts.clear();
     failedAuthAttempts.clear();
     eventCounts.clear();
+    chatMessageCounts.clear();
 
     healthCounts.clear();
     adminMetricsAuthCounts.clear();

server/rate-limiter.test.mjs

@@ -1,6 +1,10 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import {
     checkLeaveRoomRate,
+    checkChatMessageRate,
+    CHAT_MESSAGE_RATE_LIMIT,
+    CHAT_MESSAGE_RATE_WINDOW_MS,
+    chatMessageCounts,
     LEAVE_ROOM_RATE_LIMIT,
     LEAVE_ROOM_RATE_WINDOW_MS,
     rateLimitDenied,
@@ -99,6 +103,32 @@ describe('LEAVE_ROOM Rate Limiter', () => {
     });
 });
 
+describe('CHAT_MESSAGE Rate Limiter', () => {
+    const socketId = 'chat-socket';
+
+    beforeEach(() => {
+        clearRateLimitMaps();
+        rateLimitDenied.chatMessages = 0;
+    });
+
+    afterEach(() => clearRateLimitMaps());
+
+    it('allows ten messages per ten-second window and blocks the next', () => {
+        for (let i = 0; i < CHAT_MESSAGE_RATE_LIMIT; i++) {
+            expect(checkChatMessageRate(socketId)).toBe(true);
+        }
+        expect(checkChatMessageRate(socketId)).toBe(false);
+        expect(rateLimitDenied.chatMessages).toBe(1);
+    });
+
+    it('resets after the window expires', () => {
+        for (let i = 0; i <= CHAT_MESSAGE_RATE_LIMIT; i++) checkChatMessageRate(socketId);
+        const entry = chatMessageCounts.get(socketId);
+        entry.resetTime = Date.now() - CHAT_MESSAGE_RATE_WINDOW_MS - 1;
+        expect(checkChatMessageRate(socketId)).toBe(true);
+    });
+});
+
 describe('Rate Limit Constants', () => {
     it('should have correct rate limit values', () => {
         expect(LEAVE_ROOM_RATE_LIMIT).toBe(10);

shared/constants.js

@@ -7,7 +7,7 @@
  */
 
 export const PROTOCOL_VERSION = "1.0.0";
-export const APP_VERSION = "2.6.0";
+export const APP_VERSION = "3.0.1";
 
 export const OFFICIAL_SERVER_URL = 'wss://syncserver.koalastuff.net';
 export const OFFICIAL_LANDING_PAGE_URL = 'https://sync.koalastuff.net';
@@ -57,6 +57,9 @@ export const EVENTS = {
     EPISODE_READY: "episode_ready",      // Response: loaded the episode and paused at 0:00
     EPISODE_LOBBY_CANCEL: "episode_lobby_cancel", // Broadcast: cancel active lobby and resume
 
+    // Ephemeral end-to-end encrypted chat
+    CHAT_MESSAGE: "chat_message", // Ciphertext relay; no server history
+
     // Ping / Latency
     PING: "ping",  // { t: timestamp, target?: peerId } — empty target = server echo
     PONG: "pong"   // server responds with same { t } for client RTT calculation
@@ -77,7 +80,9 @@ export const CONTROL_MODES = {
 // simply ignore the field. Add a flag here as each server-gated feature lands.
 export const CAPABILITIES = {
     HOST_CONTROL: 'host-control',
-    CO_HOST: 'co-host'  // owner promotes guests to additional controllers
+    CO_HOST: 'co-host',  // owner promotes guests to additional controllers
+    CHAT: 'chat',        // legacy server capability used by the first chat beta
+    CHAT_V1: 'chat-v1'   // versioned client/server chat wire contract
 };
 
 export const HEARTBEAT_INTERVAL = 15000; // 15s

shared/invite-links.js

@@ -0,0 +1,77 @@
+(function exposeInviteLinks(root) {
+    const J2_PREFIX = '#j2:';
+    const LEGACY_PREFIX = '#join:';
+
+    function parseJ2Hash(hash) {
+        if (typeof hash !== 'string' || !hash.startsWith(J2_PREFIX)) return null;
+        const params = new URLSearchParams(hash.slice(J2_PREFIX.length));
+        const roomId = params.get('r') || '';
+        const password = params.get('p') || '';
+        const chatKey = params.get('k') || '';
+        const serverUrl = params.get('u') || '';
+        if (!roomId || !password || !chatKey) return null;
+        return {
+            format: 'j2',
+            roomId,
+            password,
+            chatKey,
+            useCustomServer: serverUrl.length > 0,
+            serverUrl
+        };
+    }
+
+    function parseLegacyHash(hash) {
+        if (typeof hash !== 'string' || !hash.startsWith(LEGACY_PREFIX)) return null;
+        const parts = hash.slice(LEGACY_PREFIX.length).split(':');
+        const roomId = parts.shift() || '';
+        let useCustomServer = false;
+        let serverUrl = '';
+
+        if (parts.length >= 3) {
+            const flag = parts.at(-2);
+            const rawUrl = parts.at(-1) || '';
+            let decodedUrl = '';
+            try {
+                decodedUrl = decodeURIComponent(rawUrl);
+            } catch (_) {
+                return null;
+            }
+            const custom = flag === '1' && /^(?:ws|wss):\/\//.test(decodedUrl);
+            const official = flag === '0' && rawUrl === '';
+            if (custom || official) {
+                parts.splice(-2, 2);
+                useCustomServer = custom;
+                serverUrl = custom ? decodedUrl : '';
+            }
+        }
+
+        const password = parts.join(':');
+        if (!roomId || !password) return null;
+        return {
+            format: 'legacy',
+            roomId,
+            password,
+            chatKey: '',
+            useCustomServer,
+            serverUrl
+        };
+    }
+
+    function parseInviteHash(hash) {
+        return parseJ2Hash(hash) || parseLegacyHash(hash);
+    }
+
+    function buildJ2Hash({ roomId, password, chatKey, serverUrl = '' }) {
+        if (!roomId || !password || !chatKey) throw new TypeError('roomId, password, and chatKey are required');
+        const params = new URLSearchParams({ r: roomId, p: password, k: chatKey });
+        if (serverUrl) params.set('u', serverUrl);
+        return `${J2_PREFIX}${params.toString()}`;
+    }
+
+    root.KoalaSyncInviteLinks = Object.freeze({
+        J2_PREFIX,
+        LEGACY_PREFIX,
+        parseInviteHash,
+        buildJ2Hash
+    });
+})(globalThis);

shared/invite-links.test.js

@@ -0,0 +1,58 @@
+import { beforeAll, describe, expect, it } from 'vitest';
+
+beforeAll(async () => {
+    await import('./invite-links.js');
+});
+
+describe('invite links', () => {
+    it('round-trips official and custom j2 links', () => {
+        const api = globalThis.KoalaSyncInviteLinks;
+        const official = api.buildJ2Hash({
+            roomId: 'SAPPHIRE-DUCK-49',
+            password: '0X:UK3C',
+            chatKey: 'R5Ti1nxp0crfAFHf3gVncw'
+        });
+        expect(api.parseInviteHash(official)).toEqual({
+            format: 'j2',
+            roomId: 'SAPPHIRE-DUCK-49',
+            password: '0X:UK3C',
+            chatKey: 'R5Ti1nxp0crfAFHf3gVncw',
+            useCustomServer: false,
+            serverUrl: ''
+        });
+
+        const custom = api.buildJ2Hash({
+            roomId: 'SILENT-EAGLE-90',
+            password: '30PXPD',
+            chatKey: 'R5Ti1nxp0crfAFHf3gVncw',
+            serverUrl: 'wss://sync.example.test/socket?region=eu'
+        });
+        expect(api.parseInviteHash(custom)).toMatchObject({
+            useCustomServer: true,
+            serverUrl: 'wss://sync.example.test/socket?region=eu'
+        });
+    });
+
+    it('keeps legacy links compatible, including colons in passwords', () => {
+        const parse = globalThis.KoalaSyncInviteLinks.parseInviteHash;
+        expect(parse('#join:ROOM-1:pass:with:colons')).toMatchObject({
+            format: 'legacy',
+            password: 'pass:with:colons',
+            chatKey: '',
+            useCustomServer: false
+        });
+        expect(parse('#join:ROOM-1:pass:with:colons:1:wss%3A%2F%2Frelay.example')).toMatchObject({
+            password: 'pass:with:colons',
+            useCustomServer: true,
+            serverUrl: 'wss://relay.example'
+        });
+    });
+
+    it('rejects incomplete or malformed invite hashes', () => {
+        const parse = globalThis.KoalaSyncInviteLinks.parseInviteHash;
+        expect(parse('#j2:r=ROOM&p=PASS')).toBeNull();
+        expect(parse('#join:ROOM')).toBeNull();
+        expect(parse('#join:ROOM:PASS:1:%E0%A4%A')).toBeNull();
+        expect(parse('#other:r=ROOM&p=PASS&k=KEY')).toBeNull();
+    });
+});

vitest.config.mjs

@@ -8,7 +8,9 @@ export default defineConfig({
             'server/**/*.test.js',
             'server/**/*.test.mjs',
             'shared/**/*.test.js',
-            'shared/**/*.test.mjs'
+            'shared/**/*.test.mjs',
+            'extension/**/*.test.js',
+            'extension/**/*.test.mjs'
         ],
         coverage: {
             provider: 'v8',

website/404.html

@@ -135,7 +135,7 @@
         <div class="container">
             <p>&copy; 2026 KoalaSync. Open source under the MIT License.</p>
             <div style="margin-top: 1.5rem; font-size: 0.8rem; display: flex; justify-content: center; align-items: center; gap: 1.5rem; flex-wrap: wrap;">
-                <a href="/imprint" style="color: var(--text-muted); text-decoration: none;">Legal Notice</a>
+                <a href="https://koalastuff.net/legal" style="color: var(--text-muted); text-decoration: none;">Legal Notice</a>
                 <a href="/privacy" style="color: var(--text-muted); text-decoration: none;">Privacy Policy</a>
             </div>
         </div>

website/alternatives/index.html

@@ -183,7 +183,7 @@
             <div class="nav-links">
                 <a href="{{ASSET_PATH}}" style="display: inline-flex; align-items: center; gap: 6px;">
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" style="width: 16px; height: 16px; display: block;"><path d="m3 9 9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"></path><polyline points="9 22 9 12 15 12 15 22"></polyline></svg>
-                    <span>Home</span>
+                    <span>{{NAV_HOME}}</span>
                 </a>
                 <a href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener" style="display: inline-flex; align-items: center; gap: 6px;">
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" width="16" height="16" aria-hidden="true" style="display: block;"><path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"/></svg>
@@ -192,7 +192,7 @@
             </div>
             <div class="nav-right">
                 <div class="lang-select-container">
-                    <select class="lang-dropdown" aria-label="Select Language">
+                    <select class="lang-dropdown" aria-label="{{ARIA_SELECT_LANGUAGE}}">
                         <option value="en">🇬🇧 English</option>
                         <option value="de">🇩🇪 Deutsch</option>
                         <option value="fr">🇫🇷 Français</option>
@@ -211,7 +211,7 @@
                     </select>
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="chevron-icon"><polyline points="6 9 12 15 18 9"/></svg>
                 </div>
-                <button class="hamburger" aria-label="Menu" aria-expanded="false">☰</button>
+                <button class="hamburger" aria-label="{{ARIA_MENU}}" aria-expanded="false">☰</button>
             </div>
         </div>
     </nav>

website/alternatives/kosmi.html

@@ -189,7 +189,7 @@
             <div class="nav-links">
                 <a href="{{ASSET_PATH}}" style="display: inline-flex; align-items: center; gap: 6px;">
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" style="width: 16px; height: 16px; display: block;"><path d="m3 9 9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"></path><polyline points="9 22 9 12 15 12 15 22"></polyline></svg>
-                    <span>Home</span>
+                    <span>{{NAV_HOME}}</span>
                 </a>
                 <a href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener" style="display: inline-flex; align-items: center; gap: 6px;">
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" width="16" height="16" aria-hidden="true" style="display: block;"><path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"/></svg>
@@ -198,7 +198,7 @@
             </div>
             <div class="nav-right">
                 <div class="lang-select-container">
-                    <select class="lang-dropdown" aria-label="Select Language">
+                    <select class="lang-dropdown" aria-label="{{ARIA_SELECT_LANGUAGE}}">
                         <option value="en">🇬🇧 English</option>
                         <option value="de">🇩🇪 Deutsch</option>
                         <option value="fr">🇫🇷 Français</option>
@@ -217,7 +217,7 @@
                     </select>
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="chevron-icon"><polyline points="6 9 12 15 18 9"/></svg>
                 </div>
-                <button class="hamburger" aria-label="Menu" aria-expanded="false">☰</button>
+                <button class="hamburger" aria-label="{{ARIA_MENU}}" aria-expanded="false">☰</button>
             </div>
         </div>
     </nav>

website/alternatives/scener.html

@@ -189,7 +189,7 @@
             <div class="nav-links">
                 <a href="{{ASSET_PATH}}" style="display: inline-flex; align-items: center; gap: 6px;">
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" style="width: 16px; height: 16px; display: block;"><path d="m3 9 9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"></path><polyline points="9 22 9 12 15 12 15 22"></polyline></svg>
-                    <span>Home</span>
+                    <span>{{NAV_HOME}}</span>
                 </a>
                 <a href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener" style="display: inline-flex; align-items: center; gap: 6px;">
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" width="16" height="16" aria-hidden="true" style="display: block;"><path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"/></svg>
@@ -198,7 +198,7 @@
             </div>
             <div class="nav-right">
                 <div class="lang-select-container">
-                    <select class="lang-dropdown" aria-label="Select Language">
+                    <select class="lang-dropdown" aria-label="{{ARIA_SELECT_LANGUAGE}}">
                         <option value="en">🇬🇧 English</option>
                         <option value="de">🇩🇪 Deutsch</option>
                         <option value="fr">🇫🇷 Français</option>
@@ -217,7 +217,7 @@
                     </select>
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="chevron-icon"><polyline points="6 9 12 15 18 9"/></svg>
                 </div>
-                <button class="hamburger" aria-label="Menu" aria-expanded="false">☰</button>
+                <button class="hamburger" aria-label="{{ARIA_MENU}}" aria-expanded="false">☰</button>
             </div>
         </div>
     </nav>

website/alternatives/teleparty.html

@@ -189,7 +189,7 @@
             <div class="nav-links">
                 <a href="{{ASSET_PATH}}" style="display: inline-flex; align-items: center; gap: 6px;">
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" style="width: 16px; height: 16px; display: block;"><path d="m3 9 9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"></path><polyline points="9 22 9 12 15 12 15 22"></polyline></svg>
-                    <span>Home</span>
+                    <span>{{NAV_HOME}}</span>
                 </a>
                 <a href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener" style="display: inline-flex; align-items: center; gap: 6px;">
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" width="16" height="16" aria-hidden="true" style="display: block;"><path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"/></svg>
@@ -198,7 +198,7 @@
             </div>
             <div class="nav-right">
                 <div class="lang-select-container">
-                    <select class="lang-dropdown" aria-label="Select Language">
+                    <select class="lang-dropdown" aria-label="{{ARIA_SELECT_LANGUAGE}}">
                         <option value="en">🇬🇧 English</option>
                         <option value="de">🇩🇪 Deutsch</option>
                         <option value="fr">🇫🇷 Français</option>
@@ -217,7 +217,7 @@
                     </select>
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="chevron-icon"><polyline points="6 9 12 15 18 9"/></svg>
                 </div>
-                <button class="hamburger" aria-label="Menu" aria-expanded="false">☰</button>
+                <button class="hamburger" aria-label="{{ARIA_MENU}}" aria-expanded="false">☰</button>
             </div>
         </div>
     </nav>

website/alternatives/twoseven.html

@@ -189,7 +189,7 @@
             <div class="nav-links">
                 <a href="{{ASSET_PATH}}" style="display: inline-flex; align-items: center; gap: 6px;">
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" style="width: 16px; height: 16px; display: block;"><path d="m3 9 9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"></path><polyline points="9 22 9 12 15 12 15 22"></polyline></svg>
-                    <span>Home</span>
+                    <span>{{NAV_HOME}}</span>
                 </a>
                 <a href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener" style="display: inline-flex; align-items: center; gap: 6px;">
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" width="16" height="16" aria-hidden="true" style="display: block;"><path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"/></svg>
@@ -198,7 +198,7 @@
             </div>
             <div class="nav-right">
                 <div class="lang-select-container">
-                    <select class="lang-dropdown" aria-label="Select Language">
+                    <select class="lang-dropdown" aria-label="{{ARIA_SELECT_LANGUAGE}}">
                         <option value="en">🇬🇧 English</option>
                         <option value="de">🇩🇪 Deutsch</option>
                         <option value="fr">🇫🇷 Français</option>
@@ -217,7 +217,7 @@
                     </select>
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="chevron-icon"><polyline points="6 9 12 15 18 9"/></svg>
                 </div>
-                <button class="hamburger" aria-label="Menu" aria-expanded="false">☰</button>
+                <button class="hamburger" aria-label="{{ARIA_MENU}}" aria-expanded="false">☰</button>
             </div>
         </div>
     </nav>

website/alternatives/watch2gether.html

@@ -189,7 +189,7 @@
             <div class="nav-links">
                 <a href="{{ASSET_PATH}}" style="display: inline-flex; align-items: center; gap: 6px;">
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" style="width: 16px; height: 16px; display: block;"><path d="m3 9 9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"></path><polyline points="9 22 9 12 15 12 15 22"></polyline></svg>
-                    <span>Home</span>
+                    <span>{{NAV_HOME}}</span>
                 </a>
                 <a href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener" style="display: inline-flex; align-items: center; gap: 6px;">
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" width="16" height="16" aria-hidden="true" style="display: block;"><path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"/></svg>
@@ -198,7 +198,7 @@
             </div>
             <div class="nav-right">
                 <div class="lang-select-container">
-                    <select class="lang-dropdown" aria-label="Select Language">
+                    <select class="lang-dropdown" aria-label="{{ARIA_SELECT_LANGUAGE}}">
                         <option value="en">🇬🇧 English</option>
                         <option value="de">🇩🇪 Deutsch</option>
                         <option value="fr">🇫🇷 Français</option>
@@ -217,7 +217,7 @@
                     </select>
                     <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="chevron-icon"><polyline points="6 9 12 15 18 9"/></svg>
                 </div>
-                <button class="hamburger" aria-label="Menu" aria-expanded="false">☰</button>
+                <button class="hamburger" aria-label="{{ARIA_MENU}}" aria-expanded="false">☰</button>
             </div>
         </div>
     </nav>

website/app.js

@@ -1,6 +1,14 @@
 // KoalaSync Landing Page Logic
 
 document.addEventListener('DOMContentLoaded', () => {
+    const siteAccessBanner = document.querySelector('.site-access-banner');
+    const siteAccessBannerDismiss = document.querySelector('.site-access-banner-dismiss');
+    if (siteAccessBanner && siteAccessBannerDismiss) {
+        siteAccessBannerDismiss.addEventListener('click', () => {
+            siteAccessBanner.hidden = true;
+        });
+    }
+
     // Mockup Video Title Randomization on Load
     const SERIES_NAMES = [
         'Stranger Things',
@@ -227,20 +235,55 @@ document.addEventListener('DOMContentLoaded', () => {
 
     // Auto-update URL hash as user scrolls through sections
     // (preserves position across language switches)
-    if ('IntersectionObserver' in window) {
-        const sectionObserver = new IntersectionObserver((entries) => {
-            entries.forEach(entry => {
-                if (entry.isIntersecting) {
-                    if (entry.target.id === 'top') {
-                        history.replaceState(null, null, window.location.pathname + window.location.search);
-                    } else {
-                        history.replaceState(null, null, '#' + entry.target.id);
-                    }
-                    if (forestGreet) forestGreet();
-                }
+    const trackedSections = [...document.querySelectorAll('section[id], header[id]')];
+    if (trackedSections.length > 0) {
+        let hashUpdateFrame = null;
+        let hashNavigationTimer = null;
+        let hashNavigationInProgress = false;
+        const updateSectionHash = () => {
+            hashUpdateFrame = null;
+            const readingLine = 112;
+            const activeSection = trackedSections.reduce((closest, section) => {
+                const distance = Math.abs(section.getBoundingClientRect().top - readingLine);
+                const closestDistance = Math.abs(closest.getBoundingClientRect().top - readingLine);
+                return distance < closestDistance ? section : closest;
             });
-        }, { threshold: 0.3 });
-        document.querySelectorAll('section[id], header[id]').forEach(el => sectionObserver.observe(el));
+
+            const nextHash = activeSection.id === 'top' ? '' : '#' + activeSection.id;
+            if (window.location.hash === nextHash) return;
+            if (nextHash === '') {
+                history.replaceState(null, null, window.location.pathname + window.location.search);
+            } else {
+                history.replaceState(null, null, nextHash);
+            }
+            if (forestGreet) forestGreet();
+        };
+        const scheduleSectionHashUpdate = () => {
+            if (hashUpdateFrame !== null) return;
+            hashUpdateFrame = requestAnimationFrame(updateSectionHash);
+        };
+        const finishHashNavigation = () => {
+            hashNavigationTimer = null;
+            hashNavigationInProgress = false;
+            scheduleSectionHashUpdate();
+        };
+        const beginHashNavigation = () => {
+            hashNavigationInProgress = true;
+            if (hashNavigationTimer !== null) clearTimeout(hashNavigationTimer);
+            hashNavigationTimer = setTimeout(finishHashNavigation, 250);
+        };
+        const handleSectionScroll = () => {
+            if (!hashNavigationInProgress) {
+                scheduleSectionHashUpdate();
+                return;
+            }
+            if (hashNavigationTimer !== null) clearTimeout(hashNavigationTimer);
+            hashNavigationTimer = setTimeout(finishHashNavigation, 180);
+        };
+        window.addEventListener('hashchange', beginHashNavigation);
+        window.addEventListener('scroll', handleSectionScroll, { passive: true });
+        if (window.location.hash) beginHashNavigation();
+        else scheduleSectionHashUpdate();
     }
 
     // Navbar scroll effect (class-based so it follows the active theme)
@@ -449,15 +492,11 @@ document.addEventListener('DOMContentLoaded', () => {
         setTimeout(() => {
             const isInstalled = document.documentElement.dataset.koalasyncInstalled === 'true';
             
-            if (window.location.hash.startsWith('#join:')) {
-                const parts = window.location.hash.split(':');
-                if (parts.length >= 3) {
-                    const roomId = parts[1];
-                    const password = parts[2];
-                    const serverFlag = parts[3] || '0';
-                    const serverUrl = parts[4] ? decodeURIComponent(parts[4]) : '';
+            const invite = globalThis.KoalaSyncInviteLinks?.parseInviteHash(window.location.hash);
+            if (invite) {
+                const { roomId, password, chatKey, useCustomServer, serverUrl } = invite;
                     
-                    if (isJoinPage) {
+                if (isJoinPage) {
                         const displayRoom = document.getElementById('display-room-id');
                         const actions = document.getElementById('join-actions');
                         if (displayRoom) displayRoom.textContent = roomId;
@@ -519,14 +558,15 @@ document.addEventListener('DOMContentLoaded', () => {
                                         detail: { 
                                             roomId, 
                                             password,
-                                            useCustomServer: serverFlag === '1',
-                                            serverUrl: serverUrl
+                                            chatKey,
+                                            useCustomServer,
+                                            serverUrl
                                         }
                                     }));
                                 }, 500);
                             }
                         }
-                    } else {
+                } else {
                         // Fallback banner for index.html
                         if (!document.getElementById('koala-banner')) {
                             const banner = document.createElement('div');
@@ -556,22 +596,22 @@ document.addEventListener('DOMContentLoaded', () => {
                         }
                     }
 
-                    // Global listener for Join Button
-                    document.addEventListener('click', (e) => {
-                        if (e.target && e.target.id === 'webJoinBtn') {
-                            e.target.textContent = 'JOINING...';
-                            e.target.disabled = true;
-                            window.dispatchEvent(new CustomEvent('KOALASYNC_JOIN_REQUEST', {
-                                detail: { 
-                                    roomId, 
-                                    password,
-                                    useCustomServer: serverFlag === '1',
-                                    serverUrl: serverUrl
-                                }
-                            }));
-                        }
-                    });
-                }
+                // Global listener for Join Button
+                document.addEventListener('click', (e) => {
+                    if (e.target && e.target.id === 'webJoinBtn') {
+                        e.target.textContent = 'JOINING...';
+                        e.target.disabled = true;
+                        window.dispatchEvent(new CustomEvent('KOALASYNC_JOIN_REQUEST', {
+                            detail: {
+                                roomId,
+                                password,
+                                chatKey,
+                                useCustomServer,
+                                serverUrl
+                            }
+                        }));
+                    }
+                });
             }
         }, 600); // 600ms delay to ensure bridge.js has set the dataset
     };
@@ -1553,6 +1593,8 @@ document.addEventListener('DOMContentLoaded', () => {
             tempSpan.style.fontFamily = style.fontFamily;
             tempSpan.style.fontSize = style.fontSize;
             tempSpan.style.fontWeight = style.fontWeight;
+            tempSpan.style.fontStyle = style.fontStyle;
+            tempSpan.style.letterSpacing = style.letterSpacing;
             tempSpan.style.visibility = 'hidden';
             tempSpan.style.position = 'absolute';
             tempSpan.style.whiteSpace = 'nowrap';
@@ -1562,7 +1604,18 @@ document.addEventListener('DOMContentLoaded', () => {
                 tempSpan.textContent = activeOption.textContent;
                 document.body.appendChild(tempSpan);
                 const textWidth = tempSpan.getBoundingClientRect().width;
-                select.style.width = (textWidth + 18) + 'px';
+                const borderBoxChrome = style.boxSizing === 'border-box'
+                    ? [
+                        style.paddingLeft,
+                        style.paddingRight,
+                        style.borderLeftWidth,
+                        style.borderRightWidth
+                    ].reduce((total, value) => total + (Number.parseFloat(value) || 0), 0)
+                    : 0;
+                // Leave a few extra pixels for platform-specific native select
+                // text rendering. The right padding already reserves the
+                // visible chevron area.
+                select.style.width = `${Math.ceil(textWidth + borderBoxChrome + 4)}px`;
                 document.body.removeChild(tempSpan);
             }
         });
@@ -1707,6 +1760,9 @@ document.addEventListener('DOMContentLoaded', () => {
     updateDynamicVersion();
     localizeHomeLinks();
     initLanguageSelectorValue();
+    if (document.fonts?.ready) {
+        document.fonts.ready.then(adjustDropdownWidth);
+    }
     // FAQ Accordion Transition (Web Animations API for smooth vertical spring height collapse/expand)
     try {
         document.querySelectorAll('.faq-item').forEach(details => {

website/build.cjs

@@ -5,6 +5,7 @@
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
+const { execFileSync } = require('child_process');
 const sharp = require('sharp');
 const esbuild = require('esbuild');
 const htmlnano = require('htmlnano');
@@ -108,12 +109,22 @@ function stageFlagFontSubset(websiteDir, wwwDir) {
 function copyDirSync(src, dest) {
     fs.mkdirSync(dest, { recursive: true });
     for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+        if (entry.name === '.DS_Store') continue;
         const s = path.join(src, entry.name);
         const d = path.join(dest, entry.name);
         entry.isDirectory() ? copyDirSync(s, d) : fs.copyFileSync(s, d);
     }
 }
 
+function removeBuildMetadata(dir) {
+    if (!fs.existsSync(dir)) return;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const entryPath = path.join(dir, entry.name);
+        if (entry.name === '.DS_Store') fs.rmSync(entryPath, { force: true });
+        else if (entry.isDirectory()) removeBuildMetadata(entryPath);
+    }
+}
+
 function sha8(buf) { return crypto.createHash('sha256').update(buf).digest('hex').slice(0, 8); }
 function sha384(buf) { return 'sha384-' + crypto.createHash('sha384').update(buf).digest('base64'); }
 
@@ -163,6 +174,7 @@ async function compile() {
     const websiteDir = __dirname;
     const wwwDir = path.join(websiteDir, 'www');
     fs.mkdirSync(wwwDir, { recursive: true });
+    removeBuildMetadata(wwwDir);
 
     // ── 0. Auto-generate website logo sizes and sync favicons ──
     console.log('Generating responsive website logos...');
@@ -235,6 +247,7 @@ async function compile() {
         'styles/hero.css',
         'styles/landing-primary.css',
         'styles/legal.css',
+        'styles/support.css',
         'styles/landing-controls.css',
         'styles/join-spinner.css',
         'styles/landing-sections.css',
@@ -284,6 +297,12 @@ async function compile() {
     const appName = `app.${appHash}.min.js`;
     const appSRI = sha384(appMin);
 
+    const inviteLinksRaw = fs.readFileSync(path.join(websiteDir, '..', 'shared', 'invite-links.js'), 'utf8');
+    const inviteLinksMin = await minifyJS(inviteLinksRaw);
+    const inviteLinksHash = sha8(inviteLinksMin);
+    const inviteLinksName = `invite-links.${inviteLinksHash}.min.js`;
+    const inviteLinksSRI = sha384(inviteLinksMin);
+
     const langRaw = fs.readFileSync(path.join(websiteDir, 'lang-init.js'), 'utf8');
     const langMin = await minifyJS(langRaw);
     const langHash = sha8(langMin);
@@ -298,6 +317,7 @@ async function compile() {
         console.log(`  Landing ${bundle.key}: ${bundle.name} (${(bundle.min.length/1024).toFixed(1)} KB)`);
     }
     console.log(`  App: ${appName} (${(appMin.length/1024).toFixed(1)} KB, -${appPct}%)`);
+    console.log(`  Invite links: ${inviteLinksName} (${(inviteLinksMin.length/1024).toFixed(1)} KB)`);
     console.log(`  Lang: ${langName} (${(langMin.length/1024).toFixed(1)} KB, -${langPct}%)`);
 
     // ── 2. Clean stale minified output ──
@@ -314,6 +334,7 @@ async function compile() {
         fs.writeFileSync(path.join(wwwDir, bundle.name), bundle.min);
     }
     fs.writeFileSync(path.join(wwwDir, appName), appMin);
+    fs.writeFileSync(path.join(wwwDir, inviteLinksName), inviteLinksMin);
     fs.writeFileSync(path.join(wwwDir, langName), langMin);
 
     // ── 3. Compile HTML templates ──
@@ -514,6 +535,8 @@ async function compile() {
         { src: 'join.html', dest: 'join.html' },
         { src: 'imprint.html', dest: 'imprint.html' },
         { src: 'privacy.html', dest: 'privacy.html' },
+        { src: 'help.html', dest: 'help.html' },
+        { src: 'site-access-help.html', dest: 'site-access-help.html' },
         { src: 'impressum-de.html', dest: 'de/impressum.html' },
         { src: 'datenschutz-de.html', dest: 'de/datenschutz.html' },
         { src: 'impressum.html', dest: 'impressum.html' },
@@ -539,7 +562,7 @@ async function compile() {
     }
 
     // ── 5.5 Generate dynamic sitemap ──
-    generateSitemap(wwwDir);
+    generateSitemap(websiteDir, wwwDir);
 
     // Auto-copy Google verification files and IndexNow/txt key files from website source to www root
     const websiteFiles = fs.readdirSync(websiteDir);
@@ -652,6 +675,9 @@ async function compile() {
         html = html.replace(/(<script\b[^>]*?\bsrc=")((?:\.\.\/)*\/?)app\.min\.js"/g, (m, before, prefix) => {
             return `${before}${prefix}${appName}" integrity="${appSRI}" crossorigin="anonymous"`;
         });
+        html = html.replace(/(<script\b[^>]*?\bsrc=")((?:\.\.\/)*\/?)invite-links\.min\.js"/g, (m, before, prefix) => {
+            return `${before}${prefix}${inviteLinksName}" integrity="${inviteLinksSRI}" crossorigin="anonymous"`;
+        });
         html = html.replace(/(<script\b[^>]*?\bsrc=")((?:\.\.\/)*\/?)lang-init\.min\.js"/g, (m, before, prefix) => {
             return `${before}${prefix}${langName}" integrity="${langSRI}" crossorigin="anonymous"`;
         });
@@ -684,7 +710,7 @@ async function compile() {
     console.log('KoalaSync build finished successfully! Output: website/www/');
 }
 
-function generateSitemap(wwwDir) {
+function generateSitemap(websiteDir, wwwDir) {
     const languages = [
       { code: 'en', prefix: '', hreflang: 'en' },
       { code: 'de', prefix: 'de/', hreflang: 'de' },
@@ -703,48 +729,102 @@ function generateSitemap(wwwDir) {
       { code: 'pt', prefix: 'pt/', hreflang: 'pt' }
     ];
 
-    const today = new Date().toISOString().split('T')[0];
+    const repoRoot = path.resolve(websiteDir, '..');
+    const lastModifiedCache = new Map();
+    const dirtySourceFiles = new Set();
+    let gitHistoryAvailable = false;
+    let usedDirtySourceDate = false;
+
+    try {
+      const isInsideWorkTree = execFileSync(
+        'git', ['rev-parse', '--is-inside-work-tree'],
+        { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+      ).trim() === 'true';
+      const isShallow = execFileSync(
+        'git', ['rev-parse', '--is-shallow-repository'],
+        { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+      ).trim() === 'true';
+      gitHistoryAvailable = isInsideWorkTree && !isShallow;
+
+      if (gitHistoryAvailable) {
+        const dirtyCommands = [
+          ['diff', '--name-only', '--'],
+          ['diff', '--cached', '--name-only', '--'],
+          ['ls-files', '--others', '--exclude-standard', '--']
+        ];
+        for (const args of dirtyCommands) {
+          const output = execFileSync(
+            'git', args,
+            { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+          );
+          for (const file of output.split(/\r?\n/).filter(Boolean)) {
+            dirtySourceFiles.add(file.replaceAll('\\', '/'));
+          }
+        }
+      }
+    } catch (_) {
+      gitHistoryAvailable = false;
+    }
+
+    function getLastModified(sourceFiles) {
+      const cacheKey = sourceFiles.slice().sort().join('\0');
+      if (lastModifiedCache.has(cacheKey)) return lastModifiedCache.get(cacheKey);
+      if (!gitHistoryAvailable) {
+        lastModifiedCache.set(cacheKey, null);
+        return null;
+      }
+      let date = null;
+      try {
+        if (sourceFiles.some(file => dirtySourceFiles.has(file))) {
+          usedDirtySourceDate = true;
+          date = new Date().toISOString().slice(0, 10);
+        } else {
+          const output = execFileSync(
+            'git',
+            ['log', '-1', '--format=%cs', '--', ...sourceFiles],
+            { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+          ).trim();
+          if (/^\d{4}-\d{2}-\d{2}$/.test(output)) date = output;
+        }
+      } catch (_) {
+        // Source archives and minimal deployment environments may not contain
+        // Git metadata. Omitting lastmod is more accurate than inventing a date.
+      }
+      lastModifiedCache.set(cacheKey, date);
+      return date;
+    }
+
+    function lastmod(sourceFiles, indent = '    ') {
+      const date = getLastModified(sourceFiles);
+      return date ? `\n${indent}<lastmod>${date}</lastmod>` : '';
+    }
 
     let xml = `<?xml version="1.0" encoding="UTF-8"?>
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"
         xmlns:xhtml="http://www.w3.org/1999/xhtml">`;
 
-    // Static legal pages
+    // Static project-specific policy and help pages
     xml += `
   <url>
-    <loc>https://sync.koalastuff.net/imprint</loc>
-    <lastmod>${today}</lastmod>
-    <changefreq>monthly</changefreq>
-    <priority>0.3</priority>
+    <loc>https://sync.koalastuff.net/privacy</loc>${lastmod(['website/privacy.html'])}
   </url>
   <url>
-    <loc>https://sync.koalastuff.net/privacy</loc>
-    <lastmod>${today}</lastmod>
-    <changefreq>monthly</changefreq>
-    <priority>0.3</priority>
+    <loc>https://sync.koalastuff.net/help</loc>${lastmod(['website/help.html', 'website/styles/support.css', 'website/app.js'])}
   </url>
   <url>
-    <loc>https://sync.koalastuff.net/de/impressum</loc>
-    <lastmod>${today}</lastmod>
-    <changefreq>monthly</changefreq>
-    <priority>0.3</priority>
+    <loc>https://sync.koalastuff.net/site-access-help</loc>${lastmod(['website/site-access-help.html', 'website/app.js'])}
   </url>
   <url>
-    <loc>https://sync.koalastuff.net/de/datenschutz</loc>
-    <lastmod>${today}</lastmod>
-    <changefreq>monthly</changefreq>
-    <priority>0.3</priority>
+    <loc>https://sync.koalastuff.net/de/datenschutz</loc>${lastmod(['website/datenschutz-de.html'])}
   </url>`;
 
-    function addPage(relativePath, changefreq, priority) {
+    function addPage(relativePath, templateSource) {
       for (const lang of languages) {
         const loc = `https://sync.koalastuff.net/${lang.prefix}${relativePath}`;
+        const sourceFiles = [templateSource, `website/locales/${lang.code}.json`];
         xml += `
   <url>
-    <loc>${loc}</loc>
-    <lastmod>${today}</lastmod>
-    <changefreq>${changefreq}</changefreq>
-    <priority>${priority}</priority>`;
+    <loc>${loc}</loc>${lastmod(sourceFiles)}`;
         for (const alt of languages) {
           const altHref = `https://sync.koalastuff.net/${alt.prefix}${relativePath}`;
           xml += `
@@ -757,24 +837,26 @@ function generateSitemap(wwwDir) {
       }
     }
 
-    addPage('', 'weekly', '1.0');
-    addPage('alternatives', 'weekly', '0.7');
+    addPage('', 'website/template.html');
+    addPage('alternatives', 'website/alternatives/index.html');
 
     const subpages = [
-      'alternatives/teleparty',
-      'alternatives/screen-sharing',
-      'alternatives/watch2gether',
-      'alternatives/scener',
-      'alternatives/kosmi',
-      'alternatives/twoseven'
+      ['alternatives/teleparty', 'website/alternatives/teleparty.html'],
+      ['alternatives/screen-sharing', 'website/alternatives/screen-sharing.html'],
+      ['alternatives/watch2gether', 'website/alternatives/watch2gether.html'],
+      ['alternatives/scener', 'website/alternatives/scener.html'],
+      ['alternatives/kosmi', 'website/alternatives/kosmi.html'],
+      ['alternatives/twoseven', 'website/alternatives/twoseven.html']
     ];
-    for (const sub of subpages) {
-      addPage(sub, 'weekly', '0.7');
+    for (const [sub, templateSource] of subpages) {
+      addPage(sub, templateSource);
     }
 
     xml += `\n</urlset>\n`;
 
     fs.writeFileSync(path.join(wwwDir, 'sitemap.xml'), xml.trim() + '\n', 'utf8');
-    console.log('  ✓ Dynamically generated sitemap.xml with current date');
+    const datedEntries = (xml.match(/<lastmod>/g) || []).length;
+    const dateSource = usedDirtySourceDate ? 'Git/working-tree-derived' : 'Git-derived';
+    console.log(`  ✓ Dynamically generated sitemap.xml with ${datedEntries} ${dateSource} modification dates`);
 }
 compile().catch(err => { console.error('Build failed:', err); process.exit(1); });

website/datenschutz-de.html

@@ -11,7 +11,7 @@
     <link rel="alternate" hreflang="en" href="https://sync.koalastuff.net/privacy">
     <link rel="alternate" hreflang="de" href="https://sync.koalastuff.net/de/datenschutz">
     <link rel="alternate" hreflang="x-default" href="https://sync.koalastuff.net/privacy">
-    <meta name="description" content="Datenschutzerklärung von KoalaSync - Wir nehmen Datenschutz ernst. Erfahre mehr über unseren Ansatz ohne Tracking, ohne Logs und ohne Cookies.">
+    <meta name="description" content="Datenschutzerklärung von KoalaSync. Erfahre, wie Live-Raumdaten, verschlüsselter Chat, Betriebslogs und Website-Access-Logs verarbeitet werden.">
     <meta name="robots" content="index, follow">
 
     <script type="application/ld+json">
@@ -31,7 +31,7 @@
       "@type": "WebPage",
       "name": "Datenschutzerklärung",
       "url": "https://sync.koalastuff.net/de/datenschutz",
-      "description": "Datenschutzerklärung von KoalaSync - Wir nehmen Datenschutz ernst. Erfahre mehr über unseren Ansatz ohne Tracking, ohne Logs und ohne Cookies.",
+      "description": "Datenschutzerklärung von KoalaSync. Erfahre, wie Live-Raumdaten, verschlüsselter Chat, Betriebslogs und Website-Access-Logs verarbeitet werden.",
       "inLanguage": "de",
       "isPartOf": {
         "@type": "WebSite",
@@ -202,11 +202,20 @@
             <section>
                 <h2>4. Offizieller Relay-Server & Raumdaten</h2>
                 <p>
-                    Der offizielle KoalaSync-Relay-Server führt keine persistenten Logs. Er speichert keine Raumhistorie, keinen Sync-Verlauf, keinen Wiedergabeverlauf, keine Raumnachrichten, keine Playback-Events, keine Tab-Titel und keine Medientitel auf Festplatte.
+                    Der offizielle KoalaSync-Relay-Server erstellt keine Raum-, Chat-, Synchronisations- oder Wiedergabehistorie. Betriebslogs für Sicherheit und Fehleranalyse können IP-Adressen, Socket- oder Peer-IDs, Protokollversionen und gekürzte Room-IDs enthalten. Ihre Aufbewahrungsdauer hängt von der Server-Infrastruktur und deren Logging-Konfiguration ab.
                 </p>
                 <p style="margin-top: 0.5rem;">
                     Zur Bereitstellung der Raumfunktion verarbeitet der Relay Raum- und Synchronisationsdaten temporär im Arbeitsspeicher, solange ein Raum aktiv ist. Dazu können Room-ID, Peer-ID, Anzeigename, Wiedergabestatus, Sync-Events und – abhängig von den Titel-Privatsphäre-Einstellungen – Tab-/Medientitel gehören. Diese Daten werden nur an Teilnehmer desselben Raums weitergeleitet und aus dem Arbeitsspeicher entfernt, wenn der Raum abläuft oder geschlossen wird.
                 </p>
+                <p style="margin-top: 0.5rem;">
+                    Der Inhalt von Raum-Chatnachrichten wird bereits in der Browser-Erweiterung vor der Übertragung Ende-zu-Ende verschlüsselt. KoalaSync leitet lokal aus der Room-ID und einem zufällig erzeugten Chat-Secret einen 256-Bit-Schlüssel für AES-GCM ab. Das Chat-Secret wird über den Einladungslink geteilt und von der Erweiterung lokal gespeichert; es ist nicht Bestandteil der an den Relay gesendeten Chat-Nutzdaten.
+                </p>
+                <p style="margin-top: 0.5rem;">
+                    Der Relay erhält ausschließlich den verschlüsselten Nachrichteninhalt sowie die für die Live-Zustellung erforderlichen technischen Metadaten, beispielsweise Absender-ID, Nachrichten-ID und Zeitstempel. Da der Relay das Chat-Secret nicht erhält, kann er den Nachrichtentext nicht entschlüsseln oder lesen. Er leitet den verschlüsselten Inhalt an die aktuell verbundenen Teilnehmer desselben Raums weiter und erstellt keine serverseitige Chat-Historie, schreibt keine Nachrichten auf Festplatte und bewahrt sie nach der Live-Weiterleitung nicht auf.
+                </p>
+                <p style="margin-top: 0.5rem;">
+                    Wer einen gültigen Einladungslink einschließlich Chat-Secret erhält, kann Nachrichten dieses Raums möglicherweise entschlüsseln. Einladungslinks sollten daher ausschließlich mit den vorgesehenen Teilnehmern geteilt werden.
+                </p>
                 <p style="margin-top: 0.5rem;">
                     Rechtsgrundlage: Art. 6 Abs. 1 lit. f DSGVO, berechtigtes Interesse an der Bereitstellung der gewünschten Synchronisationsfunktion, Sicherheit und Missbrauchsprävention.
                 </p>
@@ -221,7 +230,13 @@
                     Zur Synchronisierung der Wiedergabe zwischen Teilnehmern desselben Raums erfasst die KoalaSync Browser-Erweiterung temporär Daten des aktuell aktiven Video-Tabs (z. B. Tab-Titel, Medien-Metadaten wie den Videotitel sowie den Wiedergabestatus). Tab- oder Medientitel können je nach Inhalt potenziell personenbezogen sein. Sie werden nur für die Synchronisationsfunktion verarbeitet, können über die Privatsphäre-Einstellungen der Erweiterung eingeschränkt oder deaktiviert werden, werden nur an Teilnehmer desselben Raums weitergeleitet und vom Relay nicht protokolliert oder dauerhaft gespeichert.
                 </p>
                 <p style="margin-top: 0.5rem;">
-                    Die Erweiterung speichert nur für den Betrieb erforderliche Einstellungen lokal im Browser, z. B. Anzeigename, Server-URL, aktuelle Raumdaten, Sprache, Titel-Privatsphäre-Einstellungen, Benachrichtigungseinstellungen und Audio-Processing-Einstellungen. KoalaSync speichert keinen allgemeinen Browserverlauf und keinen persistenten Wiedergabeverlauf.
+                    Die Erweiterung speichert nur für den Betrieb erforderliche Einstellungen lokal im Browser, z. B. Anzeigename, Server-URL, aktuelle Raumdaten einschließlich Chat-Secret, Sprache, Titel-Privatsphäre-Einstellungen, Benachrichtigungseinstellungen und Audio-Processing-Einstellungen. KoalaSync speichert keinen allgemeinen Browserverlauf und keinen persistenten Wiedergabeverlauf.
+                </p>
+                <p style="margin-top: 0.5rem;">
+                    Entschlüsselte Chatnachrichten werden ausschließlich im Arbeitsspeicher des Overlays im aktuellen Video-Tab gehalten; sichtbar bleiben höchstens 200 Nachrichten- oder Aktivitätseinträge. Sie werden nicht in den Browser-Speicher geschrieben und verschwinden, wenn der Chat zurückgesetzt oder entfernt, die Seite neu geladen oder die Raumsitzung beendet wird. Im Chat angezeigte Wiedergabe- und Anwesenheitseinträge werden lokal aus bereits vorhandenen Raum-Events erzeugt und erstellen keine separate serverseitige Historie.
+                </p>
+                <p style="margin-top: 0.5rem;">
+                    Wenn Chat-Benachrichtigungen aktiviert sind, werden der entschlüsselte Anzeigename und Nachrichtentext an die Benachrichtigungs-API des Browsers übergeben und können entsprechend den Einstellungen des Browsers oder Betriebssystems angezeigt oder dort vorgehalten werden. Chat-Benachrichtigungen können in den Einstellungen der Erweiterung deaktiviert werden.
                 </p>
                 <p style="margin-top: 0.5rem;">
                     Die Erweiterung verbindet sich nur mit dem Relay-Server, während Sie sich aktiv in einem Raum befinden. Es wird keine dauerhafte Hintergrundverbindung aufrechterhalten, sodass Ihre IP-Adresse dem Server nicht offengelegt wird, wenn Sie die Erweiterung nicht nutzen.
@@ -254,14 +269,14 @@
             <section>
                 <h2>8. Empfänger & Dritte</h2>
                 <p>
-                    Technische Hosting- und Verbindungsdaten können durch Hetzner als Hosting-Anbieter im Auftrag des Betreibers verarbeitet werden. Raum-Synchronisationsdaten werden nur an Teilnehmer desselben Raums weitergeleitet. KoalaSync verwendet keine Analytics-Anbieter, Werbenetzwerke oder Tracking-Dienste.
+                    Technische Hosting- und Verbindungsdaten können durch Hetzner als Hosting-Anbieter im Auftrag des Betreibers verarbeitet werden. Raum-Synchronisationsdaten werden nur an Teilnehmer desselben Raums weitergeleitet. Verschlüsselte Raum-Chat-Nutzdaten und deren Zustellungsmetadaten werden ebenfalls nur innerhalb des Raums weitergeleitet; lesbarer Nachrichteninhalt steht nur Teilnehmern zur Verfügung, die das Chat-Secret besitzen. KoalaSync verwendet keine Analytics-Anbieter, Werbenetzwerke oder Tracking-Dienste.
                 </p>
             </section>
 
             <section>
                 <h2>9. Erforderliche & optionale Daten</h2>
                 <p>
-                    Die Bereitstellung technischer Verbindungsdaten ist erforderlich, um die Website aufzurufen und den Relay zu nutzen. Raumdaten und Sync-Events sind erforderlich, um die Raumsynchronisation zu verwenden. Das Teilen von Tab-/Medientitel ist optional und kann über die Privatsphäre-Einstellungen der Erweiterung eingeschränkt werden.
+                    Die Bereitstellung technischer Verbindungsdaten ist erforderlich, um die Website aufzurufen und den Relay zu nutzen. Raumdaten und Sync-Events sind erforderlich, um die Raumsynchronisation zu verwenden. Der Text-Chat ist optional; bei seiner Nutzung sind verschlüsselte Nachrichten-Nutzdaten und Zustellungsmetadaten für die Live-Zustellung erforderlich. Das Teilen von Tab-/Medientiteln und Browser-Benachrichtigungen sind optional und können über die Privatsphäre-Einstellungen der Erweiterung gesteuert werden.
                 </p>
             </section>
 
@@ -295,9 +310,9 @@
     <footer>
         <div class="container">
             <p>&copy; 2026 KoalaSync. Open Source unter der MIT-Lizenz.</p>
-            <p style="font-size: 0.8rem; margin-top: 0.5rem;">Keine Relay-Logs. Kein Tracking. Website-Access-Logs werden nach 7 Tagen gelöscht.</p>
+            <p style="font-size: 0.8rem; margin-top: 0.5rem;">Keine Chat- oder Wiedergabehistorie. Kein Tracking. Website-Access-Logs werden nach 7 Tagen gelöscht.</p>
             <div style="margin-top: 1.5rem; font-size: 0.8rem; display: flex; justify-content: center; align-items: center; gap: 1.5rem; flex-wrap: wrap;">
-                <a href="impressum" style="color: var(--text-muted); text-decoration: none;">Impressum</a>
+                <a href="https://koalastuff.net/legal" style="color: var(--text-muted); text-decoration: none;">Impressum</a>
                 <a href="datenschutz" style="color: var(--text-muted); text-decoration: none;">Datenschutz</a>
                 <a href="alternatives/teleparty">Vergleiche & Anleitungen</a>
                 <a href="https://mastodon.social/@koalastuff" rel="me noopener" target="_blank" style="color: var(--text-muted); text-decoration: none; display: inline-flex; align-items: center; gap: 4px;">

website/help.html

@@ -0,0 +1,457 @@
+<!DOCTYPE html>
+<html lang="en" class="lang-en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>KoalaSync Help | Setup, Chat, Privacy & Troubleshooting</title>
+    <meta name="description" content="Get KoalaSync working, fix invite and chat problems, understand supported devices and data handling, and verify official open-source releases.">
+    <meta name="robots" content="index, follow">
+    <link rel="preload" href="style.min.css" as="style">
+    <link rel="stylesheet" href="style.min.css">
+    <link rel="icon" type="image/png" sizes="32x32" href="assets/favicon-32x32.png">
+    <link rel="canonical" href="https://sync.koalastuff.net/help">
+    <link rel="alternate" hreflang="en" href="https://sync.koalastuff.net/help">
+    <link rel="alternate" hreflang="x-default" href="https://sync.koalastuff.net/help">
+    <link rel="alternate" type="text/markdown" href="https://sync.koalastuff.net/llms.txt" title="KoalaSync information for AI assistants">
+    <meta property="og:type" content="website">
+    <meta property="og:url" content="https://sync.koalastuff.net/help">
+    <meta property="og:title" content="KoalaSync Help">
+    <meta property="og:description" content="Setup help, invite troubleshooting, encrypted chat, supported devices, privacy, open-source releases, and reproducible bug reports.">
+    <meta property="og:image" content="https://sync.koalastuff.net/assets/og-image.png">
+    <meta property="og:image:width" content="1280">
+    <meta property="og:image:height" content="640">
+    <meta property="og:image:type" content="image/png">
+    <meta property="og:image:alt" content="KoalaSync browser extension">
+    <meta property="og:site_name" content="KoalaSync">
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="KoalaSync Help">
+    <meta name="twitter:description" content="Setup help, invite troubleshooting, encrypted chat, supported devices, privacy, open-source releases, and reproducible bug reports.">
+    <meta name="twitter:image" content="https://sync.koalastuff.net/assets/og-image.png">
+    <meta name="twitter:image:alt" content="KoalaSync browser extension">
+    <meta name="theme-color" content="#10190e">
+    <script type="application/ld+json">
+    {
+      "@context": "https://schema.org",
+      "@graph": [
+        {
+          "@type": "WebSite",
+          "@id": "https://sync.koalastuff.net/#website",
+          "name": "KoalaSync",
+          "url": "https://sync.koalastuff.net/"
+        },
+        {
+          "@type": "Organization",
+          "@id": "https://sync.koalastuff.net/#organization",
+          "name": "KoalaSync",
+          "url": "https://sync.koalastuff.net/",
+          "logo": "https://sync.koalastuff.net/assets/NewLogoIcon.webp",
+          "sameAs": ["https://github.com/Shik3i/KoalaSync"]
+        },
+        {
+          "@type": ["CollectionPage", "FAQPage"],
+          "@id": "https://sync.koalastuff.net/help#webpage",
+          "name": "KoalaSync Help",
+          "headline": "KoalaSync Help: Setup, Chat, Privacy and Troubleshooting",
+          "description": "Help for joining rooms, granting browser access, fixing encrypted room chat and playback synchronization, understanding data handling, and verifying official releases.",
+          "url": "https://sync.koalastuff.net/help",
+          "datePublished": "2026-07-28",
+          "dateModified": "2026-07-28",
+          "inLanguage": "en",
+          "isPartOf": {"@id": "https://sync.koalastuff.net/#website"},
+          "publisher": {"@id": "https://sync.koalastuff.net/#organization"},
+          "mainEntity": [
+            {
+              "@type": "Question",
+              "name": "Why does the browser show such a broad permission warning for KoalaSync?",
+              "acceptedAnswer": {
+                "@type": "Answer",
+                "text": "KoalaSync works with video players across many websites. It uses access on the video tab you actively select to find and control the video element, synchronize playback, and display optional room chat. Open tab titles populate the tab selector; KoalaSync does not create a general browsing or watch history."
+              }
+            },
+            {
+              "@type": "Question",
+              "name": "Why does a KoalaSync invite link not join the room?",
+              "acceptedAnswer": {
+                "@type": "Answer",
+                "text": "Open the complete invite link in the same desktop browser profile where KoalaSync is installed. If the invite page was already open when the extension was installed or enabled, reload it. Confirm that the browser allows KoalaSync to run on sync.koalastuff.net, then ask the sender for a newly copied invite if the link is incomplete."
+              }
+            },
+            {
+              "@type": "Question",
+              "name": "Why does a video tab not appear in KoalaSync?",
+              "acceptedAnswer": {
+                "@type": "Answer",
+                "text": "Reload the video page, reopen KoalaSync, and disable Hide Clutter Tabs in Settings. If the tab then appears, report the domain because it was filtered by mistake. Otherwise, verify that KoalaSync has website access."
+              }
+            },
+            {
+              "@type": "Question",
+              "name": "Why does KoalaSync find no video on a listed tab?",
+              "acceptedAnswer": {
+                "@type": "Answer",
+                "text": "Select the tab containing the visible player and start playback once. Check Video Debug Info in the Status tab, reload after permission changes, and temporarily disable extensions that modify the player. Some protected or non-HTML5 players may need site-specific support."
+              }
+            },
+            {
+              "@type": "Question",
+              "name": "Why does KoalaSync room chat not work for everyone?",
+              "acceptedAnswer": {
+                "@type": "Answer",
+                "text": "Room chat requires KoalaSync 3.0.0 or newer. The room creator receives a chat encryption secret when creating a new room, and every friend must join through that room's current invite link to receive the same secret. Manual room entry and old invite links can still join playback synchronization, but do not provide chat access."
+              }
+            },
+            {
+              "@type": "Question",
+              "name": "Why are connected KoalaSync participants not synchronized?",
+              "acceptedAnswer": {
+                "@type": "Answer",
+                "text": "Confirm that everyone uses the same KoalaSync version and selected the correct local video tab. Reload after website-access changes, test play, pause, and seeking separately, and collect a debug report from each affected participant."
+              }
+            },
+            {
+              "@type": "Question",
+              "name": "Does KoalaSync stream the video to other participants?",
+              "acceptedAnswer": {
+                "@type": "Answer",
+                "text": "No. KoalaSync does not stream, upload, proxy, share, or bypass access to video content. Everyone watches locally in their own browser and needs their own access to the website or streaming service. KoalaSync only synchronizes playback actions such as play, pause, and seeking."
+              }
+            },
+            {
+              "@type": "Question",
+              "name": "Which devices and browsers support KoalaSync?",
+              "acceptedAnswer": {
+                "@type": "Answer",
+                "text": "KoalaSync is a desktop browser extension for Chrome, Firefox, Edge, and compatible Chromium-based browsers on Windows, macOS, Linux, and ChromeOS. It does not currently provide a mobile app or Safari extension. Website compatibility also depends on the site's video player."
+              }
+            },
+            {
+              "@type": "Question",
+              "name": "What data does KoalaSync send from the browser?",
+              "acceptedAnswer": {
+                "@type": "Answer",
+                "text": "While you are in a room, KoalaSync sends the room, peer, and playback data needed for live synchronization. Display names and, depending on privacy settings, tab or media titles may be shared with room participants. Chat text is encrypted in the extension before transmission. KoalaSync does not create a persistent chat, browsing, synchronization, or watch history."
+              }
+            },
+            {
+              "@type": "Question",
+              "name": "How can official KoalaSync releases be verified?",
+              "acceptedAnswer": {
+                "@type": "Answer",
+                "text": "The extension, relay server, build scripts, release workflow, and Dockerfile are public under the MIT License. Extension ZIPs on GitHub Releases and Docker images on GitHub Container Registry receive signed provenance attestations that bind their exact digest to this repository, a release tag and commit, and the public GitHub Actions workflow."
+              }
+            }
+          ]
+        },
+        {
+          "@type": "BreadcrumbList",
+          "@id": "https://sync.koalastuff.net/help#breadcrumb",
+          "itemListElement": [
+            {
+              "@type": "ListItem",
+              "position": 1,
+              "name": "KoalaSync",
+              "item": "https://sync.koalastuff.net/"
+            },
+            {
+              "@type": "ListItem",
+              "position": 2,
+              "name": "Help",
+              "item": "https://sync.koalastuff.net/help"
+            }
+          ]
+        }
+      ]
+    }
+    </script>
+    <script src="lang-init.min.js"></script>
+</head>
+<body class="support-page">
+    <div class="scroll-progress-bar"></div>
+    <a class="skip-link" href="#main-content">Skip to help topics</a>
+
+    <nav>
+        <div class="container nav-content">
+            <a class="logo-area" href="./" aria-label="KoalaSync home">
+                <img class="nav-logo-img" src="assets/NewLogoIcon_128.webp" srcset="assets/NewLogoIcon_64.webp 64w, assets/NewLogoIcon_128.webp 128w, assets/NewLogoIcon.webp 256w" sizes="64px" alt="KoalaSync logo" width="64" height="64">
+                <span>KoalaSync</span>
+            </a>
+            <div class="nav-links" id="primary-nav" role="navigation" aria-label="Primary">
+                <a href="./">Home</a>
+                <a href="privacy">Privacy</a>
+                <a href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener">GitHub</a>
+            </div>
+            <div class="nav-right">
+                <button class="theme-toggle" id="theme-toggle" type="button" aria-label="Toggle light or dark theme" title="Toggle light or dark theme">
+                    <svg class="theme-icon-sun" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" width="18" height="18" aria-hidden="true"><circle cx="12" cy="12" r="4"/><path d="M12 2v2M12 20v2M4.93 4.93l1.41 1.41M17.66 17.66l1.41 1.41M2 12h2M20 12h2M6.34 17.66l-1.41 1.41M19.07 4.93l-1.41 1.41"/></svg>
+                    <svg class="theme-icon-moon" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" width="18" height="18" aria-hidden="true"><path d="M12 3a6 6 0 0 0 9 9 9 9 0 1 1-9-9Z"/></svg>
+                </button>
+                <button class="hamburger" aria-label="Toggle navigation menu" aria-expanded="false" aria-controls="primary-nav">
+                    <svg viewBox="0 0 24 24" width="24" height="24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" aria-hidden="true"><line x1="3" y1="6" x2="21" y2="6"/><line x1="3" y1="12" x2="21" y2="12"/><line x1="3" y1="18" x2="21" y2="18"/></svg>
+                </button>
+            </div>
+        </div>
+    </nav>
+
+    <main id="main-content" class="support-content">
+        <header class="support-hero">
+            <span class="support-status">Help center</span>
+            <h1>KoalaSync Help & Troubleshooting</h1>
+            <p class="support-lead">Start with the problem or question you have. These guides cover invites, browser access, video detection, encrypted chat, playback synchronization, supported devices, privacy, and release verification.</p>
+        </header>
+
+        <section class="support-topic-index" aria-labelledby="start-title">
+            <h2 id="start-title" class="support-section-title">Choose a help topic</h2>
+            <div class="support-topic-grid">
+                <article class="support-card support-topic-group">
+                    <header class="support-topic-header">
+                        <h3>Get connected</h3>
+                        <p>Join a room and give KoalaSync the access it needs.</p>
+                    </header>
+                    <div class="support-topic-links" role="navigation" aria-label="Get connected help">
+                        <a href="#invite-problems">The invite opens, but nothing happens</a>
+                        <a href="site-access-help">KoalaSync cannot access the video site</a>
+                        <a href="#missing-tab">The video tab does not appear</a>
+                    </div>
+                </article>
+                <article class="support-card support-topic-group">
+                    <header class="support-topic-header">
+                        <h3>Playback & chat</h3>
+                        <p>Fix the selected player, room chat, or synchronization.</p>
+                    </header>
+                    <div class="support-topic-links" role="navigation" aria-label="Playback and chat help">
+                        <a href="#video-detection">The tab appears, but KoalaSync finds no usable video</a>
+                        <a href="#room-chat">Chat does not work, or one person cannot see it</a>
+                        <a href="#sync-problems">Everyone is connected, but playback does not sync</a>
+                    </div>
+                </article>
+                <article class="support-card support-topic-group">
+                    <header class="support-topic-header">
+                        <h3>Using KoalaSync</h3>
+                        <p>Understand what the extension does and supports.</p>
+                    </header>
+                    <div class="support-topic-links" role="navigation" aria-label="Using KoalaSync help">
+                        <a href="#video-access">Does KoalaSync send the video to my friends?</a>
+                        <a href="#supported-devices">Which devices and browsers are supported?</a>
+                    </div>
+                </article>
+                <article class="support-card support-topic-group">
+                    <header class="support-topic-header">
+                        <h3>Privacy & trust</h3>
+                        <p>See what is shared and how official builds are verified.</p>
+                    </header>
+                    <div class="support-topic-links" role="navigation" aria-label="Privacy and trust help">
+                        <a href="#permissions">Why does the browser show such a broad warning?</a>
+                        <a href="#data-handling">What data leaves my browser?</a>
+                        <a href="#trust">Why should I trust KoalaSync?</a>
+                    </div>
+                </article>
+            </div>
+        </section>
+
+        <section id="invite-problems" class="support-card support-anchor-section" aria-labelledby="invite-problems-title">
+            <span class="support-eyebrow">Invite links</span>
+            <h2 id="invite-problems-title">The invite opens, but nothing happens</h2>
+            <ol class="support-steps">
+                <li>Open the invite in the same desktop browser profile where KoalaSync is installed. Extensions installed in another browser or profile cannot receive the join request.</li>
+                <li>If you installed, enabled, or updated KoalaSync after opening the invite, reload the invite page once so the extension can connect to it.</li>
+                <li>Confirm that KoalaSync is allowed to run on <code>sync.koalastuff.net</code>. If the browser blocks access, follow the <a class="support-link" href="site-access-help">site-access guide</a>, then reload the invite.</li>
+                <li>Ask the sender to open KoalaSync and copy the invite link again. Use the complete link without removing anything after <code>#</code>; that part contains the room credentials and current chat secret.</li>
+                <li>Wait for the join page to report success. Joining the room does not select a video automatically, so open KoalaSync afterward and choose your local video tab under <strong>Sync</strong>.</li>
+            </ol>
+            <div class="support-callout" role="note">
+                <span class="support-callout-icon" aria-hidden="true">i</span>
+                <div>
+                    <strong>The extension must be detected on the invite page.</strong>
+                    <p>If the page still offers an install button even though KoalaSync is installed, the usual causes are a different browser profile, blocked website access, or a page that was opened before the extension became available.</p>
+                </div>
+            </div>
+        </section>
+
+        <section id="missing-tab" class="support-card support-anchor-section" aria-labelledby="missing-tab-title">
+            <span class="support-eyebrow">Tab list</span>
+            <h2 id="missing-tab-title">The video tab does not appear</h2>
+            <ol class="support-steps">
+                <li>Keep the video page open and reload it once.</li>
+                <li>Close and reopen the KoalaSync popup, then check <strong>Select Video</strong> again.</li>
+                <li>Open KoalaSync <strong>Settings</strong> and turn off <strong>Hide Clutter Tabs</strong>.</li>
+                <li>Return to the tab selector. If the tab now appears, the site was filtered as clutter by mistake.</li>
+                <li>If the tab is still missing, verify website access using the <a class="support-link" href="site-access-help">site-access guide</a>.</li>
+            </ol>
+            <div class="support-callout" role="note">
+                <span class="support-callout-icon" aria-hidden="true">i</span>
+                <div>
+                    <strong>Tell us which domain was classified incorrectly.</strong>
+                    <p>For a false clutter match, report the domain, whether the tab appears with the filter disabled, and whether the page contains a visible HTML5 video. A domain such as <code>video.example.com</code> is usually enough; do not publish a private URL containing account or session details.</p>
+                </div>
+            </div>
+        </section>
+
+        <section id="video-detection" class="support-card support-anchor-section" aria-labelledby="video-detection-title">
+            <span class="support-eyebrow">Video detection</span>
+            <h2 id="video-detection-title">The tab appears, but KoalaSync finds no usable video</h2>
+            <ul>
+                <li>Select the exact tab containing the visible player, not a login, search, or media-library tab.</li>
+                <li>Start the video once. Some websites create their video element only after playback begins.</li>
+                <li>Open the KoalaSync <strong>Status</strong> tab and inspect <strong>Video Debug Info</strong>.</li>
+                <li>If the report says <strong>NO VIDEO ELEMENT</strong>, note the video count and whether Shadow DOM was detected.</li>
+                <li>Temporarily disable other extensions that modify the player, then reload and test again.</li>
+                <li>Protected, heavily customized, or non-HTML5 players may require site-specific support.</li>
+            </ul>
+        </section>
+
+        <section id="room-chat" class="support-card support-anchor-section" aria-labelledby="room-chat-title">
+            <span class="support-eyebrow">Room chat</span>
+            <h2 id="room-chat-title">Chat does not work, or one person cannot see it</h2>
+            <p>Room chat was introduced in KoalaSync 3.0.0. Every participant who wants to send or read chat messages needs version 3.0.0 or newer. Older versions can still join a room and synchronize playback, but they do not support room chat.</p>
+            <ol class="support-steps">
+                <li>Update KoalaSync in every browser. Open the extension and check the version in the top-right corner. Each participant needs version <strong>3.0.0 or newer</strong>.</li>
+                <li>After updating, the room creator should leave the old room and click <strong>Create New Room</strong>. This creates a new chat encryption secret and includes it in the new invite link.</li>
+                <li>Send that newly copied invite link to your friends. Each friend must leave the old room and join through the link so their extension receives the same chat encryption secret.</li>
+                <li>Do not join by typing only the room ID and password, and do not reuse an old invite link beginning with <code>#join:</code>. Both can connect playback synchronization, but neither contains the chat secret.</li>
+                <li>Each participant must select their local video tab, then open <strong>Settings → Room Chat</strong> and turn on <strong>Enable Room Chat</strong>. The chat appears on the selected video page, not inside the extension popup.</li>
+            </ol>
+            <div class="support-callout" role="note">
+                <span class="support-callout-icon" aria-hidden="true">i</span>
+                <div>
+                    <strong>Chat is live only.</strong>
+                    <p>There is no server-side message history. Someone who joins later sees only messages sent after they joined. Keep the invite link private: it contains the chat secret used to decrypt messages in that room.</p>
+                </div>
+            </div>
+        </section>
+
+        <section id="sync-problems" class="support-card support-anchor-section" aria-labelledby="sync-problems-title">
+            <span class="support-eyebrow">Synchronization</span>
+            <h2 id="sync-problems-title">Everyone is connected, but playback does not sync</h2>
+            <ol class="support-steps">
+                <li>Update KoalaSync in every browser and confirm everyone uses the same extension version.</li>
+                <li>Make sure each participant selected the correct local video tab.</li>
+                <li>Reload the video page after changing website access, then select the tab again.</li>
+                <li>Test play, pause, and seeking separately and note which action fails.</li>
+                <li>Before anyone leaves the room, collect a debug report from every affected participant.</li>
+            </ol>
+        </section>
+
+        <section id="video-access" class="support-card support-anchor-section" aria-labelledby="video-access-title">
+            <span class="support-eyebrow">Video access</span>
+            <h2 id="video-access-title">Does KoalaSync send the video to my friends?</h2>
+            <p>No. KoalaSync does not stream, upload, proxy, download, or redistribute video content. It only sends the live room and playback events needed to keep actions such as play, pause, and seeking synchronized.</p>
+            <ul>
+                <li>Everyone watches the video locally in their own browser on the original website.</li>
+                <li>Each participant needs their own valid access to the website or streaming service.</li>
+                <li>KoalaSync does not bypass subscriptions, logins, DRM, regional restrictions, or platform rules.</li>
+                <li>Subtitles, audio tracks, fullscreen, and video quality remain local choices when the video player supports them.</li>
+            </ul>
+        </section>
+
+        <section id="supported-devices" class="support-card support-anchor-section" aria-labelledby="supported-devices-title">
+            <span class="support-eyebrow">Compatibility</span>
+            <h2 id="supported-devices-title">Which devices and browsers are supported?</h2>
+            <p>KoalaSync is currently a desktop browser extension. It supports Google Chrome, Mozilla Firefox, Microsoft Edge, Opera, Brave, Vivaldi, and other compatible Chromium-based desktop browsers on Windows, macOS, Linux, and ChromeOS.</p>
+            <ul>
+                <li>There is currently no KoalaSync mobile app for phones or tablets.</li>
+                <li>There is currently no Safari extension.</li>
+                <li>Website compatibility depends on the browser and the site's video player. Websites can change their players, DRM behavior, or browser restrictions at any time.</li>
+                <li>Protected, customized, or non-HTML5 players may need site-specific support even in a supported browser.</li>
+            </ul>
+        </section>
+
+        <section id="permissions" class="support-card support-anchor-section" aria-labelledby="permissions-title">
+            <span class="support-eyebrow">Privacy & permissions</span>
+            <h2 id="permissions-title">Why does the browser show such a broad warning?</h2>
+            <p>Browsers may say that KoalaSync can “read and change all your data on all websites.” The wording is broad because KoalaSync is designed to work with video players across many different websites instead of a short fixed list.</p>
+            <p>KoalaSync injects its synchronization script into the video tab you actively select. On that tab it needs to find and control the video element, synchronize play, pause, and seeking, and display the optional room chat overlay. Open tab titles are read to populate the tab selector. KoalaSync does not create a general browsing or watch history.</p>
+            <p><a class="support-link" href="privacy#extension-permissions">Read the complete permission and data-handling explanation</a></p>
+        </section>
+
+        <section id="data-handling" class="support-card support-anchor-section" aria-labelledby="data-handling-title">
+            <span class="support-eyebrow">Privacy</span>
+            <h2 id="data-handling-title">What data leaves my browser?</h2>
+            <p>KoalaSync only connects to a relay while you are actively in a room. During that session, the relay temporarily processes the data required to connect participants and synchronize playback.</p>
+            <ul>
+                <li><strong>Room and presence:</strong> room ID, peer ID, display name, connection state, and the information needed to join the room.</li>
+                <li><strong>Playback synchronization:</strong> actions and state such as play, pause, seeking, and the current playback position.</li>
+                <li><strong>Titles:</strong> tab or media titles may be shared with room participants depending on your title privacy settings. They can be limited or disabled.</li>
+                <li><strong>Room chat:</strong> message text is encrypted in the extension before transmission. The relay receives ciphertext and delivery metadata, but not the chat secret or readable message text.</li>
+                <li><strong>Stored locally:</strong> preferences, current room credentials, and the chat secret are stored in the browser. The chat secret is not sent to the relay. Decrypted chat entries remain only in the current page overlay and are not written to browser storage.</li>
+                <li><strong>Operational logs:</strong> the relay may log technical connection and security information such as IP addresses, protocol versions, socket or peer identifiers, and shortened room identifiers. Retention depends on the server infrastructure and configuration.</li>
+            </ul>
+            <p>KoalaSync does not create a persistent browsing, room, synchronization, chat, or watch history. Browser or operating-system notifications may retain notification text according to their own settings.</p>
+            <p><a class="support-link" href="privacy">Read the complete privacy policy</a></p>
+        </section>
+
+        <section id="trust" class="support-card support-anchor-section" aria-labelledby="trust-title">
+            <span class="support-eyebrow">Trust & verification</span>
+            <h2 id="trust-title">Why should I trust KoalaSync?</h2>
+            <p>Trust should not depend on promises alone. The KoalaSync browser extension, relay server, build scripts, release workflow, and Dockerfile used for official GitHub releases are public under the MIT License.</p>
+            <p>Official extension ZIPs on GitHub Releases and Docker images on GitHub Container Registry are built by the public GitHub Actions release workflow. Signed SLSA provenance attestations connect each artifact's exact digest to this repository, its release tag and commit, and the workflow that built it.</p>
+            <p>You can install KoalaSync from an official browser store, download the Chrome or Firefox ZIP from GitHub Releases, build the extension yourself, or run your own relay server. Manual ZIP installation uses your browser's developer or manual extension installation process.</p>
+            <div class="support-actions support-actions-trust">
+                <a class="btn btn-secondary" href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener">View source code</a>
+                <a class="btn btn-secondary" href="https://github.com/Shik3i/KoalaSync/releases/latest" target="_blank" rel="noopener">Download releases</a>
+                <a class="btn btn-secondary" href="https://github.com/Shik3i/KoalaSync/blob/main/.github/workflows/release.yml" target="_blank" rel="noopener">View release workflow</a>
+                <a class="btn btn-secondary" href="./#self-hosting">Self-host the relay</a>
+            </div>
+            <details class="support-details">
+                <summary>Advanced: verify signed build provenance</summary>
+                <p>Install the GitHub CLI, download the release ZIP, and run:</p>
+                <pre><code>gh attestation verify koalasync-chrome.zip \
+  --repo Shik3i/KoalaSync</code></pre>
+                <p>To verify the current Docker image:</p>
+                <pre><code>gh attestation verify oci://ghcr.io/shik3i/koalasync:latest \
+  --repo Shik3i/KoalaSync</code></pre>
+            </details>
+            <div class="support-callout support-callout-warning" role="note">
+                <span class="support-callout-icon" aria-hidden="true">!</span>
+                <div>
+                    <strong>What an attestation proves, and what it does not.</strong>
+                    <p>An attestation proves the origin and build workflow of the GitHub release ZIP or GHCR image with that exact digest. It does not guarantee that software has no bugs or vulnerabilities. It also does not by itself prove that a package downloaded from a browser store is byte-for-byte identical to a GitHub release ZIP.</p>
+                </div>
+            </div>
+        </section>
+
+        <section id="report-issue" class="support-card support-anchor-section" aria-labelledby="report-issue-title">
+            <span class="support-eyebrow">Still not working?</span>
+            <h2 id="report-issue-title">Create a useful GitHub issue</h2>
+            <ol class="support-steps">
+                <li>Open KoalaSync, switch to <strong>Status</strong>, and click <strong>Copy Logs</strong> while the problem is still visible.</li>
+                <li>Open the KoalaSync GitHub bug-report form and sign in to GitHub if requested.</li>
+                <li>Describe the exact steps that reproduce the problem, what you expected, and what happened instead.</li>
+                <li>Add your browser, operating system, KoalaSync version, and the affected website or domain.</li>
+                <li>Paste the debug report, add a screenshot if useful, and review everything before publishing.</li>
+            </ol>
+            <div class="support-callout support-callout-warning" role="note">
+                <span class="support-callout-icon" aria-hidden="true">!</span>
+                <div>
+                    <strong>GitHub issues are public.</strong>
+                    <p>The copied report can include page titles and URLs, peer and room identifiers, participant names, and a custom server URL. Remove anything private. Never publish an invite link, room password, chat secret, account token, or a URL containing private session parameters.</p>
+                </div>
+            </div>
+            <div class="support-actions">
+                <a class="btn btn-primary" href="https://github.com/Shik3i/KoalaSync/issues/new?template=bug_report.md" target="_blank" rel="noopener">Create a bug report</a>
+                <a class="btn btn-secondary" href="https://github.com/Shik3i/KoalaSync/issues" target="_blank" rel="noopener">Search existing issues</a>
+            </div>
+        </section>
+
+        <div class="support-actions">
+            <a class="btn btn-secondary" href="./">Back to KoalaSync</a>
+            <a class="btn btn-secondary" href="privacy">Privacy policy</a>
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <p class="footer-ram">No chat or watch history. No tracking. Website access logs are deleted after 7 days.</p>
+            <p class="footer-copyright">&copy; 2026 KoalaSync. Open source under the MIT License.</p>
+            <div class="footer-links">
+                <a href="./">Home</a>
+                <a href="help">Help</a>
+                <a href="privacy">Privacy</a>
+                <a href="https://koalastuff.net/legal">Legal notice</a>
+                <a href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener">GitHub</a>
+            </div>
+        </div>
+    </footer>
+
+    <script src="app.min.js"></script>
+</body>
+</html>

website/impressum-de.html

@@ -1,250 +1,21 @@
-<!DOCTYPE html>
-<html lang="de" class="lang-de">
+<!doctype html>
+<html lang="de">
 <head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Impressum | KoalaSync</title>
-    <link rel="preload" href="../style.min.css" as="style">
-    <link rel="stylesheet" href="../style.min.css">
-    <link rel="icon" type="image/webp" href="../assets/NewLogoIcon_64.webp">
-    <link rel="canonical" href="https://sync.koalastuff.net/de/impressum">
-    <link rel="alternate" hreflang="en" href="https://sync.koalastuff.net/imprint">
-    <link rel="alternate" hreflang="de" href="https://sync.koalastuff.net/de/impressum">
-    <link rel="alternate" hreflang="x-default" href="https://sync.koalastuff.net/imprint">
-    <meta name="description" content="Impressum (Legal Notice) von KoalaSync - Anbieterkennzeichnung und Kontaktinformationen für die Open-Source Video-Synchronisations-Erweiterung.">
-    <meta name="robots" content="index, follow">
-
-    <script type="application/ld+json">
-    {
-      "@context": "https://schema.org",
-      "@type": "BreadcrumbList",
-      "itemListElement": [
-        { "@type": "ListItem", "position": 1, "name": "Startseite", "item": "https://sync.koalastuff.net/de/" },
-        { "@type": "ListItem", "position": 2, "name": "Impressum", "item": "https://sync.koalastuff.net/de/impressum" }
-      ]
-    }
-    </script>
-
-    <script type="application/ld+json">
-    {
-      "@context": "https://schema.org",
-      "@type": "WebPage",
-      "name": "Impressum",
-      "url": "https://sync.koalastuff.net/de/impressum",
-      "description": "Impressum (Legal Notice) von KoalaSync - Anbieterkennzeichnung und Kontaktinformationen für die Open-Source Video-Synchronisations-Erweiterung.",
-      "inLanguage": "de",
-      "isPartOf": {
-        "@type": "WebSite",
-        "name": "KoalaSync",
-        "url": "https://sync.koalastuff.net/de/"
-      }
-    }
-    </script>
-
-    <!-- Mobile Browser Theme Styling -->
-    <meta name="theme-color" content="#10190e">
-    <meta name="apple-mobile-web-app-capable" content="yes">
-    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
-
-    <script src="../lang-init.min.js"></script>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Impressum | KoalaSync</title>
+  <meta name="description" content="Das KoalaSync-Impressum ist zum zentralen KoalaStuff-Impressum umgezogen.">
+  <meta name="robots" content="noindex, follow">
+  <link rel="canonical" href="https://koalastuff.net/legal">
+  <link rel="stylesheet" href="../style.min.css">
 </head>
 <body>
-    <div class="bg-nature" aria-hidden="true">
-        <div class="bg-dusk-tint"></div>
-        <div class="bg-depth-day">
-            <div class="bg-godrays">
-                <span class="godray godray-1"></span>
-                <span class="godray godray-2"></span>
-                <span class="godray godray-3"></span>
-            </div>
-            <div class="bg-canopy"></div>
-            <span class="canopy-arc canopy-arc-1"></span>
-            <span class="canopy-arc canopy-arc-2"></span>
-            <span class="canopy-arc canopy-arc-3"></span>
-            <span class="canopy-arc canopy-arc-4"></span>
-        </div>
-        <div id="bamboo-far">
-            <span class="bamboo-stalk far-1"></span>
-            <span class="bamboo-stalk far-2"></span>
-            <span class="bamboo-stalk far-3"></span>
-            <span class="bamboo-stalk far-4"></span>
-            <span class="bamboo-stalk far-5"></span>
-        </div>
-        <div id="bamboo-near">
-            <div class="bamboo-stalk near-1">
-                <i class="bamboo-node node-1"></i>
-                <i class="bamboo-node node-2"></i>
-                <i class="bamboo-node node-3"></i>
-                <i class="bamboo-leaf leaf-1"></i>
-                <i class="bamboo-leaf leaf-2"></i>
-            </div>
-            <div class="bamboo-stalk near-2">
-                <i class="bamboo-node node-1"></i>
-                <i class="bamboo-node node-2"></i>
-                <i class="bamboo-node node-3"></i>
-                <i class="bamboo-leaf leaf-1"></i>
-            </div>
-            <div class="bamboo-stalk near-3">
-                <i class="bamboo-node node-1"></i>
-                <i class="bamboo-node node-2"></i>
-                <i class="bamboo-node node-3"></i>
-                <i class="bamboo-leaf leaf-1"></i>
-            </div>
-        </div>
-        <span class="fall-leaf fall-leaf-1"><i></i></span>
-        <span class="fall-leaf fall-leaf-2"><i></i></span>
-        <span class="fall-leaf fall-leaf-3"><i></i></span>
-        <span class="fall-leaf fall-leaf-4"><i></i></span>
-        <span class="fall-leaf fall-leaf-5"><i></i></span>
-        <span class="fall-leaf fall-leaf-6"><i></i></span>
-        <span class="fall-leaf fall-leaf-7"><i></i></span>
-        <span class="fall-leaf fall-leaf-8"><i></i></span>
-        <span class="bg-grass bg-grass-1"></span>
-        <span class="bg-grass bg-grass-2"></span>
-        <span class="bg-grass bg-grass-3"></span>
-        <span class="bg-grass bg-grass-4"></span>
-        <div class="bg-depth-dusk">
-            <div class="bg-mist bg-mist-1"></div>
-            <div class="bg-mist bg-mist-2"></div>
-            <div class="bg-horizon"></div>
-            <span class="firefly-wrap fw-1"><span class="firefly"></span></span>
-            <span class="firefly-wrap fw-2"><span class="firefly"></span></span>
-            <span class="firefly-wrap fw-3"><span class="firefly"></span></span>
-            <span class="firefly-wrap fw-4"><span class="firefly"></span></span>
-            <span class="firefly-wrap fw-5"><span class="firefly"></span></span>
-            <span class="firefly-wrap fw-6"><span class="firefly"></span></span>
-        </div>
-        <div class="bg-light-sweep"></div>
-        <div class="bg-grain"></div>
+  <main class="legal-content">
+    <div class="legal-card">
+      <h1>Impressum umgezogen</h1>
+      <p>Das KoalaSync-Impressum ist jetzt unter der zentralen KoalaStuff-Adresse verfügbar.</p>
+      <p><a class="legal-inline-link" href="https://koalastuff.net/legal">Zentrales Impressum öffnen</a></p>
     </div>
-
-    <nav>
-        <div class="container nav-content">
-            <a href="./" class="logo-area" style="text-decoration: none;">
-                <img src="../assets/NewLogoIcon_128.webp" alt="KoalaSync Logo" width="40" height="40">
-                <span>KoalaSync</span>
-            </a>
-            <div class="nav-links">
-                <a href="./" style="display: inline-flex; align-items: center; gap: 6px;">
-                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" style="width: 16px; height: 16px; display: block;"><path d="m3 9 9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"></path><polyline points="9 22 9 12 15 12 15 22"></polyline></svg>
-                    <span>Startseite</span>
-                </a>
-                <a href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener" style="display: inline-flex; align-items: center; gap: 6px;">
-                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" width="16" height="16" aria-hidden="true" style="display: block;"><path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"/></svg>
-                    GitHub
-                </a>
-            </div>
-            <div class="nav-right">
-                <div class="lang-select-container">
-                    <select class="lang-dropdown" aria-label="Select Language">
-                        <option value="en">🇬🇧 English</option>
-                        <option value="de">🇩🇪 Deutsch</option>
-                        <option value="fr">🇫🇷 Français</option>
-                        <option value="es">🇪🇸 Español</option>
-                        <option value="pt-BR">🇧🇷 Português (Brasil)</option>
-                        <option value="ru">🇷🇺 Русский</option>
-                        <option value="it">🇮🇹 Italiano</option>
-                        <option value="pl">🇵🇱 Polski</option>
-                        <option value="tr">🇹🇷 Türkçe</option>
-                        <option value="nl">🇳🇱 Nederlands</option>
-                        <option value="ja">🇯🇵 日本語</option>
-                        <option value="ko">🇰🇷 한국어</option>
-                        <option value="pt">🇵🇹 Português (Portugal)</option>
-                    </select>
-                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="chevron-icon"><polyline points="6 9 12 15 18 9"/></svg>
-                </div>
-                <button class="hamburger" aria-label="Menu" aria-expanded="false">☰</button>
-            </div>
-        </div>
-    </nav>
-
-    <main class="legal-content">
-        <div class="legal-card" data-reveal style="padding: 2rem;">
-            <div style="display: flex; justify-content: center;">
-                <img src="../assets/KoalaImprintl-180.webp" srcset="../assets/KoalaImprintl-180.webp 180w, ../assets/KoalaImprintl-360.webp 360w" sizes="180px" alt="Niedlicher Koala, der das Impressum repräsentiert" class="legal-mascot" width="180" height="180">
-            </div>
-            <h1>Impressum / Anbieterinformationen</h1>
-            <p style="text-align: center; text-transform: uppercase; letter-spacing: 0.1em; font-size: 0.8rem; border-bottom: 1px solid var(--glass-border); padding-bottom: 1.5rem; margin-bottom: 2rem;">
-                Kontakt & Projektinformationen
-            </p>
-
-            <section>
-                <h2>Betreiber & Kontakt</h2>
-                <p>Timo Schmidt</p>
-                <p style="margin-top: 0.5rem;">
-                    E-Mail: <span class="email-reveal" data-user="koalasync" data-domain="koalastuff.net" style="color: var(--accent); cursor: pointer; text-decoration: underline;">[E-Mail anzeigen]</span>
-                </p>
-                <p style="margin-top: 0.75rem;">
-                    <span class="legal-inline-label">🔒 Private Nachricht:</span>
-                    <a href="https://mastodon.social/@koalastuff" rel="me noopener" target="_blank" class="legal-inline-link">@koalastuff auf Mastodon</a>
-                </p>
-                <p style="margin-top: 0.5rem;">
-                    <span class="legal-inline-label">🐛 Fehlerberichte und Sicherheitsmeldungen:</span>
-                    <a href="https://github.com/Shik3i/KoalaSync/issues" target="_blank" rel="noopener" class="legal-inline-link">GitHub Issues</a>
-                </p>
-            </section>
-
-            <section>
-                <h2>Projektinformationen</h2>
-                <p>
-                    KoalaSync ist eine kostenlose und quelloffene Browser-Erweiterung. Der Quellcode ist auf GitHub unter der MIT-Lizenz verfügbar.
-                </p>
-                <p style="margin-top: 0.5rem;">
-                    Informationen zum Datenschutz, einschließlich Hosting, Access Logs, Relay-Verhalten und Betroffenenrechten, finden Sie in der <a href="datenschutz" class="legal-inline-link">Datenschutzerklärung</a>.
-                </p>
-            </section>
-
-            <section>
-                <h2>Haftung für Inhalte</h2>
-                <p>
-                    Die Inhalte dieser Website wurden mit Sorgfalt erstellt. Ich kann jedoch nicht gewährleisten, dass alle Informationen jederzeit vollständig, richtig oder aktuell sind.
-                </p>
-                <p style="margin-top: 0.5rem;">
-                    Als Diensteanbieter bin ich nach den allgemeinen Gesetzen für eigene Inhalte auf diesen Seiten verantwortlich.
-                </p>
-            </section>
-
-            <section>
-                <h2>Haftung für Links</h2>
-                <p>
-                    Diese Website enthält Links zu externen Websites Dritter. Auf deren Inhalte habe ich keinen Einfluss. Für die Inhalte verlinkter Seiten ist der jeweilige Anbieter oder Betreiber verantwortlich.
-                </p>
-                <p style="margin-top: 0.5rem;">
-                    Wenn mir rechtswidrige Inhalte auf verlinkten Seiten bekannt werden, entferne ich die entsprechenden Links.
-                </p>
-            </section>
-
-            <section>
-                <h2>Lizenz & Urheberrecht</h2>
-                <p>
-                    KoalaSync ist freie und quelloffene Software. Sofern nicht anders angegeben, steht der Quellcode von KoalaSync unter der MIT-Lizenz.
-                </p>
-                <p style="margin-top: 0.5rem;">
-                    Die MIT-Lizenz erlaubt Nutzung, Vervielfältigung, Bearbeitung, Verbreitung, Unterlizenzierung und Verkauf der Software, sofern der Copyright-Hinweis und der Lizenztext entsprechend den Lizenzbedingungen erhalten bleiben.
-                </p>
-                <p style="margin-top: 0.5rem;">
-                    Projektname, Logos, Grafiken, Website-Texte und andere Nicht-Code-Assets können separaten Rechten unterliegen, sofern sie nicht ausdrücklich von der Repository-Lizenz umfasst sind.
-                </p>
-            </section>
-        </div>
-    </main>
-
-    <footer>
-        <div class="container">
-            <p>&copy; 2026 KoalaSync. Open Source unter der MIT-Lizenz.</p>
-            <p style="font-size: 0.8rem; margin-top: 0.5rem;">Keine Relay-Logs. Kein Tracking. Website-Access-Logs werden nach 7 Tagen gelöscht.</p>
-            <div style="margin-top: 1.5rem; font-size: 0.8rem; display: flex; justify-content: center; align-items: center; gap: 1.5rem; flex-wrap: wrap;">
-                <a href="impressum" style="color: var(--text-muted); text-decoration: none;">Impressum</a>
-                <a href="datenschutz" style="color: var(--text-muted); text-decoration: none;">Datenschutz</a>
-                <a href="alternatives">Vergleiche & Anleitungen</a>
-                <a href="https://mastodon.social/@koalastuff" rel="me noopener" target="_blank" style="color: var(--text-muted); text-decoration: none; display: inline-flex; align-items: center; gap: 4px;">
-                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" width="14" height="14" aria-hidden="true" style="display: block;"><path d="M23.268 5.313c-.35-2.578-2.617-4.61-5.304-5.004C17.51.242 15.792 0 11.813 0h-.03c-3.98 0-4.835.242-5.288.309C3.882.692 1.496 2.518.917 5.127.64 6.412.61 7.837.661 9.143c.074 1.874.088 3.745.26 5.611.118 1.24.325 2.47.62 3.68.55 2.237 2.777 4.098 4.96 4.857 2.336.792 4.849.923 7.256.38.265-.061.527-.132.786-.213.585-.184 1.27-.39 1.774-.753a.057.057 0 0 0 .023-.043v-1.809a.052.052 0 0 0-.02-.041.053.053 0 0 0-.046-.01 20.282 20.282 0 0 1-4.709.545c-2.73 0-3.463-1.284-3.674-1.818a5.593 5.593 0 0 1-.319-1.433.053.053 0 0 1 .066-.054c1.517.363 3.072.546 4.632.546.376 0 .75 0 1.125-.01 1.57-.044 3.224-.124 4.768-.422.038-.008.077-.015.11-.024 2.435-.464 4.753-1.92 4.989-5.604.008-.145.03-1.52.03-1.67.002-.512.167-3.63-.024-5.545zm-3.748 9.195h-2.561V8.29c0-1.309-.55-1.976-1.67-1.976-1.23 0-1.846.79-1.846 2.35v3.403h-2.546V8.663c0-1.56-.617-2.35-1.848-2.35-1.112 0-1.668.668-1.67 1.977v6.218H4.822V8.102c0-1.31.337-2.35 1.011-3.12.696-.77 1.608-1.164 2.74-1.164 1.311 0 2.302.5 2.962 1.498l.638 1.06.638-1.06c.66-.999 1.65-1.498 2.96-1.498 1.13 0 2.043.395 2.74 1.164.675.77 1.012 1.81 1.012 3.12z"/></svg>
-                    Mastodon
-                </a>
-            </div>
-        </div>
-    </footer>
-
-    <script src="../app.min.js"></script>
+  </main>
 </body>
 </html>

website/impressum.html

@@ -1,26 +1,14 @@
-<!DOCTYPE html>
+<!doctype html>
 <html lang="en">
 <head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <meta name="robots" content="noindex, follow">
-    <title>Redirecting...</title>
-    <script>
-        (function() {
-            var savedLang = localStorage.getItem('koala_lang');
-            var browserLang = (navigator.language || navigator.userLanguage || '').toLowerCase();
-            var isDe = (savedLang === 'de') || (!savedLang && browserLang.indexOf('de') === 0);
-            var path = window.location.pathname;
-            var hasHtml = path.endsWith('.html');
-            if (isDe) {
-                window.location.replace(hasHtml ? 'de/impressum.html' : 'de/impressum');
-            } else {
-                window.location.replace(hasHtml ? 'imprint.html' : 'imprint');
-            }
-        })();
-    </script>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta http-equiv="refresh" content="0; url=https://koalastuff.net/legal">
+  <meta name="robots" content="noindex, follow">
+  <link rel="canonical" href="https://koalastuff.net/legal">
+  <title>Legal Notice | KoalaSync</title>
 </head>
 <body>
-    <p>Redirecting / Weiterleitung...</p>
+  <p><a href="https://koalastuff.net/legal">Open the central KoalaStuff legal notice</a></p>
 </body>
 </html>

website/imprint.html

@@ -1,250 +1,21 @@
-<!DOCTYPE html>
-<html lang="en" class="lang-en">
+<!doctype html>
+<html lang="en">
 <head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Legal Notice | KoalaSync</title>
-    <link rel="preload" href="style.min.css" as="style">
-    <link rel="stylesheet" href="style.min.css">
-    <link rel="icon" type="image/webp" href="assets/NewLogoIcon_64.webp">
-    <link rel="canonical" href="https://sync.koalastuff.net/imprint">
-    <link rel="alternate" hreflang="en" href="https://sync.koalastuff.net/imprint">
-    <link rel="alternate" hreflang="de" href="https://sync.koalastuff.net/de/impressum">
-    <link rel="alternate" hreflang="x-default" href="https://sync.koalastuff.net/imprint">
-    <meta name="description" content="Legal Notice (Impressum) of KoalaSync - Contact information and operator details for the open-source video synchronization extension.">
-    <meta name="robots" content="index, follow">
-
-    <script type="application/ld+json">
-    {
-      "@context": "https://schema.org",
-      "@type": "BreadcrumbList",
-      "itemListElement": [
-        { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://sync.koalastuff.net/" },
-        { "@type": "ListItem", "position": 2, "name": "Legal Notice", "item": "https://sync.koalastuff.net/imprint" }
-      ]
-    }
-    </script>
-
-    <script type="application/ld+json">
-    {
-      "@context": "https://schema.org",
-      "@type": "WebPage",
-      "name": "Legal Notice",
-      "url": "https://sync.koalastuff.net/imprint",
-      "description": "Legal Notice (Impressum) of KoalaSync - Contact information and operator details for the open-source video synchronization extension.",
-      "inLanguage": "en",
-      "isPartOf": {
-        "@type": "WebSite",
-        "name": "KoalaSync",
-        "url": "https://sync.koalastuff.net/"
-      }
-    }
-    </script>
-
-    <!-- Mobile Browser Theme Styling -->
-    <meta name="theme-color" content="#10190e">
-    <meta name="apple-mobile-web-app-capable" content="yes">
-    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
-
-    <script src="lang-init.min.js"></script>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Legal Notice | KoalaSync</title>
+  <meta name="description" content="The KoalaSync legal notice has moved to the central KoalaStuff legal notice.">
+  <meta name="robots" content="noindex, follow">
+  <link rel="canonical" href="https://koalastuff.net/legal">
+  <link rel="stylesheet" href="style.min.css">
 </head>
 <body>
-    <div class="bg-nature" aria-hidden="true">
-        <div class="bg-dusk-tint"></div>
-        <div class="bg-depth-day">
-            <div class="bg-godrays">
-                <span class="godray godray-1"></span>
-                <span class="godray godray-2"></span>
-                <span class="godray godray-3"></span>
-            </div>
-            <div class="bg-canopy"></div>
-            <span class="canopy-arc canopy-arc-1"></span>
-            <span class="canopy-arc canopy-arc-2"></span>
-            <span class="canopy-arc canopy-arc-3"></span>
-            <span class="canopy-arc canopy-arc-4"></span>
-        </div>
-        <div id="bamboo-far">
-            <span class="bamboo-stalk far-1"></span>
-            <span class="bamboo-stalk far-2"></span>
-            <span class="bamboo-stalk far-3"></span>
-            <span class="bamboo-stalk far-4"></span>
-            <span class="bamboo-stalk far-5"></span>
-        </div>
-        <div id="bamboo-near">
-            <div class="bamboo-stalk near-1">
-                <i class="bamboo-node node-1"></i>
-                <i class="bamboo-node node-2"></i>
-                <i class="bamboo-node node-3"></i>
-                <i class="bamboo-leaf leaf-1"></i>
-                <i class="bamboo-leaf leaf-2"></i>
-            </div>
-            <div class="bamboo-stalk near-2">
-                <i class="bamboo-node node-1"></i>
-                <i class="bamboo-node node-2"></i>
-                <i class="bamboo-node node-3"></i>
-                <i class="bamboo-leaf leaf-1"></i>
-            </div>
-            <div class="bamboo-stalk near-3">
-                <i class="bamboo-node node-1"></i>
-                <i class="bamboo-node node-2"></i>
-                <i class="bamboo-node node-3"></i>
-                <i class="bamboo-leaf leaf-1"></i>
-            </div>
-        </div>
-        <span class="fall-leaf fall-leaf-1"><i></i></span>
-        <span class="fall-leaf fall-leaf-2"><i></i></span>
-        <span class="fall-leaf fall-leaf-3"><i></i></span>
-        <span class="fall-leaf fall-leaf-4"><i></i></span>
-        <span class="fall-leaf fall-leaf-5"><i></i></span>
-        <span class="fall-leaf fall-leaf-6"><i></i></span>
-        <span class="fall-leaf fall-leaf-7"><i></i></span>
-        <span class="fall-leaf fall-leaf-8"><i></i></span>
-        <span class="bg-grass bg-grass-1"></span>
-        <span class="bg-grass bg-grass-2"></span>
-        <span class="bg-grass bg-grass-3"></span>
-        <span class="bg-grass bg-grass-4"></span>
-        <div class="bg-depth-dusk">
-            <div class="bg-mist bg-mist-1"></div>
-            <div class="bg-mist bg-mist-2"></div>
-            <div class="bg-horizon"></div>
-            <span class="firefly-wrap fw-1"><span class="firefly"></span></span>
-            <span class="firefly-wrap fw-2"><span class="firefly"></span></span>
-            <span class="firefly-wrap fw-3"><span class="firefly"></span></span>
-            <span class="firefly-wrap fw-4"><span class="firefly"></span></span>
-            <span class="firefly-wrap fw-5"><span class="firefly"></span></span>
-            <span class="firefly-wrap fw-6"><span class="firefly"></span></span>
-        </div>
-        <div class="bg-light-sweep"></div>
-        <div class="bg-grain"></div>
+  <main class="legal-content">
+    <div class="legal-card">
+      <h1>Legal notice moved</h1>
+      <p>The KoalaSync legal notice is now available at the central KoalaStuff address.</p>
+      <p><a class="legal-inline-link" href="https://koalastuff.net/legal">Open the central legal notice</a></p>
     </div>
-
-    <nav>
-        <div class="container nav-content">
-            <a href="./" class="logo-area" style="text-decoration: none;">
-                <img src="assets/NewLogoIcon_128.webp" alt="KoalaSync Logo" width="40" height="40">
-                <span>KoalaSync</span>
-            </a>
-            <div class="nav-links">
-                <a href="./" style="display: inline-flex; align-items: center; gap: 6px;">
-                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" style="width: 16px; height: 16px; display: block;"><path d="m3 9 9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"></path><polyline points="9 22 9 12 15 12 15 22"></polyline></svg>
-                    <span>Home</span>
-                </a>
-                <a href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener" style="display: inline-flex; align-items: center; gap: 6px;">
-                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" width="16" height="16" aria-hidden="true" style="display: block;"><path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"/></svg>
-                    GitHub
-                </a>
-            </div>
-            <div class="nav-right">
-                <div class="lang-select-container">
-                    <select class="lang-dropdown" aria-label="Select Language">
-                        <option value="en">🇬🇧 English</option>
-                        <option value="de">🇩🇪 Deutsch</option>
-                        <option value="fr">🇫🇷 Français</option>
-                        <option value="es">🇪🇸 Español</option>
-                        <option value="pt-BR">🇧🇷 Português (Brasil)</option>
-                        <option value="ru">🇷🇺 Русский</option>
-                        <option value="it">🇮🇹 Italiano</option>
-                        <option value="pl">🇵🇱 Polski</option>
-                        <option value="tr">🇹🇷 Türkçe</option>
-                        <option value="nl">🇳🇱 Nederlands</option>
-                        <option value="ja">🇯🇵 日本語</option>
-                        <option value="ko">🇰🇷 한국어</option>
-                        <option value="pt">🇵🇹 Português (Portugal)</option>
-                    </select>
-                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="chevron-icon"><polyline points="6 9 12 15 18 9"/></svg>
-                </div>
-                <button class="hamburger" aria-label="Menu" aria-expanded="false">☰</button>
-            </div>
-        </div>
-    </nav>
-
-    <main class="legal-content">
-        <div class="legal-card" data-reveal style="padding: 2rem;">
-            <div style="display: flex; justify-content: center;">
-                <img src="assets/KoalaImprintl-180.webp" srcset="assets/KoalaImprintl-180.webp 180w, assets/KoalaImprintl-360.webp 360w" sizes="180px" alt="Cute Koala representing the legal notice page" class="legal-mascot" width="180" height="180">
-            </div>
-            <h1>Legal Notice</h1>
-            <p style="text-align: center; text-transform: uppercase; letter-spacing: 0.1em; font-size: 0.8rem; border-bottom: 1px solid var(--glass-border); padding-bottom: 1.5rem; margin-bottom: 2rem;">
-                Contact & Project Information
-            </p>
-
-            <section>
-                <h2>Operator & Contact</h2>
-                <p>Timo Schmidt</p>
-                <p style="margin-top: 0.5rem;">
-                    E-Mail: <span class="email-reveal" data-user="koalasync" data-domain="koalastuff.net" style="color: var(--accent); cursor: pointer; text-decoration: underline;">[Show Email]</span>
-                </p>
-                <p style="margin-top: 0.75rem;">
-                    <span class="legal-inline-label">🔒 Private message:</span>
-                    <a href="https://mastodon.social/@koalastuff" rel="me noopener" target="_blank" class="legal-inline-link">@koalastuff on Mastodon</a>
-                </p>
-                <p style="margin-top: 0.5rem;">
-                    <span class="legal-inline-label">🐛 Bug reports and security concerns:</span>
-                    <a href="https://github.com/Shik3i/KoalaSync/issues" target="_blank" rel="noopener" class="legal-inline-link">GitHub Issues</a>
-                </p>
-            </section>
-
-            <section>
-                <h2>Project Information</h2>
-                <p>
-                    KoalaSync is a free and open-source browser extension. The source code is available on GitHub under the MIT License.
-                </p>
-                <p style="margin-top: 0.5rem;">
-                    For privacy-related information, including hosting, access logs, relay behavior, and data subject rights, please see the <a href="privacy" class="legal-inline-link">Privacy Policy</a>.
-                </p>
-            </section>
-
-            <section>
-                <h2>Liability for Content</h2>
-                <p>
-                    The contents of this website were created with care. However, I cannot guarantee that all information is always complete, accurate, or up to date.
-                </p>
-                <p style="margin-top: 0.5rem;">
-                    As a service provider, I am responsible for my own content on these pages in accordance with the general laws.
-                </p>
-            </section>
-
-            <section>
-                <h2>Liability for Links</h2>
-                <p>
-                    This website contains links to external third-party websites. I have no influence over the content of those websites. The respective provider or operator is responsible for the content of linked pages.
-                </p>
-                <p style="margin-top: 0.5rem;">
-                    If I become aware of unlawful content on linked pages, I will remove the corresponding links.
-                </p>
-            </section>
-
-            <section>
-                <h2>License & Copyright</h2>
-                <p>
-                    KoalaSync is free and open-source software. Unless otherwise stated, the KoalaSync source code is licensed under the MIT License.
-                </p>
-                <p style="margin-top: 0.5rem;">
-                    The MIT License allows use, copying, modification, distribution, sublicensing, and sale of the software, provided that the copyright notice and license text are included where required by the license.
-                </p>
-                <p style="margin-top: 0.5rem;">
-                    Project name, logos, graphics, website text, and other non-code assets may be subject to separate rights unless they are explicitly included under the repository license.
-                </p>
-            </section>
-        </div>
-    </main>
-
-    <footer>
-        <div class="container">
-            <p>&copy; 2026 KoalaSync. Open source under the MIT License.</p>
-            <p style="font-size: 0.8rem; margin-top: 0.5rem;">No relay logs. No tracking. Website access logs are deleted after 7 days.</p>
-            <div style="margin-top: 1.5rem; font-size: 0.8rem; display: flex; justify-content: center; align-items: center; gap: 1.5rem; flex-wrap: wrap;">
-                <a href="imprint" style="color: var(--text-muted); text-decoration: none;">Legal Notice</a>
-                <a href="privacy" style="color: var(--text-muted); text-decoration: none;">Privacy Policy</a>
-                <a href="alternatives">Guides & comparisons</a>
-                <a href="https://mastodon.social/@koalastuff" rel="me noopener" target="_blank" style="color: var(--text-muted); text-decoration: none; display: inline-flex; align-items: center; gap: 4px;">
-                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" width="14" height="14" aria-hidden="true" style="display: block;"><path d="M23.268 5.313c-.35-2.578-2.617-4.61-5.304-5.004C17.51.242 15.792 0 11.813 0h-.03c-3.98 0-4.835.242-5.288.309C3.882.692 1.496 2.518.917 5.127.64 6.412.61 7.837.661 9.143c.074 1.874.088 3.745.26 5.611.118 1.24.325 2.47.62 3.68.55 2.237 2.777 4.098 4.96 4.857 2.336.792 4.849.923 7.256.38.265-.061.527-.132.786-.213.585-.184 1.27-.39 1.774-.753a.057.057 0 0 0 .023-.043v-1.809a.052.052 0 0 0-.02-.041.053.053 0 0 0-.046-.01 20.282 20.282 0 0 1-4.709.545c-2.73 0-3.463-1.284-3.674-1.818a5.593 5.593 0 0 1-.319-1.433.053.053 0 0 1 .066-.054c1.517.363 3.072.546 4.632.546.376 0 .75 0 1.125-.01 1.57-.044 3.224-.124 4.768-.422.038-.008.077-.015.11-.024 2.435-.464 4.753-1.92 4.989-5.604.008-.145.03-1.52.03-1.67.002-.512.167-3.63-.024-5.545zm-3.748 9.195h-2.561V8.29c0-1.309-.55-1.976-1.67-1.976-1.23 0-1.846.79-1.846 2.35v3.403h-2.546V8.663c0-1.56-.617-2.35-1.848-2.35-1.112 0-1.668.668-1.67 1.977v6.218H4.822V8.102c0-1.31.337-2.35 1.011-3.12.696-.77 1.608-1.164 2.74-1.164 1.311 0 2.302.5 2.962 1.498l.638 1.06.638-1.06c.66-.999 1.65-1.498 2.96-1.498 1.13 0 2.043.395 2.74 1.164.675.77 1.012 1.81 1.012 3.12z"/></svg>
-                    Mastodon
-                </a>
-            </div>
-        </div>
-    </footer>
-
-    <script src="app.min.js"></script>
+  </main>
 </body>
 </html>

website/join.html

@@ -183,11 +183,11 @@
     <footer>
         <div class="container">
             <p>&copy; 2026 KoalaSync. <span lang="en">Open source under the MIT License.</span><span lang="de">Open Source unter der MIT-Lizenz.</span></p>
-            <p style="font-size: 0.8rem; margin-top: 0.5rem;"><span lang="en">No relay logs. No tracking. Website access logs are deleted after 7 days.</span><span lang="de">Keine Relay-Logs. Kein Tracking. Website-Access-Logs werden nach 7 Tagen gelöscht.</span></p>
+            <p style="font-size: 0.8rem; margin-top: 0.5rem;"><span lang="en">No chat or watch history. No tracking. Website access logs are deleted after 7 days.</span><span lang="de">Keine Chat- oder Wiedergabehistorie. Kein Tracking. Website-Access-Logs werden nach 7 Tagen gelöscht.</span></p>
             <p class="footer-disclaimer" style="margin-top: 1.2rem;"><span lang="en">KoalaSync is not affiliated with, endorsed by, or associated with Netflix, Disney+, Amazon, YouTube, Twitch, or any other streaming platform. All trademarks are property of their respective owners.</span><span lang="de">KoalaSync ist nicht mit Netflix, Disney+, Amazon, YouTube, Twitch oder anderen Streaming-Plattformen verbunden, wird von diesen nicht unterstützt oder steht in keiner Beziehung zu diesen. Alle Markenrechte liegen bei ihren jeweiligen Inhabern.</span></p>
             <div style="margin-top: 1.5rem; font-size: 0.8rem; display: flex; justify-content: center; align-items: center; gap: 1.5rem; flex-wrap: wrap;">
-                <a href="imprint" lang="en" style="color: var(--text-muted); text-decoration: none;">Legal Notice</a>
-                <a href="de/impressum" lang="de" style="color: var(--text-muted); text-decoration: none;">Impressum</a>
+                <a href="https://koalastuff.net/legal" lang="en" style="color: var(--text-muted); text-decoration: none;">Legal Notice</a>
+                <a href="https://koalastuff.net/legal" lang="de" style="color: var(--text-muted); text-decoration: none;">Impressum</a>
                 <a href="privacy" lang="en" style="color: var(--text-muted); text-decoration: none;">Privacy Policy</a>
                 <a href="de/datenschutz" lang="de" style="color: var(--text-muted); text-decoration: none;">Datenschutz</a>
                 <a href="alternatives"><span lang="en">Guides & comparisons</span><span lang="de">Vergleiche & Anleitungen</span></a>
@@ -203,6 +203,7 @@
         </div>
     </footer>
 
+    <script src="invite-links.min.js"></script>
     <script src="app.min.js"></script>
 </body>
 </html>

website/llms.txt

@@ -19,7 +19,7 @@ KoalaSync is not a fit when users need:
 
 - video or screen sharing to people who do not have access to the content
 - a hosted video library, remote browser or cloud-streaming service
-- built-in text, voice or webcam chat
+- built-in voice, video or webcam chat
 - a mobile app or Safari extension
 - guaranteed compatibility with a player that does not expose an accessible HTML5 video element
 
@@ -76,9 +76,18 @@ Compatibility depends on each website's player implementation and can change whe
 - [Firefox Add-ons](https://addons.mozilla.org/firefox/addon/koalasync/): Firefox
 - [GitHub Releases](https://github.com/Shik3i/KoalaSync/releases): Release notes and manual packages
 
+## Help and troubleshooting
+
+- [Help Center](https://sync.koalastuff.net/help): Browser permissions, missing tabs, video detection, synchronization checks and safe bug reports
+- [Website access guide](https://sync.koalastuff.net/site-access-help): Restore access when Chrome, Edge, Brave, Opera or Vivaldi blocks KoalaSync on a video site
+- If a video tab is missing, disable `Hide Clutter Tabs` temporarily. If the tab then appears, report the affected domain so the filter can be corrected.
+- If a listed tab has no detected video, start playback once and inspect `Status` → `Video Debug Info`.
+- GitHub issues are public. Remove private page URLs, titles, room or peer identifiers, participant names, custom server URLs, credentials and session parameters before publishing logs.
+- [GitHub bug report](https://github.com/Shik3i/KoalaSync/issues/new?template=bug_report.md): Include reproducible steps, browser, operating system, KoalaSync version and sanitized debug output
+
 ## Technical information
 
-- Current website release: 2.5.4
+- Current website release: 3.0.1
 - License: MIT
 - Extension runtime: dependency-free browser extension code
 - Relay: Node.js with Socket.IO-compatible WebSocket messaging
@@ -112,6 +121,6 @@ Compatibility depends on each website's player implementation and can change whe
 - [Main website](https://sync.koalastuff.net/)
 - [GitHub issues](https://github.com/Shik3i/KoalaSync/issues): Bugs, compatibility reports and feature requests
 - [Mastodon](https://mastodon.social/@koalastuff): Private contact and project updates
-- [Legal notice](https://sync.koalastuff.net/imprint)
+- [Legal notice](https://koalastuff.net/legal)
 
 KoalaSync is an independent project and is not affiliated with, endorsed by or associated with Netflix, Disney+, Amazon, YouTube, Twitch or any other streaming platform. All trademarks belong to their respective owners.