# KoalaSync Changelog All notable changes to the KoalaSync browser extension and relay server. --- ## [v2.1.1] — 2026-06-04 ### Changed - Added progressive enhancement using `appearance: base-select` to support styling of country flag emojis in expanded language selectors on newer Chromium browsers. --- ## [v2.1.0] — 2026-06-04 ### Added - Added full translation support for 7 new languages to both the browser extension popup settings and landing website: Italian (`it`), Polish (`pl`), Turkish (`tr`), Dutch (`nl`), Japanese (`ja`), Korean (`ko`), and European Portuguese (`pt`). - Implemented robust, centralized browser system language detection mapping `pt-BR` to Brazilian Portuguese and other `pt` locales (like `pt-PT`) automatically to European Portuguese. - Added flag emojis to language selector dropdowns in both the extension popup and landing/utility web pages for quicker visual identification. - Added 181 translation keys parity validation suite checks for the new languages. ### Fixed & Hardened (Extension Audit) - Guarded all website `localStorage` interactions to prevent initialization/join flow script failures on privacy-hardened or cookie-blocked browser configurations. - Added robust validation null-guards to `chrome.runtime.onMessage` listeners across all extension scripts (`bridge.js`, `content.js`, `background.js`, `popup.js`) to reject unexpected runtime messages. - Guarded CustomEvent payload destructuring in `bridge.js` to ensure stability when receiving third-party page events. - Wrapped `video.currentTime` seeking adjustments during forced sync in content scripts with exception handling to absorb uninitialized video state DOMExceptions. - Added payload validation guards on incoming Socket.IO events within the background script's event handlers to secure against malformed server updates. - Prevented noisy browser console exceptions from context invalidation in target tabs by catching promise rejections on extension message dispatches. ### Performance - Implemented in-memory language dictionary caching in the background script to completely avoid redundant extension package filesystem reads during translations. --- ## [v2.0.8] — 2026-06-03 ### Fixed - Fixed a bug where switching language inside the extension popup overwrote dynamic fields (such as active room ID, connection status, active server details, and video debug info) with default localized placeholder texts. - Fixed a version reporting mismatch where the copied logs (debug reports) and connection handshake parameters incorrectly reported the hardcoded `1.9.0` version instead of the actual installed manifest version. --- ## [v2.0.7] — 2026-06-03 ### Added - Added a `DEBUG_LOGGING` environment variable to the relay server (defaulting to `"0"` / disabled) to prevent console spam from verbose connection (`CONN`), room activity (`ROOM`, `DEDUPE`), and `CORS` events under load. Critical logs like `SERVER`, `SECURITY`, `AUTH`, and `ERROR` remain enabled at all times. --- ## [v2.0.6] — 2026-06-03 ### Performance & Security Hardening - Optimized failed authentication attempts cache eviction algorithm to $O(1)$ by exploiting Javascript `Map` insertion-order properties. This completely removes the previous array copying and sorting bottleneck, neutralizing a potential main-thread blocking DoS vector under heavy brute-force password traffic. --- ## [v2.0.5] — 2026-06-03 ### Security & Hardening - Hardened extension room idle auto-leave detection to correctly recognize when the target tab's video heartbeat goes stale (e.g., after tab navigation or media closure). - Exported cleaner graceful shutdown and lifecycle methods (`stopServerForTests`) from the relay server to prevent socket leaks and port-binding conflicts during verify checks. ### Added - Added a validation step in `test-locales.js` to ensure the supported language list in `extension/i18n.js` is perfectly synchronized with the actual JSON translation files in the locales directory. - Added a robust route verification test suite (`scripts/test-server-routes.mjs`) covering rate limit throttling, caching headers, and admin metrics access control. --- ## [v2.0.4] — 2026-06-03 ### Security & Hardening - Hardened relay health endpoints against simple flood traffic: `GET /` and `GET /health` are now limited to 10 requests per minute per client IP. - Added lazy 60-second server-side caching for `GET /`, basic `/health`, and admin `/health` JSON responses to reduce repeated health-check work under noisy polling. - Added stricter brute-force throttling for invalid admin metrics bearer attempts. - Added startup warning for short `ADMIN_METRICS_TOKEN` values and documented that production Node ports must stay private behind Caddy or another trusted reverse proxy. - Lowered the default maximum peers per room to 25. ### Added - Optional privacy-preserving admin metrics on `/health` when `ADMIN_METRICS_TOKEN` is configured and a valid bearer token is supplied. Metrics are aggregate-only and exclude room IDs, peer IDs, usernames, IP addresses, media titles, passwords, and other user-level data. ### Changed - Removed `bcryptjs`; temporary room passwords continue to use keyed SHA-256/HMAC hashing as documented. - Public room discovery is now rate-limited server-side to one refresh every 10 seconds per socket, with the extension refresh button locked for 11 seconds. ### Fixed - Improved Shadow DOM video detection so real embedded players are not hidden by smaller light-DOM preview or placeholder videos. - Fixed join-button timeout cleanup after join status responses. --- ## [v2.0.2] — 2026-06-02 ### Fixed - Peer identity spoofing in relay server: client-supplied `peerId` could be used to impersonate other peers in PEER_STATUS events. Server now always stamps `peerId` with the authenticated sender's identity. - Amazon domain detection: replaced broad `includes('amazon.')` substring check with boundary-safe regex that correctly matches all Amazon storefronts (`amazon.com`, `amazon.de`, `amazon.co.uk`, etc.) while rejecting lookalike domains. --- ## [v2.0.1] — 2026-06-01 ### Fixed - Video detection on Prime Video: `findVideo()` now scores all video elements by size, duration, and mute state instead of picking the first one. Fixes 0×0 placeholder being selected over the actual player. - History entries in debug report showing `?` instead of action names. - Prime Video status in compatibility matrix updated to reflect partial support. ### Added - Multi-video overview table in Copy Debug Report when a page has more than one `