Two fixes addressing kfj001 review #37 on commit b19035a: 1. Vendor hls.js bundle locally — chrome.runtime.getURL('hls.min.js') instead of CDN, bypassing site CSP (script-src 'self') blocks. Added hls.min.js to vite.config.ts entry points, manifest web_accessible_resources. 2. Handle null entries in executeScript results — destroyed frames return null when allFrames:true, causing 'Cannot read properties of null (reading 'result')' in probeHlsManifests() and scrapeTab(). Added null guards before accessing .result. 83/83 tests pass. Build: 10 modules, 413KB hls bundle.
b19035a