Merge pull request 'refactor: decouple from site-specific CDN references' (#5) from feature/no_mention_of_pornhub into master

Reviewed-on: http://192.168.1.74:30008/kfj001/goon_plugin/pulls/5
Reviewed-by: robot <robot@westerntechnologies.duckdns.org>

.claude/settings.local.json

@@ -1,9 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(npm run *)",
-      "Bash(node --check /home/kyle/Documents/goon_plugin/src/viewer/index.js)",
-      "Bash(open -a \"Microsoft Edge\" --args --remote-debugging-port=9222 --profile-directory=Default)"
-    ]
-  }
-}

.gitignore

@@ -2,4 +2,5 @@ node_modules/
 dist/
 .vscode-insiders/
 /icons
-/icons/*
+/icons/*
+.claude/settings.local.json

__tests__/config_validation.test.mjs

@@ -44,8 +44,8 @@ describe('Config: build integrity', () => {
 
     if (codeOnly.includes('textContent')) {
       throw new Error(
-        'content.js uses inline script injection (textContent). ' +
+          'content.js uses inline script injection (textContent). ' +
-        'Sites like Pornhub block inline scripts via CSP. Use script.src instead.'
+          'Some sites block inline scripts via CSP. Use script.src instead.'
       );
     }
     if (!codeOnly.includes('script.src') || !codeOnly.includes('chrome.runtime.getURL')) {

__tests__/data_flow.test.mjs

@@ -185,4 +185,35 @@ describe('Data flow: popup -> storage -> viewer', () => {
       throw new Error('Entry with invalid mediaType should be rejected');
     }
   });
+
+  it('an HLS entry carrying a scan-time referer passes schema + round-trips', () => {
+     // The referer is bound to the entry at scan time so it survives the
+     // watch-later flow (the source tab may be long closed). Because the schema
+     // sets additionalProperties:false, a `referer` the store carries must be an
+     // explicit property or storage-layer validation would reject the entry.
+    const scrapedEntry = {
+      url: 'https://pageA.example.com/watch',
+      src: 'https://cdn.example.com/hls/live/master.m3u8',
+      hlsManifest: 'https://cdn.example.com/hls/live/master.m3u8',
+      mediaType: 'hls',
+      poster: 'https://pageA.example.com/thumb.jpg',
+      tab: 'Referer-protected stream',
+      referer: 'https://pageA.example.com/watch',
+    };
+
+    const valid = validate(scrapedEntry);
+    if (!valid) {
+      throw new Error(`Entry with referer fails schema: ${JSON.stringify(validate.errors)}`);
+    }
+
+     // The referer must survive the storage round-trip intact so the viewer can
+    // send it to the proxy when the user opens a previously-scanned entry.
+    const roundTripped = JSON.parse(JSON.stringify(scrapedEntry));
+    if (roundTripped.referer !== 'https://pageA.example.com/watch') {
+      throw new Error('referer lost during round-trip');
+    }
+    if (!validate(roundTripped)) {
+      throw new Error('Round-tripped entry with referer fails schema');
+    }
+  });
 });

__tests__/hls_qa.test.mjs

@@ -14,8 +14,8 @@ const viewerSource = fs.readFileSync(
 );
 const interceptorSource = fs.readFileSync(
   path.join(__dirname, '../src/inject/interceptors.js'),
-  'utf-8'
+     'utf-8'
-);
+    );
 
 /* ========================================================================== */
 /* Helpers                                                                    */
@@ -940,8 +940,8 @@ describe('HLS QA: Configuration and resource management', () => {
 
   it('should vendor HLS bundle locally (not use CDN — avoids CSP blocks)', () => {
     // Viewer loads hls.js from extension origin via chrome.runtime.getURL('hls.min.js')
-    // instead of a CDN — sites like Pornhub restrict script-src to 'self', blocking
+      // instead of a CDN — sites that restrict script-src to 'self' block
-    // cross-origin <script src> injection from CDN URLs.
+      // cross-origin <script src> injection from CDN URLs.
     if (!viewerSource.includes("chrome.runtime.getURL('hlds.js')")) {
       throw new Error('viewer.js should load hlds.js from extension origin, not CDN');
     }
@@ -1027,21 +1027,48 @@ describe('HLS QA: iframe and multi-frame scenarios', () => {
     }
   });
 
-  it('should scrape video elements from all frames', () => {
+   it('should scrape video elements from all frames', () => {
-    const indexSource = fs.readFileSync(
+     const indexSource = fs.readFileSync(
-      path.join(__dirname, '../src/viewer/index.js'),
+       path.join(__dirname, '../src/viewer/index.js'),
-      'utf-8'
+       'utf-8'
-    );
+      );
 
-    // Verify scrapeTab runs in all frames
+      // Verify scrapeTab runs in all frames
-    const scrapeMatch = indexSource.match(/scrapeTab[\s\S]*?executeScript[\s\S]*?\}/);
+     const scrapeMatch = indexSource.match(/scrapeTab[\s\S]*?executeScript[\s\S]*?\}/);
-    if (!scrapeMatch) {
+     if (!scrapeMatch) {
-      throw new Error('scrapeTab function not found');
+       throw new Error('scrapeTab function not found');
-    }
+      }
-    if (!scrapeMatch[0].includes('allFrames: true')) {
+     if (!scrapeMatch[0].includes('allFrames: true')) {
-      throw new Error('scrapeTab must use allFrames: true');
+       throw new Error('scrapeTab must use allFrames: true');
-    }
+      }
-  });
+    });
+
+   it('deep probe + scrape must run in the MAIN world (see page globals)', () => {
+      // The deep probe and scraper read page globals (window.Hls, player
+      // instances, video._goon_hls_manifest) and window.__goon_plugin_data,
+      // which the main-world interceptors write. The isolated world cannot see
+      // these, so a missing `world: 'MAIN'` makes every main-world strategy find
+      // 0 manifests — the "detects nothing on pages with just <video> elements"
+      // regression. Guard the exact executeScript calls that run each function.
+     const indexSource = fs.readFileSync(
+       path.join(__dirname, '../src/viewer/index.js'),
+       'utf-8'
+       );
+
+      // Capture each call's target + func block (world: 'MAIN' lives on the
+      // target: line, which precedes func:).
+     const probeMatch = indexSource.match(/executeScript\(\{[\s\S]*?func: m3u8DeepProbeFn/);
+     if (!probeMatch) throw new Error('deep probe executeScript call not found');
+     if (!probeMatch[0].includes("world: 'MAIN'")) {
+       throw new Error('deep probe (m3u8DeepProbeFn) must use world: "MAIN" to see page globals');
+       }
+
+     const scrapeMatch = indexSource.match(/executeScript\(\{[\s\S]*?func: scrapeFn/);
+     if (!scrapeMatch) throw new Error('scrape executeScript call not found');
+     if (!scrapeMatch[0].includes("world: 'MAIN'")) {
+       throw new Error('scrape (scrapeFn) must use world: "MAIN" to see page globals');
+       }
+     });
 
   it('should inject interceptors into all frames (content_scripts.all_frames)', () => {
     const manifestSource = fs.readFileSync(
@@ -1211,6 +1238,73 @@ describe('HLS QA: Edge cases', () => {
 
     if (intercepted.length !== 1) {
       throw new Error(`Expected 1 intercept for /manifest URL, got ${intercepted.length}`);
-    }
+       }
-  });
+     });
-});
+    });
+
+/* ========================================================================== */
+/* Test: deep probe must not report route-template / nav "manifests"            */
+/* ========================================================================== */
+
+describe('HLS QA: route-template / nav URL rejection', () => {
+   const probeMatch = indexSource.match(/function m3u8DeepProbeFn\(\)[\s\S]*?^}/m);
+   if (!probeMatch) throw new Error('Could not find m3u8DeepProbeFn in index.js');
+   const probeFnSource = probeMatch[0];
+
+   function runProbeWin(url, globals) {
+     const dom = new JSDOM(
+      '<!DOCTYPE html><html><body><video></video></body></html>',
+        { url, runScripts: 'dangerously' });
+     const win = dom.window;
+     for (const [k, v] of Object.entries(globals)) win[k] = v;
+     const result = win.eval(`(${probeFnSource})();`);
+     if (!Array.isArray(result)) throw new Error('m3u8DeepProbeFn did not return an array');
+     return result;
+      }
+
+     // Reproduces a provider whose pageContext.langUrls holds server-side route
+     // TEMPLATES / nav links (e.g. /playlists/, /playlist/%1%/video/%2%/) that the
+     // old /playlist|/manifest substring check misclassified as "manifests".
+   const TEMPLATE_URLS = [
+      'https://example.com/playlists/',
+      'https://example.com/playlists/liked/',
+      'https://example.com/playlists/popular/',
+      'https://example.com/playlists/commented/',
+      'https://example.com/playlists/updated/',
+      'https://example.com/playlists/largest/',
+      'https://example.com/playlist/%1%/video/%2%/',
+      'https://example.com/playlists/?category=%DIR%',
+      'https://example.com/members/%ID%/playlists/',
+      'https://example.com/my/playlists/%ID%/',
+      ];
+
+   it('route templates / nav links are NOT reported as manifests', () => {
+     const result = runProbeWin('https://example.com/videos/redneck/', {
+       pageContext: { langUrls: TEMPLATE_URLS },
+       kvsplayer: { config: { langUrls: TEMPLATE_URLS } },
+        __goon_plugin_data: { manifests: [], sources: [] },
+        });
+     const urls = result.map(m => m.url);
+     const leaked = TEMPLATE_URLS.filter(u => urls.includes(u));
+     if (leaked.length > 0) {
+       throw new Error(`template/nav URLs leaked as manifests: ${leaked.join(', ')}`);
+         }
+       });
+
+   it('a real .m3u8 with a %2B token is still found (no over-rejection)', () => {
+         // %2B is a valid percent-encoded token, not a placeholder — it must survive.
+     const real = 'https://cdn.example.com/live/master.m3u8?h=a%2Bb%2Fc&e=1234';
+     const result = runProbeWin('https://example.com/videos/redneck/', {
+       hls: { url: real },
+       pageContext: { langUrls: TEMPLATE_URLS },
+        });
+     if (!result.some(m => m.url === real)) {
+       throw new Error(`real manifest with %2B token was dropped: ${real} — got: ${result.map(m => m.url).join(', ')}`);
+        }
+         // And the templates still must not leak in the same run.
+     const leaked = TEMPLATE_URLS.filter(u => result.some(m => m.url === u));
+     if (leaked.length > 0) {
+       throw new Error(`templates leaked alongside real manifest: ${leaked.join(', ')}`);
+        }
+       });
+     });

__tests__/referer_proxy.test.mjs

@@ -0,0 +1,364 @@
+/**
+ * referer_proxy.test.mjs — coverage for the background worker's per-CDN-host
+ * referer capture + DNR proxy-host learning, added in PR #5.
+ *
+ * The background worker is not itself a module, so the test transpiles it into
+ * one (wrapping + top-level-statement `async function` transpile) under a mocked
+ * `chrome` + `fetch`/`btoa` environment, then exercises the captured listeners
+ * and the message handler directly.
+ *
+ * Covers the three gaps robot flagged:
+ *  (a) closing a tab must NOT wipe the host-keyed `goon_referers` global store,
+ *  (b) two hosts proxied concurrently must each keep their OWN referer (no race
+ *      that leaves host B's referer live for host A -> 412),
+ *  (c) the new referer-capture / proxy-host-learning / onRemoved paths run.
+ */
+import { describe, it } from './runner.mjs';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { dirname, join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const backgroundSource = readFileSync(join(__dirname, '../src/background/background.js'), 'utf8');
+
+// Transpile the top-level-statement worker into an ES module. Wrapping in an
+// async IIFE makes its top-level `async function` declarations + `await`-using
+// nested functions legal inside a module.
+function buildModule(code) {
+  return `(async () => {\n${code}\n})();\n`;
+}
+
+  // A fresh mock of the chrome APIs the worker touches. `onBeforeRequest` and
+  // `tabs.onRemoved` capture their listener, and `tabs.get` serves the source
+  // tab's URL (the captured referer); `declarativeNetRequest.updateSessionRules`
+  // records the live rules.
+function makeChromeEnv() {
+  const storage = {};
+  const handlers = { onMessage: [] };
+  const tabUrls = {};
+  let sessionRules = {};
+
+  const webRequest = {
+    onBeforeRequest: { addListener: (cb) => { handlers.onBeforeRequest = cb; } },
+    };
+
+  const chrome = {
+    storage: {
+     local: {
+      get: async (keys) => {
+        const out = {};
+        const arr = Array.isArray(keys) ? keys : (keys === undefined ? Object.keys(storage) : [keys]);
+        for (const k of arr) if (k in storage) out[k] = storage[k];
+        return out;
+        },
+      set: async (data) => {
+        for (const [k, v] of Object.entries(data)) storage[k] = v;
+        },
+      remove: async (keys) => {
+        const arr = Array.isArray(keys) ? keys : [keys];
+        for (const k of arr) delete storage[k];
+        },
+      },
+     },
+    webRequest,
+     tabs: {
+      get: async (tabId) => tabUrls[tabId] ? { tabId, url: tabUrls[tabId] } : undefined,
+      onRemoved: { addListener: (cb) => { handlers.onRemoved = cb; } },
+       },
+    runtime: { onMessage: { addListener: (cb) => { handlers.onMessage.push(cb); } } },
+    declarativeNetRequest: {
+      updateSessionRules: async ({ removeRuleIds = [], addRules = [] } = {}) => {
+        const rm = new Set(removeRuleIds);
+        sessionRules = Object.fromEntries(
+          Object.entries(sessionRules).filter(([id]) => !rm.has(id))
+         );
+        for (const r of addRules) sessionRules[r.id] = r;
+        },
+      },
+   };
+
+  return { chrome, handlers, storage, tabUrls,
+     setTabUrl: (tabId, url) => { tabUrls[tabId] = url; },
+     getSessionRules: () => sessionRules };
+}
+
+// Load the worker into a fresh environment. `data:` URLs are cached by Node, so
+// the module body (listener registration) would only run once; instead we write
+// a uniquely-named temp file per load so each call registers into its own env.
+let loadCounter = 0;
+async function loadBackground(env) {
+  global.chrome = env.chrome;
+  const file = join(tmpdir(), `goon_bg_${process.pid}_${loadCounter++}.mjs`);
+  writeFileSync(file, buildModule(backgroundSource));
+  const module = await import(pathToFileURL(file).href);
+  await module.default;
+  return module;
+}
+
+// Drive a referer capture the way the worker now does it: the worker reads the
+// source tab's URL (via chrome.tabs.get) as the provider referer, so we set the
+// tab's URL and fire an onBeforeRequest for a video URL on that tab.
+async function capture(env, videoUrl, referer) {
+  env.setTabUrl(11, referer);
+  await env.handlers.onBeforeRequest({ tabId: 11, url: videoUrl });
+}
+
+describe('PR#5: per-host referer capture + proxy race', () => {
+   // (a) Blocking fix: a host-keyed `goon_referers` entry must outlive the close
+   // of ANY tab — including a different tab.
+  it('closing a tab does not wipe goon_referers captured for another host', async () => {
+    const env = makeChromeEnv();
+    global.chrome = env.chrome;
+    await loadBackground(env);
+
+      // A live source tab captures the provider referer for its CDN host.
+    await capture(env, 'https://cdnA.example.com/hls/live/seg-1.ts', 'https://pageA.example.com/watch');
+
+    const rA = env.storage['goon_referers']?.['example.com'];
+    if (!rA) throw new Error('referer was not captured for cdnA');
+    if (rA.referer !== 'https://pageA.example.com/watch') {
+      throw new Error('captured referer wrong: ' + JSON.stringify(rA));
+      }
+
+      // A DIFFERENT tab closes. The per-tab cleanup must NOT remove goon_referers.
+    await env.handlers.onRemoved(22);
+
+    const after = env.storage['goon_referers'];
+    if (!after || !after['example.com']) {
+      throw new Error('closing tab 22 wiped goon_referers — host A referer lost');
+      }
+      if (after['example.com'].referer !== 'https://pageA.example.com/watch') {
+       throw new Error('closing tab 22 corrupted the host A referer: ' + JSON.stringify(after));
+       }
+   });
+
+  it('closing the capturing tab itself preserves the referer for later proxy use', async () => {
+    const env = makeChromeEnv();
+    global.chrome = env.chrome;
+    await loadBackground(env);
+
+    await capture(env, 'https://cdnB.example.com/video/x/master.m3u8', 'https://pageB.example.com/v');
+
+       // The very tab that captured the referer now closes.
+    await env.handlers.onRemoved(11);
+
+    const after = env.storage['goon_referers']?.['example.com'];
+    if (!after) throw new Error('goon_referers for the capturing host was wiped on its own tab close');
+    if (after.referer !== 'https://pageB.example.com/v') {
+      throw new Error('capturing-tab close corrupted referer: ' + JSON.stringify(after));
+     }
+   });
+
+   // (b) Should-fix + coverage: two hosts proxied concurrently must each keep
+   // their own referer. With a shared rule id + non-atomic install this regressed;
+   // per-host rule ids + the per-host lock keep them distinct.
+  it('concurrent proxy fetches for two distinct registrable domains keep distinct referer rules', async () => {
+    const env = makeChromeEnv();
+    let fetchCalls = 0;
+    global.chrome = env.chrome;
+     global.fetch = async (url) => {
+      fetchCalls++;
+      return {
+        ok: true,
+        status: 200,
+        headers: { get: () => 'application/vnd.apple.mpegurl' },
+        arrayBuffer: async () => new Uint8Array([0]).buffer,
+       };
+     };
+
+    await loadBackground(env);
+
+      // Two GOON_PROXY_FETCH messages for different CDN hosts, fired together.
+    const handler = env.handlers.onMessage[env.handlers.onMessage.length - 1];
+    let respA, respB;
+    handler({ type: 'GOON_PROXY_FETCH', url: 'https://cdnA.example.com/hls/live/seg-1.ts', referer: 'https://pageA.example.com/watch' }, {}, (r) => { respA = r; });
+    handler({ type: 'GOON_PROXY_FETCH', url: 'https://cdnB.other.com/hls/live/seg-1.ts', referer: 'https://pageB.other.com/watch' }, {}, (r) => { respB = r; });
+
+     await new Promise(r => setTimeout(r, 30)); // let async sends + installs flush
+
+    if (!respA || !respA.ok) throw new Error('proxy A failed: ' + JSON.stringify(respA));
+    if (!respB || !respB.ok) throw new Error('proxy B failed: ' + JSON.stringify(respB));
+    if (fetchCalls < 2) throw new Error('expected both proxy fetches to run, got ' + fetchCalls);
+
+    // Each host must have its OWN installed DNR rule with its OWN referer —
+    // host A must NOT be served host B's referer (the 412 regression).
+     const rules = env.getSessionRules();
+    const ruleA = Object.values(rules).find(r => r.condition?.requestDomains?.includes('example.com'));
+    const ruleB = Object.values(rules).find(r => r.condition?.requestDomains?.includes('other.com'));
+    if (!ruleA) throw new Error('no DNR rule installed for cdna; rules=' + JSON.stringify(rules));
+    if (!ruleB) throw new Error('no DNR rule installed for cdnb; rules=' + JSON.stringify(rules));
+    if (ruleA.id === ruleB.id) {
+      throw new Error('cdnA and cdnB shared a DNR rule id -> concurrent race possible');
+     }
+    const refA = ruleA.action.requestHeaders?.find(h => h.header.toLowerCase() === 'referer')?.value;
+    const refB = ruleB.action.requestHeaders?.find(h => h.header.toLowerCase() === 'referer')?.value;
+    if (refA !== 'https://pageA.example.com/watch') {
+      throw new Error('cdnA served wrong referer: ' + refA);
+     }
+    if (refB !== 'https://pageB.other.com/watch') {
+      throw new Error('cdnB served wrong referer: ' + refB);
+     }
+    if (refA === refB) throw new Error('both hosts got the same referer — cross-host bleed');
+   });
+
+  it('repeated proxy for the same host is idempotent (one rule, one install)', async () => {
+    const env = makeChromeEnv();
+    let installs = 0;
+    env.chrome.declarativeNetRequest.updateSessionRules = async ({ addRules = [] } = {}) => {
+      for (const r of addRules) installs++;
+     };
+    global.chrome = env.chrome;
+    global.fetch = async () => ({
+      ok: true, status: 200,
+      headers: { get: () => 'application/vnd.apple.mpegurl' },
+      arrayBuffer: async () => new Uint8Array([0]).buffer,
+     });
+
+    await loadBackground(env);
+    const handler = env.handlers.onMessage[env.handlers.onMessage.length - 1];
+
+    const run = async (n) => {
+      handler(
+        { type: 'GOON_PROXY_FETCH', url: 'https://cdnA.example.com/hls/live/seg-1.ts', referer: 'https://pageA.example.com/watch' },
+        {},
+        () => {}
+       );
+      await new Promise(r => setTimeout(r, 5));
+     };
+    await run(1);
+    const installsAfterFirst = installs;
+    await run(2);
+    await run(3);
+
+     // Same host + same referer should not re-add the rule on repeat fetches.
+    if (installs !== installsAfterFirst) {
+      throw new Error(`expected idempotent install, but re-added rule ${installs - installsAfterFirst} extra time(s)`);
+     }
+   });
+
+   // (c) Domain generalization — the core 412 fix. A provider referer captured for
+   // ONE edge subdomain must cover a SIBLING subdomain: the DNR rule is scoped to
+   // the registrable domain and the store is domain-keyed, so a proxy for ev-h
+   // needs no per-subdomain capture.
+  it('a proxy for a sibling subdomain reuses the captured referer via the registrable domain', async () => {
+    const env = makeChromeEnv();
+    global.chrome = env.chrome;
+    global.fetch = async () => ({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/vnd.apple.mpegurl' },
+      arrayBuffer: async () => new Uint8Array([0]).buffer,
+       });
+    await loadBackground(env);
+
+       // Capture the provider referer for hv-h.example.net (one edge subdomain).
+    await capture(env, 'https://hv-h.example.net/hls/live/seg-1.ts', 'https://provider.example.com/watch');
+
+       // Proxy a SIBLING subdomain ev-h.example.net with NO referer in the message:
+     // the SW must resolve it from the domain-keyed store.
+    const handler = env.handlers.onMessage[env.handlers.onMessage.length - 1];
+    let resp;
+    handler({ type: 'GOON_PROXY_FETCH', url: 'https://ev-h.example.net/hls/live/seg-1.ts' }, {}, (r) => { resp = r; });
+    await new Promise(r => setTimeout(r, 20));
+
+    if (!resp || !resp.ok) throw new Error('sibling proxy failed: ' + JSON.stringify(resp));
+    const rules = env.getSessionRules();
+    const rule = Object.values(rules).find(r => r.condition?.requestDomains?.includes('example.net'));
+    if (!rule) throw new Error('no domain-scoped DNR rule for example.net; rules=' + JSON.stringify(rules));
+    const ref = rule.action.requestHeaders?.find(h => h.header.toLowerCase() === 'referer')?.value;
+    if (ref !== 'https://provider.example.com/watch') {
+      throw new Error('sibling edge served wrong referer: ' + ref);
+       }
+     // The rule is scoped to the registrable domain, NOT the exact subdomain.
+    if (rule.condition.requestDomains?.includes('ev-h.example.net')) {
+      throw new Error('rule scoped to exact subdomain instead of registrable domain');
+       }
+    });
+
+   // (d) With no captured referer and none in the message, install NO rule: the
+   // self-origin fallback (guaranteed-wrong for hotlink protection) is dropped.
+  it('no captured referer and no message referer installs no DNR rule', async () => {
+    const env = makeChromeEnv();
+    let fetchCalls = 0;
+    global.chrome = env.chrome;
+    global.fetch = async () => {
+      fetchCalls++;
+      return {
+        ok: true,
+        status: 200,
+        headers: { get: () => 'application/vnd.apple.mpegurl' },
+        arrayBuffer: async () => new Uint8Array([0]).buffer,
+         };
+       };
+    await loadBackground(env);
+    const handler = env.handlers.onMessage[env.handlers.onMessage.length - 1];
+    let resp;
+    handler({ type: 'GOON_PROXY_FETCH', url: 'https://cdnA.example.com/hls/live/seg-1.ts' }, {}, (r) => { resp = r; });
+    await new Promise(r => setTimeout(r, 20));
+
+    if (!resp || !resp.ok) throw new Error('proxy fetch failed: ' + JSON.stringify(resp));
+    if (fetchCalls < 1) throw new Error('proxy fetch did not run');
+    const rules = env.getSessionRules();
+    if (Object.keys(rules).length !== 0) {
+      throw new Error('installed a rule with no referer (self-origin fallback not dropped): ' + JSON.stringify(rules));
+       }
+    });
+
+   // (e) GOON_GET_REFERERS (used by scan-time capture) resolves each manifest host
+   // via the domain-keyed store: a sibling subdomain gets the provider referer,
+   // and an uncaptured host is omitted.
+  it('GOON_GET_REFERERS resolves manifest hosts through the domain-keyed store', async () => {
+    const env = makeChromeEnv();
+    global.chrome = env.chrome;
+    await loadBackground(env);
+
+        // Capture for hv-h.example.net only.
+    await capture(env, 'https://hv-h.example.net/hls/live/seg-1.ts', 'https://provider.example.com/watch');
+
+    const handler = env.handlers.onMessage[env.handlers.onMessage.length - 1];
+    let resp;
+    handler(
+       { type: 'GOON_GET_REFERERS', hosts: ['ev-h.example.net', 'hv-h.example.net', 'cdnA.example.com'] },
+       {},
+       (r) => { resp = r; });
+    await new Promise(r => setTimeout(r, 15));
+
+    if (!resp || !resp.ok) throw new Error('GOON_GET_REFERERS failed: ' + JSON.stringify(resp));
+    const referers = resp.referers || {};
+    if (referers['ev-h.example.net'] !== 'https://provider.example.com/watch') {
+      throw new Error('sibling subdomain did not resolve the captured referer: ' + JSON.stringify(referers));
+       }
+    if (referers['hv-h.example.net'] !== 'https://provider.example.com/watch') {
+      throw new Error('captured subdomain did not resolve its own referer: ' + JSON.stringify(referers));
+       }
+    if ('cdnA.example.com' in referers) {
+      throw new Error('uncaptured host should be omitted from referers: ' + JSON.stringify(referers));
+       }
+    });
+
+     // Regression for the live 412 bug: the worker captures the provider referer
+     // from the source tab's URL via chrome.tabs.get inside onBeforeRequest. The
+     // old path read request headers via onBeforeSendHeaders + extraInfoSpec, which
+     // is rejected by some Chromium builds and fails the whole service worker, so it
+     // was removed; this asserts the new tab-URL capture is wired up and actually
+     // stores a referer.
+   it('the onBeforeRequest capture reads the referer from the source tab URL', async () => {
+     const env = makeChromeEnv();
+     global.chrome = env.chrome;
+     await loadBackground(env);
+
+     const cap = env.handlers.onBeforeRequest;
+     if (!cap) throw new Error('onBeforeRequest listener was not registered');
+
+     // A video request for cdnA from a tab whose URL IS the provider referer.
+     env.setTabUrl(11, 'https://pageA.example.com/watch');
+     await cap({ tabId: 11, url: 'https://cdnA.example.com/hls/live/seg-1.ts' });
+
+     const rA = env.storage['goon_referers']?.['example.com'];
+     if (!rA) throw new Error('referer was not captured from the source tab URL');
+     if (rA.referer !== 'https://pageA.example.com/watch') {
+       throw new Error('captured referer wrong: ' + JSON.stringify(rA));
+        }
+     });
+   });

__tests__/run.mjs

@@ -7,6 +7,8 @@ import './data_flow.test.mjs';
 import './viewer_integration.test.mjs';
 import './config_validation.test.mjs';
 import './hls_qa.test.mjs';
+import './simple_video.test.mjs';
+import './referer_proxy.test.mjs';
 import { run } from './runner.mjs';
 
 const result = await run();

__tests__/simple_video.test.mjs

@@ -0,0 +1,131 @@
+// Regression tests: simple <video> / direct-media detection.
+//
+// The feature branch broke detection of pages that expose a plain <video>
+// (e.g. a site that serves a direct MP4 with a TRAILING SLASH and a
+// ?rnd= query: .../14644093/14644093.mp4/?rnd=...). Two site-agnostic fixes
+// are guarded here:
+//   1) The URL predicate (isValidManifestUrl) must let concrete media signals
+//      (.mp4/.m3u8/.webm/... and /hls/) WIN over the placeholder/`%`/trailing-
+//      slash rejections, so a real direct-media URL is not mistaken for a
+//      route template.
+//   2) scrapeTab must fall back to an ISOLATED-world scrape when the MAIN-world
+//      scrape yields nothing — the runtime cause of "detects nothing" on such pages
+//      is a MAIN-world + allFrames rejection on its ad-iframe-heavy page.
+import { describe, it } from './runner.mjs';
+import { JSDOM } from 'jsdom';
+import * as fs from 'fs';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const indexSource = fs.readFileSync(
+  path.join(__dirname, '../src/viewer/index.js'),
+   'utf-8'
+);
+
+// Extract a `function <name>(...) {…}` by balanced-brace scan. Robust to the
+// file's quirky/mixed indentation (a column-0 `}` heuristic would mis-truncate
+// nested or oddly-indented bodies).
+function extractFn(src, name) {
+  const re = new RegExp('function ' + name + '\\s*\\(');
+  const m = re.exec(src);
+  if (!m) throw new Error('not found: ' + name);
+  const start = m.index;
+  let i = src.indexOf('{', start), depth = 0;
+  for (; i < src.length; i++) {
+    const c = src[i];
+    if (c === '{') depth++;
+    else if (c === '}') { depth--; if (depth === 0) return src.slice(start, i + 1); }
+   }
+  throw new Error('unbalanced: ' + name);
+}
+
+// The direct-media URL, shaped exactly like the rejected case (a trailing slash +
+// ?rnd= query). This is the concrete case the predicate used to reject.
+const DIRECT_MP4 =
+  'https://example.com/get_file/5/6cae22f8b3ba9d74f10cc2f8d060af738c8d30ddf5/14644000/14644093/14644093.mp4/?rnd=1787811205406';
+
+describe('HLS QA: simple <video> direct-media predicate', () => {
+  // Extract and evaluate the REAL isValidManifestUrl from index.js in a browser
+  // window so its `new URL(...)` / string behavior matches production.
+  const isValidSrc = extractFn(indexSource, 'isValidManifestUrl');
+
+  function assertValid(url, expectValid, label) {
+    const dom = new JSDOM(
+      '<!DOCTYPE html><html><body></body></html>',
+       { url: 'https://example.com/videos/x/', runScripts: 'dangerously' }
+     );
+    const got = dom.window.eval('(' + isValidSrc + ')(' + JSON.stringify(url) + ')');
+    if (got !== expectValid) {
+      throw new Error(
+        `${label || 'isValidManifestUrl'}(${url}) = ${got}, expected ${expectValid}`
+       );
+    }
+  }
+
+  it('accepts a real direct-MP4 URL WITH a trailing slash + ?rnd=', () => {
+    // Before the fix, `path.endsWith('/')` rejected this real media source.
+    assertValid(DIRECT_MP4, true, 'trailing-slash MP4');
+   });
+
+  it('accepts a direct .mp4 with no trailing slash', () => {
+    assertValid('https://cdn.example.com/vids/abc123.mp4', true, 'plain MP4');
+   });
+
+  it('accepts real .m3u8 / .webm / .mpd / .m4s / /hls/ media signals', () => {
+    assertValid('https://cdn.example.com/live/master.m3u8', true, 'master.m3u8');
+    assertValid('https://cdn.example.com/seg/webm/v.webm', true, 'webm');
+    assertValid('https://cdn.example.com/seg/dash/master.mpd', true, 'mpd');
+    assertValid('https://cdn.example.com/seg/1-0.m4s', true, 'm4s');
+    assertValid('https://cdn.example.com/hls/abc/playlist.m3u8', true, '/hls/');
+   });
+
+  it('does not over-reject a real .m3u8 carrying a valid %2B/%2F token', () => {
+     // %2B/%2F are valid percent-encoded hex pairs — a genuine auth token, not a
+    // route-template placeholder, so it must survive.
+    assertValid('https://cdn.example.com/live/master.m3u8?h=a%2Bb%2Fc&e=1234', true, '%2B token');
+   });
+
+  it('still rejects route-template / nav URLs (no over-acceptance)', () => {
+     // The fix must not trade one regression for the other: the route templates
+    // a provider's pageContext.langUrls leaks must still be rejected.
+    assertValid('https://example.com/playlists/', false, '/playlists/');
+    assertValid('https://example.com/playlists/liked/', false, '/playlists/liked/');
+    assertValid('https://example.com/playlist/%1%/video/%2%/', false, '/playlist/%1%/');
+    assertValid('https://example.com/members/%ID%/playlists/', false, '/members/%ID%/playlists/');
+    assertValid('https://example.com/videos/%DIR%/', false, '/videos/%DIR%/');
+   });
+});
+
+describe('HLS QA: scrapeTab isolated-world fallback', () => {
+  // Extract the whole scrapeTab function (balanced braces, indentation-agnostic).
+  const scrapeSrc = extractFn(indexSource, 'scrapeTab');
+
+  it('runs an isolated-world scrape attempt (no `world` key) as a fallback', () => {
+    const calls = scrapeSrc.match(/executeScript\(\s*\{[\s\S]*?\}\s*\)/g) || [];
+    if (calls.length === 0) {
+      throw new Error('scrapeTab has no executeScript call');
+     }
+     // At least one executeScript must omit `world` so it runs in the always-
+    // permitted isolated world (recovers simple videos a MAIN-world injection
+    // rejects on sandboxed/opaque-origin ad iframes).
+    const hasIsolated = calls.some((c) => !/\bworld\s*:/.test(c));
+    if (!hasIsolated) {
+      throw new Error(
+        'scrapeTab has no isolated-world (no `world:`) executeScript fallback — ' +
+         'a MAIN-world+allFrames rejection on an ad-iframe-heavy page leaves 0 videos'
+       );
+    }
+   });
+
+  it('primary scrape still uses world: \'MAIN\' (reads page globals)', () => {
+    const calls = scrapeSrc.match(/executeScript\(\s*\{[\s\S]*?\}\s*\)/g) || [];
+    const hasMain = calls.some((c) => /world\s*:\s*['"]MAIN['"]/.test(c));
+    if (!hasMain) {
+      throw new Error(
+        'scrapeTab primary attempt must use world: "MAIN" to read page globals ' +
+         '(interceptor data, Hls instances, custom <video> props)'
+       );
+    }
+   });
+});

manifest.json

@@ -3,13 +3,13 @@
   "name": "VidPlex",
   "version": "0.1.0",
   "description": "Find videos on any page and view them in a grid.",
-    "permissions": [
+      "permissions": [
-        "storage",
+          "storage",
-        "tabs",
+          "tabs",
-        "scripting",
+          "scripting",
-        "webRequest",
+            "webRequest",
-        "declarativeNetRequest"
+            "declarativeNetRequest"
-    ],
+       ],
   "host_permissions": [
     "<all_urls>"
   ],

package.json

@@ -23,5 +23,7 @@
     "typescript": "^5.7.0",
     "vite": "^6.0.0",
     "vitest": "^3.0.0"
+  },
+  "dependencies": {
   }
 }

src/background/background.js

@@ -23,13 +23,12 @@ function isHlsManifest(url) {
          u.includes('/playlist.m3u') || u.includes('/manifest');
 }
 
-// === STRATEGY 8: Network-level fallback — log ALL phncdn.com and video-related requests ===
+// === STRATEGY 8: Network-level fallback — log video requests across any CDN ===
-// Pornhub's es6player generates HLS manifests in-memory with zero .m3u8 network requests.
+// Some players generate HLS manifests in-memory and make zero .m3u8 network
-// However, the player still fetches video segments from phncdn.com. By logging all phncdn
+// requests, only fetching video segments from a CDN. By logging every video-like
-// requests we can: (a) confirm HLS activity via segment patterns, (b) reconstruct manifest
+// request (any host) we can: (a) confirm HLS activity via segment patterns,
-// URLs from segment paths, (c) detect CDN response headers that reveal playlist endpoints.
+// (b) reconstruct manifest URLs from segment paths, (c) detect CDN response
-
+// headers that reveal playlist endpoints. No site-specific host list.
-const PHNCDN_HOSTS = ['phncdn.com', 'pornhubpremium.com', 'cdn.pornhub.com'];
 const VIDEO_PATH_PATTERNS = ['/hls/', '/dash/', '/video/', '/segment', '/media/', '/stream'];
 
 function isVideoRequest(url) {
@@ -47,7 +46,7 @@ async function persistVideoRequest(tabId, url) {
   try {
     const stored = await chrome.storage.local.get(key);
     const arr = stored[key] || [];
-    // Avoid duplicates — phncdn segments come in rapid succession
+    // Avoid duplicates — video segments come in rapid succession
     if (!arr.some(r => r === url)) {
       arr.push(url);
       // Keep last 200 requests per tab (enough to detect segment patterns)
@@ -59,26 +58,28 @@ async function persistVideoRequest(tabId, url) {
   }
 }
 
-// --- phncdn token / URL helpers ------------------------------------------
+// --- Token / URL helpers ------------------------------------------
 //
-// The phncdn auth token (h= / hash= / hdnea=) is base64 and its %-encoded
+// A media CDN's auth token (h= / hash= / hdnea=) is base64 and its %-encoded
 // escapes are significant: a `+` decoded to a space corrupts it, which is what
 // produces the 410 Gone the live player avoids by sending `%2B`. So every
 // helper below keeps the query string RAW — it is never passed through
 // URLSearchParams (which decodes + -> space).
 
-// Extract the phncdn videoId from a /hls/videos/ URL; '' if it isn't one.
+// Group key for a video's URL: the path directory holding its variant/segment
-// Path shape: /hls/videos/{year}/{subdir}/{videoId}/{variant}/...
+// (the last non-file path segment of a CDN URL). Used to match the freshest
-function extractVideoId(url) {
+// live URL by video, host-independent. '' when the URL is malformed.
-  if (!url || !url.includes('/hls/videos/')) return '';
+function extractGroupKey(url) {
+  if (!url) return '';
   try {
     const path = new URL(url).pathname.split('/');
-    const hlsIdx = path.findIndex(p => p === 'hls');
+    // Drop the final (file/segment or manifest) segment; the remaining
-    if (hlsIdx === -1 || hlsIdx + 4 >= path.length) return '';
+    // directory joins into a key that is stable across a video's variants.
-    return path[hlsIdx + 4];
+    path.pop();
-   } catch {
+    return path.join('/');
+  } catch {
     return '';
-   }
+  }
 }
 
 // Raw query (everything after '?') with no decoding. '' when absent.
@@ -99,31 +100,24 @@ function tokenExpirySeconds(rawQuery) {
   return secs;
 }
 
- // Build a manifest URL for a variant directory from a raw phncdn URL,
+  // Build the parent manifest URL for a segment URL, keeping the FULL path to
- // preserving the FULL variant path and the raw query (token encoding intact).
+  // the variant directory and the RAW query (token encoding intact). Swaps the
- // /hls/videos/{year}/{subid}/{videoId}/{variant}/seg-1.ts  ->
+  // segment filename for a manifest filename in the same directory:
- // /hls/videos/{year}/{subid}/{videoId}/{variant}/master.m3u8
+  // {host}/path/to/variant/seg-1.ts   ->   {host}/path/to/variant/master.m3u8
- // The variant directory (e.g. 720P_4000K_338337051.mp4) is MANDATORY — a master
+  // The variant directory is MANDATORY — a master playlist lives inside it;
- // playlist lives inside it; dropping it (the old bug) yields a 410. Returns ''
+  // dropping it yields a 404/410. Returns '' for non-segment URLs.
- // when the URL isn't a phncdn HLS URL with a complete variant path.
+  function buildManifestForVariant(url) {
- function buildManifestForVariant(rawUrl) {
+  if (!url || !/\/seg-\d+/i.test(url)) return '';
-  if (!rawUrl || !rawUrl.includes('/hls/videos/')) return '';
   try {
-    const path = rawUrl.split('?')[0];
+    const [pathPart, queryPart] = url.split('?');
-    const parts = path.split('/');
+    const idx = pathPart.lastIndexOf('/');
-    const hlsIdx = parts.findIndex(p => p === 'hls');
+    if (idx === -1) return '';
-       // Need hls, videos, year, subdir, videoId, variant (6 dirs).
+    const dir = pathPart.slice(0, idx);            // variant directory
-    if (hlsIdx === -1 || hlsIdx + 5 >= parts.length) return '';
+    const rawQuery = queryPart ? '?' + queryPart : '';
-    const prefix = parts.slice(0, hlsIdx + 2).join('/');   // .../hls/videos
+    return `${dir}/master.m3u8${rawQuery}`;
-    const year = parts[hlsIdx + 2];
+       } catch {
-    const subid = parts[hlsIdx + 3];
-    const videoId = parts[hlsIdx + 4];
-    const variant = parts[hlsIdx + 5];
-    const rawQuery = extractRawQuery(rawUrl);
-    return `${prefix}/${year}/${subid}/${videoId}/${variant}/master.m3u8${rawQuery ? '?' + rawQuery : ''}`;
-     } catch {
     return '';
-     }
+       }
 }
 
 // Reconstruct manifest URLs from segment URLs, keeping the raw query intact.
@@ -133,124 +127,145 @@ function reconstructManifestsFromSegments(segments) {
   const seen = new Set();
   const manifests = [];
   for (const url of segments) {
-       // Only handle HLS segment URLs: /hls/videos/{..}/{variant}/seg-N.ts
+        // Only handle video/segment URLs (e.g. .../seg-N.ts).
-    if (!url.includes('/hls/videos/') || !/\/seg-\d+/.test(url)) continue;
     const manifestUrl = buildManifestForVariant(url);
     if (manifestUrl && !seen.has(manifestUrl)) {
       seen.add(manifestUrl);
       manifests.push(manifestUrl);
+        }
        }
-      }
   return manifests;
 }
 
-// Collect phncdn URLs across ALL tabs without a tabs.query match pattern (which
+// Collect captured video URLs across ALL tabs without a tabs.query match pattern
-// throws if the pattern is malformed). We scan every persisted vr_requests_ /
+// (which throws if the pattern is malformed). We scan every persisted vr_requests_ /
 // wr_manifests_ key so the rescan works even if the live source tab is closed.
-async function collectAllPhncdnUrls() {
+async function collectAllVideoUrls() {
   const all = await chrome.storage.local.get();
   const out = [];
   for (const key of Object.keys(all)) {
     if ((key.startsWith('vr_requests_') || key.startsWith('wr_manifests_')) && Array.isArray(all[key])) {
       out.push(...all[key]);
-     }
+      }
-   }
+    }
   return out;
 }
 
- // For a videoId, return the freshest live phncdn URL (highest token expiry)
+  // For a group key, return the freshest live captured URL (highest token
- // across all persisted tabs, preferring captured .m3u8 manifest URLs. null if
+  // expiry) across all persisted tabs, preferring captured .m3u8 manifest URLs.
- // nothing usable is captured yet. Rescans use this to replace a stored URL that
+  // null if nothing usable is captured yet. Rescans use this to replace a
- // now 410s with the newest token the live tab captured.
+  // stored URL that now 410s with the newest token the live tab captured.
- //
+  //
- // No tabs.query match pattern is used: '*pornhub.com*' is an INVALID pattern and
+  // No tabs.query match pattern is used: match patterns are brittle (a bad
- // made this throw ("Invalid url pattern"), which silently dropped every rescan.
+  // pattern throws "Invalid url pattern" and silently drops every rescan).
- // We scan persisted capture data instead, which is always available and
+  // We scan persisted capture data instead, which is always available and
- // sidesteps the match-Pattern API entirely.
+  // sidesteps the match-pattern API entirely.
-async function freshLiveForVideo(videoId, preferManifest) {
+ async function freshLiveForGroup(groupKey, preferManifest) {
   let all;
   try {
-    all = await collectAllPhncdnUrls();
+    all = await collectAllVideoUrls();
-    } catch (e) {
+     } catch (e) {
-    console.warn('[goon-bg] collectAllPhncdnUrls failed:', e && e.message ? e.message : e);
+    console.warn('[goon-bg] collectAllVideoUrls failed:', e && e.message ? e.message : e);
     all = [];
-    }
+     }
 
   let bestManifest = null, bestManifestExp = 0;
   let bestVariant = null, bestVariantExp = 0;
   let bestTokenSource = null, bestTokenExp = 0;
   for (const url of all) {
-    if (extractVideoId(url) !== videoId) continue;
+    if (extractGroupKey(url) !== groupKey) continue;
     const exp = tokenExpirySeconds(extractRawQuery(url));
     if (url.includes('.m3u8')) {
       if (exp > bestManifestExp) { bestManifestExp = exp; bestManifest = url; }
-      } else if (/\/seg-\d+/.test(url)) {
+       } else if (/\/seg-\d+/i.test(url)) {
       if (exp > bestVariantExp) { bestVariantExp = exp; bestVariant = url; }
-      } else {
+       } else {
         if (exp > bestTokenExp) { bestTokenExp = exp; bestTokenSource = url; }
+       }
       }
-     }
 
-    // Prefer a captured manifest; else reconstruct the variant manifest; else
+     // Prefer a captured manifest; else the best segment (reconstructable to a
-    // hand back a token source so the proxy can at least re-token a good path.
+     // manifest); else a token source so the proxy can re-token a good path.
-   if (bestManifest) return bestManifest;
+    if (bestManifest) return bestManifest;
-   if (!preferManifest && bestVariant) return bestVariant;
+    if (!preferManifest && bestVariant) return bestVariant;
-   if (!preferManifest && bestTokenSource) return bestTokenSource;
+    if (!preferManifest && bestTokenSource) return bestTokenSource;
-   if (bestVariant) return bestVariant;
+    if (bestVariant) return bestVariant;
-   return bestManifest || bestTokenSource || null;
+    return bestManifest || bestTokenSource || null;
- }
+  }
 
-// Cache freshest tokens per videoId so we don't query storage on every proxy
+// Cache freshest tokens per group key so we don't query storage on every proxy
-// request. Keyed by videoId; values resolve once and are reused until a rescan
+// request. Keyed by group key; values resolve once and are reused until a rescan
 // (GOON_RESOLVE_MANIFEST) or a 410 forces an invalidation.
 const tokenCache = new Map();
 
-// Given a phncdn /hls/videos/ URL that arrives WITHOUT a query (hls.js drops the
+// Given a CDN URL that arrives WITHOUT a query (hls.js drops the relative-URL
-// relative-URL token when building sub-playslists/segments), inject the freshest
+// token when building sub-playslists/segments), inject the freshest live token
-// live token for that videoId. Returns the URL with a query appended, or the
+// for that group. Returns the URL with a query appended, or the original URL
-// original URL unchanged when no token is available yet.
+// unchanged when no token is available yet.
 async function injectFreshToken(url) {
-  if (!url || !url.includes('/hls/videos/')) return url;
+  if (!url) return url;
   // Already carries a token — leave it alone.
-  if (url.includes('?')) return url;
+ if (url.includes('?')) return url;
-  const videoId = extractVideoId(url);
+ try {
-  if (!videoId) return url;
+    const groupKey = extractGroupKey(url);
-  if (tokenCache.has(videoId)) {
+    if (!groupKey) return url;
-    const token = tokenCache.get(videoId);
+    if (tokenCache.has(groupKey)) {
+      const token = tokenCache.get(groupKey);
+      return token ? url + '?' + token : url;
+     }
+    const fresh = await freshLiveForGroup(groupKey, false);
+    const token = fresh ? extractRawQuery(fresh) : '';
+    tokenCache.set(groupKey, token);
+    console.log('[goon-bg] injectFreshToken for', groupKey, (token ? token.substring(0, 40) + '…' : '(none captured)'));
     return token ? url + '?' + token : url;
-   }
+   } catch {
-  const fresh = await freshLiveForVideo(videoId, false);
+    return url;
-  const token = fresh ? extractRawQuery(fresh) : '';
+     }
-  tokenCache.set(videoId, token);
-  console.log('[goon-bg] injectFreshToken for', videoId, videoId + '-> ' + (token ? token.substring(0, 40) + '…' : '(none captured)'));
-  return token ? url + '?' + token : url;
 }
 
 // Clear the per-video token cache. Called on rescan so the next proxy fetches
 // re-query storage for a freshly-rotated token.
 function invalidateTokenCache() { tokenCache.clear(); }
 
+// CDN registrable domains whose referer we have already captured this SW
+// lifetime, so we do not re-query the tab for every segment of a stream.
+// Lost if the SW is killed; persistReferer's storage dedupe covers a fresh SW.
+const refererCapturedDomains = new Set();
+
 chrome.webRequest.onBeforeRequest.addListener(
   async (details) => {
     if (details.tabId < 0) return;
 
-    const u = details.url.toLowerCase();
+    // Log video-like requests from any host (CDN-agnostic).
-    const isPhncdn = PHNCDN_HOSTS.some(host => details.url.includes(host));
+    if (isVideoRequest(details.url)) {
-    const isVideo = isVideoRequest(details.url);
+      console.log('[goon-bg] webRequest: video request in tab', details.tabId, ':', details.url.substring(0, 180));
-
-    // Log ALL phncdn.com requests regardless of path
-    if (isPhncdn) {
-      console.log('[goon-bg] webRequest: phncdn request in tab', details.tabId, ':', details.url.substring(0, 180));
       await persistVideoRequest(details.tabId, details.url);
-    }
+       // Capture the provider referer for this CDN host from the source tab's
+       // URL: the browser sends the referring page's URL as the Referer for a
+       // cross-origin video request, and that IS the tab's URL. extraInfoSpec
+       // (reading the actual request headers) is rejected by some Chromium
+       // builds and fails the whole service worker, so we derive the referer
+       // from the tab instead. The `tabs` + host_permissions already allow it.
+      const host = hostOf(details.url);
+      const domain = host ? registrableDomain(host) : '';
+      if (domain && !refererCapturedDomains.has(domain)) {
+        try {
+          const tab = await chrome.tabs.get(details.tabId);
+          const ref = tab && tab.url;
+          if (ref) {
+            await persistReferer(host, ref);
+            refererCapturedDomains.add(domain);
+            console.log('[goon-bg] captured referer for', domain, '->', ref);
+          }
+        } catch {
+          // Tab may have closed mid-stream; a later request from a live tab
+          // re-captures. Best-effort.
+        }
+      }
+      }
 
-    // Log video-like requests from any host
+      // Also capture HLS manifest URLs (original logic)
-    if (isVideo && !isPhncdn) {
+     if (!isHlsManifest(details.url)) return;
-      console.log('[goon-bg] webRequest: video request in tab', details.tabId, ':', details.url.substring(0, 150));
-    }
-
-    // Also capture HLS manifest URLs (original logic)
-    if (!isHlsManifest(details.url)) return;
 
     console.log('[goon-bg] webRequest: HLS manifest in tab', details.tabId, ':', details.url.substring(0, 120));
 
@@ -269,76 +284,193 @@ chrome.webRequest.onBeforeRequest.addListener(
   { urls: ['<all_urls>'] }
 );
 
-// Clean up stale entries when tabs are closed
+// Clean up stale PER-TAB entries when tabs are closed. NOTE: 'goon_referers' is
+// a domain-keyed GLOBAL store — it must outlive its capture tab so a proxy fetch
+// for that host still finds its referer after the source tab is closed. It is
+// therefore NOT removed here (only the per-tab vr_requests_/wr_manifests_ keys
+// are). Stale referers are pruned opportunistically in persistReferer.
 chrome.tabs.onRemoved.addListener(async (tabId) => {
   const keys = ['wr_manifests_' + tabId, 'vr_requests_' + tabId];
   try {
     await chrome.storage.local.remove(keys);
-   } catch { /* ignore */ }
+     } catch { /* ignore */ }
-  });
-
-// === Force a pornhub Referer on every *.phncdn.com request ===
-// The phncdn video CDN (hv-h.phncdn.com, pix-fl.phncdn.com, ev-h.phncdn.com,
-// ... and the auth-token hosts) rejects any request whose Referer is not a
-// pornhub-origin with HTTP 412 (see round-1 curl test: `Referer:
-// https://www.pornhub.com/` -> 200, no referer -> 412). Origin is NOT the
-// gate (curl with a pornhub Referer and no Origin still 200s), so we only
-// rewrite Referer and never touch Origin.
-//
-// A normal fetch() CANNOT set the `Referer` header — it is a "forbidden
-// header" in the Fetch API, so a service-worker fetch() gets
-// `Referer: chrome-extension://<id>`, which the CDN rejects (412). The
-// declarativeNetRequest API rewrites request headers at the network layer,
-// below the Fetch API's forbidden-header restriction, and — per Chrome docs —
-// these rules DO apply to fetch() calls made inside the service worker. So we
-// force a pornhub referer on phncdn.com; the GOON_PROXY_FETCH handler in the
-// SW then fetches the manifest + segments successfully.
-const REFERER_RULE_ID = 9001;
-const REFERER_RULE = {
-   id: REFERER_RULE_ID,
-   priority: 1,
-   action: {
-     type: 'modifyHeaders',
-       // `set` is allowed for any request header (only `append` is restricted to
-       // a fixed allowlist). `referer` is the header the CDN checks.
-     requestHeaders: [
-        { header: 'referer', operation: 'set', value: 'https://www.pornhub.com/' },
-           ],
-        },
-   condition: {
-       // phncdn.com (host + subdomains) ONLY. Do NOT include pornhub.com: the
-       // real page player's auth calls (api.pornhub.com) and its own segment
-       // fetches must keep their browser-supplied Origin/Referer or playback
-       // freezes. The proxy only ever fetches phncdn URLs.
-       requestDomains: ['phncdn.com'],
-          },
-        };
-
-// Cached promise so concurrent proxy fetches share one rule install; a
-// transient failure is cleared so a later fetch retries.
-let refererRuleReady = null;
-async function ensureRefererRule() {
-  if (refererRuleReady) return refererRuleReady;
-  refererRuleReady = (async () => {
-    const api = chrome.declarativeNetRequest;
-    if (!api || typeof api.updateSessionRules !== 'function') {
-     throw new Error('declarativeNetRequest.updateSessionRules unavailable');
-     }
-      // Idempotent: remove any stale copy of our rule, then add the fresh one.
-    await api.updateSessionRules({
-      removeRuleIds: [REFERER_RULE_ID],
-      addRules: [REFERER_RULE],
     });
-    console.log('[goon-bg] DNR referer rule installed for *.phncdn.com');
+
-   })();
+// === Capture the provider-origin Referer per CDN host (CDN-agnostic) ===
-   // If it failed, reset so the next call retries instead of caching the
+// Some media CDNs reject requests whose `Referer` is not the provider page's
-   // rejected promise forever.
+// origin (HTTP 412). A fetch() CANNOT set `Referer` — it is a "forbidden
-  refererRuleReady.catch(() => { refererRuleReady = null; });
+// header" in the Fetch API, so a service-worker fetch() would send
-   return refererRuleReady;
+// `Referer: chrome-extension://<id>`, which the CDN rejects. The
+// declarativeNetRequest API rewrites request headers at the network layer, below
+// the Fetch API's restriction, and its rules apply to fetch() calls made inside
+// the SW.
+//
+// We cannot hardcode a target referer: the proxy is invoked from the viewer
+// (a different origin than the source page), and a DNR rule cannot read a live
+// page's origin. So we derive the provider referer from the source tab's own URL.
+// For a cross-origin video request the browser sends the referring page's URL as
+// the Referer, and that page IS the tab currently loading the video — so the tab
+// URL is the referer we need. We read it via chrome.webRequest.onBeforeRequest
+// (no header access — it cannot read the request headers) plus chrome.tabs.get,
+// which returns the source tab's URL, and persist that per CDN host. The
+// GOON_PROXY_FETCH handler then installs a DNR rule that re-inserts that
+// captured referer for just that host, so the proxy's fetch() is accepted.
+// This requires no knowledge of any particular site. Deriving the referer from
+// the tab URL (rather than reading the real request header via
+// onBeforeSendHeaders + extraHeaders) is intentional: extraInfoSpec header
+// parsing is rejected by some Chromium builds and fails the whole service worker,
+// and the tabs + host permissions already permit chrome.tabs.get.
+//
+// Each CDN host gets its OWN declarativeNetRequest rule id so that concurrent
+// proxy fetches for different hosts can't clobber each other's rule (a single
+// shared id + a remove-then-add lets two hosts interleave and leave the wrong
+// host's referer live). The id is derived from the host via a monotonic counter
+// keyed by host, so it is stable for a given host across installs.
+let nextRefererRuleId = 9001;
+const refererRuleIds = new Map();
+function refererRuleIdFor(host) {
+  const existing = refererRuleIds.get(host);
+  if (existing !== undefined) return existing;
+  const id = nextRefererRuleId++;
+  refererRuleIds.set(host, id);
+  return id;
+}
+
+// host of a URL (CDN host, lowercased); '' when the URL is malformed.
+function hostOf(url) {
+  if (!url) return '';
+  try { return new URL(url).host.toLowerCase(); } catch { return ''; }
+}
+
+// Registrable domain of a CDN host — the label a single provider's referer
+// applies to. A referer-protecting CDN serves manifests and segments from many
+// edge subdomains that share ONE
+// provider referer, so we key the referer store, the DNR rule, and proxy-host
+// matching on this domain rather than the exact subhost.
+//
+// Heuristic: the last two DNS labels. Correct for the overwhelmingly common
+// single-label public suffixes (.com, .net, .org, .io, ...). Known caveat:
+// multi-label public suffixes such as .co.uk / .com.au collapse to the public
+// suffix itself (foo.co.uk -> co.uk); that is an exotic edge case and no worse
+// than the exact-host behavior it replaces. A single-level host (no dot, or a
+// bare TLD) is returned unchanged.
+function registrableDomain(host) {
+  if (!host) return '';
+  const parts = host.split('.');
+  if (parts.length < 2) return host;
+  return parts.slice(-2).join('.');
+}
+
+
+// How long a captured referer is trusted before it is pruned on the next
+// persist. Kept long enough for the scan-now / watch-later flow (a user scans a
+// page, then opens the viewer much later) without tying cleanup to tab close (a
+// still-open source tab's referer must survive other tabs closing).
+const REFERER_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+
+// Persist the captured referer per CDN registrable domain so the proxy can
+// re-use it even after the capture tab closes. Keyed by the host's registrable
+// domain so a single provider referer covers every edge subdomain (a CDN serves
+// manifests/segments from many subhosts that share one referer), and so a proxy
+// for any sibling subhost can look it up without knowing the source tab. Each
+// entry is stamped with a capture time; entries older than the TTL are pruned
+// opportunistically here (never on tab close).
+async function persistReferer(host, referer) {
+  const domain = registrableDomain(host);
+  if (!domain || !referer) return;
+  try {
+    const stored = await chrome.storage.local.get('goon_referers');
+    const map = stored['goon_referers'] || {};
+    const now = Date.now();
+    // Opportunistic per-domain prune: drop entries older than the TTL.
+    for (const [h, entry] of Object.entries(map)) {
+      if (h !== domain && (!entry || !entry.at || now - entry.at > REFERER_TTL_MS)) {
+        delete map[h];
+      }
+    }
+    const current = map[domain];
+    if (current && current.referer === referer) return;
+    map[domain] = { referer, at: now };
+    await chrome.storage.local.set({ goon_referers: map });
+      } catch (e) {
+    console.warn('[goon-bg] persistReferer failed:', e && e.message ? e.message : e);
+     }
+ }
+
+// Look up the referer captured for a host's registrable domain. '' when none
+// has been captured (or the stored entry is malformed).
+async function getReferer(host) {
+  if (!host) return '';
+  try {
+    const stored = await chrome.storage.local.get('goon_referers');
+    const entry = (stored['goon_referers'] || {})[registrableDomain(host)];
+    return entry && entry.referer ? entry.referer : '';
+      } catch {
+    return '';
+      }
+ }
+
+// Install (idempotently) a DNR rule that sets the captured referer for a given
+// CDN host. The value comes from capture (or a fallback origin), never a
+// hardcoded site. Scoped to the requested host so only proxy fetches for that
+// host get the rewritten header.
+//
+// Each host gets its own rule id (refererRuleIdFor) so that concurrent proxy
+// fetches for DIFFERENT hosts never interleave: host A's rule and host B's rule
+// are distinct DNR ids and one install can't remove the other. Within a single
+// host, a per-host async lock (refererRuleLocks) serializes the idempotency
+// check + updateSessionRules so the install-and-record pair is atomic — no two
+// installs for the same host can interleave their check/update.
+const refererRuleInstalled = new Map();
+const refererRuleLocks = new Map();
+
+async function ensureRefererRule(host, referer) {
+  const domain = registrableDomain(host);
+  if (!domain || !referer) return;
+  const api = chrome.declarativeNetRequest;
+  if (!api || typeof api.updateSessionRules !== 'function') {
+    console.warn('[goon-bg] declarativeNetRequest unavailable; skipping referer rule');
+    return;
   }
 
-// Install eagerly on SW start so even the first proxy fetch is covered.
+   // Serialize per host so the idempotency check + updateSessionRules is atomic.
-ensureRefererRule();
+  const run = (async () => {
+    if (refererRuleInstalled.has(domain) && refererRuleInstalled.get(domain) === referer) {
+      return;
+    }
+    const ruleId = refererRuleIdFor(domain);
+    try {
+      // Remove only THIS host's own rule id, then add it back scoped to the host.
+      await api.updateSessionRules({
+        removeRuleIds: [ruleId],
+        addRules: [{
+          id: ruleId,
+          priority: 1,
+          action: {
+            type: 'modifyHeaders',
+            // `set` is allowed for any request header (only `append` is restricted
+            // to a fixed allowlist). `referer` is the header the CDN checks.
+            requestHeaders: [
+              { header: 'referer', operation: 'set', value: referer },
+            ],
+          },
+          condition: {
+            // Host + subdomains ONLY, so only proxy fetches for this host get the
+            // rewritten referer; the source page's own requests keep theirs.
+            requestDomains: [domain],
+          },
+        }],
+      });
+      refererRuleInstalled.set(domain, referer);
+      console.log('[goon-bg] DNR referer rule installed for', domain, '(' + ruleId + ')');
+    } catch (e) {
+      console.warn('[goon-bg] ensureRefererRule failed:', e && e.message ? e.message : e);
+    }
+  })().finally(() => { refererRuleLocks.set(domain, null); });
+  refererRuleLocks.set(domain, run);
+  return run;
+}
+
 
 // === Message handlers for popup/data consumers ===
 
@@ -362,11 +494,11 @@ chrome.runtime.onMessage.addListener((message, _sender, sendResponse) => {
       return true;
     }
 
-    case 'GOON_GET_PHNCDN_REQUESTS': {
+     case 'GOON_GET_VIDEO_REQUESTS': {
-      // Strategy 8: Return all phncdn.com requests for a tab, including reconstructed manifests
+        // Strategy 8: Return all video requests for a tab, including reconstructed manifests
-      (async () => {
+        (async () => {
-        const tabId = message.tabId;
+         const tabId = message.tabId;
-        const [segKey] = ['vr_requests_' + tabId];
+         const [segKey] = ['vr_requests_' + tabId];
         try {
           const stored = await chrome.storage.local.get(segKey);
           const segments = stored[segKey] || [];
@@ -384,76 +516,103 @@ chrome.runtime.onMessage.addListener((message, _sender, sendResponse) => {
       return true;
       }
 
-     case 'GOON_RESOLVE_MANIFEST': {
+      case 'GOON_RESOLVE_MANIFEST': {
-        // Resolve the freshest live phncdn manifest for the video in a stored
+           // Resolve the freshest live manifest for the video encoded in a stored
-        // URL. The viewer calls this at startup and on a fatal network error:
+           // URL. The viewer calls this at startup and on a fatal network error:
-        // the live tab keeps rotating short-lived tokens, so the freshest
+           // the live tab keeps rotating short-lived tokens, so the freshest
-        // captured manifest (highest expiry) replaces one that has 410'd.
+           // captured manifest (highest expiry) replaces one that has 410'd.
-        // Clears the token cache first so subsequent proxy fetches re-query for
+           // Clears the token cache first so subsequent proxy fetches re-query for
-        // the freshly-rotated token rather than the cached (now-dead) one.
+           // the freshly-rotated token rather than the cached (now-dead) one.
-        async function resolveFreshManifest(message, sendResponse) {
+         async function resolveFreshManifest(message, sendResponse) {
-          invalidateTokenCache();
+           invalidateTokenCache();
-          const url = message.url || '';
+           const url = message.url || '';
-          const videoId = extractVideoId(url);
+           const groupKey = extractGroupKey(url);
-          if (!videoId) { sendResponse({ ok: false, error: 'no videoId' }); return; }
+           if (!groupKey) { sendResponse({ ok: false, error: 'no group key' }); return; }
-          try {
+           try {
-            const fresh = await freshLiveForVideo(videoId, true);
+             const fresh = await freshLiveForGroup(groupKey, true);
-            sendResponse({ ok: true, fresh, videoId, changed: !!(fresh && fresh !== url) });
+             sendResponse({ ok: true, fresh, groupKey, changed: !!(fresh && fresh !== url) });
-          } catch (e) {
+            } catch (e) {
-            console.warn('[goon-bg] resolveFreshManifest failed:', e && e.message ? e.message : e);
+             console.warn('[goon-bg] resolveFreshManifest failed:', e && e.message ? e.message : e);
-            sendResponse({ ok: false, error: e && e.message ? e.message : String(e), videoId });
+             sendResponse({ ok: false, error: e && e.message ? e.message : String(e), groupKey });
-          }
-        }
-        resolveFreshManifest(message, sendResponse);
-        return true;
-      }
-
-      case 'GOON_PROXY_FETCH': {
-          // Proxy a fetch request through the service worker (bypasses CORS).
-          // Returns base64-encoded response data. Used by the viewer when
-          // extension-origin requests to video CDNs are blocked by CORS.
-          //
-          // The phncdn CDN 412s requests without a pornhub Referer. A fetch()
-          // can't set Referer itself (forbidden header — Chrome replaces it with
-          // chrome-extension://...), so we install a declarativeNetRequest rule
-          // that forces `Referer: https://www.pornhub.com/` at the network layer
-          // for all *.phncdn.com requests (DNR applies to SW fetch() per Chrome
-          // docs). Await it first so the very next fetch is covered.
-            (async () => {
-            try {
-               await ensureRefererRule();
-                    // hls.js resolves sub-playslists/segments relative to the master
-                    // and can DROP the token query, handing us a token-less phncdn
-                    // URL that 410s. injectFreshToken supplies the freshest live token
-                    // for that videoId; the final `+` -> `%2B` pass keeps the
-                    // (possibly injected or surviving) base64 token intact for the
-                    // CDN's query parsing.
-              const resolved = await injectFreshToken(message.url || '');
-              const proxyUrl = resolved.replace(/\+/g, '%2B');
-              const resp = await fetch(proxyUrl);
-             if (!resp.ok) {
-               console.warn('[goon-bg] proxyFetch', resp.status, message.url.substring(0, 120));
-               sendResponse({ ok: false, status: resp.status, error: 'HTTP ' + resp.status });
-               return;
-                 }
-              const buffer = await resp.arrayBuffer();
-              const bytes = new Uint8Array(buffer);
-                   // Convert to base64 (btoa can only handle strings up to ~65k chars)
-               let binary = '';
-               const CHUNK_SIZE = 32768;
-               for (let i = 0; i < bytes.length; i += CHUNK_SIZE) {
-                const chunk = bytes.subarray(i, i + CHUNK_SIZE);
-                binary += String.fromCharCode.apply(null, Array.from(chunk));
-                 }
-              const base64 = btoa(binary);
-               sendResponse({ ok: true, data: base64, mimeType: resp.headers.get('content-type') || '' });
-            } catch(e) {
-             console.warn('[goon-bg] proxyFetch failed:', e && e.message ? e.message : e);
-             sendResponse({ ok: false, error: e && e.message ? e.message : String(e) });
             }
-         })();
+          }
-        return true;
+         resolveFreshManifest(message, sendResponse);
-       }
+         return true;
+        }
+
+       case 'GOON_PROXY_FETCH': {
+            // Proxy a fetch request through the service worker (bypasses CORS).
+            // Returns base64-encoded response data. Used by the viewer when
+            // extension-origin requests to video CDNs are blocked by CORS.
+            //
+            // A fetch() can't set the Referer itself (forbidden header — Chrome
+            // replaces it with chrome-extension://...), so a declarativeNetRequest
+            // rule installs the captured provider-origin referer at the network
+            // layer (DNR applies to SW fetch() per Chrome docs). The rule is
+            // installed on demand for the requested host only.
+           (async () => {
+             try {
+                const proxyHost = hostOf(message.url);
+                if (proxyHost) {
+                   // Prefer the provider's real referer captured from the live
+                   // tab (domain-aware), or the entry's scan-time referer the viewer sent.
+                    // With neither, install no rule: a self-origin referer is
+                    // guaranteed-wrong for hotlink protection, so we never fall
+                    // back to one (it would just 412).
+                   const captured = await getReferer(proxyHost);
+                   const referer = captured || message.referer || '';
+                   if (referer) await ensureRefererRule(proxyHost, referer);
+                   }
+                      // hls.js resolves sub-playslists/segments relative to the master
+                      // and can DROP the token query, handing us a token-less
+                      // URL that 410s. injectFreshToken supplies the freshest live
+                      // token for that video; the final `+` -> `%2B` pass keeps the
+                      // (possibly injected or surviving) base64 token intact for the
+                      // CDN's query parsing.
+               const resolved = await injectFreshToken(message.url || '');
+               const proxyUrl = resolved.replace(/\+/g, '%2B');
+               const resp = await fetch(proxyUrl);
+              if (!resp.ok) {
+                console.warn('[goon-bg] proxyFetch', resp.status, message.url.substring(0, 120));
+                sendResponse({ ok: false, status: resp.status, error: 'HTTP ' + resp.status });
+                return;
+                   }
+               const buffer = await resp.arrayBuffer();
+               const bytes = new Uint8Array(buffer);
+                     // Convert to base64 (btoa can only handle strings up to ~65k chars)
+                let binary = '';
+                const CHUNK_SIZE = 32768;
+                for (let i = 0; i < bytes.length; i += CHUNK_SIZE) {
+                 const chunk = bytes.subarray(i, i + CHUNK_SIZE);
+                 binary += String.fromCharCode.apply(null, Array.from(chunk));
+                   }
+               const base64 = btoa(binary);
+                sendResponse({ ok: true, data: base64, mimeType: resp.headers.get('content-type') || '' });
+              } catch(e) {
+              console.warn('[goon-bg] proxyFetch failed:', e && e.message ? e.message : e);
+              sendResponse({ ok: false, error: e && e.message ? e.message : String(e) });
+              }
+           })();
+         return true;
+         }
+
+    case 'GOON_GET_REFERERS': {
+        // Resolve the provider referer captured for each manifest host
+        // (domain-aware: one provider referer covers every edge subdomain).
+        // Used at scan time to bind the referer to a stored video entry so it
+        // survives the watch-later flow.
+       async function getReferers(message, sendResponse) {
+         const hosts = Array.isArray(message.hosts) ? message.hosts : [];
+         const referers = {};
+         for (const host of hosts) {
+           const r = await getReferer(host);
+           if (r) referers[host] = r;
+            }
+         sendResponse({ ok: true, referers });
+        }
+       getReferers(message, sendResponse);
+       return true;
+        }
 
     default:
       console.warn('[goon-plugin] Unknown message type:', message.type);

src/content/content.js

@@ -25,11 +25,11 @@
   /**
    * Inject interceptors into the MAIN world at document_start.
    *
-   * Uses script.src = chrome.runtime.getURL('interceptors.js') instead of
+     * Uses script.src = chrome.runtime.getURL('interceptors.js') instead of
-   * script.textContent to bypass strict page CSP. Sites like Pornhub enforce
+     * script.textContent to bypass strict page CSP. Some sites enforce
-   * 'script-src' that blocks inline execution (textContent). Chrome treats
+     * 'script-src' that blocks inline execution (textContent). Chrome treats
-   * extension-originated <script src="..."> as content scripts — not as
+     * extension-originated <script src="..."> as content scripts — not as
-   * page inline code — so the page's CSP does not apply.
+     * page inline code — so the page's CSP does not apply.
    *
    * IMPORTANT: Remove the script element ONLY after the load event fires.
    * Removing it synchronously can prevent the browser from starting the fetch,

src/inject/interceptors.js

@@ -2,7 +2,8 @@
  * interceptors.js — Main-world interceptors for HLS manifest detection.
  *
  * This file is injected into the main world via a <script src="..."> tag
- * (NOT inline textContent) to bypass strict CSP on sites like Pornhub.
+ * (NOT inline textContent) to bypass strict CSP on sites that restrict
+ * script-src.
  *
  * When loaded as an external script from the extension origin, Chrome treats
  * it as an extension content script — not as page inline code — so the

src/viewer/index.js

@@ -122,7 +122,11 @@ function m3u8DeepProbeFn() {
   function probeLog(...args) {
     try { console.log('[goon-probe]', ...args); } catch(e) {}
   }
-  probeLog('Deep probe started on:', window.location.href, 'World:', typeof chrome !== 'undefined' ? 'ISOLATED' : 'MAIN');
+  // NOTE: the probe is injected with chrome.scripting's `world: 'MAIN'`, so it
+  // runs in the page's main world and can see page globals. `typeof chrome` is
+  // NOT a reliable world discriminator (extensions expose `chrome` in the
+  // isolated world too), so don't infer it that way.
+  probeLog('Deep probe started on:', window.location.href, '(main world)');
 
   // Helpers available in the MAIN world context
   function resolveUrl(url) {
@@ -134,17 +138,39 @@ function m3u8DeepProbeFn() {
     } catch { return null; }
   }
 
-  function isManifestUrl(url) {
+   function isManifestUrl(url) {
-    if (!url) return false;
+  if (!url) return false;
-    const u = url.toLowerCase();
+  const u = url.toLowerCase();
-    return u.includes('.m3u8') || u.includes('.hlsvod') ||
+      // Concrete HLS/manifest signals win over the template heuristics below: a
-           (u.includes('/hls/') && u.includes('http')) ||
+      // real .m3u8/.hlsvod//hls/ path is fetchable even if it happens to carry a
-           (u.includes('/playlist') && u.includes('http')) ||
+      // trailing '%' query token or a trailing slash — so check these first.
-           (u.includes('/manifest') && u.includes('http'));
+  if (u.includes('.m3u8') || u.includes('.hlsvod') || u.includes('/hls/')) return true;
-  }
+      // Dynamic route TEMPLATES (e.g. /playlist/%1%/ or /videos/{id}/) are nav
+      // links, not fetchable manifests. A placeholder is a `%` that is NOT the
+      // start of a valid %-encoded hex pair (so real tokens like %2B, %2F are
+      // preserved) or a {name} brace token — so genuine %-encoded auth tokens are
+      // never mistaken for template placeholders.
+  if (/%(?!([0-9A-Fa-f]{2}))/i.test(u) || /\{[a-z0-9_]+\}/i.test(u)) return false;
+      // Plural collection paths are nav menus, not manifests.
+  if (u.includes('/playlists') || u.includes('/manifests')) return false;
+      // A singular manifest-ish path segment with no concrete file may still be a
+      // real (rare, extensionless) endpoint, so allow it when it carries http.
+  return (u.includes('/manifest') || u.includes('/playlist')) && u.includes('http');
+     }
 
   function walk(obj, path, depth) {
     if (depth > 5) return;
+    // Cycle guard: the live window objects hold circular references
+    // (window/_parent/_top/frames/_globalObject/_globalProxy are mutually
+    // reachable), so a depth cap alone does NOT terminate — descending a cycle
+    // re-walks the same identities along exponentially many paths. Each object
+    // tree gets its own visited set so an identity is walked at most once per
+    // tree (trees are independent, so the set is declared per call).
+    const visited = new WeakSet();
+    if (obj && typeof obj === 'object') {
+      if (visited.has(obj)) return;
+      visited.add(obj);
+    }
     if (typeof obj === 'string') {
       const match = obj.match(/https?:\/\/[^"'`\s)]+?(?:\.m3u8|\.hlsvod|\/hls\/|\/playlist[^"'`\s]*|\/manifest[^"'`\s]*)[^"'`\s)]*/gi);
       if (match) {
@@ -319,10 +345,10 @@ function m3u8DeepProbeFn() {
   }
   probeLog('Strategy E (interceptor data): found', manifests.length - preECount, 'new manifests');
 
-  // Strategy F: Dynamic playlist fallback — scan video elements for Hls-like
+   // Strategy F: Dynamic playlist fallback — scan video elements for Hls-like
-  // instances and extract ANY URL, not just .m3u8. Sites like Pornhub use
+   // instances and extract ANY URL, not just .m3u8. Some players use
-  // HLS.js dynamic playlists where the "manifest" is generated in-memory,
+   // HLS.js dynamic playlists where the "manifest" is generated in-memory,
-  // so the URL might be a blob:, CDN endpoint, or data URI.
+   // so the URL might be a blob:, CDN endpoint, or data URI.
   let strategyFCount = 0;
   try {
     for (const v of document.querySelectorAll('video')) {
@@ -666,8 +692,9 @@ async function probeHlsManifests(tabId) {
     log('probeHlsManifests: executing deep probe on tab', tabId);
     const raw = await chrome.scripting.executeScript({
       target: { tabId, allFrames: true },
+      world: 'MAIN',
       func: m3u8DeepProbeFn,
-    });
+     });
     // When allFrames is true, destroyed / sandboxed frames may return null entries.
     // Guard: ensure raw is an array, then filter to objects with a defined .result.
     const manifests = Array.isArray(raw)
@@ -697,12 +724,12 @@ function dedupManifests(allManifests) {
   });
   // Sort: prefer interceptor-collected > player globals > config > inline-script
   const playerRank = {
-    '__goon_plugin_data': 0,
+      '__goon_plugin_data': 0,
-    'content-script-intercept': 0,
+       'content-script-intercept': 0,
-    'webRequest': 1,
+        'webRequest': 1,
-    'phncdn_reconstructed': 2,
+         'hls_reconstructed': 2,
-    'video._goon_hls_manifest': 3,
+          'video._goon_hls_manifest': 3,
-    'inline-script': 99,
+           'inline-script': 99,
   };
   unique.sort((a, b) => {
     const aRank = playerRank[a.player] ?? 50;
@@ -746,26 +773,26 @@ async function queryWebRequestManifests(tabId) {
 }
 
 /**
- * Query the service worker for all phncdn.com requests captured by Strategy 8.
+ * Query the service worker for all video requests captured by Strategy 8,
- * Returns segments + reconstructed manifest URLs from segment patterns.
+ * including reconstructed manifest URLs derived from segment patterns.
  * @param {number} tabId
  * @returns {Promise<{segments: Array, reconstructedManifests: Array, totalRequests: number}>}
  */
-async function queryPhncdnRequests(tabId) {
+async function queryVideoRequests(tabId) {
   try {
     const resp = await chrome.runtime.sendMessage({
-      type: 'GOON_GET_PHNCDN_REQUESTS',
+      type: 'GOON_GET_VIDEO_REQUESTS',
       tabId: tabId,
-    });
+     });
     return resp || { segments: [], reconstructedManifests: [], totalRequests: 0 };
-  } catch {
+   } catch {
     return { segments: [], reconstructedManifests: [], totalRequests: 0 };
-  }
+   }
 }
 
 /**
  * Scrape video elements from ALL frames in a tab.
- * On sites like Pornhub, the video player lives inside an iframe — main-frame-only
+ * On many video sites the player lives inside an iframe — main-frame-only
  * scraping sees zero <video> elements. Running allFrames catches them.
  *
  * Runs in the MAIN world so it can see page globals:
@@ -778,36 +805,64 @@ async function queryPhncdnRequests(tabId) {
  * @param {Array} manifests - HLS manifests found by probing
  * @returns {Promise<Object|null>} scrape result or null on error
  */
-async function scrapeTab(tabId, manifests) {
+/**
-  try {
+ * Reduce a per-frame executeScript result array to the single largest-video
-    const raw = await chrome.scripting.executeScript({
+ * result (or a "no videos" result / null). Shared by the MAIN- and
-      target: { tabId, allFrames: true },
+ * isolated-world scrape attempts in scrapeTab.
-      func: scrapeFn,
+ */
-      args: [manifests],
+function reduceScrapeFrames(raw) {
-    });
     // When allFrames is true, destroyed / sandboxed frames may return null entries.
     // Guard: ensure raw is an array, then filter to objects with a defined .result.
-    const frameResults = Array.isArray(raw)
+  const frameResults = Array.isArray(raw)
-      ? raw.filter(r => r != null && typeof r === 'object' && 'result' in r)
+       ? raw.filter(r => r != null && typeof r === 'object' && 'result' in r)
-           .map(r => r.result)
+            .map(r => r.result)
-      : [];
+       : [];
-    const valid = frameResults.filter(r => r && r.videos && r.videos.length > 0);
+  const valid = frameResults.filter(r => r && r.videos && r.videos.length > 0);
-    if (valid.length === 0) {
+  if (valid.length === 0) {
-      const firstWithResult = frameResults.find(r => r != null);
+    const firstWithResult = frameResults.find(r => r != null);
-      return firstWithResult || null;
+    return firstWithResult || null;
-    }
+     }
-    valid.sort((a, b) => {
+  valid.sort((a, b) => {
-      const aArea = a.videos[0]?.area || 0;
+    const aArea = a.videos[0]?.area || 0;
-      const bArea = b.videos[0]?.area || 0;
+    const bArea = b.videos[0]?.area || 0;
-      return bArea - aArea;
+    return bArea - aArea;
-    });
+     });
-    return valid[0];
+  return valid[0];
-  } catch(e) {
-    warn('scrapeTab: tab', tabId, 'error:', e && e.message ? e.message : e);
-    return null;
-  }
 }
 
+ async function scrapeTab(tabId, manifests) {
+       // Primary: MAIN world — scrapeFn can read page globals the main frame
+       // exposes (interceptor annotations, Hls instances, custom <video> props).
+    try {
+      const mainRaw = await chrome.scripting.executeScript({
+        target: { tabId, allFrames: true },
+        world: 'MAIN',
+        func: scrapeFn,
+         args: [manifests],
+          });
+      let result = reduceScrapeFrames(mainRaw);
+          // Isolated-world fallback: some pages embed sandboxed / opaque-origin ad
+          // iframes that make the MAIN-world injection reject, so the primary run can
+          // return no videos even when a <video> is visible. scrapeFn only needs the
+          // shared DOM plus the passed-in manifest list, so an isolated-world run (no
+          // `world` key — always permitted) still sees the same <video> elements.
+      if (!result || !(result.videos && result.videos.length > 0)) {
+        const isoRaw = await chrome.scripting.executeScript({
+          target: { tabId, allFrames: true },
+          func: scrapeFn,
+           args: [manifests],
+            });
+        const iso = reduceScrapeFrames(isoRaw);
+        if (iso && iso.videos && iso.videos.length > 0) result = iso;
+        else if (!result) result = iso;
+          }
+       return result;
+        } catch(e) {
+      warn('scrapeTab: tab', tabId, 'error:', e && e.message ? e.message : e);
+      return null;
+        }
+     }
+
 /**
  * Filter intercepted URLs to prefer actual HLS manifests over segment files.
  * Interceptors capture both .m3u8 manifests and .ts segment URLs (any URL
@@ -829,101 +884,76 @@ function filterManifests(manifests) {
            (u.includes('/playlist') && !u.endsWith('.ts'));
   });
 
-  // Reject fake reconstructed manifest paths.
+   // Reject clearly-fake manifest paths (see isValidManifestUrl).
-  // Real manifests are under /hls/videos/{year}/{subdir}/{videoId}/...
+  const valid = actualManifests.filter(m => isValidManifestUrl(m.url));
-  // Fakes look like: phncdn.com/videos/{id}/playlist.m3u8 or .../master.m3u8 (no /hls/)
-  const valid = actualManifests.filter(m => {
-    const u = m.url.toLowerCase();
-    try {
-      const urlObj = new URL(u);
-      // phncdn URLs must have /hls/ in the path — fake reconstructed paths lack it
-      if (u.includes('phncdn') || u.includes('pornhubcdn')) {
-        if (!urlObj.pathname.includes('/hls/') && !u.includes('?h=')) {
-          return false; // Fake: phncdn URL without /hls/ or auth query param
-        }
-      }
-    } catch {}
-    return true;
-  });
-
-  // If we have actual (non-fake) manifests, use them directly
   if (valid.length > 0) {
     return valid.map(m => ({ url: m.url }));
-  }
+   }
 
-  // No .m3u8 found — interceptors only captured .ts segments.
+  // No manifest found — interceptors only captured segment files. Reconstruct a
-  // Reconstruct the parent manifest URL from segment paths.
+  // manifest URL from each segment's directory, carrying over its auth query
-  // Segment: https://ev-h.phncdn.com/hls/videos/202008/01/338337051/720P_4000K_338337051.mp4/seg-1-v1-a1.ts?h=tmrD...&e=1786932752&f=1
+  // string intact (CDNs reject a path-only URL with 403). CDN-agnostic: the
-  // Manifest: https://ev-h.phncdn.com/hls/videos/202008/01/338337051/720P_4000K_338337051.mp4/master.m3u8?h=tmrD...&e=1786932752&f=1
+  // segment filename is swapped for a manifest filename in the same directory,
-  //
+  // e.g. .../variant/seg-1.ts?h=... -> .../variant/master.m3u8?h=...
-  // Auth tokens (h, e, f or validfrom, validto, hash) are extracted from segment query params
-  // and reapplied to the reconstructed manifest URL. This is critical because CDN domains
-  // require auth — a path-only URL will be rejected with 403.
   const seen = new Set();
   const reconstructed = [];
-
+  // A segment filename: numbered segment, or an .ts/.m4s/.aac media extension.
+  const SEG_RE = /(seg-\d+|\.(?:ts|m4s|aac)(?:$|\?))/i;
   for (const m of manifests) {
-    const u = m.url.toLowerCase();
+    if (!SEG_RE.test(m.url)) continue;
-    if (!u.includes('/hls/videos/') || !/\/seg-\d+/.test(u)) continue;
     try {
       const urlObj = new URL(m.url);
-      // Skip non-phncdn hosts — we only reconstruct for known video CDNs
-      const host = urlObj.host.toLowerCase();
-      if (!host.includes('phncdn')) continue;
-
       const pathParts = urlObj.pathname.split('/');
-      // Find the /hls/ marker and extract: hls/videos/{year}/{subdir}/{videoId}/{variant}/...
+       // Need a directory to attach the manifest to (skip flat single-file paths).
-      const hlsIdx = pathParts.findIndex(p => p === 'hls');
+      if (pathParts.length < 3) continue;
-      if (hlsIdx === -1 || hlsIdx + 5 >= pathParts.length) continue;
+      pathParts.pop(); // drop the segment filename, keep its directory
-      // Reconstruct with BOTH "hls" prefix AND variant directory included:
+      const dir = pathParts.join('/');
-      // segment: /hls/videos/202008/01/338337051/720P_4000K_338337051.mp4/seg-1.ts
+       // Carry the raw query (auth token) over unchanged — never re-encode it.
-      // manifest: /hls/videos/202008/01/338337051/720P_4000K_338337051.mp4/master.m3u8
+      const q = m.url.indexOf('?');
-      const year    = pathParts[hlsIdx + 2];    // e.g. 2020
+      const rawQuery = q === -1 ? '' : m.url.slice(q);
-      const subDir  = pathParts[hlsIdx + 3];    // e.g. 01
+      const manifestUrl = `${urlObj.protocol}//${urlObj.host}/${dir}/master.m3u8${rawQuery}`;
-      const videoId = pathParts[hlsIdx + 4];    // e.g. 338337051
-      const variant = pathParts[hlsIdx + 5];    // e.g. 720P_4000K_338337051.mp4
-
-      // Extract auth params from segment query string — different CDN variants use different keys:
-      // ev-h/validfrom/validto/hash  vs  hv-h/h/e/f
-      const authParts = [];
-      for (const [key, val] of urlObj.searchParams) {
-        if (['h', 'e', 'f', 'validfrom', 'validto', 'hash'].includes(key)) {
-          authParts.push(`${key}=${val}`);
-        }
-      }
-      const authStr = authParts.length > 0 ? '?' + authParts.join('&') : '';
-
-      // Build manifest URL: include hls prefix AND variant directory
-      const manifestUrl = `${urlObj.protocol}//${urlObj.host}/${pathParts[hlsIdx]}/${pathParts[hlsIdx + 1]}/${year}/${subDir}/${videoId}/${variant}/master.m3u8${authStr}`;
       if (!seen.has(manifestUrl)) {
         seen.add(manifestUrl);
         reconstructed.push({ url: manifestUrl });
-      }
+        }
-    } catch { /* skip malformed URLs */ }
+      } catch { /* skip malformed URLs */ }
-  }
+     }
   return reconstructed;
-}
+ }
 
-/**
+ /**
- * Validate that a manifest URL uses a real phncdn.com path structure.
+  * Validate that a manifest URL is well-formed and generic (CDN-agnostic).
- * Rejects fake paths like /videos/{id}/playlist.m3u8 — real manifests use
+  * Rejects malformed paths; a manifest-like URL must live in a directory (have a
- * /hls/videos/{year}/{subdir}/{videoId}/master.m3u8 or similar /hls/ paths.
+  * path separator), which filters out obviously-broken single-segment paths.
- */
+  */
-function isValidManifestUrl(url) {
+  function isValidManifestUrl(url) {
   if (!url || typeof url !== 'string') return false;
-  // Real phncdn HLS manifest: must contain /hls/videos/ with sufficient path depth
+  let urlObj;
-  const hlsIdx = url.indexOf('/hls/videos/');
+  try {
-  if (hlsIdx === -1) {
+    urlObj = new URL(url);
-    // Not phncdn — could be a different CDN, allow it
+   } catch {
-    if (!url.includes('phncdn') && !url.includes('pornhubcdn')) return true;
-    // phncdn without /hls/ prefix is invalid for manifests
     return false;
-  }
+     }
-  // Check there are at least {year}/{subdir}/{videoId} after /hls/videos/
+  const path = urlObj.pathname.toLowerCase();
-  const after = url.substring(hlsIdx + '/hls/videos/'.length);
+       // 1) Concrete media/manifest signals win outright: a real file extension or
-  if (after.indexOf('/') === -1) return false; // need at least one more segment
+       // /hls/ path is fetchable, even with a trailing slash 
+       // or a token-bearing query — so check these before the
+       // template heuristics and never let a coincidental '%'/'/' sink a source.
+  if (path.includes('.m3u8') || path.includes('.hlsvod') || path.includes('/hls/') ||
+        path.includes('/manifest') || path.includes('.mp4') || path.includes('.webm') ||
+        path.includes('.ogv') || path.includes('.mpd') || path.includes('.m4s')) return true;
+       // 2) Dynamic route templates / nav links: a `%` that isn't a valid %-encoded
+       // hex pair (real %2B etc. are kept) or a {name} brace token.
+  if (/%(?!([0-9A-Fa-f]{2}))/i.test(url) || /\{[a-z0-9_]+\}/i.test(url)) return false;
+       // 3) Plural collection paths and trailing-slash directory listings are nav
+       // menus, not manifest files (e.g. /playlists/, /playlists/liked/).
+  if (path.includes('/playlists') || path.includes('/manifests') || path.endsWith('/')) return false;
+       // 4) A singular /playlist endpoint may be a real (extensionless) manifest;
+       // allow it when it sits in a directory.
+  if (path.includes('/playlist')) return path.includes('/');
+       // 5) Otherwise treat as a direct media source — allow it.
   return true;
-}
+   }
 
 /**
  * Build a normalized video entry from a scraped video object.
@@ -941,8 +971,8 @@ function makeVideoEntry(video, tabTitle, posterFromContent) {
     mediaType: video.mediaType || 'video',
   };
   if (video.hlsManifest) {
-    // Reject fake phncdn manifest paths before storing
+      // Reject fake/invalid manifest paths before storing
-    if (!isValidManifestUrl(video.hlsManifest)) {
+     if (!isValidManifestUrl(video.hlsManifest)) {
       console.warn('[goon] Rejecting fake manifest URL:', video.hlsManifest.substring(0, 120));
     } else {
       entry.hlsManifest = video.hlsManifest;
@@ -1004,28 +1034,28 @@ async function scanVideos(tabsToScan) {
   }
   await logToPage(`step1.5 (webRequest): found ${totalWebRequestManifests} manifests via network interception`);
 
-  // Step 1.6: Strategy 8 — Query phncdn.com requests and reconstruct manifest URLs.
+   // Step 1.6: Strategy 8 — Query captured video requests and reconstruct manifest URLs.
-  // When the player uses in-memory dynamic HLS (zero .m3u8 network requests), we can
+   // When the player uses in-memory dynamic HLS (zero .m3u8 network requests), we can
-  // still detect it by recognizing segment URL patterns from phncdn.com and deriving
+   // still detect it by recognizing segment URL patterns and deriving the parent
-  // the parent manifest URL: /hls/videos/{id}/master.m3u8
+   // manifest URL from the segment's directory.
-  const phncdnPromises = tabsToScan.map(t => queryPhncdnRequests(t.id));
+  const videoRequestPromises = tabsToScan.map(t => queryVideoRequests(t.id));
-  const phncdnResults = await Promise.all(phncdnPromises);
+  const videoRequestResults = await Promise.all(videoRequestPromises);
-  let totalPhncdnManifests = 0;
+  let totalReconstructedManifests = 0;
   for (let i = 0; i < tabsToScan.length; i++) {
-    const reconstructed = phncdnResults[i]?.reconstructedManifests || [];
+    const reconstructed = videoRequestResults[i]?.reconstructedManifests || [];
     if (reconstructed.length > 0) {
-      log('scanVideos phncdn: tab', tabsToScan[i].id, 'found', reconstructed.length, 'reconstructed manifests from segment URLs');
+      log('scanVideos strategy8: tab', tabsToScan[i].id, 'found', reconstructed.length, 'reconstructed manifests from segment URLs');
-    }
+      }
-    totalPhncdnManifests += reconstructed.length;
+    totalReconstructedManifests += reconstructed.length;
     const existing = tabManifestMap.get(tabsToScan[i].id) || [];
     for (const url of reconstructed) {
       if (!existing.some(m => m.url === url)) {
-        existing.push({ url, player: 'phncdn_reconstructed' });
+        existing.push({ url, player: 'hls_reconstructed' });
+        }
       }
-    }
     tabManifestMap.set(tabsToScan[i].id, existing);
   }
-  await logToPage(`step1.6 (phncdn): found ${totalPhncdnManifests} reconstructed manifests from segment URLs`);
+  await logToPage(`step1.6 (strategy8): found ${totalReconstructedManifests} reconstructed manifests from segment URLs`);
 
   // Step 2: Scrape video elements (all frames) AND query content scripts (in parallel)
   const scrapePromises = tabsToScan.map(t =>
@@ -1128,6 +1158,7 @@ async function scanVideos(tabsToScan) {
   }
 
   const items = [...seen.values()];
+  await attachReferers(items);
   const skipped = scrapeResults.filter(r => r === null).length;
 
   log('scanVideos complete: scanned=', tabResults.length, 'skipped=', skipped, 'unique items=', items.length);
@@ -1138,6 +1169,31 @@ async function scanVideos(tabsToScan) {
   return { items, scanned: tabResults.length, skipped };
 }
 
+/**
+ * Bind the provider referer the SW captured (domain-aware) to each item so it
+ * survives the watch-later flow and covers the sibling edge subdomains a segment
+ * may resolve to. Best-effort: playback still falls back to the SW's live store.
+ */
+async function attachReferers(items) {
+  const hostOf = (url) => { try { return new URL(url).host.toLowerCase(); } catch { return ''; } };
+  const hosts = [];
+  for (const it of items) {
+    const host = hostOf(it.hlsManifest || it.src || '');
+    if (host) hosts.push(host);
+    }
+  if (hosts.length === 0) return;
+  let referers = {};
+  try {
+    const resp = await chrome.runtime.sendMessage({ type: 'GOON_GET_REFERERS', hosts });
+    if (resp && resp.referers) referers = resp.referers;
+    } catch { /* referer is best-effort; the SW still resolves it at play time */ }
+  if (!Object.keys(referers).length) return;
+  for (const it of items) {
+    const host = hostOf(it.hlsManifest || it.src || '');
+    if (host && referers[host]) it.referer = referers[host];
+    }
+}
+
 /** Store video entries in chrome.storage.local. */
 async function storeVideos(items) {
   const stored = items.map(v => ({
@@ -1146,6 +1202,7 @@ async function storeVideos(items) {
     tab: v.tab,
     mediaType: v.mediaType || 'video',
     hlsManifest: v.hlsManifest || undefined,
+    referer: v.referer || undefined,
   }));
   await chrome.storage.local.set({
     [STORAGE_KEY]: stored,
@@ -1186,6 +1243,7 @@ findBtn.addEventListener('click', async () => {
         try {
           await chrome.scripting.executeScript({
             target: { tabId: activeTab.id },
+            world: 'MAIN',
             func: () => {
               const diag = [];
               // Check interceptor data

src/viewer/schema.json

@@ -33,6 +33,11 @@
       "type": "string",
       "enum": ["direct", "hls"],
       "description": "Media delivery format. Defaults to 'direct' when omitted. Set to 'hls' for HTTP Live Streaming."
+    },
+    "referer": {
+      "type": ["string", "null"],
+      "format": "uri",
+      "description": "Provider Referer captured at scan time for the manifest's CDN; the proxy sends it so a referer-protecting CDN accepts sibling edge subdomains. Optional."
     }
   },
   "additionalProperties": false,

src/viewer/viewer.js

@@ -19,10 +19,10 @@
  * overlays and an aggregate status bar.
  */
 
-// HLS is vendored locally to avoid CSP blocks on sites like Pornhub that
+// HLS is vendored locally to avoid CSP blocks on sites that restrict
-// restrict script-src to 'self'. The hls.min.js bundle is built by Vite
+// script-src to 'self'. The hls.js bundle is copied (not minified) so it
-// and exposed via chrome.runtime.getURL() so it loads from the extension
+// loads from the extension origin via chrome.runtime.getURL(), bypassing
-// origin, bypassing page CSP entirely.
+// page CSP entirely.
 
 /**
  * Grid-optimized hls.js configuration.
@@ -54,14 +54,15 @@ const panelsEl = document.getElementById('panels');
 
 /** Track all Hls instances so we can destroy them on unload. */
 
-   /**
+    /**
-    * Custom HLS loader that proxies phncdn.com URLs through the service worker
+     * Custom HLS loader that proxies URLs whose host blocks extension-origin
-    * (bypassing CORS/Referer restrictions) and fetches everything else natively.
+     * requests (via a learned proxy-host set) through the service worker
-    *
+     * (bypassing CORS/Referer restrictions) and fetches everything else natively.
-    * hls.js creates one loader instance per request via `new HlsLoader(hls)`, then
+     *
-    * calls `loader.load(context, config, callbacks)` — callbacks are the 3rd arg
+     * hls.js creates one loader instance per request via `new HlsLoader(hls)`, then
-    * in v9 (some wrapper paths put them 2nd, so we scan each argument). The stats
+     * calls `loader.load(context, config, callbacks)` — callbacks are the 3rd arg
-    * object passed to the callbacks is pre-allocated by us and mutated by hls.js
+     * in v9 (some wrapper paths put them 2nd, so we scan each argument). The stats
+     * object passed to the callbacks is pre-allocated by us and mutated by hls.js
     * in place, so it must have the correct sub-shape (see createLoadedStats).
     */
     function HlsLoader(config) {
@@ -134,8 +135,8 @@ const panelsEl = document.getElementById('panels');
        const stats = this.stats;
        stats.loading.start = trequest;
 
-      const isManifest = /\.m3u8($|\?)/i.test(url || '');
+       const isManifest = /\.m3u8($|\?)/i.test(url || '');
-      const needProxy = (url || '').includes('phncdn') || (url || '').includes('pornhubcdn');
+       const needProxy = needsProxy(url);
 
        // hls.js loader callback contract (verified against the bundled loader):
        //   onSuccess(response, stats, context, networkDetails)
@@ -176,8 +177,8 @@ const panelsEl = document.getElementById('panels');
       if (needProxy) {
           // Route through the service worker to bypass the CDN's CORS/Referer
         // restrictions. The SW adds the required Referer and returns base64.
-        console.log('[goon-viewer] Proxying via SW:', (url || '').substring(0, 120));
+         console.log('[goon-viewer] Proxying via SW:', (url || '').substring(0, 120));
-        chrome.runtime.sendMessage({ type: 'GOON_PROXY_FETCH', url }, (resp) => {
+        chrome.runtime.sendMessage({ type: 'GOON_PROXY_FETCH', url, referer: refererForUrl(url) }, (resp) => {
           if (self._aborted) return;
           const lastErr = chrome.runtime.lastError;
           if (lastErr || !resp || !resp.ok) {
@@ -233,52 +234,93 @@ const panelsEl = document.getElementById('panels');
 HlsLoader.prototype.destroy = function () { this.abort(); };
 HlsLoader.canSupportLoader = function () { return true; };
 
-// === CORS diagnostics — check if phncdn.com allows extension-origin requests ===
+ // === Service-worker proxy helper (CDN-agnostic) ===
-(async function checkCors() {
+ // Proxies a video URL through the service worker (no CORS restrictions). The
+ // SW forces the correct provider-origin Referer for the host (captured by the
+ // background worker), so a referer-protecting CDN accepts the request.
+ // Returns an ArrayBuffer of the response content.
+ async function proxyFetch(url, referer) {
   try {
-    const resp = await fetch('https://phncdn.com/images/favicon.ico', { method: 'HEAD', mode: 'cors' });
+    const resp = await chrome.runtime.sendMessage({ type: 'GOON_PROXY_FETCH', url, referer });
-    console.log('[goon-viewer] CORS check phncdn.com:', resp.ok ? 'ALLOWED (status ' + resp.status + ')' : 'BLOCKED');
-  } catch(e) {
-    console.warn('[goon-viewer] CORS check phncdn.com: BLOCKED —', e && e.message ? e.message : e);
-  }
-})();
-
-// === HLS segment proxy helper ===
-// Proxies a video URL through the service worker (no CORS restrictions).
-// Returns an ArrayBuffer of the response content.
-async function proxyFetch(url) {
-  try {
-    const resp = await chrome.runtime.sendMessage({ type: 'GOON_PROXY_FETCH', url });
     if (resp && resp.data && resp.ok) {
-      // Decode base64 → ArrayBuffer
+        // Decode base64 → ArrayBuffer
       const binary = atob(resp.data);
       const bytes = new Uint8Array(binary.length);
       for (let i = 0; i < binary.length; i++) {
         bytes[i] = binary.charCodeAt(i);
-      }
+       }
       return bytes.buffer;
-    }
+      }
     return null;
-  } catch(e) {
+    } catch(e) {
     console.warn('[goon-viewer] proxyFetch failed for:', url.substring(0, 120), e && e.message ? e.message : e);
     return null;
-  }
+    }
-}
+ }
 
-// === Check if any manifest URLs require proxying (phncdn.com / cdn) ===
+ // CDN hosts that block extension-origin requests are learned by a CORS probe
-function urlsNeedProxy(urls) {
+ // at viewer startup (hosts that fail the probe are recorded), then stored in
-  return urls.some(u => u && typeof u === 'string' && (u.includes('phncdn') || u.includes('pornhubcdn')));
+ // chrome.storage.local. The proxy is used only for those hosts, so we never
-}
+ // hardcode a particular CDN.
+ const PROXY_HOSTS_KEY = 'goon_proxy_hosts';
+ const proxyHosts = new Set();
+ // Provider referers bound to a stored entry at scan time, keyed by the entry's
+ // manifest registrable domain. A single provider referer covers every edge
+ // subdomain, so a segment on a sibling subhost resolves to the same referer.
+ const refererByDomain = new Map();
+ (async () => {
+   try {
+     const stored = await chrome.storage.local.get(PROXY_HOSTS_KEY);
+     const hosts = stored[PROXY_HOSTS_KEY];
+     if (Array.isArray(hosts)) for (const h of hosts) proxyHosts.add(registrableDomainOf(String(h).toLowerCase()));
+    } catch { /* ignore */ }
+   })();
 
-/** Check whether fetching a URL from the extension page works (CORS test). */
+ // Registrable domain of a CDN host — the label a single provider referer
-async function corsCheck(url) {
+ // applies to (a referer-protecting CDN serves from many edge subdomains that
+ // share one referer). Last-two-labels heuristic; mirrors the SW's copy.
+ function registrableDomainOf(host) {
+   if (!host) return '';
+   const parts = host.split('.');
+   if (parts.length < 2) return host;
+   return parts.slice(-2).join('.');
+ }
+
+ // The provider referer to send for a proxied request: the referer bound to the
+ // entry at scan time (domain-keyed), or '' when none was captured. No self-origin
+ // fallback — a self-origin referer is guaranteed-wrong for hotlink protection.
+ function refererForUrl(url) {
+   const ref = refererByDomain.get(registrableDomainOf(hostOfUrl(url)));
+   return ref || '';
+ }
+
+ // Whether a given video URL should be proxied: its host is a known
+ // referer-protected CDN host.
+ function needsProxy(url) {
+   if (!url || typeof url !== 'string') return false;
+   const host = hostOfUrl(url);
+   return host ? proxyHosts.has(registrableDomainOf(host)) : false;
+ }
+
+ // host of a URL (lowercased); '' when malformed.
+ function hostOfUrl(url) {
+   try { return new URL(url).host.toLowerCase(); } catch { return ''; }
+ }
+
+ // Whether any of the given URLs needs proxying.
+ function urlsNeedProxy(urls) {
+   return urls.some(u => needsProxy(u));
+ }
+ 
+ /** Check whether fetching a URL from the extension page works (CORS test). */
+ async function corsCheck(url) {
   try {
     const resp = await fetch(url, { method: 'HEAD', mode: 'cors' });
     return resp.ok;
-  } catch {
+   } catch {
     return false;
-  }
+   }
-}
+ }
 
 /** Track all Hls instances so we can destroy them on unload. */
 const hlsInstances = new Map();
@@ -750,10 +792,10 @@ function wireHlsEvents(hls, video, panel) {
       renderPanelState(video, panel);
       hls.destroy();
       hlsInstances.delete(video);
-      // A fatal network error on a phncdn stream is almost always an expired
+        // A fatal network error on a token-protected stream is almost always an
-      // auth token. The live source tab keeps rotating tokens, so pull a fresh
+        // expired auth token. The live source tab keeps rotating tokens, so pull a
-      // manifest from it and retry — capped at a few attempts per panel so a
+        // fresh manifest from it and retry — capped at a few attempts per panel so a
-      // tab with no live source doesn't loop forever.
+        // tab with no live source doesn't loop forever.
       if ((video.dataset.hlsRescans || '0') | 0 < 3) {
         video.dataset.hlsRescans = ((video.dataset.hlsRescans || '0') | 0) + 1;
         console.log('[goon-viewer] fatal NETWORK_ERROR → auto-rescan attempt #' + video.dataset.hlsRescans);
@@ -930,12 +972,12 @@ function playHls(video, manifestUrl, panel) {
     return;
   }
 
-  // Check whether this manifest URL needs proxying (phncdn.com without CORS headers
+   // Check whether this manifest URL needs proxying (a referer-protected host
-  // blocks extension-origin requests from the viewer page).
+   // without CORS headers blocks extension-origin requests from the viewer page).
-  const needProxy = manifestUrl.includes('phncdn') || manifestUrl.includes('pornhubcdn');
+   const needProxy = needsProxy(manifestUrl);
-  if (needProxy) {
+   if (needProxy) {
-    console.log('[goon-viewer] Manifest needs proxying via service worker');
+     console.log('[goon-viewer] Manifest needs proxying via service worker');
-  }
+    }
 
   destroyHls(video);
 
@@ -977,9 +1019,9 @@ function playHls(video, manifestUrl, panel) {
    // Log the manifest URL being loaded for debugging (helps diagnose playback failures).
   console.log(`[goon-viewer] Loading HLS manifest:`, manifestUrl.substring(0, 200));
 
-    // Remember the manifest actually loaded so a later auto-rescan can retry from
+     // Remember the manifest actually loaded so a later auto-rescan can retry from
-    // the freshest token on the same video (extractVideoId keys off this).
+     // the freshest token on the same video (the service worker keys off the path).
-  video.dataset.hlsManifest = manifestUrl;
+   video.dataset.hlsManifest = manifestUrl;
 
   hls.loadSource(manifestUrl);
   hls.attachMedia(video);
@@ -1017,32 +1059,32 @@ function loadHlsJs() {
     });
 }
 
- /* ======================================================================== */
+  /* ======================================================================== */
- /* Fresh-token resolution — replace expired/revoked phncdn URLs                */
+  /* Fresh-token resolution — replace expired/revoked token URLs                */
- /* ======================================================================== */
+  /* ======================================================================== */
 
- /**
+  /**
-  * Ask the service worker for the freshest live phncdn manifest for the video
+   * Ask the service worker for the freshest live manifest for the video encoded
-  * encoded in `storedUrl`. The live source tab keeps rotating short-lived
+   * in `storedUrl`. The live source tab keeps rotating short-lived auth tokens
-  * phncdn tokens (a stored one may already be 410 Gone), so the freshest
+   * (a stored one may already be 410 Gone), so the freshest captured manifest —
-  * captured manifest — identified by matching the videoId in the path — is the
+   * identified by matching the video's group key in the path — is the one that
-  * one that will actually validate. Resolves to the new URL, or null when the
+   * will actually validate. Resolves to the new URL, or null when the tab
-  * tab captured nothing (or the caller can't reach the SW).
+   * captured nothing (or the caller can't reach the SW).
-  */
+   */
- async function resolveFreshManifest(storedUrl) {
+   async function resolveFreshManifest(storedUrl) {
-  if (!storedUrl || !storedUrl.includes('phncdn')) return null;
+    if (!storedUrl || !needsProxy(storedUrl)) return null;
-  try {
+    try {
-    const resp = await chrome.runtime.sendMessage({ type: 'GOON_RESOLVE_MANIFEST', url: storedUrl });
+     const resp = await chrome.runtime.sendMessage({ type: 'GOON_RESOLVE_MANIFEST', url: storedUrl });
-    if (resp && resp.ok && resp.changed && resp.fresh) {
+     if (resp && resp.ok && resp.changed && resp.fresh) {
-      console.log('[goon-viewer] resolved fresh manifest for', (resp.videoId || '?'),
+      console.log('[goon-viewer] resolved fresh manifest for', (resp.groupKey || '?'),
-        '→', (resp.fresh || '').substring(0, 100));
+          '→', (resp.fresh || '').substring(0, 100));
       return resp.fresh;
-     }
+        }
-   } catch (e) {
+      } catch (e) {
-    console.warn('[goon-viewer] resolveFreshManifest failed:', e && e.message ? e.message : e);
+     console.warn('[goon-viewer] resolveFreshManifest failed:', e && e.message ? e.message : e);
+       }
+   return null;
     }
-  return null;
- }
 
  /**
   * Re-attempt playback on `video` after its stored manifest died (fatal
@@ -1154,16 +1196,33 @@ async function init() {
       });
     }
 
-    // Test CORS on all video URLs
+      // Probe CORS on each video URL. Hosts that block extension-origin
-    const urlsToTest = videoUrls.map(v => v.src || v.hlsManifest || 'none').filter(u => u !== 'none' && typeof u === 'string');
+      // requests are learned as referer-protected and persisted so the viewer
-    for (const url of [...new Set(urlsToTest)]) {
+      // routes them through the service-worker proxy.
-      const corsOk = await corsCheck(url);
+     // Bind each entry's scan-time referer to its manifest's registrable
-      console.log('[goon-viewer] CORS', corsOk ? 'OK' : 'BLOCKED:', url.substring(0, 120));
+     // domain, so the proxy sends it for every edge subdomain the provider
-    }
+     // serves from (segments often resolve to a sibling subhost).
+     for (const entry of videoUrls) {
+       const ref = entry && entry.referer;
+       if (!ref) continue;
+       const dom = registrableDomainOf(hostOfUrl(entry.src || entry.hlsManifest || ''));
+       if (dom) refererByDomain.set(dom, ref);
+       }
+     const urlsToTest = videoUrls.map(v => v.src || v.hlsManifest || 'none').filter(u => u !== 'none' && typeof u === 'string');
+     const blockedHosts = new Set();
+     for (const url of [...new Set(urlsToTest)]) {
+       const corsOk = await corsCheck(url);
+       if (!corsOk) blockedHosts.add(registrableDomainOf(hostOfUrl(url)));
+        console.log('[goon-viewer] CORS', corsOk ? 'OK' : 'BLOCKED:', url.substring(0, 120));
+        }
+     if (blockedHosts.size > 0) {
+      for (const h of blockedHosts) if (h) proxyHosts.add(h);
+      try { await chrome.storage.local.set({ [PROXY_HOSTS_KEY]: [...proxyHosts] }); } catch { /* ignore */ }
+        }
 
-    // Check if any URLs point to phncdn.com (proxy will be needed if CORS blocked)
+        // Report whether any URL needs proxying (referer-protected host).
-    const needsProxy = urlsToTest.some(u => u.includes('phncdn') || u.includes('pornhubcdn'));
+     const anyNeedsProxy = urlsNeedProxy(urlsToTest);
-    console.log('[goon-viewer] Proxy required:', needsProxy);
+     console.log('[goon-viewer] Proxy required:', anyNeedsProxy);
   } else {
     console.warn('[goon-viewer] No video entries in storage for ID:', id, '— data may have been cleared or never saved');
   }
@@ -1194,15 +1253,15 @@ async function init() {
        }
       return;
      }
-        // Before playback, swap each stored phncdn manifest for the freshest live
+          // Before playback, swap each referer-protected manifest for the freshest
-        // one the source tab has captured (a stored token may already be 410
+          // live one the source tab has captured (a stored token may already be 410
-        // Gone). Non-phncdn manifests are left untouched.
+          // Gone). Non-protected manifests are left untouched.
-     for (const { video, manifest, panel } of hlsEntries) {
+      for (const { video, manifest } of hlsEntries) {
-      if (manifest.includes('phncdn')) {
+       if (needsProxy(manifest)) {
-        const fresh = await resolveFreshManifest(manifest);
+         const fresh = await resolveFreshManifest(manifest);
-        if (fresh) video.dataset.hlsManifest = fresh;
+         if (fresh) video.dataset.hlsManifest = fresh;
-         }
+           }
-        }
+       }
      for (const { video, panel } of hlsEntries) {
       playHls(video, video.dataset.hlsManifest, panel);
        }