Summary

Integrates all-chat PR #524 (cross-platform polls, predictions & viewer points) into the extension. The streamer's live All-Chat poll/prediction now renders in the chat overlay, and a signed-in viewer can vote or wager points with one click — a proper interactive UI, not chat-command spam.
How it works

The extension attaches to a stream by streamer username and never learns the overlay id. It uses the new streamer-keyed endpoints (/api/v1/engagement/streamers/:username/{active,me,vote,wager,heartbeat}) added in all-chat under ADR-0031, which resolve username → public overlay server-side.
poll_update / prediction_update frames already arrive on the existing chat WebSocket (viewer subscription); they act as a "refetch now" signal. Authoritative state comes from the HTTP endpoints (which apply All-Chat-over-native display precedence).
All engagement HTTP goes through the service worker (the documented API proxy): it holds the viewer JWT, so background fetches pass the gateway OriginCheck and the overlay id never reaches a page context.
Twitch-native mirrored rounds render read-only (they settle in Twitch Channel Points).


Changes

useEngagement hook + EngagementPanel component, mounted in ChatContainer above the message list
Service-worker engagement proxy handlers + engagementClient (talks to the SW via chrome.runtime.sendMessage)
storage.onChanged listener so an expired token recovers the UI mid-session
Static integration spec guarding the wiring and the overlay-id secrecy invariant
Version bump 1.6.4 → 1.7.0; README


Maintenance release — no changes to features or behavior.

This version updates the build environment to a currently-supported Node.js LTS (Node 24) to comply with Mozilla's add-on policy. The extension works identically to 1.6.3.

All-Chat Browser Extension 1.5.7

Changelog

Firefox Compatibility

• Fix streamer resolution ("not using All-Chat") — removed unnecessary Content-Type header from GET request that triggered CORS preflight in Firefox
• Remove default-src 'self' from CSP — acted as restrictive fallback for unspecified directives in Firefox, blocking API calls and WebSocket connections
• Guard empty platforms array in streamer lookup to show proper badge instead of broken UI

Gradient Name Color

• Fix gradient rendering: use inline -webkit-text-fill-color: transparent instead of Tailwind class (more reliable cross-browser)
• Add validation to prevent invisible text from malformed gradient data
• Show gradient preview swatch in popup settings when a gradient is active
• Fetch cosmetics from backend when popup opens (picks up gradients set via allch.at)

Testing

• Expanded Firefox source validation tests from 10 to 21 covering CSP directives, manifest gecko settings, service worker compatibility, and chrome.identity absence

All-Chat Browser Extension 1.5.6

Changelog

Bug Fixes

• Fix popup CSS not rendering — CSP default-src 'self' was blocking inline <style> tags
• Fix streamer resolution ("not using All-Chat") — CSP was blocking fetch() to allch.at from the service worker
• Fix sign-in button not working — same CSP restriction blocked the OAuth flow
• Fix WebSocket chat connection — connect-src falling back to 'self' blocked wss://allch.at

Root Cause

The Content Security Policy added in v1.5.4 security hardening used default-src 'self' without explicit style-src or connect-src directives, which blocked inline styles, API calls, and WebSocket connections.

Changelog

Firefox Compatibility

• Fix iframe storage hang: getLocalStorage() / getSyncStorage() could hang forever in Firefox iframes when the callback never fired — added 5s timeout with fallback to defaults
• Fix postMessage rejection: content-script-relayed messages were silently dropped in Firefox due to origin mismatch — replaced event.origin check with event.source === window.parent

Security Hardening

• OAuth tokens are now exchanged server-side via auth code instead of being read directly from the URL
• WebSocket authentication moved from URL parameter to in-message auth
• Added Content Security Policy to extension manifest
• Added postMessage origin validation and WebSocket message schema validation
• Validated OAuth redirect URL with proper hostname check
• Removed localhost from host_permissions

Maintenance

• Dependency updates (TypeScript ESLint, ts-loader, mini-css-extract-plugin, actions/checkout)
• Cleaned up stale docs, artifacts, and debug screenshots from repo root

What's New

Unsupported YouTube stream detection

The extension now detects scheduled (upcoming) and unlisted YouTube streams before attempting to inject AllChat. Instead of failing silently or showing a cryptic error, users see a dismissible amber badge explaining why AllChat can't activate on that stream.

Improved error handling

• Better error display and more robust YouTube video_id extraction
• Uses backend-provided display_name instead of DOM-scraped channel ID for more reliable streamer identification

Documentation

• Documented YouTube limitation: only public, currently live streams are supported
• Unlisted, private, and scheduled streams are explicitly called out as unsupported in the README

Changelog

• feat: detect unsupported YouTube streams and show dismissible badge
• fix: improve error display and video_id extraction robustness
• fix: use backend display_name instead of DOM-scraped channel ID
• docs: document YouTube unlisted/private stream limitation
• docs: clarify only public live YouTube streams are supported

Bug Fixes

• OAuth: Route all providers (Twitch, YouTube, Kick) through backend tab-based flow instead of chrome.identity.launchWebAuthFlow, fixing redirect_uri_mismatch errors
• Remove dead code: initiateAuth(), exchangeCodeForToken(), getExtensionRedirectURI(), START_AUTH/EXCHANGE_CODE message handlers

What's New

• Pop-out chat window — Click the pop-out button in the AllChat header to open chat in a standalone browser window. Message history transfers automatically, and window size persists between sessions.
• Bidirectional native/AllChat switching — "Switch to native" button in the AllChat header restores platform chat with a one-click return to AllChat. Works in both in-page and pop-out modes.
• Native pop-out detection — On Twitch (/popout/{channel}/chat) and YouTube (/live_chat) native pop-out pages, a "Switch to AllChat" button appears instead of injecting the full UI.
• Port-based pop-out communication — Pop-out windows use chrome.runtime.Port for reliable message delivery through the service worker.
• Origin-validated message handlers — All pop-out message handlers in content scripts validate extensionOrigin before processing.

Bug Fixes

• Fixed chat send freeze — Added 15-second timeout to the message send request. Previously, if the API hung or network degraded during a YouTube stream, the UI would permanently freeze in "Sending..." state with no way to recover without reloading.

What's Changed
Features
Per-platform enable/disable toggles in popup
Separate YouTube Studio toggle from YouTube
Per-tab grayscale icon when platform is disabled
Storage migration from single extensionEnabled to per-platform platformEnabled