Release Changelog

5.4.1 Worker hardening

23 August 2026 · server only, no extension update required

TURN credentials now last eight hours instead of the previous short window, so a long film no longer risks a relay credential expiring mid-party.
The versioned API gained a membership check, so room endpoints answer only to participants who actually belong to that room.
The static website worker now runs only on the paths where it changes the response, after the www redirect moved to a Cloudflare rule. Most pages are now served straight from the asset binding.
Cloudflare's native rate-limiting binding was built, deployed, measured and then removed. It did not close the bypasses that mattered, and the measurement is recorded so the idea is not retried blindly.

The party connection moved out of the video tab into the extension's offscreen document. Because that document never navigates, changing videos no longer tears down and rebuilds the party connection on either side.
The in-page script was reduced to observing and applying playback, drawing the panel, and running the microphone and camera connection. On each page load it attaches to the existing transport with a lightweight handshake.
Microphone and camera negotiation now travels over the transport's always-open channel, and page session identifiers tell the other side exactly when a page reloaded, so the media connection is rebuilt once and cleanly rather than by timers.
The background service worker recreates the offscreen document after Chrome restarts it, if a party is still persisted.
The panel and launcher now wait for the streaming page's own load event before mounting extension styles, fonts and images, so extension assets can no longer hold the tab's loading indicator open or replace the site's favicon.

Fixed a recovery timer that could stop permanently while a data channel sat in Chrome's connecting state.
Participant timing gaps are rechecked instead of abandoning a rebuild before the participant list arrives.
Added an acknowledged peer-reset handshake with fresh session identifiers on both sides.
Negotiation retries within bounded grace periods, escalating repeated failures to TURN relay recovery, and the watchdog clears only once the replacement data channel is genuinely open.

Shared video changes route through the signalling envelope, so a change still lands over the websocket while the peer connection is rebuilding.
An unsent local video change is retried once connectivity returns.
Safe, locally reconstructed YouTube and Netflix watch URLs are followed, including changes across services, and the room survives a reload that lands on a different video.
Added a deployment safety check that verifies the live worker version and social routing before an extension build is distributed, and an actionable error when an old worker is still deployed.

Signalling messages carry a per-page peer-session identifier, so a reload during automatic video following rebuilds the right connection.
Incoming session descriptions and ICE candidates are serialized, so overlapping offers cannot race.
Recovers once from Chrome's SDP ordering error by rebuilding the connection without stopping local tracks.
Remembers whether the microphone was on before a video change and reacquires it on the new page, keeping muted microphones muted.

When either participant changes video, the other's party tab follows automatically, on YouTube and within Netflix.
A tab-scoped room handoff is stored before remote navigation, so the room reconnects after the page transition without putting the join secret in the destination URL.
Every local video change increments a media revision, and simultaneous changes resolve through a deterministic tie-break so two computers converge on one video instead of redirecting each other in a loop.
The invite link is rebuilt for the new video, so invitations sent after a change open the right thing.

Friend and invitation panels perform a centralized revision check when opened, and coalesced checks while visible.
Chrome push registration errors enter a long cooldown instead of retrying in a loop; social features continue working without push.
A reverse friend request now reports clearly that the friendship was accepted automatically.

Removed the one-minute full social bootstrap and the 15-second polling loop, replacing them with a single background-owned refresh with staleness checks, offline handling and exponential backoff.
Revision-aware sync responses mean unchanged social state no longer rereads every collection.
Push events carry event identifiers and revisions, update the local cache directly, and trigger a recovery sync only when a revision gap appears.
Fixed an invitation identifier mismatch that could open a party without marking the invitation accepted, and made accepted or declined invitations disappear from both sides' lists.
Invitation acknowledgements survive service-worker suspension and retry with backoff.

Rebuilt the social layer on the proven 4.1.3 party baseline, adding stable cross-device extension identity.
Added Google sign-in through a reusable offscreen document with exact-origin bridge security.
Added friends, friend requests, direct party invitations and website account state, with atomic and idempotent server mutations.
Added guards so delayed work cannot restore social or notification state after sign-out, collision-safe friend-code claims, and friend-visible profile privacy boundaries.

Stopped the logo flashing while a streaming page loads, keeping the floating interface hidden until its stylesheet is ready.
No change to party creation, playback sync, chat, microphone, camera or relay behaviour.

Starts with free STUN and requests TURN relay credentials only when a direct connection is slow or fails, with the candidate pool set to zero so browsers do not allocate relays speculatively.
Batches ICE candidates and moves later renegotiation peer-to-peer over the data channel, with the server as fallback.
Invitations became direct streaming links carrying secure room data in the URL fragment, removing an intermediate page round trip. Older join links still work.

Added a microphone input selector to the party controls, saved locally.
Supports switching microphone mid-party by replacing the track, with no room reconnect, and refreshes the device list when microphones are plugged in or removed.

Moved signalling to Cloudflare Workers with Durable Objects, one temporary object per invite-link room, expiring automatically after six hours.
Signalling carries only WebRTC negotiation; playback and chat move over the peer data channel.
Replaced database ticket rows with stateless short-lived signed socket tickets, and kept TURN credentials server-generated so the long-term relay token never reaches the extension.
Reduced camera defaults and added sender bitrate caps to keep relay data usage down.