fix(anime): stop superseded playEpisode calls from touching mpv

- Extend the generation guard from subtitleCacheDir to the whole playback: a stale playEpisode call now bails out before sending mpv commands, showing the overlay, or reading a playback outcome that belongs to a newer episode - Add a regression test where a slow-resolving first call must not drive mpv after a second call for a newer episode has already started playing
fix(anime): guard playback races and harden install/extract tests
2026-08-02 07:21:33 -07:00 · 2026-08-02 03:39:17 -07:00 · 2026-08-02 02:04:24 -07:00 · 2026-08-02 00:50:14 -07:00 · 2026-08-02 00:11:02 -07:00 · 2026-08-01 23:34:23 -07:00
259 changed files with 18381 additions and 1392 deletions
@@ -1,5 +1,41 @@
 # Changelog

+## v0.19.0 (2026-07-29)
+
+### Added
+- Anki Maturity Highlighting: Known-word subtitle highlights can now be colored by Anki card maturity (new, learning, young, mature), similar to asbplayer. Tier thresholds and colors are configurable, with a runtime toggle and an updated help legend.
+- Post-Playback Menu: After a watch-history episode ends, the fzf/rofi launcher returns to that series with options to play the previous or next episode, rewatch, pick another episode, or quit. The pre-playback series menu now offers the previous episode too.
+- Delete Library Entries: The stats Library detail view can now delete an entire title in one step (episodes, sessions, subtitle lines, rollups, cover art, and vocabulary counts). Delete progress is now shown app-wide via a progress bar and status toast instead of disappearing when you switch tabs.
+- Cross-Machine Sync: Added SSH-based syncing of stats and watch history between machines, available from the tray ("Sync Stats & History") or `subminer sync`, with saved devices, per-host sync direction, background auto-sync, connection testing, manual snapshots, and support for Windows remotes.
+- TsukiHime Subtitle Downloads: Added subtitle downloads for the current video via TsukiHime, loading Japanese as the primary track and your configured secondary language directly into mpv.
+
+### Changed
+- Clipboard-Video Shortcut: The "append clipboard video to queue" shortcut is now configurable.
+
+### Fixed
+- AniList Season Resolution: Season 2+ files now resolve to the correct AniList entry instead of silently falling back to season 1 (which mismatched character dictionaries and watch progress). Manual overrides now stay scoped per season, fix both the dictionary and progress tracking together, and also correct per-season cover art.
+- Subtitle Annotation Accuracy: Fixed several annotation edge cases, including inconsistent POS exclusions on merged quote-particle tokens, dropped annotations on supplementary-plane kanji, katakana punctuation wrongly treated as noise, and certain kanji vocabulary losing N+1 highlighting eligibility.
+- AnkiConnect Proxy Port Conflict: Video startup no longer crashes when another process already holds the configured AnkiConnect proxy port; a notification now explains how to resolve it.
+- AppImage Quit Crash: Fixed a "Service Crash" desktop notification appearing after closing a video when running the Linux AppImage.
+- Autoplay Pause Timing: Fixed playback resuming a few seconds before subtitle tokenization warmup finished, most noticeable when resuming mid-episode or when a cue starts within the first two seconds.
+- Stats Known-Word Count: Fixed stats reporting 0 known words for every session after the known-word cache format changed.
+- Stats Library Cover Art: Relinking a title to a different AniList entry now updates its cover in the Library grid immediately instead of leaving a stale, mismatched cover cached.
+- Rofi Prompt Spacing: Rofi menu prompts now keep a space before the input field instead of running into the placeholder text.
+- Stats Settings & Reliability: Hardened stats settings validation (nested/legacy AnkiConnect config now falls back safely instead of breaking) and stats routes against malformed requests and other edge cases.
+- Stats Delete Performance: Deleting sessions, episodes, and library entries is now dramatically faster and no longer stalls playback (e.g. a 12-episode title dropped from about a minute to under a second on a large library); the Vocabulary tab also loads much faster. The first launch after upgrading runs a one-time database migration.
+
+<details>
+<summary>Internal changes</summary>
+
+### Internal
+- Added a golden-file regression test corpus for the tokenizer/annotation pipeline, plus scripts to record new fixtures and diff against stock Yomitan.
+- Consolidated renderer modal state handling into a descriptor registry.
+- Consolidated CI quality checks (PR, stable, and prerelease) into one reusable workflow with mpv plugin tests and dependency audits.
+- Removed the unused stats IPC transport and unified stats dashboard HTTP types with the backend contract.
+- Added a script to verify known-word highlight tiers against live Anki data outside of playback.
+
+</details>
+
 ## v0.18.0 (2026-07-10)

 ### Added
@@ -66,7 +66,7 @@ Local stats dashboard tracking watch time, vocabulary growth, mining throughput,
 Browse sibling episode files and the active mpv queue in one overlay modal. Open it with `Ctrl+Alt+P` to append episodes from the current directory, jump to queued items, remove entries, or reorder the playlist without leaving playback.

 <div align="center">
-  <img src="docs-site/public/screenshots/playlist-browser.png" width="800" alt="Stats dashboard showing watch time, cards mined, streaks, and tracking data">
+  <img src="docs-site/public/screenshots/playlist-browser.png" width="800" alt="Playlist browser modal showing sibling episode files beside the active mpv queue">
 </div>

 <br>
@@ -86,10 +86,22 @@ Browse sibling episode files and the active mpv queue in one overlay modal. Open
    <td><b>Jellyfin</b></td>
    <td>Browse, launch, and cast media from your Jellyfin server with setup and discovery controls in the app tray</td>
  </tr>
+  <tr>
+    <td><b>Anime Browser</b></td>
+    <td>Search anime sources you supply as <a href="https://github.com/aniyomiorg/aniyomi">Aniyomi</a> extension APKs and play an episode in mpv with the overlay attached (<code>subminer anime</code>); SubMiner ships no repositories and bundles no sources</td>
+  </tr>
  <tr>
    <td><b>Jimaku</b></td>
    <td>Search and download Japanese subtitles</td>
  </tr>
+  <tr>
+    <td><b>TsukiHime</b></td>
+    <td>Search and download subtitles extracted from anime releases, with Japanese and secondary-language tabs (<code>Ctrl+Shift+T</code>) — no API key, requires <code>xz</code> on your <code>PATH</code></td>
+  </tr>
+  <tr>
+    <td><b>AniSkip</b></td>
+    <td>Automatic intro detection with chapter markers and a one-key skip (<code>TAB</code> by default)</td>
+  </tr>
  <tr>
    <td><b>alass / ffsubsync</b></td>
    <td>Manual subtitle retiming — requires <code>alass</code> or <code>ffsubsync</code> on your <code>PATH</code> (optional; subtitle syncing is disabled without them)</td>
@@ -110,18 +122,19 @@ Browse sibling episode files and the active mpv queue in one overlay modal. Open

 ## Requirements

-Only **mpv** and Anki+AnkiConnect are required. Everything else is optional but enhances the experience.
+Only **mpv** is required to run SubMiner. Anki + AnkiConnect are required to mine cards, which is the point of the app, but everything else is optional.

-| Dependency           | Status      | What it does                             |
-| -------------------- | ----------- | ---------------------------------------- |
-| mpv                  | Required    | The video player SubMiner overlays on    |
-| Anki + AnkiConnect   | Required    | Card creation from the Yomitan popup     |
-| ffmpeg               | Recommended | Audio clips & screenshots for Anki cards |
-| MeCab + mecab-ipadic | Recommended | More precise annotations and filtering   |
-| yt-dlp               | Optional    | YouTube playback                         |
-| fzf / rofi           | Optional    | Video picker in the launcher             |
-| alass / ffsubsync    | Optional    | Subtitle sync                            |
-| guessit              | Optional    | Better anime title and episode detection |
+| Dependency           | Status           | What it does                                             |
+| -------------------- | ---------------- | -------------------------------------------------------- |
+| mpv                  | Required         | The video player SubMiner overlays on                    |
+| Anki + AnkiConnect   | Required to mine | Card creation from the Yomitan popup                     |
+| ffmpeg               | Recommended      | Audio clips & screenshots for Anki cards                 |
+| MeCab + mecab-ipadic | Recommended      | More precise annotations and filtering                   |
+| yt-dlp               | Optional         | YouTube playback                                         |
+| xz                   | Optional         | TsukiHime subtitle downloads (not on Windows by default) |
+| alass / ffsubsync    | Optional         | Subtitle sync                                            |
+| guessit              | Optional         | Better anime title and episode detection                 |
+| fzf / rofi           | Optional         | Video picker in the `subminer` launcher (Linux/macOS)    |

 <details>
 <summary><b>Platform-specific install commands</b></summary>
@@ -138,9 +151,23 @@ sudo pacman -S --needed mpv ffmpeg mecab mecab-ipadic
 brew install mpv ffmpeg mecab mecab-ipadic
 ```

-**Windows:** Install [mpv](https://mpv.io/installation/) and [ffmpeg](https://ffmpeg.org/download.html) and ensure both are on `PATH`.
+**Windows:**

-See the [full requirements list](https://docs.subminer.moe/installation#1-install-requirements) for optional dependencies.
+```powershell
+winget install shinchiro.mpv
+winget install Gyan.FFmpeg
+```
+
+Then reopen your terminal and check `mpv --version` and `ffmpeg -version`. winget puts `ffmpeg` on `PATH` automatically; mpv uses a regular installer that may not, so if `mpv` is not found, either add its folder (usually `%LOCALAPPDATA%\Programs\mpv`) to `PATH` or set `mpv.executablePath` during first-run setup.
+
+[Scoop](https://scoop.sh) is the alternative if you want one package manager for everything, since it is the only one that also carries `xz`:
+
+```powershell
+scoop bucket add extras
+scoop install extras/mpv main/ffmpeg main/yt-dlp main/xz
+```
+
+See the [full requirements list](https://docs.subminer.moe/installation#_1-install-requirements) for optional dependencies.

 </details>

@@ -166,6 +193,11 @@ paru -S subminer-bin
 mkdir -p ~/.local/bin
 wget https://github.com/ksyasuda/SubMiner/releases/latest/download/SubMiner.AppImage -O ~/.local/bin/SubMiner.AppImage \
 && chmod +x ~/.local/bin/SubMiner.AppImage
+```
+
+The AppImage is all you need. The optional `subminer` command-line launcher runs on [Bun](https://bun.sh), and first-run setup can install both for you. To grab it manually instead, install Bun first, then:
+
+```bash
 wget https://github.com/ksyasuda/SubMiner/releases/latest/download/subminer -O ~/.local/bin/subminer \
 && chmod +x ~/.local/bin/subminer
 ```
@@ -228,19 +260,28 @@ Full guides on configuration, Anki setup, Jellyfin, immersion tracking, and more

 SubMiner builds on the work of these open-source projects:

-| Project                                                                                     | Role                                                                    |
-| ------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
-| [ani-skip](https://github.com/synacktraa/ani-skip)                                          | AniSkip API client for anime intro/outro skip timestamps                |
-| [Anacreon-Script](https://github.com/friedrich-de/Anacreon-Script)                          | Inspiration for the mining workflow                                     |
-| [asbplayer](https://github.com/killergerbah/asbplayer)                                      | Inspiration for subtitle sidebar and logic for YouTube subtitle parsing |
-| [Bee's Character Dictionary](https://github.com/bee-san/Japanese_Character_Name_Dictionary) | Character name recognition in subtitles                                 |
-| [GameSentenceMiner](https://github.com/bpwhelan/GameSentenceMiner)                          | Inspiration for Electron overlay with Yomitan integration               |
-| [jellyfin-mpv-shim](https://github.com/jellyfin/jellyfin-mpv-shim)                          | Jellyfin integration                                                    |
-| [Jimaku.cc](https://jimaku.cc)                                                              | Japanese subtitle search and downloads                                  |
-| [Renji's Texthooker Page](https://github.com/Renji-XD/texthooker-ui)                        | Base for the WebSocket texthooker integration                           |
-| [Yomitan](https://github.com/yomidevs/yomitan)                                              | Dictionary engine powering all lookups and the morphological parser     |
-| [yomitan-jlpt-vocab](https://github.com/stephenmk/yomitan-jlpt-vocab)                       | JLPT level tags for vocabulary                                          |
+| Project                                                                                     | Role                                                                         |
+| ------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
+| [ani-skip](https://github.com/synacktraa/ani-skip)                                          | AniSkip API client for anime intro/outro skip timestamps                     |
+| [Anacreon-Script](https://github.com/friedrich-de/Anacreon-Script)                          | Inspiration for the mining workflow                                          |
+| [Aniyomi](https://github.com/aniyomiorg/aniyomi)                                            | Anime extension API and data model the anime browser targets                 |
+| [asbplayer](https://github.com/killergerbah/asbplayer)                                      | Inspiration for subtitle sidebar and logic for YouTube subtitle parsing      |
+| [Bee's Character Dictionary](https://github.com/bee-san/Japanese_Character_Name_Dictionary) | Character name recognition in subtitles                                      |
+| [GameSentenceMiner](https://github.com/bpwhelan/GameSentenceMiner)                          | Inspiration for Electron overlay with Yomitan integration                    |
+| [jellyfin-mpv-shim](https://github.com/jellyfin/jellyfin-mpv-shim)                          | Jellyfin integration                                                         |
+| [Jimaku.cc](https://jimaku.cc)                                                              | Japanese subtitle search and downloads                                       |
+| [M-Extension-Server](https://github.com/1Selxo/M-Extension-Server)                          | Runs Aniyomi extension APKs off Android; the bridge the anime browser drives |
+| [Mangatan](https://github.com/1Selxo/Mangatan)                                              | Reference client for the bridge protocol the anime browser speaks            |
+| [Renji's Texthooker Page](https://github.com/Renji-XD/texthooker-ui)                        | Base for the WebSocket texthooker integration                                |
+| [Yomitan](https://github.com/yomidevs/yomitan)                                              | Dictionary engine powering all lookups and the morphological parser          |
+| [yomitan-jlpt-vocab](https://github.com/stephenmk/yomitan-jlpt-vocab)                       | JLPT level tags for vocabulary                                               |

 ## License

 [GNU General Public License v3.0](LICENSE)
+
+The anime browser drives [M-Extension-Server](https://github.com/1Selxo/M-Extension-Server),
+downloaded from its upstream releases at runtime rather than
+bundled or redistributed here; its bundles carry their own dependencies, including a JRE and
+GPL-3.0 NewPipe Extractor. SubMiner includes none of them and talks to the bridge
+over its own HTTP protocol. It ships no extensions or repositories by default.
@@ -0,0 +1,7 @@
+type: fixed
+area: anilist
+
+- Resolving "season N" against AniList no longer lands one season short for franchises whose broadcast seasons are listed as several entries. AniList records the back half of a split cour ("… Season 2 Part 2", "… Cour 2", "第2クール") as its own sequel, and the resolver counted each as a season — so Mushoku Tensei season 3 resolved to the season 2 entry and Re:ZERO season 4 to season 3, which then drove the character dictionary and AniList progress updates to the wrong series. A sequel carrying a part or cour marker that matches the season it continues is now followed without advancing the season count, in both the relation walk and the air-order fallback. Titles are compared ignoring punctuation, and the marker is looked for in every title and synonym rather than just the display title. A wrong match cached before this fix is remembered in `character-dictionaries/anilist-resolution-cache.json` and needs removing (or overriding from the character dictionary picker) for the affected series.
+- A special or OVA sitting in a franchise's sequel chain is walked through without counting as a season. Dr. STONE links STONE WARS to New World through a one-episode special, which made New World resolve as season 4 and every later season shift with it.
+- An AniList rate limit or network failure while walking sequel relations is reported so the caller can retry, instead of falling through to the air-date fallback. That fallback is for a franchise with missing relation edges; running it after a failed lookup turned a transient 429 into a confidently wrong season.
+- The shared title parser recognizes spelled-out episode labels (`Episode 4`, `第4話`) and a season named at the end of the title (`… Season 3`, `… 3rd Season`, `… S3`), which now fill the Season field instead of being searched for as part of the series name. The TsukiHime modal gained a Season field to match Jimaku, and seasons after the first are included in its search query so a later season's releases are actually found.
@@ -0,0 +1,26 @@
+type: added
+area: anime
+
+- Added an anime browser window that searches Aniyomi extension sources, shows cover art and episode lists, and plays an episode in mpv so the overlay and mining tools attach as usual.
+- Added `subminer anime` and the `--anime` flag to open the browser, plus a "Browse Anime" tray entry.
+- Anime extensions are read from `<userData>/anime-extensions`; drop Aniyomi `.apk` files there to add sources.
+- Added a source settings tab so extensions that need configuration (server address, credentials, quality) can be set up from the browser; values persist per extension and source, and updated extension schemas replace stale saved field definitions without losing values. Older unscoped preferences are discarded once because their package ownership cannot be proven safely.
+- Added an Extensions tab for adding repository URLs and installing, updating, or removing extensions in place; extensions that fail to load are listed with the reason. Repository requests time out instead of hanging, and APK updates are staged before replacing the installed copy.
+- Browse, Extensions, and Source settings are tabs, so each one gets the full window instead of sharing it with the search results.
+- Repository URLs only need to be an https URL to a `.json` index; the file name is not restricted to `index.min.json`.
+- The source picker offers "All sources", which searches every installed source at once. Results stream in as each source answers, with per-source progress in the status bar. Results are tagged with their source, failures do not blank the grid, and **Load more** appends later pages without duplicating streamed entries.
+- The Extensions tab opens with an Installed section listing every extension on disk with Remove — including ones added by hand or whose repository has since been removed — and Update where a configured repository still carries it.
+- Added `anime.repos`, `anime.extensionsDir`, and `anime.preferredQuality` config keys. SubMiner ships no extension repositories and performs no discovery.
+- Anime playback targets Japanese audio: dub-labelled entries are skipped when the source offers an alternative, `alang` prefers Japanese, and the source's own audio and subtitle tracks are loaded into mpv (Japanese selected) instead of being discarded, so all of them can be switched from mpv's track menu.
+- The primary subtitle slot stays reserved for Japanese: a source that only has, say, English subtitles gets them added with a normalized language tag (`English` → `en`) but not selected, so the regular `secondarySub` auto-load can route them to the secondary slot instead.
+- HLS streams pass through a local strip proxy that removes fake image headers some hosts glue onto their video segments, so streams ffmpeg would otherwise probe as "a PNG" and abandon now play in mpv.
+- The strip proxy retries a failed segment fetch once after a short pause and logs upstream error statuses; a host that errors on the very first fetches right after an episode resolves no longer kills the whole playback.
+- The strip proxy no longer forwards `Range` headers to the bridge: ffmpeg opens every HLS segment with `Range: bytes=0-`, the bridge answers some of those with 206, and a partial response bypassed the disguise strip, so whether an episode played depended on the bridge's cache state.
+- A bridge that dies out from under the app (killed, crashed, or stopped mid-operation) no longer leaves the browser failing every request until an app restart: the exit is detected, surfaced in the status bar, and the bridge restarts on the next request.
+- "Playing" is only reported once mpv actually configures a video output; when a stream fails to decode, the browser shows mpv's error instead of claiming playback started while no window ever appeared.
+- The Linux x64 bridge bundle is verified and pinned, so the anime browser starts on Linux instead of refusing with "No pinned checksum for linux-x64-bundle.zip".
+- The bridge bundle is fetched from the pinned release tag rather than whatever release is newest, so an upstream publish no longer breaks every install with a checksum mismatch.
+- The Extensions tab's available list has a language chip row: pick one or more languages to narrow a repository index that otherwise lists every language it knows, or "All" to clear the filter. Rows name the language ("Japanese" instead of `ja`) and the Available heading counts what the filter leaves.
+- A stream's subtitle tracks are downloaded to a temp directory and loaded into mpv as files rather than streamed from the source URL, so they can serve as the alass reference in Subsync the way Jellyfin subtitles do. The format is detected from the file's own content, a track that fails to download falls back to its URL so the episode still plays, and the directory is removed when the next episode starts or the app exits.
+- An episode launched from the browser carries its series, season and episode number through the app instead of a single joined string: stats group by series (every stream previously landed in one entry named `m3u8`), rewatching reuses the existing entry, the Jimaku and TsukiHime modals prefill Title/Season/Episode from the source's own listing, AniList updates use those fields directly, and the mpv title reads `Series S03E04 - Episode Name`.
+- Opening the browser shows a tray icon on every platform and — on macOS — puts the app in the Cmd+Tab switcher and Dock, so you can switch between it and mpv; the Dock icon is released again when the window closes during playback. Launching a video starts a regular SubMiner session, and in `subminer anime` standalone mode closing the window during playback no longer quits the app and kills the stream.
@@ -1,5 +0,0 @@
-type: added
-area: overlay
-
- Known-word subtitle highlights can now be colored by Anki card maturity (new, learning, young, mature) like asbplayer. Enable with `ankiConnect.knownWords.maturityEnabled`; the mature interval threshold (`matureThresholdDays`, default 21) and the four tier colors (`subtitleStyle.knownWordMaturityColors`) are configurable, and a runtime option toggles it in-session. The session help color legend shows the four tier colors while maturity highlighting is on.
- Tiers follow Anki's own card counts: the interval tiers exclude cards in the learning/relearning queue, so a lapsed card shows the learning color instead of young (its interval is reset to at least 1 day, which previously made the learning tier unreachable). A note with a mature card alongside a relearning card still shows mature.
@@ -1,5 +0,0 @@
-type: fixed
-area: overlay
-
- Applied configured primary POS exclusions consistently to merged trailing quote-particle tokens, preserved annotations for supplementary-plane kanji, and stopped treating katakana punctuation as kana-only annotation noise.
- Kept kanji vocabulary tagged `名詞/非自立` eligible for N+1 highlighting, consistent with frequency, JLPT, and vocabulary persistence.
@@ -1,4 +0,0 @@
-type: changed
-area: shortcuts
-
- Made the clipboard-video playlist shortcut configurable through `shortcuts.appendClipboardVideoToQueue`.
@@ -1,4 +0,0 @@
-type: fixed
-area: anki
-
- Prevented video startup from crashing when another process already owns the configured AnkiConnect proxy port, and added a notification explaining how to resolve the conflict.
@@ -1,4 +0,0 @@
-type: fixed
-area: app
-
- Fixed "Service Crash" desktop notifications (KDE DrKonqi) after closing a video when running the Linux AppImage: the short-lived background bootstrap spawned a Chromium GPU child that outlived it (surviving `app.exit`) and died with SIGBUS at session end when the bootstrap's FUSE mount was finally released. The bootstrap now runs with the GPU in-process so it leaves no children behind, and the detached app's mount remains supervised until its Chromium children finish. Set `SUBMINER_NO_APPIMAGE_MOUNT_KEEPALIVE=1` to disable the detached-app mount supervisor.
@@ -1,4 +0,0 @@
-type: fixed
-area: character dictionary
-
- Kept manual AniList overrides active across episodes in the same season directory when filename guesses differ.
@@ -1,4 +0,0 @@
-type: fixed
-area: overlay
-
- Fixed `mpv.pauseUntilOverlayReady` releasing playback seconds before tokenization warmup finished: startup subtitle priming emits the current cue untokenized so the overlay can paint early, and that emission was treated as the autoplay-readiness signal as soon as the overlay window loaded. The autoplay gate now ignores untokenized subtitle payloads while tokenization warmup is pending, so playback resumes only after the first tokenized delivery (or the post-warmup release). Most visible when resuming mid-episode or when a subtitle cue starts within the first two seconds.
@@ -1,5 +0,0 @@
-type: fixed
-area: stats
-
- Stats reported 0 known words for every session after the known-word cache gained maturity tiers. The stats server carried its own copy of the cache parser that only recognized versions up to 3, so the new v4 file was read as "no cache" rather than as a format it should understand.
- The cache format, its parser, and the derived known-word set now live in one module that both the cache manager and the stats server read, and the version dispatch ends in an exhaustive check so a future format bump fails the build instead of silently reporting zero. A cache that exists but does not parse now logs a warning rather than passing for an empty one.
@@ -1,7 +0,0 @@
-type: internal
-area: tokenizer
-
- Added a golden-file regression corpus for the tokenizer/annotation pipeline: recorded Yomitan backend responses and MeCab tokens replay through the real tokenizeSubtitle pipeline in bun tests without Electron or dictionaries.
- Added `record-tokenizer-fixture:electron` script to capture new fixtures from a live Yomitan/MeCab session, with flags for known words, JLPT levels, and annotation toggles.
- Seeded eleven fixtures covering the #147–#156 regression classes (grammar-helper suppression, lexical くれる, kanji non-independent nouns, N+1 targeting, reading collisions, unparsed runs, ordinal/honorific prefixes).
- Added `compare-yomitan-api:electron` script that diffs SubMiner tokenization against a stock Yomitan instance via the yomitan-api bridge (segmentation, readings, headword forms).
@@ -1,5 +0,0 @@
-type: added
-area: launcher
-
- After a watch-history episode ends or mpv closes, the fzf or rofi launcher returns to that series with options to play the previous episode, rewatch, play the next episode, select another episode, or quit SubMiner. Previous and Next continue across season directories.
- The action menu shown right after picking a series from `subminer -H` now also offers the previous episode, matching the menu shown after playback.
@@ -0,0 +1,4 @@
+type: fixed
+area: overlay
+
+- Fixed the overlay never loading (stuck on the "Overlay loading" OSD spinner) when the Yomitan content-script reload raced overlay window creation at startup, most visible when playing from the anime browser on Linux/Wayland: a hidden window stops painting after that reload, so the ready-to-show signal that gates showing the overlay never fired. Content-ready now falls back to did-finish-load after a short grace period.
@@ -0,0 +1,4 @@
+type: fixed
+area: overlay
+
+- Fixed the macOS Yomitan popup going inert after mining a card: clicking outside the popup no longer passes through to mpv (with the overlay flickering hidden and shown), and scrolling over the popup scrolls its definitions again instead of seeking mpv.
@@ -1,4 +0,0 @@
-type: internal
-area: overlay
-
- Consolidated renderer modal state handling into a descriptor registry.
@@ -1,4 +0,0 @@
-type: internal
-area: release
-
- Consolidated pull request, stable release, and prerelease quality checks in one reusable workflow, with Lua mpv plugin tests and blocking high-severity dependency audits running in every gate.
@@ -1,4 +0,0 @@
-type: fixed
-area: launcher
-
- Rofi menu prompts now keep a space between the prompt text and the input field instead of running into the search placeholder.
@@ -1,5 +0,0 @@
-type: fixed
-area: stats
-
- Validated nested and legacy AnkiConnect settings after splitting the resolver, preserving valid modern overrides while warning and falling back for invalid primitive values.
- Hardened stats routes against malformed IDs and static paths, stalled AniList searches, word-mining media collisions, missing Yomitan bridges, and throwing timing observers.
@@ -0,0 +1,7 @@
+type: fixed
+area: subsync
+
+- Subsync now works when mpv loaded a subtitle track from a URL, which is how Aniyomi extension streams and Jellyfin add theirs. The track is downloaded to a temporary file first — reusing mpv's own request headers, so authenticated and referer-gated hosts stay reachable — instead of being rejected with "Subtitle file not found: https://…". This applies to both the sync target and the alass reference, so a Jimaku or TsukiHime download can be retimed against a stream's own subtitles. Internal tracks of a stream also pass mpv's headers through to `ffmpeg`.
+- Alass now works on tracks that arrive as WebVTT, which is what Aniyomi extension streams serve. Alass picks its parser from the file extension and has no WebVTT support, so it treated a `.vtt` reference as a video file and failed with "no audio stream in file". Both the target and the reference are rewritten as SRT for alass, keeping the cue text as-is, and the originals are left untouched.
+- Leaving `subsync.alass_path`, `ffsubsync_path`, or `ffmpeg_path` empty now actually auto-discovers the binary, as the config help has always claimed. Previously it fell back to a hard-coded `/usr/bin/<tool>`, which does not exist on macOS and broke subsync for every default-config install there. Discovery searches `PATH` plus the usual install prefixes (a GUI launch inherits a minimal `PATH`) and accepts `alass-cli` as well as `alass`. An explicitly configured path is still used verbatim and never silently substituted.
+- Subsync failures are written to the application log. Previously the only trace was an OSD toast that vanished after a few seconds, leaving nothing to diagnose from.
@@ -1,8 +0,0 @@
-type: added
-area: sync
-
- Added cross-machine immersion sync for stats and watch history over SSH, available as a window (**Sync Stats & History** in the tray menu, or `subminer sync --ui`) and as a command (`subminer sync <host>`, with `--push` / `--pull` for one-way insert-only transfers). The window keeps saved devices with per-host direction, one-click sync with live stage-by-stage progress and separate merge summaries for each machine, connection testing for first-time setup, cancellable runs while the app/stats server/playback is active, and manual database snapshots (create/merge/reveal/delete, stored in `/tmp/subminer-db-snapshots/` by default). Hosts with auto-sync enabled sync in the background on a configurable interval, including during playback, with results reported as overlay notifications; hosts synced from the CLI are remembered in `<config dir>/sync-hosts.json` and appear in the window automatically.
- Merges are an insert-only union keyed on session UUIDs / video keys / series title keys, so re-syncing is idempotent and nothing is double-counted: each side snapshots its database (`VACUUM INTO`) from a consistent WAL point, snapshots are exchanged with `scp`, and each machine merges the other's data transactionally. Lifetime totals and daily/monthly rollups are updated incrementally (history older than the session retention window is preserved), unfinished sessions are excluded until a later sync sees them finalized, and remote-only historical rollups are copied only when they do not conflict with retained local session history. Sync aborts on stats schema version mismatches and refuses to run while the stats daemon or a live mpv session is active (`--force` overrides).
- The sync engine runs only inside the app: the sync window and the `subminer sync` command both delegate to `SubMiner --sync-cli` (headless, works over SSH with no display), so neither machine needs bun or the command-line launcher. A remote machine only needs SubMiner itself, found automatically as the app binary or via the launcher proxy.
- Windows remotes are supported: sync detects the remote shell (POSIX, cmd, or PowerShell) and manages remote temp files through SubMiner itself (`sync --make-temp` / `--remove-temp`) instead of `mktemp` / `rm`, so a Windows machine with the built-in OpenSSH Server works as a sync remote, found in its default Windows install location automatically.
- Added supporting flags: `subminer sync <host> --check` tests the SSH connection and remote launcher availability without syncing, `subminer sync --snapshot <file>` and `--merge <file>` expose the underlying steps for manual transfers, and `subminer sync --json` emits machine-readable NDJSON progress (the protocol the sync window consumes).
@@ -1,4 +0,0 @@
-type: added
-area: overlay
-
- Added TsukiHime subtitle downloads for the current video, with Japanese primary and configured secondary-language tracks loaded directly into mpv.
@@ -1,4 +0,0 @@
-type: internal
-area: stats
-
- Removed the unused stats IPC data transport and unified the stats dashboard's HTTP wire types with the backend contract.
@@ -1,7 +0,0 @@
-type: internal
-area: tokenizer
-
- Added `verify-known-word-highlights:electron` script: tokenizes a real subtitle file through the app's Yomitan/MeCab pipeline with the live known-word cache, prints each line in the configured tier colors, and summarizes the tier counts so highlighting can be checked outside of playback.
- Added `--audit`, which re-derives every highlighted tier from live Anki card data (`notesInfo` + `cardsInfo` intervals) and reports each token whose rendered tier disagrees, catching both stale cache entries and tier-classification bugs.
- Added `--profile-copy` so the check can run while SubMiner is open (Electron locks the Yomitan userData dir), plus `--refresh`, `--limit`, `--json`, and `--quiet`.
- Added `KnownWordCacheManager.getKnownWordMatchNoteIds`, exposing the note ids behind a known-word match so an audit can trace a rendered tier back to the exact Anki notes.
@@ -0,0 +1,6 @@
+type: added
+area: anki
+
+- Added `ankiConnect.lapisKiku.wordCardKind` (Settings > Mining/Anki > Kiku/Lapis Features > "Word Card Type") to choose which card-type flag SubMiner marks on Kiku/Lapis word cards: `word-and-sentence` (default, unchanged behavior), `click`, `sentence`, `audio`, or `none` to leave the flags alone. Requested by Kiku users who only want `IsClickCard` set.
+- Word cards can now be flagged as Kiku click cards (`IsClickCard`), which SubMiner previously never set.
+- Setting a card-type flag now clears `IsClickCard` alongside the other card-type flags, so a note can no longer claim two card types at once.
@@ -523,7 +523,7 @@
  // ==========================================
  // AnkiConnect Integration
  // Automatic Anki updates and media generation options.
-  // Hot-reload: ankiConnect.ai.enabled, media.normalizeAudio/mirrorMpvVolume, knownWords, nPlusOne, fields.word/audio/image/sentence/miscInfo, behavior.autoUpdateNewCards, isLapis.sentenceCardModel, and isKiku.fieldGrouping update live while SubMiner is running.
+  // Hot-reload: ankiConnect.ai.enabled, media.normalizeAudio/mirrorMpvVolume, knownWords, nPlusOne, fields.word/audio/image/sentence/miscInfo, behavior.autoUpdateNewCards, isLapis.sentenceCardModel, isKiku.fieldGrouping, and lapisKiku.wordCardKind update live while SubMiner is running.
  // Shared AI provider transport settings are read from top-level ai and typically require restart.
  // Most other AnkiConnect settings still require restart.
  // ==========================================
@@ -605,9 +605,24 @@
      "enabled": false, // Enable Kiku-specific mining behaviors (duplicate handling, field grouping). Values: true | false
      "fieldGrouping": "disabled", // Kiku duplicate-card field grouping mode. Values: auto | manual | disabled
      "deleteDuplicateInAuto": true // When Kiku field grouping is "auto", delete the duplicate source card after grouping completes. Values: true | false
-    } // Is kiku setting.
+    }, // Is kiku setting.
+    "lapisKiku": {
+      "wordCardKind": "word-and-sentence" // Card-type flag SubMiner marks on Kiku/Lapis word cards. Only one flag is set at a time; the others are cleared. Requires isKiku.enabled or isLapis.enabled. Values: word-and-sentence | click | sentence | audio | none
+    } // Lapis kiku setting.
  }, // Automatic Anki updates and media generation options.

+  // ==========================================
+  // Anime Browser
+  // Anime browser sources. SubMiner ships no extension repositories and bundles no sources;
+  // add a repository index URL here (or drop .apk files in the extensions directory) to have any.
+  // Hot-reload: anime changes apply the next time the anime browser opens.
+  // ==========================================
+  "anime": {
+    "extensionsDir": "", // Directory holding Aniyomi extension .apk files. Empty uses <userData>/anime-extensions.
+    "repos": [], // Extension repository index URLs (any https .json index, e.g. https://.../index.min.json). Empty by default; SubMiner ships no repositories.
+    "preferredQuality": "" // Preferred stream quality label, matched as a substring (for example: 1080). Empty uses the source order.
+  }, // Anime browser sources. SubMiner ships no extension repositories and bundles no sources;
+
  // ==========================================
  // Jimaku
  // Jimaku API configuration and defaults.
@@ -327,6 +327,7 @@ const sidebar: DefaultTheme.SidebarItem[] = [
      { text: 'Anki', link: '/anki-integration' },
      { text: 'Jellyfin', link: '/jellyfin-integration' },
      { text: 'YouTube', link: '/youtube-integration' },
+      { text: 'Anime Browser', link: '/anime-browser' },
      { text: 'Jimaku', link: '/jimaku-integration' },
      { text: 'TsukiHime', link: '/tsukihime-integration' },
      { text: 'AniList', link: '/anilist-integration' },
@@ -39,7 +39,7 @@ SubMiner monitors playback and triggers an AniList progress update when an episo
 The update flow:

 1. **Title detection** -- SubMiner extracts the anime title, season, and episode number from the media filename and path. Season folders such as `Season 2` are treated as a strong season signal. SubMiner tries [`guessit`](https://github.com/guessit-io/guessit) first for accurate parsing, then falls back to an internal filename parser if guessit is unavailable.
-2. **AniList search** -- The detected title is searched against the AniList GraphQL API. For season 2 and later files, SubMiner searches the season-specific title first, then falls back to the base title. SubMiner picks the best match by comparing titles (romaji, English, native) and filtering by episode count.
+2. **AniList search** -- The base title (with any `Season N` / `SN` marker stripped) is searched against the AniList GraphQL API, and SubMiner picks the best match by comparing titles (romaji, English, native, synonyms) and filtering by episode count. AniList has no notion of numbered seasons -- sequels are separate entries with their own titles (`Zoku`, `Kan`, `2nd Season`), so searching `<title> Season 3` finds nothing. For season 2 and later, SubMiner instead walks `SEQUEL` relations from the season 1 entry, preferring the TV line, and falls back to ordering the franchise's TV entries by air date when the relation chain is incomplete. If neither locates the season, SubMiner **skips the update** rather than writing progress to the season 1 entry, and tells you to pin the right entry with a [character dictionary override](/character-dictionary#correcting-anilist-matches).
 3. **Progress check** -- SubMiner fetches your current list entry for the matched media. The media must already be in Planning or Watching; otherwise SubMiner shows an MPV message explaining that the update is not possible. If your recorded progress already meets or exceeds the detected episode, the update is skipped.
 4. **Mutation** -- A `SaveMediaListEntry` mutation sets the new progress and marks the entry as `CURRENT`, or `COMPLETED` when the watched episode is the final episode of the season (the "already at this progress" skip is bypassed for the final episode so completion still lands).

@@ -69,6 +69,8 @@ SubMiner fetches cover art from AniList for display in the stats dashboard. When

 A no-match result is cached for 5 minutes before SubMiner retries, preventing repeated API calls for unrecognized media.

+If the automatic match is wrong, use **Change AniList Entry** on a title in the stats Library. Relinking rewrites the cached art for every episode of that title, and both the detail view and the Library grid pick up the new cover right away: the grid refetches after a relink, and cover responses carry an ETag and are revalidated on each request instead of being cached for a day.
+
 ## Rate Limiting

 All AniList API calls go through a shared rate limiter that enforces a sliding window of 20 requests per minute. The limiter also reads AniList's `X-RateLimit-Remaining` and `Retry-After` response headers and pauses requests when the server signals throttling. This applies to both episode tracking and cover art fetching.
@@ -93,15 +95,15 @@ All AniList API calls go through a shared rate limiter that enforces a sliding w
 }
 ```

-| Option                                      | Values              | Description                                                                                                  |
-| ------------------------------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------ |
-| `enabled`                                   | `true`, `false`     | Enable AniList post-watch progress updates (default: `false`)                                                |
-| `accessToken`                               | string              | Explicit AniList access token override; when blank, SubMiner uses the stored encrypted token (default: `""`) |
-| `characterDictionary.maxLoaded`             | number              | Number of recent media snapshots kept in the merged dictionary (default: `3`)                                |
-| `characterDictionary.refreshTtlHours`       | number              | Hours before a cached media snapshot is refreshed (default: `168`, clamped to 1–8760)                        |
-| `characterDictionary.evictionPolicy`        | `"delete"`, `"disable"` | What happens to snapshots evicted beyond `maxLoaded` (default: `"delete"`)                               |
-| `characterDictionary.profileScope`          | `"all"`, `"active"` | Apply dictionary to all Yomitan profiles or only the active one                                              |
-| `characterDictionary.collapsibleSections.*` | `true`, `false`     | Control which dictionary entry sections start expanded                                                       |
+| Option                                      | Values                  | Description                                                                                                  |
+| ------------------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------ |
+| `enabled`                                   | `true`, `false`         | Enable AniList post-watch progress updates (default: `false`)                                                |
+| `accessToken`                               | string                  | Explicit AniList access token override; when blank, SubMiner uses the stored encrypted token (default: `""`) |
+| `characterDictionary.maxLoaded`             | number                  | Number of recent media snapshots kept in the merged dictionary (default: `3`)                                |
+| `characterDictionary.refreshTtlHours`       | number                  | Hours before a cached media snapshot is refreshed (default: `168`, clamped to 1–8760)                        |
+| `characterDictionary.evictionPolicy`        | `"delete"`, `"disable"` | What happens to snapshots evicted beyond `maxLoaded` (default: `"delete"`)                                   |
+| `characterDictionary.profileScope`          | `"all"`, `"active"`     | Apply dictionary to all Yomitan profiles or only the active one                                              |
+| `characterDictionary.collapsibleSections.*` | `true`, `false`         | Control which dictionary entry sections start expanded                                                       |

 There is no `characterDictionary.enabled` key: character dictionary sync is enabled by `subtitleStyle.nameMatchEnabled`. See the [Character Dictionary](/character-dictionary) page for full details on the character dictionary feature, including name generation, matching, auto-sync lifecycle, and dictionary entry format.

@@ -0,0 +1,246 @@
+# Anime Browser
+
+Search anime sources, pick an episode, and play it in mpv with SubMiner's overlay
+and mining tools attached — the same way a local file or a Jellyfin stream works.
+
+Open it with `subminer anime`, with `SubMiner.AppImage --anime`, or from
+**Browse Anime** in the tray menu. The window stays open while you watch, so you
+can queue the next episode without reopening it.
+
+While the window is open, SubMiner shows a tray icon and — on macOS — appears
+in the Cmd+Tab switcher and the Dock (macOS ties the two together), so you can
+flip between the browser and mpv. SubMiner normally hides itself from the Dock
+because the subtitle overlay needs that to float above fullscreen video; it
+hides again when the window closes during playback.
+
+Launching an episode starts a full SubMiner playback session, the same as
+playing a local file: the overlay and mining tools attach, and the tray icon
+stays available. In standalone `subminer anime` mode, closing the window while
+a video is playing leaves playback running — reopen the browser from the tray
+(**Browse Anime**). The app only exits with the window when nothing is playing.
+
+## How it works
+
+SubMiner does not implement any anime source itself. It runs **Aniyomi extension
+APKs** through a bundled JVM sidecar ([M-Extension-Server][mes]), asks the
+selected extension to resolve an episode, and hands the resulting URL to mpv.
+
+```
+extension APK  →  bridge (JVM)  →  { url, headers }  →  mpv  →  SubMiner overlay
+```
+
+Because the extension resolves the stream, whichever sources you install decide
+what is available. SubMiner only hosts them.
+
+## Installing extensions
+
+**SubMiner ships no extension repositories and bundles no sources.** There is no
+default repository, no suggested list, and no discovery. Until you add one, the
+browser has nothing to search — that is deliberate, and it is what keeps SubMiner
+a neutral host rather than a distributor.
+
+There are two ways to add extensions.
+
+### From a repository
+
+The window has three tabs — **Browse**, **Extensions**, and **Source settings** —
+and each one fills the window, so a long extension list is not squeezed in above
+the search results.
+
+Open the **Extensions** tab, paste a repository index URL, and choose
+**Add repository**. The URL must be `https` and point at a `.json` index file —
+`index.min.json` is the common Aniyomi name, but repositories are free to publish
+under another one (for example `video.min.json`). Anything else is rejected
+immediately rather than failing later. Everything before the file name is treated
+as the repository root, so `.apk` and icon URLs are resolved relative to it.
+
+Extensions your repositories offer but you do not have appear under
+**Available**, each with **Install**. Repositories are stored in config under
+`anime.repos`, so you can also manage them there and keep them in a dotfile.
+
+A repository index lists every language it knows about, which is far more than
+any one person reads, so the **Available** list has a language chip row above
+it. Pick one or more languages to narrow it, or **All** to clear the filter;
+picking a language replaces **All** rather than sitting beside it. Rows name the
+language in full ("Japanese" rather than `ja`), extensions whose sources span
+languages are grouped under **Multi-language**, and the Available heading counts
+how many of the offered extensions the filter leaves.
+
+### Managing what is installed
+
+The Extensions tab opens with an **Installed** section listing everything in the
+extensions directory, with the sources each one provides and a **Remove**
+button. It is built from the directory rather than from a repository, so an
+extension you dropped in by hand — or one whose repository you have since
+removed — is still listed and still removable.
+
+**Update** appears next to an extension a configured repository still carries;
+it downloads the current version over the existing APK.
+
+### From a file
+
+Drop Aniyomi `.apk` files into the extensions directory, shown at the top of the
+Extensions tab. It defaults to `<userData>/anime-extensions` — on macOS,
+`~/Library/Application Support/SubMiner/anime-extensions` — and can be moved with
+`anime.extensionsDir`.
+
+A single APK may provide several sources; each appears separately in the
+**Source** picker. Extensions that fail to load are listed in the Installed
+section with the reason, so a broken APK is visible rather than silently
+missing.
+
+An extension that fails to load is skipped rather than blocking the others, so
+one bad APK will not hide the rest.
+
+## Searching every source at once
+
+With more than one source installed, the **Source** picker gains an
+**All sources** entry. Searching with it selected runs the query against every
+installed source at once, and each source's results appear the moment that
+source answers — a fast source is on screen while a slow one is still
+resolving. The status bar counts sources as they finish
+(`Searching… 3/5 sources · 42 results`).
+
+Each cover is labelled with the source it came from, and opening one always
+queries that source, whatever the picker says afterwards.
+
+A source that errors is named in the status bar and the rest still show their
+results; one extension that needs a login cannot blank the grid. If every
+source fails, the first error is shown in full.
+
+Typing a new search while one is still running simply starts over: results
+from the superseded search are discarded, even if its sources answer late.
+
+When a source reports another page, **Load more** appears below the covers.
+It appends the next page without duplicating entries that already arrived in
+the live result stream. A failed next-page request remains available to retry.
+
+Source settings belong to a single extension, so the **Source settings** tab
+asks you to pick one while **All sources** is selected.
+
+## Settings
+
+| Key                      | Purpose                                                              |
+| ------------------------ | -------------------------------------------------------------------- |
+| `anime.repos`            | Repository index URLs. Empty by default.                             |
+| `anime.extensionsDir`    | Where APKs are read from. Empty uses `<userData>/anime-extensions`.  |
+| `anime.preferredQuality` | Preferred stream label, matched as a substring (for example `1080`). |
+
+## Source settings
+
+Most extensions need configuration before they return anything — a server
+address and credentials, a preferred quality, a language filter. Open the
+**Source settings** tab to edit them. Changes save as you make them and
+persist across restarts in `<userData>/anime-source-preferences.json`.
+
+Each save is handed back to the extension, so it can react: the Jellyfin source
+logs in when the address and password land, then fills in its media-library
+picker. Password-like fields are masked. Because that file can hold
+credentials, it is written with owner-only permissions. Values are scoped to
+the exact extension package and source, so two extensions that reuse the same
+internal source ID cannot read each other's settings. Preferences saved by an
+older build without package ownership are discarded; re-enter those source
+settings once after upgrading.
+
+## The bridge
+
+The first launch downloads a platform bundle (~130 MB) containing the server and
+a matching Java runtime, so no system JDK is required. SubMiner pins one
+upstream release tag and the SHA-256 of each asset it has verified; the download
+is checked against that hash before anything runs, then unpacked into
+`<userData>/anime-bridge` and reused after that. Progress appears in the banner
+at the top of the window.
+
+The bridge stays running while the window is open. Resolved video URLs point at
+its own loopback proxy so the extension's cookies and headers apply, which means
+those URLs stop working once it exits — the window keeps it alive for the whole
+session.
+
+If the bridge dies anyway (killed by hand, crashed, or stopped mid-operation),
+the exit is detected and named in the status bar, and the next request starts a
+new one. Playback already in flight still ends when its stream URL dies, but the
+browser recovers without an app restart.
+
+Two known limits:
+
+- There is no Android WebView, so extensions that need one (typically for
+  Cloudflare challenges) will fail with an error from the source.
+- Bundles are published for macOS (arm64, x64), Linux (x64), and Windows (x64),
+  but only the ones we have hashed ourselves will run: currently macOS arm64 and
+  Linux x64. The rest stop with "No pinned checksum for …" until a maintainer
+  verifies them. Other platforms are unsupported outright.
+
+## Playback
+
+Selecting an episode resolves the best available stream, applies the source's
+required headers as mpv `http-header-fields`, and loads it. The headers are
+readable back off mpv, so Anki card audio and screenshots fetch correctly too.
+
+HLS streams are routed through a small local proxy before mpv sees them. Some
+hosts disguise their video segments by prepending a fake image header (a real
+1x1 PNG) so scrapers back off; Aniyomi's own player strips this, but ffmpeg
+probes the segment as a picture and playback dies with "no audio or video data
+played". The proxy scans each segment for the first genuine MPEG-TS packet run
+and drops whatever junk sits in front of it. Segments that are not TS (fMP4,
+subtitles, encryption keys) pass through untouched, and direct-file streams
+skip the proxy entirely.
+
+"Playing" in the status bar means playing: after handing mpv the stream,
+SubMiner waits until mpv actually configures a video output before reporting
+success. If mpv gives up instead — a dead host, an undecodable stream — the
+browser shows mpv's error rather than pretending playback started (a failed
+load leaves no mpv window, because the player idles windowless).
+
+### Japanese audio, and switching tracks
+
+Sources often return a dub and the original audio as two separate entries — or
+as two audio tracks of one stream — and the dub is frequently listed first.
+SubMiner always aims at the Japanese audio:
+
+- Entries labelled as a dub are skipped as long as another entry exists. This
+  outranks `anime.preferredQuality`: a 1080p dub is the wrong file, not a better
+  one. If every entry is a dub, it still plays.
+- mpv's `alang` is set to `ja,jpn,jp,japanese` before the file loads, so a
+  stream carrying several audio tracks starts on the Japanese one. With no
+  Japanese track, mpv falls back to the first one as usual.
+- Any audio or subtitle tracks the extension supplies separately are added to
+  mpv with `audio-add` / `sub-add`, tagged with their language, and the
+  Japanese one is selected.
+
+The primary subtitle slot is reserved for Japanese — it is what the overlay
+mines. A source that only carries, say, English subtitles does not get them
+promoted to primary; instead the track is added with a normalized language tag
+(`English` → `en`), and the regular [dual-subtitle settings](configuration.md)
+apply: with `secondarySub.autoLoadSecondarySub` enabled and the language listed
+in `secondarySub.secondarySubLanguages`, it is picked up as the secondary
+subtitle, exactly as it would be for a local file.
+
+Every track is added, including the ones that are not selected, so all of them
+appear in mpv's track menu and can be switched by hand while watching
+(`#` cycles audio, `j` cycles subtitles by default).
+
+The extension hands over subtitle tracks as URLs, but SubMiner downloads each
+one to a temporary directory and gives mpv the local file. mpv is happy either
+way; [Subsync](/troubleshooting#subtitle-sync-subsync) is not, because alass
+needs a file on disk to use as the timing reference. A track that fails to
+download falls back to its URL so the episode still plays, the format is
+detected from the file's own content rather than its URL, and the directory is
+removed when the next episode starts or the app exits.
+
+### Series, season, and episode
+
+The episode's identity travels with it instead of being guessed back out of the
+stream URL, which carries nothing but a proxy path and a file extension. The
+title and episode label from the source's own listing are split into series,
+season, and episode number once, at launch, and everything downstream reads
+those fields:
+
+- mpv's title reads `Series S03E04 - Episode Name`.
+- Stats group by series, and rewatching an episode reuses its entry instead of
+  creating a new one.
+- The [Jimaku](/jimaku-integration) and [TsukiHime](/tsukihime-integration)
+  modals open with Title, Season, and Episode already filled in, so a subtitle
+  search is one keypress rather than a retype.
+- [AniList](/anilist-integration) progress updates use those fields directly.
+
+[mes]: https://github.com/1Selxo/M-Extension-Server
@@ -289,6 +289,21 @@ Trigger with the mine sentence shortcut (`Ctrl/Cmd+S` by default). The card is c

 To mine multiple subtitle lines as one sentence card, use `Ctrl/Cmd+Shift+S` followed by a digit (1–9) to select how many recent lines to combine.

+## Word Card Type (Kiku/Lapis)
+
+Word cards get a card-type flag when SubMiner fills their sentence, whether that comes from Yomitan auto-enrichment, a manual clipboard update, or stats-dashboard word mining. By default the flag is `IsWordAndSentenceCard`; pick a different one with `ankiConnect.lapisKiku.wordCardKind`.
+
+```jsonc
+"ankiConnect": {
+  "isKiku": { "enabled": true },
+  "lapisKiku": {
+    "wordCardKind": "click" // word-and-sentence (default), click, sentence, audio, none
+  }
+}
+```
+
+`click` marks `IsClickCard`, `sentence` marks `IsSentenceCard`, `audio` marks `IsAudioCard`, and `none` leaves the flags untouched for templates that manage them elsewhere. Whichever flag is chosen, the other card-type flags are cleared so the note never claims two card types. The setting is only read when `isKiku` or `isLapis` is enabled, and cards mined with Mine Sentence or Mine Audio keep their own flag.
+
 ## Field Grouping (Kiku)

 When you mine the same word multiple times, SubMiner can merge the cards instead of creating duplicates. This is designed for note types like [Kiku](https://github.com/youyoumu/kiku) that support grouped sentence/audio/image fields.
@@ -313,11 +328,11 @@ When you mine the same word multiple times, SubMiner can merge the cards instead

 ### What Gets Merged

-| Field    | Merge behavior                          |
-| -------- | ---------------------------------------- |
+| Field    | Merge behavior                                |
+| -------- | --------------------------------------------- |
 | Sentence | Both cards' sentences kept as grouped entries |
-| Audio    | Both cards' `[sound:...]` entries kept  |
-| Image    | Both cards' images kept                 |
+| Audio    | Both cards' `[sound:...]` entries kept        |
+| Image    | Both cards' images kept                       |

 Identical values from both cards are kept as separate grouped entries; the merge does not deduplicate.

@@ -1,6 +1,47 @@
 # Changelog

-## v0.18.0 (2026-07-10)
+## v0.19.0 (2026-07-29)
+
+**Added**
+- Anki Maturity Highlighting: Known-word subtitle highlights can now be colored by Anki card maturity (new, learning, young, mature), similar to asbplayer. Tier thresholds and colors are configurable, with a runtime toggle and an updated help legend.
+- Post-Playback Menu: After a watch-history episode ends, the fzf/rofi launcher returns to that series with options to play the previous or next episode, rewatch, pick another episode, or quit. The pre-playback series menu now offers the previous episode too.
+- Delete Library Entries: The stats Library detail view can now delete an entire title in one step (episodes, sessions, subtitle lines, rollups, cover art, and vocabulary counts). Delete progress is now shown app-wide via a progress bar and status toast instead of disappearing when you switch tabs.
+- Cross-Machine Sync: Added SSH-based syncing of stats and watch history between machines, available from the tray ("Sync Stats & History") or `subminer sync`, with saved devices, per-host sync direction, background auto-sync, connection testing, manual snapshots, and support for Windows remotes.
+- TsukiHime Subtitle Downloads: Added subtitle downloads for the current video via TsukiHime, loading Japanese as the primary track and your configured secondary language directly into mpv.
+
+**Changed**
+- Clipboard-Video Shortcut: The "append clipboard video to queue" shortcut is now configurable.
+
+**Fixed**
+- AniList Season Resolution: Season 2+ files now resolve to the correct AniList entry instead of silently falling back to season 1 (which mismatched character dictionaries and watch progress). Manual overrides now stay scoped per season, fix both the dictionary and progress tracking together, and also correct per-season cover art.
+- Subtitle Annotation Accuracy: Fixed several annotation edge cases, including inconsistent POS exclusions on merged quote-particle tokens, dropped annotations on supplementary-plane kanji, katakana punctuation wrongly treated as noise, and certain kanji vocabulary losing N+1 highlighting eligibility.
+- AnkiConnect Proxy Port Conflict: Video startup no longer crashes when another process already holds the configured AnkiConnect proxy port; a notification now explains how to resolve it.
+- AppImage Quit Crash: Fixed a "Service Crash" desktop notification appearing after closing a video when running the Linux AppImage.
+- Autoplay Pause Timing: Fixed playback resuming a few seconds before subtitle tokenization warmup finished, most noticeable when resuming mid-episode or when a cue starts within the first two seconds.
+- Stats Known-Word Count: Fixed stats reporting 0 known words for every session after the known-word cache format changed.
+- Stats Library Cover Art: Relinking a title to a different AniList entry now updates its cover in the Library grid immediately instead of leaving a stale, mismatched cover cached.
+- Rofi Prompt Spacing: Rofi menu prompts now keep a space before the input field instead of running into the placeholder text.
+- Stats Settings & Reliability: Hardened stats settings validation (nested/legacy AnkiConnect config now falls back safely instead of breaking) and stats routes against malformed requests and other edge cases.
+- Stats Delete Performance: Deleting sessions, episodes, and library entries is now dramatically faster and no longer stalls playback (e.g. a 12-episode title dropped from about a minute to under a second on a large library); the Vocabulary tab also loads much faster. The first launch after upgrading runs a one-time database migration.
+
+<details>
+<summary>Internal changes</summary>
+
+**Internal**
+- Added a golden-file regression test corpus for the tokenizer/annotation pipeline, plus scripts to record new fixtures and diff against stock Yomitan.
+- Consolidated renderer modal state handling into a descriptor registry.
+- Consolidated CI quality checks (PR, stable, and prerelease) into one reusable workflow with mpv plugin tests and dependency audits.
+- Removed the unused stats IPC transport and unified stats dashboard HTTP types with the backend contract.
+- Added a script to verify known-word highlight tiers against live Anki data outside of playback.
+
+</details>
+
+## Previous Versions
+
+<details>
+<summary>v0.18.x</summary>
+
+<h2>v0.18.0 (2026-07-10)</h2>

 **Added**
 - Sentence Audio Normalization: Generated sentence audio is now normalized to -23 LUFS by default, and clips mined from playback mirror mpv's software volume curve with a limiter to prevent clipping. Both behaviors are configurable independently.
@@ -31,7 +72,7 @@

 </details>

-## Previous Versions
+</details>

 <details>
 <summary>v0.17.x</summary>
@@ -223,7 +223,9 @@ SubMiner.AppImage --dictionary-select --dictionary-anilist-id 21355 --dictionary
 subminer app --session-action '{"actionId":"openCharacterDictionaryManager"}'
 ```

-SubMiner stores manual selections in `character-dictionaries/anilist-overrides.json`. The episode's parent directory defines the override scope, so later episodes in the same season directory keep the selected AniList ID even if their filename guesses differ. Separate season directories can keep separate overrides and character dictionaries. When you replace a wrong match, SubMiner removes that stale media ID from the merged dictionary's active set and rebuilds/imports the merged character dictionary.
+SubMiner stores manual selections in `character-dictionaries/anilist-overrides.json`. The episode's parent directory **and detected season** define the override scope, so later episodes in the same season keep the selected AniList ID even if their filename guesses differ, while a different season never inherits the override -- including when every season sits in one flat folder. When you replace a wrong match, SubMiner removes that stale media ID from the merged dictionary's active set and rebuilds/imports the merged character dictionary.
+
+An override also pins the entry used for [AniList watch progress](/anilist-integration), so correcting a wrong match once fixes both the character dictionary and progress tracking.

 ## Managing Loaded Entries

@@ -154,6 +154,7 @@ The configuration file includes several main sections:

 **External Integrations**

+- [**Anime Browser**](#anime-browser) - Extension repositories and stream preferences for the anime browser
 - [**Jimaku**](#jimaku) - Jimaku API configuration and defaults
 - [**TsukiHime**](#tsukihime) - Multi-language subtitle search and download
 - [**Subtitle Sync**](#subtitle-sync) - Sync current subtitle with `alass`/`ffsubsync`
@@ -398,30 +399,30 @@ See `config.example.jsonc` for detailed configuration options.
 }
 ```

-| Option                             | Values   | Description                                                                                                                  |
-| ---------------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------- |
-| `primaryDefaultMode`               | string   | Default primary subtitle bar visibility mode: `"hidden"`, `"visible"`, or `"hover"` (default: `"visible"`)                   |
-| `subtitleStyle.css`                | object   | CSS declaration object applied to primary subtitles after normal style defaults. Use CSS property names such as `font-size`. |
-| `secondary.css`                    | object   | CSS declaration object applied to secondary subtitles after normal secondary style defaults.                                 |
-| `enableJlpt`                       | boolean  | Enable JLPT level underline styling (`false` by default)                                                                     |
-| `preserveLineBreaks`               | boolean  | Preserve line breaks in visible overlay subtitle rendering (`false` by default). Enable to mirror mpv line layout.           |
-| `autoPauseVideoOnHover`            | boolean  | Pause playback while mouse hovers subtitle text, then resume on leave (`true` by default).                                   |
-| `autoPauseVideoOnYomitanPopup`     | boolean  | Pause playback while the Yomitan popup is open, then resume when the popup closes (`true` by default).                       |
-| `primaryVisibleOnYomitanPopup`     | boolean  | Keep hover-mode primary subtitles visible while the Yomitan popup is open (`true` by default).                               |
-| `nameMatchEnabled`                 | boolean  | Enable character dictionary sync and subtitle token coloring for character-name matches (`false` by default)                 |
-| `nameMatchImagesEnabled`           | boolean  | Show small cached AniList character portraits beside matched character-name tokens (`false` by default)                      |
-| `nameMatchColor`                   | string   | Hex color used for subtitle tokens matched from the SubMiner character dictionary (default: `#f5bde6`)                       |
-| `knownWordColor`                   | string   | Hex color used for known-word subtitle highlights (default: `#a6da95`)                                                       |
+| Option                             | Values   | Description                                                                                                                                                               |
+| ---------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `primaryDefaultMode`               | string   | Default primary subtitle bar visibility mode: `"hidden"`, `"visible"`, or `"hover"` (default: `"visible"`)                                                                |
+| `subtitleStyle.css`                | object   | CSS declaration object applied to primary subtitles after normal style defaults. Use CSS property names such as `font-size`.                                              |
+| `secondary.css`                    | object   | CSS declaration object applied to secondary subtitles after normal secondary style defaults.                                                                              |
+| `enableJlpt`                       | boolean  | Enable JLPT level underline styling (`false` by default)                                                                                                                  |
+| `preserveLineBreaks`               | boolean  | Preserve line breaks in visible overlay subtitle rendering (`false` by default). Enable to mirror mpv line layout.                                                        |
+| `autoPauseVideoOnHover`            | boolean  | Pause playback while mouse hovers subtitle text, then resume on leave (`true` by default).                                                                                |
+| `autoPauseVideoOnYomitanPopup`     | boolean  | Pause playback while the Yomitan popup is open, then resume when the popup closes (`true` by default).                                                                    |
+| `primaryVisibleOnYomitanPopup`     | boolean  | Keep hover-mode primary subtitles visible while the Yomitan popup is open (`true` by default).                                                                            |
+| `nameMatchEnabled`                 | boolean  | Enable character dictionary sync and subtitle token coloring for character-name matches (`false` by default)                                                              |
+| `nameMatchImagesEnabled`           | boolean  | Show small cached AniList character portraits beside matched character-name tokens (`false` by default)                                                                   |
+| `nameMatchColor`                   | string   | Hex color used for subtitle tokens matched from the SubMiner character dictionary (default: `#f5bde6`)                                                                    |
+| `knownWordColor`                   | string   | Hex color used for known-word subtitle highlights (default: `#a6da95`)                                                                                                    |
 | `knownWordMaturityColors`          | object   | Per-tier known-word colors used when `ankiConnect.knownWords.maturityEnabled` is on: `new` (`#ee99a0`), `learning` (`#b7bdf8`), `young` (`#91d7e3`), `mature` (`#a6da95`) |
-| `nPlusOneColor`                    | string   | Hex color used for the single N+1 target subtitle highlight (default: `#c6a0f6`)                                             |
-| `frequencyDictionary.enabled`      | boolean  | Enable frequency highlighting from dictionary lookups (`false` by default)                                                   |
-| `frequencyDictionary.sourcePath`   | string   | Path to a local frequency dictionary root. Leave empty or omit to use installed/default frequency-dictionary search paths.   |
-| `frequencyDictionary.topX`         | number   | Only color tokens whose frequency rank is `<= topX` (`10000` by default)                                                     |
-| `frequencyDictionary.mode`         | string   | `"single"` or `"banded"` (`"single"` by default)                                                                             |
-| `frequencyDictionary.matchMode`    | string   | `"headword"` or `"surface"` (`"headword"` by default)                                                                        |
-| `frequencyDictionary.singleColor`  | string   | Color used for all highlighted tokens in single mode                                                                         |
-| `frequencyDictionary.bandedColors` | string[] | Array of five hex colors used for ranked bands in banded mode                                                                |
-| `jlptColors`                       | object   | JLPT level underline colors object (`N1`..`N5`)                                                                              |
+| `nPlusOneColor`                    | string   | Hex color used for the single N+1 target subtitle highlight (default: `#c6a0f6`)                                                                                          |
+| `frequencyDictionary.enabled`      | boolean  | Enable frequency highlighting from dictionary lookups (`false` by default)                                                                                                |
+| `frequencyDictionary.sourcePath`   | string   | Path to a local frequency dictionary root. Leave empty or omit to use installed/default frequency-dictionary search paths.                                                |
+| `frequencyDictionary.topX`         | number   | Only color tokens whose frequency rank is `<= topX` (`10000` by default)                                                                                                  |
+| `frequencyDictionary.mode`         | string   | `"single"` or `"banded"` (`"single"` by default)                                                                                                                          |
+| `frequencyDictionary.matchMode`    | string   | `"headword"` or `"surface"` (`"headword"` by default)                                                                                                                     |
+| `frequencyDictionary.singleColor`  | string   | Color used for all highlighted tokens in single mode                                                                                                                      |
+| `frequencyDictionary.bandedColors` | string[] | Array of five hex colors used for ranked bands in banded mode                                                                                                             |
+| `jlptColors`                       | object   | JLPT level underline colors object (`N1`..`N5`)                                                                                                                           |

 Subtitle CSS custom properties:

@@ -555,11 +556,11 @@ Secondary subtitles do **not** auto-load by default. To turn them on for local a
 }
 ```

-| Option                  | Values                             | Description                                                                                                                                                             |
-| ----------------------- | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `secondarySubLanguages` | string[]                           | Language codes to auto-load (e.g., `["eng", "en"]`); non-Signs/Songs tracks are preferred when several tracks match. Default is empty (`[]`).                            |
-| `autoLoadSecondarySub`  | `true`, `false`                    | Auto-detect and load a matching secondary subtitle track for local/Jellyfin sidecar files (default: `false`)                                                             |
-| `defaultMode`           | `"hidden"`, `"visible"`, `"hover"` | Initial display mode (default: `"hover"`)                                                                                                                               |
+| Option                  | Values                             | Description                                                                                                                                   |
+| ----------------------- | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
+| `secondarySubLanguages` | string[]                           | Language codes to auto-load (e.g., `["eng", "en"]`); non-Signs/Songs tracks are preferred when several tracks match. Default is empty (`[]`). |
+| `autoLoadSecondarySub`  | `true`, `false`                    | Auto-detect and load a matching secondary subtitle track for local/Jellyfin sidecar files (default: `false`)                                  |
+| `defaultMode`           | `"hidden"`, `"visible"`, `"hover"` | Initial display mode (default: `"hover"`)                                                                                                     |

 These two settings apply to local and Jellyfin playback only. YouTube secondary selection is fixed to English and ignores them; see [YouTube Integration](/youtube-integration#secondary-subtitle-languages). `defaultMode` still controls how the loaded secondary bar is displayed in every case.

@@ -1043,7 +1044,7 @@ This example is intentionally compact. The option table below documents availabl
 | `ankiConnect.knownWords.refreshMinutes`           | number                                      | Minutes between known-word cache refreshes (default: `1440`)                                                                                                                                                                    |
 | `ankiConnect.knownWords.decks`                    | object                                      | Deck→fields mapping used for known-word cache query scope (e.g. `{ "Kaishi 1.5k": ["Word"] }`).                                                                                                                                 |
 | `ankiConnect.knownWords.maturityEnabled`          | `true`, `false`                             | Color known words by Anki card maturity (new/learning/young/mature) instead of one color. Requires `knownWords.highlightEnabled` (default: `false`). Tier colors come from `subtitleStyle.knownWordMaturityColors`.             |
-| `ankiConnect.knownWords.matureThresholdDays`      | number                                      | Card interval in days at which a known word counts as mature (default: `21`, matching Anki's own convention)                                                                                                                   |
+| `ankiConnect.knownWords.matureThresholdDays`      | number                                      | Card interval in days at which a known word counts as mature (default: `21`, matching Anki's own convention)                                                                                                                    |
 | `ankiConnect.nPlusOne.enabled`                    | `true`, `false`                             | Enable N+1 subtitle highlighting (highlights the one unknown word in a sentence). Independent from `knownWords.highlightEnabled`. Requires known-word cache data (default: `false`).                                            |
 | `ankiConnect.nPlusOne.minSentenceWords`           | number                                      | Minimum number of words required in a sentence before single unknown-word N+1 highlighting can trigger (default: `3`).                                                                                                          |
 | `behavior.notificationType`                       | `"overlay"`, `"system"`, `"both"`, `"none"` | Notification type on card update (default: `"overlay"`). `"both"` means overlay + system. `osd` and `osd-system` are legacy config-file-only values; use `"osd-system"` to keep the old OSD + system behavior.                  |
@@ -1069,6 +1070,9 @@ SubMiner is intentionally built for [Kiku](https://kiku.youyoumu.my.id/) and [La
    "enabled": true,
    "fieldGrouping": "manual",
    "deleteDuplicateInAuto": true
+  },
+  "lapisKiku": {
+    "wordCardKind": "word-and-sentence"
  }
 }
 ```
@@ -1077,6 +1081,21 @@ SubMiner is intentionally built for [Kiku](https://kiku.youyoumu.my.id/) and [La
 - Enable `isKiku` to turn on duplicate merge behavior for mined Word/Expression hits.
 - When both are enabled, Kiku behavior is applied for grouping while sentence-card model settings are still read from `isLapis`.
 - `isKiku.fieldGrouping` supports `disabled`, `auto`, and `manual` merge modes; see [Field Grouping Modes](#field-grouping-modes).
+- `lapisKiku.wordCardKind` picks the card-type flag set on word cards; see [Word Card Type](#word-card-type). It is read only while `isLapis` or `isKiku` is enabled.
+
+### Word Card Type
+
+When SubMiner fills the sentence on a mined word card - from Yomitan auto-enrichment, a manual clipboard update, or stats-dashboard word mining - it marks which card that note should generate. `ankiConnect.lapisKiku.wordCardKind` chooses the flag:
+
+| Value                         | Flag set                |
+| ----------------------------- | ----------------------- |
+| `word-and-sentence` (default) | `IsWordAndSentenceCard` |
+| `click`                       | `IsClickCard`           |
+| `sentence`                    | `IsSentenceCard`        |
+| `audio`                       | `IsAudioCard`           |
+| `none`                        | none; flags left as-is  |
+
+The other card-type flags are cleared so a note never claims two card types at once. Notes are skipped when the note type has no field for the chosen flag, and when the note was already mined as a sentence or audio card. Cards created by Mine Sentence and Mine Audio keep their own flag regardless of this setting.

 ### N+1 Word Highlighting

@@ -1136,6 +1155,30 @@ When the manual merge popup opens, SubMiner pauses playback and closes any open

 ## External Integrations

+### Anime Browser
+
+Sources for the [anime browser](/anime-browser). SubMiner ships no extension repositories and bundles no sources, so these are empty until you add one:
+
+```json
+{
+  "anime": {
+    "extensionsDir": "",
+    "repos": [],
+    "preferredQuality": ""
+  }
+}
+```
+
+| Option                   | Type       | Default | Description                                                                                                                                                                   |
+| ------------------------ | ---------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `anime.extensionsDir`    | `string`   | `""`    | Directory holding Aniyomi extension `.apk` files. Empty uses `<userData>/anime-extensions`.                                                                                   |
+| `anime.repos`            | `string[]` | `[]`    | Extension repository index URLs. Any `https` URL ending in `.json` works; `index.min.json` is only the common name.                                                           |
+| `anime.preferredQuality` | `string`   | `""`    | Preferred stream quality label, matched as a substring (for example `1080`). Empty keeps the source's own order. A Japanese-audio entry always outranks a higher-quality dub. |
+
+Repositories added from the browser's Extensions tab are written back to `anime.repos`, so the list can also be kept in a dotfile. Changes apply the next time the anime browser opens.
+
+Per-source settings (server addresses, credentials, per-extension quality or language options) are not part of `config.jsonc`. They belong to the extension, are edited in the browser's **Source settings** tab, and persist in `<userData>/anime-source-preferences.json` with owner-only permissions.
+
 ### Jimaku

 Configure Jimaku API access and defaults:
@@ -1167,10 +1210,10 @@ TsukiHime subtitle search works out of the box and needs no account or API key.
 }
 ```

-| Option                       | Values       | Description                                                                                          |
-| ---------------------------- | ------------ | ---------------------------------------------------------------------------------------------------- |
+| Option                       | Values       | Description                                                                                           |
+| ---------------------------- | ------------ | ----------------------------------------------------------------------------------------------------- |
 | `tsukihime.apiBaseUrl`       | string (URL) | Base URL of the TsukiHime API (default: `https://api.tsukihime.org/v1`). Only change it for a mirror. |
-| `tsukihime.maxSearchResults` | number       | Maximum releases returned per search (default: `10`; the API caps this at 100)                       |
+| `tsukihime.maxSearchResults` | number       | Maximum releases returned per search (default: `10`; the API caps this at 100)                        |

 The keyboard shortcut lives under `shortcuts.openTsukihime` (default `Ctrl+Shift+T`; set to `null` to disable). The older `animetosho` section and `shortcuts.openAnimetosho` are still accepted as deprecated aliases, with the current names taking precedence when both are set.

@@ -1196,11 +1239,15 @@ Sync the active subtitle track from the overlay picker using `alass` or `ffsubsy

 | Option           | Values          | Description                                                                                                               |
 | ---------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------- |
-| `alass_path`     | string path     | Path to `alass` executable. Empty falls back to `/usr/bin/alass`. `alass` must be installed separately.                   |
-| `ffsubsync_path` | string path     | Path to `ffsubsync` executable. Empty falls back to `/usr/bin/ffsubsync`. `ffsubsync` must be installed separately.       |
-| `ffmpeg_path`    | string path     | Path to `ffmpeg` (used for internal subtitle extraction). Empty or `null` falls back to `/usr/bin/ffmpeg`.                |
+| `alass_path`     | string path     | Path to `alass` executable. Empty auto-discovers `alass` or `alass-cli`. `alass` must be installed separately.            |
+| `ffsubsync_path` | string path     | Path to `ffsubsync` executable. Empty auto-discovers `ffsubsync`. `ffsubsync` must be installed separately.               |
+| `ffmpeg_path`    | string path     | Path to `ffmpeg` (used for internal subtitle extraction). Empty or `null` auto-discovers `ffmpeg`.                        |
 | `replace`        | `true`, `false` | When `true` (default), overwrite the active subtitle file on successful sync. When `false`, write `<name>_retimed.<ext>`. |

+Auto-discovery searches `PATH`, then the usual install prefixes (`/opt/homebrew/bin`, `/usr/local/bin`, `/opt/local/bin`, `/usr/bin`, `/bin`) — a GUI launch inherits a minimal `PATH` that often omits the first two. Set the option explicitly if your binary lives elsewhere.
+
+Subtitle tracks that mpv loaded from a URL (Aniyomi extension streams, Jellyfin) are downloaded to a temporary file first, reusing mpv's own request headers, so they can be used as either the sync target or the alass reference.
+
 Stats dashboard sentence mining also uses `alass_path` when available to align a local English sidecar against the local Japanese sidecar before filling the card translation field. This stats-only retime writes a temporary cached copy and never edits the original subtitle files.

 Default trigger is `Ctrl+Alt+S` via `shortcuts.triggerSubsync`.
@@ -1228,17 +1275,17 @@ AniList integration is opt-in and disabled by default. Enable it to allow SubMin
 }
 ```

-| Option                                                         | Values              | Description                                                                                                   |
-| -------------------------------------------------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------- |
-| `anilist.enabled`                                              | `true`, `false`     | Enable AniList post-watch progress updates (default: `false`)                                                 |
-| `accessToken`                                                  | string              | Optional explicit AniList access token override (default: empty string)                                       |
-| `characterDictionary.maxLoaded`                                | number              | Maximum number of most-recently-used AniList media snapshots included in the merged dictionary (default: `3`) |
-| `characterDictionary.refreshTtlHours`                          | number              | Hours before a cached media snapshot is refreshed (default: `168`, clamped to 1–8760)                         |
-| `characterDictionary.evictionPolicy`                           | `"delete"`, `"disable"` | What happens to snapshots evicted beyond `maxLoaded` (default: `"delete"`)                                |
-| `characterDictionary.collapsibleSections.description`          | `true`, `false`     | Open the Description section by default in generated dictionary entries                                       |
-| `characterDictionary.collapsibleSections.characterInformation` | `true`, `false`     | Open the Character Information section by default in generated dictionary entries                             |
-| `characterDictionary.collapsibleSections.voicedBy`             | `true`, `false`     | Open the Voiced by section by default in generated dictionary entries                                         |
-| `characterDictionary.profileScope`                             | `"all"`, `"active"` | Apply dictionary settings updates to all Yomitan profiles or only active profile                              |
+| Option                                                         | Values                  | Description                                                                                                   |
+| -------------------------------------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------- |
+| `anilist.enabled`                                              | `true`, `false`         | Enable AniList post-watch progress updates (default: `false`)                                                 |
+| `accessToken`                                                  | string                  | Optional explicit AniList access token override (default: empty string)                                       |
+| `characterDictionary.maxLoaded`                                | number                  | Maximum number of most-recently-used AniList media snapshots included in the merged dictionary (default: `3`) |
+| `characterDictionary.refreshTtlHours`                          | number                  | Hours before a cached media snapshot is refreshed (default: `168`, clamped to 1–8760)                         |
+| `characterDictionary.evictionPolicy`                           | `"delete"`, `"disable"` | What happens to snapshots evicted beyond `maxLoaded` (default: `"delete"`)                                    |
+| `characterDictionary.collapsibleSections.description`          | `true`, `false`         | Open the Description section by default in generated dictionary entries                                       |
+| `characterDictionary.collapsibleSections.characterInformation` | `true`, `false`         | Open the Character Information section by default in generated dictionary entries                             |
+| `characterDictionary.collapsibleSections.voicedBy`             | `true`, `false`         | Open the Voiced by section by default in generated dictionary entries                                         |
+| `characterDictionary.profileScope`                             | `"all"`, `"active"`     | Apply dictionary settings updates to all Yomitan profiles or only active profile                              |

 When `enabled` is `true` and `accessToken` is empty, SubMiner opens an AniList setup helper window. Keep `enabled` as `false` to disable all AniList setup/update behavior.

@@ -1539,18 +1586,18 @@ Configure the mpv executable, profile, and window state for SubMiner-managed mpv
 }
 ```

-| Option                   | Values                                                                      | Description                                                                                                                                 |
-| ------------------------ | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
-| `executablePath`         | string                                                                      | Absolute path to `mpv.exe` for Windows launch flows. Leave empty to auto-discover from `SUBMINER_MPV_PATH` or `PATH` (default `""`)         |
-| `profile`                | string                                                                      | mpv profile name passed as `--profile=<name>`. Leave empty to pass no profile (default `""`)                                                |
-| `launchMode`             | `"normal"` \| `"maximized"` \| `"fullscreen"`                               | Window state when SubMiner spawns mpv (default `"normal"`)                                                                                  |
+| Option                   | Values                                                                      | Description                                                                                                                                                                         |
+| ------------------------ | --------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `executablePath`         | string                                                                      | Absolute path to `mpv.exe` for Windows launch flows. Leave empty to auto-discover from `SUBMINER_MPV_PATH` or `PATH` (default `""`)                                                 |
+| `profile`                | string                                                                      | mpv profile name passed as `--profile=<name>`. Leave empty to pass no profile (default `""`)                                                                                        |
+| `launchMode`             | `"normal"` \| `"maximized"` \| `"fullscreen"`                               | Window state when SubMiner spawns mpv (default `"normal"`)                                                                                                                          |
 | `socketPath`             | string                                                                      | mpv IPC socket path used by SubMiner-managed playback and the bundled mpv plugin (platform-dependent default: `/tmp/subminer-socket`, or `\\\\.\\pipe\\subminer-socket` on Windows) |
-| `backend`                | `"auto"` \| `"hyprland"` \| `"sway"` \| `"x11"` \| `"macos"` \| `"windows"` | Window tracking backend passed to the bundled mpv plugin. Auto detects the current platform (default: `"auto"`)                             |
-| `autoStartSubMiner`      | `true`, `false`                                                             | Start SubMiner in the background when SubMiner-managed mpv loads a file (default: `true`)                                                   |
-| `pauseUntilOverlayReady` | `true`, `false`                                                             | Pause mpv on visible-overlay auto-start until SubMiner signals subtitle tokenization readiness, with a 30-second fallback (default: `true`) |
-| `subminerBinaryPath`     | string                                                                      | SubMiner app binary path passed to the bundled mpv plugin. Leave empty to use the launcher-detected app path (default: `""`)                |
-| `aniskipEnabled`         | `true`, `false`                                                             | Enable AniSkip intro detection, chapter markers, and the skip-intro key (default: `true`)                                                   |
-| `aniskipButtonKey`       | string                                                                      | mpv key used to skip the detected intro while the skip prompt is visible (default: `"TAB"`)                                                 |
+| `backend`                | `"auto"` \| `"hyprland"` \| `"sway"` \| `"x11"` \| `"macos"` \| `"windows"` | Window tracking backend passed to the bundled mpv plugin. Auto detects the current platform (default: `"auto"`)                                                                     |
+| `autoStartSubMiner`      | `true`, `false`                                                             | Start SubMiner in the background when SubMiner-managed mpv loads a file (default: `true`)                                                                                           |
+| `pauseUntilOverlayReady` | `true`, `false`                                                             | Pause mpv on visible-overlay auto-start until SubMiner signals subtitle tokenization readiness, with a 30-second fallback (default: `true`)                                         |
+| `subminerBinaryPath`     | string                                                                      | SubMiner app binary path passed to the bundled mpv plugin. Leave empty to use the launcher-detected app path (default: `""`)                                                        |
+| `aniskipEnabled`         | `true`, `false`                                                             | Enable AniSkip intro detection, chapter markers, and the skip-intro key (default: `true`)                                                                                           |
+| `aniskipButtonKey`       | string                                                                      | mpv key used to skip the detected intro while the skip prompt is visible (default: `"TAB"`)                                                                                         |

 If `mpv.profile` is configured and the launcher also receives `--profile`, SubMiner passes both as a comma-separated mpv profile list.

@@ -57,6 +57,8 @@ Jellyfin stream URLs are normalized to stable item links before stats titles are

 When YouTube channel metadata is available, the Library tab groups videos by creator/channel and treats each tracked video as an episode-like entry inside that channel section.

+Open a title and use **Delete Entry** in its header to remove a mistakenly tracked show outright. This deletes every episode of that title along with their sessions, subtitle lines, rollups and cover art, drops the words and kanji that were only seen there, and removes the card from the Library grid. Individual episodes and sessions can still be deleted on their own from the episode list and session rows. Entry deletion is refused while that title is the one currently playing.
+
 ![Stats Library](/screenshots/stats-library.png)

 #### Trends
@@ -183,12 +183,8 @@ Close and reopen your terminal, then verify with `mpv --version` and `ffmpeg -ve

 1. Download mpv from [mpv.io/installation](https://mpv.io/installation/) (the Windows builds link) and ffmpeg from [ffmpeg.org/download.html](https://ffmpeg.org/download.html).
 2. Unzip each one somewhere permanent, for example `C:\Tools\mpv` and `C:\Tools\ffmpeg`. Note the folder that actually contains `mpv.exe` and the one containing `ffmpeg.exe` (for ffmpeg this is usually a `bin` subfolder).
-3. Press `Win`, type **Edit the system environment variables**, and open it.
-4. Click **Environment Variables…**
-5. Under **User variables**, select **Path** and click **Edit…**
-6. Click **New** and paste the folder containing `mpv.exe`. Click **New** again and paste the folder containing `ffmpeg.exe`.
-7. Click **OK** on all three dialogs.
-8. Close and reopen your terminal (PATH changes only apply to newly opened windows), then check:
+3. Press `Win`, type **Edit the system environment variables**, and open it. Click **Environment Variables…**, select **Path** under **User variables**, click **Edit…**, then use **New** to add each of those two folders. Confirm with **OK** on every dialog. Microsoft documents this in more detail under [environment variables](https://learn.microsoft.com/windows/deployment/usmt/usmt-recognized-environment-variables).
+4. Close and reopen your terminal, since `PATH` changes only apply to newly opened windows. Then check:

 ```powershell
 mpv --version
@@ -197,8 +193,10 @@ ffmpeg -version

 If you see `not recognized as the name of a cmdlet`, the folder you added is not the one holding the `.exe`. Reopen the Path editor and double-check.

-::: tip Don't want to touch PATH at all?
-mpv is the only hard requirement, and you can point SubMiner straight at it instead: leave `PATH` alone and set `mpv.executablePath` to the full path of `mpv.exe` during first-run setup. ffmpeg still needs to be on `PATH` for card audio and screenshots.
+::: tip mpv can skip PATH, ffmpeg cannot
+If you would rather not edit `PATH` for mpv, set `mpv.executablePath` to the full path of `mpv.exe` during first-run setup instead.
+
+There is no equivalent setting for ffmpeg: SubMiner invokes it by bare name when generating card audio and screenshots, so ffmpeg has to be on `PATH`. Without it, cards are still created but their audio and image fields come out empty. (`subsync.ffmpeg_path` only affects subtitle sync, not card media.)
 :::

 </details>
@@ -23,12 +23,12 @@ If no files match the current episode filter, a "Show all files" button lets you

 ### Modal Keyboard Shortcuts

-| Key | Action |
-| --- | --- |
-| `Enter` (in text field) | Search |
-| `Enter` (in list) | Select entry / download file |
-| `Arrow Up` / `Arrow Down` | Navigate entries or files |
-| `Escape` | Close modal |
+| Key                       | Action                       |
+| ------------------------- | ---------------------------- |
+| `Enter` (in text field)   | Search                       |
+| `Enter` (in list)         | Select entry / download file |
+| `Arrow Up` / `Arrow Down` | Navigate entries or files    |
+| `Escape`                  | Close modal                  |

 ## Configuration

@@ -41,26 +41,26 @@ Add a `jimaku` section to your `config.jsonc`:
    "apiKeyCommand": "cat ~/.jimaku_key",
    "apiBaseUrl": "https://jimaku.cc",
    "languagePreference": "ja",
-    "maxEntryResults": 10
-  }
+    "maxEntryResults": 10,
+  },
 }
 ```

-| Option | Type | Default | Description |
-| --- | --- | --- | --- |
-| `jimaku.apiKey` | `string` | - | Jimaku API key (plaintext). Mutually exclusive with `apiKeyCommand`. |
-| `jimaku.apiKeyCommand` | `string` | - | Shell command that prints the API key to stdout. Useful for secret managers (e.g., `pass jimaku/api-key`). |
-| `jimaku.apiBaseUrl` | `string` | `"https://jimaku.cc"` | Base URL for the Jimaku API. Only change this if using a mirror or local instance. |
-| `jimaku.languagePreference` | `"ja"` \| `"en"` \| `"none"` | `"ja"` | Sort subtitle files by language tag. `"ja"` pushes Japanese-tagged files to the top; `"en"` does the same for English. `"none"` preserves the API order. |
-| `jimaku.maxEntryResults` | `number` | `10` | Maximum number of anime entries returned per search. |
+| Option                      | Type                         | Default               | Description                                                                                                                                              |
+| --------------------------- | ---------------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `jimaku.apiKey`             | `string`                     | -                     | Jimaku API key (plaintext). Mutually exclusive with `apiKeyCommand`.                                                                                     |
+| `jimaku.apiKeyCommand`      | `string`                     | -                     | Shell command that prints the API key to stdout. Useful for secret managers (e.g., `pass jimaku/api-key`).                                               |
+| `jimaku.apiBaseUrl`         | `string`                     | `"https://jimaku.cc"` | Base URL for the Jimaku API. Only change this if using a mirror or local instance.                                                                       |
+| `jimaku.languagePreference` | `"ja"` \| `"en"` \| `"none"` | `"ja"`                | Sort subtitle files by language tag. `"ja"` pushes Japanese-tagged files to the top; `"en"` does the same for English. `"none"` preserves the API order. |
+| `jimaku.maxEntryResults`    | `number`                     | `10`                  | Maximum number of anime entries returned per search.                                                                                                     |

 The keyboard shortcut is configured separately under `shortcuts`:

 ```jsonc
 {
  "shortcuts": {
-    "openJimaku": "Ctrl+Shift+J"
-  }
+    "openJimaku": "Ctrl+Shift+J",
+  },
 }
 ```

@@ -79,6 +79,8 @@ SubMiner extracts media info from the current video path to pre-fill the search

 - **Season + episode patterns:** `S01E03`, `1x03`
 - **Episode-only patterns:** `E03`, `EP03`, or dash-separated numbers like `Title - 03 -`
+- **Spelled-out episode labels:** `Episode 4`, `第4話`
+- **Season named at the end of the title:** `… Season 3`, `… 3rd Season`, `… S3`, `… 第3期` - the season goes in the Season field instead of being searched for as part of the series name
 - **Season folders:** a parent directory named `Season 2` or `S2` fills in the season when the filename lacks one
 - **Bracket tags:** `[SubGroup]`, `[1080p]`, `[HEVC]` - stripped before title extraction
 - **Year tags:** `(2024)` - stripped
@@ -87,6 +89,8 @@ SubMiner extracts media info from the current video path to pre-fill the search

 If the parser produces a high-confidence result (title + episode both detected), the search runs automatically when the modal opens. Otherwise, you can adjust the fields manually before searching.

+Episodes launched from the [anime browser](/anime-browser) skip parsing entirely: Title, Season, and Episode come from the source's own listing, which is why the search runs immediately even though the stream URL says nothing about the episode.
+
 ## Troubleshooting

 **"Jimaku API key not set"**
@@ -523,7 +523,7 @@
  // ==========================================
  // AnkiConnect Integration
  // Automatic Anki updates and media generation options.
-  // Hot-reload: ankiConnect.ai.enabled, media.normalizeAudio/mirrorMpvVolume, knownWords, nPlusOne, fields.word/audio/image/sentence/miscInfo, behavior.autoUpdateNewCards, isLapis.sentenceCardModel, and isKiku.fieldGrouping update live while SubMiner is running.
+  // Hot-reload: ankiConnect.ai.enabled, media.normalizeAudio/mirrorMpvVolume, knownWords, nPlusOne, fields.word/audio/image/sentence/miscInfo, behavior.autoUpdateNewCards, isLapis.sentenceCardModel, isKiku.fieldGrouping, and lapisKiku.wordCardKind update live while SubMiner is running.
  // Shared AI provider transport settings are read from top-level ai and typically require restart.
  // Most other AnkiConnect settings still require restart.
  // ==========================================
@@ -605,9 +605,24 @@
      "enabled": false, // Enable Kiku-specific mining behaviors (duplicate handling, field grouping). Values: true | false
      "fieldGrouping": "disabled", // Kiku duplicate-card field grouping mode. Values: auto | manual | disabled
      "deleteDuplicateInAuto": true // When Kiku field grouping is "auto", delete the duplicate source card after grouping completes. Values: true | false
-    } // Is kiku setting.
+    }, // Is kiku setting.
+    "lapisKiku": {
+      "wordCardKind": "word-and-sentence" // Card-type flag SubMiner marks on Kiku/Lapis word cards. Only one flag is set at a time; the others are cleared. Requires isKiku.enabled or isLapis.enabled. Values: word-and-sentence | click | sentence | audio | none
+    } // Lapis kiku setting.
  }, // Automatic Anki updates and media generation options.

+  // ==========================================
+  // Anime Browser
+  // Anime browser sources. SubMiner ships no extension repositories and bundles no sources;
+  // add a repository index URL here (or drop .apk files in the extensions directory) to have any.
+  // Hot-reload: anime changes apply the next time the anime browser opens.
+  // ==========================================
+  "anime": {
+    "extensionsDir": "", // Directory holding Aniyomi extension .apk files. Empty uses <userData>/anime-extensions.
+    "repos": [], // Extension repository index URLs (any https .json index, e.g. https://.../index.min.json). Empty by default; SubMiner ships no repositories.
+    "preferredQuality": "" // Preferred stream quality label, matched as a substring (for example: 1080). Empty uses the source order.
+  }, // Anime browser sources. SubMiner ships no extension repositories and bundles no sources;
+
  // ==========================================
  // Jimaku
  // Jimaku API configuration and defaults.
@@ -207,21 +207,26 @@ Resume playback and wait for the next subtitle to appear, then try mining again.

 Both **alass** and **ffsubsync** are optional external dependencies. Subtitle syncing requires at least one of them to be installed.

-**"Configured alass executable not found"**
+Subsync writes to the application log under the `subsync` scope, so the full command failure — exit code, stderr, resolved file paths — is recorded there as well as on the OSD.
+
+**"Could not find alass" / "Configured alass executable not found"**

 Install alass or configure the path:

+- **Homebrew**: `brew install alass`
 - **Arch Linux (AUR)**: `paru -S alass`
 - **Cargo**: `cargo install alass-cli`
 - Set the path: `subsync.alass_path` in your config.

-**"Configured ffsubsync executable not found"**
+Leaving the option empty searches `PATH` plus the usual install prefixes, and accepts either `alass` or `alass-cli`. Set the option explicitly when the binary lives somewhere else. The second message means the configured path itself does not exist — SubMiner never silently substitutes a different binary for one you named.
+
+**"Could not find ffsubsync" / "Configured ffsubsync executable not found"**

 Install ffsubsync or configure the path:

 - **Arch Linux (AUR)**: `paru -S python-ffsubsync`
 - **pip**: `pip install ffsubsync`
- Must be on `PATH` or configured via `subsync.ffsubsync_path` in your config.
+- Must be discoverable, or configured via `subsync.ffsubsync_path` in your config.

 **"alass synchronization failed" / "ffsubsync synchronization failed"**

@@ -232,6 +237,38 @@ If subtitle sync fails (the error message is prefixed with the engine name):
 - Try running the sync tool manually to see detailed error output.
 - ffsubsync requires local files and cannot handle remote media streams (e.g., streaming URLs).

+**Syncing subtitles on a stream (Aniyomi extensions, Jellyfin)**
+
+Subtitle tracks mpv loaded from a URL are downloaded to a temporary file first, reusing mpv's own request headers, so they work as either the sync target or the alass reference. Downloading a Japanese track from Jimaku or TsukiHime while a stream is playing also works — it becomes the primary track and therefore the sync target.
+
+Internal subtitle tracks of a stream still go through `ffmpeg`, which has to reach the origin itself. If that fails, prefer an external track or a Jimaku download as the reference.
+
+Streams usually serve WebVTT, which alass cannot parse — it picks its parser from the file extension and treats a `.vtt` file as a video, failing with "no audio stream in file". SubMiner rewrites both the target and the reference as SRT for alass, so this is handled automatically; the retimed track mpv loads is that SRT.
+
+## Anime Browser
+
+See the [anime browser guide](/anime-browser) for how sources and the bridge work.
+
+**Nothing to search**
+
+SubMiner ships no extension repositories and bundles no sources. Until you add a repository index URL in the **Extensions** tab (or drop Aniyomi `.apk` files into the extensions directory) the browser has nothing to query.
+
+**"No pinned checksum for …"**
+
+The bridge bundle is verified against a SHA-256 that a maintainer has checked by hand. Bundles exist for macOS (arm64, x64), Linux (x64), and Windows (x64), but only macOS arm64 and Linux x64 are pinned so far; the rest stop with this message rather than running an unverified download. Other platforms are unsupported outright.
+
+**A source returns nothing, or asks for a login**
+
+Most extensions need configuration first - a server address, credentials, a preferred quality. Open the **Source settings** tab and fill them in; each save is handed straight back to the extension. Sources that need an Android WebView (typically for Cloudflare challenges) cannot work here, because the bridge has none.
+
+**"Playback failed" with an mpv error**
+
+"Playing" is only reported once mpv actually configures a video output, so this is a real failure rather than a silent one: a dead host, an expired stream URL, or an undecodable stream. Resolve the episode again; if it keeps failing, try another source or quality entry.
+
+**The browser starts failing every request**
+
+A bridge that dies (killed, crashed, stopped mid-operation) is named in the status bar and restarted on the next request. Anything already playing ends with it, since stream URLs point at its loopback proxy.
+
 ## TsukiHime

 **"xz binary not found"**
@@ -16,11 +16,11 @@ Unlike Jimaku, TsukiHime needs no account or API key. The only requirement is th

 The integration runs through an in-overlay modal opened with `Ctrl+Shift+T` by default. The modal has two tabs that filter the subtitle tracks of the selected release by role: the first follows `secondarySub.secondarySubLanguages` (English when unset), and the second is always **Japanese**, the currently supported primary subtitle language. Tracks with no language tag stay visible on the secondary tab.

-When you open the modal, SubMiner parses the current video filename to extract a title and episode number (same parser as Jimaku - `S01E03`, `1x03`, `E03`, and dash-separated numbers all work). If the filename yields a high-confidence match, SubMiner auto-searches immediately.
+When you open the modal, SubMiner parses the current video filename to extract a title, season, and episode number (same parser as Jimaku - `S01E03`, `1x03`, `E03`, and dash-separated numbers all work). If the filename yields a high-confidence match, SubMiner auto-searches immediately. Episodes launched from the [anime browser](/anime-browser) fill all three fields from the source's own listing instead of from a filename.

 From there:

-1. **Search** - SubMiner queries TsukiHime with `<title> <episode>`. Results appear as a list of releases (e.g. `[SubsPlease] ... - 28 (1080p)`), each showing size, file count, and the subtitle languages the release carries.
+1. **Search** - SubMiner queries TsukiHime with `<title> <season> <episode>`. Season 1 is left out on purpose: releases of a first season almost never carry `S01` in their name, so including it would match nothing. Later seasons are included, which is what makes their releases findable at all. Results appear as a list of releases (e.g. `[SubsPlease] ... - 28 (1080p)`), each showing size, file count, and the subtitle languages the release carries.
 2. **Browse releases** - Select a release to list the text subtitle tracks extracted from its files. English tracks sort first; image-based tracks (PGS/VobSub) are filtered out.
 3. **Download** - Selecting a track downloads the xz-compressed subtitle from TsukiHime's storage, decompresses it, saves it next to the video (or a temp directory for remote/streamed media), and loads it into mpv. Japanese tracks are selected as mpv's **primary** subtitle. Tracks from the configured secondary tab are assigned to mpv's **secondary** subtitle slot without replacing the primary. The filename carries the track's language - `<video basename>.en.<ext>` for English, `.ja` for Japanese, and so on - so mpv and media servers detect the language correctly.

@@ -70,6 +70,7 @@ subminer https://youtu.be/...     # Play a YouTube URL
 subminer stats                    # Open the immersion stats dashboard
 subminer doctor                   # Check dependencies, config, and the mpv socket
 subminer settings                 # Open the SubMiner settings window
+subminer anime                    # Open the anime browser window
 subminer app --setup              # Re-open first-run setup
 subminer -u                       # Check for updates
 ```
@@ -131,6 +132,7 @@ SubMiner.AppImage --open-tsukihime        # Open TsukiHime subtitle search
 SubMiner.AppImage --yomitan               # Open Yomitan settings
 SubMiner.AppImage --settings              # Open the SubMiner settings window
 SubMiner.AppImage --jellyfin              # Open the Jellyfin setup window
+SubMiner.AppImage --anime                 # Open the anime browser window
 SubMiner.AppImage --dictionary            # Generate a character dictionary ZIP
 SubMiner.AppImage --start --dev           # Enable app/dev mode
 SubMiner.AppImage --start --log-level debug  # Verbose logging without dev mode
@@ -3,7 +3,7 @@
 # Domain Ownership

 Status: active
-Last verified: 2026-07-15
+Last verified: 2026-08-02
 Owner: Kyle Yasuda
 Read when: you need to find the owner module for a behavior or test surface

@@ -27,6 +27,10 @@ Read when: you need to find the owner module for a behavior or test surface
  Includes stats storage/query schema such as `imm_videos`, `imm_media_art`, and `imm_youtube_videos` for per-video and YouTube-specific library metadata.
 - AniList tracking + character dictionary: `src/core/services/anilist/`, `src/main/runtime/composers/anilist-*`, `src/main/character-dictionary-runtime.ts`, `src/main/character-dictionary-runtime/`
 - Jellyfin integration: `src/core/services/jellyfin*.ts`, `src/main/runtime/composers/jellyfin-*`
+- Anime browser: extension bridge client, sidecar, and stream handling in `src/anime-bridge/`;
+  browser window UI in `src/animeui/` (preload `src/preload-animeui.ts`); runtime wiring in
+  `src/main/runtime/anime-browser-runtime.ts`, `src/main/runtime/anime-browser-ipc-handlers.ts`,
+  `src/main/runtime/anime-bridge-installer.ts`, `src/main/runtime/stream-playback-metadata.ts`
 - Window trackers: `src/window-trackers/`
 - Stats HTTP app: `src/core/services/stats-server.ts`, with route groups and shared route support
  in `src/core/services/stats-server/`
@@ -44,6 +48,7 @@ Read when: you need to find the owner module for a behavior or test surface
 - Settings UI contracts: `src/types/settings.ts`
 - Session-binding contracts: `src/types/session-bindings.ts`
 - Stats HTTP wire contracts: `src/types/stats-wire.ts`, `src/types/stats-http-contract.ts`
+- Anime browser contracts: `src/types/anime-browser.ts`, bridge wire types in `src/anime-bridge/types.ts`
 - Compatibility-only barrel: `src/types.ts`

 ## Ownership Heuristics
@@ -7,21 +7,21 @@ Last verified: 2026-05-23
 Owner: Kyle Yasuda  
 Read when: finding internal docs or checking verification status

-| Area | Path | Status | Last verified | Notes |
-| --- | --- | --- | --- | --- |
-| KB home | `docs/README.md` | active | 2026-05-23 | internal entrypoint |
-| Architecture index | `docs/architecture/README.md` | active | 2026-05-23 | top-level runtime map |
-| Domain ownership | `docs/architecture/domains.md` | active | 2026-05-23 | runtime and feature ownership |
-| Layering rules | `docs/architecture/layering.md` | active | 2026-05-23 | dependency direction and smells |
-| Subtitle overlay priming | `docs/architecture/subtitle-overlay-priming.md` | active | 2026-06-01 | visible-overlay subtitle startup flow |
-| KB rules | `docs/knowledge-base/README.md` | active | 2026-05-23 | maintenance policy |
-| Core beliefs | `docs/knowledge-base/core-beliefs.md` | active | 2026-03-13 | agent-first principles |
-| Quality scorecard | `docs/knowledge-base/quality.md` | active | 2026-03-13 | quality grades and gaps |
-| Workflow index | `docs/workflow/README.md` | active | 2026-05-23 | execution map |
-| Planning guide | `docs/workflow/planning.md` | active | 2026-05-23 | lightweight vs execution plans |
-| Agent plugins | `docs/workflow/agent-plugins.md` | active | 2026-05-23 | repo-local agent workflow plugin ownership |
-| Verification guide | `docs/workflow/verification.md` | active | 2026-05-23 | maintained verification lanes |
-| Release guide | `docs/RELEASING.md` | active | 2026-05-23 | release checklist |
+| Area                     | Path                                            | Status | Last verified | Notes                                      |
+| ------------------------ | ----------------------------------------------- | ------ | ------------- | ------------------------------------------ |
+| KB home                  | `docs/README.md`                                | active | 2026-05-23    | internal entrypoint                        |
+| Architecture index       | `docs/architecture/README.md`                   | active | 2026-05-23    | top-level runtime map                      |
+| Domain ownership         | `docs/architecture/domains.md`                  | active | 2026-08-02    | runtime and feature ownership              |
+| Layering rules           | `docs/architecture/layering.md`                 | active | 2026-05-23    | dependency direction and smells            |
+| Subtitle overlay priming | `docs/architecture/subtitle-overlay-priming.md` | active | 2026-06-01    | visible-overlay subtitle startup flow      |
+| KB rules                 | `docs/knowledge-base/README.md`                 | active | 2026-05-23    | maintenance policy                         |
+| Core beliefs             | `docs/knowledge-base/core-beliefs.md`           | active | 2026-03-13    | agent-first principles                     |
+| Quality scorecard        | `docs/knowledge-base/quality.md`                | active | 2026-03-13    | quality grades and gaps                    |
+| Workflow index           | `docs/workflow/README.md`                       | active | 2026-05-23    | execution map                              |
+| Planning guide           | `docs/workflow/planning.md`                     | active | 2026-05-23    | lightweight vs execution plans             |
+| Agent plugins            | `docs/workflow/agent-plugins.md`                | active | 2026-05-23    | repo-local agent workflow plugin ownership |
+| Verification guide       | `docs/workflow/verification.md`                 | active | 2026-05-23    | maintained verification lanes              |
+| Release guide            | `docs/RELEASING.md`                             | active | 2026-05-23    | release checklist                          |

 ## Update Rules

@@ -16,6 +16,10 @@ type AppCommandDeps = {
    appPath: string,
    logLevel: LauncherCommandContext['args']['logLevel'],
  ) => void;
+  launchAnimeBrowserDetached: (
+    appPath: string,
+    logLevel: LauncherCommandContext['args']['logLevel'],
+  ) => void;
 };

 const defaultAppCommandDeps: AppCommandDeps = {
@@ -23,6 +27,8 @@ const defaultAppCommandDeps: AppCommandDeps = {
  launchSyncUiDetached: (appPath, logLevel) =>
    launchAppCommandDetached(appPath, ['--sync-window'], logLevel, 'sync-ui'),
  launchAppBackgroundDetached,
+  launchAnimeBrowserDetached: (appPath, logLevel) =>
+    launchAppCommandDetached(appPath, ['--anime'], logLevel, 'anime'),
 };

 export function runAppPassthroughCommand(
@@ -37,6 +43,11 @@ export function runAppPassthroughCommand(
    deps.runAppCommandWithInherit(appPath, ['--settings']);
    return true;
  }
+  if (args.animeBrowser) {
+    // Detached: the browser window is long-lived and owns the bridge process.
+    deps.launchAnimeBrowserDetached(appPath, args.logLevel);
+    return true;
+  }
  if (args.syncUi) {
    deps.launchSyncUiDetached(appPath, args.logLevel);
    return true;
@@ -207,6 +207,7 @@ test('app command starts default macOS background app detached from launcher', (
      calls.push('attached');
    },
    launchSyncUiDetached: () => calls.push('sync-ui'),
+    launchAnimeBrowserDetached: () => {},
    launchAppBackgroundDetached: (appPath, logLevel) => {
      calls.push(`detached:${appPath}:${logLevel}`);
    },
@@ -227,6 +228,7 @@ test('app command starts default Linux background app detached from launcher', (
      calls.push('attached');
    },
    launchSyncUiDetached: () => calls.push('sync-ui'),
+    launchAnimeBrowserDetached: () => {},
    launchAppBackgroundDetached: (appPath, logLevel) => {
      calls.push(`detached:${appPath}:${logLevel}`);
    },
@@ -248,6 +250,7 @@ test('app command keeps explicit passthrough args attached', () => {
      forwarded.push(appArgs);
    },
    launchSyncUiDetached: () => detached.push('sync-ui'),
+    launchAnimeBrowserDetached: () => {},
    launchAppBackgroundDetached: () => {
      detached.push('detached');
    },
@@ -266,6 +269,7 @@ test('sync UI command launches the app detached from the terminal', () => {
  const handled = runAppPassthroughCommand(context, {
    runAppCommandWithInherit: () => calls.push('piped'),
    launchSyncUiDetached: (appPath, logLevel) => calls.push(`sync-ui:${appPath}:${logLevel}`),
+    launchAnimeBrowserDetached: () => calls.push('anime'),
    launchAppBackgroundDetached: () => calls.push('detached'),
  });

@@ -63,6 +63,7 @@ function createContext(): LauncherCommandContext {
      logsExport: false,
      version: false,
      settings: false,
+      animeBrowser: false,
      configPath: false,
      configShow: false,
      mpvIdle: false,
@@ -120,6 +120,7 @@ test('applyInvocationsToArgs maps config and jellyfin invocation state', () => {
      logLevel: 'warn',
    },
    settingsInvocation: null,
+    animeInvocation: null,
    mpvInvocation: null,
    appInvocation: null,
    dictionaryTriggered: false,
@@ -171,6 +172,7 @@ test('applyInvocationsToArgs maps settings invocation to settings window', () =>
    settingsInvocation: {
      logLevel: undefined,
    },
+    animeInvocation: null,
    mpvInvocation: null,
    appInvocation: null,
    dictionaryTriggered: false,
@@ -215,6 +217,7 @@ test('applyInvocationsToArgs fails when config invocation has no action', () =>
        action: undefined,
      },
      settingsInvocation: null,
+      animeInvocation: null,
      mpvInvocation: null,
      appInvocation: null,
      dictionaryTriggered: false,
@@ -257,6 +260,7 @@ test('applyInvocationsToArgs maps texthooker browser-open request', () => {
    jellyfinInvocation: null,
    configInvocation: null,
    settingsInvocation: null,
+    animeInvocation: null,
    mpvInvocation: null,
    appInvocation: null,
    dictionaryTriggered: false,
@@ -168,6 +168,7 @@ export function createDefaultArgs(
    version: false,
    update: false,
    settings: false,
+    animeBrowser: false,
    configPath: false,
    configShow: false,
    mpvIdle: false,
@@ -348,6 +349,12 @@ export function applyInvocationsToArgs(parsed: Args, invocations: CliInvocations
      );
  }

+  if (invocations.animeInvocation) {
+    if (invocations.animeInvocation.logLevel) {
+      parsed.logLevel = parseLogLevel(invocations.animeInvocation.logLevel);
+    }
+    parsed.animeBrowser = true;
+  }
  if (invocations.settingsInvocation) {
    if (invocations.settingsInvocation.logLevel) {
      parsed.logLevel = parseLogLevel(invocations.settingsInvocation.logLevel);
@@ -23,6 +23,7 @@ export interface CliInvocations {
  jellyfinInvocation: JellyfinInvocation | null;
  configInvocation: CommandActionInvocation | null;
  settingsInvocation: CommandActionInvocation | null;
+  animeInvocation: CommandActionInvocation | null;
  mpvInvocation: CommandActionInvocation | null;
  appInvocation: { appArgs: string[] } | null;
  dictionaryTriggered: boolean;
@@ -102,6 +103,7 @@ function getTopLevelCommand(argv: string[]): { name: string; index: number } | n
    'doctor',
    'config',
    'settings',
+    'anime',
    'mpv',
    'logs',
    'dictionary',
@@ -155,6 +157,7 @@ export function parseCliPrograms(
  let jellyfinInvocation: JellyfinInvocation | null = null;
  let configInvocation: CommandActionInvocation | null = null;
  let settingsInvocation: CommandActionInvocation | null = null;
+  let animeInvocation: CommandActionInvocation | null = null;
  let mpvInvocation: CommandActionInvocation | null = null;
  let appInvocation: { appArgs: string[] } | null = null;
  let dictionaryTriggered = false;
@@ -415,6 +418,16 @@ export function parseCliPrograms(
      };
    });

+  commandProgram
+    .command('anime')
+    .description('Open the anime browser window')
+    .option('--log-level <level>', 'Log level')
+    .action((options: Record<string, unknown>) => {
+      animeInvocation = {
+        logLevel: typeof options.logLevel === 'string' ? options.logLevel : undefined,
+      };
+    });
+
  commandProgram
    .command('mpv')
    .description('MPV helpers')
@@ -469,6 +482,7 @@ export function parseCliPrograms(
      jellyfinInvocation,
      configInvocation,
      settingsInvocation,
+      animeInvocation,
      mpvInvocation,
      appInvocation,
      dictionaryTriggered,
@@ -57,6 +57,7 @@ function createArgs(): Args {
    logsExport: false,
    version: false,
    settings: false,
+    animeBrowser: false,
    configPath: false,
    configShow: false,
    mpvIdle: false,
@@ -629,6 +629,7 @@ function makeArgs(overrides: Partial<Args> = {}): Args {
    logsExport: false,
    version: false,
    settings: false,
+    animeBrowser: false,
    configPath: false,
    configShow: false,
    mpvIdle: false,
@@ -185,6 +185,7 @@ export const IMMERSION_DB_FIXTURE_DDL = `
    line_id INTEGER NOT NULL,
    word_id INTEGER NOT NULL,
    occurrence_count INTEGER NOT NULL,
+    seen_ms INTEGER,
    PRIMARY KEY(line_id, word_id),
    FOREIGN KEY(line_id) REFERENCES imm_subtitle_lines(line_id) ON DELETE CASCADE,
    FOREIGN KEY(word_id) REFERENCES imm_words(id) ON DELETE CASCADE
@@ -193,6 +194,7 @@ export const IMMERSION_DB_FIXTURE_DDL = `
    line_id INTEGER NOT NULL,
    kanji_id INTEGER NOT NULL,
    occurrence_count INTEGER NOT NULL,
+    seen_ms INTEGER,
    PRIMARY KEY(line_id, kanji_id),
    FOREIGN KEY(line_id) REFERENCES imm_subtitle_lines(line_id) ON DELETE CASCADE,
    FOREIGN KEY(kanji_id) REFERENCES imm_kanji(id) ON DELETE CASCADE
@@ -313,8 +315,8 @@ export const IMMERSION_DB_FIXTURE_DDL = `
  CREATE INDEX idx_subtitle_lines_session_line ON imm_subtitle_lines(session_id, line_index);
  CREATE INDEX idx_subtitle_lines_video_line ON imm_subtitle_lines(video_id, line_index);
  CREATE INDEX idx_subtitle_lines_anime_line ON imm_subtitle_lines(anime_id, line_index);
-  CREATE INDEX idx_word_line_occurrences_word ON imm_word_line_occurrences(word_id, line_id);
-  CREATE INDEX idx_kanji_line_occurrences_kanji ON imm_kanji_line_occurrences(kanji_id, line_id);
+  CREATE INDEX idx_word_line_occurrences_word_seen ON imm_word_line_occurrences(word_id, seen_ms, occurrence_count, line_id);
+  CREATE INDEX idx_kanji_line_occurrences_kanji_seen ON imm_kanji_line_occurrences(kanji_id, seen_ms, occurrence_count, line_id);
  CREATE INDEX idx_media_art_cover_blob_hash ON imm_media_art(cover_blob_hash);
  CREATE INDEX idx_media_art_anilist_id ON imm_media_art(anilist_id);
  CREATE INDEX idx_media_art_cover_url ON imm_media_art(cover_url);
@@ -149,6 +149,7 @@ export interface Args {
  version: boolean;
  update?: boolean;
  settings: boolean;
+  animeBrowser: boolean;
  configPath: boolean;
  configShow: boolean;
  mpvIdle: boolean;
@@ -2,7 +2,7 @@
  "name": "subminer",
  "productName": "SubMiner",
  "desktopName": "SubMiner.desktop",
-  "version": "0.19.0-beta.4",
+  "version": "0.19.0",
  "description": "All-in-one sentence mining overlay with AnkiConnect and dictionary integration",
  "packageManager": "bun@1.3.5",
  "main": "dist/main-entry.js",
@@ -21,10 +21,11 @@
    "build:launcher": "bun build ./launcher/main.ts --target=bun --packages=bundle --banner='#!/usr/bin/env bun' --outfile=dist/launcher/subminer",
    "build:stats": "cd stats && bun run build",
    "dev:stats": "cd stats && bun run dev",
-    "build": "bun run build:yomitan && bun run build:stats && tsc -p tsconfig.json && bun run build:renderer && bun run build:settings && bun run build:syncui && bun run build:launcher && bun run build:assets",
+    "build": "bun run build:yomitan && bun run build:stats && tsc -p tsconfig.json && bun run build:renderer && bun run build:settings && bun run build:syncui && bun run build:animeui && bun run build:launcher && bun run build:assets",
    "build:renderer": "esbuild src/renderer/renderer.ts --bundle --platform=browser --format=esm --target=es2022 --outfile=dist/renderer/renderer.js --sourcemap",
    "build:settings": "esbuild src/settings/settings.ts --bundle --platform=browser --format=esm --target=es2022 --outfile=dist/settings/settings.js --sourcemap",
    "build:syncui": "esbuild src/syncui/syncui.ts --bundle --platform=browser --format=esm --target=es2022 --outfile=dist/syncui/syncui.js --sourcemap && esbuild src/preload-syncui.ts --bundle --platform=node --format=cjs --target=node20 --external:electron --outfile=dist/preload-syncui.js --sourcemap",
+    "build:animeui": "esbuild src/animeui/animeui.ts --bundle --platform=browser --format=esm --target=es2022 --outfile=dist/animeui/animeui.js --sourcemap && esbuild src/preload-animeui.ts --bundle --platform=node --format=cjs --target=node20 --external:electron --outfile=dist/preload-animeui.js --sourcemap",
    "changelog:build": "bun run scripts/build-changelog.ts build-release",
    "changelog:check": "bun run scripts/build-changelog.ts check",
    "changelog:docs": "bun run scripts/build-changelog.ts docs",
@@ -24,6 +24,11 @@
  - The mature-interval threshold and the four tier colors are configurable, and the in-session help legend shows the active tier colors while maturity highlighting is on.
  - Tiers follow Anki's own card state: a lapsed card correctly shows as learning rather than young, and a note is treated as mature if any of its cards are mature. Stats and other known-word tools stay accurate with this new data.

+- **Stats Library Entry Deletion**
+  - Added a "Delete Entry" action in the stats Library detail view that removes an entire title in one step: every episode, session, subtitle line, rollup, cover, and vocabulary count derived from it. Previously a mistaken entry had to be cleared episode by episode and still lingered in the Library.
+  - Delete progress (session, session group, episode, or full entry) now shows app-wide as a progress bar plus a status toast, staying visible across tabs and windows instead of disappearing when you switch away.
+  - Deletes are dramatically faster on large libraries, and opening the Vocabulary tab no longer stalls; the first launch after upgrading migrates the stats database in place to support this.
+
 ### Changed

 - **Clipboard-Video Shortcut**
@@ -34,8 +39,9 @@
 - **Word Highlighting Accuracy**
  - Fixed several incorrect word highlighting and annotation cases: inconsistent part-of-speech exclusions on merged quote-particle tokens, missing annotations for rare kanji, katakana punctuation wrongly treated as non-kana noise, and certain kanji vocabulary skipped for next-level ("N+1") highlighting.

- **Character Dictionary Season Overrides**
-  - Manual AniList overrides for a series now stay in effect for every episode in the same season folder, even when individual episode filenames produce different automatic guesses.
+- **AniList Season Resolution**
+  - Season 2 and later episodes now resolve to the correct AniList entry by walking sequel relations instead of guessing from the title, so watch progress, the character dictionary, and cover art for later seasons no longer silently fall back to season 1.
+  - Manual AniList overrides now stay in effect for every episode in the same season (by folder and detected season), and setting an override now fixes both the character dictionary and AniList watch progress together instead of needing separate corrections.

 - **Startup Playback Pausing Too Early**
  - Fixed playback resuming before subtitle processing finished warming up, which could briefly show untranslated subtitles right after opening a video.
@@ -53,6 +59,9 @@
  - Hardened the stats server against malformed requests, stalled AniList lookups, media mismatches during word mining, and missing Yomitan connections.
  - AnkiConnect settings validation now preserves valid custom configurations while safely falling back on invalid values instead of failing.

+- **Stats Library Cover After Relink**
+  - Relinking a title to a different AniList entry now updates its cover art in the stats Library grid, not just the detail view, so unrelated titles no longer end up sharing the wrong cover.
+
 - **Rofi Menu Prompt Spacing**
  - Rofi menu prompts now keep a space between the prompt label and the input field instead of crowding the search placeholder text.

@@ -64,6 +73,8 @@
 - refactor: split anki-connect and stats-server resolvers into modules by @ksyasuda in #169
 - feat(launcher): add post-playback history menu with previous episode by @ksyasuda in #170
 - Anki maturity-based known-word highlighting by @ksyasuda in #172
+- fix(anilist): resolve later seasons via sequel relations, not title guessing by @ksyasuda in #173
+- feat(stats): add library entry deletion and app-wide delete progress by @ksyasuda in #174

 ## Installation

@@ -3,14 +3,33 @@ import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import path from 'node:path';

-test('build:syncui bundles the sandboxed preload and keeps Electron external', () => {
+function buildScript(name: string): string {
  const packageJson = JSON.parse(
    fs.readFileSync(path.join(import.meta.dir, '..', 'package.json'), 'utf8'),
  ) as { scripts: Record<string, string> };
-  const command = packageJson.scripts['build:syncui'] ?? '';
+  return packageJson.scripts[name] ?? '';
+}
+
+test('build:syncui bundles the sandboxed preload and keeps Electron external', () => {
+  const command = buildScript('build:syncui');

  assert.match(command, /src\/preload-syncui\.ts/);
  assert.match(command, /--bundle/);
  assert.match(command, /--external:electron/);
  assert.match(command, /--outfile=dist\/preload-syncui\.js/);
 });
+
+test('build:animeui bundles the sandboxed preload and keeps Electron external', () => {
+  const command = buildScript('build:animeui');
+
+  // The preload imports IPC_CHANNELS, so it must be bundled rather than
+  // emitted by plain tsc with a relative runtime require.
+  assert.match(command, /src\/preload-animeui\.ts/);
+  assert.match(command, /--bundle/);
+  assert.match(command, /--external:electron/);
+  assert.match(command, /--outfile=dist\/preload-animeui\.js/);
+});
+
+test('build:animeui runs as part of the top-level build', () => {
+  assert.match(buildScript('build'), /bun run build:animeui/);
+});
@@ -11,6 +11,8 @@ const settingsSourceDir = path.join(repoRoot, 'src', 'settings');
 const settingsOutputDir = path.join(repoRoot, 'dist', 'settings');
 const syncUiSourceDir = path.join(repoRoot, 'src', 'syncui');
 const syncUiOutputDir = path.join(repoRoot, 'dist', 'syncui');
+const animeUiSourceDir = path.join(repoRoot, 'src', 'animeui');
+const animeUiOutputDir = path.join(repoRoot, 'dist', 'animeui');
 const scriptsOutputDir = path.join(repoRoot, 'dist', 'scripts');
 const macosHelperSourcePath = path.join(scriptDir, 'get-mpv-window-macos.swift');
 const macosHelperBinaryPath = path.join(scriptsOutputDir, 'get-mpv-window-macos');
@@ -25,9 +27,11 @@ function copyFile(sourcePath, outputPath) {
  fs.copyFileSync(sourcePath, outputPath);
 }

-function copyAssets(sourceDir, outputDir, label) {
+function copyAssets(sourceDir, outputDir, label, stylesheets = ['style.css']) {
  copyFile(path.join(sourceDir, 'index.html'), path.join(outputDir, 'index.html'));
-  copyFile(path.join(sourceDir, 'style.css'), path.join(outputDir, 'style.css'));
+  for (const stylesheet of stylesheets) {
+    copyFile(path.join(sourceDir, stylesheet), path.join(outputDir, stylesheet));
+  }
  fs.cpSync(path.join(rendererSourceDir, 'fonts'), path.join(outputDir, 'fonts'), {
    recursive: true,
    force: true,
@@ -47,6 +51,14 @@ function copySyncUiAssets() {
  copyAssets(syncUiSourceDir, syncUiOutputDir, 'syncui');
 }

+function copyAnimeUiAssets() {
+  copyAssets(animeUiSourceDir, animeUiOutputDir, 'animeui', [
+    'style.css',
+    'detail.css',
+    'panels.css',
+  ]);
+}
+
 function fallbackToMacosSource() {
  copyFile(macosHelperSourcePath, macosHelperSourceCopyPath);
  process.stdout.write(`Staged macOS helper source fallback: ${macosHelperSourceCopyPath}\n`);
@@ -90,6 +102,7 @@ function main() {
  copyRendererAssets();
  copySettingsAssets();
  copySyncUiAssets();
+  copyAnimeUiAssets();
  buildMacosHelper();
 }

@@ -1,5 +1,5 @@
 import assert from 'node:assert/strict';
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import test from 'node:test';

 const source = readFileSync('scripts/prepare-build-assets.mjs', 'utf8');
@@ -18,3 +18,19 @@ test('macOS helper build creates dist scripts directory before swiftc output', (
    'buildMacosHelper must create dist/scripts before swiftc writes the helper binary',
  );
 });
+
+test('anime UI stylesheet files exist and are all staged', () => {
+  const html = readFileSync('src/animeui/index.html', 'utf8');
+  const stylesheets = [...html.matchAll(/<link rel="stylesheet" href="\.\/(.+?\.css)"/g)].map(
+    (match) => match[1],
+  );
+
+  assert.deepEqual(stylesheets, ['style.css', 'detail.css', 'panels.css']);
+  for (const stylesheet of stylesheets) {
+    assert.equal(existsSync(`src/animeui/${stylesheet}`), true, `${stylesheet} must exist`);
+  }
+  assert.match(
+    source,
+    /copyAssets\(animeUiSourceDir, animeUiOutputDir, 'animeui', \[\s*'style\.css',\s*'detail\.css',\s*'panels\.css',?\s*\]\)/,
+  );
+});
@@ -0,0 +1,180 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { AnimeBridgeClient, BridgeExtensionError } from './bridge-client';
+import { BRIDGE_CONTEXT_KEY } from './types';
+
+const EXTENSION_ID = 'a'.repeat(64);
+const APK_BASE64 = 'QVBLLUJZVEVT';
+const source = {
+  fingerprint: 'sha-1',
+  loadApkBase64: async () => APK_BASE64,
+  sourceId: 'source-1',
+};
+
+interface Recorded {
+  url: string;
+  body: Record<string, unknown>;
+}
+
+function stubFetch(responder: (call: Recorded, index: number) => Response): {
+  fetchImpl: typeof fetch;
+  calls: Recorded[];
+} {
+  const calls: Recorded[] = [];
+  const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const call: Recorded = {
+      url: String(input),
+      body: init?.body ? (JSON.parse(String(init.body)) as Record<string, unknown>) : {},
+    };
+    calls.push(call);
+    return responder(call, calls.length - 1);
+  }) as typeof fetch;
+  return { fetchImpl, calls };
+}
+
+function jsonResponse(body: unknown, extensionId?: string): Response {
+  const headers = new Headers({ 'Content-Type': 'application/json' });
+  if (extensionId) headers.set('x-mangatan-extension-id', extensionId);
+  return new Response(JSON.stringify(body), { status: 200, headers });
+}
+
+test('isReady requires every capability the client depends on', async () => {
+  const ready = new AnimeBridgeClient({
+    baseUrl: 'http://127.0.0.1:9',
+    fetchImpl: stubFetch(() =>
+      jsonResponse({ mangatanMihonBridge: 1, sourceFactory: true, preferenceCallbacks: true }),
+    ).fetchImpl,
+  });
+  assert.equal(await ready.isReady(), true);
+
+  const partial = new AnimeBridgeClient({
+    baseUrl: 'http://127.0.0.1:9',
+    fetchImpl: stubFetch(() => jsonResponse({ mangatanMihonBridge: 1, sourceFactory: true }))
+      .fetchImpl,
+  });
+  assert.equal(await partial.isReady(), false);
+});
+
+test('isReady caps the probe at the deadline the caller passes', async () => {
+  // A bridge that accepts the socket and then stalls: only the abort ends it.
+  const fetchImpl = (async (_input: RequestInfo | URL, init?: RequestInit) => {
+    await new Promise((resolve) => init?.signal?.addEventListener('abort', resolve));
+    throw new Error('aborted');
+  }) as typeof fetch;
+  const client = new AnimeBridgeClient({ baseUrl: 'http://127.0.0.1:9', fetchImpl });
+
+  const started = Date.now();
+  assert.equal(await client.isReady(50), false);
+  // Well under the 5s default, so the per-call deadline is what applied.
+  assert.ok(Date.now() - started < 1000, 'probe outlived the caller deadline');
+});
+
+test('isReady reports false instead of throwing when the bridge is down', async () => {
+  const client = new AnimeBridgeClient({
+    baseUrl: 'http://127.0.0.1:9',
+    fetchImpl: (async () => {
+      throw new Error('ECONNREFUSED');
+    }) as typeof fetch,
+  });
+  assert.equal(await client.isReady(), false);
+});
+
+test('getVideoList posts the APK and episode url with a bridge context preference', async () => {
+  const { fetchImpl, calls } = stubFetch(() => jsonResponse([{ videoUrl: 'http://x/video/t' }]));
+  const client = new AnimeBridgeClient({ baseUrl: 'http://127.0.0.1:9/', fetchImpl });
+
+  const videos = await client.getVideoList(source, 'https://origin.example/ep/1');
+
+  assert.equal(calls[0]?.url, 'http://127.0.0.1:9/dalvik');
+  assert.equal(calls[0]?.body.method, 'getVideoList');
+  assert.deepEqual(calls[0]?.body.episodeData, { url: 'https://origin.example/ep/1' });
+  assert.equal(calls[0]?.body.data, APK_BASE64);
+  assert.deepEqual(calls[0]?.body.preferences, [{ key: BRIDGE_CONTEXT_KEY, sourceId: 'source-1' }]);
+  assert.equal(videos.length, 1);
+});
+
+test('a cached extension id replaces the APK upload on later calls', async () => {
+  const { fetchImpl, calls } = stubFetch(() => jsonResponse([], EXTENSION_ID));
+  const client = new AnimeBridgeClient({ baseUrl: 'http://127.0.0.1:9', fetchImpl });
+
+  await client.getVideoList(source, 'https://origin.example/ep/1');
+  await client.getVideoList(source, 'https://origin.example/ep/2');
+
+  assert.equal(calls[0]?.body.data, APK_BASE64);
+  assert.equal(calls[0]?.body.extensionId, undefined);
+  assert.equal(calls[1]?.body.data, undefined);
+  assert.equal(calls[1]?.body.extensionId, EXTENSION_ID);
+});
+
+test('an upgraded APK re-uploads instead of reusing the previous extension id', async () => {
+  const { fetchImpl, calls } = stubFetch(() => jsonResponse([], EXTENSION_ID));
+  const client = new AnimeBridgeClient({ baseUrl: 'http://127.0.0.1:9', fetchImpl });
+
+  await client.getVideoList(source, 'https://origin.example/ep/1');
+  // Same source id, new build in the same file: the id cache must miss.
+  const upgraded = { ...source, fingerprint: 'sha-2', loadApkBase64: async () => 'TkVXLUFQSw==' };
+  await client.getVideoList(upgraded, 'https://origin.example/ep/2');
+
+  assert.equal(calls[1]?.body.extensionId, undefined);
+  assert.equal(calls[1]?.body.data, 'TkVXLUFQSw==');
+});
+
+test('a 409 re-uploads the APK once and succeeds', async () => {
+  const { fetchImpl, calls } = stubFetch((call, index) => {
+    if (index === 0) return jsonResponse([], EXTENSION_ID);
+    // Cache evicted: reject the id-only call, accept the re-upload.
+    if (call.body.extensionId !== undefined) return new Response('', { status: 409 });
+    return jsonResponse([{ videoUrl: 'http://x/video/t' }], EXTENSION_ID);
+  });
+  const client = new AnimeBridgeClient({ baseUrl: 'http://127.0.0.1:9', fetchImpl });
+
+  await client.getVideoList(source, 'https://origin.example/ep/1');
+  const videos = await client.getVideoList(source, 'https://origin.example/ep/2');
+
+  assert.equal(calls.length, 3);
+  assert.equal(calls[1]?.body.extensionId, EXTENSION_ID);
+  assert.equal(calls[2]?.body.data, APK_BASE64);
+  assert.equal(videos.length, 1);
+});
+
+test('an error body on a 200 response raises BridgeExtensionError with the code', async () => {
+  const { fetchImpl } = stubFetch(() => jsonResponse({ error: 'Cloudflare challenge', code: 403 }));
+  const client = new AnimeBridgeClient({ baseUrl: 'http://127.0.0.1:9', fetchImpl });
+
+  await assert.rejects(
+    () => client.getVideoList(source, 'https://origin.example/ep/1'),
+    (error: unknown) => {
+      assert.ok(error instanceof BridgeExtensionError);
+      assert.equal(error.code, 403);
+      assert.match(error.message, /Cloudflare challenge/);
+      return true;
+    },
+  );
+});
+
+test('searchAnime sends a 1-based page and returns the page payload', async () => {
+  const { fetchImpl, calls } = stubFetch(() =>
+    jsonResponse({ animes: [{ title: 'Example' }], hasNextPage: true }),
+  );
+  const client = new AnimeBridgeClient({ baseUrl: 'http://127.0.0.1:9', fetchImpl });
+
+  const page = await client.searchAnime(source, 'example');
+
+  assert.equal(calls[0]?.body.method, 'getSearchAnime');
+  assert.equal(calls[0]?.body.page, 1);
+  assert.equal(calls[0]?.body.search, 'example');
+  assert.deepEqual(calls[0]?.body.filterList, []);
+  assert.equal(page.hasNextPage, true);
+  assert.equal(page.animes?.length, 1);
+});
+
+test('getEpisodeList wraps the anime url in animeData', async () => {
+  const { fetchImpl, calls } = stubFetch(() => jsonResponse([{ name: 'Episode 1', url: '/ep/1' }]));
+  const client = new AnimeBridgeClient({ baseUrl: 'http://127.0.0.1:9', fetchImpl });
+
+  const episodes = await client.getEpisodeList(source, 'https://origin.example/anime/1');
+
+  assert.equal(calls[0]?.body.method, 'getEpisodeList');
+  assert.deepEqual(calls[0]?.body.animeData, { url: 'https://origin.example/anime/1' });
+  assert.equal(episodes[0]?.name, 'Episode 1');
+});
@@ -0,0 +1,245 @@
+import { BRIDGE_CONTEXT_KEY } from './types';
+import type {
+  BridgeAnime,
+  BridgeAnimePage,
+  BridgeCapabilities,
+  BridgeEpisode,
+  BridgePreference,
+  BridgeSourceDescriptor,
+  BridgeVideo,
+} from './types';
+
+const EXTENSION_ID_HEADER = 'x-mangatan-extension-id';
+const EXTENSION_ID_PATTERN = /^[0-9a-f]{64}$/;
+
+export interface BridgeSource {
+  /**
+   * Identity of the APK's contents. Keys the extension-id cache, so an upgraded
+   * APK is re-uploaded instead of reusing the previous build's id.
+   */
+  fingerprint: string;
+  /**
+   * Reads and base64-encodes the APK. Called only when the bridge actually
+   * needs the bytes, so multi-megabyte payloads are not held on the heap.
+   */
+  loadApkBase64: () => Promise<string>;
+  /** Selects one source inside a multi-source (SourceFactory) APK. */
+  sourceId?: string;
+  preferences?: BridgePreference[];
+}
+
+export interface BridgeClientOptions {
+  /** Loopback base URL of the running bridge, e.g. `http://127.0.0.1:53112`. */
+  baseUrl: string;
+  fetchImpl?: typeof fetch;
+  /**
+   * Per-request deadline. Node's `fetch` has none, so a sidecar that accepts
+   * the socket and then stalls would leave every call pending forever.
+   */
+  requestTimeoutMs?: number;
+}
+
+/** Extension calls can be slow (a source may scrape several pages). */
+const DEFAULT_REQUEST_TIMEOUT_MS = 60_000;
+
+/** The readiness probe is a local health check; it should answer at once. */
+const CAPABILITIES_TIMEOUT_MS = 5_000;
+
+/** The bridge reports extension failures as HTTP 200 with an error body. */
+export class BridgeExtensionError extends Error {
+  readonly code?: number;
+  constructor(message: string, code?: number) {
+    super(message);
+    this.name = 'BridgeExtensionError';
+    this.code = code;
+  }
+}
+
+/**
+ * Client for the M-Extension-Server `/dalvik` RPC endpoint.
+ *
+ * The server caches uploaded APKs and returns a content hash, letting
+ * subsequent calls send that id instead of re-uploading megabytes of base64.
+ * A 409 means the cache was evicted, so the APK is resent once.
+ */
+export class AnimeBridgeClient {
+  private readonly baseUrl: string;
+  private readonly fetchImpl: typeof fetch;
+  private readonly requestTimeoutMs: number;
+  private readonly extensionIds = new Map<string, string>();
+
+  constructor(options: BridgeClientOptions) {
+    this.baseUrl = options.baseUrl.replace(/\/+$/, '');
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  }
+
+  /**
+   * `timeoutMs` lets a caller with its own deadline (the readiness loop) cap the
+   * probe below the default, so a short readiness budget is actually honored.
+   */
+  async getCapabilities(timeoutMs = CAPABILITIES_TIMEOUT_MS): Promise<BridgeCapabilities> {
+    const response = await this.fetchImpl(`${this.baseUrl}/capabilities`, {
+      signal: AbortSignal.timeout(Math.max(0, Math.min(timeoutMs, this.requestTimeoutMs))),
+    });
+    if (!response.ok) {
+      throw new Error(`Anime bridge capabilities check failed (${response.status}).`);
+    }
+    return (await response.json()) as BridgeCapabilities;
+  }
+
+  /** True once the bridge is up and reports the features this client needs. */
+  async isReady(timeoutMs?: number): Promise<boolean> {
+    try {
+      const capabilities = await this.getCapabilities(timeoutMs);
+      return (
+        capabilities.mangatanMihonBridge === 1 &&
+        capabilities.sourceFactory === true &&
+        capabilities.preferenceCallbacks === true
+      );
+    } catch {
+      return false;
+    }
+  }
+
+  async searchAnime(
+    source: BridgeSource,
+    query: string,
+    page = 1,
+    filterList: unknown[] = [],
+  ): Promise<BridgeAnimePage> {
+    return this.call<BridgeAnimePage>(source, 'getSearchAnime', {
+      page,
+      search: query,
+      filterList,
+    });
+  }
+
+  /**
+   * List the sources an extension APK provides. A single APK may expose many
+   * (a SourceFactory), so this is how a package becomes selectable entries.
+   */
+  async listAnimeSources(source: BridgeSource): Promise<BridgeSourceDescriptor[]> {
+    return this.call<BridgeSourceDescriptor[]>(source, 'sourcesAnime', {});
+  }
+
+  /** The extension's own settings schema, with current values. */
+  async getSourcePreferences(source: BridgeSource): Promise<BridgePreference[]> {
+    return this.call<BridgePreference[]>(source, 'preferencesAnime', {});
+  }
+
+  /**
+   * Commit a preference change. The whole array is sent back with the edited
+   * entry, and `changedPreferenceKey` tells the extension which one moved so it
+   * can react (the Jellyfin source logs in when the address or password lands).
+   * Returns the extension's refreshed schema.
+   */
+  async setSourcePreference(
+    source: BridgeSource,
+    changedPreferenceKey: string,
+  ): Promise<BridgePreference[]> {
+    return this.call<BridgePreference[]>(source, 'setPreferenceAnime', {}, changedPreferenceKey);
+  }
+
+  /** Full metadata for one anime: description, cover art, genres, status. */
+  async getAnimeDetails(source: BridgeSource, animeUrl: string): Promise<BridgeAnime> {
+    return this.call<BridgeAnime>(source, 'getDetailsAnime', {
+      animeData: { url: animeUrl },
+    });
+  }
+
+  async getPopularAnime(source: BridgeSource, page = 1): Promise<BridgeAnimePage> {
+    return this.call<BridgeAnimePage>(source, 'getPopularAnime', { page });
+  }
+
+  async getEpisodeList(source: BridgeSource, animeUrl: string): Promise<BridgeEpisode[]> {
+    return this.call<BridgeEpisode[]>(source, 'getEpisodeList', {
+      animeData: { url: animeUrl },
+    });
+  }
+
+  async getVideoList(source: BridgeSource, episodeUrl: string): Promise<BridgeVideo[]> {
+    return this.call<BridgeVideo[]>(source, 'getVideoList', {
+      episodeData: { url: episodeUrl },
+    });
+  }
+
+  private buildPreferences(
+    source: BridgeSource,
+    changedPreferenceKey?: string,
+  ): BridgePreference[] {
+    const context: BridgePreference = { key: BRIDGE_CONTEXT_KEY };
+    if (source.sourceId !== undefined) context.sourceId = source.sourceId;
+    if (changedPreferenceKey !== undefined) context.changedPreferenceKey = changedPreferenceKey;
+    return [...(source.preferences ?? []), context];
+  }
+
+  private async call<T>(
+    source: BridgeSource,
+    method: string,
+    extras: Record<string, unknown>,
+    changedPreferenceKey?: string,
+  ): Promise<T> {
+    // Keyed by APK contents, not by source id: an in-place upgrade keeps the
+    // same source id, and reusing its cached extension id would silently run
+    // the previous build (the bridge has no reason to answer 409).
+    const cacheKey = `${source.fingerprint}:${source.sourceId ?? ''}`;
+    const cachedId = this.extensionIds.get(cacheKey);
+
+    let response = await this.post(method, extras, source, cachedId, changedPreferenceKey);
+    if (response.status === 409 && cachedId !== undefined) {
+      // Server evicted the cached APK; upload it again.
+      this.extensionIds.delete(cacheKey);
+      response = await this.post(method, extras, source, undefined, changedPreferenceKey);
+    }
+
+    if (!response.ok) {
+      throw new Error(`Anime bridge ${method} failed (${response.status}).`);
+    }
+
+    const returnedId = response.headers.get(EXTENSION_ID_HEADER)?.trim();
+    if (returnedId && EXTENSION_ID_PATTERN.test(returnedId)) {
+      this.extensionIds.set(cacheKey, returnedId);
+    }
+
+    const body = (await response.json()) as T;
+    assertNoExtensionError(body, method);
+    return body;
+  }
+
+  private async post(
+    method: string,
+    extras: Record<string, unknown>,
+    source: BridgeSource,
+    extensionId: string | undefined,
+    changedPreferenceKey?: string,
+  ): Promise<Response> {
+    const payload: Record<string, unknown> = {
+      method,
+      ...extras,
+      preferences: this.buildPreferences(source, changedPreferenceKey),
+      ...(extensionId === undefined ? { data: await source.loadApkBase64() } : { extensionId }),
+    };
+
+    return this.fetchImpl(`${this.baseUrl}/dalvik`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json; charset=utf-8',
+        Accept: 'application/json',
+      },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(this.requestTimeoutMs),
+    });
+  }
+}
+
+function assertNoExtensionError(body: unknown, method: string): void {
+  if (body === null || typeof body !== 'object' || Array.isArray(body)) return;
+  const error = (body as { error?: unknown }).error;
+  if (typeof error !== 'string') return;
+  const code = (body as { code?: unknown }).code;
+  throw new BridgeExtensionError(
+    `Anime bridge ${method} failed: ${error}`,
+    typeof code === 'number' ? code : undefined,
+  );
+}
@@ -0,0 +1,140 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  buildAnimeStreamMetadata,
+  buildAnimeStreamStatsPath,
+  buildStreamDisplayTitle,
+  splitEpisodeLabel,
+  splitSeasonFromTitle,
+} from './episode-metadata';
+
+test('splitSeasonFromTitle pulls a trailing season marker off the title', () => {
+  assert.deepEqual(splitSeasonFromTitle('Mushoku Tensei: Jobless Reincarnation Season 3'), {
+    title: 'Mushoku Tensei: Jobless Reincarnation',
+    season: 3,
+  });
+  assert.deepEqual(splitSeasonFromTitle('Spy x Family 2nd Season'), {
+    title: 'Spy x Family',
+    season: 2,
+  });
+  assert.deepEqual(splitSeasonFromTitle('Bocchi the Rock! S2'), {
+    title: 'Bocchi the Rock!',
+    season: 2,
+  });
+  assert.deepEqual(splitSeasonFromTitle('シャングリラ・フロンティア 第2期'), {
+    title: 'シャングリラ・フロンティア',
+    season: 2,
+  });
+});
+
+test('splitSeasonFromTitle leaves a title without a trailing marker alone', () => {
+  assert.deepEqual(splitSeasonFromTitle('My Teen Romantic Comedy SNAFU Climax!'), {
+    title: 'My Teen Romantic Comedy SNAFU Climax!',
+    season: null,
+  });
+  // "Season" inside the name is not a season marker.
+  assert.deepEqual(splitSeasonFromTitle('A Season of Snow and Ash'), {
+    title: 'A Season of Snow and Ash',
+    season: null,
+  });
+  // Nothing would be left of the title, so the marker is not a marker.
+  assert.deepEqual(splitSeasonFromTitle('Season 2'), { title: 'Season 2', season: null });
+});
+
+test('splitEpisodeLabel reads the number and the episode name', () => {
+  assert.deepEqual(splitEpisodeLabel('Episode 4'), { number: 4, title: null });
+  assert.deepEqual(splitEpisodeLabel('Episode 10: Gallantly, Shizuka Hiratsuka Moves Forward.'), {
+    number: 10,
+    title: 'Gallantly, Shizuka Hiratsuka Moves Forward.',
+  });
+  assert.deepEqual(splitEpisodeLabel('Ep. 7 - The Long Road'), {
+    number: 7,
+    title: 'The Long Road',
+  });
+  assert.deepEqual(splitEpisodeLabel('第12話 決戦'), { number: 12, title: '決戦' });
+  assert.deepEqual(splitEpisodeLabel('5. Homecoming'), { number: 5, title: 'Homecoming' });
+  assert.deepEqual(splitEpisodeLabel('13'), { number: 13, title: null });
+  assert.deepEqual(splitEpisodeLabel('Episode 6.5'), { number: 6.5, title: null });
+});
+
+test('splitEpisodeLabel keeps a label that carries no number as a name', () => {
+  assert.deepEqual(splitEpisodeLabel('Movie'), { number: null, title: 'Movie' });
+  assert.deepEqual(splitEpisodeLabel('OVA - Beach Episode'), {
+    number: null,
+    title: 'OVA - Beach Episode',
+  });
+  assert.deepEqual(splitEpisodeLabel(''), { number: null, title: null });
+});
+
+test('buildStreamDisplayTitle emits a form guessit and the jimaku parser both read', () => {
+  assert.equal(
+    buildStreamDisplayTitle('Mushoku Tensei: Jobless Reincarnation', 3, 4, null),
+    'Mushoku Tensei: Jobless Reincarnation S03E04',
+  );
+  assert.equal(
+    buildStreamDisplayTitle('My Teen Romantic Comedy SNAFU Climax!', null, 10, 'Gallantly'),
+    'My Teen Romantic Comedy SNAFU Climax! E10 - Gallantly',
+  );
+  assert.equal(buildStreamDisplayTitle('Some Movie', null, null, null), 'Some Movie');
+});
+
+test('buildAnimeStreamStatsPath is stable across playbacks of the same episode', () => {
+  const first = buildAnimeStreamStatsPath('9001', '/anime/mushoku', '/watch/ep-4');
+  const second = buildAnimeStreamStatsPath('9001', '/anime/mushoku', '/watch/ep-4');
+  assert.equal(first, second);
+  assert.notEqual(first, buildAnimeStreamStatsPath('9001', '/anime/mushoku', '/watch/ep-5'));
+  assert.match(first, /^animebrowser:\/\//);
+});
+
+test('buildAnimeStreamMetadata resolves the browser strings into fields', () => {
+  const metadata = buildAnimeStreamMetadata({
+    sourceId: '9001',
+    animeUrl: '/anime/mushoku',
+    animeTitle: 'Mushoku Tensei: Jobless Reincarnation Season 3',
+    episodeUrl: '/watch/ep-4',
+    episodeName: 'Episode 4',
+    episodeNumber: 4,
+    mediaPath: 'http://127.0.0.1:41234/video/abc123.m3u8',
+  });
+
+  assert.equal(metadata.seriesTitle, 'Mushoku Tensei: Jobless Reincarnation');
+  assert.equal(metadata.seasonNumber, 3);
+  assert.equal(metadata.episodeNumber, 4);
+  assert.equal(metadata.episodeTitle, null);
+  assert.equal(metadata.displayTitle, 'Mushoku Tensei: Jobless Reincarnation S03E04');
+  assert.equal(metadata.mediaPath, 'http://127.0.0.1:41234/video/abc123.m3u8');
+  assert.equal(
+    metadata.statsPath,
+    buildAnimeStreamStatsPath('9001', '/anime/mushoku', '/watch/ep-4'),
+  );
+});
+
+test('buildAnimeStreamMetadata prefers the extension episode number over the label', () => {
+  const metadata = buildAnimeStreamMetadata({
+    sourceId: '1',
+    animeUrl: '/a',
+    animeTitle: 'Show',
+    episodeUrl: '/e',
+    episodeName: 'Finale',
+    episodeNumber: 24,
+    mediaPath: 'http://host/x.m3u8',
+  });
+  assert.equal(metadata.episodeNumber, 24);
+  assert.equal(metadata.episodeTitle, 'Finale');
+  assert.equal(metadata.displayTitle, 'Show E24 - Finale');
+});
+
+test('buildAnimeStreamMetadata falls back to the label when the source reports no number', () => {
+  const metadata = buildAnimeStreamMetadata({
+    sourceId: '1',
+    animeUrl: '/a',
+    animeTitle: 'Show 2nd Season',
+    episodeUrl: '/e',
+    episodeName: 'Episode 3: Rain',
+    episodeNumber: null,
+    mediaPath: 'http://host/x.m3u8',
+  });
+  assert.equal(metadata.seasonNumber, 2);
+  assert.equal(metadata.episodeNumber, 3);
+  assert.equal(metadata.displayTitle, 'Show S02E03 - Rain');
+});
@@ -0,0 +1,205 @@
+/**
+ * Structured metadata for a streamed episode.
+ *
+ * Extensions hand us two free-form strings — an anime title that usually
+ * carries the season ("… Season 3") and an episode label that usually carries
+ * the number ("Episode 4: …"). Everything downstream (stats grouping, AniList,
+ * the subtitle modals) wants those as separate fields, so they are split once
+ * here rather than re-parsed out of the mpv title by each consumer.
+ */
+
+/** Where a stream came from, resolved into the fields consumers actually want. */
+export interface AnimeStreamMetadata {
+  /** The URL handed to mpv. Matches what mpv reports as `path`. */
+  mediaPath: string;
+  /**
+   * Stable identity for this episode. The stream URL carries a per-playback
+   * proxy port and token, so it cannot be the key stats stores.
+   */
+  statsPath: string;
+  /** Series name with the season suffix removed. */
+  seriesTitle: string;
+  seasonNumber: number | null;
+  episodeNumber: number | null;
+  /** The episode's own name, or null when the label was only a number. */
+  episodeTitle: string | null;
+  /** Shown by mpv, and the fallback every string parser sees. */
+  displayTitle: string;
+}
+
+export interface AnimeStreamMetadataInput {
+  sourceId: string;
+  animeUrl: string;
+  animeTitle: string;
+  episodeUrl: string;
+  episodeName: string;
+  /** Extension-reported number; trusted over anything parsed from the label. */
+  episodeNumber: number | null;
+  /** The URL playback actually uses, after proxy rewriting. */
+  mediaPath: string;
+}
+
+/**
+ * Season suffixes, anchored to the end of the title so a "Season" that is part
+ * of the name ("A Season of Snow") cannot be mistaken for one.
+ */
+const SEASON_SUFFIX_PATTERNS: RegExp[] = [
+  /[\s:_-]+season\s*(\d{1,2})\s*$/i,
+  /[\s:_-]+(\d{1,2})(?:st|nd|rd|th)\s+season\s*$/i,
+  /[\s:_-]+s(\d{1,2})\s*$/i,
+  /[\s:_-]*第\s*(\d{1,2})\s*期\s*$/,
+  /[\s:_-]+(\d{1,2})\s*期\s*$/,
+];
+
+/**
+ * Episode labels, most specific first. The trailing group is the episode's own
+ * name when the label carries one.
+ */
+const EPISODE_LABEL_PATTERNS: RegExp[] = [
+  /^\s*(?:episodio|épisode|episode|ep|e)\s*[.#]?\s*(\d{1,4}(?:\.\d+)?)\s*(?:[:\-–—.)]+\s*(.*))?$/i,
+  /^\s*第\s*(\d{1,4})\s*話\s*(?:[:\-–—]+\s*)?(.*)$/,
+  /^\s*(\d{1,4}(?:\.\d+)?)\s*[:\-–—.)]+\s*(.*)$/,
+  /^\s*(\d{1,4}(?:\.\d+)?)\s*$/,
+];
+
+function collapseWhitespace(value: string): string {
+  return value.replace(/\s+/g, ' ').trim();
+}
+
+/**
+ * Trims separators a split left dangling on either end. `.` is deliberately not
+ * one of them: an episode name often ends in a full stop that belongs to it.
+ */
+function trimSeparators(value: string): string {
+  return collapseWhitespace(value)
+    .replace(/^[\s:_\-–—]+/, '')
+    .replace(/[\s:_\-–—]+$/, '')
+    .trim();
+}
+
+function toEpisodeNumber(value: unknown): number | null {
+  if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0) return null;
+  return value;
+}
+
+/**
+ * Split a trailing season marker off an anime title.
+ *
+ * "Mushoku Tensei: Jobless Reincarnation Season 3" becomes the series plus
+ * season 3, which is what both AniList and the stats grouping key want. A title
+ * with no marker is returned unchanged with a null season — season 1 is *not*
+ * assumed, because "unknown" and "one" behave differently when grouping.
+ */
+export function splitSeasonFromTitle(animeTitle: string): {
+  title: string;
+  season: number | null;
+} {
+  const normalized = collapseWhitespace(animeTitle);
+  for (const pattern of SEASON_SUFFIX_PATTERNS) {
+    const match = normalized.match(pattern);
+    if (!match || match.index === undefined) continue;
+    const season = Number.parseInt(match[1]!, 10);
+    if (!Number.isInteger(season) || season <= 0) continue;
+    const title = trimSeparators(normalized.slice(0, match.index));
+    // A title that is *only* a season marker is not a title; keep the original.
+    if (!title) continue;
+    return { title, season };
+  }
+  return { title: normalized, season: null };
+}
+
+/**
+ * Split an episode label into its number and its own name.
+ *
+ * Sources are inconsistent here: "Episode 4", "4. Title", "第4話 タイトル" and a
+ * bare "4" all show up. A label that matches nothing is treated as a pure
+ * episode name, which is right for movies and specials.
+ */
+export function splitEpisodeLabel(episodeName: string): {
+  number: number | null;
+  title: string | null;
+} {
+  const normalized = collapseWhitespace(episodeName);
+  if (!normalized) return { number: null, title: null };
+
+  for (const pattern of EPISODE_LABEL_PATTERNS) {
+    const match = normalized.match(pattern);
+    if (!match) continue;
+    const parsed = Number.parseFloat(match[1]!);
+    if (!Number.isFinite(parsed) || parsed <= 0) continue;
+    const title = trimSeparators(match[2] ?? '');
+    return { number: parsed, title: title || null };
+  }
+
+  return { number: null, title: normalized };
+}
+
+function formatEpisodePart(value: number): string {
+  return Number.isInteger(value) ? String(value).padStart(2, '0') : String(value);
+}
+
+/**
+ * The title mpv shows.
+ *
+ * `SxxEyy` is not just for looks: it is the one form both guessit and
+ * SubMiner's own filename parser read reliably, so any consumer that only ever
+ * sees the title string still lands on the right series and episode.
+ */
+export function buildStreamDisplayTitle(
+  seriesTitle: string,
+  season: number | null,
+  episode: number | null,
+  episodeTitle: string | null,
+): string {
+  const parts: string[] = [seriesTitle];
+  if (episode !== null) {
+    parts.push(
+      season !== null
+        ? `S${String(season).padStart(2, '0')}E${formatEpisodePart(episode)}`
+        : `E${formatEpisodePart(episode)}`,
+    );
+  } else if (season !== null) {
+    parts.push(`S${String(season).padStart(2, '0')}`);
+  }
+
+  const head = parts.join(' ');
+  return episodeTitle ? `${head} - ${episodeTitle}` : head;
+}
+
+/**
+ * A per-episode identity that survives across playbacks.
+ *
+ * The stream URL points at the strip proxy, whose port and token are minted per
+ * playback, so keying stats on it makes every rewatch a new video. The source's
+ * own episode url is stable, so that is what stats records instead — with the
+ * real URL kept as an alias so mpv's path change still finds the row.
+ */
+export function buildAnimeStreamStatsPath(
+  sourceId: string,
+  animeUrl: string,
+  episodeUrl: string,
+): string {
+  const source = encodeURIComponent(sourceId || 'unknown');
+  const anime = encodeURIComponent(animeUrl || 'unknown');
+  const episode = encodeURIComponent(episodeUrl || 'unknown');
+  return `animebrowser://${source}/${anime}/${episode}`;
+}
+
+export function buildAnimeStreamMetadata(input: AnimeStreamMetadataInput): AnimeStreamMetadata {
+  const { title: seriesTitle, season } = splitSeasonFromTitle(input.animeTitle);
+  const label = splitEpisodeLabel(input.episodeName);
+  const episodeNumber = toEpisodeNumber(input.episodeNumber) ?? label.number;
+  const displayTitle = buildStreamDisplayTitle(seriesTitle, season, episodeNumber, label.title);
+
+  return {
+    mediaPath: input.mediaPath,
+    statsPath: buildAnimeStreamStatsPath(input.sourceId, input.animeUrl, input.episodeUrl),
+    seriesTitle,
+    seasonNumber: season,
+    episodeNumber,
+    episodeTitle: label.title,
+    // A source that gave us neither a number nor a name leaves the series title
+    // alone rather than showing an empty suffix.
+    displayTitle: displayTitle || collapseWhitespace(input.animeTitle),
+  };
+}
@@ -0,0 +1,250 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdir, mkdtemp, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { installExtension, looksLikeApk, removeExtension } from './extension-installer';
+import type { RepoExtension } from './extension-repo';
+
+const PKG = 'eu.kanade.tachiyomi.animeextension.all.example';
+
+function apkBytes(payload = 'APK-BODY'): Uint8Array {
+  // APKs are zip archives, so they start with the PK local-file-header magic.
+  return new Uint8Array([0x50, 0x4b, 0x03, 0x04, ...new TextEncoder().encode(payload)]);
+}
+
+function repoExtension(overrides: Partial<RepoExtension> = {}): RepoExtension {
+  return {
+    pkg: PKG,
+    name: 'Example Source',
+    lang: 'all',
+    version: '1.2.3',
+    versionCode: 12,
+    nsfw: false,
+    apkUrl: 'https://repo.example/anime/apk/example.apk',
+    iconUrl: 'https://repo.example/anime/icon/example.png',
+    repoUrl: 'https://repo.example/anime/index.min.json',
+    sourceNames: ['Example'],
+    ...overrides,
+  };
+}
+
+function respondWith(bytes: Uint8Array, headers: Record<string, string> = {}): typeof fetch {
+  // Uint8Array is a valid Response body at runtime; the DOM lib types disagree.
+  const body = bytes as unknown as BodyInit;
+  return (async () => new Response(body, { status: 200, headers })) as typeof fetch;
+}
+
+test('looksLikeApk accepts the zip magic and rejects anything else', () => {
+  assert.equal(looksLikeApk(apkBytes()), true);
+  assert.equal(looksLikeApk(new TextEncoder().encode('<!DOCTYPE html>')), false);
+  assert.equal(looksLikeApk(new Uint8Array([])), false);
+});
+
+test('installExtension writes the apk named after its package', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'subminer-install-'));
+  const target = await installExtension({
+    extensionsDir: dir,
+    extension: repoExtension(),
+    fetchImpl: respondWith(apkBytes()),
+  });
+
+  assert.equal(target, path.join(dir, `${PKG}.apk`));
+  assert.match((await readFile(target)).toString(), /APK-BODY/);
+});
+
+test('installing again replaces the previous version in place', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'subminer-install-'));
+  await installExtension({
+    extensionsDir: dir,
+    extension: repoExtension(),
+    fetchImpl: respondWith(apkBytes('OLD')),
+  });
+  await installExtension({
+    extensionsDir: dir,
+    extension: repoExtension({ version: '2.0.0', versionCode: 20 }),
+    fetchImpl: respondWith(apkBytes('NEW')),
+  });
+
+  const contents = (await readFile(path.join(dir, `${PKG}.apk`))).toString();
+  assert.match(contents, /NEW/);
+  assert.doesNotMatch(contents, /OLD/);
+});
+
+test('the extensions directory is created when missing', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'subminer-install-'));
+  const nested = path.join(root, 'does', 'not', 'exist');
+  await installExtension({
+    extensionsDir: nested,
+    extension: repoExtension(),
+    fetchImpl: respondWith(apkBytes()),
+  });
+  assert.equal(existsSync(path.join(nested, `${PKG}.apk`)), true);
+});
+
+test('a non-ok response is reported with the extension name', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'subminer-install-'));
+  const fetchImpl = (async () => new Response('', { status: 404 })) as typeof fetch;
+
+  await assert.rejects(
+    () => installExtension({ extensionsDir: dir, extension: repoExtension(), fetchImpl }),
+    /Example Source.*404/,
+  );
+});
+
+test('a response that is not an apk is rejected rather than written', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'subminer-install-'));
+  // A misconfigured repo commonly serves an HTML error page instead.
+  const fetchImpl = respondWith(new TextEncoder().encode('<!DOCTYPE html><html>404</html>'));
+
+  await assert.rejects(
+    () => installExtension({ extensionsDir: dir, extension: repoExtension(), fetchImpl }),
+    /did not download as an APK/,
+  );
+  assert.equal(existsSync(path.join(dir, `${PKG}.apk`)), false);
+});
+
+test('an oversized download is refused by the declared length', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'subminer-install-'));
+  const fetchImpl = respondWith(apkBytes(), { 'content-length': '999999999' });
+
+  await assert.rejects(
+    () =>
+      installExtension({
+        extensionsDir: dir,
+        extension: repoExtension(),
+        fetchImpl,
+        maxBytes: 1024,
+      }),
+    /larger than the 1024 byte limit/,
+  );
+});
+
+test('an oversized download is refused even when the length header lies', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'subminer-install-'));
+  const fetchImpl = respondWith(apkBytes('x'.repeat(4096)), { 'content-length': '10' });
+
+  await assert.rejects(
+    () =>
+      installExtension({
+        extensionsDir: dir,
+        extension: repoExtension(),
+        fetchImpl,
+        maxBytes: 1024,
+      }),
+    /larger than the 1024 byte limit/,
+  );
+  assert.equal(existsSync(path.join(dir, `${PKG}.apk`)), false);
+});
+
+test('the byte limit stops the read instead of buffering the whole body', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'subminer-install-'));
+  let pushed = 0;
+  // Endless body: if the limit were only checked after buffering, this hangs.
+  const body = new ReadableStream<Uint8Array>({
+    pull(controller) {
+      pushed += 1;
+      controller.enqueue(new Uint8Array(512));
+    },
+  });
+  const fetchImpl = (async () => new Response(body, { status: 200 })) as typeof fetch;
+
+  await assert.rejects(
+    () =>
+      installExtension({
+        extensionsDir: dir,
+        extension: repoExtension(),
+        fetchImpl,
+        maxBytes: 1024,
+      }),
+    /larger than the 1024 byte limit/,
+  );
+  // Only enough chunks to cross the limit were ever read.
+  assert.ok(pushed <= 4, `read ${pushed} chunks before aborting`);
+});
+
+test('a failed reader cancellation does not hide the size-limit error', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'subminer-install-'));
+  let cancellationAttempted = false;
+  const body = new ReadableStream<Uint8Array>({
+    pull(controller) {
+      controller.enqueue(new Uint8Array(1025));
+    },
+    async cancel() {
+      cancellationAttempted = true;
+      throw new Error('cancel failed');
+    },
+  });
+  const fetchImpl = (async () => new Response(body, { status: 200 })) as typeof fetch;
+
+  await assert.rejects(
+    () =>
+      installExtension({
+        extensionsDir: dir,
+        extension: repoExtension(),
+        fetchImpl,
+        maxBytes: 1024,
+      }),
+    /larger than the 1024 byte limit/,
+  );
+  assert.ok(cancellationAttempted, 'the reader was never cancelled');
+});
+
+test('a failed staged write preserves the installed apk and removes the partial file', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'subminer-install-'));
+  const target = path.join(dir, `${PKG}.apk`);
+  await writeFile(target, apkBytes('OLD'));
+  let stagedPath = '';
+
+  await assert.rejects(
+    () =>
+      installExtension({
+        extensionsDir: dir,
+        extension: repoExtension({ version: '2.0.0', versionCode: 20 }),
+        fetchImpl: respondWith(apkBytes('NEW')),
+        fileIo: {
+          mkdir: (dirPath) => mkdir(dirPath, { recursive: true }),
+          async writeFile(filePath, bytes) {
+            stagedPath = filePath;
+            await writeFile(filePath, bytes.subarray(0, 5));
+            throw new Error('simulated disk write failure');
+          },
+          rename,
+          removeFile: (filePath) => rm(filePath, { force: true }),
+        },
+      }),
+    /simulated disk write failure/,
+  );
+
+  assert.match((await readFile(target)).toString(), /OLD/);
+  assert.notEqual(stagedPath, target);
+  assert.equal(existsSync(stagedPath), false);
+});
+
+test('a package name carrying path separators cannot escape the extensions dir', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'subminer-install-'));
+  const dir = path.join(root, 'extensions');
+  const escaping = `eu.kanade.tachiyomi.animeextension${path.sep}..${path.sep}..${path.sep}pwned`;
+
+  await assert.rejects(
+    () =>
+      installExtension({
+        extensionsDir: dir,
+        extension: repoExtension({ pkg: escaping }),
+        fetchImpl: respondWith(apkBytes()),
+      }),
+    /not a valid file name/,
+  );
+  assert.equal(existsSync(path.join(root, 'pwned.apk')), false);
+});
+
+test('removeExtension deletes the file and tolerates a missing one', async () => {
+  const dir = await mkdtemp(path.join(tmpdir(), 'subminer-install-'));
+  const file = path.join(dir, `${PKG}.apk`);
+  await writeFile(file, 'x');
+
+  await removeExtension(dir, PKG);
+  assert.equal(existsSync(file), false);
+  await removeExtension(dir, PKG);
+});
@@ -0,0 +1,155 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, rename, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { extensionFileName, type RepoExtension } from './extension-repo';
+
+/**
+ * Downloads extension APKs into the extensions directory.
+ *
+ * Only URLs that came from a repository index the user configured are ever
+ * fetched; nothing here discovers or suggests sources.
+ */
+
+export interface InstallExtensionOptions {
+  extensionsDir: string;
+  extension: RepoExtension;
+  fetchImpl?: typeof fetch;
+  /** Guards against a mistyped repo serving something enormous. */
+  maxBytes?: number;
+  /** Cancels a stalled download; without it a hung repo blocks the install. */
+  signal?: AbortSignal;
+  /** Applied when no `signal` is given, so a download can never hang forever. */
+  timeoutMs?: number;
+  /** Injectable filesystem boundary for failure-path tests. */
+  fileIo?: ExtensionInstallerFileIo;
+}
+
+export interface ExtensionInstallerFileIo {
+  mkdir: (dir: string) => Promise<unknown>;
+  writeFile: (filePath: string, bytes: Uint8Array) => Promise<void>;
+  rename: (from: string, to: string) => Promise<void>;
+  removeFile: (filePath: string) => Promise<void>;
+}
+
+const DEFAULT_FILE_IO: ExtensionInstallerFileIo = {
+  mkdir: (dir) => mkdir(dir, { recursive: true }),
+  writeFile: (filePath, bytes) => writeFile(filePath, bytes),
+  rename,
+  removeFile: (filePath) => rm(filePath, { force: true }),
+};
+
+/** APKs are a few MB; anything far past that is not an extension. */
+const DEFAULT_MAX_BYTES = 64 * 1024 * 1024;
+
+/** Generous enough for a large APK on a slow link, short of hanging forever. */
+const DEFAULT_TIMEOUT_MS = 120_000;
+
+const APK_MAGIC = [0x50, 0x4b, 0x03, 0x04]; // "PK\x03\x04" — APKs are zip archives.
+
+export function looksLikeApk(bytes: Uint8Array): boolean {
+  return APK_MAGIC.every((byte, index) => bytes[index] === byte);
+}
+
+/**
+ * Download one extension into `extensionsDir`, replacing any previous version.
+ *
+ * The file is named after the package so an update overwrites in place rather
+ * than leaving two versions for the bridge to load.
+ */
+export async function installExtension(options: InstallExtensionOptions): Promise<string> {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const fileIo = options.fileIo ?? DEFAULT_FILE_IO;
+  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
+  const signal = options.signal ?? AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+
+  const response = await fetchImpl(options.extension.apkUrl, { signal });
+  if (!response.ok) {
+    throw new Error(`Downloading ${options.extension.name} failed (${response.status}).`);
+  }
+
+  const declared = Number(response.headers.get('content-length') ?? '0');
+  if (declared > maxBytes) {
+    throw new Error(`${options.extension.name} is larger than the ${maxBytes} byte limit.`);
+  }
+
+  const bytes = await readBounded(response, maxBytes, options.extension.name);
+  if (!looksLikeApk(bytes)) {
+    throw new Error(`${options.extension.name} did not download as an APK.`);
+  }
+
+  await fileIo.mkdir(options.extensionsDir);
+  const target = resolveTarget(options.extensionsDir, options.extension.pkg);
+  const staged = `${target}.${randomUUID()}.tmp`;
+  try {
+    await fileIo.writeFile(staged, bytes);
+    await fileIo.rename(staged, target);
+  } finally {
+    try {
+      await fileIo.removeFile(staged);
+    } catch {}
+  }
+  return target;
+}
+
+/**
+ * Read the body incrementally and stop the moment the limit is passed.
+ *
+ * Buffering first and measuring afterwards would let a repo that lies about
+ * (or omits) `content-length` push an unbounded amount into memory before the
+ * check ever runs.
+ */
+async function readBounded(
+  response: Response,
+  maxBytes: number,
+  name: string,
+): Promise<Uint8Array> {
+  const reader = response.body?.getReader();
+  if (!reader) {
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (bytes.byteLength > maxBytes) {
+      throw new Error(`${name} is larger than the ${maxBytes} byte limit.`);
+    }
+    return bytes;
+  }
+
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      try {
+        await reader.cancel();
+      } catch {}
+      throw new Error(`${name} is larger than the ${maxBytes} byte limit.`);
+    }
+    chunks.push(value);
+  }
+
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
+
+/**
+ * Defence in depth against a repository index that smuggles path separators
+ * into a package name: the write target must stay inside `extensionsDir`.
+ */
+function resolveTarget(extensionsDir: string, pkg: string): string {
+  const root = path.resolve(extensionsDir);
+  const target = path.resolve(root, extensionFileName(pkg));
+  if (path.dirname(target) !== root) {
+    throw new Error(`Refusing to install ${pkg}: the package name is not a valid file name.`);
+  }
+  return target;
+}
+
+/** Delete an installed extension. Missing files are treated as already gone. */
+export async function removeExtension(extensionsDir: string, pkg: string): Promise<void> {
+  await rm(resolveTarget(extensionsDir, pkg), { force: true });
+}
@@ -0,0 +1,209 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  extensionFileName,
+  fetchRepoCatalogue,
+  fetchRepoIndex,
+  isValidRepoUrl,
+  parseRepoIndex,
+  repoBaseUrl,
+} from './extension-repo';
+
+const INDEX = 'https://repo.example/anime/index.min.json';
+
+function animeEntry(overrides: Record<string, unknown> = {}): Record<string, unknown> {
+  return {
+    name: 'Aniyomi: Example Source',
+    pkg: 'eu.kanade.tachiyomi.animeextension.all.example',
+    apk: 'example-v1.2.3.apk',
+    lang: 'all',
+    code: 12,
+    version: '1.2.3',
+    nsfw: 0,
+    sources: [{ name: 'Example', lang: 'en' }],
+    ...overrides,
+  };
+}
+
+test('any https url naming a json index is accepted', () => {
+  assert.equal(isValidRepoUrl(INDEX), true);
+  assert.equal(isValidRepoUrl('  ' + INDEX + '  '), true);
+  // Repos are free to name the index; index.min.json is only a convention.
+  assert.equal(isValidRepoUrl('https://repo.example/anime/index.json'), true);
+  assert.equal(
+    isValidRepoUrl('https://manatan-community.github.io/extensions/video.min.json'),
+    true,
+  );
+  // Plain http would let a network attacker swap the APK list.
+  assert.equal(isValidRepoUrl('http://repo.example/anime/index.min.json'), false);
+  assert.equal(isValidRepoUrl('https://repo.example/anime/'), false);
+  assert.equal(isValidRepoUrl('https://repo.example/index.min.json.txt'), false);
+  assert.equal(isValidRepoUrl('https://repo.example'), false);
+  assert.equal(isValidRepoUrl(''), false);
+});
+
+test('repoBaseUrl strips the index file name', () => {
+  assert.equal(repoBaseUrl(INDEX), 'https://repo.example/anime');
+  assert.equal(
+    repoBaseUrl('https://manatan-community.github.io/extensions/video.min.json'),
+    'https://manatan-community.github.io/extensions',
+  );
+});
+
+test('parseRepoIndex builds apk and icon urls from the repo root', () => {
+  const [extension] = parseRepoIndex(INDEX, [animeEntry()]);
+
+  assert.equal(extension?.pkg, 'eu.kanade.tachiyomi.animeextension.all.example');
+  assert.equal(extension?.apkUrl, 'https://repo.example/anime/apk/example-v1.2.3.apk');
+  assert.equal(
+    extension?.iconUrl,
+    'https://repo.example/anime/icon/eu.kanade.tachiyomi.animeextension.all.example.png',
+  );
+  assert.equal(extension?.repoUrl, INDEX);
+  assert.equal(extension?.versionCode, 12);
+  assert.deepEqual(extension?.sourceNames, ['Example']);
+});
+
+test('the Aniyomi name prefix is stripped', () => {
+  const [extension] = parseRepoIndex(INDEX, [animeEntry()]);
+  assert.equal(extension?.name, 'Example Source');
+});
+
+test('manga packages are excluded', () => {
+  const entries = [animeEntry(), animeEntry({ pkg: 'eu.kanade.tachiyomi.extension.en.somemanga' })];
+  const parsed = parseRepoIndex(INDEX, entries);
+  assert.equal(parsed.length, 1);
+  assert.match(parsed[0]!.pkg, /animeextension/);
+});
+
+test('malformed entries are skipped rather than failing the repo', () => {
+  const parsed = parseRepoIndex(INDEX, [
+    null,
+    'nonsense',
+    animeEntry({ apk: undefined }),
+    animeEntry({ pkg: undefined }),
+    animeEntry(),
+  ]);
+  assert.equal(parsed.length, 1);
+});
+
+test('a package name that is not a plain identifier is rejected', () => {
+  // The package name becomes the on-disk file name, and a repo index is
+  // unauthenticated: path separators here would write outside the extensions
+  // directory even though the prefix check passes.
+  const parsed = parseRepoIndex(INDEX, [
+    animeEntry({ pkg: 'eu.kanade.tachiyomi.animeextension/../../../../etc/cron.d/x' }),
+    animeEntry({ pkg: 'eu.kanade.tachiyomi.animeextension\\..\\evil' }),
+    animeEntry({ pkg: 'eu.kanade.tachiyomi.animeextension.all.ok' }),
+  ]);
+  assert.deepEqual(
+    parsed.map((extension) => extension.pkg),
+    ['eu.kanade.tachiyomi.animeextension.all.ok'],
+  );
+});
+
+test('an apk file name with path characters is rejected', () => {
+  const parsed = parseRepoIndex(INDEX, [animeEntry({ apk: '../../../etc/passwd' })]);
+  assert.deepEqual(parsed, []);
+});
+
+test('parseRepoIndex tolerates a non-array payload', () => {
+  assert.deepEqual(parseRepoIndex(INDEX, { message: 'Not Found' }), []);
+  assert.deepEqual(parseRepoIndex(INDEX, null), []);
+});
+
+test('missing optional fields fall back to safe defaults', () => {
+  const [extension] = parseRepoIndex(INDEX, [
+    { pkg: 'eu.kanade.tachiyomi.animeextension.all.bare', apk: 'bare.apk' },
+  ]);
+  assert.equal(extension?.name, 'eu.kanade.tachiyomi.animeextension.all.bare');
+  assert.equal(extension?.lang, 'all');
+  assert.equal(extension?.versionCode, 0);
+  assert.equal(extension?.nsfw, false);
+  assert.deepEqual(extension?.sourceNames, []);
+});
+
+test('nsfw is read from the numeric flag', () => {
+  assert.equal(parseRepoIndex(INDEX, [animeEntry({ nsfw: 1 })])[0]?.nsfw, true);
+  assert.equal(parseRepoIndex(INDEX, [animeEntry({ nsfw: 0 })])[0]?.nsfw, false);
+});
+
+test('fetchRepoIndex rejects an invalid url before making a request', async () => {
+  let called = false;
+  const fetchImpl = (async () => {
+    called = true;
+    return new Response('[]');
+  }) as typeof fetch;
+
+  await assert.rejects(() => fetchRepoIndex('http://insecure/index.min.json', { fetchImpl }));
+  assert.equal(called, false);
+});
+
+test('fetchRepoIndex surfaces a non-ok response', async () => {
+  const fetchImpl = (async () => new Response('', { status: 404 })) as typeof fetch;
+  await assert.rejects(() => fetchRepoIndex(INDEX, { fetchImpl }), /404/);
+});
+
+test('fetchRepoIndex applies a deadline when the caller supplies no signal', async () => {
+  let receivedSignal: AbortSignal | undefined;
+  const fetchImpl = (async (_input: RequestInfo | URL, init?: RequestInit) => {
+    receivedSignal = init?.signal instanceof AbortSignal ? init.signal : undefined;
+    return new Response('[]');
+  }) as typeof fetch;
+
+  await fetchRepoIndex(INDEX, { fetchImpl, timeoutMs: 50 });
+
+  assert.ok(receivedSignal, 'repository request should receive a deadline signal');
+});
+
+test('fetchRepoCatalogue merges repos and keeps the highest version code', async () => {
+  const second = 'https://other.example/anime/index.min.json';
+  const fetchImpl = (async (input: RequestInfo | URL) => {
+    const url = String(input);
+    if (url === INDEX) {
+      return new Response(JSON.stringify([animeEntry({ code: 12, version: '1.2.3' })]));
+    }
+    return new Response(JSON.stringify([animeEntry({ code: 20, version: '2.0.0' })]));
+  }) as typeof fetch;
+
+  const catalogue = await fetchRepoCatalogue([INDEX, second], { fetchImpl });
+
+  assert.equal(catalogue.extensions.length, 1);
+  assert.equal(catalogue.extensions[0]?.versionCode, 20);
+  assert.equal(catalogue.extensions[0]?.repoUrl, second);
+  assert.deepEqual(catalogue.failures, []);
+});
+
+test('one failing repo does not hide the others', async () => {
+  const broken = 'https://broken.example/anime/index.min.json';
+  const fetchImpl = (async (input: RequestInfo | URL) => {
+    if (String(input) === broken) throw new Error('ENOTFOUND');
+    return new Response(JSON.stringify([animeEntry()]));
+  }) as typeof fetch;
+
+  const catalogue = await fetchRepoCatalogue([broken, INDEX], { fetchImpl });
+
+  assert.equal(catalogue.extensions.length, 1);
+  assert.equal(catalogue.failures.length, 1);
+  assert.equal(catalogue.failures[0]?.repoUrl, broken);
+  assert.match(catalogue.failures[0]?.error ?? '', /ENOTFOUND/);
+});
+
+test('an empty repo list yields an empty catalogue without any request', async () => {
+  let called = false;
+  const fetchImpl = (async () => {
+    called = true;
+    return new Response('[]');
+  }) as typeof fetch;
+
+  const catalogue = await fetchRepoCatalogue([], { fetchImpl });
+  assert.deepEqual(catalogue, { extensions: [], failures: [] });
+  assert.equal(called, false);
+});
+
+test('extensions are stored under their package name so updates replace in place', () => {
+  assert.equal(
+    extensionFileName('eu.kanade.tachiyomi.animeextension.all.example'),
+    'eu.kanade.tachiyomi.animeextension.all.example.apk',
+  );
+});
@@ -0,0 +1,200 @@
+/**
+ * Client for Aniyomi-format extension repositories.
+ *
+ * SubMiner ships no repositories and performs no discovery. A repository only
+ * exists once the user adds its index URL, and only extensions from those
+ * repositories are ever listed or downloaded.
+ */
+
+/** Aniyomi extension packages carry this prefix; manga packages are ignored. */
+const ANIME_PACKAGE_PREFIX = 'eu.kanade.tachiyomi.animeextension';
+
+/**
+ * A package name becomes the on-disk APK file name, and a repository index is
+ * unauthenticated content the user pointed us at. Only plain dotted identifiers
+ * are accepted, so nothing in an index can carry `/` or `..` into a file path.
+ */
+const PACKAGE_NAME_PATTERN = /^[A-Za-z0-9_.]+$/;
+
+/** The APK file name is appended to the repo URL, so keep it a bare name. */
+const APK_FILE_NAME_PATTERN = /^[A-Za-z0-9_.+-]+$/;
+
+/**
+ * Repos are identified by their index URL. The file name is not fixed:
+ * `index.min.json` is the Aniyomi convention, but repositories publish under
+ * other names too (e.g. `video.min.json`), so only https and a `.json` file
+ * name are required.
+ */
+const INDEX_URL_PATTERN = /^https:\/\/[^\s/]+(?:\/[^\s/]*)*\/[^\s/]+\.json$/;
+
+export interface RepoExtension {
+  /** Package name, the stable identity of an extension across versions. */
+  pkg: string;
+  name: string;
+  lang: string;
+  version: string;
+  /** Monotonic version code; the comparison basis for updates. */
+  versionCode: number;
+  nsfw: boolean;
+  apkUrl: string;
+  iconUrl: string;
+  /** Index URL of the repo this came from. */
+  repoUrl: string;
+  /** Source names the package provides, when the index declares them. */
+  sourceNames: string[];
+}
+
+/** `true` when `url` is a usable Aniyomi index URL. */
+export function isValidRepoUrl(url: string): boolean {
+  return INDEX_URL_PATTERN.test(url.trim());
+}
+
+/** Strip the index file name to get the repo root. */
+export function repoBaseUrl(indexUrl: string): string {
+  return indexUrl.trim().replace(/\/[^/]*$/, '');
+}
+
+interface RawEntry {
+  name?: unknown;
+  pkg?: unknown;
+  apk?: unknown;
+  lang?: unknown;
+  code?: unknown;
+  version?: unknown;
+  nsfw?: unknown;
+  sources?: unknown;
+}
+
+function readSourceNames(sources: unknown): string[] {
+  if (!Array.isArray(sources)) return [];
+  return sources
+    .map((source) =>
+      source !== null && typeof source === 'object'
+        ? (source as { name?: unknown }).name
+        : undefined,
+    )
+    .filter((name): name is string => typeof name === 'string' && name.length > 0);
+}
+
+/**
+ * Parse an index payload into anime extensions.
+ *
+ * Entries that are malformed, or that are manga rather than anime packages,
+ * are skipped rather than failing the whole repo.
+ */
+export function parseRepoIndex(indexUrl: string, payload: unknown): RepoExtension[] {
+  if (!Array.isArray(payload)) return [];
+  const base = repoBaseUrl(indexUrl);
+
+  const extensions: RepoExtension[] = [];
+  for (const raw of payload as RawEntry[]) {
+    if (raw === null || typeof raw !== 'object') continue;
+    const pkg = typeof raw.pkg === 'string' ? raw.pkg : '';
+    const apk = typeof raw.apk === 'string' ? raw.apk : '';
+    if (!pkg.startsWith(ANIME_PACKAGE_PREFIX) || !PACKAGE_NAME_PATTERN.test(pkg)) continue;
+    if (apk.length === 0 || !APK_FILE_NAME_PATTERN.test(apk)) continue;
+
+    const versionCode = Number(raw.code);
+    extensions.push({
+      pkg,
+      // Repo entries are prefixed "Aniyomi: "; the app supplies its own context.
+      name: (typeof raw.name === 'string' ? raw.name : pkg).replace(/^Aniyomi:\s*/, ''),
+      lang: typeof raw.lang === 'string' ? raw.lang : 'all',
+      version: typeof raw.version === 'string' ? raw.version : '0',
+      versionCode: Number.isFinite(versionCode) ? versionCode : 0,
+      nsfw: Number(raw.nsfw) === 1,
+      apkUrl: `${base}/apk/${apk}`,
+      iconUrl: `${base}/icon/${pkg}.png`,
+      repoUrl: indexUrl,
+      sourceNames: readSourceNames(raw.sources),
+    });
+  }
+  return extensions;
+}
+
+export interface FetchRepoOptions {
+  fetchImpl?: typeof fetch;
+  signal?: AbortSignal;
+  /** Applied when no signal is supplied, so one stalled repo cannot block the catalogue. */
+  timeoutMs?: number;
+}
+
+const DEFAULT_REPO_TIMEOUT_MS = 15_000;
+
+/** Fetch and parse one repository index. */
+export async function fetchRepoIndex(
+  indexUrl: string,
+  options: FetchRepoOptions = {},
+): Promise<RepoExtension[]> {
+  if (!isValidRepoUrl(indexUrl)) {
+    throw new Error(`Not a valid repository index URL: ${indexUrl}`);
+  }
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const signal =
+    options.signal ?? AbortSignal.timeout(options.timeoutMs ?? DEFAULT_REPO_TIMEOUT_MS);
+  const response = await fetchImpl(indexUrl.trim(), {
+    headers: { Accept: 'application/json' },
+    signal,
+  });
+  if (!response.ok) {
+    throw new Error(`Repository returned ${response.status} for ${indexUrl}`);
+  }
+  return parseRepoIndex(indexUrl, await response.json());
+}
+
+export interface RepoFetchFailure {
+  repoUrl: string;
+  error: string;
+}
+
+export interface RepoCatalogue {
+  extensions: RepoExtension[];
+  failures: RepoFetchFailure[];
+}
+
+/**
+ * Fetch every configured repository.
+ *
+ * When two repos publish the same package, the higher version code wins, so a
+ * user's preferred repo ordering does not silently pin an older build.
+ */
+export async function fetchRepoCatalogue(
+  indexUrls: string[],
+  options: FetchRepoOptions = {},
+): Promise<RepoCatalogue> {
+  const failures: RepoFetchFailure[] = [];
+  const byPackage = new Map<string, RepoExtension>();
+
+  const results = await Promise.all(
+    indexUrls.map(async (indexUrl) => {
+      try {
+        return { indexUrl, extensions: await fetchRepoIndex(indexUrl, options) };
+      } catch (error) {
+        failures.push({
+          repoUrl: indexUrl,
+          error: error instanceof Error ? error.message : String(error),
+        });
+        return { indexUrl, extensions: [] as RepoExtension[] };
+      }
+    }),
+  );
+
+  for (const { extensions } of results) {
+    for (const extension of extensions) {
+      const existing = byPackage.get(extension.pkg);
+      if (!existing || extension.versionCode > existing.versionCode) {
+        byPackage.set(extension.pkg, extension);
+      }
+    }
+  }
+
+  return {
+    extensions: [...byPackage.values()].sort((a, b) => a.name.localeCompare(b.name)),
+    failures,
+  };
+}
+
+/** File name an extension is stored under, so updates replace in place. */
+export function extensionFileName(pkg: string): string {
+  return `${pkg}.apk`;
+}
@@ -0,0 +1,178 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import {
+  listExtensionSources,
+  readInstalledExtensions,
+  toBridgeSource,
+  toInstalledExtensionViews,
+  type ExtensionSource,
+  type InstalledExtension,
+} from './extension-store';
+import type { AnimeBridgeClient } from './bridge-client';
+
+async function makeExtensionDir(files: Record<string, string>): Promise<string> {
+  const dir = await mkdtemp(path.join(tmpdir(), 'subminer-ext-'));
+  for (const [name, contents] of Object.entries(files)) {
+    await writeFile(path.join(dir, name), contents);
+  }
+  return dir;
+}
+
+function fakeClient(
+  impl: (source: { fingerprint: string }) => Promise<unknown[]>,
+): AnimeBridgeClient {
+  return { listAnimeSources: impl } as unknown as AnimeBridgeClient;
+}
+
+test('readInstalledExtensions fingerprints apks without holding their bytes', async () => {
+  const dir = await makeExtensionDir({ 'my-source.apk': 'APK-BYTES' });
+  const extensions = await readInstalledExtensions(dir);
+
+  assert.equal(extensions.length, 1);
+  assert.equal(extensions[0]?.fallbackName, 'my-source');
+  assert.equal(extensions[0]?.sha256, createHash('sha256').update('APK-BYTES').digest('hex'));
+});
+
+test('the fingerprint changes when an apk is replaced in place', async () => {
+  const dir = await makeExtensionDir({ 'my-source.apk': 'V1' });
+  const before = (await readInstalledExtensions(dir))[0]?.sha256;
+  await writeFile(path.join(dir, 'my-source.apk'), 'V2');
+  const after = (await readInstalledExtensions(dir))[0]?.sha256;
+
+  assert.notEqual(before, after);
+});
+
+test('toBridgeSource reads the apk only when the bridge asks for it', async () => {
+  const dir = await makeExtensionDir({ 'lazy.apk': 'APK-BYTES' });
+  const extension = (await readInstalledExtensions(dir))[0]!;
+
+  const bridgeSource = toBridgeSource(extension);
+  assert.equal(bridgeSource.fingerprint, extension.sha256);
+  assert.equal(Buffer.from(await bridgeSource.loadApkBase64(), 'base64').toString(), 'APK-BYTES');
+});
+
+test('readInstalledExtensions ignores non-apk files and subdirectories', async () => {
+  const dir = await makeExtensionDir({ 'a.apk': 'A', 'notes.txt': 'x', 'b.APK': 'B' });
+  await mkdir(path.join(dir, 'nested.apk'), { recursive: true });
+
+  const names = (await readInstalledExtensions(dir)).map((e) => e.fallbackName);
+  // Sorted, case-insensitive extension match, directories excluded.
+  assert.deepEqual(names, ['a', 'b']);
+});
+
+test('readInstalledExtensions returns empty for a missing directory', async () => {
+  assert.deepEqual(await readInstalledExtensions('/nonexistent/subminer/extensions'), []);
+});
+
+test('toBridgeSource includes sourceId only when selecting inside a factory apk', () => {
+  const extension: InstalledExtension = { file: '/x/a.apk', fallbackName: 'a', sha256: 'hash-a' };
+  assert.equal(toBridgeSource(extension).sourceId, undefined);
+  assert.equal(toBridgeSource(extension, 'src-1').sourceId, 'src-1');
+  assert.equal(toBridgeSource(extension, 'src-1').fingerprint, 'hash-a');
+});
+
+test('listExtensionSources flattens every source a factory apk provides', async () => {
+  const extensions: InstalledExtension[] = [
+    { file: '/x/multi.apk', fallbackName: 'multi', sha256: 'hash-a' },
+  ];
+  const client = fakeClient(async () => [
+    { id: 101, name: 'Source One', lang: 'en' },
+    { id: '102', name: 'Source Two', lang: 'ja' },
+  ]);
+
+  const sources = await listExtensionSources(client, extensions);
+
+  assert.equal(sources.length, 2);
+  // Numeric bridge ids are normalized and package-qualified for UI state.
+  assert.equal(sources[0]?.id, 'multi:101');
+  assert.equal(sources[0]?.bridgeId, '101');
+  assert.equal(sources[0]?.name, 'Source One');
+  assert.equal(sources[1]?.lang, 'ja');
+});
+
+test('sources with the same bridge id in different packages have distinct runtime ids', async () => {
+  const extensions: InstalledExtension[] = [
+    { file: '/x/one.apk', fallbackName: 'pkg.one', sha256: 'hash-one' },
+    { file: '/x/two.apk', fallbackName: 'pkg.two', sha256: 'hash-two' },
+  ];
+  const client = fakeClient(async () => [{ id: 'shared', name: 'Source', lang: 'en' }]);
+
+  const sources = await listExtensionSources(client, extensions);
+
+  assert.deepEqual(
+    sources.map(({ id, bridgeId, pkg }) => ({ id, bridgeId, pkg })),
+    [
+      { id: 'pkg.one:shared', bridgeId: 'shared', pkg: 'pkg.one' },
+      { id: 'pkg.two:shared', bridgeId: 'shared', pkg: 'pkg.two' },
+    ],
+  );
+});
+
+test('listExtensionSources falls back to the file name and a default language', async () => {
+  const extensions: InstalledExtension[] = [
+    { file: '/x/my-ext.apk', fallbackName: 'my-ext', sha256: 'hash-a' },
+  ];
+  const client = fakeClient(async () => [{ id: '1', name: '   ' }]);
+
+  const sources = await listExtensionSources(client, extensions);
+  assert.equal(sources[0]?.name, 'my-ext');
+  assert.equal(sources[0]?.lang, 'all');
+});
+
+test('listExtensionSources drops descriptors with no usable id', async () => {
+  const client = fakeClient(async () => [{ name: 'No Id' }, { id: '', name: 'Empty' }]);
+  const sources = await listExtensionSources(client, [
+    { file: '/x/a.apk', fallbackName: 'a', sha256: 'hash-a' },
+  ]);
+  assert.deepEqual(sources, []);
+});
+
+test('toInstalledExtensionViews names an extension after the sources it provides', () => {
+  const extensions: InstalledExtension[] = [
+    { file: '/x/multi.apk', fallbackName: 'multi', sha256: 'hash-a' },
+  ];
+  const sources: ExtensionSource[] = [
+    { id: 'multi:1', bridgeId: '1', name: 'One', lang: 'en', pkg: 'multi', file: '/x/multi.apk' },
+    { id: 'multi:2', bridgeId: '2', name: 'Two', lang: 'ja', pkg: 'multi', file: '/x/multi.apk' },
+  ];
+
+  assert.deepEqual(toInstalledExtensionViews(extensions, sources, []), [
+    { pkg: 'multi', name: 'One, Two', langs: ['en', 'ja'], sourceCount: 2, error: null },
+  ]);
+});
+
+test('toInstalledExtensionViews lists an extension that loaded nothing, with its reason', () => {
+  const extensions: InstalledExtension[] = [
+    { file: '/x/broken.apk', fallbackName: 'broken', sha256: 'hash-a' },
+  ];
+
+  // A broken APK is still installed, so it must stay listed and removable.
+  assert.deepEqual(
+    toInstalledExtensionViews(extensions, [], [{ pkg: 'broken', error: 'dex2jar failed' }]),
+    [{ pkg: 'broken', name: 'broken', langs: [], sourceCount: 0, error: 'dex2jar failed' }],
+  );
+});
+
+test('one broken extension does not hide the working ones', async () => {
+  const extensions: InstalledExtension[] = [
+    { file: '/x/broken.apk', fallbackName: 'broken', sha256: 'hash-a' },
+    { file: '/x/good.apk', fallbackName: 'good', sha256: 'hash-b' },
+  ];
+  const failures: string[] = [];
+  const client = fakeClient(async (source) => {
+    if (source.fingerprint === 'hash-a') throw new Error('dex2jar failed');
+    return [{ id: '7', name: 'Good Source', lang: 'en' }];
+  });
+
+  const sources = await listExtensionSources(client, extensions, (extension) => {
+    failures.push(extension.fallbackName);
+  });
+
+  assert.deepEqual(failures, ['broken']);
+  assert.equal(sources.length, 1);
+  assert.equal(sources[0]?.name, 'Good Source');
+});
@@ -0,0 +1,148 @@
+import { createReadStream } from 'node:fs';
+import { readdir, readFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { pipeline } from 'node:stream/promises';
+import path from 'node:path';
+import type { AnimeBridgeClient } from './bridge-client';
+import type { BridgeSource } from './bridge-client';
+import type { ExtensionLoadFailure, InstalledExtensionView } from '../types/anime-browser';
+
+/**
+ * Anime extensions are Aniyomi APKs the user supplies. They are read from a
+ * directory rather than fetched from a hardcoded catalogue, so which sources
+ * exist is entirely the user's choice.
+ */
+
+export interface InstalledExtension {
+  /** Absolute path to the .apk. */
+  file: string;
+  /** File name without extension, used when the bridge reports no name. */
+  fallbackName: string;
+  /**
+   * SHA-256 of the APK. Identifies the build rather than the slot, so the
+   * bridge's extension-id cache misses after an in-place upgrade.
+   */
+  sha256: string;
+}
+
+export interface ExtensionSource {
+  /** Package-qualified id used by the UI and runtime. */
+  id: string;
+  /** Raw bridge id, which selects this source inside a factory APK. */
+  bridgeId: string;
+  name: string;
+  lang: string;
+  pkg: string;
+  file: string;
+}
+
+/**
+ * Discover every .apk in `directory`. A missing directory yields no extensions.
+ *
+ * Only a hash is kept, never the bytes: APKs run to several MB each and a
+ * base64 copy adds a third on top, so holding the whole set for the lifetime of
+ * the Anime Browser would cost far more than re-reading a file on the rare
+ * upload. Hashing streams, so peak memory stays flat regardless of APK size.
+ */
+export async function readInstalledExtensions(directory: string): Promise<InstalledExtension[]> {
+  let entries;
+  try {
+    entries = await readdir(directory, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+
+  const extensions: InstalledExtension[] = [];
+  for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+    if (!entry.isFile() || !entry.name.toLowerCase().endsWith('.apk')) continue;
+    const file = path.join(directory, entry.name);
+    extensions.push({
+      file,
+      fallbackName: entry.name.replace(/\.apk$/i, ''),
+      sha256: await hashFile(file),
+    });
+  }
+  return extensions;
+}
+
+async function hashFile(file: string): Promise<string> {
+  const hash = createHash('sha256');
+  await pipeline(createReadStream(file), hash);
+  return hash.digest('hex');
+}
+
+/**
+ * Describe what is on disk, for the installed list in the Extensions tab.
+ *
+ * Built from the directory rather than from a repository catalogue: an APK
+ * dropped in by hand, or one whose repository the user has since removed, is
+ * still installed and must stay removable.
+ */
+export function toInstalledExtensionViews(
+  extensions: InstalledExtension[],
+  sources: ExtensionSource[],
+  loadFailures: ExtensionLoadFailure[],
+): InstalledExtensionView[] {
+  return extensions.map((extension) => {
+    const provided = sources.filter((source) => source.file === extension.file);
+    const names = [...new Set(provided.map((source) => source.name))];
+    return {
+      pkg: extension.fallbackName,
+      name: names.length > 0 ? names.join(', ') : extension.fallbackName,
+      langs: [...new Set(provided.map((source) => source.lang))],
+      sourceCount: provided.length,
+      error: loadFailures.find((failure) => failure.pkg === extension.fallbackName)?.error ?? null,
+    };
+  });
+}
+
+/**
+ * The bridge payload for a specific source inside an extension.
+ *
+ * The APK is read on demand: after the first upload the bridge answers by
+ * extension id, so most calls never touch the file at all.
+ */
+export function toBridgeSource(extension: InstalledExtension, sourceId?: string): BridgeSource {
+  return {
+    fingerprint: extension.sha256,
+    loadApkBase64: async () => (await readFile(extension.file)).toString('base64'),
+    ...(sourceId ? { sourceId } : {}),
+  };
+}
+
+/**
+ * Ask the bridge which sources each extension provides.
+ *
+ * An extension that fails to load is skipped rather than aborting the scan, so
+ * one broken APK cannot hide every working one. Failures are reported through
+ * `onError` for surfacing in the UI.
+ */
+export async function listExtensionSources(
+  client: AnimeBridgeClient,
+  extensions: InstalledExtension[],
+  onError?: (extension: InstalledExtension, error: unknown) => void,
+): Promise<ExtensionSource[]> {
+  const sources: ExtensionSource[] = [];
+
+  for (const extension of extensions) {
+    try {
+      const descriptors = await client.listAnimeSources(toBridgeSource(extension));
+      for (const descriptor of descriptors) {
+        const bridgeId = descriptor.id === undefined ? null : String(descriptor.id);
+        if (bridgeId === null || bridgeId.length === 0) continue;
+        sources.push({
+          id: `${extension.fallbackName}:${bridgeId}`,
+          bridgeId,
+          name: descriptor.name?.trim() || extension.fallbackName,
+          lang: descriptor.lang ?? 'all',
+          pkg: extension.fallbackName,
+          file: extension.file,
+        });
+      }
+    } catch (error) {
+      onError?.(extension, error);
+    }
+  }
+
+  return sources;
+}
@@ -0,0 +1,73 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { parseOkHttpHeaders, resolveStream, toMpvHeaderFields } from './headers';
+
+test('parseOkHttpHeaders flattens the alternating name/value array', () => {
+  const parsed = parseOkHttpHeaders({
+    namesAndValues$okhttp: ['Referer', 'https://origin.example/', 'User-Agent', 'Aniyomi'],
+  });
+  assert.deepEqual(parsed, {
+    Referer: 'https://origin.example/',
+    'User-Agent': 'Aniyomi',
+  });
+});
+
+test('parseOkHttpHeaders tolerates missing, empty, and odd-length input', () => {
+  assert.deepEqual(parseOkHttpHeaders(undefined), {});
+  assert.deepEqual(parseOkHttpHeaders({}), {});
+  assert.deepEqual(parseOkHttpHeaders({ namesAndValues$okhttp: [] }), {});
+  // A trailing name with no value is dropped rather than mapped to undefined.
+  assert.deepEqual(parseOkHttpHeaders({ namesAndValues$okhttp: ['Referer'] }), {});
+});
+
+test('toMpvHeaderFields joins entries and escapes commas in values', () => {
+  const fields = toMpvHeaderFields({
+    Referer: 'https://origin.example/',
+    Cookie: 'a=1, b=2',
+  });
+  assert.equal(fields, 'Referer: https://origin.example/,Cookie: a=1\\, b=2');
+});
+
+test('toMpvHeaderFields escapes backslashes so a trailing one cannot eat the separator', () => {
+  const fields = toMpvHeaderFields({ Referer: 'https://origin.example/path\\', Cookie: 'a=1' });
+  // Without doubling, the value's trailing backslash would escape the comma
+  // and merge Cookie into the Referer entry.
+  assert.equal(fields, 'Referer: https://origin.example/path\\\\,Cookie: a=1');
+});
+
+test('toMpvHeaderFields returns an empty string when there are no headers', () => {
+  assert.equal(toMpvHeaderFields({}), '');
+});
+
+test('resolveStream normalizes a bridge video into a playable stream', () => {
+  const stream = resolveStream({
+    url: 'https://origin.example/embed/1',
+    quality: '1080p',
+    videoUrl: 'http://127.0.0.1:8080/video/master-token',
+    headers: { namesAndValues$okhttp: ['Referer', 'https://origin.example/'] },
+    subtitleTracks: [{ url: 'http://127.0.0.1:8080/video/sub-token', lang: 'English' }],
+    audioTracks: [{ url: 'http://127.0.0.1:8080/video/audio-token', lang: 'Japanese' }],
+  });
+
+  assert.deepEqual(stream, {
+    url: 'http://127.0.0.1:8080/video/master-token',
+    quality: '1080p',
+    headers: { Referer: 'https://origin.example/' },
+    subtitles: [{ url: 'http://127.0.0.1:8080/video/sub-token', lang: 'English' }],
+    audios: [{ url: 'http://127.0.0.1:8080/video/audio-token', lang: 'Japanese' }],
+  });
+});
+
+test('resolveStream returns null when the extension resolved no media url', () => {
+  assert.equal(resolveStream({ url: 'https://origin.example/embed/1', quality: '1080p' }), null);
+  assert.equal(resolveStream({ videoUrl: '' }), null);
+});
+
+test('resolveStream drops tracks without a url and defaults a missing lang', () => {
+  const stream = resolveStream({
+    videoUrl: 'http://127.0.0.1:8080/video/master-token',
+    subtitleTracks: [{ lang: 'English' }, { url: 'http://127.0.0.1:8080/video/sub-token' }],
+  });
+  assert.deepEqual(stream?.subtitles, [{ url: 'http://127.0.0.1:8080/video/sub-token', lang: '' }]);
+  assert.equal(stream?.quality, '');
+});
@@ -0,0 +1,56 @@
+import type { BridgeVideo, OkHttpHeaders, ResolvedStream } from './types';
+
+/**
+ * Flatten OkHttp's alternating `[name, value, name, value]` array into a map.
+ * A trailing name with no value is dropped rather than mapped to undefined.
+ */
+export function parseOkHttpHeaders(headers: OkHttpHeaders | undefined): Record<string, string> {
+  const flat = headers?.['namesAndValues$okhttp'];
+  if (!Array.isArray(flat)) return {};
+
+  const parsed: Record<string, string> = {};
+  for (let i = 0; i + 1 < flat.length; i += 2) {
+    const name = flat[i];
+    const value = flat[i + 1];
+    if (typeof name === 'string' && typeof value === 'string') parsed[name] = value;
+  }
+  return parsed;
+}
+
+/**
+ * Render headers as mpv's `--http-header-fields` string list. mpv splits
+ * entries on commas, so commas inside a value must be escaped — and the
+ * backslash that does the escaping has to be escaped first, or a value ending
+ * in `\` would neutralise the separator and swallow the next header.
+ */
+export function toMpvHeaderFields(headers: Record<string, string>): string {
+  return Object.entries(headers)
+    .map(([name, value]) => `${name}: ${value.replace(/\\/g, '\\\\').replace(/,/g, '\\,')}`)
+    .join(',');
+}
+
+function normalizeTracks(
+  tracks: Array<{ url?: string; lang?: string }> | undefined,
+): Array<{ url: string; lang: string }> {
+  if (!Array.isArray(tracks)) return [];
+  return tracks
+    .filter((track): track is { url: string; lang?: string } => typeof track.url === 'string')
+    .map((track) => ({ url: track.url, lang: track.lang ?? '' }));
+}
+
+/**
+ * Normalize a bridge video into a playable stream. Returns null when the
+ * extension produced no `videoUrl`, which happens for entries it failed to
+ * resolve.
+ */
+export function resolveStream(video: BridgeVideo): ResolvedStream | null {
+  if (typeof video.videoUrl !== 'string' || video.videoUrl.length === 0) return null;
+
+  return {
+    url: video.videoUrl,
+    quality: video.quality ?? '',
+    headers: parseOkHttpHeaders(video.headers),
+    subtitles: normalizeTracks(video.subtitleTracks),
+    audios: normalizeTracks(video.audioTracks),
+  };
+}
@@ -0,0 +1,95 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { parseAnimeStatus, resolveBridgeMediaUrl, routeHlsThroughProxy } from './media-url';
+
+const BRIDGE = 'http://127.0.0.1:56037';
+const PROXY = 'http://127.0.0.1:60001';
+
+test('a bridge m3u8 stream is routed through the strip proxy', () => {
+  assert.equal(
+    routeHlsThroughProxy(`${BRIDGE}/video/master.m3u8?q=1080`, BRIDGE, PROXY),
+    `${PROXY}/video/master.m3u8?q=1080`,
+  );
+});
+
+test('non-HLS bridge streams stay on the bridge', () => {
+  const direct = `${BRIDGE}/video/movie-token`;
+  assert.equal(routeHlsThroughProxy(direct, BRIDGE, PROXY), direct);
+});
+
+test('external m3u8 streams are not routed through the proxy', () => {
+  const remote = 'https://cdn.example.com/hls/master.m3u8';
+  assert.equal(routeHlsThroughProxy(remote, BRIDGE, PROXY), remote);
+});
+
+test('unparseable stream urls pass through routeHlsThroughProxy unchanged', () => {
+  assert.equal(routeHlsThroughProxy('not a url', BRIDGE, PROXY), 'not a url');
+  assert.equal(
+    routeHlsThroughProxy(`${BRIDGE}/video/a.m3u8`, 'garbage', PROXY),
+    `${BRIDGE}/video/a.m3u8`,
+  );
+});
+
+test('a loopback proxy url is rebased onto the live bridge port', () => {
+  assert.equal(
+    resolveBridgeMediaUrl(BRIDGE, 'http://127.0.0.1:8080/image/cover-uuid'),
+    'http://127.0.0.1:56037/image/cover-uuid',
+  );
+  assert.equal(
+    resolveBridgeMediaUrl(BRIDGE, 'http://localhost:8080/video/master-token'),
+    'http://127.0.0.1:56037/video/master-token',
+  );
+});
+
+test('query strings and fragments survive rebasing', () => {
+  assert.equal(
+    resolveBridgeMediaUrl(BRIDGE, 'http://127.0.0.1:8080/video/token?quality=1080#t=30'),
+    'http://127.0.0.1:56037/video/token?quality=1080#t=30',
+  );
+});
+
+test('ipv6 loopback is recognised', () => {
+  assert.equal(
+    resolveBridgeMediaUrl(BRIDGE, 'http://[::1]:8080/image/cover'),
+    'http://127.0.0.1:56037/image/cover',
+  );
+});
+
+test('remote urls are left untouched', () => {
+  const remote = 'https://cdn.example.com/covers/1.jpg';
+  assert.equal(resolveBridgeMediaUrl(BRIDGE, remote), remote);
+});
+
+test('loopback urls outside the proxy routes are left untouched', () => {
+  // Only /image and /video are proxy routes; /capabilities is the server's own API.
+  const other = 'http://127.0.0.1:8080/capabilities';
+  assert.equal(resolveBridgeMediaUrl(BRIDGE, other), other);
+});
+
+test('a base url without a scheme is assumed to be http', () => {
+  assert.equal(
+    resolveBridgeMediaUrl('127.0.0.1:56037', 'http://127.0.0.1:8080/image/cover'),
+    'http://127.0.0.1:56037/image/cover',
+  );
+});
+
+test('unparseable input is returned unchanged rather than throwing', () => {
+  assert.equal(resolveBridgeMediaUrl(BRIDGE, 'not a url'), 'not a url');
+  assert.equal(
+    resolveBridgeMediaUrl('', 'http://127.0.0.1:8080/image/c'),
+    'http://127.0.0.1:8080/image/c',
+  );
+  assert.equal(resolveBridgeMediaUrl(BRIDGE, ''), '');
+});
+
+test('parseAnimeStatus maps the SAnime constants', () => {
+  assert.equal(parseAnimeStatus(1), 'ongoing');
+  assert.equal(parseAnimeStatus(2), 'completed');
+  assert.equal(parseAnimeStatus(4), 'publishing-finished');
+  assert.equal(parseAnimeStatus(5), 'cancelled');
+  assert.equal(parseAnimeStatus(6), 'on-hiatus');
+  assert.equal(parseAnimeStatus(0), 'unknown');
+  assert.equal(parseAnimeStatus(undefined), 'unknown');
+  // 3 is unused in the SAnime constants.
+  assert.equal(parseAnimeStatus(3), 'unknown');
+});
@@ -0,0 +1,98 @@
+/**
+ * The bridge returns cover art and video URLs pointing at its own loopback
+ * media proxy, but the origin it embeds is not always the port we actually
+ * started it on. Rebase those onto the live bridge origin, and leave any
+ * genuinely remote URL untouched.
+ */
+
+const PROXY_ROUTES = new Set(['image', 'video']);
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
+
+function isLoopbackProxyUrl(candidate: URL): boolean {
+  if (candidate.protocol !== 'http:' && candidate.protocol !== 'https:') return false;
+  const host = candidate.hostname.toLowerCase();
+  if (!LOOPBACK_HOSTS.has(host)) return false;
+  const route = candidate.pathname.split('/').filter(Boolean)[0];
+  return route !== undefined && PROXY_ROUTES.has(route);
+}
+
+/**
+ * Rewrite a bridge media URL onto `bridgeBaseUrl`, preserving path and query.
+ * Returns the input unchanged when it is not a loopback proxy URL, or when
+ * either URL cannot be parsed.
+ */
+export function resolveBridgeMediaUrl(bridgeBaseUrl: string, mediaUrl: string): string {
+  let media: URL;
+  try {
+    media = new URL(mediaUrl);
+  } catch {
+    return mediaUrl;
+  }
+  if (!isLoopbackProxyUrl(media)) return mediaUrl;
+
+  const normalizedBase = bridgeBaseUrl.includes('://') ? bridgeBaseUrl : `http://${bridgeBaseUrl}`;
+  let base: URL;
+  try {
+    base = new URL(normalizedBase);
+  } catch {
+    return mediaUrl;
+  }
+  if (base.protocol !== 'http:' && base.protocol !== 'https:') return mediaUrl;
+  if (base.hostname.length === 0) return mediaUrl;
+
+  const rebased = new URL(base.origin);
+  rebased.pathname = media.pathname;
+  rebased.search = media.search;
+  rebased.hash = media.hash;
+  return rebased.toString();
+}
+
+/**
+ * Send a bridge-served HLS stream through the local strip proxy instead. Only
+ * `.m3u8` URLs on the bridge origin qualify: direct files need no fixing, and
+ * an external URL would not resolve through a proxy that forwards to the
+ * bridge. Anything unparseable comes back unchanged.
+ */
+export function routeHlsThroughProxy(
+  streamUrl: string,
+  bridgeBaseUrl: string,
+  proxyOrigin: string,
+): string {
+  let stream: URL;
+  let bridge: URL;
+  try {
+    stream = new URL(streamUrl);
+    bridge = new URL(bridgeBaseUrl);
+  } catch {
+    return streamUrl;
+  }
+  if (stream.origin !== bridge.origin) return streamUrl;
+  if (!stream.pathname.endsWith('.m3u8')) return streamUrl;
+  return `${proxyOrigin}${stream.pathname}${stream.search}`;
+}
+
+/** Aniyomi's SAnime status constants. */
+export type AnimeStatus =
+  | 'unknown'
+  | 'ongoing'
+  | 'completed'
+  | 'publishing-finished'
+  | 'cancelled'
+  | 'on-hiatus';
+
+export function parseAnimeStatus(status: number | undefined): AnimeStatus {
+  switch (status) {
+    case 1:
+      return 'ongoing';
+    case 2:
+      return 'completed';
+    case 4:
+      return 'publishing-finished';
+    case 5:
+      return 'cancelled';
+    case 6:
+      return 'on-hiatus';
+    default:
+      return 'unknown';
+  }
+}
@@ -0,0 +1,231 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  buildLoadfileOptions,
+  buildPlaybackCommands,
+  buildTrackCommands,
+  normalizeLangTag,
+  selectPreferredStream,
+} from './mpv-playback';
+import type { ResolvedStream } from './types';
+
+function stream(overrides: Partial<ResolvedStream> = {}): ResolvedStream {
+  return {
+    url: 'http://127.0.0.1:8080/video/token',
+    quality: '1080p',
+    headers: {},
+    subtitles: [],
+    audios: [],
+    ...overrides,
+  };
+}
+
+test('loadfile options keep one visible track and never scan the filesystem', () => {
+  const options = buildLoadfileOptions({ stream: stream() });
+  for (const expected of [
+    'sub-auto=no',
+    'secondary-sid=no',
+    'secondary-sub-visibility=no',
+    'sub-visibility=yes',
+  ]) {
+    assert.ok(options.split(',').includes(expected), `missing ${expected}`);
+  }
+  // The source's own subtitles are the only ones this path gets, so they must
+  // not be suppressed the way the Jellyfin path suppresses them.
+  assert.ok(!options.split(',').includes('sid=no'));
+  // Comma-separated values would split the option list, so the language
+  // preferences ride as properties instead.
+  assert.ok(!options.includes('alang'));
+  assert.ok(!options.includes('slang'));
+});
+
+test('headers are percent-escaped so their commas do not split the option list', () => {
+  const headers = { Referer: 'https://a.test/', 'User-Agent': 'X' };
+  const options = buildLoadfileOptions({ stream: stream({ headers }) });
+
+  // Verified against mpv 0.41: the unescaped form yields an empty header list.
+  const fields = 'Referer: https://a.test/,User-Agent: X';
+  assert.ok(options.includes(`http-header-fields=%${fields.length}%${fields}`));
+});
+
+test('the escape length counts the full header string including separators', () => {
+  const options = buildLoadfileOptions({
+    stream: stream({ headers: { Cookie: 'a=1, b=2' } }),
+  });
+  // The comma inside the value is backslash-escaped first, so the length grows.
+  const fields = 'Cookie: a=1\\, b=2';
+  assert.ok(options.includes(`%${fields.length}%${fields}`));
+});
+
+test('the escape length is counted in utf-8 bytes, not js string units', () => {
+  // An extension may put a non-ASCII value in a header; mpv reads %n% as a
+  // byte count, so counting string units would truncate the value.
+  const options = buildLoadfileOptions({
+    stream: stream({ headers: { 'X-Title': '日本語' } }),
+  });
+  const fields = 'X-Title: 日本語';
+  assert.ok(options.includes(`%${Buffer.byteLength(fields, 'utf8')}%${fields}`));
+  assert.ok(!options.includes(`%${fields.length}%`));
+});
+
+test('no header option is emitted when the stream carries no headers', () => {
+  const options = buildLoadfileOptions({ stream: stream() });
+  assert.ok(!options.includes('http-header-fields'));
+});
+
+test('a positive start position is appended, zero is omitted', () => {
+  assert.ok(buildLoadfileOptions({ stream: stream(), startSeconds: 42 }).includes('start=42'));
+  assert.ok(!buildLoadfileOptions({ stream: stream(), startSeconds: 0 }).includes('start='));
+  assert.ok(!buildLoadfileOptions({ stream: stream() }).includes('start='));
+});
+
+test('playback commands set the language preference before loading the file', () => {
+  const commands = buildPlaybackCommands({ stream: stream(), title: 'Example - 01' });
+
+  assert.deepEqual(commands[0], ['script-message', 'subminer-managed-subtitles-loading']);
+  // Japanese first, so a multi-audio stream never starts on the dub. slang is
+  // Japanese-only: an English track belongs in the secondary slot, which the
+  // secondarySub auto-load fills by language tag.
+  assert.deepEqual(commands[1], ['set_property', 'alang', 'ja,jpn,jp,japanese']);
+  assert.deepEqual(commands[2], ['set_property', 'slang', 'ja,jpn,jp,japanese']);
+  assert.equal(commands[3]?.[0], 'loadfile');
+  assert.equal(commands[3]?.[1], 'http://127.0.0.1:8080/video/token');
+  assert.equal(commands[3]?.[2], 'replace');
+  assert.equal(commands[3]?.[3], -1);
+  assert.deepEqual(commands[4], ['set_property', 'force-media-title', 'Example - 01']);
+});
+
+test('force-media-title is skipped when there is no title', () => {
+  assert.equal(buildPlaybackCommands({ stream: stream() }).length, 4);
+  assert.equal(buildPlaybackCommands({ stream: stream(), title: '' }).length, 4);
+});
+
+test('external audio tracks are added, with the Japanese one selected', () => {
+  const commands = buildTrackCommands(
+    stream({
+      audios: [
+        { url: 'http://host/en.m4a', lang: 'en' },
+        { url: 'http://host/ja.m4a', lang: 'ja' },
+      ],
+    }),
+  );
+
+  assert.deepEqual(commands, [
+    ['audio-add', 'http://host/en.m4a', 'auto', 'en', 'en'],
+    ['audio-add', 'http://host/ja.m4a', 'select', 'ja', 'ja'],
+  ]);
+});
+
+test('external audio is left unselected when none of it is Japanese', () => {
+  // alang already picked a track off the container; do not override it.
+  const commands = buildTrackCommands(
+    stream({ audios: [{ url: 'http://host/en.m4a', lang: 'eng' }] }),
+  );
+
+  assert.deepEqual(commands, [['audio-add', 'http://host/en.m4a', 'auto', 'eng', 'en']]);
+});
+
+test('only a Japanese subtitle track is selected as primary', () => {
+  const japanese = buildTrackCommands(
+    stream({
+      subtitles: [
+        { url: 'http://host/en.vtt', lang: 'English' },
+        { url: 'http://host/ja.vtt', lang: 'Japanese' },
+      ],
+    }),
+  );
+  assert.deepEqual(japanese[1], ['sub-add', 'http://host/ja.vtt', 'select', 'Japanese', 'ja']);
+  assert.equal(japanese[0]?.[2], 'auto');
+
+  // English is the user's *secondary* language; it must not take the primary
+  // slot. It rides in unselected, tagged so the secondarySub auto-load can
+  // route it to secondary-sid.
+  const englishOnly = buildTrackCommands(
+    stream({ subtitles: [{ url: 'http://host/en.vtt', lang: 'English' }] }),
+  );
+  assert.deepEqual(englishOnly, [['sub-add', 'http://host/en.vtt', 'auto', 'English', 'en']]);
+});
+
+test('language labels normalize to the tags users configure', () => {
+  assert.equal(normalizeLangTag('English'), 'en');
+  assert.equal(normalizeLangTag('eng'), 'en');
+  assert.equal(normalizeLangTag('en-US'), 'en');
+  assert.equal(normalizeLangTag('Japanese'), 'ja');
+  assert.equal(normalizeLangTag('jpn'), 'ja');
+  assert.equal(normalizeLangTag('Português'), 'pt');
+  // Unknown labels pass through untouched rather than being guessed at.
+  assert.equal(normalizeLangTag('Klingon'), 'Klingon');
+  assert.equal(normalizeLangTag(''), '');
+});
+
+test('unlabelled tracks still get a usable menu title, duplicates are dropped', () => {
+  const commands = buildTrackCommands(
+    stream({
+      subtitles: [
+        { url: 'http://host/a.vtt', lang: '' },
+        { url: 'http://host/a.vtt', lang: '' },
+        { url: 'http://host/b.vtt', lang: '' },
+      ],
+    }),
+  );
+
+  assert.deepEqual(commands, [
+    ['sub-add', 'http://host/a.vtt', 'auto', 'Subtitle 1', ''],
+    ['sub-add', 'http://host/b.vtt', 'auto', 'Subtitle 2', ''],
+  ]);
+});
+
+test('a stream with no external tracks emits no track commands', () => {
+  assert.deepEqual(buildTrackCommands(stream()), []);
+});
+
+test('selectPreferredStream skips dub entries in favour of the original audio', () => {
+  const streams = [
+    stream({ quality: '1080p (Dub)' }),
+    stream({ quality: '720p (Sub)' }),
+    stream({ quality: '480p (Dub)' }),
+  ];
+
+  // Language beats the quality hint: a 1080p dub is the wrong file, not a
+  // better one.
+  assert.equal(selectPreferredStream(streams)?.quality, '720p (Sub)');
+  assert.equal(selectPreferredStream(streams, '1080')?.quality, '720p (Sub)');
+});
+
+test('selectPreferredStream prefers an entry carrying a Japanese audio track', () => {
+  const streams = [
+    stream({ quality: '1080p' }),
+    stream({ quality: '720p', audios: [{ url: 'http://host/ja.m4a', lang: 'ja' }] }),
+  ];
+
+  assert.equal(selectPreferredStream(streams)?.quality, '720p');
+});
+
+test('an all-dub list still plays rather than failing', () => {
+  const streams = [stream({ quality: '1080p Dub' }), stream({ quality: '720p Dub' })];
+
+  assert.equal(selectPreferredStream(streams)?.quality, '1080p Dub');
+  assert.equal(selectPreferredStream(streams, '720')?.quality, '720p Dub');
+});
+
+test('selectPreferredStream honours a quality hint, else takes the first', () => {
+  const streams = [stream({ quality: '360p' }), stream({ quality: '1080p' })];
+
+  assert.equal(selectPreferredStream(streams, '1080')?.quality, '1080p');
+  assert.equal(selectPreferredStream(streams, '1080P')?.quality, '1080p');
+  // Extensions label streams with the host name, so the hint matches a substring.
+  const decorated = [
+    stream({ quality: 'Doodstream - 360p' }),
+    stream({ quality: 'Vidhide - 720p' }),
+  ];
+  assert.equal(selectPreferredStream(decorated, '720')?.quality, 'Vidhide - 720p');
+  // Extensions pre-sort by their own preference, so the first entry wins.
+  assert.equal(selectPreferredStream(streams)?.quality, '360p');
+  // A hint that matches nothing falls back rather than failing.
+  assert.equal(selectPreferredStream(streams, '4k')?.quality, '360p');
+});
+
+test('selectPreferredStream returns null for an empty list', () => {
+  assert.equal(selectPreferredStream([]), null);
+  assert.equal(selectPreferredStream([], '1080p'), null);
+});
@@ -0,0 +1,238 @@
+import { toMpvHeaderFields } from './headers';
+import type { ResolvedStream } from './types';
+
+/**
+ * Japanese first, always, and for subtitles Japanese *only*: the primary slot
+ * belongs to the language being mined, and an English track belongs in the
+ * secondary slot, where the `secondarySub` machinery puts it by language tag.
+ * For audio, mpv falls back to the first track when nothing matches, so an
+ * English-only release still plays.
+ */
+export const JAPANESE_LANGUAGE_PREFERENCE = 'ja,jpn,jp,japanese';
+
+/**
+ * mpv must not scan the filesystem for sidecar subtitles when the "file" is a
+ * network stream, and the secondary slot stays empty so the overlay only ever
+ * reads one track. Everything else is left to normal track selection, driven
+ * by the language preferences above.
+ *
+ * `alang`/`slang` are set as properties instead of file-local options: their
+ * values are comma-separated lists, and a comma inside a `loadfile` option
+ * value splits the option list.
+ */
+const BASE_LOADFILE_OPTIONS = [
+  'sub-auto=no',
+  'secondary-sid=no',
+  'secondary-sub-visibility=no',
+  'sub-visibility=yes',
+];
+
+/** Matches a language tag or a label such as "Japanese (Sub)" or "[JPN]". */
+const JAPANESE_PATTERN = /(^|[^a-z])(ja|jp|jpn|japanese|日本語)([^a-z]|$)/i;
+/** Extensions label dub entries in the quality string, e.g. "1080p (Dub)". */
+const DUB_PATTERN = /(^|[^a-z])(dub|dubbed|dublado|latino|castellano)([^a-z]|$)/i;
+/** The counterpart label for original-audio entries, e.g. "SUB - 1080p". */
+const SUBBED_PATTERN = /(^|[^a-z])(sub|subbed|softsub|hardsub|subtitulado|raw)([^a-z]|$)/i;
+
+export type MpvCommand = Array<string | number>;
+
+export interface BuildPlaybackOptions {
+  stream: ResolvedStream;
+  /** Shown as the mpv window/OSD title. */
+  title?: string;
+  /** Resume position in seconds. */
+  startSeconds?: number;
+}
+
+export function isJapaneseTag(value: string): boolean {
+  return JAPANESE_PATTERN.test(value);
+}
+
+/**
+ * Build the mpv `loadfile` option string for a stream.
+ *
+ * Headers ride as `file-local-options/http-header-fields` so they apply to this
+ * file only, and so SubMiner's Anki media path can read them back off mpv when
+ * generating card audio and screenshots. Tracks added later with `sub-add` /
+ * `audio-add` inherit them too, which is how external tracks on an
+ * authenticated host stay reachable.
+ */
+export function buildLoadfileOptions(options: BuildPlaybackOptions): string {
+  const parts = [...BASE_LOADFILE_OPTIONS];
+
+  const headerFields = toMpvHeaderFields(options.stream.headers);
+  if (headerFields.length > 0) {
+    // Escape the mpv option-list separators so a header never splits the list.
+    parts.push(`http-header-fields=${escapeOptionValue(headerFields)}`);
+  }
+
+  if (options.startSeconds !== undefined && options.startSeconds > 0) {
+    parts.push(`start=${options.startSeconds}`);
+  }
+
+  return parts.join(',');
+}
+
+/**
+ * mpv splits `loadfile` options on commas and `=`-separates keys, so a value
+ * containing either must be quoted. Percent-encoding is mpv's own escape for
+ * embedded separators in option values.
+ *
+ * The count is in UTF-8 bytes of the decoded value, not JS string units, so a
+ * non-ASCII header value (extensions supply these) would otherwise under-count
+ * and mpv would cut the value short.
+ */
+function escapeOptionValue(value: string): string {
+  return `%${Buffer.byteLength(value, 'utf8')}%${value}`;
+}
+
+/**
+ * Ordered mpv commands that start playback of a resolved stream.
+ *
+ * The plugin is told subtitles are being managed before the file loads, so the
+ * overlay does not flash the source's own tracks during the swap.
+ */
+export function buildPlaybackCommands(options: BuildPlaybackOptions): MpvCommand[] {
+  const commands: MpvCommand[] = [
+    ['script-message', 'subminer-managed-subtitles-loading'],
+    ['set_property', 'alang', JAPANESE_LANGUAGE_PREFERENCE],
+    ['set_property', 'slang', JAPANESE_LANGUAGE_PREFERENCE],
+    ['loadfile', options.stream.url, 'replace', -1, buildLoadfileOptions(options)],
+  ];
+
+  if (options.title !== undefined && options.title.length > 0) {
+    commands.push(['set_property', 'force-media-title', options.title]);
+  }
+
+  return commands;
+}
+
+/**
+ * Commands that attach the extension's external audio and subtitle tracks.
+ *
+ * These must be sent *after* the file is loading, so they are separate from
+ * {@link buildPlaybackCommands}. Every track is added — even the ones we do not
+ * select — so they show up in mpv's track menu and can be switched by hand.
+ */
+export function buildTrackCommands(stream: ResolvedStream): MpvCommand[] {
+  return [
+    ...buildAddTrackCommands('audio-add', stream.audios, 'Audio'),
+    ...buildAddTrackCommands('sub-add', stream.subtitles, 'Subtitle'),
+  ];
+}
+
+/**
+ * Only a Japanese track is ever selected outright — the primary slot is for
+ * the mining language. A non-Japanese track is added unselected: for audio,
+ * `alang`'s pick off the container stands; for subtitles, the `secondarySub`
+ * auto-load matches the track's language tag against the user's configured
+ * secondary languages and routes it to `secondary-sid` instead.
+ */
+function buildAddTrackCommands(
+  command: 'audio-add' | 'sub-add',
+  tracks: Array<{ url: string; lang: string }>,
+  kind: 'Audio' | 'Subtitle',
+): MpvCommand[] {
+  const unique = dedupeByUrl(tracks);
+  const selected = unique.findIndex((track) => isJapaneseTag(track.lang));
+
+  return unique.map((track, index) => [
+    command,
+    track.url,
+    index === selected ? 'select' : 'auto',
+    track.lang || `${kind} ${index + 1}`,
+    normalizeLangTag(track.lang),
+  ]);
+}
+
+/** Extension language labels mapped to the tags users put in config. */
+const LANG_TAG_BY_LABEL: Record<string, string> = {
+  japanese: 'ja',
+  日本語: 'ja',
+  english: 'en',
+  eng: 'en',
+  spanish: 'es',
+  español: 'es',
+  portuguese: 'pt',
+  português: 'pt',
+  french: 'fr',
+  français: 'fr',
+  german: 'de',
+  deutsch: 'de',
+  italian: 'it',
+  italiano: 'it',
+  indonesian: 'id',
+  arabic: 'ar',
+  russian: 'ru',
+  korean: 'ko',
+  chinese: 'zh',
+  thai: 'th',
+  vietnamese: 'vi',
+};
+
+/**
+ * mpv's `lang` field is what SubMiner's secondary-subtitle auto-load compares
+ * against `secondarySub.secondarySubLanguages`, so a label like "English" must
+ * become the tag a user would actually configure. Unknown labels pass through;
+ * matching is best-effort, and the raw label stays visible as the track title.
+ */
+export function normalizeLangTag(lang: string): string {
+  const trimmed = lang.trim();
+  if (isJapaneseTag(trimmed)) return 'ja';
+  const mapped = LANG_TAG_BY_LABEL[trimmed.toLowerCase()];
+  if (mapped !== undefined) return mapped;
+  if (/^[A-Za-z]{2,3}([-_][A-Za-z0-9]+)?$/.test(trimmed)) {
+    return trimmed.split(/[-_]/, 1)[0]?.toLowerCase() ?? trimmed.toLowerCase();
+  }
+  return trimmed;
+}
+
+function dedupeByUrl(
+  tracks: Array<{ url: string; lang: string }>,
+): Array<{ url: string; lang: string }> {
+  const seen = new Set<string>();
+  return tracks.filter((track) => {
+    if (track.url.length === 0 || seen.has(track.url)) return false;
+    seen.add(track.url);
+    return true;
+  });
+}
+
+/**
+ * Rank a stream by how likely it is to carry Japanese audio.
+ *
+ * Sources commonly return the dub and the original as separate entries rather
+ * than as two audio tracks of one entry, so the choice of *entry* is the first
+ * place a dub can slip in.
+ */
+function scoreStream(stream: ResolvedStream): number {
+  if (stream.audios.some((audio) => isJapaneseTag(audio.lang))) return 2;
+  const label = stream.quality;
+  if (isJapaneseTag(label) || SUBBED_PATTERN.test(label)) return 1;
+  if (DUB_PATTERN.test(label)) return -1;
+  return 0;
+}
+
+/**
+ * Pick the best stream from an extension's video list.
+ *
+ * Japanese audio outranks the quality hint — a 1080p dub is the wrong file, not
+ * a better one. Within the surviving entries the hint decides, and otherwise
+ * the extension's own ordering does.
+ */
+export function selectPreferredStream(
+  streams: ResolvedStream[],
+  preferredQuality?: string,
+): ResolvedStream | null {
+  if (streams.length === 0) return null;
+
+  const best = Math.max(...streams.map(scoreStream));
+  const candidates = streams.filter((stream) => scoreStream(stream) === best);
+
+  if (preferredQuality !== undefined && preferredQuality.length > 0) {
+    const needle = preferredQuality.toLowerCase();
+    const match = candidates.find((stream) => stream.quality.toLowerCase().includes(needle));
+    if (match) return match;
+  }
+  return candidates[0] ?? null;
+}
@@ -0,0 +1,71 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { interleave, mapSourcesConcurrently } from './multi-source-search';
+
+const source = (id: string) => ({ id, name: `Source ${id}` });
+
+test('mapSourcesConcurrently returns results in source order, not completion order', async () => {
+  const sources = [source('a'), source('b'), source('c')];
+  const delays: Record<string, number> = { a: 20, b: 0, c: 10 };
+
+  const { results, failures } = await mapSourcesConcurrently(sources, async (target) => {
+    await new Promise((resolve) => setTimeout(resolve, delays[target.id]));
+    return target.id;
+  });
+
+  assert.deepEqual(results, ['a', 'b', 'c']);
+  assert.deepEqual(failures, []);
+});
+
+test('a failing source is reported without losing the others', async () => {
+  const sources = [source('a'), source('b'), source('c')];
+
+  const { results, failures } = await mapSourcesConcurrently(sources, async (target) => {
+    if (target.id === 'b') throw new Error('login required');
+    return target.id;
+  });
+
+  assert.deepEqual(results, ['a', 'c']);
+  assert.deepEqual(failures, [{ sourceId: 'b', sourceName: 'Source b', error: 'login required' }]);
+});
+
+test('mapSourcesConcurrently never runs more than the concurrency limit at once', async () => {
+  const sources = ['a', 'b', 'c', 'd', 'e'].map(source);
+  let running = 0;
+  let peak = 0;
+
+  await mapSourcesConcurrently(
+    sources,
+    async () => {
+      running += 1;
+      peak = Math.max(peak, running);
+      await new Promise((resolve) => setTimeout(resolve, 5));
+      running -= 1;
+    },
+    2,
+  );
+
+  assert.equal(peak, 2);
+});
+
+test('mapSourcesConcurrently handles an empty source list', async () => {
+  const { results, failures } = await mapSourcesConcurrently([], async () => 'x');
+  assert.deepEqual(results, []);
+  assert.deepEqual(failures, []);
+});
+
+test('interleave takes one from each source before taking a second', () => {
+  assert.deepEqual(interleave([['a1', 'a2', 'a3'], ['b1'], ['c1', 'c2']]), [
+    'a1',
+    'b1',
+    'c1',
+    'a2',
+    'c2',
+    'a3',
+  ]);
+});
+
+test('interleave ignores empty groups', () => {
+  assert.deepEqual(interleave([[], ['b1', 'b2'], []]), ['b1', 'b2']);
+  assert.deepEqual(interleave([]), []);
+});
@@ -0,0 +1,85 @@
+import type { SourceSearchFailure } from '../types/anime-browser';
+
+/**
+ * Running one query against every installed source at once.
+ *
+ * Each source is a separate extension behind the same single-threaded bridge,
+ * so the fan-out is bounded rather than unleashed: a dozen extensions all
+ * uploading and searching at once starves the ones the user is waiting on.
+ */
+
+/** Enough to hide the latency of a slow source without queueing the bridge. */
+const DEFAULT_CONCURRENCY = 4;
+
+export interface SourceTarget {
+  id: string;
+  name: string;
+}
+
+export interface FanOutResult<T> {
+  /** One entry per source that succeeded, in source order. */
+  results: T[];
+  /** One entry per source that threw, in source order. */
+  failures: SourceSearchFailure[];
+}
+
+/**
+ * Run `task` against every source, at most `concurrency` at a time.
+ *
+ * A source that throws becomes a failure instead of rejecting the whole call —
+ * one misconfigured extension must not hide every other source's results.
+ */
+export async function mapSourcesConcurrently<S extends SourceTarget, T>(
+  sources: S[],
+  task: (source: S) => Promise<T>,
+  concurrency: number = DEFAULT_CONCURRENCY,
+): Promise<FanOutResult<T>> {
+  // Slots keep the output in source order regardless of completion order, so
+  // the same query lays out the same way twice.
+  const results: Array<{ value: T } | null> = sources.map(() => null);
+  const failures: Array<SourceSearchFailure | null> = sources.map(() => null);
+  let next = 0;
+
+  const worker = async (): Promise<void> => {
+    for (;;) {
+      const index = next;
+      next += 1;
+      const source = sources[index];
+      if (!source) return;
+      try {
+        results[index] = { value: await task(source) };
+      } catch (error) {
+        failures[index] = {
+          sourceId: source.id,
+          sourceName: source.name,
+          error: error instanceof Error ? error.message : String(error),
+        };
+      }
+    }
+  };
+
+  const workers = Math.max(1, Math.min(concurrency, sources.length));
+  await Promise.all(Array.from({ length: workers }, () => worker()));
+
+  return {
+    results: results
+      .filter((slot): slot is { value: T } => slot !== null)
+      .map((slot) => slot.value),
+    failures: failures.filter((slot): slot is SourceSearchFailure => slot !== null),
+  };
+}
+
+/**
+ * Round-robin merge, so the grid opens with one hit from each source rather
+ * than the whole of the first source before the second one starts.
+ */
+export function interleave<T>(groups: T[][]): T[] {
+  const merged: T[] = [];
+  const longest = groups.reduce((max, group) => Math.max(max, group.length), 0);
+  for (let index = 0; index < longest; index += 1) {
+    for (const group of groups) {
+      if (index < group.length) merged.push(group[index] as T);
+    }
+  }
+  return merged;
+}
@@ -0,0 +1,133 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { watchPlaybackOutcome, type PlaybackEndFileEvent } from './playback-outcome';
+
+type Harness = {
+  emitEndFile: (event: PlaybackEndFileEvent) => void;
+  listenerCount: () => number;
+  setProperty: (name: string, value: unknown) => void;
+  failProperty: (name: string) => void;
+  /** Virtual milliseconds burned so far, by sleeps and by property reads. */
+  elapsed: () => number;
+};
+
+/**
+ * The clock is virtual and only moves when the code under test sleeps (or,
+ * with `readCostMs`, when it reads a property), so timeout behaviour is
+ * asserted without any real waiting.
+ */
+function createHarness(overrides?: {
+  timeoutMs?: number;
+  probeIntervalMs?: number;
+  readCostMs?: number;
+}) {
+  const listeners = new Set<(event: PlaybackEndFileEvent) => void>();
+  const properties = new Map<string, unknown>();
+  const failing = new Set<string>();
+  const readCostMs = overrides?.readCostMs ?? 0;
+  let clock = 0;
+
+  const watch = watchPlaybackOutcome({
+    onEndFile: (listener) => {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    readProperty: async (name) => {
+      clock += readCostMs;
+      if (failing.has(name)) throw new Error(`Failed to read MPV property '${name}'`);
+      return properties.get(name);
+    },
+    wait: async (ms) => {
+      clock += ms;
+    },
+    now: () => clock,
+    timeoutMs: overrides?.timeoutMs ?? 1000,
+    probeIntervalMs: overrides?.probeIntervalMs ?? 100,
+  });
+
+  const harness: Harness = {
+    emitEndFile: (event) => {
+      for (const listener of listeners) listener(event);
+    },
+    listenerCount: () => listeners.size,
+    setProperty: (name, value) => properties.set(name, value),
+    failProperty: (name) => failing.add(name),
+    elapsed: () => clock,
+  };
+  return { watch, harness };
+}
+
+test('resolves ok once mpv configures a video output', async () => {
+  const { watch, harness } = createHarness();
+  harness.setProperty('vo-configured', true);
+  const outcome = await watch.wait();
+  assert.deepEqual(outcome, { ok: true });
+  watch.dispose();
+});
+
+test('resolves failure with the mpv error when the file ends in error', async () => {
+  const { watch, harness } = createHarness();
+  const pending = watch.wait();
+  harness.emitEndFile({ reason: 'error', fileError: 'no audio or video data played' });
+  const outcome = await pending;
+  assert.equal(outcome.ok, false);
+  assert.ok(!outcome.ok && outcome.error.includes('no audio or video data played'));
+  watch.dispose();
+});
+
+test('ignores the end-file fired for the file being replaced', async () => {
+  const { watch, harness } = createHarness();
+  const pending = watch.wait();
+  harness.emitEndFile({ reason: 'stop', fileError: null });
+  harness.setProperty('vo-configured', true);
+  const outcome = await pending;
+  assert.deepEqual(outcome, { ok: true });
+  watch.dispose();
+});
+
+test('times out with a failure when nothing ever starts', async () => {
+  const { watch, harness } = createHarness({ timeoutMs: 300, probeIntervalMs: 100 });
+  const outcome = await watch.wait();
+  assert.equal(outcome.ok, false);
+  assert.ok(!outcome.ok && outcome.error.length > 0);
+  assert.equal(harness.elapsed(), 300);
+  watch.dispose();
+});
+
+test('slow property reads eat the budget instead of extending it', async () => {
+  const { watch, harness } = createHarness({
+    timeoutMs: 300,
+    probeIntervalMs: 100,
+    readCostMs: 250,
+  });
+  const outcome = await watch.wait();
+  assert.equal(outcome.ok, false);
+  // Two probes: 250 + 50 (the sleep clamped to what was left) then 250 again.
+  assert.ok(harness.elapsed() >= 300, 'gave up before the timeout');
+  assert.ok(harness.elapsed() < 900, 'read delays stretched the timeout');
+  watch.dispose();
+});
+
+test('a zero probe interval still terminates at the deadline', async () => {
+  const { watch } = createHarness({ timeoutMs: 200, probeIntervalMs: 0, readCostMs: 50 });
+  const outcome = await watch.wait();
+  assert.equal(outcome.ok, false);
+  watch.dispose();
+});
+
+test('keeps polling through property read failures', async () => {
+  const { watch, harness } = createHarness();
+  harness.failProperty('vo-configured');
+  const pending = watch.wait();
+  harness.emitEndFile({ reason: 'error', fileError: null });
+  const outcome = await pending;
+  assert.equal(outcome.ok, false);
+  watch.dispose();
+});
+
+test('dispose removes the end-file subscription', () => {
+  const { watch, harness } = createHarness();
+  assert.equal(harness.listenerCount(), 1);
+  watch.dispose();
+  assert.equal(harness.listenerCount(), 0);
+});
@@ -0,0 +1,89 @@
+/**
+ * Confirms that a `loadfile` handed to mpv actually turned into playback.
+ *
+ * Sending the command proves nothing: mpv accepts the file, fails to decode it
+ * (a dead host, a disguised stream the proxy could not fix), fires `end-file`
+ * with reason "error", and drops back to `--idle` — with no window, because
+ * idle mpv shows none. The UI would happily say "Playing" over a blank desktop.
+ *
+ * Success is mpv configuring a video output (`vo-configured`), which is
+ * literally "a window with frames in it". `file-loaded` is not enough — the
+ * broken stream in the wild reached it before dying. Failure is an `end-file`
+ * with reason "error"; the end-file of the file being *replaced* arrives with
+ * "stop"/"redirect" and is ignored.
+ */
+
+export interface PlaybackEndFileEvent {
+  reason: string;
+  fileError: string | null;
+}
+
+export type PlaybackOutcome = { ok: true } | { ok: false; error: string };
+
+export interface WatchPlaybackOutcomeDeps {
+  /** Subscribe to mpv end-file events; returns the unsubscribe. */
+  onEndFile: (listener: (event: PlaybackEndFileEvent) => void) => () => void;
+  /** One-shot mpv property read; may reject while the file is still loading. */
+  readProperty: (name: string) => Promise<unknown>;
+  wait: (ms: number) => Promise<void>;
+  /** Injectable clock; the timeout is wall-clock, not a probe count. */
+  now?: () => number;
+  timeoutMs?: number;
+  probeIntervalMs?: number;
+}
+
+export interface PlaybackOutcomeWatch {
+  wait: () => Promise<PlaybackOutcome>;
+  dispose: () => void;
+}
+
+export const DEFAULT_PLAYBACK_OUTCOME_TIMEOUT_MS = 20_000;
+const DEFAULT_PROBE_INTERVAL_MS = 500;
+
+/**
+ * Call *before* sending `loadfile` so the error subscription cannot lose a
+ * race against a fast failure; await `wait()` after the commands went out.
+ */
+export function watchPlaybackOutcome(deps: WatchPlaybackOutcomeDeps): PlaybackOutcomeWatch {
+  const timeoutMs = deps.timeoutMs ?? DEFAULT_PLAYBACK_OUTCOME_TIMEOUT_MS;
+  const probeIntervalMs = deps.probeIntervalMs ?? DEFAULT_PROBE_INTERVAL_MS;
+
+  let failure: PlaybackOutcome | null = null;
+  const unsubscribe = deps.onEndFile((event) => {
+    if (event.reason !== 'error') return;
+    failure = {
+      ok: false,
+      error: event.fileError
+        ? `mpv could not play this stream: ${event.fileError}`
+        : 'mpv could not play this stream.',
+    };
+  });
+
+  async function wait(): Promise<PlaybackOutcome> {
+    // Wall-clock, not a probe count: a slow `readProperty` must eat into the
+    // budget rather than stretch it, and a zero probe interval must still end.
+    const now = deps.now ?? Date.now;
+    const deadline = now() + timeoutMs;
+    while (now() < deadline) {
+      if (failure) return failure;
+      try {
+        if ((await deps.readProperty('vo-configured')) === true) return { ok: true };
+      } catch {
+        // The property is unreadable while mpv is between files; keep polling.
+      }
+      if (failure) return failure;
+      // Sleeping past the deadline would only delay the timeout report.
+      const remaining = deadline - now();
+      if (remaining <= 0) break;
+      await deps.wait(Math.min(probeIntervalMs, remaining));
+    }
+    return (
+      failure ?? {
+        ok: false,
+        error: 'Playback did not start. mpv gave no error; try another server or quality.',
+      }
+    );
+  }
+
+  return { wait, dispose: unsubscribe };
+}
@@ -0,0 +1,128 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { chmod, mkdtemp, readFile, readdir, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { PreferenceStore } from './preference-store';
+
+async function storeFile(): Promise<string> {
+  const dir = await mkdtemp(path.join(tmpdir(), 'subminer-prefs-'));
+  return path.join(dir, 'anime-preferences.json');
+}
+
+test('values round-trip through the file', async () => {
+  const file = await storeFile();
+  await new PreferenceStore(file).set('pkg', 'src-1', [{ key: 'address' }]);
+
+  assert.deepEqual(await new PreferenceStore(file).get('pkg', 'src-1'), [{ key: 'address' }]);
+});
+
+test('the same bridge source id is isolated between extension packages', async () => {
+  const file = await storeFile();
+  const store = new PreferenceStore(file);
+
+  await store.set('pkg.one', 'shared-source', [{ key: 'password', value: 'one-secret' }]);
+  await store.set('pkg.two', 'shared-source', [{ key: 'password', value: 'two-secret' }]);
+
+  const reloaded = new PreferenceStore(file);
+  assert.deepEqual(await reloaded.get('pkg.one', 'shared-source'), [
+    { key: 'password', value: 'one-secret' },
+  ]);
+  assert.deepEqual(await reloaded.get('pkg.two', 'shared-source'), [
+    { key: 'password', value: 'two-secret' },
+  ]);
+});
+
+test('a legacy bare source id is discarded rather than assigned to an unproven package', async () => {
+  const file = await storeFile();
+  await writeFile(file, JSON.stringify({ 'legacy-source': [{ key: 'address', value: 'saved' }] }));
+
+  const store = new PreferenceStore(file);
+  assert.deepEqual(await store.get('pkg.one', 'legacy-source'), []);
+
+  const persisted = JSON.parse(await readFile(file, 'utf8')) as Record<string, unknown>;
+  assert.equal(persisted['legacy-source'], undefined);
+  assert.equal(persisted['pkg.one:legacy-source'], undefined);
+});
+
+test('an ambiguous legacy source id is discarded instead of exposed to either package', async () => {
+  const file = await storeFile();
+  await writeFile(file, JSON.stringify({ shared: [{ key: 'password', value: 'old-secret' }] }));
+
+  const store = new PreferenceStore(file);
+  assert.deepEqual(await store.get('pkg.one', 'shared'), []);
+  assert.deepEqual(await store.get('pkg.two', 'shared'), []);
+
+  const persisted = JSON.parse(await readFile(file, 'utf8')) as Record<string, unknown>;
+  assert.equal(persisted.shared, undefined);
+});
+
+test('concurrent writes on a cold cache do not lose an update', async () => {
+  const file = await storeFile();
+  const store = new PreferenceStore(file);
+
+  // Both start before either has loaded; unserialized they would each get their
+  // own object and the later persist would drop the other's entry.
+  await Promise.all([
+    store.set('pkg', 'src-1', [{ key: 'a' }]),
+    store.set('pkg', 'src-2', [{ key: 'b' }]),
+  ]);
+
+  const reloaded = new PreferenceStore(file);
+  assert.deepEqual(await reloaded.get('pkg', 'src-1'), [{ key: 'a' }]);
+  assert.deepEqual(await reloaded.get('pkg', 'src-2'), [{ key: 'b' }]);
+});
+
+test('a clear racing a set is applied in order', async () => {
+  const file = await storeFile();
+  const store = new PreferenceStore(file);
+  await store.set('pkg', 'src', [{ key: 'password' }]);
+
+  await Promise.all([store.clear('pkg'), store.set('other', 'src', [{ key: 'x' }])]);
+
+  const reloaded = new PreferenceStore(file);
+  assert.deepEqual(await reloaded.get('pkg', 'src'), []);
+  assert.deepEqual(await reloaded.get('other', 'src'), [{ key: 'x' }]);
+});
+
+test('the file is written owner-only even when an existing temporary file is permissive', async () => {
+  const file = await storeFile();
+  await writeFile(`${file}.tmp`, 'stale');
+  await chmod(`${file}.tmp`, 0o666);
+  await new PreferenceStore(file).set('pkg', 'src-1', [{ key: 'password' }]);
+
+  assert.equal((await stat(file)).mode & 0o777, 0o600);
+  assert.deepEqual(await readdir(path.dirname(file)), [path.basename(file)]);
+});
+
+test('a corrupt file starts empty rather than blocking the browser', async () => {
+  const file = await storeFile();
+  await writeFile(file, '{ not json');
+
+  assert.deepEqual(await new PreferenceStore(file).get('pkg', 'src-1'), []);
+});
+
+test('malformed persisted values are filtered to preference objects with string keys', async () => {
+  const file = await storeFile();
+  await writeFile(
+    file,
+    JSON.stringify({
+      'pkg:source': [null, { key: 42 }, 'bad', { key: 'valid', value: 'kept' }],
+      'pkg:not-an-array': { key: 'invalid-container' },
+    }),
+  );
+
+  const store = new PreferenceStore(file);
+  assert.deepEqual(await store.get('pkg', 'source'), [{ key: 'valid', value: 'kept' }]);
+  assert.deepEqual(await store.get('pkg', 'not-an-array'), []);
+});
+
+test('a write replaces the previous contents wholesale', async () => {
+  const file = await storeFile();
+  const store = new PreferenceStore(file);
+  await store.set('pkg', 'src-1', [{ key: 'first' }]);
+  await store.set('pkg', 'src-1', [{ key: 'second' }]);
+
+  const parsed = JSON.parse(await readFile(file, 'utf8')) as Record<string, unknown[]>;
+  assert.deepEqual(parsed['pkg:src-1'], [{ key: 'second' }]);
+});
@@ -0,0 +1,130 @@
+import { chmod, readFile, writeFile, rename, rm, mkdir } from 'node:fs/promises';
+import path from 'node:path';
+import type { BridgePreference } from './types';
+
+function parseStoredPreferences(value: unknown): Record<string, BridgePreference[]> {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return {};
+
+  const parsed: Record<string, BridgePreference[]> = {};
+  for (const [key, entries] of Object.entries(value)) {
+    if (!Array.isArray(entries)) continue;
+    parsed[key] = entries.filter(
+      (entry): entry is BridgePreference =>
+        entry !== null &&
+        typeof entry === 'object' &&
+        !Array.isArray(entry) &&
+        typeof (entry as Record<string, unknown>).key === 'string',
+    );
+  }
+  return parsed;
+}
+
+/**
+ * Persists each source's preference array verbatim, keyed by extension package
+ * and bridge source id.
+ *
+ * Extensions keep credentials in here (the Jellyfin source stores a password),
+ * so the file is written with owner-only permissions.
+ */
+export class PreferenceStore {
+  private readonly file: string;
+  private cache: Record<string, BridgePreference[]> | null = null;
+  /**
+   * Mutations run one at a time. Two concurrent load-modify-persist cycles
+   * starting on a cold cache would each read their own object, and the later
+   * write would drop the earlier one's edit.
+   */
+  private queue: Promise<unknown> = Promise.resolve();
+
+  constructor(file: string) {
+    this.file = file;
+  }
+
+  private enqueue<T>(operation: () => Promise<T>): Promise<T> {
+    const result = this.queue.then(operation, operation);
+    // Keep the chain alive after a rejection so one failure cannot wedge it.
+    this.queue = result.catch(() => undefined);
+    return result;
+  }
+
+  private async load(): Promise<Record<string, BridgePreference[]>> {
+    if (this.cache !== null) return this.cache;
+    try {
+      const parsed = JSON.parse(await readFile(this.file, 'utf8')) as unknown;
+      this.cache = parseStoredPreferences(parsed);
+    } catch {
+      // Missing or corrupt file starts empty rather than blocking the browser.
+      this.cache = {};
+    }
+    return this.cache;
+  }
+
+  async get(pkg: string, sourceId: string): Promise<BridgePreference[]> {
+    return this.enqueue(async () => {
+      const all = await this.load();
+      const key = `${pkg}:${sourceId}`;
+      if (all[key]) return all[key];
+
+      // Bare source IDs predate package scoping and have no trustworthy owner.
+      // Never assign their credentials to whichever package happens to ask first.
+      const legacy = all[sourceId];
+      if (legacy) {
+        delete all[sourceId];
+        await this.persist(all);
+      }
+      return [];
+    });
+  }
+
+  async set(pkg: string, sourceId: string, preferences: BridgePreference[]): Promise<void> {
+    await this.enqueue(async () => {
+      const all = await this.load();
+      all[`${pkg}:${sourceId}`] = preferences;
+      await this.persist(all);
+    });
+  }
+
+  /**
+   * Drop every saved value whose key starts with `prefix`.
+   *
+   * Removing an extension should not leave its credentials on disk, and a
+   * source id is not knowable once the APK is gone — so callers pass the
+   * package name and this clears anything recorded under it.
+   */
+  async clear(prefix: string): Promise<void> {
+    await this.enqueue(async () => {
+      const all = await this.load();
+      let changed = false;
+      for (const key of Object.keys(all)) {
+        if (key === prefix || key.startsWith(`${prefix}:`)) {
+          delete all[key];
+          changed = true;
+        }
+      }
+      if (changed) await this.persist(all);
+    });
+  }
+
+  /**
+   * Write through a temporary file and rename into place.
+   *
+   * A write interrupted partway would otherwise leave truncated JSON, and
+   * `load()` treats unparseable content as empty — which would quietly discard
+   * every saved credential.
+   */
+  private async persist(all: Record<string, BridgePreference[]>): Promise<void> {
+    await mkdir(path.dirname(this.file), { recursive: true });
+    const temporary = `${this.file}.tmp`;
+    try {
+      await chmod(temporary, 0o600).catch((error: NodeJS.ErrnoException) => {
+        if (error.code !== 'ENOENT') throw error;
+      });
+      await writeFile(temporary, JSON.stringify(all, null, 2), { mode: 0o600 });
+      await chmod(temporary, 0o600);
+      await rename(temporary, this.file);
+    } catch (error) {
+      await rm(temporary, { force: true }).catch(() => undefined);
+      throw error;
+    }
+  }
+}
@@ -0,0 +1,143 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  applyPreferenceValue,
+  isSecretPreference,
+  parsePreferences,
+  type SourcePreferenceView,
+} from './preferences';
+import type { BridgePreference } from './types';
+
+// Shapes taken from the real Jellyfin extension's preferencesAnime response.
+const RAW: BridgePreference[] = [
+  {
+    key: 'host_url',
+    editTextPreference: {
+      title: 'Address',
+      summary: 'The server address',
+      value: '',
+      text: '',
+    },
+  },
+  {
+    key: 'password',
+    editTextPreference: { title: 'Password', summary: 'The user account password', value: '' },
+  },
+  {
+    key: 'pref_quality',
+    listPreference: {
+      title: 'Preferred quality',
+      summary: 'Preferred quality.',
+      valueIndex: 0,
+      entries: ['Source', '20 Mbps'],
+      entryValues: ['source', '20000000'],
+    },
+  },
+  {
+    key: 'pref_episode_details_key',
+    multiSelectListPreference: {
+      title: 'Additional details for episodes',
+      values: [],
+      entries: ['Overview', 'Runtime'],
+      entryValues: ['overview', 'runtime'],
+    },
+  },
+  {
+    key: 'pref_trust_cert',
+    switchPreferenceCompat: { title: 'Trust certificate', value: false },
+  },
+];
+
+function view(views: SourcePreferenceView[], key: string): SourcePreferenceView {
+  const found = views.find((candidate) => candidate.key === key);
+  assert.ok(found, `missing preference ${key}`);
+  return found;
+}
+
+test('parsePreferences flattens each widget type', () => {
+  const views = parsePreferences(RAW);
+  assert.equal(views.length, 5);
+
+  assert.equal(view(views, 'host_url').kind, 'text');
+  assert.equal(view(views, 'host_url').title, 'Address');
+  assert.equal(view(views, 'host_url').value, '');
+
+  const quality = view(views, 'pref_quality');
+  assert.equal(quality.kind, 'list');
+  // valueIndex 0 resolves through entryValues, not entries.
+  assert.equal(quality.value, 'source');
+  assert.deepEqual(quality.entries, ['Source', '20 Mbps']);
+
+  assert.deepEqual(view(views, 'pref_episode_details_key').value, []);
+  assert.equal(view(views, 'pref_trust_cert').value, false);
+});
+
+test('parsePreferences skips the bridge context entry and unknown widgets', () => {
+  const views = parsePreferences([
+    { key: '__mangatan_bridge_context__', sourceId: '1' },
+    { key: 'mystery', someFutureWidget: { title: 'X' } },
+    ...RAW.slice(0, 1),
+  ]);
+  assert.deepEqual(
+    views.map((v) => v.key),
+    ['host_url'],
+  );
+});
+
+test('a list preference with no selection reads as empty', () => {
+  const views = parsePreferences([
+    {
+      key: 'library_pref',
+      listPreference: {
+        title: 'Select media library',
+        valueIndex: -1,
+        entries: [],
+        entryValues: [],
+      },
+    },
+  ]);
+  assert.equal(view(views, 'library_pref').value, '');
+});
+
+test('applyPreferenceValue writes text into both value and text', () => {
+  const updated = applyPreferenceValue(RAW, 'host_url', 'https://media.example');
+  const body = updated.find((e) => e.key === 'host_url')!.editTextPreference as Record<
+    string,
+    unknown
+  >;
+  assert.equal(body.value, 'https://media.example');
+  assert.equal(body.text, 'https://media.example');
+  // Other entries are untouched.
+  assert.equal(parsePreferences(updated).length, RAW.length);
+});
+
+test('applyPreferenceValue moves a list preference by entry value', () => {
+  const updated = applyPreferenceValue(RAW, 'pref_quality', '20000000');
+  const body = updated.find((e) => e.key === 'pref_quality')!.listPreference as Record<
+    string,
+    unknown
+  >;
+  assert.equal(body.valueIndex, 1);
+  assert.equal(parsePreferences(updated).find((v) => v.key === 'pref_quality')?.value, '20000000');
+});
+
+test('applyPreferenceValue handles multi-select and switch widgets', () => {
+  const multi = applyPreferenceValue(RAW, 'pref_episode_details_key', ['overview']);
+  assert.deepEqual(
+    parsePreferences(multi).find((v) => v.key === 'pref_episode_details_key')?.value,
+    ['overview'],
+  );
+
+  const toggled = applyPreferenceValue(RAW, 'pref_trust_cert', true);
+  assert.equal(parsePreferences(toggled).find((v) => v.key === 'pref_trust_cert')?.value, true);
+});
+
+test('applyPreferenceValue leaves unknown keys alone', () => {
+  assert.deepEqual(applyPreferenceValue(RAW, 'not-a-key', 'x'), RAW);
+});
+
+test('secrets are recognised by key or title', () => {
+  const views = parsePreferences(RAW);
+  assert.equal(isSecretPreference(view(views, 'password')), true);
+  assert.equal(isSecretPreference(view(views, 'host_url')), false);
+});
@@ -0,0 +1,132 @@
+import type { BridgePreference } from './types';
+
+/**
+ * Extension preferences arrive as Android preference objects, one wrapper key
+ * per widget type. They are stored and sent back verbatim so the extension sees
+ * exactly the shape it produced; only the value field is edited.
+ */
+
+export type PreferenceKind = 'text' | 'list' | 'multi' | 'switch';
+
+/** A preference flattened for rendering. */
+export interface SourcePreferenceView {
+  key: string;
+  kind: PreferenceKind;
+  title: string;
+  summary: string | null;
+  /** Current value: string for text/list, string[] for multi, boolean for switch. */
+  value: string | string[] | boolean;
+  /** Display labels, parallel to entryValues. Empty for text/switch. */
+  entries: string[];
+  entryValues: string[];
+}
+
+const WIDGETS = {
+  editTextPreference: 'text',
+  listPreference: 'list',
+  multiSelectListPreference: 'multi',
+  switchPreferenceCompat: 'switch',
+  checkBoxPreference: 'switch',
+} as const satisfies Record<string, PreferenceKind>;
+
+type WidgetName = keyof typeof WIDGETS;
+
+function widgetOf(
+  entry: BridgePreference,
+): { name: WidgetName; body: Record<string, unknown> } | null {
+  for (const name of Object.keys(WIDGETS) as WidgetName[]) {
+    const body = entry[name];
+    if (body !== null && typeof body === 'object') {
+      return { name, body: body as Record<string, unknown> };
+    }
+  }
+  return null;
+}
+
+function stringList(value: unknown): string[] {
+  return Array.isArray(value)
+    ? value.filter((item): item is string => typeof item === 'string')
+    : [];
+}
+
+/** Flatten bridge preference entries for display. Unknown widgets are skipped. */
+export function parsePreferences(raw: BridgePreference[]): SourcePreferenceView[] {
+  const views: SourcePreferenceView[] = [];
+
+  for (const entry of raw) {
+    if (typeof entry.key !== 'string' || entry.key.startsWith('__')) continue;
+    const widget = widgetOf(entry);
+    if (!widget) continue;
+
+    const { body } = widget;
+    const kind = WIDGETS[widget.name];
+    const entries = stringList(body.entries);
+    const entryValues = stringList(body.entryValues);
+
+    let value: string | string[] | boolean;
+    if (kind === 'multi') {
+      value = stringList(body.values);
+    } else if (kind === 'switch') {
+      value = body.value === true;
+    } else if (kind === 'list') {
+      const index = typeof body.valueIndex === 'number' ? body.valueIndex : -1;
+      // valueIndex is -1 when the extension has no selection yet.
+      value = index >= 0 && index < entryValues.length ? entryValues[index]! : '';
+    } else {
+      value = typeof body.value === 'string' ? body.value : '';
+    }
+
+    views.push({
+      key: entry.key,
+      kind,
+      title: typeof body.title === 'string' ? body.title : entry.key,
+      summary: typeof body.summary === 'string' ? body.summary : null,
+      value,
+      entries,
+      entryValues,
+    });
+  }
+
+  return views;
+}
+
+/**
+ * Return a copy of `raw` with one preference's value replaced, in whichever
+ * fields that widget type reads. Unknown keys are returned unchanged.
+ */
+export function applyPreferenceValue(
+  raw: BridgePreference[],
+  key: string,
+  value: string | string[] | boolean,
+): BridgePreference[] {
+  return raw.map((entry) => {
+    if (entry.key !== key) return entry;
+    const widget = widgetOf(entry);
+    if (!widget) return entry;
+
+    const body = { ...widget.body };
+    const kind = WIDGETS[widget.name];
+
+    if (kind === 'multi') {
+      body.values = Array.isArray(value) ? value : [];
+    } else if (kind === 'switch') {
+      body.value = value === true;
+    } else if (kind === 'list') {
+      const entryValues = stringList(body.entryValues);
+      const index = entryValues.indexOf(String(value));
+      body.valueIndex = index;
+      if (index >= 0) body.value = entryValues[index];
+    } else {
+      // editTextPreference carries the same string in both value and text.
+      body.value = String(value);
+      body.text = String(value);
+    }
+
+    return { ...entry, [widget.name]: body };
+  });
+}
+
+/** True when the preference should be masked in the UI and in logs. */
+export function isSecretPreference(view: SourcePreferenceView): boolean {
+  return /password|token|api[-_ ]?key|secret/i.test(`${view.key} ${view.title}`);
+}
@@ -0,0 +1,159 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import {
+  bundleReleaseUrl,
+  findBundleBinaries,
+  PINNED_BUNDLE_SHA256,
+  PINNED_BUNDLE_TAG,
+  resolveBundleAssetName,
+  selectBundleAsset,
+  sha256,
+  verifyPinnedBundle,
+} from './sidecar-bundle';
+
+test('resolveBundleAssetName maps supported platform/arch pairs', () => {
+  assert.equal(resolveBundleAssetName('darwin', 'arm64'), 'macOS-arm64-bundle.zip');
+  assert.equal(resolveBundleAssetName('darwin', 'x64'), 'macOS-x64-bundle.zip');
+  assert.equal(resolveBundleAssetName('linux', 'x64'), 'linux-x64-bundle.zip');
+  assert.equal(resolveBundleAssetName('win32', 'x64'), 'windows-x64-bundle.zip');
+});
+
+test('resolveBundleAssetName returns null for unpublished combinations', () => {
+  assert.equal(resolveBundleAssetName('linux', 'arm64'), null);
+  assert.equal(resolveBundleAssetName('win32', 'arm64'), null);
+  assert.equal(resolveBundleAssetName('freebsd', 'x64'), null);
+});
+
+const PINNED_RELEASE = {
+  tag_name: PINNED_BUNDLE_TAG,
+  assets: [
+    {
+      name: 'macOS-arm64-bundle.zip',
+      browser_download_url: 'https://example.test/macOS-arm64-bundle.zip',
+      size: 133_058_560,
+    },
+  ],
+};
+
+test('selectBundleAsset reads the by-tag endpoint payload', () => {
+  const asset = selectBundleAsset(PINNED_RELEASE, 'macOS-arm64-bundle.zip');
+  assert.equal(asset?.tagName, PINNED_BUNDLE_TAG);
+  assert.equal(asset?.downloadUrl, 'https://example.test/macOS-arm64-bundle.zip');
+  assert.equal(asset?.sizeBytes, 133_058_560);
+});
+
+test('selectBundleAsset skips releases without a matching asset', () => {
+  const releases = [
+    // The iOS runtime release carries no desktop bundle.
+    { tag_name: 'ios-runtime-v7', assets: [{ name: 'MExtensionServer-ios.jar' }] },
+    PINNED_RELEASE,
+  ];
+
+  const asset = selectBundleAsset(releases, 'macOS-arm64-bundle.zip');
+  assert.equal(asset?.tagName, PINNED_BUNDLE_TAG);
+});
+
+test('selectBundleAsset ignores releases newer than the pin', () => {
+  const releases = [
+    {
+      tag_name: 'v9.9.9.9',
+      assets: [
+        {
+          name: 'macOS-arm64-bundle.zip',
+          browser_download_url: 'https://example.test/unpinned.zip',
+          size: 1,
+        },
+      ],
+    },
+    PINNED_RELEASE,
+  ];
+
+  const asset = selectBundleAsset(releases, 'macOS-arm64-bundle.zip');
+  assert.equal(asset?.tagName, PINNED_BUNDLE_TAG);
+  assert.equal(asset?.downloadUrl, 'https://example.test/macOS-arm64-bundle.zip');
+});
+
+test('selectBundleAsset returns null when nothing matches', () => {
+  assert.equal(
+    selectBundleAsset([{ tag_name: PINNED_BUNDLE_TAG, assets: [] }], 'linux-x64-bundle.zip'),
+    null,
+  );
+  assert.equal(selectBundleAsset([], 'linux-x64-bundle.zip'), null);
+  assert.equal(selectBundleAsset({ message: 'rate limited' }, 'linux-x64-bundle.zip'), null);
+});
+
+test('bundleReleaseUrl targets the pinned tag', () => {
+  assert.equal(
+    bundleReleaseUrl(),
+    `https://api.github.com/repos/1Selxo/M-Extension-Server/releases/tags/${PINNED_BUNDLE_TAG}`,
+  );
+});
+
+test('findBundleBinaries locates the nested jre and jar', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'subminer-bundle-'));
+  await mkdir(path.join(root, 'jre', 'jre', 'bin'), { recursive: true });
+  await writeFile(path.join(root, 'jre', 'jre', 'bin', 'java'), '');
+  await writeFile(path.join(root, 'MExtensionServer-1.0.6.0.jar'), '');
+
+  const binaries = await findBundleBinaries(root);
+  assert.equal(binaries?.javaPath, path.join(root, 'jre', 'jre', 'bin', 'java'));
+  assert.equal(binaries?.jarPath, path.join(root, 'MExtensionServer-1.0.6.0.jar'));
+});
+
+test('findBundleBinaries prefers the shallowest java when a nested copy exists', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'subminer-bundle-'));
+  await mkdir(path.join(root, 'bin'), { recursive: true });
+  await mkdir(path.join(root, 'bin', 'nested', 'bin'), { recursive: true });
+  await writeFile(path.join(root, 'bin', 'java'), '');
+  await writeFile(path.join(root, 'bin', 'nested', 'bin', 'java'), '');
+  await writeFile(path.join(root, 'MExtensionServer.jar'), '');
+
+  const binaries = await findBundleBinaries(root);
+  assert.equal(binaries?.javaPath, path.join(root, 'bin', 'java'));
+});
+
+test('findBundleBinaries returns null when the bundle is incomplete', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'subminer-bundle-'));
+  await writeFile(path.join(root, 'MExtensionServer.jar'), '');
+  assert.equal(await findBundleBinaries(root), null);
+});
+
+test('sha256 produces lowercase hex digests matching known vectors', () => {
+  const encode = (value: string) => new TextEncoder().encode(value);
+  assert.equal(
+    sha256(encode('')),
+    'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
+  );
+  assert.equal(
+    sha256(encode('subminer')),
+    'f3b7fdb2037add4cd8f122c090a727243b46b1b9d8a6c379f71573e2df120885',
+  );
+});
+
+test('verifyPinnedBundle accepts a matching hash and rejects a mismatch', () => {
+  const asset = 'macOS-arm64-bundle.zip';
+  const wrong = verifyPinnedBundle(asset, new TextEncoder().encode('not the bundle'));
+  assert.equal(wrong.ok, false);
+  assert.match((wrong as { reason: string }).reason, /Checksum mismatch/);
+});
+
+test('verifyPinnedBundle refuses an asset that has no pin', () => {
+  const result = verifyPinnedBundle('windows-x64-bundle.zip', new Uint8Array([1, 2, 3]));
+  assert.equal(result.ok, false);
+  assert.match((result as { reason: string }).reason, /No pinned checksum/);
+});
+
+test('the pinned tag and hashes are the verified release', () => {
+  assert.equal(PINNED_BUNDLE_TAG, 'v1.0.6.0');
+  assert.equal(
+    PINNED_BUNDLE_SHA256['macOS-arm64-bundle.zip'],
+    '5f4fb03abfe88bc46ddf5f4d8221156ee2d66b9cbad7c4bc3ade4baf3a4266e6',
+  );
+  assert.equal(
+    PINNED_BUNDLE_SHA256['linux-x64-bundle.zip'],
+    'c2b869d3905b06a308517fec0b44f70ff76f7212230c60710bba39a7025c3a69',
+  );
+});
@@ -0,0 +1,169 @@
+import { createHash } from 'node:crypto';
+import { readdir, stat } from 'node:fs/promises';
+import path from 'node:path';
+
+/**
+ * Locates the M-Extension-Server release bundle for the host platform. Each
+ * bundle ships a matching JRE alongside the server JAR, so no system JDK is
+ * required.
+ */
+
+const BUNDLE_REPO_API = 'https://api.github.com/repos/1Selxo/M-Extension-Server';
+
+/**
+ * Fetch the pinned release by tag rather than listing releases: upstream ships
+ * several a week, so a paged list would scroll the pinned tag off page one.
+ */
+export function bundleReleaseUrl(tagName: string = PINNED_BUNDLE_TAG): string {
+  return `${BUNDLE_REPO_API}/releases/tags/${encodeURIComponent(tagName)}`;
+}
+
+/**
+ * The bridge release this integration was verified against.
+ *
+ * Upstream publishes no checksums for the desktop bundles, so we pin a tag and
+ * a hash we computed ourselves rather than tracking "latest". Bumping this
+ * means downloading the new asset, verifying it starts and reports the
+ * capabilities in `AnimeBridgeClient.isReady`, then updating both fields.
+ */
+export const PINNED_BUNDLE_TAG = 'v1.0.6.0';
+
+/** SHA-256 of each pinned asset, keyed by release asset name. */
+export const PINNED_BUNDLE_SHA256: Readonly<Record<string, string>> = {
+  'macOS-arm64-bundle.zip': '5f4fb03abfe88bc46ddf5f4d8221156ee2d66b9cbad7c4bc3ade4baf3a4266e6',
+  'linux-x64-bundle.zip': 'c2b869d3905b06a308517fec0b44f70ff76f7212230c60710bba39a7025c3a69',
+};
+
+/**
+ * Check a downloaded asset against its pin. Assets we have not verified
+ * ourselves are rejected rather than trusted, so an unpinned platform fails
+ * loudly instead of silently running an unchecked binary.
+ */
+export function verifyPinnedBundle(
+  assetName: string,
+  bytes: Uint8Array,
+): { ok: true } | { ok: false; reason: string } {
+  const expected = PINNED_BUNDLE_SHA256[assetName];
+  if (expected === undefined) {
+    return { ok: false, reason: `No pinned checksum for ${assetName}; refusing to run it.` };
+  }
+  const actual = sha256(bytes);
+  if (actual !== expected) {
+    return {
+      ok: false,
+      reason: `Checksum mismatch for ${assetName}: expected ${expected}, got ${actual}.`,
+    };
+  }
+  return { ok: true };
+}
+
+/** Release asset name for a platform/arch pair, or null when unsupported. */
+export function resolveBundleAssetName(platform: string, arch: string): string | null {
+  if (platform === 'linux') return arch === 'x64' ? 'linux-x64-bundle.zip' : null;
+  if (platform === 'win32') return arch === 'x64' ? 'windows-x64-bundle.zip' : null;
+  if (platform === 'darwin') {
+    if (arch === 'arm64') return 'macOS-arm64-bundle.zip';
+    if (arch === 'x64') return 'macOS-x64-bundle.zip';
+  }
+  return null;
+}
+
+export interface BundleBinaries {
+  javaPath: string;
+  jarPath: string;
+}
+
+async function walk(dir: string, depth: number, onFile: (file: string) => void): Promise<void> {
+  if (depth < 0) return;
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) await walk(full, depth - 1, onFile);
+    else onFile(full);
+  }
+}
+
+/**
+ * Find the bundled `java` executable and `MExtensionServer-*.jar` inside an
+ * extracted bundle. The archive nests them a few levels deep and the exact
+ * layout differs per platform, so this searches rather than assuming a path.
+ */
+export async function findBundleBinaries(rootDir: string): Promise<BundleBinaries | null> {
+  const javaCandidates: string[] = [];
+  const jarCandidates: string[] = [];
+
+  await walk(rootDir, 6, (file) => {
+    const base = path.basename(file);
+    if (base === 'java' || base === 'java.exe') javaCandidates.push(file);
+    else if (/^MExtensionServer.*\.jar$/.test(base)) jarCandidates.push(file);
+  });
+
+  // Prefer the shallowest match so a nested duplicate never shadows the real one.
+  const byDepth = (a: string, b: string) => a.split(path.sep).length - b.split(path.sep).length;
+  const javaPath = javaCandidates.sort(byDepth)[0];
+  const jarPath = jarCandidates.sort(byDepth)[0];
+  if (!javaPath || !jarPath) return null;
+  return { javaPath, jarPath };
+}
+
+/** Verify a downloaded archive against a pinned SHA-256, as Mangatan does. */
+export function sha256(bytes: Uint8Array): string {
+  return createHash('sha256').update(bytes).digest('hex');
+}
+
+export async function isExecutableFile(file: string): Promise<boolean> {
+  try {
+    const info = await stat(file);
+    return info.isFile();
+  } catch {
+    return false;
+  }
+}
+
+export interface BundleAsset {
+  tagName: string;
+  assetName: string;
+  downloadUrl: string;
+  sizeBytes: number;
+}
+
+interface GithubRelease {
+  tag_name?: string;
+  assets?: Array<{ name?: string; browser_download_url?: string; size?: number }>;
+}
+
+/**
+ * Pick the asset for this platform from the pinned release. Selecting "newest"
+ * instead would download a release whose checksum we never computed, so every
+ * upstream publish would break the install with a mismatch.
+ */
+export function selectBundleAsset(
+  releases: unknown,
+  assetName: string,
+  tagName: string = PINNED_BUNDLE_TAG,
+): BundleAsset | null {
+  // Accepts either a single release (the by-tag endpoint) or a list.
+  const candidates = Array.isArray(releases)
+    ? releases
+    : releases && typeof releases === 'object'
+      ? [releases]
+      : [];
+  for (const release of candidates as GithubRelease[]) {
+    if (release.tag_name !== tagName) continue;
+    const asset = release.assets?.find((candidate) => candidate.name === assetName);
+    if (asset?.browser_download_url && release.tag_name) {
+      return {
+        tagName: release.tag_name,
+        assetName,
+        downloadUrl: asset.browser_download_url,
+        sizeBytes: asset.size ?? 0,
+      };
+    }
+  }
+  return null;
+}
@@ -0,0 +1,130 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { EventEmitter } from 'node:events';
+import type { spawn as spawnType, ChildProcess } from 'node:child_process';
+import { allocatePort, startSidecar } from './sidecar-process';
+import type { BundleBinaries } from './sidecar-bundle';
+
+const binaries: BundleBinaries = {
+  javaPath: '/nonexistent/java',
+  jarPath: '/tmp/MExtensionServer.jar',
+};
+
+/**
+ * A ChildProcess stand-in: an EventEmitter with the bits startSidecar touches.
+ * A `pid` marks a child that did spawn, which is how a kill failure is told
+ * apart from a spawn failure.
+ */
+function fakeChild(onKill?: (child: EventEmitter) => void, pid?: number): ChildProcess {
+  const child = new EventEmitter();
+  Object.assign(child, {
+    stdout: null,
+    stderr: null,
+    pid,
+    kill: () => {
+      onKill?.(child);
+      return true;
+    },
+  });
+  return child as unknown as ChildProcess;
+}
+
+test('a failed spawn rejects instead of throwing an unhandled error event', async () => {
+  const port = await allocatePort();
+  const child = fakeChild();
+  const spawnImpl = (() => {
+    // Node emits `error` asynchronously when the binary cannot be executed.
+    queueMicrotask(() => child.emit('error', new Error('spawn ENOENT')));
+    return child;
+  }) as unknown as typeof spawnType;
+
+  await assert.rejects(
+    () => startSidecar({ binaries, port, readyTimeoutMs: 2000, spawnImpl }),
+    /could not start.*ENOENT/,
+  );
+});
+
+test('a readiness timeout shuts the child down and reports the timeout', async () => {
+  const port = await allocatePort();
+  // Never becomes ready, but does go down on the first signal.
+  const child = fakeChild((emitter) => queueMicrotask(() => emitter.emit('exit', 0, 'SIGTERM')));
+  const spawnImpl = (() => child) as unknown as typeof spawnType;
+
+  await assert.rejects(
+    () => startSidecar({ binaries, port, readyTimeoutMs: 50, spawnImpl }),
+    /did not become ready within 50ms/,
+  );
+});
+
+test('a kill that fails without an exit is reported, not counted as a shutdown', async () => {
+  const port = await allocatePort();
+  // Signalling fails (EPERM-style) and the child never goes: it may still hold
+  // the port, so the stop must not report success.
+  const child = fakeChild(
+    (emitter) => queueMicrotask(() => emitter.emit('error', new Error('kill EPERM'))),
+    4242,
+  );
+  const spawnImpl = (() => child) as unknown as typeof spawnType;
+
+  await assert.rejects(
+    () => startSidecar({ binaries, port, readyTimeoutMs: 50, stopTimeoutMs: 10, spawnImpl }),
+    (error: Error) => {
+      assert.match(error.message, /did not become ready within 50ms/);
+      assert.match((error.cause as Error).message, /could not be killed.*EPERM/);
+      return true;
+    },
+  );
+});
+
+test('an early exit is reported with its code rather than waiting out the deadline', async () => {
+  const port = await allocatePort();
+  const child = fakeChild();
+  const spawnImpl = (() => {
+    queueMicrotask(() => child.emit('exit', 1, null));
+    return child;
+  }) as unknown as typeof spawnType;
+
+  await assert.rejects(
+    () => startSidecar({ binaries, port, readyTimeoutMs: 2000, spawnImpl }),
+    /exited before becoming ready \(code 1/,
+  );
+});
+
+test('onExit reports a death after readiness, including to late subscribers', async () => {
+  const port = await allocatePort();
+  // Fake the bridge's capabilities endpoint so startSidecar reports ready.
+  const server = http.createServer((_req, res) => {
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(
+      JSON.stringify({ mangatanMihonBridge: 1, sourceFactory: true, preferenceCallbacks: true }),
+    );
+  });
+  await new Promise<void>((resolve) => server.listen(port, '127.0.0.1', resolve));
+  const child = fakeChild();
+  const spawnImpl = (() => child) as unknown as typeof spawnType;
+
+  try {
+    const handle = await startSidecar({ binaries, port, readyTimeoutMs: 5000, spawnImpl });
+    const exits: Array<{ code: number | null; signal: NodeJS.Signals | null }> = [];
+    handle.onExit((info) => exits.push(info));
+    assert.equal(exits.length, 0);
+
+    child.emit('exit', 137, null);
+    await new Promise((resolve) => setImmediate(resolve));
+    assert.deepEqual([...exits], [{ code: 137, signal: null }]);
+
+    // A listener attached after the death still hears about it.
+    handle.onExit((info) => exits.push(info));
+    await new Promise((resolve) => setImmediate(resolve));
+    assert.deepEqual(
+      [...exits],
+      [
+        { code: 137, signal: null },
+        { code: 137, signal: null },
+      ],
+    );
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});
@@ -0,0 +1,180 @@
+import { spawn, type ChildProcess } from 'node:child_process';
+import path from 'node:path';
+import { createServer } from 'node:net';
+import { AnimeBridgeClient } from './bridge-client';
+import type { BundleBinaries } from './sidecar-bundle';
+
+/** Cold start includes JVM boot plus AndroidCompat init; be generous. */
+export const DEFAULT_READY_TIMEOUT_MS = 30_000;
+const READY_POLL_INTERVAL_MS = 500;
+/** How long to wait for the child to go after each signal before escalating. */
+const STOP_TIMEOUT_MS = 5_000;
+
+function delay(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/** Ask the OS for a free loopback port, then hand it to the JVM. */
+export async function allocatePort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address();
+      if (address === null || typeof address === 'string') {
+        server.close();
+        reject(new Error('Could not allocate a loopback port for the anime bridge.'));
+        return;
+      }
+      const { port } = address;
+      server.close(() => resolve(port));
+    });
+  });
+}
+
+export interface SidecarHandle {
+  baseUrl: string;
+  port: number;
+  /**
+   * Fires once when the child process goes away, however it goes away —
+   * including deliberate stops. Fires immediately for a subscriber that
+   * attaches after the death, so a caller cannot miss it.
+   */
+  onExit: (
+    listener: (info: { code: number | null; signal: NodeJS.Signals | null }) => void,
+  ) => void;
+  client: AnimeBridgeClient;
+  stop: () => Promise<void>;
+}
+
+export interface StartSidecarOptions {
+  binaries: BundleBinaries;
+  port?: number;
+  readyTimeoutMs?: number;
+  /** How long to wait for the child to go after each stop signal. Tests only. */
+  stopTimeoutMs?: number;
+  spawnImpl?: typeof spawn;
+  onLog?: (line: string) => void;
+}
+
+/**
+ * Launch the bridge and wait until it reports the capabilities this client
+ * needs. The desktop launch contract is `java -jar MExtensionServer.jar <port>`,
+ * run from the JAR's own directory.
+ */
+export async function startSidecar(options: StartSidecarOptions): Promise<SidecarHandle> {
+  const { binaries } = options;
+  const port = options.port ?? (await allocatePort());
+  const baseUrl = `http://127.0.0.1:${port}`;
+  const spawnProcess = options.spawnImpl ?? spawn;
+
+  const child: ChildProcess = spawnProcess(
+    binaries.javaPath,
+    ['-jar', binaries.jarPath, String(port)],
+    {
+      cwd: path.dirname(binaries.jarPath),
+      stdio: ['ignore', 'pipe', 'pipe'],
+    },
+  );
+
+  const log = options.onLog;
+  if (log) {
+    child.stdout?.on('data', (chunk: Buffer) => log(chunk.toString().trimEnd()));
+    child.stderr?.on('data', (chunk: Buffer) => log(chunk.toString().trimEnd()));
+  }
+
+  let exited: { code: number | null; signal: NodeJS.Signals | null } | null = null;
+  let spawnError: Error | null = null;
+  let killError: Error | null = null;
+  const stopTimeoutMs = options.stopTimeoutMs ?? STOP_TIMEOUT_MS;
+  const hasExited = new Promise<void>((resolve) => {
+    child.once('exit', (code, signal) => {
+      exited = { code, signal };
+      resolve();
+    });
+    // A ChildProcess is an EventEmitter: without this listener a failed spawn
+    // (a missing or non-executable java) throws in the main process instead of
+    // failing the readiness loop below. `error` never proves the child is gone
+    // -- only `exit` does -- so it must never set `exited`, or a kill that
+    // failed would look like a clean shutdown. A spawn failure is told apart
+    // from a later kill failure by the missing pid.
+    child.on('error', (error: Error) => {
+      if (child.pid === undefined) {
+        spawnError = error;
+        resolve();
+        return;
+      }
+      killError = error;
+    });
+  });
+
+  const stop = async (): Promise<void> => {
+    if (exited !== null) return;
+    // Nothing was ever spawned, so there is nothing to signal or wait for.
+    if (spawnError !== null) return;
+    // Graceful first: the server exposes a shutdown endpoint.
+    try {
+      await fetch(`${baseUrl}/stop`, { signal: AbortSignal.timeout(2000) });
+    } catch {
+      // Falling through to a signal is fine; the endpoint may already be gone.
+    }
+    if (exited !== null) return;
+    child.kill();
+    // kill() only sends the signal. Wait for the process to actually go, so a
+    // restart cannot race the old one still holding the port.
+    await Promise.race([hasExited, delay(stopTimeoutMs)]);
+    if (exited === null) {
+      child.kill('SIGKILL');
+      await Promise.race([hasExited, delay(stopTimeoutMs)]);
+    }
+    // Never report success while the child may still hold the port: a caller
+    // that restarts on the same port would race the survivor.
+    if (exited === null) {
+      const failedKill = killError as Error | null;
+      if (failedKill !== null) {
+        throw new Error(`Anime bridge could not be killed: ${failedKill.message}`, {
+          cause: failedKill,
+        });
+      }
+      throw new Error('Anime bridge did not exit after SIGKILL.');
+    }
+  };
+
+  const client = new AnimeBridgeClient({ baseUrl });
+  const deadline = Date.now() + (options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS);
+
+  while (Date.now() < deadline) {
+    if (spawnError !== null) {
+      throw new Error(`Anime bridge could not start: ${(spawnError as Error).message}`);
+    }
+    if (exited !== null) {
+      const { code, signal } = exited as { code: number | null; signal: NodeJS.Signals | null };
+      throw new Error(
+        `Anime bridge exited before becoming ready (code ${code}, signal ${signal}).`,
+      );
+    }
+    // Cap the probe at the time actually left, so a short readiness budget is
+    // not overrun by a single stalled capabilities request.
+    if (await client.isReady(deadline - Date.now())) {
+      const onExit: SidecarHandle['onExit'] = (listener) => {
+        void hasExited.then(() => listener(exited ?? { code: null, signal: null }));
+      };
+      return { baseUrl, port, client, stop, onExit };
+    }
+    // Sleeping past the deadline would only delay the timeout report.
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) break;
+    await delay(Math.min(READY_POLL_INTERVAL_MS, remaining));
+  }
+
+  const timeout = new Error(
+    `Anime bridge did not become ready within ${options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS}ms.`,
+  );
+  // A failed shutdown must not mask why startup failed, but it must not be
+  // dropped either: a surviving child still holds the port, which decides
+  // whether a caller may retry on it.
+  await stop().catch((error: unknown) => {
+    timeout.cause = error;
+  });
+  throw timeout;
+}
@@ -0,0 +1,263 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import type { AddressInfo } from 'node:net';
+import {
+  findTsSyncOffset,
+  rewritePlaylistOrigins,
+  startStreamStripProxy,
+  TS_PACKET_LENGTH,
+} from './stream-strip-proxy';
+
+/** A valid MPEG-TS payload: 0x47 sync byte every 188 bytes. */
+function makeTsPackets(count: number): Buffer {
+  const data = Buffer.alloc(count * TS_PACKET_LENGTH, 0x11);
+  for (let i = 0; i < count; i++) data[i * TS_PACKET_LENGTH] = 0x47;
+  return data;
+}
+
+/** The disguise seen in the wild: a real PNG header glued before the TS data. */
+const PNG_HEADER = Buffer.from([
+  0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d, 0x49, 0x48, 0x44, 0x52,
+]);
+
+test('findTsSyncOffset returns 0 for clean TS data', () => {
+  assert.equal(findTsSyncOffset(makeTsPackets(6)), 0);
+});
+
+test('findTsSyncOffset finds TS data behind a PNG prefix', () => {
+  const disguised = Buffer.concat([PNG_HEADER, makeTsPackets(6)]);
+  assert.equal(findTsSyncOffset(disguised), PNG_HEADER.length);
+});
+
+test('findTsSyncOffset ignores a lone sync byte in the junk prefix', () => {
+  const junk = Buffer.alloc(64, 0x00);
+  junk[10] = 0x47; // decoy: no packet run follows it
+  const disguised = Buffer.concat([junk, makeTsPackets(6)]);
+  assert.equal(findTsSyncOffset(disguised), junk.length);
+});
+
+test('findTsSyncOffset returns null when no TS run exists', () => {
+  assert.equal(findTsSyncOffset(Buffer.alloc(4096, 0x42)), null);
+});
+
+test('findTsSyncOffset returns null when the run starts past the scan limit', () => {
+  const disguised = Buffer.concat([Buffer.alloc(600, 0x00), makeTsPackets(6)]);
+  assert.equal(findTsSyncOffset(disguised, 500), null);
+});
+
+test('rewritePlaylistOrigins swaps absolute upstream URLs and keeps relative lines', () => {
+  const body = [
+    '#EXTM3U',
+    '#EXTINF:6.006,',
+    '/video/aaa.ts',
+    '#EXTINF:4.463,',
+    'http://127.0.0.1:41569/video/bbb.ts',
+  ].join('\n');
+  const rewritten = rewritePlaylistOrigins(body, 'http://127.0.0.1:41569', 'http://127.0.0.1:9999');
+  assert.ok(rewritten.includes('http://127.0.0.1:9999/video/bbb.ts'));
+  assert.ok(rewritten.includes('\n/video/aaa.ts\n'));
+  assert.ok(!rewritten.includes('41569'));
+});
+
+/* ---------- proxy end-to-end ---------- */
+
+type Route = { status: number; contentType: string; body: Buffer };
+
+/** Either a static routing table or a handler, for upstreams that need one. */
+async function withProxy(
+  routes: Record<string, Route> | http.RequestListener,
+  run: (proxyOrigin: string, upstreamOrigin: string) => Promise<void>,
+): Promise<void> {
+  const upstream = http.createServer((req, res) => {
+    if (typeof routes === 'function') {
+      routes(req, res);
+      return;
+    }
+    const route = routes[req.url ?? ''];
+    if (!route) {
+      res.writeHead(404).end('missing');
+      return;
+    }
+    res.writeHead(route.status, { 'content-type': route.contentType });
+    res.end(route.body);
+  });
+  await new Promise<void>((resolve) => upstream.listen(0, '127.0.0.1', resolve));
+  const upstreamOrigin = `http://127.0.0.1:${(upstream.address() as AddressInfo).port}`;
+
+  const proxy = await startStreamStripProxy({
+    upstreamOrigin: () => upstreamOrigin,
+    retryDelayMs: 5,
+  });
+  try {
+    await run(proxy.origin, upstreamOrigin);
+  } finally {
+    await proxy.close();
+    await new Promise<void>((resolve) => upstream.close(() => resolve()));
+  }
+}
+
+async function fetchBytes(url: string): Promise<{ status: number; body: Buffer }> {
+  const response = await fetch(url);
+  return { status: response.status, body: Buffer.from(await response.arrayBuffer()) };
+}
+
+test('proxy strips the PNG disguise off a segment', async () => {
+  const ts = makeTsPackets(8);
+  const disguised = Buffer.concat([PNG_HEADER, ts]);
+  await withProxy(
+    { '/video/seg.ts': { status: 200, contentType: 'video/mp2t', body: disguised } },
+    async (origin) => {
+      const { status, body } = await fetchBytes(`${origin}/video/seg.ts`);
+      assert.equal(status, 200);
+      assert.deepEqual(body, ts);
+    },
+  );
+});
+
+test('proxy passes a clean segment through unchanged', async () => {
+  const ts = makeTsPackets(8);
+  await withProxy(
+    { '/video/seg.ts': { status: 200, contentType: 'video/mp2t', body: ts } },
+    async (origin) => {
+      const { body } = await fetchBytes(`${origin}/video/seg.ts`);
+      assert.deepEqual(body, ts);
+    },
+  );
+});
+
+test('proxy leaves non-TS bodies alone', async () => {
+  const vtt = Buffer.from('WEBVTT\n\n00:00.000 --> 00:01.000\nhello\n');
+  await withProxy(
+    { '/video/sub.vtt': { status: 200, contentType: 'text/vtt', body: vtt } },
+    async (origin) => {
+      const { body } = await fetchBytes(`${origin}/video/sub.vtt`);
+      assert.deepEqual(body, vtt);
+    },
+  );
+});
+
+test('proxy rewrites absolute upstream playlist entries to its own origin', async () => {
+  await withProxy(
+    (req, res) => {
+      if (req.url !== '/video/list.m3u8') {
+        res.writeHead(404).end();
+        return;
+      }
+      // The proxy rewrites the Host header to the upstream it dialled, so this
+      // is that origin — the one the playlist must not leak to mpv.
+      res.writeHead(200, { 'content-type': 'application/vnd.apple.mpegurl' });
+      res.end(`#EXTM3U\n#EXTINF:6,\nhttp://${req.headers.host}/video/abs.ts\n`);
+    },
+    async (proxyOrigin, upstreamOrigin) => {
+      const { body } = await fetchBytes(`${proxyOrigin}/video/list.m3u8`);
+      const text = body.toString('utf8');
+      assert.ok(text.includes(`${proxyOrigin}/video/abs.ts`));
+      assert.ok(!text.includes(upstreamOrigin));
+    },
+  );
+});
+
+test('proxy strips even when the client asks for a byte range', async () => {
+  // ffmpeg opens every HLS segment with `Range: bytes=0-`. The proxy drops the
+  // header, so the upstream answers 200 with the whole body and the strip
+  // applies; a 206 would have been forwarded untouched.
+  const ts = makeTsPackets(8);
+  const disguised = Buffer.concat([PNG_HEADER, ts]);
+  await withProxy(
+    (req, res) => {
+      if (req.headers.range !== undefined) {
+        res.writeHead(206, {
+          'content-type': 'image/png',
+          'content-range': `bytes 0-${disguised.length - 1}/${disguised.length}`,
+        });
+        res.end(disguised);
+        return;
+      }
+      res.writeHead(200, { 'content-type': 'image/png' });
+      res.end(disguised);
+    },
+    async (proxyOrigin) => {
+      const response = await fetch(`${proxyOrigin}/video/seg.ts`, {
+        headers: { Range: 'bytes=0-' },
+      });
+      const body = Buffer.from(await response.arrayBuffer());
+      assert.equal(response.status, 200);
+      assert.deepEqual(body, ts);
+    },
+  );
+});
+
+test('proxy forwards error statuses without touching the body', async () => {
+  await withProxy(
+    { '/video/gone.ts': { status: 404, contentType: 'text/plain', body: Buffer.from('nope') } },
+    async (origin) => {
+      const { status, body } = await fetchBytes(`${origin}/video/gone.ts`);
+      assert.equal(status, 404);
+      assert.equal(body.toString('utf8'), 'nope');
+    },
+  );
+});
+
+/**
+ * Upstream that fails the first `failures` hits per path, then serves the
+ * route. Mirrors the bridge right after an episode resolve: mpv's immediate
+ * segment fetch errors, the same fetch a moment later works.
+ */
+async function withFlakyUpstream(
+  failures: number,
+  failStatus: number,
+  route: Route,
+  run: (proxyOrigin: string, hits: () => number) => Promise<void>,
+): Promise<void> {
+  let hits = 0;
+  const upstream = http.createServer((_req, res) => {
+    hits += 1;
+    if (hits <= failures) {
+      res.writeHead(failStatus, { 'content-type': 'text/plain' }).end('not ready');
+      return;
+    }
+    res.writeHead(route.status, { 'content-type': route.contentType });
+    res.end(route.body);
+  });
+  await new Promise<void>((resolve) => upstream.listen(0, '127.0.0.1', resolve));
+  const upstreamOrigin = `http://127.0.0.1:${(upstream.address() as AddressInfo).port}`;
+  const proxy = await startStreamStripProxy({
+    upstreamOrigin: () => upstreamOrigin,
+    retryDelayMs: 5,
+  });
+  try {
+    await run(proxy.origin, () => hits);
+  } finally {
+    await proxy.close();
+    await new Promise<void>((resolve) => upstream.close(() => resolve()));
+  }
+}
+
+test('proxy retries a failed segment fetch once and serves the retry', async () => {
+  const ts = makeTsPackets(8);
+  await withFlakyUpstream(
+    1,
+    404,
+    { status: 200, contentType: 'video/mp2t', body: ts },
+    async (origin, hits) => {
+      const { status, body } = await fetchBytes(`${origin}/video/seg.ts`);
+      assert.equal(status, 200);
+      assert.deepEqual(body, ts);
+      assert.equal(hits(), 2);
+    },
+  );
+});
+
+test('proxy gives up after one retry and forwards the error', async () => {
+  await withFlakyUpstream(
+    Infinity,
+    503,
+    { status: 200, contentType: 'video/mp2t', body: makeTsPackets(8) },
+    async (origin, hits) => {
+      const { status } = await fetchBytes(`${origin}/video/seg.ts`);
+      assert.equal(status, 503);
+      assert.equal(hits(), 2);
+    },
+  );
+});
@@ -0,0 +1,296 @@
+import http from 'node:http';
+import type { AddressInfo } from 'node:net';
+
+/**
+ * Loopback proxy between mpv and the anime bridge that undoes segment
+ * disguises. Some hosts prepend a real image header (a 1x1 PNG in the wild) to
+ * every HLS segment so scrapers see "an image"; ffmpeg then probes the segment
+ * as a picture and playback dies with "no audio or video data played". Aniyomi
+ * strips this in its player; mpv needs the bytes fixed before it sees them.
+ *
+ * Only bridge-origin `.m3u8` streams are routed through here (see
+ * anime-browser-runtime). Playlist bodies get their absolute upstream origins
+ * rewritten so segment requests come back through the proxy; segment bodies are
+ * scanned for the first genuine MPEG-TS packet run and any junk before it is
+ * dropped. Anything that is not TS (fMP4, VTT, keys) passes through untouched.
+ */
+
+export const TS_PACKET_LENGTH = 188;
+const TS_SYNC_BYTE = 0x47;
+/**
+ * Sync bytes that must repeat at exact packet spacing before an offset counts
+ * as TS data. One or two matches happen by chance in binary data; five in a
+ * row at 188-byte strides do not.
+ */
+const SYNC_RUN = 5;
+/** A disguise prefix is small; give up scanning after this much. */
+export const DEFAULT_SCAN_LIMIT_BYTES = 1024 * 1024;
+/** Bytes needed to either find a run within the limit or rule one out. */
+const DECISION_BYTES = DEFAULT_SCAN_LIMIT_BYTES + (SYNC_RUN - 1) * TS_PACKET_LENGTH + 1;
+
+/**
+ * First offset at which a confirmed MPEG-TS packet run starts, or null when
+ * the data does not look like TS at all (within the scan limit).
+ */
+export function findTsSyncOffset(
+  data: Buffer,
+  scanLimit = DEFAULT_SCAN_LIMIT_BYTES,
+): number | null {
+  const lastConfirmable = data.length - (SYNC_RUN - 1) * TS_PACKET_LENGTH - 1;
+  const end = Math.min(lastConfirmable, scanLimit);
+  for (let offset = 0; offset <= end; offset++) {
+    if (data[offset] !== TS_SYNC_BYTE) continue;
+    let confirmed = true;
+    for (let packet = 1; packet < SYNC_RUN; packet++) {
+      if (data[offset + packet * TS_PACKET_LENGTH] !== TS_SYNC_BYTE) {
+        confirmed = false;
+        break;
+      }
+    }
+    if (confirmed) return offset;
+  }
+  return null;
+}
+
+/**
+ * Point absolute playlist entries at the proxy. Relative entries already
+ * resolve against whatever origin served the playlist, so they need no help.
+ */
+export function rewritePlaylistOrigins(
+  body: string,
+  upstreamOrigin: string,
+  proxyOrigin: string,
+): string {
+  return body.split(upstreamOrigin).join(proxyOrigin);
+}
+
+export interface StreamStripProxyOptions {
+  /** Read per request so a bridge restart on a new port keeps working. */
+  upstreamOrigin: () => string;
+  log?: (message: string) => void;
+  /** Pause before the single retry of a failed upstream GET. */
+  retryDelayMs?: number;
+}
+
+const DEFAULT_RETRY_DELAY_MS = 400;
+/**
+ * Socket timeout on the upstream GET, cleared once its headers arrive. Node's
+ * http client has no deadline of its own, so a host that accepts the
+ * connection and then says nothing would hang mpv on that segment forever.
+ */
+const UPSTREAM_TIMEOUT_MS = 15_000;
+
+export interface StreamStripProxyHandle {
+  origin: string;
+  port: number;
+  close: () => Promise<void>;
+}
+
+/** Response headers that must not be forwarded verbatim. */
+const DROPPED_HEADERS = new Set([
+  'connection',
+  'keep-alive',
+  'transfer-encoding',
+  'content-length',
+]);
+
+function forwardableHeaders(headers: http.IncomingHttpHeaders): http.OutgoingHttpHeaders {
+  const result: http.OutgoingHttpHeaders = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (value === undefined || DROPPED_HEADERS.has(name.toLowerCase())) continue;
+    result[name] = value;
+  }
+  return result;
+}
+
+export function startStreamStripProxy(
+  options: StreamStripProxyOptions,
+): Promise<StreamStripProxyHandle> {
+  const log = options.log ?? (() => {});
+  const retryDelayMs = options.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS;
+
+  const server = http.createServer((req, res) => {
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+      res.writeHead(405).end();
+      return;
+    }
+
+    let upstreamUrl: URL;
+    try {
+      upstreamUrl = new URL(req.url ?? '/', options.upstreamOrigin());
+    } catch {
+      res.writeHead(502).end();
+      return;
+    }
+
+    const requestHeaders = forwardableHeaders(req.headers);
+    delete requestHeaders.host;
+    // Never forward Range: ffmpeg opens every segment with `bytes=0-`, the
+    // bridge answers some of those 206, and a partial response cannot be
+    // stripped (only full 200 bodies are). Byte ranges into a resource whose
+    // bytes this proxy rewrites would be incoherent anyway.
+    delete requestHeaders.range;
+    res.on('error', () => {});
+
+    requestUpstream(req, res, upstreamUrl, requestHeaders, 0);
+  });
+
+  /**
+   * One delayed retry on a failed GET: right after an episode resolve, the
+   * bridge (or the host behind it) can error on the very first segment
+   * fetches and be fine a moment later — mpv treats a playlist full of failed
+   * segments as a dead file and gives up for good.
+   */
+  function requestUpstream(
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    upstreamUrl: URL,
+    requestHeaders: http.OutgoingHttpHeaders,
+    attempt: number,
+  ): void {
+    const mayRetry = req.method === 'GET' && attempt === 0;
+    const retry = (): void => {
+      setTimeout(
+        () => requestUpstream(req, res, upstreamUrl, requestHeaders, attempt + 1),
+        retryDelayMs,
+      );
+    };
+
+    const upstreamRequest = http.request(
+      upstreamUrl,
+      { method: req.method, headers: requestHeaders, timeout: UPSTREAM_TIMEOUT_MS },
+      (upstream) => {
+        // Body streaming has its own pace; only the wait for headers is capped.
+        upstreamRequest.setTimeout(0);
+        const status = upstream.statusCode ?? 502;
+        if (status === 404 || status >= 500) {
+          if (mayRetry) {
+            log(`[stream-proxy] upstream ${status} for ${upstreamUrl.pathname}; retrying once`);
+            upstream.resume();
+            retry();
+            return;
+          }
+          log(`[stream-proxy] upstream ${status} for ${upstreamUrl.pathname}`);
+        }
+        handleUpstreamResponse(req, res, upstream);
+      },
+    );
+    // Destroying with an error routes the stall through the retry/502 path.
+    upstreamRequest.on('timeout', () => {
+      upstreamRequest.destroy(new Error(`upstream silent for ${UPSTREAM_TIMEOUT_MS}ms`));
+    });
+    upstreamRequest.on('error', (error) => {
+      if (mayRetry) {
+        log(`[stream-proxy] upstream request failed: ${String(error)}; retrying once`);
+        retry();
+        return;
+      }
+      log(`[stream-proxy] upstream request failed: ${String(error)}`);
+      if (!res.headersSent) res.writeHead(502);
+      res.end();
+    });
+    upstreamRequest.end();
+  }
+
+  function handleUpstreamResponse(
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    upstream: http.IncomingMessage,
+  ): void {
+    const status = upstream.statusCode ?? 502;
+    const pathname = (req.url ?? '').split('?', 1)[0] ?? '';
+    const contentType = String(upstream.headers['content-type'] ?? '');
+    const isPlaylist = pathname.endsWith('.m3u8') || contentType.includes('mpegurl');
+
+    upstream.on('error', () => res.destroy());
+
+    // Only a full 200 body is safe to modify; everything else (errors, range
+    // responses, HEAD) forwards untouched.
+    if (status !== 200 || req.method === 'HEAD') {
+      res.writeHead(status, forwardableHeaders(upstream.headers));
+      upstream.pipe(res);
+      return;
+    }
+
+    if (isPlaylist) {
+      const chunks: Buffer[] = [];
+      upstream.on('data', (chunk: Buffer) => chunks.push(chunk));
+      upstream.on('end', () => {
+        const body = rewritePlaylistOrigins(
+          Buffer.concat(chunks).toString('utf8'),
+          options.upstreamOrigin(),
+          origin,
+        );
+        res.writeHead(status, {
+          ...forwardableHeaders(upstream.headers),
+          'content-length': Buffer.byteLength(body, 'utf8'),
+        });
+        res.end(body);
+      });
+      return;
+    }
+
+    stripSegment(res, upstream);
+  }
+
+  /**
+   * Buffer just enough of the body to find (or rule out) a TS packet run,
+   * drop everything before it, then stream the rest through untouched.
+   */
+  function stripSegment(res: http.ServerResponse, upstream: http.IncomingMessage): void {
+    const chunks: Buffer[] = [];
+    let buffered = 0;
+
+    const respond = (data: Buffer, remainderFollows: boolean): void => {
+      const offset = findTsSyncOffset(data) ?? 0;
+      if (offset > 0) log(`[stream-proxy] stripped ${offset} disguise bytes off a segment`);
+      const body = offset > 0 ? data.subarray(offset) : data;
+
+      const headers = forwardableHeaders(upstream.headers);
+      const upstreamLength = Number(upstream.headers['content-length']);
+      if (remainderFollows) {
+        if (Number.isFinite(upstreamLength)) headers['content-length'] = upstreamLength - offset;
+      } else {
+        headers['content-length'] = body.length;
+      }
+
+      res.writeHead(upstream.statusCode ?? 200, headers);
+      res.write(body);
+    };
+
+    const onData = (chunk: Buffer): void => {
+      chunks.push(chunk);
+      buffered += chunk.length;
+      if (buffered < DECISION_BYTES) return;
+      upstream.off('data', onData);
+      upstream.off('end', onEnd);
+      respond(Buffer.concat(chunks), true);
+      upstream.pipe(res);
+    };
+    const onEnd = (): void => {
+      respond(Buffer.concat(chunks), false);
+      res.end();
+    };
+    upstream.on('data', onData);
+    upstream.on('end', onEnd);
+  }
+
+  let origin = '';
+
+  return new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      const { port } = server.address() as AddressInfo;
+      origin = `http://127.0.0.1:${port}`;
+      resolve({
+        origin,
+        port,
+        close: () =>
+          new Promise<void>((resolveClose) => {
+            server.closeAllConnections?.();
+            server.close(() => resolveClose());
+          }),
+      });
+    });
+  });
+}
@@ -0,0 +1,211 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import * as path from 'path';
+import {
+  cacheSubtitleTracks,
+  removeSubtitleCache,
+  resolveSubtitleExtension,
+  sniffSubtitleExtension,
+  subtitleExtensionFromUrl,
+  type SubtitleCacheIo,
+} from './subtitle-cache';
+
+interface FakeIo extends SubtitleCacheIo {
+  written: Map<string, string>;
+  removed: string[];
+  requests: Array<{ url: string; headers: Record<string, string> }>;
+}
+
+function fakeIo(bodies: Record<string, string | { status: number }>): FakeIo {
+  const written = new Map<string, string>();
+  const removed: string[] = [];
+  const requests: Array<{ url: string; headers: Record<string, string> }> = [];
+
+  return {
+    written,
+    removed,
+    requests,
+    async fetch(url, init) {
+      requests.push({ url, headers: init.headers });
+      const body = bodies[url];
+      if (body === undefined) throw new Error(`unexpected fetch: ${url}`);
+      if (typeof body !== 'string') {
+        return { ok: false, status: body.status, arrayBuffer: async () => new ArrayBuffer(0) };
+      }
+      const bytes = Buffer.from(body, 'utf8');
+      return {
+        ok: true,
+        status: 200,
+        arrayBuffer: async () =>
+          bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer,
+      };
+    },
+    async makeTempDir(prefix) {
+      return `${prefix}test`;
+    },
+    async writeFile(filePath, bytes) {
+      written.set(filePath, Buffer.from(bytes).toString('utf8'));
+    },
+    async removeDir(dir) {
+      removed.push(dir);
+    },
+  };
+}
+
+const SRT = '1\n00:00:01,000 --> 00:00:02,000\nこんにちは\n';
+const ASS = '[Script Info]\nScriptType: v4.00+\n\n[Events]\n';
+
+test('content decides the extension before the url does', () => {
+  assert.equal(sniffSubtitleExtension(ASS), 'ass');
+  assert.equal(sniffSubtitleExtension(SRT), 'srt');
+  assert.equal(sniffSubtitleExtension('WEBVTT\n\n00:01.000 --> 00:02.000\n'), 'vtt');
+  assert.equal(sniffSubtitleExtension('nothing recognisable'), null);
+  // An ASS body served from a .srt URL keeps the extension its parser needs.
+  assert.equal(resolveSubtitleExtension('http://host/sub.srt', ASS), 'ass');
+});
+
+test('a bom or leading whitespace does not hide the format marker', () => {
+  assert.equal(sniffSubtitleExtension(`${ASS}`), 'ass');
+  assert.equal(sniffSubtitleExtension(`\n\n${SRT}`), 'srt');
+});
+
+test('the url extension is the fallback, and only for formats we know', () => {
+  assert.equal(subtitleExtensionFromUrl('http://host/a/b.ASS?x=1'), 'ass');
+  assert.equal(subtitleExtensionFromUrl('http://host/video/token'), null);
+  assert.equal(subtitleExtensionFromUrl('http://host/a.mp4'), null);
+  // Nothing to go on: mpv can still probe past a wrong name.
+  assert.equal(resolveSubtitleExtension('http://host/video/token', 'unknown'), 'srt');
+});
+
+test('tracks are downloaded to a temp dir and handed back as file paths', async () => {
+  const io = fakeIo({ 'http://bridge/sub/ja': SRT, 'http://bridge/sub/en': ASS });
+  const result = await cacheSubtitleTracks({
+    tracks: [
+      { url: 'http://bridge/sub/ja', lang: 'Japanese' },
+      { url: 'http://bridge/sub/en', lang: 'English' },
+    ],
+    headers: { Referer: 'https://host/' },
+    io,
+  });
+
+  assert.ok(result.dir);
+  assert.deepEqual(
+    result.tracks.map((track) => path.basename(track.url)),
+    ['track-0.srt', 'track-1.ass'],
+  );
+  assert.ok(result.tracks.every((track) => track.local));
+  assert.equal(io.written.get(result.tracks[0]!.url), SRT);
+  // The stream's headers ride along; some hosts gate the subtitle URL too.
+  assert.deepEqual(io.requests[0]!.headers, { Referer: 'https://host/' });
+});
+
+test('a failed download keeps its url so the episode still plays', async () => {
+  const io = fakeIo({ 'http://bridge/sub/ja': SRT, 'http://bridge/sub/en': { status: 404 } });
+  const logged: string[] = [];
+  const result = await cacheSubtitleTracks({
+    tracks: [
+      { url: 'http://bridge/sub/ja', lang: 'Japanese' },
+      { url: 'http://bridge/sub/en', lang: 'English' },
+    ],
+    io,
+    log: (message) => logged.push(message),
+  });
+
+  assert.equal(result.tracks[0]!.local, true);
+  assert.equal(result.tracks[1]!.local, false);
+  assert.equal(result.tracks[1]!.url, 'http://bridge/sub/en');
+  assert.ok(logged.some((message) => message.includes('404')));
+  // One track survived, so the directory stays.
+  assert.ok(result.dir);
+  assert.deepEqual(io.removed, []);
+});
+
+test('an oversized streamed subtitle stops early and falls back to its remote url', async () => {
+  const io = fakeIo({});
+  const logged: string[] = [];
+  let chunksRead = 0;
+  let buffered = false;
+  const chunk = new Uint8Array(20 * 1024 * 1024);
+  const body = new ReadableStream<Uint8Array>(
+    {
+      pull(controller) {
+        chunksRead += 1;
+        controller.enqueue(chunk);
+      },
+    },
+    { highWaterMark: 0 },
+  );
+  io.fetch = async () => ({
+    ok: true,
+    status: 200,
+    body,
+    async arrayBuffer() {
+      buffered = true;
+      throw new Error('stream should not be buffered');
+    },
+  });
+
+  const result = await cacheSubtitleTracks({
+    tracks: [{ url: 'http://bridge/sub/oversized', lang: 'Japanese' }],
+    io,
+    log: (message) => logged.push(message),
+  });
+
+  assert.equal(buffered, false);
+  assert.equal(chunksRead, 2);
+  assert.equal(result.dir, null);
+  assert.deepEqual(result.tracks, [
+    {
+      url: 'http://bridge/sub/oversized',
+      lang: 'Japanese',
+      sourceUrl: 'http://bridge/sub/oversized',
+      local: false,
+    },
+  ]);
+  assert.ok(logged.some((message) => message.includes('response too large')));
+});
+
+test('a directory with nothing in it is removed and not reported', async () => {
+  const io = fakeIo({ 'http://bridge/sub/ja': { status: 500 } });
+  const result = await cacheSubtitleTracks({
+    tracks: [{ url: 'http://bridge/sub/ja', lang: 'Japanese' }],
+    io,
+  });
+
+  assert.equal(result.dir, null);
+  assert.equal(result.tracks[0]!.local, false);
+  assert.equal(io.removed.length, 1);
+});
+
+test('duplicate and empty urls are dropped before anything is fetched', async () => {
+  const io = fakeIo({ 'http://bridge/sub/ja': SRT });
+  const result = await cacheSubtitleTracks({
+    tracks: [
+      { url: 'http://bridge/sub/ja', lang: 'Japanese' },
+      { url: 'http://bridge/sub/ja', lang: 'Japanese' },
+      { url: '', lang: 'English' },
+    ],
+    io,
+  });
+
+  assert.equal(result.tracks.length, 1);
+  assert.equal(io.requests.length, 1);
+});
+
+test('no tracks means no temp directory at all', async () => {
+  const io = fakeIo({});
+  const result = await cacheSubtitleTracks({ tracks: [], io });
+
+  assert.deepEqual(result, { dir: null, tracks: [] });
+  assert.equal(io.written.size, 0);
+});
+
+test('cleanup is best effort and never throws', async () => {
+  const io = fakeIo({});
+  io.removeDir = async () => {
+    throw new Error('EBUSY');
+  };
+  await removeSubtitleCache('/tmp/subminer-anime-subtitles-x', io);
+  // A null directory is the common case after a source with no subtitles.
+  await removeSubtitleCache(null, io);
+});
@@ -0,0 +1,258 @@
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+
+/**
+ * Extension subtitle tracks arrive as URLs on the bridge's loopback proxy, and
+ * mpv is perfectly happy to stream them. alass is not: it needs a file on disk
+ * to use as the timing reference, and the subsync path rejects an external
+ * track whose `external-filename` is not an existing file. So every track is
+ * downloaded to a temp directory first and mpv is given the local path, the
+ * same way the Jellyfin preload caches its delivery URLs.
+ *
+ * The directory outlives the `sub-add` — alass reads it mid-playback — and is
+ * removed when the next episode starts or the runtime shuts down.
+ */
+
+/** Extensions mpv and alass both recognise off a filename. */
+const KNOWN_SUBTITLE_EXTENSIONS = new Set([
+  'srt',
+  'ass',
+  'ssa',
+  'vtt',
+  'sub',
+  'ttml',
+  'smi',
+  'sbv',
+]);
+
+/** What an unrecognisable track is named; mpv still probes the content. */
+const DEFAULT_SUBTITLE_EXTENSION = 'srt';
+
+const DOWNLOAD_TIMEOUT_MS = 15_000;
+
+/** Anything this large is not a subtitle file, and is not worth buffering. */
+const MAX_SUBTITLE_BYTES = 32 * 1024 * 1024;
+
+/** How much of the body is decoded to guess the format. */
+const SNIFF_BYTES = 1024;
+
+export interface SubtitleTrackRef {
+  url: string;
+  lang: string;
+}
+
+export interface CachedSubtitleTrack extends SubtitleTrackRef {
+  /** Where the track came from, kept for logs. */
+  sourceUrl: string;
+  /** False when the download failed and `url` is still the remote URL. */
+  local: boolean;
+}
+
+export interface SubtitleCacheResult {
+  /** The temp directory to remove later, or null when nothing was cached. */
+  dir: string | null;
+  tracks: CachedSubtitleTrack[];
+}
+
+interface FetchResponseLike {
+  ok: boolean;
+  status: number;
+  body?: ReadableStream<Uint8Array> | null;
+  arrayBuffer: () => Promise<ArrayBuffer>;
+}
+
+export interface SubtitleCacheIo {
+  fetch: (
+    url: string,
+    init: { headers: Record<string, string>; signal: AbortSignal },
+  ) => Promise<FetchResponseLike>;
+  makeTempDir: (prefix: string) => Promise<string>;
+  writeFile: (filePath: string, bytes: Uint8Array) => Promise<void>;
+  removeDir: (dir: string) => Promise<void>;
+}
+
+export interface CacheSubtitleTracksOptions {
+  tracks: SubtitleTrackRef[];
+  /** Headers the stream was resolved with; some hosts gate subtitles too. */
+  headers?: Record<string, string>;
+  io?: SubtitleCacheIo;
+  log?: (message: string) => void;
+}
+
+export function createSubtitleCacheIo(): SubtitleCacheIo {
+  return {
+    fetch: (url, init) => fetch(url, init),
+    makeTempDir: (prefix) => fs.promises.mkdtemp(prefix),
+    writeFile: (filePath, bytes) => fs.promises.writeFile(filePath, bytes),
+    removeDir: (dir) => fs.promises.rm(dir, { recursive: true, force: true }),
+  };
+}
+
+/**
+ * Guess a subtitle format from the start of the file.
+ *
+ * Bridge subtitle URLs are opaque tokens far more often than they are
+ * filenames, so the content is the only reliable signal. mpv and alass both
+ * pick their parser off the extension, and a `.srt` holding ASS is a parse
+ * error rather than a mistimed subtitle.
+ */
+export function sniffSubtitleExtension(head: string): string | null {
+  const text = head.replace(/^\uFEFF/, '').trimStart();
+  if (/^\[(script info|v4\+? styles|events)\]/i.test(text)) return 'ass';
+  if (/^WEBVTT(\s|$)/.test(text)) return 'vtt';
+  if (/^<\?xml/i.test(text) && /<tt[\s>]|ttml/i.test(text)) return 'ttml';
+  // Cue-numbered and bare-timestamp SRT; the `.` separator is a common variant.
+  if (/^(\d+\s*\r?\n)?\d{1,3}:\d{2}:\d{2}[,.]\d{1,3}\s*-->/.test(text)) return 'srt';
+  return null;
+}
+
+/** The URL's own extension, when it names a format we know. */
+export function subtitleExtensionFromUrl(url: string): string | null {
+  const urlPath = (() => {
+    try {
+      return new URL(url).pathname;
+    } catch {
+      return url;
+    }
+  })();
+  const extension = path.extname(urlPath).slice(1).toLowerCase();
+  return KNOWN_SUBTITLE_EXTENSIONS.has(extension) ? extension : null;
+}
+
+/** Content first, then the URL, then a guess mpv can still probe past. */
+export function resolveSubtitleExtension(url: string, head: string): string {
+  return (
+    sniffSubtitleExtension(head) ?? subtitleExtensionFromUrl(url) ?? DEFAULT_SUBTITLE_EXTENSION
+  );
+}
+
+function dedupeByUrl(tracks: SubtitleTrackRef[]): SubtitleTrackRef[] {
+  const seen = new Set<string>();
+  return tracks.filter((track) => {
+    if (track.url.length === 0 || seen.has(track.url)) return false;
+    seen.add(track.url);
+    return true;
+  });
+}
+
+async function downloadTrack(
+  io: SubtitleCacheIo,
+  dir: string,
+  index: number,
+  track: SubtitleTrackRef,
+  headers: Record<string, string>,
+): Promise<string> {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), DOWNLOAD_TIMEOUT_MS);
+  let bytes: Uint8Array;
+  try {
+    const response = await io.fetch(track.url, { headers, signal: controller.signal });
+    if (!response.ok) {
+      throw new Error(`HTTP ${response.status}`);
+    }
+    bytes = await readBounded(response, MAX_SUBTITLE_BYTES);
+  } finally {
+    clearTimeout(timeoutId);
+  }
+
+  if (bytes.byteLength === 0) {
+    throw new Error('empty response');
+  }
+  if (bytes.byteLength > MAX_SUBTITLE_BYTES) {
+    throw new Error(`response too large (${bytes.byteLength} bytes)`);
+  }
+
+  const head = Buffer.from(bytes.subarray(0, SNIFF_BYTES)).toString('utf8');
+  const extension = resolveSubtitleExtension(track.url, head);
+  const filePath = path.join(dir, `track-${index}.${extension}`);
+  // Written byte for byte: re-encoding would corrupt a non-UTF-8 track that
+  // mpv's own charset detection would otherwise handle.
+  await io.writeFile(filePath, bytes);
+  return filePath;
+}
+
+async function readBounded(response: FetchResponseLike, maxBytes: number): Promise<Uint8Array> {
+  const reader = response.body?.getReader();
+  if (!reader) {
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (bytes.byteLength > maxBytes) {
+      throw new Error(`response too large (${bytes.byteLength} bytes)`);
+    }
+    return bytes;
+  }
+
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      try {
+        await reader.cancel();
+      } catch {}
+      throw new Error(`response too large (${total} bytes)`);
+    }
+    chunks.push(value);
+  }
+
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
+
+/**
+ * Download every subtitle track to a fresh temp directory.
+ *
+ * A track that fails to download keeps its remote URL, so a dead subtitle
+ * server costs the alass reference rather than the episode.
+ */
+export async function cacheSubtitleTracks(
+  options: CacheSubtitleTracksOptions,
+): Promise<SubtitleCacheResult> {
+  const io = options.io ?? createSubtitleCacheIo();
+  const tracks = dedupeByUrl(options.tracks);
+  if (tracks.length === 0) return { dir: null, tracks: [] };
+
+  const dir = await io.makeTempDir(path.join(os.tmpdir(), 'subminer-anime-subtitles-'));
+  const cached = await Promise.all(
+    tracks.map(async (track, index): Promise<CachedSubtitleTrack> => {
+      try {
+        const filePath = await downloadTrack(io, dir, index, track, options.headers ?? {});
+        return { url: filePath, lang: track.lang, sourceUrl: track.url, local: true };
+      } catch (error) {
+        options.log?.(
+          `[anime-browser] subtitle download failed (${track.lang || 'unknown'}): ` +
+            describeError(error),
+        );
+        return { url: track.url, lang: track.lang, sourceUrl: track.url, local: false };
+      }
+    }),
+  );
+
+  if (!cached.some((track) => track.local)) {
+    await removeSubtitleCache(dir, io);
+    return { dir: null, tracks: cached };
+  }
+  return { dir, tracks: cached };
+}
+
+/** Remove a cache directory. Never throws: cleanup is best effort. */
+export async function removeSubtitleCache(
+  dir: string | null,
+  io: SubtitleCacheIo = createSubtitleCacheIo(),
+): Promise<void> {
+  if (!dir) return;
+  try {
+    await io.removeDir(dir);
+  } catch {}
+}
+
+function describeError(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
@@ -0,0 +1,101 @@
+/**
+ * Wire types for the M-Extension-Server bridge, which runs Aniyomi
+ * (`eu.kanade.tachiyomi.animeextension`) APKs on a desktop JVM and exposes
+ * them over loopback HTTP.
+ *
+ * Field names mirror the server's JSON exactly, including Kotlin/OkHttp
+ * internals that leak into the payload (see `OkHttpHeaders`).
+ */
+
+/** Marker key the server uses to select a source inside a SourceFactory APK. */
+export const BRIDGE_CONTEXT_KEY = '__mangatan_bridge_context__';
+
+/** Handshake shape from `GET /capabilities`. */
+export interface BridgeCapabilities {
+  mangatanMihonBridge?: number;
+  sourceFactory?: boolean;
+  preferenceCallbacks?: boolean;
+  youtubeResolver?: boolean;
+}
+
+/**
+ * OkHttp serializes `Headers` as a flat alternating name/value array under an
+ * internal field name. Kept verbatim so parsing stays honest about the source.
+ */
+export interface OkHttpHeaders {
+  namesAndValues$okhttp?: string[];
+}
+
+export interface BridgeTrack {
+  url?: string;
+  lang?: string;
+}
+
+/** One playable stream returned by an extension's `getVideoList`. */
+export interface BridgeVideo {
+  /** Page/embed URL the stream was extracted from. */
+  url?: string;
+  /** Display label, e.g. "1080p". */
+  quality?: string;
+  /**
+   * Playable media URL. Normally a `/video/<token>` proxy URL on the bridge
+   * itself, valid only while that server process is alive.
+   */
+  videoUrl?: string;
+  headers?: OkHttpHeaders;
+  audioTracks?: BridgeTrack[];
+  subtitleTracks?: BridgeTrack[];
+}
+
+export interface BridgeEpisode {
+  name?: string;
+  url?: string;
+  date_upload?: number;
+  scanlator?: string;
+  episode_number?: number;
+}
+
+export interface BridgeAnime {
+  url?: string;
+  title?: string;
+  artist?: string;
+  author?: string;
+  description?: string;
+  genres?: string[];
+  status?: number;
+  thumbnail_url?: string;
+}
+
+/** One source inside an extension APK. A SourceFactory APK yields several. */
+export interface BridgeSourceDescriptor {
+  id?: string | number;
+  name?: string;
+  lang?: string;
+  baseUrl?: string;
+}
+
+export interface BridgeAnimePage {
+  animes?: BridgeAnime[];
+  hasNextPage?: boolean;
+}
+
+/** The server reports failures as HTTP 200 with an error body. */
+export interface BridgeErrorBody {
+  error?: string;
+  code?: number;
+}
+
+/** A source preference entry, passed through to the extension unchanged. */
+export interface BridgePreference {
+  key: string;
+  [field: string]: unknown;
+}
+
+/** Normalized stream, ready to hand to mpv. */
+export interface ResolvedStream {
+  url: string;
+  quality: string;
+  headers: Record<string, string>;
+  subtitles: Array<{ url: string; lang: string }>;
+  audios: Array<{ url: string; lang: string }>;
+}
@@ -0,0 +1,431 @@
+import { describe, el } from './dom';
+import { sourceOptionLabel, summarizeSearch } from './format';
+import { applySearchUpdate, idleSearchProgress, summarizeProgress } from './search-progress';
+import { createExtensionsPanel } from './extensions-panel';
+import { createDetailPanel } from './detail-panel';
+import { renderPreferences, renderPreferencesUnavailable } from './preferences-fields';
+import {
+  beginBrowse,
+  beginNextPage,
+  createBrowseState,
+  failBrowse,
+  finishBrowse,
+  soleBrowseRequest,
+  takeUnseenEntries,
+} from './browse-state';
+import type { BrowseRequest } from './browse-state';
+import { ALL_SOURCES_ID } from '../types/anime-browser';
+import type {
+  AnimeBrowserAPI,
+  AnimeBrowserBridgeState,
+  AnimeBrowserEntry,
+  AnimeBrowserSource,
+} from '../types/anime-browser';
+
+declare global {
+  interface Window {
+    animeBrowserAPI: AnimeBrowserAPI;
+  }
+}
+
+const api = window.animeBrowserAPI;
+
+const searchForm = el<HTMLFormElement>('search-form');
+const searchInput = el<HTMLInputElement>('search-input');
+const searchButton = el<HTMLButtonElement>('search-button');
+const sourceSelect = el<HTMLSelectElement>('source-select');
+const grid = el<HTMLDivElement>('grid');
+const gridEmpty = el<HTMLParagraphElement>('grid-empty');
+const loadMoreButton = el<HTMLButtonElement>('load-more');
+const banner = el<HTMLDivElement>('bridge-banner');
+const bannerMessage = el<HTMLSpanElement>('bridge-message');
+const bannerMeter = el<HTMLSpanElement>('bridge-meter');
+const bannerMeterFill = el<HTMLElement>('bridge-meter-fill');
+const statusMessage = el<HTMLSpanElement>('status-message');
+const browseTab = el<HTMLButtonElement>('tab-browse');
+const extensionsTab = el<HTMLButtonElement>('tab-extensions');
+const settingsTab = el<HTMLButtonElement>('tab-settings');
+const layout = el<HTMLElement>('layout');
+const extensionsPanel = el<HTMLElement>('extensions');
+const settingsPanel = el<HTMLElement>('settings');
+const settingsFields = el<HTMLDivElement>('settings-fields');
+const settingsTitle = el<HTMLHeadingElement>('settings-title');
+
+/** Last source accepted by the main process, used to roll back a rejected change. */
+let selectedSourceId: string | null = null;
+
+/* ---------- tabs ---------- */
+
+type View = 'browse' | 'extensions' | 'settings';
+
+let currentView: View = 'browse';
+
+/**
+ * Show one view at a time. The panels used to sit above the results, which left
+ * a long extension list scrolling inside a sliver of the window; as tabs each
+ * one gets the whole content region.
+ */
+function setView(view: View): void {
+  currentView = view;
+  layout.classList.toggle('hidden', view !== 'browse');
+  extensionsPanel.classList.toggle('hidden', view !== 'extensions');
+  settingsPanel.classList.toggle('hidden', view !== 'settings');
+  browseTab.setAttribute('aria-selected', String(view === 'browse'));
+  extensionsTab.setAttribute('aria-selected', String(view === 'extensions'));
+  settingsTab.setAttribute('aria-selected', String(view === 'settings'));
+}
+
+function setStatus(message: string, tone: 'info' | 'ok' | 'error' = 'info'): void {
+  statusMessage.textContent = message;
+  statusMessage.parentElement?.setAttribute('data-tone', tone);
+}
+
+const detailPanel = createDetailPanel({ api, setStatus });
+
+const BRIDGE_LABELS: Record<AnimeBrowserBridgeState['stage'], string> = {
+  idle: 'Starting the extension bridge',
+  locating: 'Looking up the extension bridge release',
+  downloading: 'Downloading the extension bridge',
+  verifying: 'Verifying the download',
+  extracting: 'Unpacking the extension bridge',
+  starting: 'Starting the extension bridge',
+  ready: 'Bridge ready',
+  failed: 'Bridge failed to start',
+};
+
+const BUSY_STAGES = new Set([
+  'idle',
+  'locating',
+  'downloading',
+  'verifying',
+  'extracting',
+  'starting',
+]);
+
+function renderBridgeState(state: AnimeBrowserBridgeState): void {
+  const busy = BUSY_STAGES.has(state.stage);
+  banner.dataset.stage = state.stage;
+  banner.dataset.busy = String(busy);
+
+  // Once ready with nothing to report, the banner has nothing to say.
+  const hide = state.stage === 'ready' && state.message === null;
+  banner.classList.toggle('hidden', hide);
+  bannerMessage.textContent = state.message ?? BRIDGE_LABELS[state.stage];
+
+  const showMeter = state.progress !== null;
+  bannerMeter.classList.toggle('hidden', !showMeter);
+  if (state.progress !== null) {
+    bannerMeterFill.style.width = `${Math.round(state.progress * 100)}%`;
+  }
+
+  const ready = state.stage === 'ready';
+  searchInput.disabled = !ready;
+  searchButton.disabled = !ready;
+}
+
+/* ---------- source picker ---------- */
+
+/**
+ * The picker lists every installed source, plus an "All sources" entry that
+ * searches them together. That entry only earns its place with more than one
+ * source installed.
+ */
+function renderSources(sources: AnimeBrowserSource[], selectedId: string | null): void {
+  const options: HTMLOptionElement[] = [];
+
+  if (sources.length > 1) {
+    const all = document.createElement('option');
+    all.value = ALL_SOURCES_ID;
+    all.textContent = `All sources (${sources.length})`;
+    all.selected = selectedId === ALL_SOURCES_ID;
+    options.push(all);
+  }
+
+  for (const source of sources) {
+    const option = document.createElement('option');
+    option.value = source.id;
+    option.textContent = sourceOptionLabel(source);
+    option.selected = source.id === selectedId;
+    options.push(option);
+  }
+
+  sourceSelect.replaceChildren(...options);
+  sourceSelect.disabled = options.length <= 1;
+  selectedSourceId = selectedId;
+}
+
+function searchingAllSources(): boolean {
+  return sourceSelect.value === ALL_SOURCES_ID;
+}
+
+/* ---------- results ---------- */
+
+function createCard(entry: AnimeBrowserEntry, showSource: boolean): HTMLButtonElement {
+  const card = document.createElement('button');
+  card.type = 'button';
+  card.className = 'card';
+
+  const art = document.createElement('div');
+  art.className = 'card-art';
+  if (entry.thumbnailUrl) {
+    const img = document.createElement('img');
+    img.src = entry.thumbnailUrl;
+    img.alt = '';
+    img.loading = 'lazy';
+    // A dead cover should fall back to the initial, not a broken-image icon.
+    img.addEventListener('error', () => {
+      img.remove();
+      art.classList.add('is-empty');
+    });
+    art.append(img);
+  } else {
+    art.classList.add('is-empty');
+  }
+  art.dataset.initial = entry.title.trim().charAt(0).toUpperCase() || '?';
+
+  if (showSource) {
+    const badge = document.createElement('span');
+    badge.className = 'card-source';
+    badge.textContent = entry.sourceName;
+    art.append(badge);
+  }
+
+  const title = document.createElement('div');
+  title.className = 'card-title';
+  title.textContent = entry.title;
+
+  card.append(art, title);
+  card.title = showSource ? `${entry.title} — ${entry.sourceName}` : entry.title;
+  card.addEventListener('click', () => {
+    void detailPanel.open(entry);
+  });
+  return card;
+}
+
+/** Drops every card and the empty-state message so a fresh page can build up. */
+function resetGrid(): void {
+  seenEntries.clear();
+  grid.replaceChildren();
+  gridEmpty.classList.add('hidden');
+}
+
+function renderEntries(entries: AnimeBrowserEntry[], emptyMessage: string): void {
+  // Which source a cover came from only matters when they are mixed together.
+  resetGrid();
+  appendEntries(entries);
+
+  const empty = grid.childElementCount === 0;
+  gridEmpty.classList.toggle('hidden', !empty);
+  gridEmpty.textContent = emptyMessage;
+}
+
+/** Streamed results land at the end of the grid, in arrival order. */
+function appendEntries(entries: AnimeBrowserEntry[]): void {
+  const showSource = searchingAllSources();
+  const unseen = takeUnseenEntries(entries, seenEntries);
+  grid.append(...unseen.map((entry) => createCard(entry, showSource)));
+  if (unseen.length > 0) gridEmpty.classList.add('hidden');
+}
+
+/* ---------- streamed search ---------- */
+
+/**
+ * Results are pushed per source while the search call is still pending, so a
+ * fast source is on screen before a slow one answers. The grid is built from
+ * those pushes; the awaited result then settles the final status line (and
+ * backfills the grid if no push ever arrived).
+ */
+let progress = idleSearchProgress();
+
+let browseState = createBrowseState();
+const inFlightBrowses = new Map<number, BrowseRequest>();
+let activeStreamRequestId = 0;
+const seenEntries = new Set<string>();
+
+function renderLoadMore(): void {
+  const loadingNextPage = browseState.loading && browseState.page > 1;
+  loadMoreButton.classList.toggle('hidden', !browseState.hasNextPage && !loadingNextPage);
+  loadMoreButton.disabled = browseState.loading;
+  loadMoreButton.textContent = loadingNextPage ? 'Loading…' : 'Load more';
+}
+
+api.onSearchUpdate((update) => {
+  const applied = applySearchUpdate(progress, update);
+  if (!applied) return; // A superseded search; let it run out quietly.
+  progress = applied.progress;
+
+  if (applied.started) {
+    // The runtime token does not carry the renderer request id. When calls
+    // overlap their starts may arrive in either order, so stream only when the
+    // association is unambiguous; the final response still backfills the grid.
+    const request = soleBrowseRequest(inFlightBrowses);
+    activeStreamRequestId = request?.id ?? 0;
+    const append = request?.append === true;
+    if (!append) resetGrid();
+    return;
+  }
+  if (activeStreamRequestId !== browseState.requestId) return;
+  if (applied.entries.length > 0) appendEntries(applied.entries);
+  if (!progress.done) {
+    setStatus(summarizeProgress(progress), progress.failures.length > 0 ? 'error' : 'info');
+  }
+});
+
+async function runBrowse(request: BrowseRequest): Promise<void> {
+  inFlightBrowses.set(request.id, request);
+  renderLoadMore();
+
+  try {
+    const result = request.query
+      ? await api.search(request.query, request.page)
+      : await api.getPopular(request.page);
+    if (request.id !== browseState.requestId) return;
+    browseState = finishBrowse(browseState, request.id, result.hasNextPage);
+    renderLoadMore();
+
+    // Every source failing is an error, not an empty result set.
+    if (result.entries.length === 0 && result.failures.length > 0) {
+      const first = result.failures[0];
+      if (!request.append) renderEntries([], `${first?.sourceName}: ${first?.error}`);
+      setStatus(summarizeSearch(result), 'error');
+      return;
+    }
+
+    // The final response backfills a host without streaming. Entries already
+    // pushed by the stream are filtered out, including sources that repeat a
+    // final page while another source still has more.
+    appendEntries(result.entries);
+    if (!request.append && grid.childElementCount === 0) {
+      renderEntries(
+        [],
+        request.query ? `Nothing found for “${request.query}”.` : 'This source returned nothing.',
+      );
+    }
+    setStatus(summarizeSearch(result), result.failures.length > 0 ? 'error' : 'info');
+  } catch (error) {
+    if (request.id !== browseState.requestId) return;
+    browseState = failBrowse(browseState, request);
+    renderLoadMore();
+    if (!request.append) renderEntries([], describe(error));
+    setStatus(describe(error), 'error');
+  } finally {
+    inFlightBrowses.delete(request.id);
+  }
+}
+
+async function runSearch(query: string): Promise<void> {
+  const started = beginBrowse(browseState, query);
+  browseState = started.state;
+  // A new search means new results; leave the detail page for them.
+  if (detailPanel.isOpen()) detailPanel.close();
+  setStatus(query ? `Searching for “${query}”…` : 'Loading popular…');
+  resetGrid();
+  await runBrowse(started.request);
+}
+
+async function loadNextPage(): Promise<void> {
+  const started = beginNextPage(browseState);
+  if (!started) return;
+  browseState = started.state;
+  setStatus(`Loading page ${started.request.page}…`);
+  await runBrowse(started.request);
+}
+
+/* ---------- source settings ---------- */
+
+async function openSettings(): Promise<void> {
+  const option = sourceSelect.selectedOptions[0];
+  settingsTitle.textContent = option ? `${option.textContent} settings` : 'Source settings';
+  settingsFields.replaceChildren();
+  setView('settings');
+
+  // Settings belong to one extension, so there is nothing coherent to show for
+  // "All sources".
+  if (searchingAllSources()) {
+    renderPreferencesUnavailable(
+      settingsFields,
+      'Pick a single source in the Source picker to edit its settings.',
+    );
+    return;
+  }
+
+  const sourceId = sourceSelect.value;
+  try {
+    renderPreferences(settingsFields, await api.getPreferences(sourceId), (key, value) =>
+      api.setPreference(sourceId, key, value),
+    );
+  } catch (error) {
+    setStatus(describe(error), 'error');
+    setView('browse');
+  }
+}
+
+/* ---------- wiring ---------- */
+
+async function refreshSources(): Promise<void> {
+  const snapshot = await api.getSnapshot();
+  renderSources(snapshot.sources, snapshot.selectedSourceId);
+}
+
+const extensions = createExtensionsPanel({ api, setStatus, onSourcesChanged: refreshSources });
+
+browseTab.addEventListener('click', () => setView('browse'));
+
+settingsTab.addEventListener('click', () => void openSettings());
+
+extensionsTab.addEventListener('click', () => {
+  setView('extensions');
+  void extensions.refresh();
+});
+
+searchForm.addEventListener('submit', (event) => {
+  event.preventDefault();
+  // Searching is a browse action, whichever tab it was typed from.
+  setView('browse');
+  void runSearch(searchInput.value.trim());
+});
+
+sourceSelect.addEventListener('change', () => {
+  void (async () => {
+    const requestedSourceId = sourceSelect.value;
+    try {
+      await api.selectSource(requestedSourceId);
+      selectedSourceId = requestedSourceId;
+      // Settings belong to the source, so reload them rather than showing stale fields.
+      if (currentView === 'settings') await openSettings();
+      await runSearch(searchInput.value.trim());
+    } catch (error) {
+      if (selectedSourceId !== null) sourceSelect.value = selectedSourceId;
+      setStatus(describe(error), 'error');
+    }
+  })();
+});
+
+loadMoreButton.addEventListener('click', () => void loadNextPage());
+
+api.onBridgeState(renderBridgeState);
+
+void (async () => {
+  renderBridgeState({ stage: 'idle', progress: null, message: null });
+  try {
+    const state = await api.ensureBridge();
+    renderBridgeState(state);
+
+    const snapshot = await api.getSnapshot();
+    renderSources(snapshot.sources, snapshot.selectedSourceId);
+
+    if (state.stage === 'ready' && snapshot.sources.length > 0) {
+      searchInput.focus();
+      await runSearch('');
+    } else if (state.stage === 'ready') {
+      setStatus(state.message ?? 'No extensions installed.', 'error');
+    } else {
+      setStatus(state.message ?? 'The extension bridge is not available.', 'error');
+    }
+  } catch (error) {
+    // Without this the window keeps the "starting" banner up forever, with the
+    // search box disabled and nothing saying why.
+    renderBridgeState({ stage: 'failed', progress: null, message: describe(error) });
+    setStatus(describe(error), 'error');
+  }
+})();
@@ -0,0 +1,114 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  beginBrowse,
+  beginNextPage,
+  capture,
+  createBrowseState,
+  failBrowse,
+  finishBrowse,
+  LatestRequest,
+  safeUploadDate,
+  soleBrowseRequest,
+  takeUnseenEntries,
+} from './browse-state';
+import type { AnimeBrowserEntry } from '../types/anime-browser';
+
+test('a new browse replaces results and starts from page one', () => {
+  const started = beginBrowse(createBrowseState(), 'frieren');
+
+  assert.deepEqual(started.request, {
+    id: 1,
+    query: 'frieren',
+    page: 1,
+    append: false,
+  });
+  assert.equal(started.state.loading, true);
+});
+
+test('the next page appends only when the current result has another page', () => {
+  const first = beginBrowse(createBrowseState(), '');
+  const ready = finishBrowse(first.state, first.request.id, true);
+  const next = beginNextPage(ready);
+
+  assert.ok(next);
+  assert.deepEqual(next.request, {
+    id: 2,
+    query: '',
+    page: 2,
+    append: true,
+  });
+  assert.equal(beginNextPage(next.state), null, 'cannot overlap page requests');
+  assert.equal(beginNextPage(finishBrowse(next.state, next.request.id, false)), null);
+});
+
+test('a stale page completion cannot change the active browse state', () => {
+  const first = beginBrowse(createBrowseState(), 'old');
+  const current = beginBrowse(first.state, 'new');
+
+  assert.equal(finishBrowse(current.state, first.request.id, true), current.state);
+});
+
+test('stream updates are correlated only when one browse request is in flight', () => {
+  const first = beginBrowse(createBrowseState(), 'old');
+  const second = beginBrowse(first.state, 'new');
+  const inFlight = new Map([
+    [second.request.id, second.request],
+    [first.request.id, first.request],
+  ]);
+
+  assert.equal(soleBrowseRequest(inFlight), null, 'start order is ambiguous while calls overlap');
+  inFlight.delete(first.request.id);
+  assert.equal(soleBrowseRequest(inFlight), second.request);
+});
+
+test('a failed next page remains retryable', () => {
+  const first = beginBrowse(createBrowseState(), '');
+  const ready = finishBrowse(first.state, first.request.id, true);
+  const next = beginNextPage(ready)!;
+  const failed = failBrowse(next.state, next.request);
+  const retry = beginNextPage(failed);
+
+  assert.ok(retry);
+  assert.equal(retry.request.page, 2);
+});
+
+test('latest request tokens invalidate closed and superseded details', () => {
+  const requests = new LatestRequest();
+  const first = requests.begin();
+  const second = requests.begin();
+
+  assert.equal(requests.isCurrent(first), false);
+  assert.equal(requests.isCurrent(second), true);
+  requests.cancel();
+  assert.equal(requests.isCurrent(second), false);
+});
+
+test('safeUploadDate ignores malformed timestamps', () => {
+  assert.equal(safeUploadDate(Date.UTC(2025, 3, 2)), '2025-04-02');
+  assert.equal(safeUploadDate(Number.NaN), null);
+  assert.equal(safeUploadDate(Number.POSITIVE_INFINITY), null);
+});
+
+test('capture turns a rejected IPC operation into a displayable failure', async () => {
+  const failure = new Error('bridge disconnected');
+  const result = await capture(async () => Promise.reject(failure));
+
+  assert.deepEqual(result, { ok: false, error: failure });
+});
+
+test('takeUnseenEntries deduplicates streamed and final-page entries', () => {
+  const entry = (sourceId: string, url: string): AnimeBrowserEntry => ({
+    sourceId,
+    sourceName: sourceId,
+    url,
+    title: url,
+    thumbnailUrl: null,
+  });
+  const seen = new Set<string>();
+
+  assert.deepEqual(takeUnseenEntries([entry('one', '/a')], seen), [entry('one', '/a')]);
+  assert.deepEqual(takeUnseenEntries([entry('one', '/a'), entry('two', '/a')], seen), [
+    entry('two', '/a'),
+  ]);
+});
@@ -0,0 +1,133 @@
+import type { AnimeBrowserEntry } from '../types/anime-browser';
+
+export interface BrowseState {
+  requestId: number;
+  query: string;
+  page: number;
+  loading: boolean;
+  hasNextPage: boolean;
+}
+
+export interface BrowseRequest {
+  id: number;
+  query: string;
+  page: number;
+  append: boolean;
+}
+
+export interface StartedBrowse {
+  state: BrowseState;
+  request: BrowseRequest;
+}
+
+export function createBrowseState(): BrowseState {
+  return { requestId: 0, query: '', page: 0, loading: false, hasNextPage: false };
+}
+
+export function beginBrowse(state: BrowseState, query: string): StartedBrowse {
+  const request: BrowseRequest = {
+    id: state.requestId + 1,
+    query,
+    page: 1,
+    append: false,
+  };
+  return {
+    state: {
+      requestId: request.id,
+      query,
+      page: request.page,
+      loading: true,
+      hasNextPage: false,
+    },
+    request,
+  };
+}
+
+export function beginNextPage(state: BrowseState): StartedBrowse | null {
+  if (state.loading || !state.hasNextPage) return null;
+  const request: BrowseRequest = {
+    id: state.requestId + 1,
+    query: state.query,
+    page: state.page + 1,
+    append: true,
+  };
+  return {
+    state: {
+      ...state,
+      requestId: request.id,
+      page: request.page,
+      loading: true,
+      hasNextPage: false,
+    },
+    request,
+  };
+}
+
+export function soleBrowseRequest(
+  inFlight: ReadonlyMap<number, BrowseRequest>,
+): BrowseRequest | null {
+  if (inFlight.size !== 1) return null;
+  return inFlight.values().next().value ?? null;
+}
+
+export function finishBrowse(
+  state: BrowseState,
+  requestId: number,
+  hasNextPage: boolean,
+): BrowseState {
+  if (requestId !== state.requestId) return state;
+  return { ...state, loading: false, hasNextPage };
+}
+
+export function failBrowse(state: BrowseState, request: BrowseRequest): BrowseState {
+  if (request.id !== state.requestId) return state;
+  return {
+    ...state,
+    page: request.append ? request.page - 1 : request.page,
+    loading: false,
+    hasNextPage: request.append,
+  };
+}
+
+export class LatestRequest {
+  private current = 0;
+
+  begin(): number {
+    return ++this.current;
+  }
+
+  cancel(): void {
+    this.current += 1;
+  }
+
+  isCurrent(request: number): boolean {
+    return request === this.current;
+  }
+}
+
+export function safeUploadDate(uploadedAt: number): string | null {
+  const date = new Date(uploadedAt);
+  return Number.isFinite(date.getTime()) ? date.toISOString().slice(0, 10) : null;
+}
+
+export type Captured<T> = { ok: true; value: T } | { ok: false; error: unknown };
+
+export async function capture<T>(operation: () => Promise<T>): Promise<Captured<T>> {
+  try {
+    return { ok: true, value: await operation() };
+  } catch (error) {
+    return { ok: false, error };
+  }
+}
+
+export function takeUnseenEntries(
+  entries: AnimeBrowserEntry[],
+  seen: Set<string>,
+): AnimeBrowserEntry[] {
+  return entries.filter((entry) => {
+    const key = `${entry.sourceId}\0${entry.url}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
@@ -0,0 +1,189 @@
+import { capture, LatestRequest, safeUploadDate } from './browse-state';
+import { describe, el } from './dom';
+import type {
+  AnimeBrowserAPI,
+  AnimeBrowserEntry,
+  AnimeBrowserEpisode,
+} from '../types/anime-browser';
+
+interface DetailPanelOptions {
+  api: AnimeBrowserAPI;
+  setStatus: (message: string, tone?: 'info' | 'ok' | 'error') => void;
+}
+
+export function createDetailPanel({ api, setStatus }: DetailPanelOptions) {
+  const results = el<HTMLElement>('results');
+  const detail = el<HTMLElement>('detail');
+  const detailBack = el<HTMLButtonElement>('detail-back');
+  const detailCover = el<HTMLImageElement>('detail-cover');
+  const detailTitle = el<HTMLHeadingElement>('detail-title');
+  const detailChips = el<HTMLDivElement>('detail-chips');
+  const detailDescription = el<HTMLParagraphElement>('detail-description');
+  const episodes = el<HTMLOListElement>('episodes');
+  const episodesCount = el<HTMLSpanElement>('episodes-count');
+
+  let selectedAnime: { url: string; title: string; sourceId: string } | null = null;
+  let resultsScrollTop = 0;
+  const requests = new LatestRequest();
+  const playbacks = new LatestRequest();
+
+  function formatEpisodeIndex(episode: AnimeBrowserEpisode, fallbackIndex: number): string {
+    const value = episode.number ?? fallbackIndex;
+    return Number.isInteger(value) ? String(value).padStart(2, '0') : value.toFixed(1);
+  }
+
+  async function playEpisode(
+    button: HTMLButtonElement,
+    episode: AnimeBrowserEpisode,
+  ): Promise<void> {
+    const anime = selectedAnime;
+    if (!anime) return;
+
+    // Only the newest click owns the button states and the status line; an
+    // earlier episode resolving late must not overwrite them.
+    const playback = playbacks.begin();
+    for (const other of episodes.querySelectorAll<HTMLButtonElement>('.cue')) {
+      other.removeAttribute('data-state');
+    }
+    button.dataset.state = 'loading';
+    setStatus(`Resolving ${episode.name}…`);
+
+    const attempt = await capture(() =>
+      api.playEpisode({
+        sourceId: anime.sourceId,
+        animeUrl: anime.url,
+        animeTitle: anime.title,
+        episodeUrl: episode.url,
+        episodeName: episode.name,
+        episodeNumber: episode.number,
+      }),
+    );
+
+    if (!playbacks.isCurrent(playback)) return;
+
+    if (!attempt.ok) {
+      button.removeAttribute('data-state');
+      setStatus(describe(attempt.error), 'error');
+      return;
+    }
+
+    const result = attempt.value;
+    if (result.ok) {
+      button.dataset.state = 'playing';
+      setStatus(
+        result.quality ? `Playing ${episode.name} · ${result.quality}` : `Playing ${episode.name}`,
+        'ok',
+      );
+    } else {
+      button.removeAttribute('data-state');
+      setStatus(result.error ?? 'Could not play that episode.', 'error');
+    }
+  }
+
+  function renderEpisodes(list: AnimeBrowserEpisode[]): void {
+    episodesCount.textContent = list.length === 0 ? '' : `${list.length}`;
+    episodes.replaceChildren(
+      ...list.map((episode, index) => {
+        const item = document.createElement('li');
+        const button = document.createElement('button');
+        button.type = 'button';
+        button.className = 'cue';
+
+        const cueIndex = document.createElement('span');
+        cueIndex.className = 'cue-index';
+        cueIndex.textContent = formatEpisodeIndex(episode, list.length - index);
+
+        const name = document.createElement('span');
+        name.className = 'cue-name';
+        name.textContent = episode.name;
+        if (episode.uploadedAt !== null) {
+          const uploaded = safeUploadDate(episode.uploadedAt);
+          if (uploaded) {
+            const sub = document.createElement('span');
+            sub.className = 'cue-sub';
+            sub.textContent = uploaded;
+            name.append(sub);
+          }
+        }
+
+        button.append(cueIndex, name);
+        button.addEventListener('click', () => void playEpisode(button, episode));
+        item.append(button);
+        return item;
+      }),
+    );
+  }
+
+  async function open(entry: AnimeBrowserEntry): Promise<void> {
+    const request = requests.begin();
+    selectedAnime = { url: entry.url, title: entry.title, sourceId: entry.sourceId };
+    resultsScrollTop = results.scrollTop;
+    results.classList.add('hidden');
+    detail.classList.remove('hidden');
+    detail.scrollTop = 0;
+    detailTitle.textContent = entry.title;
+    detailDescription.textContent = 'Loading…';
+    detailChips.replaceChildren();
+    episodes.replaceChildren();
+    episodesCount.textContent = '';
+    detailCover.src = entry.thumbnailUrl ?? '';
+
+    try {
+      const [details, episodeList] = await Promise.all([
+        api.getDetails(entry.url, entry.sourceId),
+        api.getEpisodes(entry.url, entry.sourceId),
+      ]);
+      if (!requests.isCurrent(request)) return;
+
+      detailTitle.textContent = details.title;
+      detailDescription.textContent = details.description ?? 'No description from this source.';
+      if (details.thumbnailUrl) detailCover.src = details.thumbnailUrl;
+
+      const chips: HTMLSpanElement[] = [];
+      const source = document.createElement('span');
+      source.className = 'chip source';
+      source.textContent = entry.sourceName;
+      chips.push(source);
+      if (details.status !== 'unknown') {
+        const status = document.createElement('span');
+        status.className = 'chip status';
+        status.textContent = details.status.replace(/-/g, ' ');
+        chips.push(status);
+      }
+      for (const genre of details.genres.slice(0, 6)) {
+        const chip = document.createElement('span');
+        chip.className = 'chip';
+        chip.textContent = genre;
+        chips.push(chip);
+      }
+      detailChips.replaceChildren(...chips);
+
+      renderEpisodes(episodeList);
+      setStatus(`${details.title} · ${episodeList.length} episodes`);
+    } catch (error) {
+      if (!requests.isCurrent(request)) return;
+      detailDescription.textContent = '';
+      setStatus(describe(error), 'error');
+    }
+  }
+
+  function close(): void {
+    requests.cancel();
+    playbacks.cancel();
+    detail.classList.add('hidden');
+    results.classList.remove('hidden');
+    results.scrollTop = resultsScrollTop;
+    selectedAnime = null;
+  }
+
+  detailBack.addEventListener('click', close);
+  document.addEventListener('keydown', (event) => {
+    if (event.key === 'Escape' && !detail.classList.contains('hidden')) close();
+  });
+
+  return {
+    open,
+    close,
+    isOpen: (): boolean => !detail.classList.contains('hidden'),
+  };
+}
@@ -0,0 +1,272 @@
+/* ---------- detail page ---------- */
+
+/*
+ * The detail view is a page, not a sidebar: it takes over the whole content
+ * region while the results grid waits, hidden, behind the Back button.
+ */
+.detail {
+  flex: 1 1 auto;
+  min-width: 0;
+  background: var(--panel);
+  overflow-y: auto;
+  padding: 20px clamp(20px, 5vw, 56px) 32px;
+  animation: detail-in 0.28s ease both;
+}
+
+@keyframes detail-in {
+  from {
+    opacity: 0;
+    transform: translateY(10px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
+}
+
+.detail-body {
+  max-width: 1040px;
+  margin: 0 auto;
+}
+
+.detail-back {
+  padding: 6px 14px;
+  font-size: 12px;
+  margin-bottom: 20px;
+}
+
+.detail-head {
+  display: flex;
+  gap: clamp(18px, 3vw, 36px);
+  margin-bottom: 28px;
+}
+
+.detail-cover {
+  flex: none;
+  align-self: flex-start;
+  width: clamp(140px, 18vw, 232px);
+  height: auto;
+  border-radius: 12px;
+  border: 1px solid var(--line);
+  background: var(--ctp-crust);
+  box-shadow: 0 18px 40px -24px var(--shadow);
+}
+
+.detail-title {
+  margin: 0 0 10px;
+  font-size: clamp(19px, 2.4vw, 27px);
+  font-weight: 600;
+  line-height: 1.25;
+}
+
+.detail-chips {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+  margin-bottom: 10px;
+}
+
+.chip {
+  padding: 2px 8px;
+  border-radius: 999px;
+  border: 1px solid var(--line);
+  font-size: 11px;
+  color: var(--muted);
+}
+
+.chip.status {
+  border-color: rgba(166, 218, 149, 0.4);
+  color: var(--ok);
+}
+
+/* Which extension answered — the one chip that is always present. */
+.chip.source {
+  border-color: color-mix(in srgb, var(--accent) 40%, transparent);
+  color: var(--accent);
+}
+
+.detail-description {
+  margin: 0;
+  font-size: 13px;
+  max-width: 72ch;
+  color: var(--muted);
+  white-space: pre-wrap;
+}
+
+.episodes-head {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  margin-bottom: 10px;
+  padding-bottom: 8px;
+  border-bottom: 1px solid var(--line);
+}
+
+.episodes-title {
+  margin: 0;
+  font-size: 11px;
+  font-weight: 700;
+  letter-spacing: 0.18em;
+  text-transform: uppercase;
+  color: var(--faint);
+}
+
+.episodes-count {
+  font-family: var(--mono);
+  font-size: 11px;
+  color: var(--faint);
+}
+
+/*
+ * The cue rail: episodes read as subtitle cues on a timeline, because that is
+ * what they are about to become. The rail is the spine, the index is the cue
+ * number, and the title is the cue text.
+ */
+
+.cue-rail {
+  list-style: none;
+  margin: 0;
+  padding: 0 0 0 2px;
+  position: relative;
+}
+
+.cue-rail::before {
+  content: '';
+  position: absolute;
+  left: 48px;
+  top: 6px;
+  bottom: 6px;
+  width: 1px;
+  background: var(--line);
+}
+
+.cue {
+  position: relative;
+  display: grid;
+  grid-template-columns: 34px 1fr;
+  gap: 26px;
+  align-items: baseline;
+  width: 100%;
+  padding: 9px 10px 9px 0;
+  border: none;
+  border-radius: 8px;
+  background: none;
+  color: inherit;
+  font: inherit;
+  text-align: left;
+  cursor: pointer;
+  transition: background 0.14s ease;
+}
+
+.cue::after {
+  content: '';
+  position: absolute;
+  left: 43px;
+  top: 15px;
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  background: var(--ctp-surface0);
+  border: 1px solid var(--line);
+  transition:
+    background 0.14s ease,
+    border-color 0.14s ease;
+}
+
+.cue:hover,
+.cue:focus-visible {
+  background: var(--panel-elevated);
+}
+
+.cue:hover::after,
+.cue:focus-visible::after {
+  background: var(--mine);
+  border-color: var(--mine);
+}
+
+.cue-index {
+  font-family: var(--mono);
+  font-size: 12px;
+  color: var(--faint);
+  text-align: right;
+  font-variant-numeric: tabular-nums;
+}
+
+.cue-name {
+  font-size: 13px;
+  line-height: 1.4;
+}
+
+.cue-sub {
+  display: block;
+  font-family: var(--mono);
+  font-size: 11px;
+  color: var(--faint);
+  margin-top: 2px;
+}
+
+.cue[data-state='loading'] {
+  background: var(--panel-elevated);
+}
+
+.cue[data-state='loading']::after {
+  background: var(--accent);
+  border-color: var(--accent);
+  animation: pulse 1.1s ease-in-out infinite;
+}
+
+.cue[data-state='playing']::after {
+  background: var(--mine);
+  border-color: var(--mine);
+}
+
+/* ---------- status bar ---------- */
+
+.statusbar {
+  flex: none;
+  padding: 7px 20px;
+  border-top: 1px solid var(--line);
+  background: var(--ctp-mantle);
+  font-size: 12px;
+  color: var(--faint);
+  min-height: 30px;
+}
+
+.statusbar[data-tone='error'] {
+  color: var(--danger);
+}
+
+.statusbar[data-tone='ok'] {
+  color: var(--ok);
+}
+
+/* ---------- scrollbars ---------- */
+
+::-webkit-scrollbar {
+  width: 10px;
+  height: 10px;
+}
+
+::-webkit-scrollbar-track {
+  background: transparent;
+}
+
+::-webkit-scrollbar-thumb {
+  background: var(--ctp-surface0);
+  border-radius: 6px;
+  border: 2px solid var(--bg);
+}
+
+::-webkit-scrollbar-thumb:hover {
+  background: var(--faint);
+}
+
+@media (prefers-reduced-motion: reduce) {
+  *,
+  *::before,
+  *::after {
+    animation-duration: 0.01ms !important;
+    animation-iteration-count: 1 !important;
+    transition-duration: 0.01ms !important;
+  }
+}
@@ -0,0 +1,13 @@
+/** Small helpers shared by the anime browser's panels. */
+
+export function el<T extends HTMLElement>(id: string): T {
+  const node = document.getElementById(id);
+  if (!node) throw new Error(`Missing element #${id}`);
+  return node as T;
+}
+
+export function describe(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error);
+  // Electron wraps handler errors; keep only the useful tail.
+  return message.replace(/^Error invoking remote method '[^']+':\s*/, '').replace(/^Error:\s*/, '');
+}
@@ -0,0 +1,345 @@
+import { describe, el } from './dom';
+import { describeInstalled } from './format';
+import {
+  collectLanguages,
+  filterByLanguage,
+  languageLabel,
+  pruneSelection,
+  toggleLanguage,
+} from './language-filter';
+import type {
+  AnimeBrowserAPI,
+  AvailableExtension,
+  InstalledExtensionView,
+} from '../types/anime-browser';
+
+/**
+ * The Extensions tab: what is installed, which repositories feed it, and what
+ * those repositories still offer.
+ *
+ * Installed extensions get their own section at the top, listed from the
+ * extensions directory rather than from a repository catalogue — an APK dropped
+ * in by hand, or one whose repository has since been removed, is still
+ * installed and has to stay removable.
+ */
+
+export interface ExtensionsPanelOptions {
+  api: AnimeBrowserAPI;
+  setStatus: (message: string, tone?: 'info' | 'ok' | 'error') => void;
+  /** Called after an install or removal, so the source picker keeps up. */
+  onSourcesChanged: () => Promise<void>;
+}
+
+interface RowAction {
+  label: string;
+  primary?: boolean;
+  onClick: () => void | Promise<void>;
+}
+
+interface RowOptions {
+  name: string;
+  sub: string;
+  tags?: Array<{ text: string; className: string }>;
+  actions?: RowAction[];
+  isError?: boolean;
+}
+
+function extensionRow(options: RowOptions): HTMLDivElement {
+  const row = document.createElement('div');
+  row.className = options.isError ? 'ext-row is-error' : 'ext-row';
+
+  const main = document.createElement('div');
+  main.className = 'ext-main';
+  const name = document.createElement('div');
+  name.className = 'ext-name';
+  name.textContent = options.name;
+  const sub = document.createElement('div');
+  sub.className = 'ext-sub';
+  sub.textContent = options.sub;
+  main.append(name, sub);
+  row.append(main);
+
+  for (const tag of options.tags ?? []) {
+    const chip = document.createElement('span');
+    chip.className = `ext-tag ${tag.className}`;
+    chip.textContent = tag.text;
+    row.append(chip);
+  }
+
+  for (const action of options.actions ?? []) {
+    const button = document.createElement('button');
+    button.type = 'button';
+    button.className = action.primary ? 'primary-button' : 'ghost-button';
+    button.textContent = action.label;
+    button.addEventListener('click', () => {
+      button.disabled = true;
+      void Promise.resolve(action.onClick()).finally(() => {
+        button.disabled = false;
+      });
+    });
+    row.append(button);
+  }
+
+  return row;
+}
+
+function emptyNote(text: string): HTMLParagraphElement {
+  const empty = document.createElement('p');
+  empty.className = 'ext-empty';
+  empty.textContent = text;
+  return empty;
+}
+
+export function createExtensionsPanel(options: ExtensionsPanelOptions) {
+  const { api, setStatus, onSourcesChanged } = options;
+
+  const extensionsDirLabel = el<HTMLSpanElement>('extensions-dir');
+  const installedList = el<HTMLDivElement>('installed-list');
+  const installedCount = el<HTMLSpanElement>('installed-count');
+  const availableList = el<HTMLDivElement>('extensions-list');
+  const availableCount = el<HTMLSpanElement>('available-count');
+  const langFilter = el<HTMLDivElement>('lang-filter');
+  const repoInput = el<HTMLInputElement>('repo-input');
+  const repoAddButton = el<HTMLButtonElement>('repo-add');
+  const repoList = el<HTMLDivElement>('repo-list');
+
+  // What the last refresh found, kept so toggling a language chip re-renders
+  // the list without re-fetching every repository index.
+  let installable: AvailableExtension[] = [];
+  let repoFailures: Array<{ name: string; error: string }> = [];
+  let hasRepos = false;
+  /** Selected language codes; empty means "All". */
+  let selectedLangs = new Set<string>();
+
+  async function afterChange(extensionName: string, verb: string): Promise<void> {
+    await refresh();
+    await onSourcesChanged();
+    setStatus(`${extensionName} ${verb}`, 'ok');
+  }
+
+  function renderInstalled(
+    installed: InstalledExtensionView[],
+    offeredPkgs: Set<string>,
+    extensionsDir: string,
+  ): void {
+    installedCount.textContent = installed.length === 0 ? '' : String(installed.length);
+
+    if (installed.length === 0) {
+      installedList.replaceChildren(
+        emptyNote(
+          `Nothing installed yet. Add a repository below, or drop .apk files in ${extensionsDir}.`,
+        ),
+      );
+      return;
+    }
+
+    installedList.replaceChildren(
+      ...installed.map((view) => {
+        const actions: RowAction[] = [];
+        // Only offer an update for an extension a configured repository still
+        // carries; reinstalling overwrites the APK in place.
+        if (offeredPkgs.has(view.pkg)) {
+          actions.push({
+            label: 'Update',
+            onClick: async () => {
+              setStatus(`Updating ${view.name}…`);
+              try {
+                await api.installExtension(view.pkg);
+                await afterChange(view.name, 'updated');
+              } catch (error) {
+                setStatus(describe(error), 'error');
+              }
+            },
+          });
+        }
+        actions.push({
+          label: 'Remove',
+          onClick: async () => {
+            setStatus(`Removing ${view.name}…`);
+            try {
+              await api.removeExtension(view.pkg);
+              await afterChange(view.name, 'removed');
+            } catch (error) {
+              setStatus(describe(error), 'error');
+            }
+          },
+        });
+
+        return extensionRow({
+          name: view.name,
+          sub: view.error ?? describeInstalled(view),
+          isError: view.error !== null,
+          tags: view.error === null ? [] : [{ text: 'failed', className: 'nsfw' }],
+          actions,
+        });
+      }),
+    );
+  }
+
+  function renderRepos(repos: string[]): void {
+    repoList.replaceChildren(
+      ...repos.map((repoUrl) =>
+        extensionRow({
+          name: repoUrl.replace(/^https:\/\//, '').replace(/\/[^/]*\.json$/, ''),
+          sub: repoUrl,
+          actions: [
+            {
+              label: 'Remove',
+              onClick: async () => {
+                setStatus('Removing repository…');
+                try {
+                  await api.removeRepo(repoUrl);
+                  await refresh();
+                  setStatus('Repository removed', 'ok');
+                } catch (error) {
+                  setStatus(describe(error), 'error');
+                }
+              },
+            },
+          ],
+        }),
+      ),
+    );
+  }
+
+  function languageChip(label: string, active: boolean, onClick: () => void): HTMLButtonElement {
+    const chip = document.createElement('button');
+    chip.type = 'button';
+    chip.className = active ? 'lang-chip is-active' : 'lang-chip';
+    chip.textContent = label;
+    chip.setAttribute('aria-pressed', active ? 'true' : 'false');
+    chip.addEventListener('click', onClick);
+    return chip;
+  }
+
+  function renderLanguageFilter(languages: string[]): void {
+    // One language, or none: there is nothing to choose between.
+    if (languages.length < 2) {
+      langFilter.replaceChildren();
+      return;
+    }
+
+    langFilter.replaceChildren(
+      // "All" is the empty selection, so picking a language always replaces it
+      // rather than sitting alongside it.
+      languageChip('All', selectedLangs.size === 0, () => {
+        if (selectedLangs.size === 0) return;
+        selectedLangs = new Set();
+        renderAvailable();
+      }),
+      ...languages.map((code) =>
+        languageChip(languageLabel(code), selectedLangs.has(code), () => {
+          selectedLangs = toggleLanguage(selectedLangs, code);
+          renderAvailable();
+        }),
+      ),
+    );
+  }
+
+  function renderAvailable(): void {
+    const languages = collectLanguages(installable);
+    selectedLangs = pruneSelection(selectedLangs, languages);
+    renderLanguageFilter(languages);
+
+    const shown = filterByLanguage(installable, selectedLangs);
+    availableCount.textContent =
+      shown.length === installable.length
+        ? installable.length === 0
+          ? ''
+          : String(installable.length)
+        : `${shown.length} of ${installable.length}`;
+
+    const rows: HTMLElement[] = repoFailures.map((failure) =>
+      extensionRow({ name: failure.name, sub: failure.error, isError: true }),
+    );
+
+    for (const extension of shown) {
+      rows.push(
+        extensionRow({
+          name: extension.name,
+          sub: `${languageLabel(extension.lang)} · v${extension.version}`,
+          tags: extension.nsfw ? [{ text: '18+', className: 'nsfw' }] : [],
+          actions: [
+            {
+              label: 'Install',
+              primary: true,
+              onClick: async () => {
+                setStatus(`Installing ${extension.name}…`);
+                try {
+                  await api.installExtension(extension.pkg);
+                  await afterChange(extension.name, 'installed');
+                } catch (error) {
+                  setStatus(describe(error), 'error');
+                }
+              },
+            },
+          ],
+        }),
+      );
+    }
+
+    if (rows.length === 0) {
+      rows.push(
+        emptyNote(
+          selectedLangs.size > 0
+            ? 'No available extension matches the selected languages.'
+            : hasRepos
+              ? 'Every extension the configured repositories offer is already installed.'
+              : 'No repository configured, so there is nothing to install from.',
+        ),
+      );
+    }
+
+    availableList.replaceChildren(...rows);
+  }
+
+  async function refresh(): Promise<void> {
+    const snapshot = await api.getSnapshot();
+    extensionsDirLabel.textContent = snapshot.extensionsDir;
+    renderRepos(snapshot.repos);
+
+    repoFailures = [];
+    let available;
+    try {
+      available = await api.listAvailableExtensions();
+    } catch (error) {
+      repoFailures.push({ name: 'Repository error', error: describe(error) });
+      available = { extensions: [], failures: [] };
+    }
+    for (const failure of available.failures) {
+      repoFailures.push({ name: failure.repoUrl, error: failure.error });
+    }
+
+    const offeredPkgs = new Set(available.extensions.map((extension) => extension.pkg));
+    renderInstalled(snapshot.installed, offeredPkgs, snapshot.extensionsDir);
+    // Installed extensions have their own section; leaving them here too would
+    // list every one of them twice.
+    installable = available.extensions.filter((extension) => !extension.installed);
+    hasRepos = snapshot.repos.length > 0;
+    renderAvailable();
+  }
+
+  repoAddButton.addEventListener('click', () => {
+    void (async () => {
+      const url = repoInput.value.trim();
+      if (url.length === 0) return;
+      try {
+        await api.addRepo(url);
+        repoInput.value = '';
+        setStatus('Repository added');
+        await refresh();
+      } catch (error) {
+        setStatus(describe(error), 'error');
+      }
+    })();
+  });
+
+  repoInput.addEventListener('keydown', (event) => {
+    if (event.key === 'Enter') {
+      event.preventDefault();
+      repoAddButton.click();
+    }
+  });
+
+  return { refresh };
+}
@@ -0,0 +1,60 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { describeInstalled, sourceOptionLabel, summarizeSearch } from './format';
+import type { AnimeBrowserSearchResult } from '../types/anime-browser';
+
+const result = (
+  entryCount: number,
+  failures: AnimeBrowserSearchResult['failures'] = [],
+): AnimeBrowserSearchResult => ({
+  entries: Array.from({ length: entryCount }, (_unused, index) => ({
+    url: `/a/${index}`,
+    title: `Anime ${index}`,
+    thumbnailUrl: null,
+    sourceId: 's',
+    sourceName: 'Source',
+  })),
+  hasNextPage: false,
+  failures,
+});
+
+test('sourceOptionLabel omits the language for an all-language source', () => {
+  assert.equal(sourceOptionLabel({ id: '1', name: 'Nyaa', lang: 'ja', pkg: 'p' }), 'Nyaa (ja)');
+  assert.equal(sourceOptionLabel({ id: '2', name: 'Jellyfin', lang: 'all', pkg: 'p' }), 'Jellyfin');
+});
+
+test('summarizeSearch counts results and singularizes one', () => {
+  assert.equal(summarizeSearch(result(4)), '4 results');
+  assert.equal(summarizeSearch(result(1)), '1 result');
+  assert.equal(summarizeSearch(result(0)), '0 results');
+});
+
+test('summarizeSearch names the sources that failed alongside the ones that answered', () => {
+  const summary = summarizeSearch(
+    result(6, [
+      { sourceId: 'a', sourceName: 'Alpha', error: 'login required' },
+      { sourceId: 'b', sourceName: 'Beta', error: 'timed out' },
+    ]),
+  );
+  assert.equal(summary, '6 results · 2 unavailable: Alpha, Beta');
+});
+
+test('describeInstalled reports sources and languages when the extension loaded', () => {
+  assert.equal(
+    describeInstalled({
+      pkg: 'multi',
+      name: 'One, Two',
+      langs: ['en', 'ja'],
+      sourceCount: 2,
+      error: null,
+    }),
+    'multi · 2 sources · en, ja',
+  );
+});
+
+test('describeInstalled falls back to the package alone when nothing loaded', () => {
+  assert.equal(
+    describeInstalled({ pkg: 'broken', name: 'broken', langs: [], sourceCount: 0, error: 'boom' }),
+    'broken',
+  );
+});
@@ -0,0 +1,35 @@
+import type {
+  AnimeBrowserSearchResult,
+  AnimeBrowserSource,
+  InstalledExtensionView,
+} from '../types/anime-browser';
+
+/** Display strings for the anime browser, kept separate from the DOM. */
+
+/** `Nyaa (ja)`, or just the name for a source that serves every language. */
+export function sourceOptionLabel(source: AnimeBrowserSource): string {
+  return source.lang === 'all' ? source.name : `${source.name} (${source.lang})`;
+}
+
+/**
+ * The status line after a search.
+ *
+ * An all-sources search can half-succeed, so the sources that failed are named
+ * rather than folded into a count the user cannot act on.
+ */
+export function summarizeSearch(result: AnimeBrowserSearchResult): string {
+  const count = `${result.entries.length} result${result.entries.length === 1 ? '' : 's'}`;
+  if (result.failures.length === 0) return count;
+  const names = result.failures.map((failure) => failure.sourceName).join(', ');
+  return `${count} · ${result.failures.length} unavailable: ${names}`;
+}
+
+/** `pkg · 3 sources · en, ja`, trimmed to what the extension actually reported. */
+export function describeInstalled(view: InstalledExtensionView): string {
+  const parts = [view.pkg];
+  if (view.sourceCount > 0) {
+    parts.push(`${view.sourceCount} source${view.sourceCount === 1 ? '' : 's'}`);
+  }
+  if (view.langs.length > 0) parts.push(view.langs.join(', '));
+  return parts.join(' · ');
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
sudacode	96ecb4a136	fix(anime): stop superseded playEpisode calls from touching mpv - Extend the generation guard from subtitleCacheDir to the whole playback: a stale playEpisode call now bails out before sending mpv commands, showing the overlay, or reading a playback outcome that belongs to a newer episode - Add a regression test where a slow-resolving first call must not drive mpv after a second call for a newer episode has already started playing	2026-08-02 03:39:17 -07:00
sudacode	10ad19f934	fix(anime): guard playback races and harden install/extract tests - Tag subtitle cache writes with a generation counter so overlapping playEpisode calls can't clobber the shared cache dir, and don't fail playback when track setup errors - Ignore stale episode clicks in the detail panel via a LatestRequest guard on playback - Extract a resetGrid helper in animeui to dedupe grid-clearing logic - Assert reader cancellation and extracted-file writes actually happen in installer/subsync tests	2026-08-02 02:04:24 -07:00
sudacode	fbfdea7c64	fix(anime): scope preferences, paginate sources, harden installs - Preference store keys entries by extension package + bridge source id; legacy unscoped entries are discarded once instead of being handed to whichever extension asks first - Source picker's "Load more" appends the next page without duplicating streamed results - Repository index fetches and subtitle/APK downloads now time out and are size-bounded instead of hanging or growing unbounded - APK installs are staged to a temp file and renamed into place - Stream metadata lookup matches the requested path, not only the currently playing one - Reworked animeui into browse-state/detail-panel/panels.css modules - Reverted premature CHANGELOG unreleased entries; refreshed anime-browser docs	2026-08-02 00:50:14 -07:00
sudacode	a2533118eb	docs: catch up docs for anilist, anime browser, and subsync fixes - Add changelog entries for the split-cour AniList season resolution fix and the subsync stream-track fixes - Document anime browser language filter, stream subtitle download-to-disk behavior, and series/season/episode metadata threading - Update domain ownership and knowledge-base catalog for the anime browser modules - Trim the credits table and clarify the M-Extension-Server licensing note in README	2026-08-02 00:11:02 -07:00
sudacode	722222c651	fix(anime): thread episode metadata through stream playback and fix seas - Split anime browser stream titles into series/season/episode fields (episode-metadata.ts) instead of one joined string, so stats grouping, the mpv title, and the Jimaku/TsukiHime modals all get real values instead of a filename-derived "m3u8" - Fix AniList season resolver to walk through split-cour sequels and specials without counting them as a season, and to surface rate-limit/network failures instead of falling through to a wrong air-order guess - Add a Season field to the TsukiHime modal and include later seasons in its search query - Rewrite WebVTT subtitle tracks as SRT before handing them to alass, since alass has no VTT support and streams serve VTT - Update CHANGELOG and troubleshooting docs	2026-08-01 23:34:23 -07:00
sudacode	558e00cb44	fix(subsync): resolve ffmpeg only when a track needs extraction Stream subtitles arrive as URLs and are downloaded, never piped through ffmpeg, so demanding an ffmpeg install up front broke stream syncs (and CI, which has no ffmpeg). Resolution is now lazy, scoped to embedded tracks.	2026-08-01 17:35:59 -07:00
sudacode	4b85ad3eb4	fix(subsync): sync subtitles from stream URLs, auto-discover tool paths - Download URL-loaded subtitle tracks (Aniyomi extension streams, Jellyfin) to a temp file first, reusing mpv's own request headers, instead of rejecting them with "Subtitle file not found" - Pass mpv's headers through to ffmpeg for internal track extraction from streams too - Auto-discover alass/ffsubsync/ffmpeg on PATH and common install prefixes when the config path is empty, instead of a hard-coded /usr/bin fallback that never exists on macOS - Log subsync failures to the app log, not just a toast that vanishes in seconds - Update docs-site and README credits for the new behavior	2026-08-01 17:23:36 -07:00
sudacode	336e9fb8a5	fix(anime): cap outcome polling and upstream stalls by wall clock - watchPlaybackOutcome now tracks a real deadline so slow property reads eat the timeout budget instead of extending it, and a zero probe interval still terminates - stream strip proxy aborts upstream GETs that go silent for 15s instead of hanging mpv on that segment forever - anime browser runtime drops a stream proxy that finishes starting after its bridge already died, instead of leaking a listener pointed at nothing	2026-08-01 03:13:48 -07:00
sudacode	dec7851a17	feat(anime): cache stream subtitles to disk for the alass reference - Download a stream's subtitle tracks to a temp dir and load them into mpv as files instead of streaming from the source URL, so Subsync can use them as the alass reference (mirrors the Jellyfin subtitle preload) - Detect format from content first, falling back to the URL extension - A track that fails to download falls back to its URL so the episode still plays - Remove the temp dir when the next episode loads or the runtime disposes	2026-08-01 02:32:25 -07:00
sudacode	4eaaf5769f	fix(anime): report a failed bridge kill instead of a generic timeout - Track kill errors separately from exit/spawn so a signal failure (e.g. EPERM) surfaces its own message instead of a bare "did not exit after SIGKILL" - Attach stop() failures as the cause on the readiness-timeout error so a surviving child's kill failure isn't dropped - Skip stop() entirely when spawn itself failed, and stop polling once the ready deadline has passed - Add stopTimeoutMs test hook and a test covering a kill that fails without the child exiting	2026-08-01 01:50:19 -07:00
sudacode	0dfba67ae8	style(animeui): tighten source picker and cue rail layout - Lay source picker label + input inline instead of stacked - Let detail cover keep natural aspect ratio instead of forced 2:3 crop - Widen cue rail gutter to match new cue number column width	2026-08-01 01:38:54 -07:00
sudacode	18e0200934	fix(overlay): fall back to did-finish-load when ready-to-show never fires A hidden overlay window stops producing frames once it is explicitly hidden and then reloaded (the Yomitan content-script reload right after startup), so ready-to-show never fires and the content-ready gate keeps the window hidden forever behind the Overlay loading spinner. Mark content ready from did-finish-load after a 1.5s grace period so the overlay always becomes showable; ready-to-show still wins when it fires.	2026-08-01 01:31:48 -07:00
sudacode	d7188a2155	fix(anime): restart the bridge on the next request after it dies The reported 'APK crash' turned out not to exist: repeated full scans of all installed extensions load cleanly. The real incident was the app's quit sequence stopping the bridge (its /stop endpoint) while requests were in flight - and it exposed that a bridge dying for any reason left the anime browser failing every call with a raw 'fetch failed' until the whole app was restarted. SidecarHandle now reports the child's exit (including to late subscribers), and the runtime detects a death it did not order: it drops the dead handle, closes the strip proxy, tells the UI, and the next request transparently starts a fresh bridge. requireBridge became an async bridge() that starts on demand, which also covers first use. Verified live: search -> SIGKILL the JVM -> search recovers.	2026-08-01 01:05:40 -07:00
sudacode	1c50ff74cb	fix(anime): never forward Range to the bridge so 206 replies cannot skip the strip ffmpeg opens every HLS segment with 'Range: bytes=0-'. The bridge answers some of those 206 (depending on its cache state), and the proxy only rewrites full 200 bodies, so the PNG disguise passed through untouched and whether an episode played was a coin flip: first attempts died with "no audio or video data played", the same URL played fine once the bridge had the segments cached. Reproduced end to end against a private bridge + mpv driven with the app's exact commands; with Range dropped every segment is stripped and playback runs.	2026-08-01 00:40:34 -07:00
sudacode	c2781a3f80	fix(anime): retry cold upstream fetches in the stream strip proxy Right after an episode resolves, the bridge (or the host behind it) can error on the very first segment fetches and be fine a moment later; mpv sweeps the playlist of failing segments in ~2s and gives up with "no audio or video data played" while a manual reload of the same URL plays. Retry a failed GET once after 400ms and log upstream error statuses so the next failure names the real cause in the app log.	2026-08-01 00:24:26 -07:00
sudacode	ff25e5cafa	fix(anime): strip disguised HLS segments and report real playback errors Some hosts prepend a fake image header (a real 1x1 PNG) to every HLS segment; ffmpeg probes the segment as a picture and mpv drops back to idle with no window while the browser claims the episode is playing. - Route bridge-served m3u8 streams through a local strip proxy that scans each segment for the first genuine MPEG-TS packet run and drops the junk in front of it; playlists get absolute origins rewritten so segment requests come back through the proxy. Non-TS bodies pass through untouched. - Only report ok from playEpisode once mpv configures a video output; an end-file with reason error surfaces mpv's own message (e.g. "no audio or video data played") in the browser status bar instead of "Playing". New end-file event plumbed through the mpv IPC client.	2026-08-01 00:05:31 -07:00
sudacode	7254db66ad	fix(anime): pin linux-x64 bridge checksum and fetch release by tag - Add PINNED_BUNDLE_SHA256 entry for linux-x64-bundle.zip so Linux no longer refuses to start with "No pinned checksum" - Fetch the bridge release by its pinned tag (releases/tags/<tag>) instead of listing newest releases, so an upstream publish can't swap in an unverified asset - Update docs and changelog to describe the pin/tag behavior	2026-07-31 23:41:52 -07:00
sudacode	3c19228b35	feat(anime): add language filter to extensions available list - Add a language chip row above the Available list; pick one or more languages to narrow the repo index, or "All" to clear - Show language display names (e.g. "Japanese") instead of raw tags, and an "N of M" count on the Available heading - Add language-filter.ts with collectLanguages/toggleLanguage/pruneSelection/filterByLanguage/languageLabel, plus tests	2026-07-31 23:41:14 -07:00
sudacode	2e34f01adf	fix(anime): honor the sidecar readiness deadline and confirm shutdown The capabilities probe used a fixed 5s timeout, so a readiness budget shorter than that could be overrun by one stalled request. Pass the remaining deadline down instead. stop() also resolved after the SIGKILL wait even when the child had not exited, letting a restart race a process still holding the port. Throw in that case, and keep a failed shutdown from masking the readiness error at startup.	2026-07-31 18:07:32 -07:00
sudacode	f5e98dfa9d	fix(anime): harden the extension bridge against untrusted repos and hangs Addresses CodeRabbit review feedback on the Anime Browser: - reject repository package/apk names that are not plain identifiers, and verify the install target resolves inside the extensions directory - count mpv's %n% option escape in UTF-8 bytes, and escape backslashes in header values so a trailing one cannot eat the list separator - key the bridge extension-id cache by APK content, so an in-place upgrade re-uploads instead of running the previous build - bound every bridge, release-listing, and download request with a timeout - enforce the APK size limit while streaming rather than after buffering - read APK bytes on demand instead of holding a base64 copy per extension for the lifetime of the browser - serialize preference mutations and write the file atomically - handle the sidecar spawn error event, and wait for the child to exit in stop() before returning - report a failed Anime Browser bootstrap instead of showing the starting banner forever - keep the preferences panel's save confirmation and in-flight multi-select edits by re-rendering only on a structural schema change	2026-07-31 17:57:01 -07:00
sudacode	e64ff1a0ee	feat(anime): add anime browser powered by Aniyomi extensions - Add `subminer anime` / `--anime` and a tray entry to open a browser that searches installed Aniyomi extension sources, shows cover art and episodes, and plays into mpv with overlay/mining attached - Add an Extensions tab to add repos and install/update/remove sources, and per-source settings for sources needing config - Support searching all sources at once with streaming, per-source results and status - Prefer Japanese audio/subtitle tracks from the source and keep the primary subtitle slot reserved for Japanese - Fix window/tray/Dock handling so the browser and mpv can be switched between without quitting the app or losing the Dock icon - Add anime.repos, anime.extensionsDir, anime.preferredQuality config keys (no bundled repos or discovery)	2026-07-31 17:21:12 -07:00
sudacode	b204d4dd6e	feat(anki): add configurable word card type for Kiku/Lapis (#175 )	2026-07-31 17:17:29 -07:00
sudacode	89ed675935	fix(overlay): keep Yomitan popup interactive on macOS/Windows (#177 )	2026-07-30 19:47:08 -07:00
sudacode	1995200e76	chore(release): prepare v0.19.0	2026-07-29 22:26:03 -07:00
sudacode	e876e483d6	chore(release): prepare v0.19.0-beta.5	2026-07-29 02:09:01 -07:00
sudacode	6d2a72e13b	feat(stats): add library entry deletion and app-wide delete progress (#174 )	2026-07-29 02:00:16 -07:00
sudacode	0d7084c8aa	fix(anilist): resolve later seasons via sequel relations, not title guessing (#173 )	2026-07-28 22:56:26 -07:00
sudacode	95e0abc7b7	test(immersion): apply runtime SQLite pragmas in query tests The query test suite opened each temp database with SQLite's defaults (rollback journal, synchronous=FULL) while the runtime opens them via applyPragmas (WAL, synchronous=NORMAL). Every statement therefore ran as its own fsync-ing transaction. That is unnoticeable on a fast local disk but dominates on CI: the file took 40.6s there versus 0.5s locally, and the 106-insert case 'getVocabularyStats pages past hidden rows' crossed the 5s per-test timeout and failed the quality gate. Open test databases through a helper that applies the same pragmas as production, so the tests exercise the runtime's actual SQLite configuration instead of a slower one.	2026-07-28 02:23:16 -07:00
sudacode	d9155ceacb	docs: update requirements table and Windows install instructions - Add TsukiHime and AniSkip to feature table; note xz dependency - Clarify Anki+AnkiConnect is required to mine, not to run - Rework Windows setup with winget/scoop commands and PATH steps - Note ffmpeg has no path-override setting, unlike mpv - Fix screenshot alt text and installation.md anchor link	2026-07-28 02:10:50 -07:00