Single purpose (store listing): hand off the current page URL, or a media request the user explicitly captures from the active tab, to the local StreamKeep desktop app. The extension does not inspect browsing traffic until the user starts capture for that tab.

1. Visit chrome://extensions, enable Developer mode.
2. Click Load unpacked, pick this browser-extension/ folder.
3. Pin the StreamKeep icon in the toolbar.

1. Visit about:debugging#/runtime/this-firefox.
2. Click Load Temporary Add-on, pick this browser-extension/manifest.json.

1. Open StreamKeep → Settings tab → Browser companion. Tick Enable.
2. Select New code and note the loopback port. The one-use code expires after five minutes.
3. Click the StreamKeep browser icon, enter the port and code, then select Pair.
4. Click Test pairing — should show Paired with StreamKeep.

Open any supported page (Kick, Twitch, YouTube, Rumble, etc.), click the icon, and then:

• Send to Fetch — StreamKeep jumps to the Download tab and fetches immediately.
• Send to Queue — Queued silently; StreamKeep shows a status toast.

For a protected, DRM-free manifest or direct media request, open the extension popup and select Capture this tab before starting playback. This explicit action uses Chrome's temporary activeTab grant and installs request listeners only for that tab's current http(s) origin; navigating the tab stops capture. Play the media, then choose a discovered .m3u8, .mpd, or media URL and send it to Fetch or Queue. Candidates and replay headers remain in session storage, and the handoff allowlist carries the request's Referer, Origin, User-Agent, Cookie, and Authorization values when present. The desktop server drops all other browser headers and keeps the captured context transient rather than writing it to the queue database or resume files. Encrypted media extensions (EME/DRM) are outside this workflow.

• The application server binds strictly to 127.0.0.1. Optional LAN access requires an explicitly configured HTTPS reverse proxy on the StreamKeep PC.
• The extension has no broad host grant: capture is opt-in through activeTab and is scoped to the active tab's current origin. The loopback host permission is retained only for the desktop handoff.
• All loopback HTTP requests are made by the background service worker; popup pages send validated messages to that worker.
• Pairing codes are short-lived and one-use. The issued client token is origin-bound, scoped, and held only in browser session storage.
• Every mutating request includes a fresh timestamp and cryptographic nonce; Host, Origin, and cross-site metadata are validated by the server.
• Re-pairing uses a new code; no extension re-install is needed.