The companion extension

The companion is a small Manifest V3 browser extension for Chromium browsers (Chrome, Edge, Brave) and Firefox 140+. Its only job is local CORS unblock and header injection, so the in-browser sources engine can resolve gated streams and play them straight from the CDN to the viewer, with no backend and no proxy in the byte path.

The visitor presses one red button, Use Extension; everything else happens in the background.

Why it’s the best playback path

A plain browser can’t read most cross-origin responses (CORS) or set Referer / Origin / User-Agent headers. The proxy solves that, but from a datacenter IP. The extension solves all of it from a real browser on the viewer’s own connection:

Capability	Proxy (E2)	Extension (E3)
Read cross-origin responses	✅ relay	✅ host access
Inject forbidden headers	✅	✅
Pass anti-bot fingerprint checks	❌ datacenter	✅ real browser
Mint IP/ASN-bound tokens correctly	❌ wrong IP	✅ viewer’s IP
Video bytes off your backend	✅ via edge	✅ direct CDN → viewer

It holds no secrets, signs nothing, and knows nothing source-specific: the page (your sources engine) drives it. While toggled off, it answers handshakes (so the page knows it exists) but does no work.

It has no build step

The extension is plain JS/CSS/JSON with no bundler. To load it unpacked in Chrome or Edge:

1. Visit chrome://extensions and enable Developer mode.
2. Load unpacked and select the crimson-extension/ folder.
3. Open your Haven, click the toolbar sigil, press Use Extension.

In Firefox, use about:debugging#/runtime/this-firefox → Load Temporary Add-on… and pick manifest.json (or run npx web-ext run in the folder).

Distributing it to your visitors

The companion is published on the Chrome Web Store and on Firefox Add-ons, so visitors install it in one click and the browser keeps it updated:

• The /extension page on your site links to the Chrome Web Store listing, and a home-page banner nudges visitors who don’t have it yet (hidden once it is detected via window.CrimsonExtension).
• Nothing is baked into the client image. The client no longer vendors the extension, and the old zip-and-side-load download flow is retired.

It works on self-hosted Havens too

The same public listing works on any self-hosted instance, without forking or republishing. The catch: the extension only injects its page bridge (window.CrimsonExtension) on origins it is allowed on. Out of the box that is crimsonhaven.to (and subdomains) and localhost. For your own domain, the user enables it per site:

1. Install the companion from the store.
2. On your Haven, open the companion popup and click “Enable on yourhaven.com”.
3. The browser shows its native permission prompt for that site. On grant, the companion registers its bridge for that origin (via chrome.scripting.registerContentScripts) and reloads the tab. From then on it is active there, just like on crimsonhaven.to.

A self-hoster only needs to change the extension (fork it, add their host to the manifest matches, and load it unpacked) to modify its behaviour. To use it, the store listing and the per-site toggle are enough.

Note

Enabling a site controls where the bridge is injected. The privileged fetch/header rewrite still needs the broad host access requested when you press the red button: it targets unpredictable third-party CDNs, so that grant can’t be per-domain.

Three capabilities

1. Privileged fetch: a cross-origin fetch from the extension’s service worker (no CORS wall) that injects the headers a page can’t set itself.
2. Media unblock rules: declarative header injection and permissive CORS on the page’s own hls.js / <video> fetches, so the player streams gated CDN segments directly.
3. Hidden-tab capture: a last resort for the hardest hosters. It opens the embed in a background tab, watches the network for the real media URL, and closes the tab. The page reverses nothing.

Security posture

• Loads only on Crimson origins and sites the user enabled; the in-page API exposes fetch and rule primitives only.
• Holds no secrets. Secret-bound sources stay on the backend.
• Fully user-toggled. Absent or off, your sources engine falls back to the proxy (E2) or the backend (E0).

Lumi says

Visitors on browsers the companion doesn’t support (such as Safari) use the proxy and backend paths. They still watch, with more of the bytes passing through the edge.