feat: the extension adds Discord channels to an artist you pick, and its tests gate the XPI (milestone 429)

Server (#4420)
- extension_service gains a Discord pattern (server or channel, jump links,
  ptb/canary; not DMs or threads), mirrored in platforms.js and pinned by
  the shared artist-url-samples.json.
- probe on a Discord URL matches the source by ids under any artist, reports
  a whole-server source as covering the channel, suggests the artist who owns
  another source on the same server, and names server/channel via the stored
  token (best-effort, bounded, no rate-limit waits).
- quick-add takes artist_id / artist_name; Discord URLs are stored canonical.

Extension (#4421, #4422)
- Content script on discord.com; SPA navigation by URL polling (the old
  pushState patch ran in the isolated world and never fired); stale probes
  are dropped.
- Discord chip opens an Add panel: this channel or the whole server, and the
  suggested artist / a search / a new name.
- Popup: sources show artist, platform and state; a Discord token export is
  verified by FC and the result shown. Token capture covers ptb/canary.
- Pure logic in lib/chip.js and lib/popup-format.js, with specs.

CI (#4423)
- extension.yml's lane (web-ext lint, vitest, XPI contents) moves into
  build.yml as extension-test and joins the needs of sign-extension,
  build-web and build-agent. As a separate workflow it gated nothing: a red
  extension suite still signed and shipped the XPI (rule 177).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVjrnpQjRgHdvq95rASoiR

extension/lib/api.js

@@ -80,6 +80,17 @@ class FabledCuratorAPI {
   getCredentials() {
     return this.request('GET', '/credentials');
   }
+  // Test the STORED credential against one of the platform's sources — the
+  // same check the web UI's Verify button runs. {valid: true|false|null, reason}.
+  verifyCredential(platform) {
+    return this.request('POST', `/credentials/${encodeURIComponent(platform)}/verify`);
+  }
+
+  // Artist search for the Discord Add panel — the web UI's autocomplete.
+  searchArtists(q, limit = 8) {
+    const qs = new URLSearchParams({ q, limit: String(limit) }).toString();
+    return this.request('GET', `/artists/autocomplete?${qs}`);
+  }
 
   // FC-3a — sources.
   listSources() {
@@ -90,8 +101,14 @@ class FabledCuratorAPI {
   }
 
   // FC-3g — extension-specific.
-  quickAddSource(url) {
-    return this.request('POST', '/extension/quick-add-source', { url });
+  // artistId connects the source to an existing artist, artistName to the
+  // artist of that name (created if new); with neither the server derives the
+  // artist from the URL. A Discord channel always sends one.
+  quickAddSource(url, { artistId = null, artistName = null } = {}) {
+    const body = { url };
+    if (artistId != null) body.artist_id = artistId;
+    else if (artistName) body.artist_name = artistName;
+    return this.request('POST', '/extension/quick-add-source', body);
   }
   probeSource(url) {
     // Read-only existence check. Drives the content-script chip's

extension/lib/chip.js

@@ -0,0 +1,80 @@
+/**
+ * The content script's decisions, kept apart from its DOM so the specs can
+ * load them (test/chip.spec.js): which state the chip shows, what it says,
+ * and what the Discord Add panel starts out proposing.
+ *
+ * `probe` is /api/extension/probe's answer; `platformName` is the display
+ * name (PLATFORMS[key].name), passed in so this file needs no other lib.
+ */
+
+function chipState(probe) {
+  if (!probe || probe.error) return 'new';
+  return ({ source_match: 'source-match', artist_match: 'artist-match', new: 'new' })[probe.state] || 'new';
+}
+
+function chipLabel(probe, platformName) {
+  if (!probe || probe.error) return '+ Add to FabledCurator';
+  const artist = probe.artist?.name || 'artist';
+  if (probe.platform === 'discord') {
+    const d = probe.discord || {};
+    if (probe.state === 'source_match') {
+      return probe.covered_by_server
+        ? `✓ Whole server in FabledCurator · ${artist}`
+        : `✓ In FabledCurator · ${artist}`;
+    }
+    // Every other Discord state opens the panel: the artist is always chosen.
+    return d.channel_id ? `+ Add ${channelLabel(d)} to FabledCurator` : '+ Add server to FabledCurator';
+  }
+  switch (probe.state) {
+    case 'source_match':
+      return `✓ In FabledCurator · ${platformName}`;
+    case 'artist_match':
+      return `+ Add ${platformName} source to ${artist}`;
+    default:
+      return '+ Add to FabledCurator';
+  }
+}
+
+/** `#name` when the probe could read it, else a neutral "this channel". */
+function channelLabel(d) {
+  return d.channel_name ? `#${d.channel_name}` : 'this channel';
+}
+
+/** `name` when the probe could read it, else "this server". */
+function serverLabel(d) {
+  return d.server_name || 'this server';
+}
+
+/**
+ * What the Discord Add panel opens with. The channel is the default scope
+ * when there is one: a server source walks every channel the token can read,
+ * which is rarely what a single art channel wants. The artist is the probe's
+ * suggestion (the owner of another source on this server), else a new artist
+ * named after the server.
+ */
+function discordPanelDefaults(probe) {
+  const d = probe?.discord || {};
+  const suggested = probe?.state === 'artist_match' && probe.artist ? probe.artist : null;
+  return {
+    scope: d.channel_id ? 'channel' : 'server',
+    channelUrl: d.channel_url || null,
+    serverUrl: d.server_url || null,
+    artist: suggested ? { id: suggested.id, name: suggested.name } : null,
+    artistName: suggested ? suggested.name : (d.server_name || ''),
+  };
+}
+
+/**
+ * The quick-add body for the panel's current choice. A picked artist goes by
+ * id — names can collide once slugified — and a typed name creates (or
+ * finds) that artist. null when there is nothing valid to send.
+ */
+function discordAddRequest(choice) {
+  const url = choice.scope === 'server' ? choice.serverUrl : choice.channelUrl;
+  if (!url) return null;
+  if (choice.artist && choice.artist.id != null && choice.artist.name === choice.artistName) {
+    return { url, artistId: choice.artist.id };
+  }
+  const name = (choice.artistName || '').trim();
+  return name ? { url, artistName: name } : null;
+}

extension/lib/platforms.js

@@ -57,7 +57,8 @@ const PLATFORMS = {
     domains: ['.discord.com', 'discord.com'],
     authType: 'token',
     color: '#5865F2',
-    urlPattern: /^https?:\/\/(www\.)?discord\.com/,
+    // ptb/canary are Discord's beta clients — same channels, same token.
+    urlPattern: /^https?:\/\/((www|ptb|canary)\.)?discord\.com/,
     note: 'Open Discord in browser to capture token',
   },
 };
@@ -80,8 +81,23 @@ const PLATFORM_ARTIST_PATTERNS = {
   patreon:       /^https?:\/\/(www\.)?patreon\.com\/(?:cw\/|c\/)?(?!(?:home|search|messages|notifications|library|settings|posts)(?:[\/?#]|$))[^/?#]+/i,
   subscribestar: /^https?:\/\/(www\.)?subscribestar\.(com|adult)\/(?!feed$|messages$|library$)[^/?#]+\/?$/i,
   hentaifoundry: /^https?:\/\/(www\.)?hentai-foundry\.com\/user\/[^/?#]+/i,
+  // A Discord URL names a server or channel, not a creator: the backend's slug
+  // is `<server>[/<channel>]` and the Add panel asks which artist it belongs
+  // to. A message jump link still names its channel; DMs (@me) and thread
+  // links don't match. Mirrors extension_service._PLATFORM_PATTERNS.
+  discord:       /^https?:\/\/(?:www\.|ptb\.|canary\.)?discord\.com\/channels\/\d+(?:\/\d+)?(?:\/\d+)?\/?(?:[?#].*)?$/i,
 };
 
+/**
+ * `{serverId, channelId}` from a Discord channel/server URL the artist
+ * pattern accepts, else null. channelId is null for a whole-server URL.
+ */
+function parseDiscordUrl(url) {
+  if (!PLATFORM_ARTIST_PATTERNS.discord.test(url || '')) return null;
+  const m = /\/channels\/(\d+)(?:\/(\d+))?/.exec(url);
+  return m ? { serverId: m[1], channelId: m[2] || null } : null;
+}
+
 function getPlatformFromUrl(url) {
   for (const [key, platform] of Object.entries(PLATFORMS)) {
     if (platform.urlPattern.test(url)) return key;

extension/lib/popup-format.js

@@ -0,0 +1,55 @@
+/**
+ * The popup's wording, kept apart from its DOM so the specs can load it
+ * (test/popup-format.spec.js). Classic script, like the rest of lib/.
+ */
+
+/**
+ * One line of state for a source row, from /api/sources' fields, with the
+ * status class the popup colours it by ('ready' | 'error' | 'no-cookies' for
+ * a warning | '' for plain). The most actionable fact wins: an error before
+ * a running backfill, a backfill before the last-checked time.
+ */
+function sourceStatus(src, now = Date.now()) {
+  if (!src.enabled) return { text: 'Disabled', kind: '' };
+  if (src.last_error) {
+    const first = String(src.last_error).split('\n')[0].trim();
+    const short = first.length > 90 ? `${first.slice(0, 89)}…` : first;
+    return { text: `Error — ${short}`, kind: 'error' };
+  }
+  if (src.backfill_state === 'running') {
+    const n = src.backfill_chunks || 0;
+    return { text: n ? `Backfilling — ${n} chunk${n === 1 ? '' : 's'} done` : 'Backfill queued', kind: 'ready' };
+  }
+  if (src.backfill_state === 'stalled') return { text: 'Backfill stalled', kind: 'no-cookies' };
+  if (!src.last_checked_at) return { text: 'Not checked yet', kind: '' };
+  return { text: `Checked ${relativeTime(src.last_checked_at, now)}`, kind: '' };
+}
+
+// Same buckets and wording as the web UI's canonical formatRelative
+// (frontend/src/utils/date.js, snippet #3959) — the extension can't import it (classic
+// scripts, separate package), so it mirrors it: "42s ago", "5m ago", "3h ago",
+// "2d ago", and "Never" for a missing or unreadable time.
+function relativeTime(iso, now = Date.now()) {
+  const t = iso ? Date.parse(iso) : NaN;
+  if (Number.isNaN(t)) return 'Never';
+  const abs = Math.abs(now - t) / 1000;
+  let body;
+  if (abs < 60) body = `${Math.floor(abs)}s`;
+  else if (abs < 3600) body = `${Math.floor(abs / 60)}m`;
+  else if (abs < 86400) body = `${Math.floor(abs / 3600)}h`;
+  else body = `${Math.floor(abs / 86400)}d`;
+  return `${body} ago`;
+}
+
+/**
+ * The popup message after a Discord token export, from FC's verify of the
+ * stored token: {text, kind} with kind 'success' | 'warning' | 'error'.
+ * valid=null is "FC couldn't test it" (no Discord source yet, or a network
+ * hiccup) — a warning with FC's reason, never a failure.
+ */
+function tokenExportMessage(verify) {
+  if (!verify) return { text: 'Discord: token exported', kind: 'success' };
+  if (verify.valid === true) return { text: `Discord: token exported and verified ✓ — ${verify.reason}`, kind: 'success' };
+  if (verify.valid === false) return { text: `Discord: token exported, but FC's check failed — ${verify.reason}`, kind: 'error' };
+  return { text: `Discord: token exported (not verified — ${verify.reason})`, kind: 'warning' };
+}