fix(permissions): request host permissions during user gesture, not in background

chrome.permissions.request() must be called synchronously within a user
gesture. Moving it from the background message-router (where the gesture
context has expired) into the addVhostSubmit click handler in virtual-hosts.js
fixes the "Unchecked runtime.lastError: This function must be called during
a user gesture" console error.

extension/background/message-router.js

@@ -55,19 +55,6 @@ browser.runtime.onMessage.addListener((message, sender, sendResponse) => {
               extensionState.virtualHosts = state.virtualHosts;
               const newTlds = getActiveTlds(extensionState.virtualHosts);
               applyPAC(newTlds);
-              if (message.payload?.type === 'setVirtualHost' && message.payload?.payload?.hostname) {
-                const hostname = message.payload.payload.hostname;
-                const parts = hostname.split('.');
-                if (parts.length >= 3) {
-                  const baseDomain = parts.slice(-2).join('.');
-                  if (baseDomain !== 'hole.sail') {
-                    const origin = '*://*.' + baseDomain + '/*';
-                    browser.permissions.request({ origins: [origin] }, (granted) => {
-                      log('permissions.request for', origin, ':', granted ? 'granted' : 'denied');
-                    });
-                  }
-                }
-              }
             }
           }).catch(() => {});
         }

extension/dashboard/pages/virtual-hosts.js

@@ -180,21 +180,41 @@ function setupVirtualHostEvents() {
     if (!hsUrl || !hsUrl.startsWith('hs://')) { showModalError('modal-addVhost', 'addVhostError', 'Enter a valid hs:// URL'); return; }
     const btn = $('addVhostSubmit');
     if (btn) { btn.disabled = true; btn.textContent = 'Adding…'; }
-    chrome.runtime.sendMessage(
+
-      { target: 'holesail-native', action: 'send', payload: { type: 'setVirtualHost', payload: { hostname, hsUrl } } },
+    function doAddVhost() {
-      (response) => {
+      chrome.runtime.sendMessage(
-        if (btn) { btn.disabled = false; btn.textContent = 'Add Host'; }
+        { target: 'holesail-native', action: 'send', payload: { type: 'setVirtualHost', payload: { hostname, hsUrl } } },
-        if (response?.ok) {
+        (response) => {
-          if (hostnameEl) hostnameEl.value = '';
+          if (btn) { btn.disabled = false; btn.textContent = 'Add Host'; }
-          if (hsUrlEl) hsUrlEl.value = '';
+          if (response?.ok) {
-          closeModal('modal-addVhost');
+            if (hostnameEl) hostnameEl.value = '';
-          showToast('Virtual host added', 'success');
+            if (hsUrlEl) hsUrlEl.value = '';
-          refresh();
+            closeModal('modal-addVhost');
-        } else {
+            showToast('Virtual host added', 'success');
-          showModalError('modal-addVhost', 'addVhostError', response?.error || 'Failed to add');
+            refresh();
+          } else {
+            showModalError('modal-addVhost', 'addVhostError', response?.error || 'Failed to add');
+          }
         }
+      );
+    }
+
+    // Request host permissions synchronously within the user gesture so Chrome
+    // allows the permissions.request call. Non-hole.sail custom domains need
+    // explicit host permission for the extension to intercept their traffic.
+    const parts = hostname.split('.');
+    if (parts.length >= 3) {
+      const baseDomain = parts.slice(-2).join('.');
+      if (baseDomain !== 'hole.sail') {
+        const origin = '*://*.' + baseDomain + '/*';
+        chrome.permissions.request({ origins: [origin] }, () => {
+          void chrome.runtime.lastError;
+          doAddVhost();
+        });
+        return;
       }
-    );
+    }
+    doAddVhost();
   });
 
   $('removeVhostConfirm')?.addEventListener('click', () => {