Working logic to redirect to sessions

VIBE/CHAT_LOG.md

@@ -849,6 +849,12 @@ Change the title of the field “One-time password” to “One-time password (w
 ### Assistant outcome
 Updated the OTP field label in the English, Spanish, German, French, and Dutch extension locale catalogs to clarify that the code is needed only when OTP is configured.
 
+### User
+The plugin settings still show `emailLabel`; make that `email` as the title for the email field.
+
+### Assistant outcome
+Added the missing `emailLabel` and `emailPlaceholder` messages to every extension locale. The English field now resolves to `Email` instead of displaying the localization key.
+
 ### User
 For the new password in the user setting add a validation field to make sure they are the same before submitting.
 
@@ -914,3 +920,39 @@ Remove the “New primary email address” functionality and keep only selecting
 
 ### Assistant outcome
 Removed the replacement-email workflow entirely. Added cleanup migration 14 for its unused table; verified alternatives remain the only addresses eligible for primary selection.
+
+### User
+When the user is logged in, the web plugin should not display “Please sign in to use LinkLog.”
+
+### Assistant outcome
+Removed the authenticated-state warning flash by hiding the popup sign-in warning in the initial markup. The popup reveals it only after the session check confirms that no valid bearer session is available.
+
+### User
+When the user is signed in, the plugin should not display “Please sign in to use LinkLog.” or the settings link.
+
+### Assistant outcome
+Updated popup session detection to validate the stored bearer token through `/api/auth/me` before hiding the sign-in warning and revealing capture fields. Expired or invalid sessions now keep the warning and settings action visible.
+
+### User
+The plugin still does not behave as expected and still shows that the user should sign in.
+
+### Assistant outcome
+Centralized popup session validation, ensured valid bearer sessions hide the sign-in warning, and cleared stale credentials when the backend rejects a session. The capture form is shown only after successful validation.
+
+### User
+In the popup show that the user has logged in.
+
+### Assistant outcome
+Added a localized authenticated-session indicator to the Firefox popup, showing the returned username and backend URL after successful session validation. It remains hidden for signed-out or invalid sessions.
+
+### User
+The popup still shows the sign-in block even though the authenticated session text is displayed; show the block only when signed out.
+
+### Assistant outcome
+Made popup authentication states mutually exclusive using the DOM `hidden` property. Authenticated sessions now always hide the sign-in block, while signed-out sessions hide the session text and show only the warning block.
+
+### User
+The authenticated session text and sign-in block are still shown together.
+
+### Assistant outcome
+Made popup state transitions defensive by synchronizing both `hidden` attributes and CSS classes. Non-authentication tag-loading errors no longer switch the popup to signed-out state; only a rejected session does. Added `display: none !important` guards for both authentication blocks.