Wire up document scanner for file upload interception, bump to 0.9.23

- Inject document-scanner.js into page world via injector.js (as module,
  sets globalThis.DocumentScanner)
- Add FormData interception to fetch hook: scans File/Blob entries through
  DocumentScanner.processUpload(), also substitutes string fields
- Add document-scanner.js to web_accessible_resources in both manifests
- Bump version to 0.9.23 in package.json, manifest.json, manifest.firefox.json

https://claude.ai/code/session_01NNBEPuXMFGWezJb1f958nL

manifest.firefox.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Silent Send",
-  "version": "0.9.21",
+  "version": "0.9.23",
   "description": "Intercepts personal info and substitutes it with user-defined replacements before sending to AI services.",
   "browser_specific_settings": {
     "gecko": {
@@ -114,7 +114,7 @@
   ],
   "web_accessible_resources": [
     {
-      "resources": ["src/content/content.js", "src/content/early-hook.js"],
+      "resources": ["src/content/content.js", "src/content/early-hook.js", "src/lib/document-scanner.js"],
       "matches": ["<all_urls>"]
     }
   ]

manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Silent Send",
-  "version": "0.9.21",
+  "version": "0.9.23",
   "description": "Intercepts personal info and substitutes it with user-defined replacements before sending to AI services.",
   "permissions": [
     "storage",
@@ -102,7 +102,7 @@
   ],
   "web_accessible_resources": [
     {
-      "resources": ["src/content/content.js", "src/content/early-hook.js"],
+      "resources": ["src/content/content.js", "src/content/early-hook.js", "src/lib/document-scanner.js"],
       "matches": ["<all_urls>"]
     }
   ]

package.json

@@ -1,6 +1,6 @@
 {
   "name": "silent-send",
-  "version": "0.9.21",
+  "version": "0.9.23",
   "private": true,
   "license": "MIT",
   "description": "Browser extension that substitutes personal data before sending to AI services",

src/content/content.js

@@ -737,6 +737,52 @@
     return isConfigured();
   }
 
+  // ============================================================
+  // Document Scanner — process file uploads in FormData
+  // ============================================================
+  async function scanFormData(formData) {
+    const newForm = new FormData();
+    const allReplacements = [];
+    let anyModified = false;
+
+    for (const [key, value] of formData.entries()) {
+      if (value instanceof File || value instanceof Blob) {
+        const filename = value instanceof File ? value.name : (key || 'file');
+        try {
+          const result = await globalThis.DocumentScanner.processUpload(
+            value, filename, substituteAll
+          );
+          if (result.replacements.length > 0) {
+            anyModified = true;
+            allReplacements.push(...result.replacements);
+            const newFile = new File([result.file], result.filename, { type: result.file.type });
+            newForm.append(key, newFile, result.filename);
+          } else {
+            newForm.append(key, value, filename);
+          }
+        } catch (e) {
+          console.warn('[Silent Send] Document scan failed for', filename, e);
+          newForm.append(key, value, filename);
+        }
+      } else if (typeof value === 'string' && value.length >= MIN_STRING_LENGTH) {
+        // Also substitute string fields in the FormData
+        const result = substituteAll(value);
+        if (result.modified) {
+          anyModified = true;
+          allReplacements.push(...result.replacements);
+          newForm.append(key, result.text);
+        } else {
+          newForm.append(key, value);
+        }
+      } else {
+        newForm.append(key, value);
+      }
+    }
+
+    if (!anyModified) return null;
+    return { formData: newForm, replacements: allReplacements };
+  }
+
   // ============================================================
   // Fetch Interception — scans ALL POST requests with a body.
   // Service-agnostic: doesn't depend on URL patterns.
@@ -765,35 +811,55 @@
     const urlStr = typeof url === 'string' ? url : url?.url || '';
     const method = (options?.method || 'GET').toUpperCase();
 
-    // Only intercept POST/PUT/PATCH with a string body
+    // Only intercept POST/PUT/PATCH
     if (
       (method === 'POST' || method === 'PUT' || method === 'PATCH') &&
-      options?.body && typeof options.body === 'string' &&
+      options?.body && !shouldSkipUrl(urlStr)
-      !shouldSkipUrl(urlStr)
     ) {
-      try {
+      // FormData body — scan file uploads via DocumentScanner
-        // Try JSON
+      if (options.body instanceof FormData && typeof globalThis.DocumentScanner !== 'undefined') {
-        const body = JSON.parse(options.body);
+        try {
-        const { modified, replacements } = processBody(body);
+          const scannedForm = await scanFormData(options.body);
-
+          if (scannedForm) {
-        if (modified) {
+            options = { ...options, body: scannedForm.formData };
-          options = { ...options, body: JSON.stringify(body) };
+            if (scannedForm.replacements.length > 0) {
-          notifySubstitutions(replacements);
+              notifySubstitutions(scannedForm.replacements);
-          console.log(
+              console.log(
-            `[Silent Send] Substituted ${replacements.length} value(s) in ${urlStr}`
+                `[Silent Send] Substituted ${scannedForm.replacements.length} value(s) in file upload to ${urlStr}`
-          );
+              );
+            }
+          }
+        } catch (e) {
+          console.warn('[Silent Send] FormData scan failed:', e);
         }
-      } catch (e) {
+      }
-        // Not JSON — try raw string substitution (form data, etc.)
+
-        if (options.body.length > MIN_STRING_LENGTH) {
+      // String body — JSON or raw text
-          const result = substituteAll(options.body);
+      if (typeof options.body === 'string') {
-          if (result.modified) {
+        try {
-            options = { ...options, body: result.text };
+          // Try JSON
-            notifySubstitutions(result.replacements);
+          const body = JSON.parse(options.body);
+          const { modified, replacements } = processBody(body);
+
+          if (modified) {
+            options = { ...options, body: JSON.stringify(body) };
+            notifySubstitutions(replacements);
             console.log(
-              `[Silent Send] Substituted ${result.replacements.length} value(s) in form body`
+              `[Silent Send] Substituted ${replacements.length} value(s) in ${urlStr}`
             );
           }
+        } catch (e) {
+          // Not JSON — try raw string substitution (form data, etc.)
+          if (options.body.length > MIN_STRING_LENGTH) {
+            const result = substituteAll(options.body);
+            if (result.modified) {
+              options = { ...options, body: result.text };
+              notifySubstitutions(result.replacements);
+              console.log(
+                `[Silent Send] Substituted ${result.replacements.length} value(s) in form body`
+              );
+            }
+          }
         }
       }
     }

src/content/injector.js

@@ -70,6 +70,14 @@
     // Merge active profiles into a flat identity object for the content script
     const identity = mergeProfiles(identityData);
 
+    // Inject the document scanner into the page's world first (sets globalThis.DocumentScanner)
+    const docScannerScript = document.createElement('script');
+    docScannerScript.type = 'module';
+    docScannerScript.src = api.runtime.getURL('src/lib/document-scanner.js');
+    (document.head || document.documentElement).appendChild(docScannerScript);
+    await new Promise(resolve => { docScannerScript.onload = resolve; docScannerScript.onerror = resolve; });
+    docScannerScript.remove();
+
     // Inject the main interception script into the page's world
     const script = document.createElement('script');
     script.setAttribute('data-ss-config', JSON.stringify({ mappings, identity, settings }));