fix: encrypted data breaks Firefox — injector can't decrypt — v2.0.13

When at-rest encryption is enabled, storage.local contains encrypted
blobs. The injector reads raw storage (content script world, no
access to IndexedDB CryptoKey) and sees { _ssLocalEncrypted: true }.
It passed empty config to content.js → no mappings → no substitution.

This is why Firefox stopped working after encryption was enabled.
Chrome/Brave worked because the user hadn't set up encryption there.

Fixed: injector now detects encrypted data and asks the background
script for decrypted config via 'get:decrypted-config' message.
The background uses the Storage module (which has IndexedDB access)
to decrypt and return the data. Falls back to empty config if the
vault is actually locked.

https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn

src/background/service-worker.js

@@ -163,6 +163,17 @@ const messageHandlers = {
     await setupAutoSyncAlarm();
   },
 
+  async 'get:decrypted-config'(_message, _sender, sendResponse) {
+    try {
+      const mappings = await Storage.getMappings();
+      const identity = await Storage.getIdentity();
+      const settings = await Storage.getSettings();
+      sendResponse({ mappings, identity, settings });
+    } catch {
+      sendResponse(null);
+    }
+  },
+
   async 'org:config-changed'() {
     await setupOrgPolicyAlarm();
   },

src/content/injector.js

@@ -57,18 +57,45 @@
 
   // Load mappings and settings, then inject into page
   async function init() {
+    let mappings, identity, settings;
+
     const result = await api.storage.local.get(['ss_mappings', 'ss_identity', 'ss_settings']);
-    const settings = result.ss_settings || { enabled: true };
+    const isEncrypted = result.ss_mappings?._ssLocalEncrypted ||
+                        result.ss_identity?._ssLocalEncrypted;
 
-    // Check if data is encrypted (locked) — pass empty config
-    // The background will send decrypted data via vault:unlocked when ready
-    const isLocked = result.ss_mappings?._ssLocalEncrypted ||
-                     result.ss_identity?._ssLocalEncrypted;
-    const mappings = isLocked ? [] : (result.ss_mappings || []);
-    const identityData = isLocked ? {} : (result.ss_identity || {});
+    if (isEncrypted) {
+      // Data is encrypted — ask the background script for decrypted config.
+      // The background has access to the Storage module which can decrypt.
+      try {
+        const response = await api.runtime.sendMessage({ type: 'get:decrypted-config' });
+        if (response?.mappings) {
+          mappings = response.mappings;
+          identity = response.identity || {};
+          settings = response.settings || { enabled: true };
+        } else {
+          // Background couldn't decrypt (locked) — inject with empty config
+          // and wait for vault:unlocked message later
+          mappings = [];
+          identity = {};
+          settings = result.ss_settings || { enabled: true };
+        }
+      } catch {
+        mappings = [];
+        identity = {};
+        settings = result.ss_settings || { enabled: true };
+      }
+    } else {
+      // Data is plaintext — read directly
+      mappings = result.ss_mappings || [];
+      const identityData = result.ss_identity || {};
+      identity = mergeProfiles(identityData);
+      settings = result.ss_settings || { enabled: true };
+    }
 
-    // Merge active profiles into a flat identity object for the content script
-    const identity = mergeProfiles(identityData);
+    // Ensure identity is merged if it came from background
+    if (identity.profiles) {
+      identity = mergeProfiles(identity);
+    }
 
     // Inject the main interception script into the page's world
     const script = document.createElement('script');

src/options/options.html

@@ -591,7 +591,7 @@
     </section>
 
     <footer>
-      <p>Silent Send v2.0.12</p>
+      <p>Silent Send v2.0.13</p>
     </footer>
   </div>