From 557b1ffd0c4fdc5051a83aa5a295506ab9e275b0 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 27 Mar 2026 15:04:13 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20Firefox=20broken=20=E2=80=94=20CSP=20blo?=
 =?UTF-8?q?cks=20inline=20early=20hook=20script=20=E2=80=94=20v2.0.11?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The inline <script> with textContent was blocked by claude.ai's
Content Security Policy on Firefox (Chrome is more permissive).
No fetch interception = no substitution = completely broken on FF.

Fixed by moving the early fetch hook to its own file (early-hook.js)
loaded via <script src="..."> which is CSP-compliant. Added to
web_accessible_resources in both Chrome and Firefox manifests.

Also fixed duplicate 'const api' declaration in injector.js that
would have crashed the content script.

https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
---
 manifest.firefox.json     |  4 ++--
 manifest.json             |  4 ++--
 package.json              |  2 +-
 src/content/early-hook.js | 23 +++++++++++++++++++++++
 src/content/injector.js   | 39 +++++++++++++++------------------------
 src/options/options.html  |  2 +-
 6 files changed, 44 insertions(+), 30 deletions(-)
 create mode 100644 src/content/early-hook.js

diff --git a/manifest.firefox.json b/manifest.firefox.json
index 960868e..917c622 100644
--- a/manifest.firefox.json
+++ b/manifest.firefox.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Silent Send",
-  "version": "2.0.10",
+  "version": "2.0.11",
   "description": "Intercepts personal info and substitutes it with user-defined replacements before sending to AI services.",
   "browser_specific_settings": {
     "gecko": {
@@ -86,7 +86,7 @@
   ],
   "web_accessible_resources": [
     {
-      "resources": ["src/content/content.js"],
+      "resources": ["src/content/content.js", "src/content/early-hook.js"],
       "matches": ["<all_urls>"]
     }
   ]
diff --git a/manifest.json b/manifest.json
index 6a3f500..608598c 100644
--- a/manifest.json
+++ b/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Silent Send",
-  "version": "2.0.10",
+  "version": "2.0.11",
   "description": "Intercepts personal info and substitutes it with user-defined replacements before sending to AI services.",
   "permissions": [
     "storage",
@@ -78,7 +78,7 @@
   ],
   "web_accessible_resources": [
     {
-      "resources": ["src/content/content.js"],
+      "resources": ["src/content/content.js", "src/content/early-hook.js"],
       "matches": ["<all_urls>"]
     }
   ]
diff --git a/package.json b/package.json
index 617a43e..b78dfe4 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "silent-send",
-  "version": "2.0.10",
+  "version": "2.0.11",
   "private": true,
   "license": "BSL-1.1",
   "description": "Browser extension that substitutes personal data before sending to AI services",
diff --git a/src/content/early-hook.js b/src/content/early-hook.js
new file mode 100644
index 0000000..d68dafe
--- /dev/null
+++ b/src/content/early-hook.js
@@ -0,0 +1,23 @@
+/**
+ * Silent Send - Early Fetch Hook
+ *
+ * Injected synchronously BEFORE any page JavaScript to capture the
+ * real fetch() and XMLHttpRequest before frameworks (Next.js, React)
+ * can store their own references.
+ *
+ * Must be loaded as an external <script src="..."> (not inline)
+ * because sites like claude.ai have strict CSP that blocks inline scripts.
+ */
+(function () {
+  window.__ssOriginalFetch = window.fetch;
+  window.__ssOriginalXHROpen = XMLHttpRequest.prototype.open;
+  window.__ssOriginalXHRSend = XMLHttpRequest.prototype.send;
+  window.__ssReady = false;
+
+  window.fetch = function () {
+    if (window.__ssReady && window.__ssInterceptFetch) {
+      return window.__ssInterceptFetch.apply(this, arguments);
+    }
+    return window.__ssOriginalFetch.apply(this, arguments);
+  };
+})();
diff --git a/src/content/injector.js b/src/content/injector.js
index b870a82..c802986 100644
--- a/src/content/injector.js
+++ b/src/content/injector.js
@@ -15,24 +15,23 @@
   if (window.__silentSendInjected) return;
   window.__silentSendInjected = true;
 
-  // IMMEDIATELY inject a synchronous fetch hook into the page world
-  // BEFORE any async operations. This must run before any page JS
-  // (like ChatGPT's Next.js) can store a reference to the original fetch.
+  // Cross-browser API
+  const api =
+    typeof browser !== 'undefined' && browser.runtime
+      ? browser
+      : typeof chrome !== 'undefined'
+        ? chrome
+        : null;
+
+  // IMMEDIATELY inject the early fetch hook into the page world as an
+  // EXTERNAL file. Must be external (not inline) because sites like
+  // claude.ai have strict CSP that blocks inline scripts. Firefox
+  // enforces this strictly; Chrome is more permissive but external
+  // works everywhere.
   const earlyHook = document.createElement('script');
-  earlyHook.textContent = `(function(){
-    window.__ssOriginalFetch = window.fetch;
-    window.__ssOriginalXHROpen = XMLHttpRequest.prototype.open;
-    window.__ssOriginalXHRSend = XMLHttpRequest.prototype.send;
-    window.__ssReady = false;
-    window.fetch = function() {
-      if (window.__ssReady && window.__ssInterceptFetch) {
-        return window.__ssInterceptFetch.apply(this, arguments);
-      }
-      return window.__ssOriginalFetch.apply(this, arguments);
-    };
-  })();`;
+  earlyHook.src = api.runtime.getURL('src/content/early-hook.js');
   (document.head || document.documentElement).appendChild(earlyHook);
-  earlyHook.remove();
+  earlyHook.onload = () => earlyHook.remove();
 
   // Merge active profiles into flat identity object
   function mergeProfiles(data) {
@@ -66,14 +65,6 @@
     return merged;
   }
 
-  // Cross-browser API
-  const api =
-    typeof browser !== 'undefined' && browser.runtime
-      ? browser
-      : typeof chrome !== 'undefined'
-        ? chrome
-        : null;
-
   // Load mappings and settings, then inject into page
   async function init() {
     const result = await api.storage.local.get(['ss_mappings', 'ss_identity', 'ss_settings']);
diff --git a/src/options/options.html b/src/options/options.html
index 6071fb0..185c7cf 100644
--- a/src/options/options.html
+++ b/src/options/options.html
@@ -591,7 +591,7 @@
     </section>
 
     <footer>
-      <p>Silent Send v2.0.10</p>
+      <p>Silent Send v2.0.11</p>
     </footer>
   </div>