Merge pull request #28 from outis1one/claude/read-repo-wA3y1

fix: Firefox broken — CSP blocks inline early hook script — v2.0.11

src/content/early-hook.js

@@ -0,0 +1,23 @@
+/**
+ * Silent Send - Early Fetch Hook
+ *
+ * Injected synchronously BEFORE any page JavaScript to capture the
+ * real fetch() and XMLHttpRequest before frameworks (Next.js, React)
+ * can store their own references.
+ *
+ * Must be loaded as an external <script src="..."> (not inline)
+ * because sites like claude.ai have strict CSP that blocks inline scripts.
+ */
+(function () {
+  window.__ssOriginalFetch = window.fetch;
+  window.__ssOriginalXHROpen = XMLHttpRequest.prototype.open;
+  window.__ssOriginalXHRSend = XMLHttpRequest.prototype.send;
+  window.__ssReady = false;
+
+  window.fetch = function () {
+    if (window.__ssReady && window.__ssInterceptFetch) {
+      return window.__ssInterceptFetch.apply(this, arguments);
+    }
+    return window.__ssOriginalFetch.apply(this, arguments);
+  };
+})();

src/content/injector.js

@@ -15,24 +15,23 @@
   if (window.__silentSendInjected) return;
   window.__silentSendInjected = true;
 
-  // IMMEDIATELY inject a synchronous fetch hook into the page world
-  // BEFORE any async operations. This must run before any page JS
-  // (like ChatGPT's Next.js) can store a reference to the original fetch.
+  // Cross-browser API
+  const api =
+    typeof browser !== 'undefined' && browser.runtime
+      ? browser
+      : typeof chrome !== 'undefined'
+        ? chrome
+        : null;
+
+  // IMMEDIATELY inject the early fetch hook into the page world as an
+  // EXTERNAL file. Must be external (not inline) because sites like
+  // claude.ai have strict CSP that blocks inline scripts. Firefox
+  // enforces this strictly; Chrome is more permissive but external
+  // works everywhere.
   const earlyHook = document.createElement('script');
-  earlyHook.textContent = `(function(){
-    window.__ssOriginalFetch = window.fetch;
-    window.__ssOriginalXHROpen = XMLHttpRequest.prototype.open;
-    window.__ssOriginalXHRSend = XMLHttpRequest.prototype.send;
-    window.__ssReady = false;
-    window.fetch = function() {
-      if (window.__ssReady && window.__ssInterceptFetch) {
-        return window.__ssInterceptFetch.apply(this, arguments);
-      }
-      return window.__ssOriginalFetch.apply(this, arguments);
-    };
-  })();`;
+  earlyHook.src = api.runtime.getURL('src/content/early-hook.js');
   (document.head || document.documentElement).appendChild(earlyHook);
-  earlyHook.remove();
+  earlyHook.onload = () => earlyHook.remove();
 
   // Merge active profiles into flat identity object
   function mergeProfiles(data) {
@@ -66,14 +65,6 @@
     return merged;
   }
 
-  // Cross-browser API
-  const api =
-    typeof browser !== 'undefined' && browser.runtime
-      ? browser
-      : typeof chrome !== 'undefined'
-        ? chrome
-        : null;
-
   // Load mappings and settings, then inject into page
   async function init() {
     const result = await api.storage.local.get(['ss_mappings', 'ss_identity', 'ss_settings']);