From 740f692ff177a6371f447d39a6ddd9b688678e95 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 29 Mar 2026 18:25:28 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20config=20not=20reaching=20content.js=20?=
 =?UTF-8?q?=E2=80=94=20race=20condition=20with=20script=20removal?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The data-ss-config attribute on the script tag was being removed
(via script.onload) before content.js could read it. Changed approach:
inject config as a separate <script type="application/json" id="ss-config-data">
element that persists in the DOM until content.js reads and removes it.

This eliminates the race condition between script execution and onload
removal. Bump 0.9.20.

https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT
---
 manifest.firefox.json    |  2 +-
 manifest.json            |  2 +-
 package.json             |  2 +-
 src/content/content.js   |  5 +++--
 src/content/injector.js  | 10 +++++++++-
 src/options/options.html |  2 +-
 6 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/manifest.firefox.json b/manifest.firefox.json
index e01cb92..76ac735 100644
--- a/manifest.firefox.json
+++ b/manifest.firefox.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Silent Send",
-  "version": "0.9.19",
+  "version": "0.9.20",
   "description": "Intercepts personal info and substitutes it with user-defined replacements before sending to AI services.",
   "browser_specific_settings": {
     "gecko": {
diff --git a/manifest.json b/manifest.json
index 22cf700..1e43db5 100644
--- a/manifest.json
+++ b/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Silent Send",
-  "version": "0.9.19",
+  "version": "0.9.20",
   "description": "Intercepts personal info and substitutes it with user-defined replacements before sending to AI services.",
   "permissions": [
     "storage",
diff --git a/package.json b/package.json
index 2c8ed42..c3aebd4 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "silent-send",
-  "version": "0.9.19",
+  "version": "0.9.20",
   "private": true,
   "license": "MIT",
   "description": "Browser extension that substitutes personal data before sending to AI services",
diff --git a/src/content/content.js b/src/content/content.js
index 3f9db50..af8b13d 100644
--- a/src/content/content.js
+++ b/src/content/content.js
@@ -26,12 +26,13 @@
   let settings = { enabled: true, revealMode: false, showHighlights: false };
 
   try {
-    const configEl = document.querySelector('script[data-ss-config]');
+    const configEl = document.getElementById('ss-config-data');
     if (configEl) {
-      const config = JSON.parse(configEl.getAttribute('data-ss-config'));
+      const config = JSON.parse(configEl.textContent);
       mappings = config.mappings || [];
       identity = config.identity || {};
       settings = { ...settings, ...(config.settings || {}) };
+      configEl.remove(); // clean up
     }
   } catch (e) {
     console.warn('[Silent Send] Failed to parse initial config:', e);
diff --git a/src/content/injector.js b/src/content/injector.js
index 4c3d5a2..9574bdc 100644
--- a/src/content/injector.js
+++ b/src/content/injector.js
@@ -97,9 +97,17 @@
       identity = mergeProfiles(identity);
     }
 
+    // Inject config as a global variable before loading content.js
+    // Using a separate inline-data element ensures content.js can read it
+    // even if there's a race condition with script.onload removal
+    const configEl = document.createElement('script');
+    configEl.type = 'application/json';
+    configEl.id = 'ss-config-data';
+    configEl.textContent = JSON.stringify({ mappings, identity, settings });
+    (document.head || document.documentElement).appendChild(configEl);
+
     // Inject the main interception script into the page's world
     const script = document.createElement('script');
-    script.setAttribute('data-ss-config', JSON.stringify({ mappings, identity, settings }));
     script.src = api.runtime.getURL('src/content/content.js');
     (document.head || document.documentElement).appendChild(script);
     script.onload = () => script.remove();
diff --git a/src/options/options.html b/src/options/options.html
index 3e52028..3db2c07 100644
--- a/src/options/options.html
+++ b/src/options/options.html
@@ -629,7 +629,7 @@
     </section>
 
     <footer>
-      <p>Silent Send v0.9.19</p>
+      <p>Silent Send v0.9.20</p>
       <p style="font-size:11px;color:#9ca3af;margin-top:6px;max-width:600px">
         Silent Send is a convenience tool, not a security guarantee. Third-party sites may change how they send data at any time, which can cause missed substitutions without warning. You are responsible for verifying your data before sending. See the <a href="https://github.com/outis1one/silent-send/blob/main/LICENSE" target="_blank" style="color:#6b7280">LICENSE</a> for full terms.
       </p>