revert: remove early fetch hook, restore simple injection — v2.0.12

The early hook approach (inline script, then external early-hook.js)
kept breaking Firefox due to CSP restrictions and timing issues with
the async external script load. Each fix for ChatGPT introduced a
new regression for Firefox/Brave.

Reverted to the original simple approach:
- Injector reads storage, injects content.js via <script src="...">
- content.js captures window.fetch at load time and patches it
- No inline scripts, no early hooks, no __ssOriginalFetch globals

This is what worked on Claude.ai across all browsers before the
ChatGPT fix attempts. ChatGPT support may need a different approach
later (possibly using declarativeNetRequest for header-only changes,
or a ChatGPT-specific content script), but it should not break the
core functionality on Claude.ai.

Kept the Request object handling in the fetch interceptor (needed for
some frameworks) but removed all early hook dependencies.

https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn

src/content/content.js

@@ -905,11 +905,8 @@
   // ============================================================
   // Fetch Interception — scans ALL POST requests with a body.
   // Service-agnostic: doesn't depend on URL patterns.
-  // Uses __ssOriginalFetch from the early hook (injected synchronously
-  // before any page JS) to ensure we have the real fetch, even if
-  // frameworks like Next.js (ChatGPT) store a reference early.
   // ============================================================
-  const originalFetch = window.__ssOriginalFetch || window.fetch;
+  const originalFetch = window.fetch;
 
   // URLs to never touch (static assets, analytics, etc.)
   const SKIP_URL_PATTERNS = [
@@ -1029,9 +1026,7 @@
     return originalFetch.call(this, url, options);
   };
 
-  // Register our fetch interceptor so the early hook proxy can use it
-  window.__ssInterceptFetch = window.fetch;
-  window.__ssReady = true;
+
 
   // ============================================================
   // Document Upload Processing
@@ -1397,8 +1392,8 @@
   // ============================================================
   // XMLHttpRequest Interception — same aggressive approach
   // ============================================================
-  const origOpen = window.__ssOriginalXHROpen || XMLHttpRequest.prototype.open;
-  const origSend = window.__ssOriginalXHRSend || XMLHttpRequest.prototype.send;
+  const origOpen = XMLHttpRequest.prototype.open;
+  const origSend = XMLHttpRequest.prototype.send;
 
   XMLHttpRequest.prototype.open = function (method, url, ...rest) {
     this._ssUrl = url;

src/content/injector.js

@@ -15,24 +15,6 @@
   if (window.__silentSendInjected) return;
   window.__silentSendInjected = true;
 
-  // Cross-browser API
-  const api =
-    typeof browser !== 'undefined' && browser.runtime
-      ? browser
-      : typeof chrome !== 'undefined'
-        ? chrome
-        : null;
-
-  // IMMEDIATELY inject the early fetch hook into the page world as an
-  // EXTERNAL file. Must be external (not inline) because sites like
-  // claude.ai have strict CSP that blocks inline scripts. Firefox
-  // enforces this strictly; Chrome is more permissive but external
-  // works everywhere.
-  const earlyHook = document.createElement('script');
-  earlyHook.src = api.runtime.getURL('src/content/early-hook.js');
-  (document.head || document.documentElement).appendChild(earlyHook);
-  earlyHook.onload = () => earlyHook.remove();
-
   // Merge active profiles into flat identity object
   function mergeProfiles(data) {
     const profiles = data?.profiles || [];
@@ -65,6 +47,14 @@
     return merged;
   }
 
+  // Cross-browser API
+  const api =
+    typeof browser !== 'undefined' && browser.runtime
+      ? browser
+      : typeof chrome !== 'undefined'
+        ? chrome
+        : null;
+
   // Load mappings and settings, then inject into page
   async function init() {
     const result = await api.storage.local.get(['ss_mappings', 'ss_identity', 'ss_settings']);
@@ -80,8 +70,7 @@
     // Merge active profiles into a flat identity object for the content script
     const identity = mergeProfiles(identityData);
 
-    // Load the full content.js which will use __ssOriginalFetch
-    // (captured by the early hook above) and set __ssReady = true
+    // Inject the main interception script into the page's world
     const script = document.createElement('script');
     script.setAttribute('data-ss-config', JSON.stringify({ mappings, identity, settings }));
     script.src = api.runtime.getURL('src/content/content.js');