robot a621db9674 fix: use script.src for content.js interceptor injection to bypass CSP ...

The inline script.textContent injection in content.js violated the
strict CSP on sites like Pornhub ('script-src' without 'unsafe-inline').

Move interceptor code to a separate interceptors.js file and inject
via script.src = chrome.runtime.getURL('interceptors.js'). Chrome
treats extension-originated <script src> as content scripts — not
as page inline code — so the page's CSP does not apply.

- New src/inject/interceptors.js with all main-world interceptor code
- content.js now creates <script src> instead of <script textContent>
- Vite config updated to build interceptors.js to dist/

2026-08-11 06:43:54 +00:00

..

background

initial commit

2026-05-30 18:51:10 +00:00

content

fix: use script.src for content.js interceptor injection to bypass CSP

2026-08-11 06:43:54 +00:00

icons

initial commit

2026-05-30 18:51:10 +00:00

inject

fix: use script.src for content.js interceptor injection to bypass CSP

2026-08-11 06:43:54 +00:00

viewer

fix: guard video.play() for jsdom and fix Hls mock case mismatch

2026-08-11 04:42:28 +00:00

types.ts

feat: add HLS playback support with hls.js

2026-08-10 06:18:27 +00:00