sliccy 3.44.0 → 3.46.0

package/dist/node-server/electron-controller.js

@@ -175,16 +175,10 @@ export async function launchElectronApp(options) {
 // Theme detection — screenshot-based luminance analysis
 // ---------------------------------------------------------------------------
 /**
- * Decode a base64 PNG into raw RGBA pixel data by parsing chunks and inflating.
- * Returns { width, height, pixels } where pixels is a Buffer of RGBA bytes.
+ * Parse the IHDR/IDAT/IEND chunks of a PNG buffer (signature already validated).
+ * Other chunk types are intentionally skipped.
  */
-export function decodePngPixels(base64Data) {
-    const buf = Buffer.from(base64Data, 'base64');
-    // Validate PNG signature
-    const PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
-    if (buf.subarray(0, 8).compare(PNG_SIGNATURE) !== 0) {
-        throw new Error('Not a valid PNG');
-    }
+function parsePngChunks(buf) {
     let width = 0;
     let height = 0;
     let bitDepth = 0;
@@ -209,6 +203,52 @@ export function decodePngPixels(base64Data) {
         }
         offset += 12 + chunkLength; // 4 (length) + 4 (type) + data + 4 (CRC)
     }
+    return { width, height, bitDepth, colorType, idatChunks };
+}
+/**
+ * Apply a single PNG row filter in place. Filter 0 (None) is a no-op so this
+ * helper is not called for it. See the PNG spec §9 Filtering for details.
+ */
+function applyPngRowFilter(row, prevRow, filter, bytesPerPixel, rowBytes) {
+    for (let i = 0; i < rowBytes; i++) {
+        const a = i >= bytesPerPixel ? row[i - bytesPerPixel] : 0;
+        const b = prevRow[i];
+        const c = i >= bytesPerPixel ? prevRow[i - bytesPerPixel] : 0;
+        switch (filter) {
+            case 1: // Sub
+                row[i] = (row[i] + a) & 0xff;
+                break;
+            case 2: // Up
+                row[i] = (row[i] + b) & 0xff;
+                break;
+            case 3: // Average
+                row[i] = (row[i] + ((a + b) >>> 1)) & 0xff;
+                break;
+            case 4: {
+                // Paeth
+                const p = a + b - c;
+                const pa = Math.abs(p - a);
+                const pb = Math.abs(p - b);
+                const pc = Math.abs(p - c);
+                row[i] = (row[i] + (pa <= pb && pa <= pc ? a : pb <= pc ? b : c)) & 0xff;
+                break;
+            }
+            // case 0: None — no transformation needed
+        }
+    }
+}
+/**
+ * Decode a base64 PNG into raw RGBA pixel data by parsing chunks and inflating.
+ * Returns { width, height, pixels } where pixels is a Buffer of RGBA bytes.
+ */
+export function decodePngPixels(base64Data) {
+    const buf = Buffer.from(base64Data, 'base64');
+    // Validate PNG signature
+    const PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
+    if (buf.subarray(0, 8).compare(PNG_SIGNATURE) !== 0) {
+        throw new Error('Not a valid PNG');
+    }
+    const { width, height, bitDepth, colorType, idatChunks } = parsePngChunks(buf);
     if (width === 0 || height === 0)
         throw new Error('Missing IHDR chunk');
     if (bitDepth !== 8)
@@ -227,33 +267,7 @@ export function decodePngPixels(base64Data) {
         const rowStart = y * (1 + rowBytes);
         const filter = inflated[rowStart];
         const row = Buffer.from(inflated.subarray(rowStart + 1, rowStart + 1 + rowBytes));
-        // Apply PNG row filters
-        for (let i = 0; i < rowBytes; i++) {
-            const a = i >= bytesPerPixel ? row[i - bytesPerPixel] : 0;
-            const b = prevRow[i];
-            const c = i >= bytesPerPixel ? prevRow[i - bytesPerPixel] : 0;
-            switch (filter) {
-                case 1: // Sub
-                    row[i] = (row[i] + a) & 0xff;
-                    break;
-                case 2: // Up
-                    row[i] = (row[i] + b) & 0xff;
-                    break;
-                case 3: // Average
-                    row[i] = (row[i] + ((a + b) >>> 1)) & 0xff;
-                    break;
-                case 4: {
-                    // Paeth
-                    const p = a + b - c;
-                    const pa = Math.abs(p - a);
-                    const pb = Math.abs(p - b);
-                    const pc = Math.abs(p - c);
-                    row[i] = (row[i] + (pa <= pb && pa <= pc ? a : pb <= pc ? b : c)) & 0xff;
-                    break;
-                }
-                // case 0: None — no transformation needed
-            }
-        }
+        applyPngRowFilter(row, prevRow, filter, bytesPerPixel, rowBytes);
         for (let x = 0; x < width; x++) {
             const srcIdx = x * bytesPerPixel;
             const dstIdx = (y * width + x) * 4;
@@ -352,16 +366,81 @@ async function loadElectronOverlayBundleSource(options) {
     }
     return await readFile(getElectronOverlayEntryDistPath(options.projectRoot), 'utf8');
 }
+/**
+ * Resolve the `Fetch.enable` origin pattern for CSP-bypass escalation. Mirrors
+ * swift-server's `OverlayTargetSession.fetchProxyOrigin` (Wave 5): prefer the
+ * parent page's http(s) origin so interception is byte-for-byte the same as
+ * before, but for `file://` (or other no-http-origin) targets fall back to the
+ * overlay iframe's own `http://localhost:<servePort>` origin — that is what
+ * actually needs unblocking when the parent is a local file.
+ */
+export function resolveFetchProxyOrigin(targetUrl, servePort) {
+    try {
+        const url = new URL(targetUrl);
+        if (url.protocol === 'http:' || url.protocol === 'https:') {
+            return url.origin;
+        }
+    }
+    catch {
+        // Fall through to the localhost fallback below.
+    }
+    return `http://localhost:${servePort}`;
+}
+/**
+ * Translate a Node http(s) response's headers into the array shape required by
+ * `Fetch.fulfillRequest`, stripping CSP and other hop-by-hop headers that are
+ * invalid in fulfill responses and rewriting `content-length` to match the
+ * actually-buffered body length. Returns whether any CSP header was stripped
+ * so the caller can log it.
+ */
+function buildFulfillResponseHeaders(rawHeaders, contentLength) {
+    const HOP_BY_HOP = new Set([
+        'content-security-policy',
+        'content-security-policy-report-only',
+        'transfer-encoding',
+        'connection',
+        'keep-alive',
+    ]);
+    const responseHeaders = [];
+    let strippedCSP = false;
+    for (const [name, value] of Object.entries(rawHeaders)) {
+        const lower = name.toLowerCase();
+        if (lower.includes('content-security-policy')) {
+            strippedCSP = true;
+            continue;
+        }
+        if (HOP_BY_HOP.has(lower))
+            continue;
+        // Update content-length to match actual body size
+        if (lower === 'content-length') {
+            responseHeaders.push({ name, value: String(contentLength) });
+            continue;
+        }
+        if (Array.isArray(value)) {
+            value.forEach((v) => {
+                responseHeaders.push({ name, value: v });
+            });
+        }
+        else if (value) {
+            responseHeaders.push({ name, value });
+        }
+    }
+    return { responseHeaders, strippedCSP };
+}
 export class ElectronOverlayInjector {
     cdpPort;
+    servePort;
     bootstrapScript;
+    probeDelayMs;
     connections = new Map();
     cspBypassedTargets = new Set();
     syncTimer = null;
     syncing = false;
-    constructor(cdpPort, bootstrapScript) {
+    constructor(cdpPort, servePort, bootstrapScript, probeDelayMs = 1500) {
         this.cdpPort = cdpPort;
+        this.servePort = servePort;
         this.bootstrapScript = bootstrapScript;
+        this.probeDelayMs = probeDelayMs;
     }
     static async create(options) {
         const bundleSource = await loadElectronOverlayBundleSource(options);
@@ -369,7 +448,39 @@ export class ElectronOverlayInjector {
             bundleSource,
             appUrl: buildElectronOverlayAppUrl(getElectronServeOrigin(options.servePort)),
         });
-        return new ElectronOverlayInjector(options.cdpPort, bootstrapScript);
+        return new ElectronOverlayInjector(options.cdpPort, options.servePort, bootstrapScript);
+    }
+    /**
+     * Test-only factory: skips bundle loading and lets tests drive the per-target
+     * connect flow directly with a controllable probe delay. Mirrors swift-server's
+     * `_testing_*` hooks on `ElectronOverlayInjector`.
+     */
+    static _createForTesting(options) {
+        return new ElectronOverlayInjector(options.cdpPort ?? 9223, options.servePort, options.bootstrapScript ?? '/* test-noop */', options.probeDelayMs ?? 1500);
+    }
+    /** Test-only: drive the per-target connect flow without going through `start`. */
+    _testingConnectToTarget(target) {
+        this.connectToTarget(target);
+    }
+    /** Test-only: seed the per-target "already bypassed" guard. */
+    _testingSeedBypassedTarget(url) {
+        this.cspBypassedTargets.add(url);
+    }
+    /** Test-only: snapshot the per-target "already bypassed" guard set. */
+    _testingBypassedTargets() {
+        return new Set(this.cspBypassedTargets);
+    }
+    /** Test-only: close any sockets opened by `_testingConnectToTarget`. */
+    _testingCloseConnections() {
+        for (const connection of this.connections.values()) {
+            try {
+                connection.close();
+            }
+            catch {
+                // Ignore connection cleanup failures.
+            }
+        }
+        this.connections.clear();
     }
     async start() {
         await this.syncTargets();
@@ -481,6 +592,199 @@ export class ElectronOverlayInjector {
             ws.on('message', onMessage);
         });
     }
+    /**
+     * Build a script that sets the SLICC theme preference in localStorage to
+     * match the target app's detected theme, then runs the bootstrap.
+     */
+    buildThemedBootstrap(theme) {
+        const themeScript = `try{localStorage.setItem('slicc-theme',${JSON.stringify(theme)})}catch(e){}`;
+        return `${themeScript}\n${this.bootstrapScript}`;
+    }
+    /**
+     * Handle the initial CDP `ws.on('open', ...)` event for a target: enable
+     * Runtime/Page, set CSP bypass, detect theme, inject the overlay, and (on a
+     * first connect) probe whether the overlay iframe actually loaded — falling
+     * back to a CSP-bypass reload by setting `state.pendingReload` and
+     * `state.pendingCspEscalation` for the message handler to continue from.
+     *
+     * Mutating flow flags (`pendingReload`, `pendingCspEscalation`,
+     * `fetchProxyActive`) live on the shared `state` object so this helper
+     * preserves the original closure-driven control flow exactly.
+     */
+    handleSocketOpen(ws, send, target, state) {
+        const alreadyBypassed = this.cspBypassedTargets.has(target.url);
+        console.log(`[electron-float] Connected to target, bypassed=${alreadyBypassed}, url=${target.url}`);
+        send('Runtime.enable');
+        send('Page.enable');
+        // Set CSP bypass — affects future resource loads on the current page
+        send('Page.setBypassCSP', { enabled: true });
+        if (alreadyBypassed) {
+            // Already reloaded with CSP bypass previously — detect theme and inject
+            console.log(`[electron-float] Detecting theme and injecting overlay (CSP already bypassed)...`);
+            void detectAppThemeFromScreenshot(ws, send).then((theme) => {
+                if (ws.readyState !== WebSocket.OPEN)
+                    return;
+                send('Runtime.evaluate', {
+                    expression: this.buildThemedBootstrap(theme),
+                    awaitPromise: false,
+                });
+            });
+            return;
+        }
+        // First connection to this target URL: detect theme, then inject overlay.
+        // After injection, probe whether the iframe loaded; if CSP blocked it, fall
+        // back to reload+proxy. We probe/escalate regardless of URL scheme — file://
+        // (and app://-style local) Electron renderers can still ship a meta CSP
+        // (e.g. AEM Desktop's `default-src 'self'`) that blocks the overlay iframe.
+        console.log(`[electron-float] Detecting theme before first overlay injection...`);
+        void detectAppThemeFromScreenshot(ws, send).then((theme) => {
+            if (ws.readyState !== WebSocket.OPEN)
+                return;
+            console.log(`[electron-float] Injecting overlay (first attempt, theme=${theme})...`);
+            send('Runtime.evaluate', {
+                expression: this.buildThemedBootstrap(theme),
+                awaitPromise: false,
+            });
+            // After a short delay, probe whether the overlay iframe loaded.
+            // If CSP blocked it, reload the page so Page.setBypassCSP takes effect.
+            // If that still doesn't work, escalate to the Fetch proxy.
+            setTimeout(async () => {
+                if (ws.readyState !== WebSocket.OPEN)
+                    return;
+                const loaded = await this.probeOverlayIframeLoaded(ws, send);
+                if (loaded) {
+                    console.log(`[electron-float] Overlay iframe loaded successfully — no CSP reload needed`);
+                    this.cspBypassedTargets.add(target.url);
+                    return;
+                }
+                // Phase 2: Page.setBypassCSP was already set — a simple reload should
+                // make the browser ignore CSP headers on the fresh navigation.
+                // Deliberately do NOT recordBypassed yet — if the CDP session
+                // disconnects mid-reload (AEM Desktop's bootstrap recreates the
+                // execution context, which closes our WS), the next reconnect
+                // needs to re-run the reload path. Only record once the post-reload
+                // probe confirms the iframe loaded. Mirrors swift-server d1c9f14d
+                // (`shouldRecordBypassedAfter(probeAction:)` returns false for
+                // `.reloadWithBypass`).
+                console.log(`[electron-float] Overlay iframe blocked by CSP, reloading with bypass: ${target.url}`);
+                state.pendingReload = true;
+                state.pendingCspEscalation = true;
+                send('Page.reload', { ignoreCache: true });
+            }, this.probeDelayMs);
+        });
+    }
+    /**
+     * Handle `Page.loadEventFired` after a CSP-bypass reload: re-inject the
+     * themed overlay, then (if this load came from the simple-reload path) probe
+     * the iframe again and, if still blocked, escalate to the Fetch HTTP proxy
+     * which strips CSP from the document response. The proxy reload also sets
+     * `pendingReload` again so the next `loadEventFired` re-injects on top of
+     * the stripped response.
+     */
+    handlePageLoadAfterReload(ws, send, target, state) {
+        state.pendingReload = false;
+        console.log(`[electron-float] Page loaded after CSP reload, detecting theme and injecting overlay...`);
+        if (ws.readyState !== WebSocket.OPEN)
+            return;
+        void detectAppThemeFromScreenshot(ws, send).then((theme) => {
+            if (ws.readyState !== WebSocket.OPEN)
+                return;
+            send('Runtime.evaluate', {
+                expression: this.buildThemedBootstrap(theme),
+                awaitPromise: false,
+            });
+        });
+        // If this was a simple reload (no proxy), check if the iframe loads now.
+        // If it still doesn't, escalate to the Fetch proxy as a last resort.
+        if (state.pendingCspEscalation) {
+            state.pendingCspEscalation = false;
+            setTimeout(async () => {
+                if (ws.readyState !== WebSocket.OPEN)
+                    return;
+                const loaded = await this.probeOverlayIframeLoaded(ws, send);
+                if (loaded) {
+                    console.log(`[electron-float] Overlay iframe loaded after CSP reload — no proxy needed`);
+                    this.cspBypassedTargets.add(target.url);
+                    return;
+                }
+                const fetchOrigin = resolveFetchProxyOrigin(target.url, this.servePort);
+                console.log(`[electron-float] CSP reload insufficient, escalating to Fetch proxy: target=${target.url} origin=${fetchOrigin}`);
+                state.fetchProxyActive = true;
+                send('Fetch.enable', {
+                    patterns: [{ urlPattern: `${fetchOrigin}/*`, requestStage: 'Request' }],
+                });
+                state.pendingReload = true;
+                send('Page.reload', { ignoreCache: true });
+            }, this.probeDelayMs);
+        }
+    }
+    /**
+     * Handle a single `Fetch.requestPaused` event under the active Fetch proxy:
+     * pass non-HTML requests straight through with `Fetch.continueRequest`, and
+     * proxy HTML document requests through Node http/https so the response can
+     * be returned via `Fetch.fulfillRequest` with CSP and hop-by-hop headers
+     * stripped. `Fetch.fulfillRequest` is intentionally fire-and-forget — there
+     * is no CDP reply for fulfill, and the response body is the document body.
+     */
+    handleFetchRequestPaused(ws, send, msg) {
+        const requestId = msg.params?.requestId;
+        if (!requestId) {
+            console.warn('[electron-float] Fetch.requestPaused without requestId, skipping');
+            return;
+        }
+        const request = (msg.params?.request ?? {});
+        const url = request.url || '';
+        const method = request.method || 'GET';
+        const requestHeaders = request.headers || {};
+        const postData = request.postData;
+        // Only proxy HTML document requests (Accept header contains text/html)
+        const acceptHeader = requestHeaders['Accept'] || requestHeaders['accept'] || '';
+        if (!acceptHeader.includes('text/html')) {
+            send('Fetch.continueRequest', { requestId });
+            return;
+        }
+        console.log(`[electron-float] Proxying request to strip CSP: ${url.substring(0, 60)}`);
+        // Make the request ourselves using Node.js http/https
+        const parsedUrl = new URL(url);
+        const transport = parsedUrl.protocol === 'https:' ? https : http;
+        const options = {
+            hostname: parsedUrl.hostname,
+            port: parsedUrl.port || (parsedUrl.protocol === 'https:' ? 443 : 80),
+            path: parsedUrl.pathname + parsedUrl.search,
+            method: method,
+            headers: requestHeaders,
+        };
+        const proxyReq = transport.request(options, (proxyRes) => {
+            const bodyChunks = [];
+            proxyRes.on('data', (chunk) => bodyChunks.push(chunk));
+            proxyRes.on('end', () => {
+                if (ws.readyState !== WebSocket.OPEN)
+                    return;
+                const fullBody = Buffer.concat(bodyChunks);
+                const { responseHeaders, strippedCSP } = buildFulfillResponseHeaders(proxyRes.headers, fullBody.length);
+                if (strippedCSP) {
+                    console.log(`[electron-float] Stripped CSP from: ${url.substring(0, 60)}`);
+                }
+                send('Fetch.fulfillRequest', {
+                    requestId,
+                    responseCode: proxyRes.statusCode || 200,
+                    responseHeaders,
+                    body: fullBody.toString('base64'),
+                });
+            });
+        });
+        proxyReq.on('error', (err) => {
+            console.error(`[electron-float] Proxy request failed for ${url.substring(0, 60)}:`, err.message);
+            if (ws.readyState === WebSocket.OPEN) {
+                send('Fetch.failRequest', { requestId, errorReason: 'Failed' });
+            }
+        });
+        // Forward request body if present (for POST/PUT requests)
+        if (postData) {
+            proxyReq.write(postData);
+        }
+        proxyReq.end();
+    }
     connectToTarget(target) {
         const targetId = target.webSocketDebuggerUrl;
         const ws = new WebSocket(targetId);
@@ -491,204 +795,24 @@ export class ElectronOverlayInjector {
             ws.send(JSON.stringify({ id, method, params }));
             return id;
         };
-        const cspBypassedTargets = this.cspBypassedTargets;
-        const bootstrapScript = this.bootstrapScript;
-        let pendingReload = false;
-        let pendingCspEscalation = false;
-        let fetchProxyActive = false;
-        /**
-         * Build a script that sets the SLICC theme preference in localStorage
-         * to match the target app's detected theme, then runs the bootstrap.
-         */
-        const buildThemedBootstrap = (theme) => {
-            const themeScript = `try{localStorage.setItem('slicc-theme',${JSON.stringify(theme)})}catch(e){}`;
-            return `${themeScript}\n${bootstrapScript}`;
+        const state = {
+            pendingReload: false,
+            pendingCspEscalation: false,
+            fetchProxyActive: false,
         };
         ws.on('open', () => {
-            const isWebContent = target.url.startsWith('https://');
-            const alreadyBypassed = cspBypassedTargets.has(target.url);
-            console.log(`[electron-float] Connected to target, web=${isWebContent}, bypassed=${alreadyBypassed}, url=${target.url}`);
-            send('Runtime.enable');
-            send('Page.enable');
-            // Set CSP bypass — affects future resource loads on the current page
-            send('Page.setBypassCSP', { enabled: true });
-            if (alreadyBypassed) {
-                // Already reloaded with CSP bypass previously — detect theme and inject
-                console.log(`[electron-float] Detecting theme and injecting overlay (CSP already bypassed)...`);
-                void detectAppThemeFromScreenshot(ws, send).then((theme) => {
-                    if (ws.readyState !== WebSocket.OPEN)
-                        return;
-                    send('Runtime.evaluate', {
-                        expression: buildThemedBootstrap(theme),
-                        awaitPromise: false,
-                    });
-                });
-                return;
-            }
-            // First connection to this target URL: detect theme, then inject overlay.
-            // After injection, check if the iframe loaded. If CSP blocked it, fall back to reload+proxy.
-            console.log(`[electron-float] Detecting theme before first overlay injection...`);
-            void detectAppThemeFromScreenshot(ws, send).then((theme) => {
-                if (ws.readyState !== WebSocket.OPEN)
-                    return;
-                console.log(`[electron-float] Injecting overlay (first attempt, theme=${theme})...`);
-                send('Runtime.evaluate', { expression: buildThemedBootstrap(theme), awaitPromise: false });
-                if (!isWebContent) {
-                    // Local content (file://, app protocol) — CSP is not an issue
-                    return;
-                }
-                // After a short delay, probe whether the overlay iframe loaded.
-                // If CSP blocked it, reload the page so Page.setBypassCSP takes effect.
-                // If that still doesn't work, escalate to the Fetch proxy.
-                setTimeout(async () => {
-                    if (ws.readyState !== WebSocket.OPEN)
-                        return;
-                    const loaded = await this.probeOverlayIframeLoaded(ws, send);
-                    if (loaded) {
-                        console.log(`[electron-float] Overlay iframe loaded successfully — no CSP reload needed`);
-                        cspBypassedTargets.add(target.url);
-                        return;
-                    }
-                    // Phase 2: Page.setBypassCSP was already set — a simple reload should
-                    // make the browser ignore CSP headers on the fresh navigation.
-                    console.log(`[electron-float] Overlay iframe blocked by CSP, reloading with bypass: ${target.url}`);
-                    cspBypassedTargets.add(target.url);
-                    pendingReload = true;
-                    pendingCspEscalation = true;
-                    send('Page.reload', { ignoreCache: true });
-                }, 1500);
-            });
+            this.handleSocketOpen(ws, send, target, state);
         });
         // Handle CDP events: lifecycle events and Fetch interception
         ws.on('message', (data) => {
             try {
                 const msg = JSON.parse(data.toString());
                 // Inject overlay after page load completes (after CSP-bypass reload)
-                if (msg.method === 'Page.loadEventFired' && pendingReload) {
-                    pendingReload = false;
-                    console.log(`[electron-float] Page loaded after CSP reload, detecting theme and injecting overlay...`);
-                    if (ws.readyState !== WebSocket.OPEN)
-                        return;
-                    void detectAppThemeFromScreenshot(ws, send).then((theme) => {
-                        if (ws.readyState !== WebSocket.OPEN)
-                            return;
-                        send('Runtime.evaluate', {
-                            expression: buildThemedBootstrap(theme),
-                            awaitPromise: false,
-                        });
-                    });
-                    // If this was a simple reload (no proxy), check if the iframe loads now.
-                    // If it still doesn't, escalate to the Fetch proxy as a last resort.
-                    if (pendingCspEscalation) {
-                        pendingCspEscalation = false;
-                        setTimeout(async () => {
-                            if (ws.readyState !== WebSocket.OPEN)
-                                return;
-                            const loaded = await this.probeOverlayIframeLoaded(ws, send);
-                            if (loaded) {
-                                console.log(`[electron-float] Overlay iframe loaded after CSP reload — no proxy needed`);
-                                return;
-                            }
-                            console.log(`[electron-float] CSP reload insufficient, escalating to Fetch proxy: ${target.url}`);
-                            fetchProxyActive = true;
-                            const urlOrigin = new URL(target.url).origin;
-                            send('Fetch.enable', {
-                                patterns: [{ urlPattern: `${urlOrigin}/*`, requestStage: 'Request' }],
-                            });
-                            pendingReload = true;
-                            send('Page.reload', { ignoreCache: true });
-                        }, 1500);
-                    }
+                if (msg.method === 'Page.loadEventFired' && state.pendingReload) {
+                    this.handlePageLoadAfterReload(ws, send, target, state);
                 }
-                if (msg.method === 'Fetch.requestPaused' && fetchProxyActive) {
-                    const requestId = msg.params?.requestId;
-                    if (!requestId) {
-                        console.warn('[electron-float] Fetch.requestPaused without requestId, skipping');
-                        return;
-                    }
-                    const url = msg.params?.request?.url || '';
-                    const method = msg.params?.request?.method || 'GET';
-                    const requestHeaders = msg.params?.request?.headers || {};
-                    const postData = msg.params?.request?.postData;
-                    // Only proxy HTML document requests (Accept header contains text/html)
-                    const acceptHeader = requestHeaders['Accept'] || requestHeaders['accept'] || '';
-                    if (!acceptHeader.includes('text/html')) {
-                        send('Fetch.continueRequest', { requestId });
-                        return;
-                    }
-                    console.log(`[electron-float] Proxying request to strip CSP: ${url.substring(0, 60)}`);
-                    // Make the request ourselves using Node.js http/https
-                    const parsedUrl = new URL(url);
-                    const transport = parsedUrl.protocol === 'https:' ? https : http;
-                    const options = {
-                        hostname: parsedUrl.hostname,
-                        port: parsedUrl.port || (parsedUrl.protocol === 'https:' ? 443 : 80),
-                        path: parsedUrl.pathname + parsedUrl.search,
-                        method: method,
-                        headers: requestHeaders,
-                    };
-                    const proxyReq = transport.request(options, (proxyRes) => {
-                        const bodyChunks = [];
-                        proxyRes.on('data', (chunk) => bodyChunks.push(chunk));
-                        proxyRes.on('end', () => {
-                            if (ws.readyState !== WebSocket.OPEN)
-                                return;
-                            const fullBody = Buffer.concat(bodyChunks);
-                            // Build response headers, stripping CSP and hop-by-hop headers
-                            // that are invalid in Fetch.fulfillRequest responses
-                            const HOP_BY_HOP = new Set([
-                                'content-security-policy',
-                                'content-security-policy-report-only',
-                                'transfer-encoding',
-                                'connection',
-                                'keep-alive',
-                            ]);
-                            const responseHeaders = [];
-                            let strippedCSP = false;
-                            for (const [name, value] of Object.entries(proxyRes.headers)) {
-                                const lower = name.toLowerCase();
-                                if (lower.includes('content-security-policy')) {
-                                    strippedCSP = true;
-                                    continue;
-                                }
-                                if (HOP_BY_HOP.has(lower))
-                                    continue;
-                                // Update content-length to match actual body size
-                                if (lower === 'content-length') {
-                                    responseHeaders.push({ name, value: String(fullBody.length) });
-                                    continue;
-                                }
-                                if (Array.isArray(value)) {
-                                    value.forEach((v) => {
-                                        responseHeaders.push({ name, value: v });
-                                    });
-                                }
-                                else if (value) {
-                                    responseHeaders.push({ name, value });
-                                }
-                            }
-                            if (strippedCSP) {
-                                console.log(`[electron-float] Stripped CSP from: ${url.substring(0, 60)}`);
-                            }
-                            send('Fetch.fulfillRequest', {
-                                requestId,
-                                responseCode: proxyRes.statusCode || 200,
-                                responseHeaders,
-                                body: fullBody.toString('base64'),
-                            });
-                        });
-                    });
-                    proxyReq.on('error', (err) => {
-                        console.error(`[electron-float] Proxy request failed for ${url.substring(0, 60)}:`, err.message);
-                        if (ws.readyState === WebSocket.OPEN) {
-                            send('Fetch.failRequest', { requestId, errorReason: 'Failed' });
-                        }
-                    });
-                    // Forward request body if present (for POST/PUT requests)
-                    if (postData) {
-                        proxyReq.write(postData);
-                    }
-                    proxyReq.end();
+                if (msg.method === 'Fetch.requestPaused' && state.fetchProxyActive) {
+                    this.handleFetchRequestPaused(ws, send, msg);
                 }
             }
             catch {