feat(extension): bypass CORS for cross-origin images during export via background fetch

[lcomplete]

Summary

• Routes cross-origin image fetches through the background service worker, which operates in a privileged context and is not subject to the CORS restrictions imposed on content scripts in Manifest V3.
• Introduces fetchImageViaBackground and convertCrossOriginImages helpers in exportUtils.ts that run before html2canvas, converting unsafe images to data URLs so the canvas is never tainted.
• Adds a fetch_image message handler in background.ts (with arrayBufferToBase64 / blobToDataUrl utilities) and registers the new message type in model.d.ts.
• Bumps the extension version to 0.5.4.

[augmentcode]

🤖 Augment PR Summary

Summary: This PR improves export reliability by avoiding CORS-tainted canvases when rendering pages that contain cross-origin images.

Changes:

• Adds a background service worker fetch_image message that fetches remote images and returns them as data URLs.
• Introduces fetchImageViaBackground and convertCrossOriginImages in exportUtils.ts to rewrite export-unsafe <img> sources to data URLs before html2canvas runs.
• Enhances canvasToBlob to surface tainted-canvas errors via a toDataURL() attempt when toBlob() returns null.
• Registers the new message type in model.d.ts and bumps the extension version to 0.5.4.

Technical Notes: Background fetch omits credentials and checks content-type is image/*; export still waits for images to load in the cloned DOM before rendering.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 3 suggestions posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

Since this runs in a privileged background context, consider validating that imageUrl is an expected scheme (e.g. http(s) only) before attempting fetch, to avoid surprising behavior on unusual/invalid URL types.

Severity: low

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[augmentcode]

Converting an arbitrary image Blob to a base64 data URL can create very large strings; if the payload exceeds Chrome message size limits (or causes memory pressure), this path may fail and the caller will just see a null image with no clear cause.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[augmentcode]

This early-return means same-origin images that haven’t loaded yet won’t be background-fetched, which can miss the “same-origin URL that redirects cross-origin at load time” case described above and still lead to a tainted canvas in some exports.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}