Claude in Chrome: CSP violation blocks sidepanel initialization, prevents native messaging connection (Linux/Chrome)

Bug Description

The Claude Chrome extension fails to connect to Claude Code CLI due to a Content Security Policy (CSP) violation in sidepanel.html. An inline <script> tag (theme detection code) is blocked by Chrome's CSP, which prevents the side panel from initializing and breaks the native messaging connection.

Environment

• Claude Code version: 2.1.78
• OS: Fedora Linux (kernel 6.18.13-100.fc42.x86_64)
• Chrome: Google Chrome (latest stable)
• Extension ID: fcoeoabgfenejglbffodgkkbkcdhcgfn
• Account: Claude Pro Max, logged into claude.ai

Errors from Chrome Extensions Page

Executing inline script violates the following Content Security Policy directive 'script-src 'self''.
Either the 'unsafe-inline' keyword, a hash ('sha256-kFwyFWA0myfqRcE5y2d5UX8g0o2QFHSmCz1gWSW0xpk='),
or a nonce ('nonce-...') is required to enable inline execution. The action has been blocked.

Context: sidepanel.html?tabId=1395929411

Additional errors:

• Loading the script 'https://cdn.segment.com/next-integrations/actions/amplitude-plugins/...' violates CSP directive: "script-src 'self'"
• Uncaught (in promise) Error: Could not establish connection. Receiving end does not exist. (x2)
• Error: A listener indicated an asynchronous response by returning true, but the message channel closed before a response was received

Root Cause

The inline script at line 8 of sidepanel.html sets the initial theme based on system preference:

<script>
  // Set initial theme mode based on system preference
  (function () {
    const isDark = window.matchMedia("(prefers-color-scheme: dark)").matches;
    document.documentElement.setAttribute("data-mode", isDark ? "dark" : "light");
    // ...
  })();
</script>

Manifest V3 extensions do not allow inline scripts. This should be moved to an external .js file or use a CSP hash.

Behavior

• mcp__claude-in-chrome__tabs_context_mcp always returns: "Browser extension is not connected"
• Native messaging host is correctly configured at ~/.config/google-chrome/NativeMessagingHosts/com.anthropic.claude_code_browser_extension.json
• The native host script at ~/.claude/chrome/chrome-native-host exists and points to the correct Claude Code binary
• Extension service worker console is empty (no activity)

Steps to Reproduce

1. Install Claude extension from Chrome Web Store on Linux
2. Log into claude.ai with a Pro Max account
3. Start Claude Code CLI v2.1.78
4. Run /chrome or attempt to use any claude-in-chrome tool
5. Observe "Browser extension is not connected" error
6. Check extension errors page — CSP violations visible

Expected Behavior

The extension should connect to Claude Code and allow browser automation via the mcp__claude-in-chrome__* tools.

Related Issues

• #20298
• #20789 (same "Receiving end does not exist" error)
• #21371
• #24935
• #26217
• #31971