StackSight v2.0.1

Security

• A hostile page could suppress the prompt with CSS. Found by testing a live install
  rather than by reading the code. The shadow root is closed, so the page cannot read,
  query or restyle the prompt's contents, and that all held up. But the host element is
  an ordinary node in the page's DOM, and
  #stacksight-prompt-host { display: none !important } hid the entire prompt.

  The host's layout-critical properties are now asserted inline with !important, which
  outranks any author stylesheet including one that uses !important itself, and a
  MutationObserver re-applies them if the style attribute is stripped. transform,
  filter, perspective and contain are locked alongside the obvious ones, because
  any of them on the host makes it the containing block for the fixed-position card
  inside the shadow root, so transform: scale(0) collapsed the prompt without touching
  display.

  Impact was bounded: suppression only, no read, no alteration, no leak. A page can still
  delete the host node outright, which nothing injected into a page's DOM can survive.
  docs/SECURITY.md now says that plainly instead of claiming page CSS cannot reach the
  prompt at all.

Changed

• npm run verify gained an 18th check, for the host style lock.

---

Install

Download stacksight-2.0.1.zip below and unzip it somewhere stable, not Downloads or the Desktop: Chrome reads the folder live.

1. Open chrome://extensions and turn on Developer mode.
2. Click Load unpacked and select the unzipped stacksight folder.
3. Pin it from the puzzle-piece menu.

Requires Chrome 111 or newer. Not on the Chrome Web Store, and not planned for it.

Full notes: INSTALL.txt · Architecture · Security model