AI-Safe Plugin v1.3.0

[1.3.0] - 2026-06-21

Changed (Windows)

• Windows installer wizard now displays Maya-branded purple artwork generated at build time instead of stale placeholder BMPs, and the Windows UX fixes from this release (hidden autostart console window, metadata self-healing, cached popup status, enlarged in-field badge, themed/deduplicated offline toast) are included in this re-release.

Security

• The local server now requires a per-machine shared token on its detection endpoints (/detect, /classify, /structure, /anonymize). The server generates the token on startup and stores it with restricted permissions; the extension fetches it through the native messaging host and sends it as X-AI-Safe-Plugin-Token, so other local processes and localhost web pages can no longer drive detection. /health stays open and reports authRequired; auth can be disabled with --no-auth / AI_SAFE_PLUGIN_NO_AUTH=1.
• Tightened the local server's CORS policy to browser-extension origins only (configurable via AI_SAFE_PLUGIN_EXTRA_ALLOWED_ORIGINS); localhost web pages are no longer allowed to call the API from the browser.
• Added Host-header validation (loopback only) to defend against DNS rebinding, and a per-request socket timeout so a slow or idle client cannot tie up a server worker thread.
• Releases now publish a SHA256SUMS file, and both installers verify downloaded assets against it: a backend-bundle mismatch aborts the install, a model mismatch falls back to the Hugging Face download, and a missing SHA256SUMS (older releases) warns and continues.
• The local server no longer writes anonymisation response bodies to its logs. Anonymisation logging is now metadata-only by default (counts, status codes, and body sizes), so raw values returned by the Maya endpoint never reach the logs. Verbose logging can be restored for debugging by setting AI_SAFE_PLUGIN_DEBUG_ANON_LOGS=1.
• Updated idna to 3.18 to close CVE-2024-3651, a crafted-input bypass of the earlier fix. It was a transitive dependency in uv.lock.

Changed

• Rebranded the product to MAYA AISafe Plugin across the toolbar popup, options page, onboarding, playground, README, and a new categorized features doc (docs/FEATURES.md). Internal identifiers, native-host names, and the repository slug are unchanged.

• Made the extension Chrome Web Store-ready: scripts/build_crx.sh --store (and npm run build:zip:store) produce a key-free upload package, and each GitHub release now also publishes an …-webstore.zip asset. The unpacked/GitHub zip keeps its pinned key for a stable extension ID.

• Installers now auto-detect MAYA AISafe Plugin builds already present in a local Chromium browser (e.g. the Web Store build, whose ID Google assigns) and register those IDs for native messaging alongside the pinned default, so the Web Store and GitHub/unpacked installs both work.

• Replaced the README logo with a single transparent-background mark so it stays visible in both light and dark themes.

• Renamed the extension to AI-Safe Plugin, dropping the "AI Privacy Guard" / "Privacy Guard" suffix from the manifest, options page, and privacy policy.

• Fixed Windows native-messaging setup by pinning AI-Safe Plugin's extension ID (aggkonihfabdcbgomkfecjhdolddfabe) and defaulting installers/native-host registration to that ID when no explicit custom ID is supplied. Existing unpacked installs must reload the extension once and rerun setup once so Chrome and the native-host manifest agree.

• Rebranded the Windows local-server install path and scheduled task to AI-Safe-Plugin / AISafePluginGLiNER2, while keeping legacy cleanup for older Veil/PrivacyShield task names.

• Hardened the local server against Windows client disconnects (WinError 10053) and corrupt runtime state files so aborted browser requests and partial writes no longer produce noisy startup or handler failures.

• Fixed the macOS install on Apple Silicon where the downloaded managed Python was killed with SIGKILL ("Killed: 9"): the installer and native host now strip the Gatekeeper quarantine attribute and ad-hoc-sign the interpreter before it runs, so uv sync and the local server can start.

• The native-host registration now accepts multiple browser extension IDs (and always includes the pinned ID), so one local server can be shared across Chrome, Brave, Edge, and other Chromium browsers on the same machine.

• Refreshed the popup and settings UI: the toolbar/settings pages now use the high-resolution Maya mark (crisp white on the purple header, on a purple brand chip on light backgrounds) instead of the old low-contrast icon, and ship the Inter font for a consistent, professional look across devices. The browser toolbar action icons were regenerated to the white Maya atom on a purple rounded tile.

• Tidied the popup header layout: the brand name now stays on a single line, the live "Active (Local)" status moved into the stats/hero area, and the Beta badge and version moved down into the footer.

• Surfaced the beta product stage as a slim, dismissible banner at the top of the popup and settings pages (replacing the inline "Beta" chip in the settings sidebar), so the early-access status reads clearly and can be retired in one place later.

• Refreshed the in-page field badge to the Maya atom mark on a brand-purple disc with a white halo so it stays clearly visible on any website background, plus a gentle resting animation; it still turns amber with a count when items need attention and green with a check when protected. The atom is drawn inline (bolder strokes) so it stays legible at the small badge size, and the onboarding welcome icon now uses the white Maya mark.

• Improved the beta banner's contrast (deeper background, brighter text) and shrank its dismiss button, and fixed the playground page card so it is horizontally centered again.

• Enlarged the in-field corner badge slightly (easier to see and click) and fixed the redaction panel's per-item action buttons rendering as oversized purple pills on the playground — the settings page's global button styling is now scoped to the settings and playground containers so it no longer leaks onto the injected in-page panel.

• Re-themed the in-page UI (field panel, popover, token chips, toast notifications) from the old warm cream/brown palette to the purple Material-You theme used across the rest of the extension, so the injected surfaces match the brand. Semantic colours — risk-tier badges, error/warning toasts, and per-category detection colours — are unchanged.

Added

• Non-sensitive settings now sync across your devices via Chrome sync: protection toggle, sensitivity, redaction mode, auto-redact, enabled types, custom patterns and detectors, and monitored/excluded sites and selectors. Secrets (Maya API key, anonymisation seed, server token), per-site ledgers, caches, local stats, and per-site snoozes are never synced and stay on the device. Local remains the source of truth; a newer copy from another device is applied on startup and live.

Changed

• Expanded the default monitored-sites list to cover today's major AI chat apps — ChatGPT, Claude, Gemini, Copilot, Perplexity, Grok, DeepSeek, Mistral Le Chat, Poe, Character.AI, Pi, You.com, Meta AI, Qwen, DuckDuckGo (duck.ai), Hugging Face, Phind, and T3 Chat — so scoped monitoring protects them out of the box. (With "monitor all sites" on by default, every site is already covered; this improves the allowlist used when you scope monitoring to specific sites.)
• AI-Safe Plugin now initializes lazily on ordinary websites: on pages that aren't known AI chat apps, it does no work until you focus a text field, instead of always loading its model ping, observers, and polling on every page. Known AI sites (ChatGPT, Claude, Gemini) still activate immediately on load.

Added

• Added a local "Your privacy impact" summary in the options About section: a durable, privacy-safe tally of how many items you've protected in total, this week, and your top detection types. Counts only — it never stores the protected values or the sites you used — and the "Delete all data" control clears it.
• Added a first-run interactive playground: a built-in "try it" page (linked from the end of onboarding and the options About section) where new users can insert synthetic sample text and watch AI-Safe Plugin detect, underline, and redact it — using the real in-page engine, without visiting any third-party site and without sending anything anywhere.
• Accessibility pass on the in-page UI: the field badge is now a keyboard-operable button (Tab to it, Enter/Space opens the panel) with a screen-reader label that reflects its state; the detection panel is a focus-trapped dialog that closes on Escape and returns focus to the badge; status changes like "N items protected" are announced through an ARIA live region; toasts and token-tray chips carry proper roles/labels; and all animation continues to respect the reduced-motion setting.
• Added keyboard shortcuts: Alt+Shift+R redacts all detections in the focused field, and Alt+Shift+V toggles AI-Safe Plugin off/on for the current site using the per-site exclude list.
• Added per-site quick controls to the popup: the current host can be paused for one hour or turned off/on directly, backed by excludedSites and siteSnoozes storage that content scripts honor live.
• Added a live count on the AI-Safe Plugin toolbar icon: an amber badge shows how many detections still need attention on the current page, flips to a green check when everything is protected, and clears when you navigate away — so you get an at-a-glance signal without opening the popup. Push-based and throttled; no new permissions.
• Brought back the hover popover on detection underlines: hovering an unredacted detection now shows a small card with the detection type, a one-line explanation of why it matters, and Redact / Dismiss actions — so the colored underlines are self-explanatory. The card works on rich-editor (ChatGPT/Gemini/Claude-style) fields, closes on Escape or pointer-out, and respects reduced-motion.
• Added a persistent per-site "Ignore on this site" action (on the hover popover and the field panel) so AI-Safe Plugin stops flagging values you've marked as safe — and remembers them across reloads. Ignored values are stored per site, expire after 90 days, and can be reviewed or removed from the new "Ignored Values" card in the options page. High-risk types (cards, SSNs, API keys, JWTs, private keys, connection strings, Aadhaar) can never be ignored.
• Added a "Delete all AI-Safe Plugin data" control in the Advanced settings. A two-click confirm fully clears all browser-local AI-Safe Plugin data — settings, custom patterns, custom entity types, Maya API key, Hugging Face token, anonymisation seed, server-URL override, per-site alias ledgers, cached redaction state, onboarding flags, and local stats — then restores defaults.
• Published the AI-Safe Plugin privacy policy at docs/PRIVACY_POLICY.md, linked from the extension's About section and the README.

Changed

• Simplified the per-site popup controls so the site row uses contextual Pause/Resume and Turn on/off actions instead of a second switch, and re-scans existing fields immediately when site protection is restored.
• Corrected store and in-app copy that claimed data "never leaves your machine" to accurately describe AI-Safe Plugin as local detection by default, with optional Maya anonymisation only when the user enables it.
• Replaced the "AI-Safe Plugin / Scanning..." banner pill and the floating action bar with a single 26 px corner badge per field. The badge morphs between five states — idle monogram, spinning scanner, amber count of unredacted items, green check when all protected, and a fallback dot when the server is offline — so the field is never obscured while typing.
• Clicking the badge opens a compact panel listing each detected item with individual redact, restore, and dismiss actions, plus "Redact all" and "Restore all" footer buttons. The panel replaces the old action bar entirely.
• The token tray remains for redacted textarea/input fields but is hidden while the panel is open to avoid duplication.

Removed

• Removed the Dependabot configuration; dependencies are now updated by hand.
• Removed internal draft and planning documents that were never meant to ship: the privacy-policy draft, the hardening/UX plan, the Windows-installer plan, and a redundant changelog stub.

Documentation

• Added docs/RELEASING.md describing the release process: bump the version, run npm run version:sync, add a changelog entry, then push a v* tag.

---