Summary. 2.0.3 changes the extension's icon to the Locke logo. The package
differs from 2.0.2 only in the four icon PNGs and the version number; no
script, permission, host or popup markup changes. For reviewers, since the 2.0.2 notes understated it: from
2.0.2 onward the content scripts match every http:// and https:// page (they
previously matched a fixed list of AI sites) so each bodied request can be
classified on-device by the Locke desktop app. host_permissions is still
loopback-only (http://127.0.0.1/*), no permission was added, and the
extension sends request content only to the local desktop app over native
messaging. 2.0.3 is unchanged from 2.0.2 in this respect.

Changed — Locke logo on the extension icon and store listing
- icons/icon-{16,32,48,128}.png are re-rendered from the Locke padlock mark
(transparent background), replacing the charcoal-tile version. Sizes are
unchanged, so manifest.json and the store-build size checks are untouched.
- docs/store/assets/store-listing-logo.png (the Locke mark on white, with
padding) and its 300x300 downscale edge-logo-300x300.png are the store
listing logo. Published listings keep the old art until the next version is
submitted. icons/action.svg is no longer the master for the PNG icons.

Summary. 2.0.2 raises the fail-closed verdict ceiling so a cold screen of a
long conversation can finish instead of being blocked for taking too long, and
documents a coverage limit that had gone unstated since it landed: on
chatgpt.com, claude.ai and www.perplexity.ai only a short list of paths is
screened, so other bodied requests on those hosts are not held. The same
catalog revision closes the worst of that gap by adding claude.ai's two
attachment-upload paths. For reviewers: nothing here weakens fail-closed, no
permission was added or widened, outbound requests are still loopback-only, the
Firefox data-collection declaration is still none, and HONEST.md now states
the path limit in full.

Fixed
- A blocked XMLHttpRequest left readyState at OPENED and fired no
readystatechange, so a page driving XHR through onreadystatechange — the
older of the two idioms, and still common — waited forever on a request we had
already refused. A refused XHR now transitions to DONE and fires
readystatechange before error and loadend, which is what the page sees
from a network failure.
- HONEST.md and README.md both claimed a same-origin bodied request to a
covered AI host is held. On the three hosts the catalog narrows by path, it is
not. Both documents now say which paths are screened and what that leaves
unscreened; a test fails if either drifts from the generated file again.
- Three native-host failure codes (host-panic, bridge-protocol-mismatch,
native-timeout) told the user "the Locke desktop app could not be reached.
Start it." Nothing was unreachable in any of them. Each now says what actually
happened, and the first two no longer leave the popup reading "Active" off a
receipt from before the failure.

Added
- claude.ai attachment uploads (/api/*/upload,
/api/organizations/*/convert_document) are now held and screened.
- The popup reports how many requests were blocked this session beside the
count of items redacted, and the toolbar badge shows the blocked count for ten
seconds after a block. A block was previously visible only as a failed request
on the page and a line on a console nobody has open. The badge stays empty when
healthy and every existing badge state still wins over the count.

Changed
- The fail-closed verdict ceiling is 200 s (was 45 s), behind the service
worker's 190 s native-call timeout and the native host's 180 s capture
deadline, so a slow-but-valid screen is no longer refused for being slow and
each hop still reports its own specific reason. The managed
enforceTimeoutMs range is 1000–300000, default 200000.
- Native host requests are cancellable, and live browser connection status
recovers rather than staying stuck after a failed round trip.

Summary. 2.0.1 makes the extension work on Firefox (2.0.0 blocked every
in-scope AI request there), closes the remaining ways a request could leave the
browser unscreened, and stops the popup and toolbar badge reporting "Active" on
anything short of a real screened request. For reviewers: the Firefox
data-collection declaration is none, the privacy policy is the
extension-specific one, the only outbound requests are to loopback, and the
source is published under a view-only licence.

Fixed
- Firefox: every in-scope AI request was blocked because the content-script
relay expected a promise from chrome.runtime.sendMessage; both messaging
dialects are now handled, and settings (including admin policy) are read the
same way.
- Attachments an AI web app uploads to object storage on another host were
never seen; a cross-origin object write from a covered page is now held and
screened, with no host permission added.
- The popup and badge could show "Screening: Active" from a connection alone, a
reachability probe, or a fail-open send; "Active" now requires a real
screened-request receipt.
- Frames with no URL of their own (about:blank, srcdoc, blob:) and
subdomains of catalog hosts got no hooks; the manifest now covers them.
- A blocked request looked like the site breaking and often carried wrong
advice; every block now names Sonomos, its kind, and a remedy that is true.
- Popup status no longer claims the desktop app is down before asking, and the
enforce timeout is back to 45 s.
- On a managed profile, a request fired before the admin policy arrived was
screened even for an excluded provider; and a redacted resend of
fetch(new Request(url), init) dropped init.

Added
- Source published as sonomoshq/Locke-Extension under a view-only licence.
- data_collection_permissions: { required: ["none"] } under
browser_specific_settings.gecko.
- The allowedProviders managed policy is enforced (subtractive).
- In-scope navigator.sendBeacon and fetchLater() requests carrying a body
are refused rather than sent unscreened.
- The popup reports how many items of personal information were redacted this
session and how many requests went out under the user's fail-open setting.

Changed
- Privacy policy URL is now https://sonomos.ai/locke/privacy.
- Injection host list resynced from the catalog: removed phind.com,
www.phind.com, chat.lechat.fr, leo.brave.com, brave.com,
grok.x.ai; added copilot.microsoft.com, grok.com, duck.ai,
assistant.kagi.com.
- Store packages ship PNG icons only and exclude build inputs; the Firefox
package drops the Chrome-only storage.managed_schema pointer.
- Publishing is a manual workflow_dispatch, not a side effect of merging.