• The detector runs as WebAssembly. The extension now takes a snapshot of the page and evaluates the rules in an offscreen document, so a site's Content Security Policy no longer decides whether the detector runs. Same rules as the CLI and live mode, built from the same source. The new offscreen permission is what makes that possible; nothing else about what the extension can see has changed.