Requestador Prompt Guard — demo build
======================================

This is a proof-of-concept build for evaluating the extension's prompt
interception flow. It ships with TEST_MODE = true in background.js, so it
never calls a live validator and never contains a real auth token: it
just flags prompts containing the words "secret", "password", "ssn", or
"api key", and allows everything else.

Install (Chrome / Edge):
  1. Unzip this file.
  2. Go to chrome://extensions (or edge://extensions).
  3. Enable "Developer mode" (top-right toggle).
  4. Click "Load unpacked" and select this unzipped folder.
  5. Requestador Prompt Guard will appear in your extensions list.

Try it against the hosted demo chat (no extra setup):
  1. With the extension loaded, open the "Open the demo environment" link
     on the install page (or go directly to /Requestador/Demo).
  2. Type a normal sentence and hit Enter — expect "Checking…" then
     "Looks clean — sending."
  3. Type something containing "secret" and hit Enter — expect a red
     "Blocked" banner, and the message is not sent.

Try it against the bundled local demo chat instead:
  1. On chrome://extensions, find Requestador Prompt Guard -> Details.
  2. Enable "Allow access to file URLs" (needed because demo.html is a
     local file, not a real site).
  3. Open demo.html directly in the browser (double-click it, or drag it
     into a tab).
  4. Same test prompts as above.

The extension also runs on claude.ai, chatgpt.com, and chat.openai.com,
using the same TEST_MODE keyword check, no production access, no risk.

Not for production use: this build has no real validator connection and
no auth token by design. Wiring up a live validator requires moving the
token behind a backend proxy first, never embedding it in the extension
itself.
