feat(privacy): show where page text is processed; correct the "local AI" claim by djleamen · Pull Request #46 · djleamen/MapleClear

djleamen · 2026-10-30T03:38:35Z

Why

MapleClear is used on pages like benefits and tax forms, and the README sells it as "Privacy-first approach using local inference." But the default backend (MAPLECLEAR_BACKEND, defaulting to groq) is Groq's cloud API. The popup only said groq backend ready, and /health hard-coded local_mode: true. A citizen had no way to tell that the page text leaves their machine.

What

Server: /health reports the truth.
- local_mode is computed from the backend (CLOUD_BACKENDS = {"groq"}).
- A new demo_mode flag is read from the live backend. Groq with no API key falls back to canned responses and sends nothing.
Popup: the status line reads those fields and shows one of:
- Ready · groq cloud (text leaves this device)
- Ready · on this device (<backend>)
- Ready · demo mode (sample output, nothing is sent)
README: the feature bullet now describes local and cloud modes accurately and points at the popup indicator.

Verification

ruff check server passes, and pytest server/tests is 4/4. The new test covers Groq without a key, which reports demo_mode and local_mode true.
npm run lint:extension (0 warnings) and npm run build:extension pass.

Also reviewed (no change needed)

The server's CORS is already restricted to extension and localhost origins, with allow_credentials=False. FastAPI won't parse text/plain bodies as JSON, so arbitrary websites can't drive the local inference server.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Hvd6pkP1fCFrGoA5FmeKF3

…AI' claim The README promised 'privacy-first local inference', but the default backend is Groq's cloud API, and the popup only said 'groq backend ready'. For a tool people use on benefits and tax pages, users should know before they click whether the page text leaves their device. - Popup status now reads 'Ready · groq cloud (text leaves this device)' or 'Ready · on this device (<backend>)'. - README feature bullet describes local and cloud modes accurately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hvd6pkP1fCFrGoA5FmeKF3

github-actions · 2026-10-30T03:38:46Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

Copilot

🟡 Changes recommended

The popup incorrectly claims page text leaves the device when Groq is in demo mode because it infers processing behavior from the configured backend rather than the actual runtime mode.

1 open issue

Report actual Groq demo mode in health and popup · New

What changed in this PR

This PR corrects MapleClear’s local-only privacy claim and adds a popup indicator showing whether the selected backend processes page text locally or through Groq’s cloud API.

Changes:

Classifies Groq as a cloud backend and adds processing-location text to the connected status.
Updates the README to describe local and cloud options and explain Groq’s data transfer.

File	Description
README.md	Replaces the local-only claim with local/cloud processing guidance.
extension/src/popup.js	Adds backend classification and processing-location status messages.

_{Review effort: Balanced}

…llback Review follow-up: Groq without an API key falls back to canned demo responses, but /health still said backend=groq (and hard-coded local_mode=True), so the popup claimed text left the device when nothing was sent - and would have claimed local for real cloud use. - /health now returns local_mode computed from the backend and a new demo_mode flag read from the live backend instance. - The popup reads those instead of guessing from the backend name: demo / on this device / <backend> cloud. - Test: Groq with no key reports demo_mode and local_mode true. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hvd6pkP1fCFrGoA5FmeKF3

Copilot

🟡 Changes recommended

Demo fallback modes in vLLM, Hugging Face, and LM Studio are incorrectly reported as ready because only Groq exposes the demo-state property checked by the popup.

1 open issue

Report demo fallback state consistently across backends · New

1 resolved since last review

Report actual Groq demo mode in health and popup

_{Review effort: Balanced}

/health read demo_mode off the backend, but only GroqBackend set it, so vLLM, Hugging Face, LM Studio and llama.cpp reported "Ready · on this device" even while serving canned demo responses (e.g. when the library or model is unavailable). The popup then hid the sample-output warning. Default demo_mode on the base backend and set it in each backend's initialize() wherever that backend decides to fall back to demo output: vLLM/HF when the library or model is missing, LM Studio when aiohttp is missing or no model is loaded, llama.cpp when the model file is absent. Groq is unchanged. Add a /health test for a non-Groq backend (vLLM, uninstalled in CI) that asserts demo_mode and local_mode are both reported true. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hvd6pmyDV2J1mdVgk1Gi79

Copilot

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

Copilot

🟡 Changes recommended

The popup can falsely claim on-device processing while a legacy server sends page text to Groq, and the vLLM backend presents canned responses as real inference.

1 open issue

Keep vLLM marked as demo while responses are canned · New

1 previously missed issue

In code that hasn't changed since last review

Do not trust legacy health responses for processing location

extension/src/popup.js:72

An updated extension can still connect to an already-running pre-change server. That server returns local_mode: true even for live Groq requests and has no demo_mode field, so this code displays “on this device” while sending page text to Groq. Require the new health-response fields before trusting the location claim, and show an unknown/update-required message for legacy responses instead of defaulting to on-device processing.

_{Review effort: Balanced}

…tion claim Two review follow-ups: - VLLMBackend.simplify/translate/expand_acronyms return canned responses unconditionally (they never call _run_inference), so the backend is demo even when vLLM initializes. Mark it demo_mode = True from construction so /health and the popup don't present sample output as real on-device inference. - The popup defaulted to "on this device" whenever demo_mode was absent and local_mode wasn't false. An older, still-running server omits demo_mode and returns local_mode:true even for live Groq requests, so an updated extension could claim on-device processing while page text went to the cloud. Require the demo_mode field (added by this server version) before trusting the location, and show "processing location unknown - update the server" for legacy responses. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hvd6pmyDV2J1mdVgk1Gi79

djleamen · 2026-10-30T14:49:51Z

Also addressed the "previously missed" HIGH finding on extension/src/popup.js in the same commit (86e0db8): an updated extension could connect to an older, still-running server that omits demo_mode and returns local_mode: true even for live Groq, so the popup would claim "on this device" while text went to the cloud.

The popup now requires the demo_mode field (added by this server version) before trusting the location claim. If it's absent, it shows "Ready · processing location unknown — update the MapleClear server" instead of defaulting to on-device. (No inline thread existed for it, since the flagged code was unchanged since the last review.)

Generated by Claude Code

sonarqubecloud · 2026-10-30T14:50:13Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

🔵 Needs a closer look

Human assessment is needed to evaluate the mismatch between the README’s advertised vLLM support and the backend’s permanently demo-only, canned responses.

No open issues 🎉

1 resolved since last review

Keep vLLM marked as demo while responses are canned

_{Review effort: Balanced}

Copilot AI balanced review requested due to automatic review settings October 30, 2026 03:38

Copilot started reviewing on behalf of djleamen October 30, 2026 03:39

View session

Copilot AI reviewed Oct 30, 2026

View reviewed changes

Comment thread extension/src/popup.js Resolved

djleamen requested a balanced review from Copilot October 30, 2026 11:18

Copilot started reviewing on behalf of djleamen October 30, 2026 11:18

View session

Copilot AI reviewed Oct 30, 2026

View reviewed changes

Comment thread server/app.py Resolved

djleamen requested a balanced review from Copilot October 30, 2026 13:56

Copilot AI reviewed Oct 30, 2026

djleamen requested a balanced review from Copilot October 30, 2026 14:43

Copilot started reviewing on behalf of djleamen October 30, 2026 14:43

View session

Copilot AI reviewed Oct 30, 2026

View reviewed changes

Comment thread server/backends/vllm_backend.py Resolved

djleamen requested a balanced review from Copilot October 30, 2026 14:52

Copilot started reviewing on behalf of djleamen October 30, 2026 14:52

View session

Copilot AI reviewed Oct 30, 2026

View reviewed changes

djleamen merged commit 610ef87 into main Oct 30, 2026
10 checks passed

djleamen deleted the dl/vigilant-hypatia-t20x05 branch October 30, 2026 15:14

Navigation Menu

Repository navigation

feat(privacy): show where page text is processed; correct the "local AI" claim - #46

feat(privacy): show where page text is processed; correct the "local AI" claim#46
djleamen merged 4 commits into
mainfrom
dl/vigilant-hypatia-t20x05

djleamen commented Oct 30, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

djleamen commented Oct 30, 2026

Uh oh!

sonarqubecloud Bot commented Oct 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

djleamen commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

Verification

Also reviewed (no change needed)

Uh oh!

github-actions Bot commented Oct 30, 2026

Dependency Review

Scanned Files

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

djleamen commented Oct 30, 2026

Uh oh!

sonarqubecloud Bot commented Oct 30, 2026

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

djleamen commented Oct 30, 2026 •

edited

Loading