fix(extension): correct API_BASE URL to Netlify web app, store session_id, fix async sidePanel, clean up CRITICAL severity

extension/background.js

@@ -1,13 +1,19 @@
 /**
- * ClauseGuard — Background Service Worker v3.0
- * FIXED: API payload now sends {text, source_url} (not {clauses})
- * FIXED: Error handling and retry logic
+ * ClauseGuard — Background Service Worker v4.3
+ * FIXED v4.3: API_BASE now routes through the Netlify web app which has
+ *   proper Gradio SSE polling logic. The old URL pointed at the Gradio Space
+ *   directly, which doesn't expose a REST /api/analyze endpoint.
+ * FIXED v4.3: session_id from analyze response is now stored so chat can use it.
+ * FIXED v4.3: sidePanel.open() is properly awaited.
  */
 
-// FIX v4.2: Corrected API_BASE URL to match the actual Gradio Space
-const API_BASE = "https://gaurv007-clauseguard.hf.space";
+// FIX v4.3: Route through the Netlify web app — it already has Gradio SSE
+// polling in its /api/analyze route. The extension just needs a REST endpoint.
+// Previously pointed to "https://gaurv007-clauseguard.hf.space" which is a
+// Gradio Space that only exposes /gradio_api/call/analyze (SSE, not REST).
+const API_BASE = "https://clauseguardweb.netlify.app";
 const FREE_SCANS_PER_MONTH = 10;
-const API_TIMEOUT_MS = 45000;
+const API_TIMEOUT_MS = 90000; // Increased to 90s — web route polls Gradio which can be slow
 
 const SITE_ORIGINS = [
   "https://clauseguardweb.netlify.app",
@@ -34,10 +40,15 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
       case "GET_AUTH": return await getAuth();
       case "GET_USER": return await getUser();
       case "CHECK_USAGE": return await checkUsage();
-      case "OPEN_SIDEPANEL": if (sender.tab?.id) chrome.sidePanel.open({ tabId: sender.tab.id }); return { ok: true };
+      case "OPEN_SIDEPANEL":
+        if (sender.tab?.id) {
+          try { await chrome.sidePanel.open({ tabId: sender.tab.id }); } catch(e) { console.warn("sidePanel.open failed:", e); }
+        }
+        return { ok: true };
       case "GET_RESULTS": return await getStoredResults(sender.tab?.id || message.tabId);
       case "SYNC_AUTH": return await syncAuthFromWebsite();
       case "GET_SCAN_HISTORY": return await getScanHistory();
+      case "GET_SESSION_ID": return await getStoredSessionId(sender.tab?.id || message.tabId);
       default: return null;
     }
   };
@@ -95,7 +106,8 @@ async function handleAnalyze(payload, tabId) {
   let results;
   try {
     const auth = await getAuth();
-    // FIXED: Send {text, source_url} not {clauses}
+    // FIX v4.3: Send {text, source_url} to the Netlify web route which
+    // handles Gradio SSE polling internally and returns plain JSON.
     const resp = await fetchWithTimeout(`${API_BASE}/api/analyze`, {
       method: "POST",
       headers: {
@@ -109,9 +121,17 @@ async function handleAnalyze(payload, tabId) {
       return { error: "rate_limited", message: "Too many requests. Please wait a moment." };
     }
 
-    if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
-    results = await resp.json();
-    results.source = "api";
+    if (resp.status === 401) {
+      // Web route requires auth — fall back to local analysis for guests
+      console.warn("API returned 401, using local analysis for guest user");
+      results = localAnalyze(text);
+      results.source = "local";
+    } else if (!resp.ok) {
+      throw new Error(`HTTP ${resp.status}`);
+    } else {
+      results = await resp.json();
+      results.source = "api";
+    }
   } catch (err) {
     console.warn("API unavailable, using local:", err.message);
     results = localAnalyze(text);
@@ -121,6 +141,12 @@ async function handleAnalyze(payload, tabId) {
   // Store results
   if (tabId) {
     await chrome.storage.local.set({ [`results_${tabId}`]: results });
+
+    // FIX v4.3: Also store session_id so the chat feature can use it
+    if (results.session_id) {
+      await chrome.storage.local.set({ [`session_${tabId}`]: results.session_id });
+    }
+
     const flagged = results.results?.filter(r => r.categories?.length > 0).length || results.flagged_count || 0;
     chrome.action.setBadgeText({ text: flagged > 0 ? String(flagged) : "", tabId });
     if (flagged > 0) chrome.action.setBadgeBackgroundColor({ color: flagged > 3 ? "#ef4444" : "#f59e0b", tabId });
@@ -152,6 +178,12 @@ async function getScanHistory() {
   return { history: scanHistory };
 }
 
+// ─── Get stored session ID (for chat) ───
+async function getStoredSessionId(tabId) {
+  if (!tabId) return null;
+  return new Promise(r => chrome.storage.local.get([`session_${tabId}`], d => r(d[`session_${tabId}`] || null)));
+}
+
 // ─── Sync auth from website ───
 async function syncAuthFromWebsite() {
   return await getAuth();
@@ -182,14 +214,12 @@ function localAnalyze(text) {
   });
 
   const flagged = results.filter(r => r.categories.length > 0);
-  const sev = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 };
+  const sev = { HIGH: 0, MEDIUM: 0, LOW: 0 };
   flagged.forEach(r => r.categories.forEach(c => {
     if (sev.hasOwnProperty(c.severity)) sev[c.severity]++;
-    else sev.MEDIUM++;  // default for unknown severity
+    else sev.MEDIUM++;
   }));
-  // FIX v4.2: Use the same diminishing-returns formula as the backend (app.py)
-  // instead of normalizing by clause count (which gave different scores)
-  const weighted = sev.CRITICAL*40 + sev.HIGH*20 + sev.MEDIUM*10 + sev.LOW*3;
+  const weighted = sev.HIGH * 20 + sev.MEDIUM * 10 + sev.LOW * 3;
   const risk = Math.min(100, Math.round(100 * (1 - (1 / (1 + weighted / 30)))));
 
   return {
@@ -245,4 +275,4 @@ async function getStoredResults(tabId) {
   return new Promise(r => chrome.storage.local.get([`results_${tabId}`], d => r(d[`results_${tabId}`]||null)));
 }
 
-chrome.tabs.onRemoved.addListener(tabId => chrome.storage.local.remove([`results_${tabId}`]));
+chrome.tabs.onRemoved.addListener(tabId => chrome.storage.local.remove([`results_${tabId}`, `session_${tabId}`]));