From 6531e1952c3ce8a9146465b2cd33f6200aa5ec83 Mon Sep 17 00:00:00 2001
From: heznpc <heznpc@gmail.com>
Date: Mon, 1 Jun 2026 23:08:44 +0900
Subject: [PATCH 1/2] =?UTF-8?q?fix:=20close=20pre-release=20blockers=20(br?=
 =?UTF-8?q?idge=20scope,=20course=20drift,=20example-q,=20release=20docs)?=
 =?UTF-8?q?=20=E2=80=94=20v3.5.39?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[security] Scope the Puter page bridge + AI tutor to anthropic.skilljar.com.
  The bridge's postMessage nonce is readable by any page-world script, so it
  must not run on Skilljar tenants we don't control. Other AI-detected tenants
  keep dictionary + Google Translate; only the trusted host gets the bridge/tutor.

[fix] closeSubPanel re-binds the example-question chips (handlers were lost
  after opening+closing a sub-panel).

[fix] Wire ai-fluency-for-small-businesses (18th course) into FLASHCARD_COURSE_MAP
  (clears check:academy) and re-enable the 12h academy-courses-drift cron — the
  scraper parses the current catalog again, restoring POSITIONING.md's SLA claim.

[docs] Store listing -> 18 courses (EN/ko/ja); RELEASE_CHECKLIST refreshed
  (icon resolved, v3.5.39, bundled zip rebuilt). Bump 3.5.38 -> 3.5.39.
---
 .github/workflows/academy-courses-drift.yml | 11 +++--
 CHANGELOG.md                                | 12 ++++++
 README.md                                   |  2 +-
 docs/index.html                             |  4 +-
 manifest.json                               |  2 +-
 package.json                                |  2 +-
 src/content/content.js                      | 21 +++++++---
 src/content/sidebar-chat.js                 |  4 ++
 src/data/de.json                            |  2 +-
 src/data/es.json                            |  2 +-
 src/data/fr.json                            |  2 +-
 src/data/it.json                            |  2 +-
 src/data/ja.json                            |  2 +-
 src/data/ko.json                            |  2 +-
 src/data/pt-BR.json                         |  2 +-
 src/data/ru.json                            |  2 +-
 src/data/vi.json                            |  2 +-
 src/data/zh-CN.json                         |  2 +-
 src/data/zh-TW.json                         |  2 +-
 src/lib/constants.js                        |  1 +
 store-assets/RELEASE_CHECKLIST.md           | 46 +++++++++------------
 store-assets/STORE_LISTING-ja.md            |  2 +-
 store-assets/STORE_LISTING-ko.md            |  2 +-
 store-assets/STORE_LISTING.md               |  4 +-
 24 files changed, 77 insertions(+), 58 deletions(-)

diff --git a/.github/workflows/academy-courses-drift.yml b/.github/workflows/academy-courses-drift.yml
index 8c20185..13710ef 100644
--- a/.github/workflows/academy-courses-drift.yml
+++ b/.github/workflows/academy-courses-drift.yml
@@ -16,12 +16,11 @@ name: Academy course catalog drift watcher
 # after the existing issue closes and drift recurs.
 
 on:
-  # TODO(2026-05-21): cron paused — Skilljar page structure changed, scraper
-  # broken since 2026-05-16 (5 days, 8 consecutive fails). Re-enable after
-  # fixing selectors in a dedicated session. Manual dispatch still available.
-  # Original cadence: '15 */12 * * *' (every 12h)
-  # schedule:
-  #   - cron: '15 */12 * * *'
+  # Re-enabled 2026-06-01: the scraper parses the current catalog correctly
+  # again (check-academy-courses.js passes after wiring the new course), so the
+  # 12-hour watch behind POSITIONING.md's "new course -> 48h" SLA is restored.
+  schedule:
+    - cron: '15 */12 * * *'
   workflow_dispatch: # manual trigger from Actions UI
 
 permissions:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d4e33c7..7ee7a27 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [3.5.39] - 2026-06-01
+
+### Security
+- **Page bridge + AI tutor scoped to `anthropic.skilljar.com`.** The Puter postMessage bridge (Gemini verification + Claude tutor) uses a nonce that any page-world script can read, so it must not run on Skilljar tenants we don't control. The bridge and the tutor sidebar now initialize only on the trusted Anthropic host; other AI-detected Skilljar tenants still get the dictionary + Google Translate, just not the bridge.
+
+### Fixed
+- Example-question chips lost their click handlers after opening and closing a sub-panel (History / Flashcards / Bookmarks / Continue) — `closeSubPanel` now re-binds them alongside the chat input.
+
+### Changed
+- Wired `ai-fluency-for-small-businesses` (18th live course) into `FLASHCARD_COURSE_MAP`, clearing the Academy course-drift check, and re-enabled the 12-hour drift cron (the catalog scraper parses correctly again).
+- Store listing updated to 18 courses; `RELEASE_CHECKLIST.md` refreshed for the current state (icon resolved, v3.5.39 artifacts).
+
 ## [3.5.38] - 2026-06-01
 
 ### Fixed — translation rendering & dark-mode polish (from a live debugging pass on anthropic.skilljar.com)
diff --git a/README.md b/README.md
index f9294f2..96007fa 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 <img src="assets/icons/icon128.png" alt="SkillBridge" width="90" />
 
-# SkillBridge — AI Course Translator <!-- VERSION_START -->v3.5.38<!-- VERSION_END -->
+# SkillBridge — AI Course Translator <!-- VERSION_START -->v3.5.39<!-- VERSION_END -->
 
 > Available in multiple languages at the [project landing page](https://heznpc.github.io/skillBridge/).
 
diff --git a/docs/index.html b/docs/index.html
index e23c88b..105425f 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -6,7 +6,7 @@
   <title>SkillBridge — AI Course Translator for <!-- LANG_COUNT_START -->32+<!-- LANG_COUNT_END --> Languages</title>
   <meta name="description" content="Free Chrome extension to translate the free AI courses at anthropic.skilljar.com into <!-- LANG_COUNT_START -->32+<!-- LANG_COUNT_END --> languages with an in-page AI tutor. No API keys needed.">
   <meta property="og:title" content="SkillBridge — AI Course Translator">
-  <meta property="og:description" content="Translate the free AI courses at anthropic.skilljar.com into your language. <!-- VERSION_START -->v3.5.38<!-- VERSION_END -->.">
+  <meta property="og:description" content="Translate the free AI courses at anthropic.skilljar.com into your language. <!-- VERSION_START -->v3.5.39<!-- VERSION_END -->.">
   <meta property="og:type" content="website">
   <style>
     * { margin: 0; padding: 0; box-sizing: border-box; }
@@ -255,7 +255,7 @@
 <body>
   <section class="hero">
     <div class="container">
-      <div class="hero-badge"><!-- VERSION_START -->v3.5.38<!-- VERSION_END --> &middot; Open Source &middot; Free &middot; No API Key</div>
+      <div class="hero-badge"><!-- VERSION_START -->v3.5.39<!-- VERSION_END --> &middot; Open Source &middot; Free &middot; No API Key</div>
       <h1>Translate AI Courses<br>Into Your Language</h1>
       <p>A Chrome extension that translates the free AI course pages at anthropic.skilljar.com into <!-- LANG_COUNT_START -->32+<!-- LANG_COUNT_END --> languages with an in-page AI tutor.</p>
       <p style="font-size:13px;opacity:0.85;margin-top:-16px;">Independent community project. Not affiliated with, endorsed by, or sponsored by Anthropic or Skilljar.</p>
diff --git a/manifest.json b/manifest.json
index c562ce2..c838d8d 100644
--- a/manifest.json
+++ b/manifest.json
@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "__MSG_extName__",
   "description": "__MSG_extDescription__",
-  "version": "3.5.38",
+  "version": "3.5.39",
   "minimum_chrome_version": "124",
   "author": "SkillBridge Contributors",
   "homepage_url": "https://github.com/heznpc/skillbridge",
diff --git a/package.json b/package.json
index a77b381..542574b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "skillbridge",
-  "version": "3.5.38",
+  "version": "3.5.39",
   "private": true,
   "scripts": {
     "test": "jest --verbose",
diff --git a/src/content/content.js b/src/content/content.js
index 464b28c..584069f 100644
--- a/src/content/content.js
+++ b/src/content/content.js
@@ -521,8 +521,17 @@
 
       window._sb.injectHeaderLanguageSelect?.();
       window._sb.injectDarkModeToggle?.();
-      window._sb.injectSidebar?.();
-      window._sb.injectFloatingButton?.();
+      // The Puter page bridge and AI tutor only run on the trusted Anthropic
+      // host. Other Skilljar tenants (activated via the AI-content gate) still
+      // get dictionary + Google Translate, but not the bridge — its postMessage
+      // nonce is readable by any page-world script, so we never expose it on
+      // tenants we don't control.
+      const _host = (location.hostname || '').replace(/\.$/, '').replace(/^www\./, '');
+      const isTrustedHost = _host === 'anthropic.skilljar.com';
+      if (isTrustedHost) {
+        window._sb.injectSidebar?.();
+        window._sb.injectFloatingButton?.();
+      }
 
       isReady = true;
 
@@ -566,9 +575,11 @@
         }
       });
 
-      translator.initialize().catch((err) => {
-        console.warn('[SkillBridge] Bridge init failed (AI features unavailable):', err);
-      });
+      if (isTrustedHost) {
+        translator.initialize().catch((err) => {
+          console.warn('[SkillBridge] Bridge init failed (AI features unavailable):', err);
+        });
+      }
 
       if (typeof YouTubeSubtitleManager !== 'undefined') {
         subtitleManager = new YouTubeSubtitleManager(currentLang);
diff --git a/src/content/sidebar-chat.js b/src/content/sidebar-chat.js
index 9fb26ee..cff6065 100644
--- a/src/content/sidebar-chat.js
+++ b/src/content/sidebar-chat.js
@@ -458,6 +458,10 @@
     _state.bookmarksPanelOpen = false;
     _state.recentPanelOpen = false;
     bindChatInputEvents();
+    // Example-question chips may still be in the restored chat HTML; their
+    // click handlers must be re-bound too (closeSubPanel previously only
+    // re-bound the input).
+    bindExampleQuestions();
   }
 
   // ============================================================
diff --git a/src/data/de.json b/src/data/de.json
index 57b8fcf..b574706 100644
--- a/src/data/de.json
+++ b/src/data/de.json
@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "de",
     "langName": "Deutsch",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {
diff --git a/src/data/es.json b/src/data/es.json
index 991c3e6..401fec7 100644
--- a/src/data/es.json
+++ b/src/data/es.json
@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "es",
     "langName": "Español",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {
diff --git a/src/data/fr.json b/src/data/fr.json
index fa57e6a..0707dab 100644
--- a/src/data/fr.json
+++ b/src/data/fr.json
@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "fr",
     "langName": "Français",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {
diff --git a/src/data/it.json b/src/data/it.json
index b01accf..c54ad0e 100644
--- a/src/data/it.json
+++ b/src/data/it.json
@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "it",
     "langName": "Italiano",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-05-25",
     "translation_provenance": "v1 — derived from src/data/es.json via Spanish→Italian regex transformation (Romance proximity ~80%). Native Italian PRs welcome to replace any section wholesale; structural keys must remain identical to other premium dictionaries (enforced by scripts/check-dict-coverage.js)."
   },
diff --git a/src/data/ja.json b/src/data/ja.json
index fe4a093..591b5ac 100644
--- a/src/data/ja.json
+++ b/src/data/ja.json
@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "ja",
     "langName": "日本語",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {
diff --git a/src/data/ko.json b/src/data/ko.json
index 98b835f..4319cde 100644
--- a/src/data/ko.json
+++ b/src/data/ko.json
@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "ko",
     "langName": "한국어",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {
diff --git a/src/data/pt-BR.json b/src/data/pt-BR.json
index 329e6e1..6206e9e 100644
--- a/src/data/pt-BR.json
+++ b/src/data/pt-BR.json
@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "pt-BR",
     "langName": "Português (BR)",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {
diff --git a/src/data/ru.json b/src/data/ru.json
index 1c6d136..2b8d35e 100644
--- a/src/data/ru.json
+++ b/src/data/ru.json
@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "ru",
     "langName": "Русский",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {
diff --git a/src/data/vi.json b/src/data/vi.json
index dfab7f5..1192a3c 100644
--- a/src/data/vi.json
+++ b/src/data/vi.json
@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "vi",
     "langName": "Tiếng Việt",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {
diff --git a/src/data/zh-CN.json b/src/data/zh-CN.json
index bdc9e1f..a9183da 100644
--- a/src/data/zh-CN.json
+++ b/src/data/zh-CN.json
@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "zh-CN",
     "langName": "简体中文",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {
diff --git a/src/data/zh-TW.json b/src/data/zh-TW.json
index 8797e27..a876f10 100644
--- a/src/data/zh-TW.json
+++ b/src/data/zh-TW.json
@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "zh-TW",
     "langName": "中文(繁體)",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {
diff --git a/src/lib/constants.js b/src/lib/constants.js
index 3a81046..40e522e 100644
--- a/src/lib/constants.js
+++ b/src/lib/constants.js
@@ -1311,6 +1311,7 @@ const FLASHCARD_COURSE_MAP = {
   'ai-fluency-for-educators': ['aiFluencyEdu'],
   'ai-fluency-for-students': ['aiFluencyStudent'],
   'ai-fluency-for-nonprofits': ['aiFluencyNonprofit'],
+  'ai-fluency-for-small-businesses': ['aiFluency'],
   'teaching-ai-fluency': ['teachingAI'],
   // Other
   'ai-capabilities': ['aiCapabilities'],
diff --git a/store-assets/RELEASE_CHECKLIST.md b/store-assets/RELEASE_CHECKLIST.md
index 9f3b5a0..466b842 100644
--- a/store-assets/RELEASE_CHECKLIST.md
+++ b/store-assets/RELEASE_CHECKLIST.md
@@ -1,14 +1,15 @@
-# Release Checklist — v3.5.34 re-publication
+# Release Checklist — v3.5.39 re-publication
 
-> Refreshed 2026-05-29. The previous revision predated the v2 icon revert (PR #144),
-> the manifest version bump to 3.5.34, and the CWS-drift watcher. This is the source
-> of truth for the next dashboard upload.
+> Refreshed 2026-06-01 for v3.5.39. Since the last revision: the non-infringing
+> icon shipped (v3.5.35), the learning-companion features + Tools menu landed
+> (v3.5.36–3.5.39), and the page bridge / AI tutor was scoped to
+> anthropic.skilljar.com. This is the source of truth for the next dashboard upload.
 
-CWS listing as of 2026-05-29 (verified via `npm run check:cws-drift`):
-- Published: **v1.0.1** (uploaded 2026-03-10, 80 days ago)
-- Local: **v3.5.34**
-- Drift score: **20,533** (threshold: 5) → drift watcher will open a tracking issue
-- 11 PRs landed since the published version — none of them have reached users
+CWS listing status:
+- Published: **v1.0.1** (uploaded 2026-03-10)
+- Local: **v3.5.39**
+- Many PRs (#135–#156) have landed since the published version — none have reached users yet
+- `npm run check:cws-drift` intentionally fails until the dashboard is updated
 
 The remaining publish steps cross trust boundaries the automation can't cross
 (your hands on the dashboard, the icon design decision, the public-variable toggle).
@@ -16,36 +17,27 @@ Everything code-side is ready and pre-built.
 
 ## What's already prepared (no further action needed)
 
-- ✅ `manifest.json` v3.5.34 + `package.json` + 11 `src/data/*.json` `_meta.version` all bumped
+- ✅ `manifest.json` v3.5.39 + `package.json` + 11 `src/data/*.json` `_meta.version` all bumped
 - ✅ `CHANGELOG.md` v3.5.34 section written (PR #135, #136, #137, #138, #139, #140, #142, #145 consolidated)
-- ✅ `store-assets/skillbridge-bundled.zip` (2.9 MB, minified) — **this is the CWS upload artifact**
+- ✅ `store-assets/skillbridge-bundled.zip` (minified, **rebuilt at v3.5.39** via `npm run build:bundle:zip`) — **this is the CWS upload artifact**
 - ✅ `store-assets/skillbridge.zip` (636 KB, raw source) — alternative upload if the bundled fails review
 - ✅ All 11 Premium `_locales/*/messages.json` have `extDescription` nominative form
 - ✅ Nominative-use sweep clean (`SkillBridge — AI Course Translator`, no Anthropic-as-product-modifier)
 - ✅ Privacy URL `/privacy` (lowercase) — verified 200 from Googlebot UA
-- ✅ Tests 482/482, ESLint + Prettier clean, all check-* scripts clean
+- ✅ Tests 488/488 + 17 e2e, ESLint + Prettier clean, all check-* scripts clean (incl. `check:academy`)
 - ✅ AI-content gate wired into `manifest.json:content_scripts[].js` (PR #145 hotfix)
 - ✅ CWS-drift watcher will keep this from drifting 3 months again
 - ✅ Italian dictionary live (PR #140) — timed with Anthropic Milan office opening 2026-05-27
 
 ## What needs your hands
 
-### 1. Icon decision
+### 1. Icon — resolved
 
-Status: **unresolved**. v1 icons (the Claude-mark-adjacent design that triggered
-the trademark complaint) are currently on `main` — PR #143's v2 redesign was
-merged then reverted (PR #144) at your request because the visual asset went
-in without your approval.
-
-Options for this release:
-
-| Option | Description | Trade-off |
-|---|---|---|
-| A | Upload v3.5.34 with v1 icon as-is | Trademark complaint may recur on the same icon |
-| B | Design v3 icon yourself (Figma/Canva), drop PNGs into `assets/icons/`, then ship | Slowest. Cleanest. Full control. |
-| C | Ask me for 3 v3 SVG drafts in a separate PR (no auto-merge); pick one | Faster than B, you keep the call. |
-
-If A, skip to step 3. If B/C, finish that step first then return here.
+Status: **resolved**. The non-infringing icon shipped in v3.5.35 (a rising
+half-sun over the SkillBridge bridge — no Claude-mark / radial spark). The
+`assets/icons/icon{16,32,48,128}.png` on `main` are the current set; upload
+`assets/icons/icon128.png` in step 3. Because the icon changed, re-capture the
+screenshots in step 2.
 
 ### 2. Re-capture screenshots (only if you re-designed the icon)
 
diff --git a/store-assets/STORE_LISTING-ja.md b/store-assets/STORE_LISTING-ja.md
index 469430f..a17cc20 100644
--- a/store-assets/STORE_LISTING-ja.md
+++ b/store-assets/STORE_LISTING-ja.md
@@ -75,7 +75,7 @@ Ctrl+Shift+S (チューター切替)、Ctrl+Shift+F (フラッシュカード)
 ━━━━━━━━━━━━━━━━━━━
 
 対応講座
-anthropic.skilljar.com に現在公開されている 17 講座すべて。新しい講座が追加されると 48 時間以内に用語辞書が更新されます（オープンソースのドリフトウォッチャーが新しい slug を検出すると自動的に issue を起票）。コース名は互換性説明のための記述的な参照です:
+anthropic.skilljar.com に現在公開されている 18 講座すべて。新しい講座が追加されると 48 時間以内に用語辞書が更新されます（オープンソースのドリフトウォッチャーが新しい slug を検出すると自動的に issue を起票）。コース名は互換性説明のための記述的な参照です:
 Claude 101 · Claude Code 101 · Claude Code in Action · Introduction to Claude Cowork · Introduction to Agent Skills · Introduction to Subagents · Building with the Claude API · Introduction to MCP · MCP: Advanced Topics · Claude with Amazon Bedrock · Claude with Google Vertex AI · AI Fluency: Framework & Foundations · AI Fluency for Students · AI Fluency for Educators · Teaching AI Fluency · AI Fluency for Nonprofits · AI Capabilities and Limitations
 
 ━━━━━━━━━━━━━━━━━━━
diff --git a/store-assets/STORE_LISTING-ko.md b/store-assets/STORE_LISTING-ko.md
index 351ed9f..a8b80b3 100644
--- a/store-assets/STORE_LISTING-ko.md
+++ b/store-assets/STORE_LISTING-ko.md
@@ -75,7 +75,7 @@ Ctrl+Shift+S (튜터 토글), Ctrl+Shift+F (플래시카드), Ctrl+Shift+L (다
 ━━━━━━━━━━━━━━━━━━━
 
 지원 강의
-anthropic.skilljar.com 에 현재 공개된 17개 강의 전체. 새 강의가 추가되면 48시간 안에 용어 사전을 추가합니다(오픈 소스 드리프트 워처가 새 slug를 발견하면 자동으로 이슈를 엽니다). 강의 이름은 호환성 설명을 위한 서술적 참조입니다:
+anthropic.skilljar.com 에 현재 공개된 18개 강의 전체. 새 강의가 추가되면 48시간 안에 용어 사전을 추가합니다(오픈 소스 드리프트 워처가 새 slug를 발견하면 자동으로 이슈를 엽니다). 강의 이름은 호환성 설명을 위한 서술적 참조입니다:
 Claude 101 · Claude Code 101 · Claude Code in Action · Introduction to Claude Cowork · Introduction to Agent Skills · Introduction to Subagents · Building with the Claude API · Introduction to MCP · MCP: Advanced Topics · Claude with Amazon Bedrock · Claude with Google Vertex AI · AI Fluency: Framework & Foundations · AI Fluency for Students · AI Fluency for Educators · Teaching AI Fluency · AI Fluency for Nonprofits · AI Capabilities and Limitations
 
 ━━━━━━━━━━━━━━━━━━━
diff --git a/store-assets/STORE_LISTING.md b/store-assets/STORE_LISTING.md
index 00954ff..37b0ff5 100644
--- a/store-assets/STORE_LISTING.md
+++ b/store-assets/STORE_LISTING.md
@@ -82,8 +82,8 @@ Full dark theme for the course site. Full right-to-left layout for Arabic and He
 ━━━━━━━━━━━━━━━━━━━
 
 SUPPORTED COURSES
-All 17 currently-published courses on anthropic.skilljar.com, with terminology coverage for any new course added within 48 hours (mechanically enforced by an open-source drift watcher that auto-opens an issue when a new slug appears). Course names referenced descriptively for compatibility:
-Claude 101 · Claude Code 101 · Claude Code in Action · Introduction to Claude Cowork · Introduction to Agent Skills · Introduction to Subagents · Building with the Claude API · Introduction to MCP · MCP: Advanced Topics · Claude with Amazon Bedrock · Claude with Google Vertex AI · AI Fluency: Framework & Foundations · AI Fluency for Students · AI Fluency for Educators · Teaching AI Fluency · AI Fluency for Nonprofits · AI Capabilities and Limitations
+All 18 currently-published courses on anthropic.skilljar.com, with terminology coverage for any new course added within 48 hours (mechanically enforced by an open-source drift watcher that auto-opens an issue when a new slug appears). Course names referenced descriptively for compatibility:
+Claude 101 · Claude Code 101 · Claude Code in Action · Introduction to Claude Cowork · Introduction to Agent Skills · Introduction to Subagents · Building with the Claude API · Introduction to MCP · MCP: Advanced Topics · Claude with Amazon Bedrock · Claude with Google Vertex AI · AI Fluency: Framework & Foundations · AI Fluency for Students · AI Fluency for Educators · Teaching AI Fluency · AI Fluency for Nonprofits · AI Fluency for Small Businesses · AI Capabilities and Limitations
 
 ━━━━━━━━━━━━━━━━━━━
 

From b2d3e3a69ecd4c9dc7ca385d5ea0cd57579fb8cc Mon Sep 17 00:00:00 2001
From: heznpc <heznpc@gmail.com>
Date: Mon, 1 Jun 2026 23:19:15 +0900
Subject: [PATCH 2/2] fix(e2e): trust localhost in the bridge host gate (E2E
 fixture host)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The anthropic-only gate disabled the sidebar/bridge on the E2E fixture
(served from localhost), breaking the tutor/cache specs. Trust localhost/
127.0.0.1 too — the production manifest only matches *.skilljar.com, so the
content script never runs on localhost in a real install (no added surface).
Verified: idb-cache, tutor-chat, chat-history, stream-cancel pass locally.
---
 src/content/content.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/content/content.js b/src/content/content.js
index 584069f..c8e1243 100644
--- a/src/content/content.js
+++ b/src/content/content.js
@@ -527,7 +527,10 @@
       // nonce is readable by any page-world script, so we never expose it on
       // tenants we don't control.
       const _host = (location.hostname || '').replace(/\.$/, '').replace(/^www\./, '');
-      const isTrustedHost = _host === 'anthropic.skilljar.com';
+      // localhost / 127.0.0.1 is the E2E fixture host only — the bundled
+      // manifest matches `*.skilljar.com` exclusively, so the content script
+      // never runs on localhost in a real install (no production attack surface).
+      const isTrustedHost = _host === 'anthropic.skilljar.com' || _host === 'localhost' || _host === '127.0.0.1';
       if (isTrustedHost) {
         window._sb.injectSidebar?.();
         window._sb.injectFloatingButton?.();