heznpc · heznpc · Jun 1, 2026 · Jun 1, 2026 · Jun 1, 2026
@@ -16,12 +16,11 @@ name: Academy course catalog drift watcher
 # after the existing issue closes and drift recurs.
 
 on:
-  # TODO(2026-05-21): cron paused — Skilljar page structure changed, scraper
-  # broken since 2026-05-16 (5 days, 8 consecutive fails). Re-enable after
-  # fixing selectors in a dedicated session. Manual dispatch still available.
-  # Original cadence: '15 */12 * * *' (every 12h)
-  # schedule:
-  #   - cron: '15 */12 * * *'
+  # Re-enabled 2026-06-01: the scraper parses the current catalog correctly
+  # again (check-academy-courses.js passes after wiring the new course), so the
+  # 12-hour watch behind POSITIONING.md's "new course -> 48h" SLA is restored.
+  schedule:
+    - cron: '15 */12 * * *'
   workflow_dispatch: # manual trigger from Actions UI
 
 permissions:

@@ -6,6 +6,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [3.5.39] - 2026-06-01
+
+### Security
+- **Page bridge + AI tutor scoped to `anthropic.skilljar.com`.** The Puter postMessage bridge (Gemini verification + Claude tutor) uses a nonce that any page-world script can read, so it must not run on Skilljar tenants we don't control. The bridge and the tutor sidebar now initialize only on the trusted Anthropic host; other AI-detected Skilljar tenants still get the dictionary + Google Translate, just not the bridge.
+
+### Fixed
+- Example-question chips lost their click handlers after opening and closing a sub-panel (History / Flashcards / Bookmarks / Continue) — `closeSubPanel` now re-binds them alongside the chat input.
+
+### Changed
+- Wired `ai-fluency-for-small-businesses` (18th live course) into `FLASHCARD_COURSE_MAP`, clearing the Academy course-drift check, and re-enabled the 12-hour drift cron (the catalog scraper parses correctly again).
+- Store listing updated to 18 courses; `RELEASE_CHECKLIST.md` refreshed for the current state (icon resolved, v3.5.39 artifacts).
+
 ## [3.5.38] - 2026-06-01
 
 ### Fixed — translation rendering & dark-mode polish (from a live debugging pass on anthropic.skilljar.com)

@@ -2,7 +2,7 @@
 
 <img src="assets/icons/icon128.png" alt="SkillBridge" width="90" />
 
-# SkillBridge — AI Course Translator <!-- VERSION_START -->v3.5.38<!-- VERSION_END -->
+# SkillBridge — AI Course Translator <!-- VERSION_START -->v3.5.39<!-- VERSION_END -->
 
 > Available in multiple languages at the [project landing page](https://heznpc.github.io/skillBridge/).
 

@@ -6,7 +6,7 @@
   <title>SkillBridge — AI Course Translator for <!-- LANG_COUNT_START -->32+<!-- LANG_COUNT_END --> Languages</title>
   <meta name="description" content="Free Chrome extension to translate the free AI courses at anthropic.skilljar.com into <!-- LANG_COUNT_START -->32+<!-- LANG_COUNT_END --> languages with an in-page AI tutor. No API keys needed.">
   <meta property="og:title" content="SkillBridge — AI Course Translator">
-  <meta property="og:description" content="Translate the free AI courses at anthropic.skilljar.com into your language. <!-- VERSION_START -->v3.5.38<!-- VERSION_END -->.">
+  <meta property="og:description" content="Translate the free AI courses at anthropic.skilljar.com into your language. <!-- VERSION_START -->v3.5.39<!-- VERSION_END -->.">
   <meta property="og:type" content="website">
   <style>
     * { margin: 0; padding: 0; box-sizing: border-box; }
@@ -255,7 +255,7 @@
 <body>
   <section class="hero">
     <div class="container">
-      <div class="hero-badge"><!-- VERSION_START -->v3.5.38<!-- VERSION_END --> &middot; Open Source &middot; Free &middot; No API Key</div>
+      <div class="hero-badge"><!-- VERSION_START -->v3.5.39<!-- VERSION_END --> &middot; Open Source &middot; Free &middot; No API Key</div>
       <h1>Translate AI Courses<br>Into Your Language</h1>
       <p>A Chrome extension that translates the free AI course pages at anthropic.skilljar.com into <!-- LANG_COUNT_START -->32+<!-- LANG_COUNT_END --> languages with an in-page AI tutor.</p>
       <p style="font-size:13px;opacity:0.85;margin-top:-16px;">Independent community project. Not affiliated with, endorsed by, or sponsored by Anthropic or Skilljar.</p>

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "__MSG_extName__",
   "description": "__MSG_extDescription__",
-  "version": "3.5.38",
+  "version": "3.5.39",
   "minimum_chrome_version": "124",
   "author": "SkillBridge Contributors",
   "homepage_url": "https://github.com/heznpc/skillbridge",

@@ -1,6 +1,6 @@
 {
   "name": "skillbridge",
-  "version": "3.5.38",
+  "version": "3.5.39",
   "private": true,
   "scripts": {
     "test": "jest --verbose",

@@ -521,8 +521,20 @@
 
       window._sb.injectHeaderLanguageSelect?.();
       window._sb.injectDarkModeToggle?.();
-      window._sb.injectSidebar?.();
-      window._sb.injectFloatingButton?.();
+      // The Puter page bridge and AI tutor only run on the trusted Anthropic
+      // host. Other Skilljar tenants (activated via the AI-content gate) still
+      // get dictionary + Google Translate, but not the bridge — its postMessage
+      // nonce is readable by any page-world script, so we never expose it on
+      // tenants we don't control.
+      const _host = (location.hostname || '').replace(/\.$/, '').replace(/^www\./, '');
+      // localhost / 127.0.0.1 is the E2E fixture host only — the bundled
+      // manifest matches `*.skilljar.com` exclusively, so the content script
+      // never runs on localhost in a real install (no production attack surface).
+      const isTrustedHost = _host === 'anthropic.skilljar.com' || _host === 'localhost' || _host === '127.0.0.1';
+      if (isTrustedHost) {
+        window._sb.injectSidebar?.();
+        window._sb.injectFloatingButton?.();
+      }
 
       isReady = true;
 
@@ -566,9 +578,11 @@
         }
       });
 
-      translator.initialize().catch((err) => {
-        console.warn('[SkillBridge] Bridge init failed (AI features unavailable):', err);
-      });
+      if (isTrustedHost) {
+        translator.initialize().catch((err) => {
+          console.warn('[SkillBridge] Bridge init failed (AI features unavailable):', err);
+        });
+      }
 
       if (typeof YouTubeSubtitleManager !== 'undefined') {
         subtitleManager = new YouTubeSubtitleManager(currentLang);

@@ -458,6 +458,10 @@
     _state.bookmarksPanelOpen = false;
     _state.recentPanelOpen = false;
     bindChatInputEvents();
+    // Example-question chips may still be in the restored chat HTML; their
+    // click handlers must be re-bound too (closeSubPanel previously only
+    // re-bound the input).
+    bindExampleQuestions();
   }
 
   // ============================================================

@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "de",
     "langName": "Deutsch",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {

@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "es",
     "langName": "Español",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {

@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "fr",
     "langName": "Français",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {

@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "it",
     "langName": "Italiano",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-05-25",
     "translation_provenance": "v1 — derived from src/data/es.json via Spanish→Italian regex transformation (Romance proximity ~80%). Native Italian PRs welcome to replace any section wholesale; structural keys must remain identical to other premium dictionaries (enforced by scripts/check-dict-coverage.js)."
   },

@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "ja",
     "langName": "日本語",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {

@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "ko",
     "langName": "한국어",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {

@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "pt-BR",
     "langName": "Português (BR)",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {

@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "ru",
     "langName": "Русский",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {

@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "vi",
     "langName": "Tiếng Việt",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {

@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "zh-CN",
     "langName": "简体中文",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {

@@ -2,7 +2,7 @@
   "_meta": {
     "lang": "zh-TW",
     "langName": "中文(繁體)",
-    "version": "3.5.38",
+    "version": "3.5.39",
     "lastUpdated": "2026-04-02"
   },
   "ui": {

@@ -1311,6 +1311,7 @@ const FLASHCARD_COURSE_MAP = {
   'ai-fluency-for-educators': ['aiFluencyEdu'],
   'ai-fluency-for-students': ['aiFluencyStudent'],
   'ai-fluency-for-nonprofits': ['aiFluencyNonprofit'],
+  'ai-fluency-for-small-businesses': ['aiFluency'],
   'teaching-ai-fluency': ['teachingAI'],
   // Other
   'ai-capabilities': ['aiCapabilities'],

@@ -1,51 +1,43 @@
-# Release Checklist — v3.5.34 re-publication
+# Release Checklist — v3.5.39 re-publication
 
-> Refreshed 2026-05-29. The previous revision predated the v2 icon revert (PR #144),
-> the manifest version bump to 3.5.34, and the CWS-drift watcher. This is the source
-> of truth for the next dashboard upload.
+> Refreshed 2026-06-01 for v3.5.39. Since the last revision: the non-infringing
+> icon shipped (v3.5.35), the learning-companion features + Tools menu landed
+> (v3.5.36–3.5.39), and the page bridge / AI tutor was scoped to
+> anthropic.skilljar.com. This is the source of truth for the next dashboard upload.
 
-CWS listing as of 2026-05-29 (verified via `npm run check:cws-drift`):
-- Published: **v1.0.1** (uploaded 2026-03-10, 80 days ago)
-- Local: **v3.5.34**
-- Drift score: **20,533** (threshold: 5) → drift watcher will open a tracking issue
-- 11 PRs landed since the published version — none of them have reached users
+CWS listing status:
+- Published: **v1.0.1** (uploaded 2026-03-10)
+- Local: **v3.5.39**
+- Many PRs (#135–#156) have landed since the published version — none have reached users yet
+- `npm run check:cws-drift` intentionally fails until the dashboard is updated
 
 The remaining publish steps cross trust boundaries the automation can't cross
 (your hands on the dashboard, the icon design decision, the public-variable toggle).
 Everything code-side is ready and pre-built.
 
 ## What's already prepared (no further action needed)
 
-- ✅ `manifest.json` v3.5.34 + `package.json` + 11 `src/data/*.json` `_meta.version` all bumped
+- ✅ `manifest.json` v3.5.39 + `package.json` + 11 `src/data/*.json` `_meta.version` all bumped
 - ✅ `CHANGELOG.md` v3.5.34 section written (PR #135, #136, #137, #138, #139, #140, #142, #145 consolidated)
-- ✅ `store-assets/skillbridge-bundled.zip` (2.9 MB, minified) — **this is the CWS upload artifact**
+- ✅ `store-assets/skillbridge-bundled.zip` (minified, **rebuilt at v3.5.39** via `npm run build:bundle:zip`) — **this is the CWS upload artifact**
 - ✅ `store-assets/skillbridge.zip` (636 KB, raw source) — alternative upload if the bundled fails review
 - ✅ All 11 Premium `_locales/*/messages.json` have `extDescription` nominative form
 - ✅ Nominative-use sweep clean (`SkillBridge — AI Course Translator`, no Anthropic-as-product-modifier)
 - ✅ Privacy URL `/privacy` (lowercase) — verified 200 from Googlebot UA
-- ✅ Tests 482/482, ESLint + Prettier clean, all check-* scripts clean
+- ✅ Tests 488/488 + 17 e2e, ESLint + Prettier clean, all check-* scripts clean (incl. `check:academy`)
 - ✅ AI-content gate wired into `manifest.json:content_scripts[].js` (PR #145 hotfix)
 - ✅ CWS-drift watcher will keep this from drifting 3 months again
 - ✅ Italian dictionary live (PR #140) — timed with Anthropic Milan office opening 2026-05-27
 
 ## What needs your hands
 
-### 1. Icon decision
+### 1. Icon — resolved
 
-Status: **unresolved**. v1 icons (the Claude-mark-adjacent design that triggered
-the trademark complaint) are currently on `main` — PR #143's v2 redesign was
-merged then reverted (PR #144) at your request because the visual asset went
-in without your approval.
-
-Options for this release:
-
-| Option | Description | Trade-off |
-|---|---|---|
-| A | Upload v3.5.34 with v1 icon as-is | Trademark complaint may recur on the same icon |
-| B | Design v3 icon yourself (Figma/Canva), drop PNGs into `assets/icons/`, then ship | Slowest. Cleanest. Full control. |
-| C | Ask me for 3 v3 SVG drafts in a separate PR (no auto-merge); pick one | Faster than B, you keep the call. |
-
-If A, skip to step 3. If B/C, finish that step first then return here.
+Status: **resolved**. The non-infringing icon shipped in v3.5.35 (a rising
+half-sun over the SkillBridge bridge — no Claude-mark / radial spark). The
+`assets/icons/icon{16,32,48,128}.png` on `main` are the current set; upload
+`assets/icons/icon128.png` in step 3. Because the icon changed, re-capture the
+screenshots in step 2.
 
 ### 2. Re-capture screenshots (only if you re-designed the icon)
 

@@ -75,7 +75,7 @@ Ctrl+Shift+S (チューター切替)、Ctrl+Shift+F (フラッシュカード)
 ━━━━━━━━━━━━━━━━━━━
 
 対応講座
-anthropic.skilljar.com に現在公開されている 17 講座すべて。新しい講座が追加されると 48 時間以内に用語辞書が更新されます（オープンソースのドリフトウォッチャーが新しい slug を検出すると自動的に issue を起票）。コース名は互換性説明のための記述的な参照です:
+anthropic.skilljar.com に現在公開されている 18 講座すべて。新しい講座が追加されると 48 時間以内に用語辞書が更新されます（オープンソースのドリフトウォッチャーが新しい slug を検出すると自動的に issue を起票）。コース名は互換性説明のための記述的な参照です:
 Claude 101 · Claude Code 101 · Claude Code in Action · Introduction to Claude Cowork · Introduction to Agent Skills · Introduction to Subagents · Building with the Claude API · Introduction to MCP · MCP: Advanced Topics · Claude with Amazon Bedrock · Claude with Google Vertex AI · AI Fluency: Framework & Foundations · AI Fluency for Students · AI Fluency for Educators · Teaching AI Fluency · AI Fluency for Nonprofits · AI Capabilities and Limitations
 
 ━━━━━━━━━━━━━━━━━━━

@@ -75,7 +75,7 @@ Ctrl+Shift+S (튜터 토글), Ctrl+Shift+F (플래시카드), Ctrl+Shift+L (다
 ━━━━━━━━━━━━━━━━━━━
 
 지원 강의
-anthropic.skilljar.com 에 현재 공개된 17개 강의 전체. 새 강의가 추가되면 48시간 안에 용어 사전을 추가합니다(오픈 소스 드리프트 워처가 새 slug를 발견하면 자동으로 이슈를 엽니다). 강의 이름은 호환성 설명을 위한 서술적 참조입니다:
+anthropic.skilljar.com 에 현재 공개된 18개 강의 전체. 새 강의가 추가되면 48시간 안에 용어 사전을 추가합니다(오픈 소스 드리프트 워처가 새 slug를 발견하면 자동으로 이슈를 엽니다). 강의 이름은 호환성 설명을 위한 서술적 참조입니다:
 Claude 101 · Claude Code 101 · Claude Code in Action · Introduction to Claude Cowork · Introduction to Agent Skills · Introduction to Subagents · Building with the Claude API · Introduction to MCP · MCP: Advanced Topics · Claude with Amazon Bedrock · Claude with Google Vertex AI · AI Fluency: Framework & Foundations · AI Fluency for Students · AI Fluency for Educators · Teaching AI Fluency · AI Fluency for Nonprofits · AI Capabilities and Limitations
 
 ━━━━━━━━━━━━━━━━━━━

@@ -82,8 +82,8 @@ Full dark theme for the course site. Full right-to-left layout for Arabic and He
 ━━━━━━━━━━━━━━━━━━━
 
 SUPPORTED COURSES
-All 17 currently-published courses on anthropic.skilljar.com, with terminology coverage for any new course added within 48 hours (mechanically enforced by an open-source drift watcher that auto-opens an issue when a new slug appears). Course names referenced descriptively for compatibility:
-Claude 101 · Claude Code 101 · Claude Code in Action · Introduction to Claude Cowork · Introduction to Agent Skills · Introduction to Subagents · Building with the Claude API · Introduction to MCP · MCP: Advanced Topics · Claude with Amazon Bedrock · Claude with Google Vertex AI · AI Fluency: Framework & Foundations · AI Fluency for Students · AI Fluency for Educators · Teaching AI Fluency · AI Fluency for Nonprofits · AI Capabilities and Limitations
+All 18 currently-published courses on anthropic.skilljar.com, with terminology coverage for any new course added within 48 hours (mechanically enforced by an open-source drift watcher that auto-opens an issue when a new slug appears). Course names referenced descriptively for compatibility:
+Claude 101 · Claude Code 101 · Claude Code in Action · Introduction to Claude Cowork · Introduction to Agent Skills · Introduction to Subagents · Building with the Claude API · Introduction to MCP · MCP: Advanced Topics · Claude with Amazon Bedrock · Claude with Google Vertex AI · AI Fluency: Framework & Foundations · AI Fluency for Students · AI Fluency for Educators · Teaching AI Fluency · AI Fluency for Nonprofits · AI Fluency for Small Businesses · AI Capabilities and Limitations
 
 ━━━━━━━━━━━━━━━━━━━