From 815857b56d807b163d95b7179e608204dead849e Mon Sep 17 00:00:00 2001 From: heznpc Date: Mon, 11 May 2026 00:32:18 +0900 Subject: [PATCH] =?UTF-8?q?fix:=20v3.5.12=20=E2=80=94=20background.js=20cl?= =?UTF-8?q?eanup=20(dead=20code,=20retry=20consistency,=20manifest)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Deep audit of the service worker found 4 real fixes after triaging 13 raw findings (the agent's rate-limiter persistence concerns relied on incorrect assumptions about per-tab SW spawning and JS concurrency — a single SW is shared across all tabs of an extension and check() is atomic in single-threaded JS). #1 Dead chrome.storage.local self-healing path removed `_BG_YT_CLIENT_VERSION_DEFAULT` was a `let` hydrated from chrome.storage.local on every SW wake, but a grep across src/ shows nothing ever WRITES that key. The "refreshed by maintenance alarm" comment was aspirational — the alarm only sends version- check against GitHub. The runtime override never triggered. Replaced let + hydration block with a plain const + the actual manual-bump workflow note (synced via check-bg-sync.js). Also eliminates the fire-and-forget storage race that fired on every SW spin-up. #2 FETCH_URL routes through fetchWithRetry Was using raw fetch with no 4xx-no-retry contract. A transient YouTube/InnerTube 5xx propagated straight to the content script while GOOGLE_TRANSLATE_BATCH had retries — the same inconsistency the v3.5.8 fix was supposed to eliminate. #3 handleVersionCheck routes through fetchWithRetry Anonymous GitHub API quota is 60/h per IP; with users converging on residential ranges, 403s are common. Previously a single attempt silently dropped them. fetchWithRetry's 4xx fail-fast still avoids pointless retries on 403/404. #4 api.github.com added to manifest host_permissions SW fetch to undeclared origins works in MV3 but CWS reviewers flag it. Explicit declaration matches what the code does. Also: scripts/check-bg-sync.js updated to match the renamed constant (was looking for _BG_YT_CLIENT_VERSION_DEFAULT). Findings deliberately skipped, with reasons: - Rate-limiter persistence across SW termination (agent: "two tabs spawn fresh SWs, doubling rate"). False — one SW per extension, shared across all tabs. - Parallel acquire() polling races (agent: "many may pass check() in same microtask"). False — JS is single-threaded; check() is synchronous and atomic. - Sender-tab.url validation. host_permissions already constrains content_script injection to skilljar.com. - Origin/Referer header spoofing on InnerTube. Required for the endpoint to work at all; documented. 336/336 tests pass. Lint, format, selectors, dicts, sync, glossary, validate, build:firefox, build:bundle all green. Co-Authored-By: Claude Opus 4.7 (1M context) --- CHANGELOG.md | 10 ++++++ README.md | 2 +- docs/index.html | 4 +-- manifest.json | 5 +-- package.json | 2 +- scripts/check-bg-sync.js | 12 +++---- src/background/background.js | 61 +++++++++--------------------------- src/data/de.json | 2 +- src/data/es.json | 2 +- src/data/fr.json | 2 +- src/data/ja.json | 2 +- src/data/ko.json | 2 +- src/data/pt-BR.json | 2 +- src/data/ru.json | 2 +- src/data/vi.json | 2 +- src/data/zh-CN.json | 2 +- src/data/zh-TW.json | 2 +- 17 files changed, 47 insertions(+), 69 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1872eb0..cc077ca 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +## [3.5.12] - 2026-05-11 + +### Fixed +- Background SW removed a dead chrome.storage.local self-healing path for the YouTube InnerTube client version. The hydration block read `sb_yt_client_version` on every SW wake but **no code anywhere ever wrote that key** — the comment claimed the maintenance alarm refreshed it, but the alarm only sends `version-check` against GitHub. The runtime override never triggered; `_BG_YT_CLIENT_VERSION` was effectively a const all along. Replaced the let + hydration block with a plain const + comment explaining the manual-bump workflow (in sync with `src/lib/constants.js` + `src/shared/constants.json` via `check-bg-sync.js`). Also removes the fire-and-forget storage race on every SW wake. +- `FETCH_URL` proxy handler now routes through `fetchWithRetry` instead of raw `fetch`. Previously a transient YouTube/InnerTube 5xx propagated straight to the content script while `GOOGLE_TRANSLATE_BATCH` got the retry contract — inconsistency the v3.5.8 fix was supposed to eliminate. +- `handleVersionCheck` (GitHub API call) likewise routes through `fetchWithRetry`. Anonymous GitHub quota is 60/h per IP; with users converging on residential ranges, 403s are common, and the previous code silently dropped them with a single attempt. The 4xx fail-fast contract still prevents pointless retries on 403/404. + +### Changed +- Added `https://api.github.com/*` to `host_permissions` in `manifest.json`. SW `fetch` to undeclared origins works in MV3 but CWS reviewers flag undeclared hostnames; explicit declaration matches what the code actually does. + ## [3.5.11] - 2026-05-07 ### Security / Hardening diff --git a/README.md b/README.md index 0758474..21fa2cb 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ SkillBridge -# SkillBridge for Anthropic Academy v3.5.11 +# SkillBridge for Anthropic Academy v3.5.12 > Available in multiple languages at the [project landing page](https://heznpc.github.io/skillBridge/). diff --git a/docs/index.html b/docs/index.html index e72f06b..5f82dea 100644 --- a/docs/index.html +++ b/docs/index.html @@ -6,7 +6,7 @@ SkillBridge — AI Course Translator for <!-- LANG_COUNT_START -->32+<!-- LANG_COUNT_END --> Languages - +