Repository navigation
Release v0.10.0: extension updates, releases page, and consent improvements - #91
Closed
Bryan Fawcett (bryanfawcett) wants to merge 20 commits into
Closed
Bryan Fawcett (bryanfawcett) wants to merge 20 commits into
Bryan Fawcett (bryanfawcett) wants to merge 20 commits into
Conversation
Every merge into `staging` (the live beta) is released as the next patch under the org versioning policy (nyuchi/.github#80), through the pinned reusable-staging-release.yml. The build workflow now also runs on pushes to `staging`, so the beta branch carries the same checks as master. Claude-Session: https://claude.ai/code/session_017T4NxM5wbhJ3LjHt7bnuwr Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* chore: the default branch is main The default branch was renamed from master to main on 2026-10-04. Point the build trigger and the README at it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017T4NxM5wbhJ3LjHt7bnuwr * ci: build on pushes to main Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017T4NxM5wbhJ3LjHt7bnuwr --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…claim matches its code (#66) * docs(legal): every claim about the extension matches its code, for 0.8.2 and 0.8.4 Checked against the extension at 75876d4 (docs/toddle-data-fields.md, the security reviews, SECURITY.md, licence.js, background.js and the code). - Flags: from 0.8.4 they are shown as Toddle shows them and the free switch hides them everywhere; before 0.8.4 they were hidden by default. Unless flags are hidden, the sidebar asks Toddle for them each time it opens. - Memory: answers stay in the tab until it is closed or reloaded, reused for at most 5 minutes (2 for a student's day); never written to storage. - Storage: licenceCheck and licenceViewer in the extension's storage, and the four values on Toddle's site, each described. Drops a "message button style" value the code does not have. - Switches: adds gradebook tools and the Attendance dashboard's details. - Licence keys may, not must, name who they are for. - Reads: gradebook, home page, profile page and Attendance dashboard, plus the sign-in headers and academic year noted from Toddle's own requests. - What leaves the device, listed exactly, student photos included. - Security page: the review of 6 October 2026 (findings 13 to 16) and what code inside Toddle's page cannot promise; says which versions it covers. - Version facts in one place (extensionVersions); dated 6 October 2026. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq * docs(legal): privacy rests on Zimbabwe's Act and the GDPR; fix missing spaces - The privacy policy names the two laws Nyuchi holds itself to: Zimbabwe's Cyber and Data Protection Act [Chapter 12:07], and the EU and UK GDPR, applied to everyone. "The law we follow" names POTRAZ, says where data goes and how transfers out of the EU and UK are covered. The rights section lists each right, the one-month answer and where to complain (POTRAZ, the ICO, or an EU authority). Each legal basis carries its GDPR article. - Breaches go to POTRAZ within 24 hours (Zimbabwe's Act), and to an EU or UK regulator within 72 where the GDPR requires it (privacy and data pages). - Student privacy names both laws. Singapore's PDPA is no longer named, in the pages or the consent notes. The facts live once, in `dataProtection`. - compressHTML off: Astro's compression dropped the space where a line break sat next to an inline tag ("Applies to<strong>…"), about 90 times across the legal and product pages. Now none; CSP hashes unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq --------- Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
…oncealed, not hidden (#67) * docs: the extension page and legal pages describe 0.9.0, with flags concealed, not hidden The pages described 0.8.4 as the next release and said the flag switch hides flags. Patches are now test releases that do not go to the Chrome Web Store, so the next release teachers get is 0.9.0, and from it the extension no longer hides Toddle's own flags: a teacher can conceal them for a shared screen. - Flags, said once in `flags` (src/data/legal.ts): "conceal" and "flag visibility", never "hide"; "Show flags" in the sidebar for one student; concealing is a screen, not a lock. A test fails on "hide flags". - The rebuild in closed shadow roots, the student sidebar's timetable, email and admin-portal changes, a class's teachers by email, and My classes switching at once. - For schools: the rollout steps and the organisation key on the extension page, a help centre link, and the data schema, described and on request. - Data handling: the licence server keeps a hash of each key, not the key. - The Zimbabwe CDPA and GDPR framing is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq * fix: sitemap lastmod is an ISO string, and source-map-js 1.2.2 for GHSA-68fv-2mgg-jv7q - astro.config.mjs: the sitemap's serialize hook set `lastmod` to a Date, but a sitemap item's `lastmod` is a string (TS2322 in `npm run lint`). It is now `new Date().toISOString()`; the sitemap output is the same ISO 8601 timestamp. - package-lock.json: source-map-js 1.2.1 → 1.2.2, the patched release for GHSA-68fv-2mgg-jv7q (high), which failed "Audit what ships". Every dependent's range already allows 1.2.2, so it is `npm update source-map-js`, run with the repo's npm (11.12.1); no override needed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq * docs: the newest patch is 0.8.9 Extension PR #38 (My classes switches at once; docs/data-schema.md) merged into staging and shipped in the v0.8.9 patch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq --------- Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
…s it (#68) * feat: a public Releases page for the extension; the terms say who owns it Releases need a public home: the extension's repository is private and its GitHub releases are internal test builds. - /toddle-enhancement-extension/releases: each version's notes in plain words for teachers, newest first, from the extension's changelog. 0.9.0 is coming soon to the Chrome Web Store; 0.8.2, 0.8.1, 0.8.0, 0.7.x and the early builds follow, condensed; 0.8.3 to 0.8.13, test builds for pilot schools, are one line. Every version has the anchor #v<version> for the extension's menu. No downloads, no GitHub links. Data in src/data/releases.ts. Linked from the extension page, the footer and llms.txt; in the sitemap. - Terms: the extension and its code belong to Nyuchi Web Services, all rights reserved, not open source; a licence grants use, not ownership; no copying, modifying, reusing or redistributing its code in another product or service without written permission. Reading the code stays welcome; building a competing product stays forbidden. Said once in `ownership`. - Flags facts as 0.9.0 ships them (grey, no colour; 0.8.2 updaters concealed); the newest test build is 0.8.13. - Tests: the releases page's anchors, no downloads or GitHub links, and the organisation price is US$149.99 everywhere. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq * @bundu/ui 0.5.0; the site's code is proprietary Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq --------- Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
The legal pages, the extension page, llms.txt and SECURITY.md name the new host for the daily check for cancelled keys, and say that earlier versions ask licences.nyuchi.dev, the same server, which still answers (nyuchi/nyuchi-licence-server#24). The legal pages' date is 7 October. Claude-Session: https://claude.ai/code/session_017T4NxM5wbhJ3LjHt7bnuwr Signed-off-by: Bryan Fawcett <bryan@nyuchi.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* docs: one account of 0.9.0 across the site (review of the release) - The extension page and the Security page say the gradebook's toolbar and the Attendance dashboard's details run in closed shadow roots from 0.9.0, as the releases page and the extension's code (rebuild steps 5 and 7) do; they no longer say these are still moving. - The second review's fixes are in 0.8.4, a test build, and reach schools in 0.9.0, not '0.8.4 before it is published'. - Concealing flags: a new install starts with flags shown; updating from 0.8.2 keeps them concealed. Not 'off until you switch it on'. - llms.txt: the sidebar asks for a student's active flags each time it opens, as legal.ts says. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq Signed-off-by: Bryan Fawcett <bryan@nyuchi.com> * docs: re-review fixes: 0.9.0 is still to come; llms.txt matches the pages Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq Signed-off-by: Bryan Fawcett <bryan@nyuchi.com> * docs: re-review fixes: the 0.8.4 fixes reach schools in 0.9.0; every reviewed rebuild step named; llms.txt flags say what 0.8.2 does Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq * docs: the extension page's flags paragraph says from which version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq --------- Signed-off-by: Bryan Fawcett <bryan@nyuchi.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…that follows your Chrome account, and the upgrade (#72) * wip * wip2 * docs: an older unpacked copy's licence is entered once more Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* ci: a release to main is tagged as the next minor The repo tagged staging merges as patches (staging-version.yml) but had nothing on main, so a release to main produced no tag. This calls the org's reusable auto-tag on main with the version computed from the tags (channel main: the next minor), the RELEASE_BUMP_TOKEN, and a GitHub release. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq * ci: the main version workflow runs only on main Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…ate, the changelog cut to 0.1.0 (#75) * docs: release review fixes: the licence host per version, one legal date, the changelog cut to 0.1.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq * docs: the README's version is the latest tag Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq * docs: the changelog's licence-host entry names the versions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq * docs: the staging patch tags start at v0.0.1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…laims, fixed review history (#76) * docs: second release review fixes: what 0.9.0 reads, versioned flag claims, fixed review history Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq * docs: the flags summary keeps its full stop Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq * style: no blank line in flags Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* docs: the extension's 0.9.0 is on the Chrome Web Store 0.9.0 was approved and published on 7 October 2026. The Releases page marks it "On the Chrome Web Store", dated 7 October 2026. extensionVersions.current is 0.9.0, with no `next` until another minor waits for the store; `previous` (0.8.2) names the release before it where updating from it still matters. The "0.8.2, on the store today" wording and every "from version 0.9.0" are gone from the product page, the legal pages, llms.txt and SECURITY.md; what helps a teacher updating from 0.8.2 stays, as history. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq * docs: review fixes: 0.9.0 reached schools, versions before 0.9.0, grammar Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
What teachers get in 0.10.0: more of a flag's formatting in the sidebar, the fix for a flag line that could freeze Toddle, and licences on internationalised school domains. 0.9.1 to 0.9.5 (test builds) anchor to it. The releases test now checks each version's part of the page. Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
scripts/clean.mjs (the same script as the extension's and the licence server's) removes the build output, the QA report, the tools' caches, finished Claude Code worktrees and local branches already in main or staging, touching only what Git ignores. It runs after a git pull that merges (.githooks/post-merge, turned on by npm ci through a new prepare script) and after Claude Code merges a pull request (.claude/settings.json, PostToolUse), and as npm run clean. Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
#87) * fix: load Google Analytics only after consent Google's tag is no longer requested behind Consent Mode set to denied. Analytics.astro queues the denied defaults and holds the only loader, which runs on a stored yes from the current banner version or when the banner records one. Older versions, the legacy key and malformed records count as no answer, in the banner and the support widget alike. The privacy and cookie policies now say Google Analytics contacts Google only after you agree. Tests run the built script against each case; the consent probe fails on any Google Analytics request before consent. Closes #83 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq * fix: anchors for the extension's test builds 0.9.6 to 0.9.8 The extension has tagged v0.9.6, v0.9.7 and v0.9.8 since the 0.10.0 entry was written, and their menus link to anchors the Releases page did not have. They join 0.9.1 to 0.9.5 under 0.10.0, which stays "coming". taggedTestBuilds lists every tagged test build, and a test fails the build if one has no anchor or more than one. Part of #85 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq * ci: least-privilege permissions, pinned actions, no persisted credentials Workflows grant nothing at the top level and each job asks for its own permissions: contents read for build and audit, write only for tagging. The build workflow's checkouts no longer persist the token, since nothing there pushes. actions/checkout and actions/setup-node are pinned to full commit SHAs with the version in a comment, and Dependabot now keeps the github-actions pins current. The nyuchi/.github reusable workflows were already pinned to a commit. Closes #84 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq * chore: bring the docs up to date, drop react, keep the formatters agreed README, CONTRIBUTING and docs/toolchain.md now describe the Astro site's pages, the staging to main release flow, Vite+ as adopted, the inline scripts the CSP hashes and the current audit; the dead Lint badge, the vitest pin, master and "two pages" are gone. react and react-dom are removed: nothing imports them and @bundu/ui declares no peers. Prettier and vp fmt both stay, since a required org gate runs each, and a test fails if their settings differ. Closes #86 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq * fix(deps): take the patched http-cache-semantics; hold postcss-selector-parser at 7.1.6+ npm audit fix brings http-cache-semantics past GHSA-ch52-4w7c-c8xp, so its dated exception in scripts/audit.mjs goes. @tailwindcss/typography pins postcss-selector-parser 6.0.10 (GHSA-rj75-hqrm-r3gf, moderate); an npm overrides entry takes 7.1.6, and the built CSS is byte-for-byte unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq --------- Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
The Releases page shows 0.10.0 as on the store since 13 October 2026, and the test builds 0.9.9 and 0.9.10 open its notes. Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
The checkout note on the extension page said the licence key is emailed. The licence server now emails a one-time claim link instead (72 hours, single use): the note says so, how to use it, how to get a new one, and how a school licence differs. tests/purchase.test.ts holds it to that. Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+20
to
+22
| return page | ||
| .slice(at, page.indexOf("</p>", at)) | ||
| .replace(/<[^>]+>/g, "") |
Mukoko Lingo, a partner app developed by Nyuchi Learning as part of Mukoko, gets its own page at /mukoko-lingo, a product card on the home page beside the Toddle Enhancement Extension, a header link, and a place in the footer's Products column. JSON-LD, Open Graph, sitemap and llms.txt match. Every claim is from Lingo's public repository; the old home-page copy (French, Portuguese, "free for personal use") is gone. Releases: 0.11.0 is on the Chrome Web Store and current; anchors for the 0.10.x and 0.11.x test builds; 0.12.0 is not listed. extensionVersions gains changedIn (0.9.0) so "versions before" wording stays true. Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
…koko by Nyuchi; Swahili in beta (#93) Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
The licence server still emails the key; claim links ship with extension 0.12.0. Production should describe what buyers get today. Restore #89 when 0.12.0 and the server's claim links go live. Claude-Session: https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
Merged
Member
Author
|
Closing in favour of #95, which releases Generated by Claude Code |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This release brings the Toddle Enhancement Extension v0.10.0 to the Chrome Web Store and adds comprehensive release notes infrastructure.
Summary
Updates the learning.nyuchi.com site to reflect the v0.10.0 release of the Toddle Enhancement Extension (published 13 October 2026), adds a new Releases page documenting all extension versions, improves consent handling for Google Analytics, and refactors legal/security documentation to reflect two adversarial reviews and updated extension capabilities.
Key Changes
Extension Release & Documentation
src/data/releases.tswith complete release notes for all extension versions (v0.10.0 newest, with test builds 0.8.3–0.8.13 and 0.9.1–0.9.10)/toddle-enhancement-extension/releasespage to display release notes with version anchors for toolbar menu linkingConsent & Analytics
tests/consent.test.tsto verify Analytics loads only after consent in the built outputAnalytics.astroto queue loader function that runs only when stored consent exists and matches current banner versionSecurity & Legal Updates
dataProtectionexport documenting Zimbabwe's CDPA and EU/UK GDPR standards applied uniformlyInfrastructure & Maintenance
scripts/clean.mjsto remove build artifacts, caches, finished worktrees, and merged local branchesscripts/install-hooks.mjsto enable.githooks/post-mergefor automatic cleanup after pulls.githooks/post-mergehook to run cleanup after merging pulls.claude/settings.jsonhook to run cleanup after Claude Code merges PRs.github/workflows/main-version.yml,staging-version.yml) for semantic versioning on main/staging branchesLICENSEfile (UNLICENSED).github/dependabot.ymlfor action pinningTesting & Quality
tests/purchase.test.tsto verify checkout messaging promises claim links, not keystests/toolchain.test.tsto verify Prettier and vp fmt settings agreetests/seo.test.tsto verify all tagged test builds have release anchorstests/consent.test.tsandtests/security.test.tsfor new consent modelDocumentation & Configuration
CHANGELOG.mdwith detailed release notes for v0.10.0 and infrastructure changesREADME.mdto reflect staging/main branch workflow and git tag versioningCONTRIBUTING.mdwith new data locations and cleanup proceduresdocs/toolchain.mdto remove Vite+ evaluation (no longer relevant)mainandstagingbranchesvercel.jsonCSP headers for new analytics loading modelContent Updates
public/llms.txtto reflect flag concealment (not hiding) and new extension behaviorNotable Implementation Details
src/data/releases.tswith structured `https://claude.ai/code/session_01CoDNYz27iJ7o8PPztCzTpq