[savvides]

Fixes

• Extension stores the Gemini API key in chrome.storage.sync #177: extension/shared/storage.js saves the API key in chrome.storage.local. getSettings moves an older key from sync to local once, then removes it from sync. Local wins if both exist. PRIVACY.md updated. The storage permission covers both areas.
• Extension still reads New Quizzes pages that show student data #191 (partial): studentRecordUrl now also blocks /courses/:id/assignments/:id/{moderation,reporting,moderate,anonymous_submissions}. Source: canvas-lms config/routes.rb (assignments scope: get "moderation(/*path)", get "reporting(/*path)", get "moderate", anonymous_submissions/:anonymous_id), plus Instructure guides saying the New Quizzes Moderate page shows each student's results and Reports include a Student Analysis report. Not verified on a live Canvas site.
• Extension version 1.2.6.

Not covered (so no Closes #191)

Other New Quizzes routes in routes.rb: taking, observing, exports, build, settings, errors, banks. I could not confirm from a source what they show, so I did not block them (build is allowed in the tests as course material). Quiz LTI hosts and /external_tools/... paths are not verified either.

Tests

• test-storage.mjs: key to local not sync, migration, local wins, no key returns ''.
• test-extractor.mjs: blocked and allowed URL cases.
• Mutation cases 66a, 66b, 66c GUARDED (run from a frozen copy with the 31d anchor); case 31d anchor updated.
• test-extension, smoke (655/655), integration (58/58), setup 10/10, status 32/32, manifest-merge 44/44, zsh 161/161, report-section OK, doc-accuracy OK.
• Not run: the full mutation suite. The hand-kept counts in CLAUDE.md were not updated (they are already stale versus a real run; other PRs edit the same lines).

Closes #177

🤖 Generated with Claude Code