extension-id.ts
25 lines · browse/src/extension-id.ts at 3f79d81
1/**
2 * The one extension origin allowed to reach browse's local control surfaces:
3 * POST /extension-token on the server and the terminal agent's /ws.
4 *
5 * GSTACK_EXTENSION_ID is derived from the "key" field in
6 * extension/manifest.json (first 16 bytes of SHA-256 of the DER public key,
7 * hex nibbles mapped 0-9a-f → a-p). Reproduce with:
8 * bun browse/scripts/extension-id.ts
9 * If the manifest keypair is ever rotated, update this constant in the same
10 * commit.
11 *
12 * Forks and self-built extensions override it with
13 * `gstack-config set browse_extension_id <id>`. There is deliberately no
14 * environment override: a project's .env must never be able to widen it.
15 */
16import { readGstackConfigYamlKey } from './config';
18export const GSTACK_EXTENSION_ID = 'dgbkdbjebeiblbajiilljmhjdpmiglep';
20/** `chrome-extension://<id>` for the pinned or configured extension. */
21export function allowedExtensionOrigin(): string {
22 const configured = readGstackConfigYamlKey('browse_extension_id');
23 const id = configured && /^[a-p]{32}$/.test(configured) ? configured : GSTACK_EXTENSION_ID;
24 return `chrome-extension://${id}`;
25}