plugins/browser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

the extension download is a published file, not an authed route

Browse Source 
The route I added returned 401 to an <a download>, which Chrome reports as "Try to sign in to the
site" — a plain navigation carries no Bearer token, so that advice cannot work. The platform publishes
extension/ to /plugins/browser/extension.zip instead, which is served without auth like plugin icons.

zip.ts moved to the platform: extensions are meant to be a marketplace of them, not this plugin's
private trick.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-08-21 01:36:44 +00:00
co-authored by Claude Opus 5
parent c0e0848e6a
commit c20d03e9f5
4 changed files with 12 additions and 151 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/router.ts
+5 -25
View File
@@ -1,6 +1,4 @@
import { randomUUID } from 'node:crypto';
import { join } from 'node:path';
import { zipDirectory } from './zip';
import { createRouter } from '@@/create-router';
import * as errors from '@@/custom-errors';
import { sendSidecarCommand } from '@@/sidecar-registry';
@@ -46,29 +44,11 @@ async function getOpts(userId: number) {
return { relayPort: RELAY_PORT, userToken: deriveRelayToken(userId, RELAY_PORT, salt) };
}
// ── The extension, zipped from the directory on every request ──
//
// This route existed once, shelling out to `zip`, and was removed as having no caller: the UI linked at
// `/browser-relay-extension.zip`, a static file in public/. That file was then found to be 58 lines
// behind the source it claimed to be — built from something older and never rebuilt.
//
// So it is back, without the host binary (see zip.ts) and with the caller inside this plugin. There is
// no second copy to fall behind, which is the only durable fix for that.
router.get('/extension.zip', async (ctx) => {
const dir = join(import.meta.dir, '..', 'extension');
const bytes = zipDirectory(dir);
// `.buffer` because Bun's BodyInit does not accept a Uint8Array view directly.
return new Response(bytes.buffer as ArrayBuffer, {
headers: {
'content-type': 'application/zip',
'content-disposition': 'attachment; filename="officer-browser-relay.zip"',
// Deterministic bytes for an unchanged directory, so a repeat download is a 304 rather than 50 KB.
etag: `"${Bun.hash(bytes).toString(16)}"`,
'cache-control': 'private, no-cache',
},
});
});
// The extension is NOT served from here. It is published at install time to
// `/plugins/browser/extension.zip`, which is unauthenticated on purpose — an `<a download>` cannot carry
// a Bearer token, and the browser reports the resulting 401 as "Try to sign in to the site", which is
// advice that cannot work. Nothing in an extension is secret; the pairing token is what is secret, and
// that is not in there.
router.get('/status', async (ctx) => {
const user = ctx.get('user');