@rogatio/cli 6.7.0 → 6.7.1

package/README.md

@@ -41,7 +41,7 @@ rogatio <command> [options]
 | `rogatio import requestly <export.json>` | Migrate a Requestly export into `.rogatio.json`. `--out <path>` chooses the file (default `.rogatio.json`); `--merge` appends onto an existing project; `--json` prints the report. |
 | `rogatio test [path] [url...]` | Run offline dry-run tests against `.rogatio.json`. |
 | `rogatio ai <setup\|ls\|show\|delete\|test>` | AI provider configuration. `setup` interactive; `ls` list; `show` redacted; `delete` remove; `test` connection. |
-| `rogatio runtime <install\|uninstall\|verify>` | Register the native-messaging host with `install --extension-id <id>` and trust the device-local CA in one **transactional** call; it needs elevated privileges (Linux `sudo`, macOS keychain authorization, Windows Administrator) and rolls back with exit `1` and `trust unsupported: <reasons>` when a capability or elevation is missing. `uninstall` removes the host manifest, the device-local CA files, and the CA trust installation (idempotent). `verify` reports whether manifest, `runtime-host` wrapper, allowed origins, and CA trust are all valid. |
+| `rogatio runtime <install\|uninstall\|verify>` | Register the native-messaging host with `install` and trust the device-local CA in one **transactional** call; it needs elevated privileges (Linux `sudo`, macOS keychain authorization, Windows Administrator) and rolls back with exit `1` and `trust unsupported: <reasons>` when a capability or elevation is missing. Release users never pass `--extension-id`. That flag is only for development (a local unpacked build without the release key) and for forks. `uninstall` removes the host manifest, the device-local CA files, and the CA trust installation (idempotent). `verify` reports whether manifest, `runtime-host` wrapper, allowed origins, and CA trust are all valid, and fails when `allowed_origins` omits the release ID. Release users never pass `--extension-id` on verify either. |
 | `rogatio runtime host [path]` | Run the consolidated native-messaging host for the project (pair/authorize/body transforms over stdio). Normally launched by the browser; run manually only for debugging. `--root <dir>` overrides the confined file root; `--mock-port <n>` binds the loopback mock-response faucet. |
 
 Global options: `--help, -h` and `--version, -v`. Run `rogatio <command> --help`
@@ -73,8 +73,10 @@ rogatio runtime host .rogatio.json
 ## Local runtime
 
 ```sh
-# Register the native-messaging host and trust the device-local CA (needs elevation)
-rogatio runtime install --extension-id <id>
+# Register the native-messaging host and trust the device-local CA (needs elevation).
+# Release users never pass --extension-id. It is only for development
+# (a local unpacked build without the release key) and for forks.
+rogatio runtime install
 
 # Check manifest, runtime-host wrapper, allowed origins, and CA trust
 rogatio runtime verify

package/dist/node/index.js

@@ -2079,11 +2079,11 @@ import { Worker } from "node:worker_threads";
 import { lookup as dnsLookup } from "node:dns/promises";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash as createHash2, randomBytes, timingSafeEqual } from "node:crypto";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { readFile as readFile2, realpath as realpath2, stat } from "node:fs/promises";
 import { isAbsolute as isAbsolute2, relative as relative2, resolve, sep } from "node:path";
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { mkdir as mkdir2, readFile as readFile3, rename, rm, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
 import { basename, dirname as dirname2, isAbsolute as isAbsolute3, join as join2, relative as relative3 } from "node:path";
 import { generateKeyPairSync, webcrypto } from "node:crypto";
@@ -22056,6 +22056,27 @@ function parseEnvelope(json) {
   };
   return envelope;
 }
+var RELEASE_EXTENSION_ID = "dkngkciiiabbdjcopbipkpndfmpbmjom";
+var EXTENSION_ID_RE = /^[a-p]{32}$/;
+function extensionOrigin(extensionId) {
+  return `chrome-extension://${extensionId}/`;
+}
+function extensionOriginListed(extensionId, allowedOrigins) {
+  if (!EXTENSION_ID_RE.test(extensionId)) return false;
+  const origin = extensionOrigin(extensionId);
+  const bare = origin.slice(0, -1);
+  return allowedOrigins.some((value) => value === origin || value === bare);
+}
+function describeExtensionIdMismatch(expectedExtensionId, allowedOrigins) {
+  const allowed = allowedOrigins.length > 0 ? allowedOrigins.join(", ") : "(none)";
+  const command = expectedExtensionId === RELEASE_EXTENSION_ID ? "rogatio runtime install" : `rogatio runtime install --extension-id ${expectedExtensionId}`;
+  return [
+    `Extension ID ${expectedExtensionId} is not in the host manifest allowed_origins.`,
+    `The host manifest allows: ${allowed}.`,
+    "Chrome refuses the connection until allowed_origins includes this ID (Access to the specified native messaging host is forbidden).",
+    `Run: ${command}`
+  ].join("\n");
+}
 function supportedContentType(value) {
   if (value === void 0) return false;
   const mediaType = value.split(";", 1)[0]?.trim().toLowerCase() ?? "";
@@ -23439,7 +23460,7 @@ function createCapabilityState(preset, now) {
   };
 }
 function digestToken(value) {
-  return createHash("sha256").update(value, "utf8").digest();
+  return createHash2("sha256").update(value, "utf8").digest();
 }
 function isToken(value) {
   if (typeof value !== "string" || value.length !== TOKEN_LENGTH) return false;
@@ -23657,7 +23678,7 @@ function canonicalPresetBytes(preset, grants = preset.grants) {
   return new TextEncoder().encode(canonical);
 }
 function digestBytes(bytes) {
-  return formatSha256(createHash2("sha256").update(bytes).digest("hex"));
+  return formatSha256(createHash3("sha256").update(bytes).digest("hex"));
 }
 var ID_PATTERN2 = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 function exactKeys(value, required) {
@@ -24942,17 +24963,16 @@ function createRequestBodyTrustController(options = {}) {
     let manifestValid = false;
     let binaryExists = false;
     let binaryExecutable = false;
-    let allowedOriginsCount = 0;
+    let allowedOrigins = [];
     try {
       const raw = await readFile3(manifestPath(), "utf8");
       manifestExists = true;
       const parsed = JSON.parse(raw);
       if (isWellFormedManifest(parsed)) {
         manifestValid = true;
-        const manifest = parsed;
-        allowedOriginsCount = manifest.allowed_origins.length;
+        allowedOrigins = [...parsed.allowed_origins];
         try {
-          const fileStat = await stat2(manifest.path);
+          const fileStat = await stat2(parsed.path);
           binaryExists = fileStat.isFile();
           binaryExecutable = (fileStat.mode & 73) !== 0;
           if (!binaryExists) reasons.push("binary-not-found");
@@ -24961,7 +24981,7 @@ function createRequestBodyTrustController(options = {}) {
           binaryExists = false;
           reasons.push("binary-not-found");
         }
-        if (allowedOriginsCount === 0) reasons.push("no-allowed-origins");
+        if (allowedOrigins.length === 0) reasons.push("no-allowed-origins");
       } else {
         reasons.push("manifest-invalid");
       }
@@ -24970,7 +24990,7 @@ function createRequestBodyTrustController(options = {}) {
     }
     const caTrusted = await existsFile(caKeyFile) && await existsFile(caCertFile);
     if (!caTrusted) reasons.push("ca-not-trusted");
-    const ok = manifestExists && manifestValid && binaryExists && binaryExecutable && caTrusted && allowedOriginsCount > 0;
+    const ok = manifestExists && manifestValid && binaryExists && binaryExecutable && caTrusted && allowedOrigins.length > 0;
     return {
       ok,
       manifestExists,
@@ -24978,7 +24998,8 @@ function createRequestBodyTrustController(options = {}) {
       binaryExists,
       binaryExecutable,
       caTrusted,
-      allowedOriginsCount,
+      allowedOriginsCount: allowedOrigins.length,
+      allowedOrigins,
       reasons
     };
   }
@@ -25736,23 +25757,31 @@ Native messaging runtime control for response-body and request-body rules.
 
 Commands:
   install   Install the native-messaging host manifest and (on capable
-            platforms) provision the device-local CA (requires --extension-id).
+            platforms) provision the device-local CA. Uses the pinned release
+            extension ID. Release users never pass --extension-id. That flag is
+            only for development (a local unpacked build without the release
+            key) and for forks.
             CA trust requires root/admin privileges (Linux: sudo, macOS: keychain
             password, Windows: Administrator). Transactional: when CA trust is
             unavailable the manifest is rolled back and the command exits 1.
   uninstall Remove the native-messaging host manifest and device-local CA trust
             (idempotent).
   verify    Check that the manifest, runtime-host wrapper, allowed origins, and
-            device-local CA trust are all present and valid.
+            device-local CA trust are all present and valid. Fails when
+            allowed_origins does not include the release ID. Release users
+            never pass --extension-id. That flag is only for development (a
+            local unpacked build without the release key) and for forks.
   host [path]  Run the native-messaging runtime host. The browser launches this
                process via the native-messaging manifest to handle rule matching.
 
 The lifecycle of the runtime (start/stop) is driven from the extension's
-Start/Stop controls, not the CLI. Run 'rogatio runtime install --extension-id
-<id>' once to register the host, then use the extension.
+Start/Stop controls, not the CLI. Run 'rogatio runtime install' once to
+register the host for a release build, then use the extension.
 
 Options:
-  --extension-id  Extension ID for native messaging manifest (required for install)
+  --extension-id  Extension ID for the native messaging manifest. Release users
+                  never need this. It is only for development (a local unpacked
+                  build without the release key) and for forks.
   --root <dir>    Root for confined runtime file access (host only; default: project directory)
   --mock-port <n> Bind the loopback mock-response faucet to this port (host only, 1-65535)
   --help, -h      Show this help
@@ -29961,30 +29990,42 @@ function reportTrust(subcommand, result, okMessage) {
   );
   return 1;
 }
+function parseExtensionIdFlag(args) {
+  const extIdIndex = args.indexOf("--extension-id");
+  if (extIdIndex === -1) return { extensionId: RELEASE_EXTENSION_ID };
+  const extensionId = args[extIdIndex + 1];
+  if (extensionId === void 0 || extensionId.startsWith("-")) {
+    return {
+      error: "Error: --extension-id requires a value",
+      showHelp: true
+    };
+  }
+  if (!/^[a-p]{32}$/.test(extensionId)) {
+    return {
+      error: "Error: --extension-id must be exactly 32 lowercase characters from a through p",
+      showHelp: false
+    };
+  }
+  return { extensionId };
+}
 async function trustRuntimeCommand(args) {
   const subcommand = args[0];
-  let extensionId;
-  if (subcommand === "install") {
-    const extIdIndex = args.indexOf("--extension-id");
-    if (extIdIndex === -1 || extIdIndex + 1 >= args.length) {
-      console.error("Error: --extension-id is required for install command");
-      showRuntimeHelp();
-      return 2;
-    }
-    extensionId = args[extIdIndex + 1];
-    if (!/^[a-p]{32}$/.test(extensionId)) {
-      console.error(
-        "Error: --extension-id must be exactly 32 lowercase characters from a through p"
-      );
+  let extensionId = RELEASE_EXTENSION_ID;
+  if (subcommand === "install" || subcommand === "verify") {
+    const parsed = parseExtensionIdFlag(args);
+    if ("error" in parsed) {
+      console.error(parsed.error);
+      if (parsed.showHelp) showRuntimeHelp();
       return 2;
     }
+    extensionId = parsed.extensionId;
   }
   const controller = makeTrustController();
   const installRoot = defaultTrustInstallRoot(process.platform);
   const hostPath = join7(installRoot, "runtime-host");
   switch (subcommand) {
     case "install": {
-      const installResult = await controller.install(extensionId ?? "");
+      const installResult = await controller.install(extensionId);
       if (installResult.ok) {
         try {
           await writeHostWrapper(hostPath, installRoot);
@@ -29997,7 +30038,9 @@ async function trustRuntimeCommand(args) {
       return reportTrust(
         "install",
         installResult,
-        "runtime install complete: manifest + device-local CA trusted + runtime-host wrapper created\nNote: reload the extension at chrome://extensions for the native host to be detected."
+        `runtime install complete: manifest + device-local CA trusted + runtime-host wrapper created
+Pinned extension ID: ${extensionId}
+Note: reload the extension at chrome://extensions for the native host to be detected.`
       );
     }
     case "uninstall": {
@@ -30018,9 +30061,11 @@ async function trustRuntimeCommand(args) {
     }
     case "verify": {
       const result = await controller.verify();
-      if (result.ok) {
+      const originMismatch = result.manifestValid && result.allowedOrigins.length > 0 && !extensionOriginListed(extensionId, result.allowedOrigins);
+      if (result.ok && !originMismatch) {
         console.log(
-          "runtime verification passed: manifest, binary, and CA trust all OK"
+          `runtime verification passed: manifest, binary, and CA trust all OK
+allowed_origins includes chrome-extension://${extensionId}/`
         );
         return 0;
       }
@@ -30035,10 +30080,18 @@ async function trustRuntimeCommand(args) {
       if (result.allowedOriginsCount === 0)
         console.error("  no allowed_origins in manifest");
       if (!result.caTrusted) console.error("  device-local CA not trusted");
+      if (originMismatch) {
+        for (const line of describeExtensionIdMismatch(
+          extensionId,
+          result.allowedOrigins
+        ).split("\n")) {
+          console.error(`  ${line}`);
+        }
+      }
       for (const reason of result.reasons) {
         if (reason === "manifest-not-found")
           console.error(
-            "  Hint: run 'rogatio runtime install --extension-id <id>' to register the host manifest"
+            "  Hint: run 'rogatio runtime install' to register the host manifest (release users never pass --extension-id; it is only for development without the release key, and for forks)"
           );
         if (reason === "binary-not-found")
           console.error(
@@ -30050,11 +30103,11 @@ async function trustRuntimeCommand(args) {
           );
         if (reason === "no-allowed-origins")
           console.error(
-            "  Hint: re-run 'rogatio runtime install --extension-id <id>' to pin your extension ID"
+            "  Hint: re-run 'rogatio runtime install' to pin your extension ID (release users never pass --extension-id; it is only for development without the release key, and for forks)"
           );
         if (reason === "ca-not-trusted")
           console.error(
-            "  Hint: re-run 'rogatio runtime install --extension-id <id>' with elevated privileges to trust the CA"
+            "  Hint: re-run 'rogatio runtime install' with elevated privileges to trust the CA"
           );
       }
       return 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.7.0",
+  "version": "6.7.1",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",