creative-upload-extension-updater 0.1.0

package/README.md

@@ -0,0 +1,29 @@
+# Creative Upload Extension Updater
+
+macOS Native Messaging updater for the unpacked Creative Upload Chrome extension.
+
+## First installation
+
+```bash
+npm install -g @ttam/creative-upload-extension-updater
+creative-upload-extension-updater install
+```
+
+过渡期默认使用内网 Devbox 地址 `http://10.37.83.141:3100`，无需额外参数。其他 HTTP 地址必须显式传入 `--allow-insecure`；切换 HTTPS 后请使用 `--registry https://registry.example.com`。
+The command downloads and verifies the first release, then prints the fixed extension directory. In Chrome, enable Developer mode once and choose **Load unpacked** for that directory.
+
+The extension ID is fixed to `amfhocfbdlbooohhoinhhhgobfdmaljc`. Do not change the manifest public key after users begin using this updater.
+
+## Operations
+
+```bash
+creative-upload-extension-updater diagnose
+creative-upload-extension-updater update
+creative-upload-extension-updater rollback
+```
+
+`update` immediately checks the Registry and applies a newer verified release when available. On macOS it then opens a controlled extension URL so the running extension calls `chrome.runtime.reload()` automatically; pass `--no-reload` to only replace files. `rollback` restores the previous verified extension directory. Chrome must then reload the extension once.
+
+## Security
+
+The updater accepts only the configured Registry URL, checks the release SHA256, verifies the detached Ed25519 signature, and verifies the manifest version and fixed Extension ID before replacing files. HTTP is a temporary internal-network transport exception; the signing private key is never stored in this package or in the Registry.

package/bin/creative-upload-extension-updater.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+const fs = require('node:fs');
+const path = require('node:path');
+const { diagnose, install, requestChromeReload, rollback, update, TRANSITION_HTTP_REGISTRY_ORIGIN } = require('../lib/updater');
+
+const parseArguments = (values) =>
+  values.reduce((result, value, index) => {
+    if (!value.startsWith('--')) return result;
+    const key = value.slice(2);
+    const next = values[index + 1];
+    result[key] = next && !next.startsWith('--') ? next : true;
+    return result;
+  }, {});
+
+const main = async () => {
+  const [command] = process.argv.slice(2);
+  const args = parseArguments(process.argv.slice(3));
+  if (command === 'install') {
+    const publicKey =
+      typeof args['public-key'] === 'string'
+        ? fs.readFileSync(path.resolve(args['public-key']), 'utf8')
+        : undefined;
+    const result = await install({
+      registryUrl: typeof args.registry === 'string' ? args.registry : TRANSITION_HTTP_REGISTRY_ORIGIN,
+      extensionId: typeof args['extension-id'] === 'string' ? args['extension-id'] : undefined,
+      publicKey,
+      allowInsecure: args['allow-insecure'] === true,
+      hostPath: path.resolve(__dirname, 'native-host.js'),
+    });
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    return;
+  }
+  if (command === 'diagnose') return process.stdout.write(`${JSON.stringify(diagnose(), null, 2)}\n`);
+  if (command === 'update') {
+    const result = await update();
+    if (result.status === 'updated' && args['no-reload'] !== true) {
+      const diagnostic = diagnose();
+      Object.assign(result, { chromeReload: requestChromeReload(diagnostic.extensionId) });
+    }
+    return process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  }
+  if (command === 'rollback') return process.stdout.write(`${JSON.stringify(rollback(), null, 2)}\n`);
+  throw new Error(
+    '用法：creative-upload-extension-updater install [--registry <url>] [--allow-insecure] | update [--no-reload] | diagnose | rollback。默认使用当前 Devbox 过渡地址。',
+  );
+};
+
+main().catch((error) => {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+  process.exitCode = 1;
+});

package/bin/native-host.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+const { checkAndUpdate } = require('../lib/updater');
+
+let input = Buffer.alloc(0);
+const respond = (value) => {
+  const body = Buffer.from(JSON.stringify(value));
+  const header = Buffer.alloc(4);
+  header.writeUInt32LE(body.length, 0);
+  process.stdout.write(Buffer.concat([header, body]));
+};
+process.stdin.on('data', (chunk) => {
+  input = Buffer.concat([input, chunk]);
+  if (input.length < 4) return;
+  const length = input.readUInt32LE(0);
+  if (input.length < length + 4) return;
+  const message = JSON.parse(input.subarray(4, length + 4).toString('utf8'));
+  if (message.type !== 'check_and_update')
+    return respond({ status: 'failed', message: '不支持的更新器请求。' });
+  void checkAndUpdate(message)
+    .then(respond)
+    .catch((error) =>
+      respond({
+        status: 'failed',
+        currentVersion: message.currentVersion,
+        checkedAt: Date.now(),
+        message: error instanceof Error ? error.message : '插件更新失败。',
+      }),
+    );
+});

package/lib/updater.js

@@ -0,0 +1,171 @@
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const HOST_NAME = 'com.bytedance.creative_upload_extension_updater';
+const DEFAULT_EXTENSION_ID = 'amfhocfbdlbooohhoinhhhgobfdmaljc';
+const TRANSITION_HTTP_REGISTRY_ORIGIN = 'http://10.37.83.141:3100';
+const DEFAULT_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAlMYzNfVA3wLMfEniZDN3VQ+hfVXgMspwK6rM4h2P6Mk=
+-----END PUBLIC KEY-----
+`;
+const baseDirectory = path.join(os.homedir(), 'Library', 'Application Support', 'CreativeUploadInspector');
+const configPath = path.join(baseDirectory, 'updater.json');
+const extensionDirectory = path.join(baseDirectory, 'extension');
+const previousDirectory = path.join(baseDirectory, 'previous');
+const nativeHostLauncherPath = path.join(baseDirectory, 'native-host');
+
+const readConfig = () => {
+  if (!fs.existsSync(configPath)) throw new Error('更新器尚未安装。请运行 creative-upload-extension-updater install。');
+  return JSON.parse(fs.readFileSync(configPath, 'utf8'));
+};
+const writeConfig = (config) => {
+  fs.mkdirSync(baseDirectory, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+};
+const assertUrl = (url, allowInsecure) => {
+  const parsed = new URL(url);
+  const transitionRegistry = parsed.origin === TRANSITION_HTTP_REGISTRY_ORIGIN;
+  if (parsed.protocol === 'http:' && !allowInsecure && !transitionRegistry) {
+    throw new Error(`仅允许 HTTPS 或当前过渡 Registry ${TRANSITION_HTTP_REGISTRY_ORIGIN}。其他 HTTP 地址需显式传入 --allow-insecure。`);
+  }
+  if (!['https:', 'http:'].includes(parsed.protocol)) {
+    throw new Error('更新源 URL 协议无效。');
+  }
+  return parsed;
+};
+const fetchJson = async (url, allowInsecure) => {
+  assertUrl(url, allowInsecure);
+  const response = await fetch(url);
+  if (!response.ok) throw new Error(`读取更新元数据失败（HTTP ${response.status}）。`);
+  return response.json();
+};
+const extensionIdFromKey = (key) => {
+  const hash = crypto.createHash('sha256').update(Buffer.from(key, 'base64')).digest('hex').slice(0, 32);
+  return hash.replace(/[0-9a-f]/g, (digit) => 'abcdefghijklmnop'[Number.parseInt(digit, 16)]);
+};
+const validateRelease = (release) => {
+  if (!release || typeof release !== 'object') throw new Error('更新元数据格式无效。');
+  for (const field of ['version', 'artifactUrl', 'sha256', 'signature']) {
+    if (typeof release[field] !== 'string' || !release[field]) throw new Error(`更新元数据缺少 ${field}。`);
+  }
+  if (!/^[a-f0-9]{64}$/i.test(release.sha256)) throw new Error('更新元数据中的 SHA256 无效。');
+};
+const downloadAndVerify = async (release, config, staging) => {
+  assertUrl(release.artifactUrl, config.allowInsecure);
+  const response = await fetch(release.artifactUrl);
+  if (!response.ok) throw new Error(`下载插件制品失败（HTTP ${response.status}）。`);
+  const content = Buffer.from(await response.arrayBuffer());
+  const checksum = crypto.createHash('sha256').update(content).digest('hex');
+  if (!crypto.timingSafeEqual(Buffer.from(checksum), Buffer.from(release.sha256))) throw new Error('插件制品 SHA256 校验失败。');
+  if (!crypto.verify(null, content, config.signingPublicKey, Buffer.from(release.signature, 'base64'))) throw new Error('插件制品签名校验失败。');
+  const archive = path.join(staging, 'extension.zip');
+  fs.writeFileSync(archive, content, { mode: 0o600 });
+  return archive;
+};
+const unpackAndValidate = (archive, staging, release, config) => {
+  const unpacked = path.join(staging, 'unpacked');
+  fs.mkdirSync(unpacked, { recursive: true, mode: 0o700 });
+  execFileSync('/usr/bin/ditto', ['-x', '-k', archive, unpacked], { stdio: 'pipe' });
+  const manifestPath = path.join(unpacked, 'manifest.json');
+  if (!fs.existsSync(manifestPath)) throw new Error('插件制品缺少 manifest.json。');
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  if (manifest.version !== release.version) throw new Error('插件制品版本与发布元数据不一致。');
+  if (typeof manifest.key !== 'string' || extensionIdFromKey(manifest.key) !== config.extensionId) throw new Error('插件制品的 Extension ID 不匹配。');
+  return unpacked;
+};
+const replaceExtension = (unpacked) => {
+  const failedDirectory = `${extensionDirectory}.failed-${Date.now()}`;
+  fs.rmSync(failedDirectory, { recursive: true, force: true });
+  try {
+    if (fs.existsSync(previousDirectory)) fs.rmSync(previousDirectory, { recursive: true, force: true });
+    if (fs.existsSync(extensionDirectory)) fs.renameSync(extensionDirectory, previousDirectory);
+    fs.renameSync(unpacked, extensionDirectory);
+  } catch (error) {
+    if (!fs.existsSync(extensionDirectory) && fs.existsSync(previousDirectory)) fs.renameSync(previousDirectory, extensionDirectory);
+    throw error;
+  }
+};
+const checkAndUpdate = async (request) => {
+  const config = readConfig();
+  if (request.extensionId !== config.extensionId) throw new Error('未授权的扩展尝试调用更新器。');
+  const response = await fetchJson(`${config.registryUrl}/v1/extension-releases/latest`, config.allowInsecure);
+  const checkedAt = Date.now();
+  if (!response.release) return { status: 'up_to_date', currentVersion: request.currentVersion, checkedAt, message: 'Registry 尚未发布插件版本。' };
+  const release = response.release;
+  validateRelease(release);
+  if (release.version === request.currentVersion) return { status: 'up_to_date', currentVersion: request.currentVersion, targetVersion: release.version, checkedAt };
+  const staging = fs.mkdtempSync(path.join(baseDirectory, 'staging-'));
+  try {
+    const archive = await downloadAndVerify(release, config, staging);
+    const unpacked = unpackAndValidate(archive, staging, release, config);
+    replaceExtension(unpacked);
+    return { status: 'updated', currentVersion: request.currentVersion, targetVersion: release.version, checkedAt };
+  } finally {
+    fs.rmSync(staging, { recursive: true, force: true });
+  }
+};
+const update = async () => {
+  const config = readConfig();
+  const manifestPath = path.join(extensionDirectory, 'manifest.json');
+  if (!fs.existsSync(manifestPath)) throw new Error('未找到已安装的插件目录。请先运行 creative-upload-extension-updater install。');
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  if (typeof manifest.version !== 'string') throw new Error('已安装插件的 manifest 版本无效。');
+  return checkAndUpdate({ extensionId: config.extensionId, currentVersion: manifest.version });
+};
+const requestChromeReload = (extensionId) => {
+  if (process.platform !== 'darwin') return { requested: false, message: '当前平台不支持命令行自动重载。' };
+  try {
+    execFileSync('/usr/bin/open', ['-g', '-a', 'Google Chrome', `chrome-extension://${extensionId}/options.html?nativeReload=1`], { stdio: 'ignore' });
+    return { requested: true };
+  } catch {
+    return { requested: false, message: '未能唤起 Google Chrome；请在 chrome://extensions 手动重新加载。' };
+  }
+};
+const installNativeHostLauncher = (hostPath) => {
+  const nodePath = process.execPath;
+  if (!path.isAbsolute(nodePath)) throw new Error('无法确定 Native Host 的 Node 运行时路径。');
+  if (!path.isAbsolute(hostPath)) throw new Error('Native Host 脚本路径必须为绝对路径。');
+
+  // Chrome does not inherit an interactive shell's PATH, so /usr/bin/env node
+  // cannot resolve an nvm-managed Node binary. Keep a stable launcher with the
+  // exact Node executable used during installation.
+  fs.mkdirSync(baseDirectory, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(
+    nativeHostLauncherPath,
+    `#!/bin/sh\nexec ${JSON.stringify(nodePath)} ${JSON.stringify(hostPath)}\n`,
+    { mode: 0o700 },
+  );
+  fs.chmodSync(nativeHostLauncherPath, 0o700);
+  return nativeHostLauncherPath;
+};
+const install = async ({ registryUrl = TRANSITION_HTTP_REGISTRY_ORIGIN, extensionId = DEFAULT_EXTENSION_ID, publicKey = DEFAULT_PUBLIC_KEY, allowInsecure = false, hostPath }) => {
+  assertUrl(registryUrl, allowInsecure);
+  if (!/^[a-p]{32}$/.test(extensionId)) throw new Error('Extension ID 无效。');
+  crypto.createPublicKey(publicKey);
+  const config = { registryUrl: registryUrl.replace(/\/$/, ''), extensionId, signingPublicKey: publicKey, allowInsecure };
+  writeConfig(config);
+  const update = await checkAndUpdate({ extensionId, currentVersion: '0.0.0' });
+  const manifestDirectory = path.join(os.homedir(), 'Library', 'Application Support', 'Google', 'Chrome', 'NativeMessagingHosts');
+  fs.mkdirSync(manifestDirectory, { recursive: true, mode: 0o700 });
+  const launcherPath = installNativeHostLauncher(hostPath);
+  fs.writeFileSync(path.join(manifestDirectory, `${HOST_NAME}.json`), `${JSON.stringify({ name: HOST_NAME, description: 'Creative Upload Extension Updater', path: launcherPath, type: 'stdio', allowed_origins: [`chrome-extension://${extensionId}/`] }, null, 2)}\n`, { mode: 0o600 });
+  return { ...update, extensionDirectory, extensionId };
+};
+const rollback = () => {
+  if (!fs.existsSync(previousDirectory)) throw new Error('没有可回滚的上一版本。');
+  const currentDirectory = `${extensionDirectory}.rollback-${Date.now()}`;
+  if (fs.existsSync(extensionDirectory)) fs.renameSync(extensionDirectory, currentDirectory);
+  fs.renameSync(previousDirectory, extensionDirectory);
+  fs.rmSync(currentDirectory, { recursive: true, force: true });
+  return { extensionDirectory };
+};
+const diagnose = () => {
+  const config = readConfig();
+  const manifestPath = path.join(os.homedir(), 'Library', 'Application Support', 'Google', 'Chrome', 'NativeMessagingHosts', `${HOST_NAME}.json`);
+  return { extensionDirectory, extensionLoaded: fs.existsSync(path.join(extensionDirectory, 'manifest.json')), nativeHostRegistered: fs.existsSync(manifestPath), registryUrl: config.registryUrl, extensionId: config.extensionId };
+};
+
+module.exports = { DEFAULT_EXTENSION_ID, HOST_NAME, TRANSITION_HTTP_REGISTRY_ORIGIN, checkAndUpdate, diagnose, install, requestChromeReload, rollback, update };

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "creative-upload-extension-updater",
+  "version": "0.1.0",
+  "private": false,
+  "description": "Native Messaging updater for the Creative Upload unpacked Chrome extension.",
+  "bin": {
+    "creative-upload-updater": "bin/creative-upload-extension-updater.js"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}