crx-gate 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 crx-gate contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,39 @@
-# Temporary Holding Version
+# crx-gate
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Static security analyzer and permission linter for Chrome extensions. Statically inspects unpacked extension directories, `.zip` bundles, or `.crx` binaries in under 3ms.
+
+[![GitHub](https://img.shields.io/badge/GitHub-jaw0r3k%2Fcrx--gate-blue?logo=github)](https://github.com/jaw0r3k/crx-gate)
+[![License: MIT OR Apache-2.0](https://img.shields.io/badge/License-MIT%20OR%20Apache--2.0-blue.svg)](https://github.com/jaw0r3k/crx-gate/blob/master/LICENSE)
+
+---
+
+## Instant usage via `npx`
+
+No installation required:
+
+```bash
+# Audit an extension directory
+npx crx-gate audit ./dist
+
+# Generate standalone interactive HTML report
+npx crx-gate audit ./dist --format html --output report.html
+
+# Audit a packed .crx binary archive
+npx crx-gate audit ./extension.crx
+
+# Diff two versions to prevent permission creep
+npx crx-gate diff ./v1.0.0 ./v1.1.0 --fail-on-degradation
+
+# Export SARIF for GitHub Code Scanning
+npx crx-gate audit ./dist --format sarif --output crx-gate.sarif
+
+# List all built-in rules
+npx crx-gate rules
+```
+
+---
+
+## Documentation
+
+Full documentation, GitHub Actions setup, and pre-commit hook integrations:
+[https://github.com/jaw0r3k/crx-gate](https://github.com/jaw0r3k/crx-gate)

package/bin/crx-gate.js

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+
+const { spawnSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const https = require("https");
+
+const VERSION = "0.2.0";
+const REPO = "jaw0r3k/crx-gate";
+
+function getBinaryName() {
+  const platform = os.platform();
+  const arch = os.arch();
+
+  let targetArch = arch === "x64" ? "x86_64" : arch === "arm64" ? "aarch64" : null;
+  if (!targetArch) {
+    console.error(`crx-gate error: Unsupported CPU architecture '${arch}'.`);
+    process.exit(1);
+  }
+
+  if (platform === "linux") {
+    return {
+      artifact: `crx-gate-${targetArch}-unknown-linux-gnu.tar.gz`,
+      binaryName: "crx-gate",
+      isZip: false,
+    };
+  } else if (platform === "darwin") {
+    return {
+      artifact: `crx-gate-${targetArch}-apple-darwin.tar.gz`,
+      binaryName: "crx-gate",
+      isZip: false,
+    };
+  } else if (platform === "win32") {
+    return {
+      artifact: `crx-gate-x86_64-pc-windows-msvc.zip`,
+      binaryName: "crx-gate.exe",
+      isZip: true,
+    };
+  } else {
+    console.error(`crx-gate error: Unsupported OS '${platform}'.`);
+    process.exit(1);
+  }
+}
+
+function getLocalBinaryPath() {
+  // Check local release build first if developing locally
+  const localTarget = path.join(__dirname, "..", "..", "target", "release", process.platform === "win32" ? "crx-gate.exe" : "crx-gate");
+  if (fs.existsSync(localTarget)) {
+    return localTarget;
+  }
+
+  const { binaryName } = getBinaryName();
+  const cacheDir = path.join(os.homedir(), ".crx-gate", `v${VERSION}`);
+  return path.join(cacheDir, binaryName);
+}
+
+function runBinary(binPath, args) {
+  const result = spawnSync(binPath, args, { stdio: "inherit" });
+  if (result.error) {
+    console.error("Execution error:", result.error);
+    process.exit(1);
+  }
+  process.exit(result.status !== null ? result.status : 0);
+}
+
+function downloadBinary(url, dest, cb) {
+  https.get(url, (res) => {
+    if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+      downloadBinary(res.headers.location, dest, cb);
+      return;
+    }
+    if (res.statusCode !== 200) {
+      cb(new Error(`Failed to download binary: HTTP ${res.statusCode}`));
+      return;
+    }
+    const file = fs.createWriteStream(dest);
+    res.pipe(file);
+    file.on("finish", () => {
+      file.close(() => cb(null));
+    });
+  }).on("error", (err) => {
+    cb(err);
+  });
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  const binPath = getLocalBinaryPath();
+
+  if (fs.existsSync(binPath)) {
+    runBinary(binPath, args);
+    return;
+  }
+
+  const { artifact, binaryName, isZip } = getBinaryName();
+  const cacheDir = path.join(os.homedir(), ".crx-gate", `v${VERSION}`);
+  fs.mkdirSync(cacheDir, { recursive: true });
+
+  const archivePath = path.join(cacheDir, artifact);
+  const downloadUrl = `https://github.com/${REPO}/releases/download/v${VERSION}/${artifact}`;
+
+  console.log(`crx-gate: Fetching pre-compiled release binary (v${VERSION})...`);
+  downloadBinary(downloadUrl, archivePath, (err) => {
+    if (!err) {
+      try {
+        if (isZip) {
+          spawnSync("powershell", ["-Command", `Expand-Archive -Path '${archivePath}' -DestinationPath '${cacheDir}' -Force`]);
+        } else {
+          spawnSync("tar", ["-xzf", archivePath, "-C", cacheDir]);
+        }
+        if (fs.existsSync(binPath)) {
+          if (process.platform !== "win32") {
+            fs.chmodSync(binPath, 0o755);
+          }
+          try { fs.unlinkSync(archivePath); } catch (_) {}
+          runBinary(binPath, args);
+          return;
+        }
+      } catch (_) {}
+    }
+
+    // Fallback to cargo run if developing in repo
+    const cargoRun = spawnSync("cargo", ["run", "--release", "--quiet", "--", ...args], {
+      stdio: "inherit",
+      cwd: path.join(__dirname, "..", ".."),
+    });
+
+    if (cargoRun.status === 0) {
+      process.exit(0);
+    }
+
+    console.error(`crx-gate error: Could not run or download binary. Please install via cargo: 'cargo install crx-gate'`);
+    process.exit(1);
+  });
+}
+
+main();

package/package.json

@@ -1,6 +1,43 @@
 {
   "name": "crx-gate",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Zero-dependency pre-commit extension security, permission blast-radius auditing, and CWS rejection prediction",
+  "bin": {
+    "crx-gate": "bin/crx-gate.js"
+  },
+  "scripts": {
+    "test": "node bin/crx-gate.js --help"
+  },
+  "keywords": [
+    "chrome-extension",
+    "crx",
+    "security",
+    "audit",
+    "manifest-v3",
+    "blast-radius",
+    "sast",
+    "taint-analysis"
+  ],
+  "author": "crx-gate contributors",
+  "license": "MIT",
+  "homepage": "https://github.com/jaw0r3k/crx-gate#readme",
+  "bugs": {
+    "url": "https://github.com/jaw0r3k/crx-gate/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jaw0r3k/crx-gate.git"
+  },
+  "funding": {
+    "type": "individual",
+    "url": "https://github.com/jaw0r3k/crx-gate"
+  },
+  "files": [
+    "bin",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=16.0.0"
+  }
+}