extension-from-store 0.2.3 → 0.2.4

package/README.md

@@ -107,7 +107,23 @@ When extraction is disabled, the archive is saved as:
 
 - `.crx`: strip CRX header, extract ZIP payload
 - `.xpi`: treat as ZIP
-- No normalization, no rewriting, no formatting
+- No content normalization, no rewriting, no formatting
+- Unix permission bits from the archive are not preserved: directories come
+  out `0755` and files come out `0644` (`0755` when the archive marked them
+  executable). Some store packages ship entries with modes like `0204` that
+  the owner cannot read back after extraction; browsers ignore archive modes
+  when installing, so this package does too.
+
+## When the store refuses to serve an extension
+
+Stores sometimes decline to serve a listed extension for download. The Chrome
+Web Store update endpoint answers `HTTP 204 No Content` instead of a CRX when
+an extension is blocked, for example when its update check reports
+`_malware="true"` (observed live with ModHeader,
+`idgpnmonknjnojddfkpgkljpfnnfcklj`, on 2026-08-02). This is a store-side
+refusal, not a truncated download: real Chrome clients get the same empty
+response. extension-from-store surfaces it as a `NotPublic` error that names
+the URL that returned no content.
 
 ## `extension.meta.json`
 

package/dist/browser.js

@@ -1,5 +1,5 @@
 import { strFromU8, unzipSync } from "fflate";
-import { createLogger, resolveDownload, extensionFromStoreError, stripCrxHeader, validateInput, parseManifestInfo } from "./588.js";
+import { createLogger, resolveDownload, extensionFromStoreError, stripCrxHeader, validateInput, parseManifestInfo } from "./614.js";
 const TEXT_FILE_PATTERN = /(^|\/)(?:[^/]+\.(?:txt|md|mdx|json|js|jsx|mjs|cjs|ts|tsx|css|scss|sass|less|html|xml|svg|yml|yaml|toml|ini|conf|map)|\.(?:gitignore|npmrc|editorconfig|prettierrc|eslintrc))$/i;
 function getDefaultFetch() {
     if ('function' != typeof globalThis.fetch) throw new extensionFromStoreError('DownloadFailed', 'No fetch implementation was provided');

package/dist/core.js

@@ -1 +1 @@
-export { asExtensionFromStoreError, createLogger, detectStoreFromUrl, extensionFromStoreError, extractChromeIdFromUrl, extractEdgeIdFromUrl, extractFirefoxSlugFromUrl, getChromeDownloadUrl, getEdgeDownloadUrl, normalizeChromePlatformInfo, parseManifestInfo, resolveDownload, resolveFirefoxDownload, sanitizeSegment, stripCrxHeader, validateInput } from "./588.js";
+export { asExtensionFromStoreError, createLogger, detectStoreFromUrl, extensionFromStoreError, extractChromeIdFromUrl, extractEdgeIdFromUrl, extractFirefoxSlugFromUrl, getChromeDownloadUrl, getEdgeDownloadUrl, normalizeChromePlatformInfo, parseManifestInfo, resolveDownload, resolveFirefoxDownload, sanitizeSegment, stripCrxHeader, validateInput } from "./614.js";

package/dist/index.cjs

@@ -92,6 +92,20 @@ function stripCrxHeader(buffer) {
     }
     throw new errors_extensionFromStoreError('ExtractionFailed', `Unsupported CRX version ${version}`);
 }
+async function normalizeExtractedModes(dir) {
+    await promises_default().chmod(dir, 493);
+    const entries = await promises_default().readdir(dir, {
+        withFileTypes: true
+    });
+    for (const entry of entries){
+        const target = external_node_path_default().join(dir, entry.name);
+        if (entry.isDirectory()) await normalizeExtractedModes(target);
+        else if (entry.isFile()) {
+            const { mode } = await promises_default().stat(target);
+            await promises_default().chmod(target, 73 & mode ? 493 : 420);
+        }
+    }
+}
 async function extractCrx(crxPath, extractDir, workDir) {
     const crxBuffer = await promises_default().readFile(crxPath);
     const zipBuffer = Buffer.from(stripCrxHeader(crxBuffer));
@@ -100,12 +114,14 @@ async function extractCrx(crxPath, extractDir, workDir) {
     await external_extract_zip_default()(zipPath, {
         dir: extractDir
     });
+    await normalizeExtractedModes(extractDir);
     await promises_default().unlink(zipPath).catch(()=>void 0);
 }
 async function extractZipArchive(zipPath, extractDir) {
     await external_extract_zip_default()(zipPath, {
         dir: extractDir
     });
+    await normalizeExtractedModes(extractDir);
 }
 const external_node_fs_namespaceObject = require("node:fs");
 var external_node_fs_default = /*#__PURE__*/ __webpack_require__.n(external_node_fs_namespaceObject);
@@ -166,7 +182,13 @@ async function downloadToFile(url, filePath, options, maxRedirects = 5) {
         if (401 === statusCode || 403 === statusCode) throw new errors_extensionFromStoreError('NotPublic', 'Extension is not publicly downloadable');
         throw new errors_extensionFromStoreError('DownloadFailed', `Failed to download ${url} (HTTP ${statusCode})`);
     }
+    if (204 === statusCode) {
+        stream.resume();
+        throw new errors_extensionFromStoreError('NotPublic', `Store returned no content for ${url}; the extension is not being served for download`);
+    }
     await (0, external_node_stream_promises_namespaceObject.pipeline)(stream, external_node_fs_default().createWriteStream(filePath));
+    const { size } = await external_node_fs_default().promises.stat(filePath);
+    if (0 === size) throw new errors_extensionFromStoreError('DownloadFailed', `Downloaded file from ${url} is empty`);
 }
 async function requestJson(url, options, maxRedirects = 5) {
     const { statusCode, headers, stream } = await request(url, options);

package/dist/index.js

@@ -7,7 +7,21 @@ import node_http from "node:http";
 import node_https from "node:https";
 import { pipeline } from "node:stream/promises";
 import { URL } from "node:url";
-import { createLogger, stripCrxHeader, extensionFromStoreError as errors_extensionFromStoreError, resolveDownload, sanitizeSegment, validateInput, parseManifestInfo } from "./588.js";
+import { createLogger, stripCrxHeader, extensionFromStoreError as errors_extensionFromStoreError, resolveDownload, sanitizeSegment, validateInput, parseManifestInfo } from "./614.js";
+async function normalizeExtractedModes(dir) {
+    await promises.chmod(dir, 493);
+    const entries = await promises.readdir(dir, {
+        withFileTypes: true
+    });
+    for (const entry of entries){
+        const target = node_path.join(dir, entry.name);
+        if (entry.isDirectory()) await normalizeExtractedModes(target);
+        else if (entry.isFile()) {
+            const { mode } = await promises.stat(target);
+            await promises.chmod(target, 73 & mode ? 493 : 420);
+        }
+    }
+}
 async function extractCrx(crxPath, extractDir, workDir) {
     const crxBuffer = await promises.readFile(crxPath);
     const zipBuffer = Buffer.from(stripCrxHeader(crxBuffer));
@@ -16,12 +30,14 @@ async function extractCrx(crxPath, extractDir, workDir) {
     await extract_zip(zipPath, {
         dir: extractDir
     });
+    await normalizeExtractedModes(extractDir);
     await promises.unlink(zipPath).catch(()=>void 0);
 }
 async function extractZipArchive(zipPath, extractDir) {
     await extract_zip(zipPath, {
         dir: extractDir
     });
+    await normalizeExtractedModes(extractDir);
 }
 const DEFAULT_USER_AGENT = 'extension-from-store';
 function request(url, options) {
@@ -67,7 +83,13 @@ async function downloadToFile(url, filePath, options, maxRedirects = 5) {
         if (401 === statusCode || 403 === statusCode) throw new errors_extensionFromStoreError('NotPublic', 'Extension is not publicly downloadable');
         throw new errors_extensionFromStoreError('DownloadFailed', `Failed to download ${url} (HTTP ${statusCode})`);
     }
+    if (204 === statusCode) {
+        stream.resume();
+        throw new errors_extensionFromStoreError('NotPublic', `Store returned no content for ${url}; the extension is not being served for download`);
+    }
     await pipeline(stream, node_fs.createWriteStream(filePath));
+    const { size } = await node_fs.promises.stat(filePath);
+    if (0 === size) throw new errors_extensionFromStoreError('DownloadFailed', `Downloaded file from ${url} is empty`);
 }
 async function requestJson(url, options, maxRedirects = 5) {
     const { statusCode, headers, stream } = await request(url, options);
@@ -203,5 +225,5 @@ async function fetchExtensionFromStore(url, options = {}) {
         }).catch(()=>void 0);
     }
 }
-export { extensionFromStoreError } from "./588.js";
+export { extensionFromStoreError } from "./614.js";
 export { fetchExtensionFromStore };

package/package.json

@@ -9,7 +9,7 @@
   },
   "engineStrict": false,
   "name": "extension-from-store",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Download public browser extensions from official stores",
   "homepage": "https://www.npmjs.com/package/extension-from-store",
   "type": "module",
@@ -97,12 +97,12 @@
     }
   },
   "devDependencies": {
-    "@rslib/core": "^0.23.0",
-    "@types/node": "^25.9.3",
-    "eslint": "^10.5.0",
-    "eslint-config-auditor": "^2.3.1",
+    "@rslib/core": "^0.23.2",
+    "@types/node": "^26.1.1",
+    "eslint": "^10.8.0",
+    "eslint-config-auditor": "^3.0.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.10"
   },
   "packageManager": "pnpm@9.9.0+sha512.60c18acd138bff695d339be6ad13f7e936eea6745660d4cc4a776d5247c540d0edee1a563695c183a66eb917ef88f2b4feb1fc25f32a7adcadc7aaf3438e99c1",
   "bugs": "https://github.com/cezaraugusto/extension-from-store/issues",