- Add CWS build variant that strips the `key` field from manifest.json
- Update release workflow to produce both sideloading and CWS zips
- Bump extension version to 0.1.2
* [packages/actionbook-extension]feat: add independent release infrastructure
- Add GitHub Actions workflow for tag-triggered releases (actionbook-extension-v*)
- Add package.json with npm run package script for local zip packaging
- Add scripts/package.js to build distributable .zip from extension files
- Add .gitignore for dist/ and node_modules/
- Rewrite README with install/release/troubleshooting docs
The extension now has its own independent release cycle via GitHub Releases,
decoupled from the CLI binary release process.
* [packages/actionbook-rs]refactor: replace embedded extension with GitHub download installer
Remove all include_str!/include_bytes! compile-time embedding of the Chrome
extension. The CLI now downloads the extension from GitHub Releases at install
time via `actionbook extension install`.
Key changes:
- Rename embedded_extension.rs → extension_installer.rs
- Add download_and_install() using reqwest with HTTPS-only, timeouts
- Add extract_zip() with zip-slip and zip-bomb protection
- Add download URL host validation (github.com whitelist)
- Add post-extraction manifest version verification
- Use semver crate for proper version comparison
- Add zip crate dependency for safe extraction
- Update extension command to use new installer module
Security measures:
- HTTPS-only with 30s request / 10s connect timeouts
- 10MB max download size, 50MB max uncompressed size
- Zip-slip protection via enclosed_name()
- Download host whitelist (github.com, githubusercontent.com)
- Manifest version verification after extraction
* [packages/actionbook-rs]fix: atomic install, better error display, and real zip test
- Display errors with thiserror format instead of Rust Debug
("Extension error: ..." not "ExtensionError("...")")
- Atomic install: extract to temp dir, verify manifest, then swap
(existing install survives if download/extract fails)
- Move tempfile from dev-dependencies to dependencies
- Add test_extract_real_extension_zip using actual packaged zip
* [packages/actionbook-rs,actionbook-extension]fix: address review findings from dual review
- Remove early return in install command that blocked automatic upgrades;
let download_and_install() handle semver comparison via new
ExtensionAlreadyUpToDate error variant
- Remove redundant zip -j9 call in package.js, keep only zip -r9
- Add pagination NOTE on fetch_latest_release()
- Make test_extract_real_extension_zip read version from manifest.json
dynamically instead of hardcoding "0.2.0"
sen