Install-helper: check TronBrowser store before Chrome Web Store#39
Merged
Conversation
The "Add to TronBrowser" button injected on Chrome Web Store detail pages jumped straight to Google's CRX. Since we don't publish on the Chrome Web Store, it now resolves the TronBrowser store first (by the page's slug, then an exact name-search match) via the background service worker — which has host permissions for tronbrowser.dev so the lookup isn't blocked by the store page's CSP/CORS. When a live listing with a downloadable artifact exists, the button installs from the TronBrowser store and relabels; otherwise it falls back to the Chrome Web Store CRX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
Add to TronBrowserbutton thatinstall-helper.jsinjects on Chrome Web Store detail pages navigated straight to Google's CRX (clients2.google.com/service/update2/crx). It never looked at the TronBrowser store. Since we don't publish on the Chrome Web Store, the install order was backwards.Fix
The button now checks the TronBrowser store first, and only falls back to the Chrome Web Store CRX when the extension isn't listed there:
background.js— newresolve-tron-storemessage handler. Given the page'sslug/name, it queriestronbrowser.dev/api/store(exact slug, then an exact name-search match) and returns a Tron-store download URL when a live listing with a downloadable artifact exists. Resolving in the service worker matters: it holds host permissions fortronbrowser.dev, so the fetch isn't blocked by the store page's CSP/CORS.install-helper.js— extracts the slug (not just the id) from the detail URL and the name from the tab title, asks the background worker to resolve, relabels the button to "Add from TronBrowser Store" when found, and on click prefers the Tron download with the Google CRX as fallback. All failure paths (SW asleep, offline, not listed, 5s timeout) degrade to the Chrome CRX, so the button never hangs or breaks.Verification
node --checkpasses on both files.tronbrowser.dev/api/storeAPI that the response shape gated on (status: "live",version.crxUrl/version.bundleUrl) matches production, including the slug-miss case that exercises the name-search fallback.🤖 Generated with Claude Code