Trust the Chrome Web Store extension (pmhfoafjoogobhfadaicklhkldgnafmk)

The store build has its own id, so the native-messaging manifest refused it
and the extension reported the app as not running. Chrome now allows the
store id and the unpacked development id, in the NSIS hook and in both
install scripts; --chrome-id / -ChromeId take a list.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

native-messaging/README.md

@@ -1,9 +1,10 @@
 # Native messaging manifests
 
 `install.sh` (Linux, macOS) and `install.ps1` (Windows) fill in the placeholders and register the
-manifests for the current user. Default ids are the development ones: the unpacked Chrome build is pinned
-to `kogapfibnnpeapfcjkkpgjddbhnjfein` by the manifest key in kestrove-browser, Firefox uses
-`[email protected]`. Pass `--chrome-id` / `-ChromeId` for a Web Store build.
+manifests for the current user. Chrome allows two ids by default: the Chrome Web Store build
+(`pmhfoafjoogobhfadaicklhkldgnafmk`) and the unpacked development build, pinned to
+`kogapfibnnpeapfcjkkpgjddbhnjfein` by the manifest key in kestrove-browser. Firefox uses `[email protected]`.
+Pass `--chrome-id a,b` / `-ChromeId a,b` to allow other ids instead.
 
 ```bash
 native-messaging/install.sh                     # every browser with a profile dir, host from target/

native-messaging/install.ps1

@@ -2,13 +2,14 @@
 # Linux/macOS: install.sh.
 #
 #   powershell -ExecutionPolicy Bypass -File install.ps1 [-Nmh C:\path\kestrove-nmh.exe]
-#       [-ChromeId ID] [-FirefoxId ID] [-Browsers chrome,chromium,edge,firefox] [-Uninstall]
+#       [-ChromeId ID[,ID…]] [-FirefoxId ID] [-Browsers chrome,chromium,edge,firefox] [-Uninstall]
 #
 # Chrome and Brave share the Google\Chrome key. The manifests go to %LOCALAPPDATA%\Kestrove\NativeMessagingHosts.
 # allowed_origins / allowed_extensions pin the host to our extension ids (docs/04 A8).
 param(
   [string]$Nmh = "",
-  [string]$ChromeId = "kogapfibnnpeapfcjkkpgjddbhnjfein",
+  # The Chrome Web Store build, then the unpacked development build.
+  [string[]]$ChromeId = @("pmhfoafjoogobhfadaicklhkldgnafmk", "kogapfibnnpeapfcjkkpgjddbhnjfein"),
   [string]$FirefoxId = "[email protected]",
   [string[]]$Browsers = @("chrome", "chromium", "edge", "firefox"),
   [switch]$Uninstall
@@ -17,7 +18,7 @@ $ErrorActionPreference = "Stop"
 $HostName = "app.kestrove.nmh"
 $Here = Split-Path -Parent $MyInvocation.MyCommand.Path
 
-if ($ChromeId -notmatch '^[a-p]{32}$') { throw "-ChromeId must be 32 letters a-p" }
+foreach ($id in $ChromeId) { if ($id -notmatch '^[a-p]{32}$') { throw "-ChromeId must be 32 letters a-p" } }
 if ($FirefoxId -notmatch '^[A-Za-z0-9._@{}-]+$') { throw "bad -FirefoxId" }
 
 $Keys = @{
@@ -48,7 +49,7 @@ New-Item -ItemType Directory -Force -Path $OutDir | Out-Null
 foreach ($flavor in @("chrome", "firefox")) {
   $m = Get-Content -Raw (Join-Path $Here "$HostName.$flavor.json") | ConvertFrom-Json
   $m.path = $Nmh
-  if ($flavor -eq "chrome") { $m.allowed_origins = @("chrome-extension://$ChromeId/") } else { $m.allowed_extensions = @($FirefoxId) }
+  if ($flavor -eq "chrome") { $m.allowed_origins = @($ChromeId | ForEach-Object { "chrome-extension://$_/" }) } else { $m.allowed_extensions = @($FirefoxId) }
   $m | ConvertTo-Json -Depth 4 | Set-Content -Encoding UTF8 (Join-Path $OutDir "$HostName.$flavor.json")
 }
 

native-messaging/install.sh

@@ -2,7 +2,7 @@
 # Registers the Kestrove native-messaging host with the browsers of the current user (Linux, macOS).
 # Windows: install.ps1.
 #
-#   install.sh [--nmh /path/to/kestrove-nmh] [--chrome-id ID] [--firefox-id ID]
+#   install.sh [--nmh /path/to/kestrove-nmh] [--chrome-id ID[,ID…]] [--firefox-id ID]
 #              [--browsers chrome,chromium,edge,brave,firefox] [--user-data-dir DIR] [--uninstall]
 #
 # With neither --browsers nor --user-data-dir it installs for every browser whose profile directory exists.
@@ -14,8 +14,9 @@ set -eu
 HOST=app.kestrove.nmh
 HERE=$(cd "$(dirname "$0")" && pwd)
 NMH=""
-# Development ids: the unpacked Chrome build is pinned by the manifest key in kestrove-browser/scripts/build.mjs.
-CHROME_ID=kogapfibnnpeapfcjkkpgjddbhnjfein
+# Chrome: the Chrome Web Store build, then the unpacked development build (pinned by the manifest key in
+# kestrove-browser/scripts/build.mjs).
+CHROME_IDS="pmhfoafjoogobhfadaicklhkldgnafmk kogapfibnnpeapfcjkkpgjddbhnjfein"
 FIREFOX_ID=[email protected]
 BROWSERS=""
 USER_DATA_DIR=""
@@ -26,7 +27,7 @@ die() { echo "install.sh: $*" >&2; exit 1; }
 while [ $# -gt 0 ]; do
   case "$1" in
     --nmh) NMH=$2; shift 2 ;;
-    --chrome-id) CHROME_ID=$2; shift 2 ;;
+    --chrome-id) CHROME_IDS=$(echo "$2" | tr ',' ' '); shift 2 ;;
     --firefox-id) FIREFOX_ID=$2; shift 2 ;;
     --browsers) BROWSERS=$(echo "$2" | tr ',' ' '); shift 2 ;;
     --user-data-dir) USER_DATA_DIR=$2; shift 2 ;;
@@ -36,7 +37,9 @@ while [ $# -gt 0 ]; do
   esac
 done
 
-echo "$CHROME_ID" | grep -Eq '^[a-p]{32}$' || die "--chrome-id must be 32 letters a-p"
+for id in $CHROME_IDS; do echo "$id" | grep -Eq '^[a-p]{32}$' || die "--chrome-id must be 32 letters a-p"; done
+# "chrome-extension://a/", "chrome-extension://b/" (the template supplies the outer quotes).
+CHROME_ORIGINS=$(for id in $CHROME_IDS; do printf '%s' "${sep-}chrome-extension://$id/"; sep='", "'; done)
 echo "$FIREFOX_ID" | grep -Eq '^[A-Za-z0-9._@{}-]+$' || die "bad --firefox-id"
 
 if [ "$UNINSTALL" = 0 ]; then
@@ -83,7 +86,7 @@ esac
 done
 
 render() { # template → stdout
-  sed -e "s|__NMH_PATH__|$NMH|" -e "s|__CHROME_EXTENSION_ID__|$CHROME_ID|" -e "s|__FIREFOX_EXTENSION_ID__|$FIREFOX_ID|" "$HERE/$HOST.$1.json"
+  sed -e "s|__NMH_PATH__|$NMH|" -e "s|chrome-extension://__CHROME_EXTENSION_ID__/|$CHROME_ORIGINS|" -e "s|__FIREFOX_EXTENSION_ID__|$FIREFOX_ID|" "$HERE/$HOST.$1.json"
 }
 
 place() { # flavor dir

src-tauri/windows/hooks.nsh

@@ -3,9 +3,10 @@
 ; native-messaging/install.ps1: a manifest next to kestrove-nmh.exe ("path" relative to the manifest, which
 ; Chrome and Firefox allow on Windows) and one registry key per browser.
 ; Extension ids: keep in sync with kestrove-apple/App/BrowserIntegration.swift (NativeHostRegistration).
+; Chrome: the Chrome Web Store build, then the unpacked development build (pinned by the manifest key).
 
 !define KV_HOST "app.kestrove.nmh"
-!define KV_CHROME_ORIGINS '"chrome-extension://kogapfibnnpeapfcjkkpgjddbhnjfein/"'
+!define KV_CHROME_ORIGINS '"chrome-extension://pmhfoafjoogobhfadaicklhkldgnafmk/", "chrome-extension://kogapfibnnpeapfcjkkpgjddbhnjfein/"'
 !define KV_FIREFOX_IDS '"[email protected]"'
 
 !macro NSIS_HOOK_POSTINSTALL