feat(extension): bind native host manifest authority

[seonghobae]

Partial implementation of #27, stacked on exact current PR #154 head d2e1ae8d654703b76897db202980fec82d26babc.

Buyer/security gap

#82 binds an exact extension identity to a native host name and #154 bounds native-messaging framing, but a process adapter must also prove that the host manifest names the exact requested host, declares Chrome's stdio interface, carries an executable path with platform-correct shape and bounded allocation cost, and explicitly allows the exact calling extension origin. Treating installation, nativeMessaging permission, a host-name string, or unchecked path text as sufficient authority would reintroduce ambient authority at the native-process boundary.

Dependency / current stack

Current exact #169 head is b6d2601bcfc0596c5f7819ffb7a9c7805bdd9adf. Fresh compare against exact current #154 head d2e1ae8d654703b76897db202980fec82d26babc reports ahead 13 / behind 0, with merge base exactly equal to that live prerequisite. The delta remains limited to the manifest-authority implementation/tests plus crate-root exposure and existing code-current CHANGELOG/doctoring/extension-security traceability files. Keep Draft while #154/#82 remain active. No prerequisite check, review, status, coverage, mergeability, or synthetic-merge evidence transfers.

RED -> RCA -> implementation

The original test-only head f8b0539d270dd0eaa5259985ad7f2ee14e22d771 established the host-name/interface/origin boundary before production support existed.

For executable-path authority:

1. Test-only head ea89ba0dad1757d2cfe003538c03d814a2b8a4c8 introduced platform/path expectations but CI 31931627600 failed first at canonical formatting, so that run is not treated as semantic RED evidence.
2. Canonically formatted test-only head d1423e75189aa7388a5f287be9c30f425cf773ca passed repository contracts and formatting, then CI 31931677160, Rust contracts job 95127377536, failed first at the locked workspace check with exit 101 because the new production API did not yet exist. That is the production-boundary RED.
3. Production added NativeMessagingHostPlatform, exact declared path storage, empty/NUL rejection, absolute-path enforcement for Linux/macOS, preservation of Windows relative manifest paths for later trusted manifest-directory resolution, public path/platform accessors, deterministic errors, and complete public rustdoc.
4. A subsequent resource-governance audit found executable_path.to_owned() remained allocation-unbounded. Exact test-only head fdd674b6f0ea42d9114702d61cd3dce389f5b5a1 added the exact-limit/one-byte-over boundary first. CI 31931995519, Rust contracts job 95128141183, passed repository contracts and canonical formatting, then failed first at the locked workspace check because MAX_NATIVE_MESSAGING_EXECUTABLE_PATH_BYTES and ExecutablePathTooLong did not exist. That is the second valid production-boundary RED.
5. Current production head adds a public, rustdoc-documented 32 KiB OriginWeave allocation safety budget for declared executable-path UTF-8 bytes, accepts the exact limit, rejects one byte over before storing a String, and returns deterministic ExecutablePathTooLong. This is explicitly a product resource-governance limit, not a claim about Chrome or operating-system maximum valid path length.

The complete current manifest contract also retains exact stdio, raw allowed_origins budget 256, canonical chrome-extension://<id>/ parsing, duplicate collapse without authority widening, and exact host/extension membership checks.

Exact-current proof

On unchanged exact head b6d2601bcfc0596c5f7819ffb7a9c7805bdd9adf against exact current prerequisite d2e1ae8d654703b76897db202980fec82d26babc:

• CI run 31932125848: success;
• Rust contracts job 95128459729: repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success;
• Production coverage job 95128459719: exact owned-production function/line/region/branch measurement and enforcement success;
• Manifest V3 Compatibility run 31932125905: success;
• fresh ancestry: ahead 13 / behind 0 with merge base exactly the live prerequisite;
• GitHub reports the Draft open and mergeable;
• formal reviews currently returned: none; and
• inline review threads currently returned: none.

Security/SAST and central review workflows not generated for this stacked Draft base are absent, not passing. Skipped formatting-diagnostic steps are not promoted as passing gates. No predecessor-head, prerequisite-head, queued, pending, skipped, cancelled, absent, stale, status-only, model-only, or synthetic evidence is promoted as current proof.

Standards and truth boundary

Chrome's native-messaging contract is the primary platform basis already recorded in docs/doctoring.md: Linux/macOS host paths are absolute while Windows permits a path relative to the manifest directory. The Rust policy preserves that distinction without pretending relative Windows path text is already resolved or authenticated. The 32 KiB bound is an OriginWeave resource budget and does not override native platform path validation.

This slice still validates caller-supplied authority-bearing manifest fields only. It does not read or authenticate manifest JSON from the filesystem/Windows registry, resolve or canonicalize a Windows relative path against an authenticated manifest directory, prove executable existence/publisher/ownership, spawn/sandbox/supervise a host process, authenticate a stdio peer, parse/trust host JSON, expose secrets, grant Agent actions, or claim complete native-messaging integration. Those remain separately reviewed runtime boundaries. This scheduled actor does not merge, self-approve, alter workflows, add secrets, weaken checks, tag, or publish.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 06b2547d-9176-450b-9981-2a96ed756321

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}