Changelog
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
[1.7.0] - 2025-12-07
Added
- CLI Version Flag: Added
--versionflag to the CLI to display the current version of the tool. - Resumable Downloads: Implemented support for resuming interrupted downloads using HTTP
Rangeheaders. - Network Resilience: Enhanced
download_fileto handle416 Range Not Satisfiableerrors by automatically restarting the download. - Integrity Checking: Added
--verify-hash <sha256>flag todownloadcommand to verify file integrity after download. - Proxy Configuration: Added support for configuring HTTP/HTTPS proxies via
[network.proxies]inconfig.toml. - Disk Space Safety: Added pre-flight checks to ensure sufficient disk space before downloading or extracting extensions.
- Filename Sanitization: Implemented filename sanitization to ensure cross-platform compatibility (Windows/macOS/Linux) by stripping illegal characters.
[1.6.0] - 2025-12-07
Added
- Docs Deployment: Added GitHub Actions workflow to automatically build and deploy documentation to GitHub Pages.
- Unified Audit Report: Added
fext report --jsonto generate a comprehensive JSON report aggregating metadata, risk analysis, MV3 audit, complexity, entropy, domains, and secrets. - Documentation Refactor: Split documentation into a slim
README.md(Quick Start) and detaileddocs/site (MkDocs).
Changed
- Performance Optimization: Parallelized entropy and complexity analysis using
ProcessPoolExecutorto improve performance on multi-core systems. - YARA Integration: Updated
fext analyze --yarato accept a directory of rule files, compiling them all for the scan. - Risk Scoring Tuning: Refined risk analysis to detect and penalize dangerous permission combinations (e.g.,
tabs+cookies+<all_urls>). - False Positive Reduction: Improved
SecretScanneraccuracy by filtering out common placeholders, low-entropy strings, and URLs from "Generic API Key" matches. - Python Compatibility: Added
tomlifallback for Python 3.10 compatibility (while maintaining 3.11+ target).
Fixed
- Testing: Fixed test suite hangs/deadlocks in complexity and entropy tests by mocking
ProcessPoolExecutorwhen usingpyfakefs.
[1.5.0] - 2025-12-07
Changed
- CLI Modularization: Refactored the monolithic
cli.pyinto a modular command structure undersrc/fetchext/commands/. This improves maintainability and extensibility.
[1.4.0] - 2025-12-07
Added
- Timeline View: Added
fext timeline <file>command to visualize file modification times within an extension archive for forensic analysis. - Local Server: Added
fext servecommand to host the local repository as a Chrome Update Server (HTTP). - Dependency Graph: Added
fext graph <file>command to generate DOT graphs of internal file dependencies. - Image Optimizer: Added
fext optimize <directory>command to losslessly compress PNG and JPEG images within an extension to reduce size. - Interactive Tutorial: Added
fext tutorialcommand to launch a TUI-based interactive guide for new users.
[1.3.0] - 2025-12-06
Added
- Format Converter: Added
fext convertcommand to convert between extension formats (CRX -> ZIP, Directory -> ZIP). - Configuration Wizard: Added
fext setupcommand to interactively create or update the user configuration file. - Markdown Reports: Added
fext report <file>command to generate comprehensive Markdown reports including metadata, risk analysis, and file structure. - Local Update Server: Added
fext update-manifestcommand to generateupdate.xml(Chrome/Edge) andupdates.json(Firefox) for self-hosted extensions. - Mirror Mode: Added
fext mirrorcommand to synchronize a local directory with a list of extension IDs, supporting updates and pruning. - Dependency Scanner: Added
fext scancommand to detect known vulnerable libraries (e.g., jQuery, Lodash) within extension source code. - Plugin Hooks: Added support for Python-based pre/post-download hooks in
~/.config/fext/hooks. - Rate Limiting: Added
rate_limit_delayconfiguration option to throttle network requests and prevent IP bans. - Interactive TUI: Added
fext uicommand to launch a terminal-based user interface for browsing and downloading extensions. - Repository Statistics: Added
fext statscommand to analyze local repository metrics (count, size, permissions, MV2/MV3 breakdown). - CSV Export: Added
--csvflag tosearchandscancommands for exporting results to spreadsheet-friendly format. - Man Page Generation: Added
make docsto generate standard man pages (docs/man/fext.1). - Shell Completion: Added generation of Bash and Zsh completion scripts (
docs/completions/). - Fuzz Testing: Added
make fuzzto run hypothesis-based fuzz tests for robust parsing. - Documentation Site: Added MkDocs-based documentation site configuration and
make docs-buildtarget. - Signed Releases: Added infrastructure for GPG signing of releases (
make sign,make release). - Complexity Analysis: Added
fext analyze --complexityto calculate cyclomatic complexity of JavaScript files. - Locale Inspector: Added
fext localescommand to inspect supported locales and message counts. - Docker Image: Added
Dockerfileand GitHub Actions workflow for containerized deployment. - Pre-commit Hook: Added
.pre-commit-hooks.yamlfor integration with pre-commit. - Permission Explainer: Added
fext explain <permission>command to provide detailed descriptions and risk assessments for extension permissions. - Entropy Analysis: Added
fext analyze --entropy <file>to calculate Shannon entropy of files within an extension to detect obfuscation or packing. - Domain Extractor: Added
fext analyze --domains <file>to extract all URLs and domains from extension source code for network forensics. - YARA Rules: Added
fext analyze --yara <rules_file>to scan extension files against YARA rules for malware detection. - Config Management: Added
fext configsubcommand to get, set, and list configuration values in~/.config/fext/config.toml. - Cache Management: Added
fext cleansubcommand to remove build artifacts, caches, and temporary files. - CSP Auditor: Added Content Security Policy analysis to
fext auditto detect weak security configurations. - Secret Scanner: Added
fext scan --secretsto detect API keys and tokens (AWS, Google, Slack, Stripe) in extension source code. - History Tracking: Added
fext historycommand to view a log of downloaded and extracted extensions. - JSON Schema: Added
fext schema <type>command to output JSON schemas for configuration and reports. - Plugin Manager: Added
fext plugincommand to list, install, enable, and disable Python-based hooks.
[0.7.0] - 2025-12-06
Added
- Source Preview: Added
fext preview <file>command to list extension contents without extracting. - Manifest V3 Auditor: Added
fext audit <file>command to check for MV3 compatibility and deprecated APIs. - Diff Command: Added
fext diff <old> <new>command to compare two extension versions. - Risk Analysis: Added
fext risk <file>command to analyze permission risks and assign a privacy score. - Signature Verification: Added
fext verify <file>command to cryptographically verify CRX3 signatures.
Fixed
- Build System: Fixed
TypeError: canonicalize_version()build error by upgradingsetuptoolsrequirement to>=77.0. - CI/CD: Fixed CI test failures by adding missing
pytest-asynciodependency and fixing TUI test focus logic. - Logging: Fixed a regression where the TUI module globally disabled logging, causing test failures in other modules.
- Deprecations: Resolved
setuptoolsdeprecation warnings by updatingpyproject.tomlto use SPDX license expression and removing deprecated classifiers.
[0.6.0] - 2025-12-05
Added
- Update Checker: Added
checksubcommand to check for updates of local extension files against the Web Store. - JSON Output: Added
--jsonflag tosearchandinspectcommands to output machine-readable JSON. - PyPI Publishing: Added GitHub Actions workflow to automatically publish releases to PyPI on tag creation.
Changed
- Library Mode: Refactored core logic into
src/fetchext/core.pyto allow programmatic usage offetchextas a library. - Public API: Exposed
download_extension,search_extension,inspect_extension,extract_extension, andbatch_downloadinsrc/fetchext/__init__.py.
[0.5.0] - 2025-12-05
Added
- Proper CRX Parsing: Implemented a robust CRX3 parser (
CrxDecoder) andPartialFileReaderto handle CRX files without loading them entirely into memory. - Network Resilience: Added automatic retries with exponential backoff for network requests to handle transient failures (5xx errors, connection issues).
- Config File: Added support for a user configuration file (
~/.config/fext/config.toml) to set default values for download directory, worker count, and flags. - Verbose/Quiet Mode: Added
-v/--verbose(DEBUG level) and-q/--quiet(ERROR level, no progress bars) flags for global logging control. - User-Agent Rotation: Implemented random User-Agent rotation for network requests to avoid blocking by Web Stores.
[0.3.0] - 2025-12-04
Added
- Extract Command: Added
fext extractsubcommand to unzip existing extension files. - Auto-Extraction: Added
--extract/-xflag todownloadcommand to automatically unzip the downloaded extension. - Metadata Sidecars: Added
--save-metadata/-mflag todownloadcommand to save extension details (ID, name, version, source, timestamp) to a JSON file. - Rich Output: Replaced
tqdmand standard logging withrichfor beautiful console output, progress bars, and tables. - Progress Bars: Integrated
tqdmto display progress bars for file downloads and batch processing. - Dependencies: Added
richtopyproject.tomlandrequirements-dev.txt. - Parallel Batch Downloading:
fext batchnow supports downloading multiple extensions simultaneously. - CLI Argument: Added
-w/--workersflag tofext batchto control the number of concurrent downloads (default: 4). - Makefile Target: Added
make test-batch-clifor smoke testing batch downloads without pytest. - Integration Tests: Added
tests/integration/test_batch_parallel.pyto verify parallel execution performance. - Testing: Added
pyfakefstorequirements-dev.txtand integrated it into unit and integration tests to mock file system operations.
Changed
- Dependencies: Replaced
tqdmwithrichinpyproject.tomlandrequirements-dev.txt. - Inspector: Updated
inspectcommand to display manifest data in a formatted table. - Search: Updated
searchcommand (Firefox) to display results in a formatted table. - Batch Processing: Updated
BatchProcessorto show a main "Batch Progress" bar and disable individual file download bars during batch operations. - Downloaders: Updated
ChromeDownloader,EdgeDownloader, andFirefoxDownloaderto support an optionalshow_progressargument. - Performance: Refactored
BatchProcessorto useconcurrent.futures.ThreadPoolExecutorfor improved speed when processing large batch files. - Documentation: Updated
README.mdandROADMAP.mdto reflect parallel batch capabilities. - Testing: Refactored unit and integration tests to use
pyfakefsinstead of real temporary files, improving test isolation and speed.
[0.1.0] - 2025-12-04
Added
- Multi-Browser Support: Core functionality to download extensions from Chrome Web Store, Microsoft Edge Add-ons, and Firefox Add-ons.
- CLI: Unified
fextcommand-line interface withdownload,batch, andinspectsubcommands. - Project Structure: Adopted
src/layout for better packaging and import isolation. - Testing: Implemented a 4-level testing strategy (Unit, CLI, Integration, Live) using
pytest. - CI/CD: GitHub Actions workflow for automated linting, building, and testing on Python 3.11+.
- Development Tools:
Makefilefor common tasks (setup,test,lint,format,build). - Linting: Enforced strict code quality with
ruff(Python) andmarkdownlint(Markdown). - Inspector: Basic
ExtensionInspectorto parse and display manifest data from downloaded.crxand.xpifiles. - Documentation: Comprehensive
README.mdandcopilot-instructions.mdfor project context and agent guidelines.