[rajuGT]

Context

I tried to install a Chrome Web Store extension that's published only to my company's Google Workspace domain. The listing opened, since I'm signed in with an account that can see it, but the install failed with:

Couldn't download this extension from the Chrome Web Store (HTTP 401).

This is the problem reported in #263. I used Claude to produce this fix. It would help a lot to have it in a release before Arc's sunset in December; otherwise I'll need another browser for extensions limited to our domain.

What changed

A Chrome Web Store install now retries the package download once with the Space's cookies when Google's update service answers 401 or 403. Without this, a private or trusted-tester item can't be installed, because the service serves it only to an account that can see it. The first request still omits cookies, so a public item is downloaded anonymously as before. This matches how Chromium's extension downloader recovers an authenticated CRX fetch (IterateFetchCredentialsAfterFailure). Cancelling the install review still stops the retry.

The download's network traffic annotation and the engine README describe when cookies are sent.

This touches engine inputs (CrestEngines/Chromium/Overlay), so a maintainer needs to publish a new chromium-engine release with the merge.

Validation

• Scripts/check-version.sh --fix-commit passed (0.8.114 to 0.8.115, release note private-web-store-extension-install).
• The Chromium engine was not rebuilt with this change, and installing a private item has not been tried yet.

AI usage

• AI tools helped produce this change.
• I ran the crest-contribution skill (.agents/skills/crest-contribution/SKILL.md), followed it, and reviewed every generated line.

Boundaries

• Space and browsing-profile isolation are preserved.
• The macOS and mobile platform behavior remains intentionally native.
• User-visible or architecture-significant changes add an explicit entry to Documentation/ReleaseNotes.json.
• Every verified fix commit includes its patch bump and passes Scripts/check-version.sh --fix-commit.
• I have signed off every commit as described in CONTRIBUTING.md.

Summary by CodeRabbit

• New Features
  • Private and trusted-tester Chrome Web Store extensions can now be installed in a Space signed in to a Google account with access to them.
  • Extension downloads retry once with the Space’s cookies if the initial request is denied.
• Updates
  • Updated the app version to 0.8.115.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0b1974bb-bd86-482f-89c5-8eef3a3c0ab2

Commits

Reviewing files that changed from the base of the PR and between a6f0f0c and 01a228b.

Files selected for processing: 4

• Config/Version.xcconfig
• CrestEngines/Chromium/Overlay/chrome/browser/ui/crest/crest_chrome_host.mm
• CrestEngines/Chromium/README.md
• Documentation/ReleaseNotes.json

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

Walkthrough

The Web Store package download now uses Google’s update service. It starts without cookies and retries once with Space cookies after HTTP 401 or 403. The change also updates download documentation, release notes, and the marketing version.

Changes: Web Store package download

Layer / File(s)	Summary
Package download and retry flow CrestEngines/Chromium/Overlay/chrome/browser/ui/crest/crest_chrome_host.mm, CrestEngines/Chromium/README.md, Documentation/ReleaseNotes.json, Config/Version.xcconfig	The download requests the package without cookies and retries once with Space cookies after HTTP 401 or 403. Other unsuccessful responses report an error. The README and release note describe the private extension installation flow, and the marketing version changes to 0.8.115.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant WebStoreDownload
  participant URLLoaderFactory
  participant GoogleUpdateService
  WebStoreDownload->>URLLoaderFactory: Start anonymous package request
  URLLoaderFactory->>GoogleUpdateService: Request package without cookies
  GoogleUpdateService-->>WebStoreDownload: Return response
  alt HTTP 401 or 403
    WebStoreDownload->>URLLoaderFactory: Retry once with Space cookies
    URLLoaderFactory->>GoogleUpdateService: Request package with cookies
    GoogleUpdateService-->>WebStoreDownload: Return retry response
  end
  URLLoaderFactory-->>WebStoreDownload: Return file or error

Loading

Merge Risk: Minimal · up to 01a22

No concrete merge-blocking issue is established. A private-extension install remains untested, and the Chromium engine release is still needed after merge.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: support for installing private and trusted-tester extensions from the Chrome Web Store.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pauljoda]

Thanks @rajuGT. This landed in #983, ported to the current Chrome Web Store install code, with you credited as a co-author. It ships in 0.8.188 and later. Closing this as superseded by #983.