6 files changed, 97 insertions, 51 deletions
diff --git a/modules/web/chromium/browserpass.nix b/modules/web/chromium/browserpass.nix
index 9186a7d..af430c5 100644
--- a/modules/web/chromium/browserpass.nix
+++ b/modules/web/chromium/browserpass.nix
@@ -9,10 +9,12 @@ let
   patchedHost =
     pkgs.runCommand "com.github.browserpass.native.json"
       {
-        nativeBuildInputs = [ pkgs.python3 ];
+        nativeBuildInputs = [
+          (pkgs.luajit.withPackages (ps: [ ps.dkjson ]))
+        ];
       }
       ''
-        python3 ${./patch_native_host.py} \
+        luajit ${./patch_native_host.lua} \
           ${config.web.chromium.extensions.browserpass.id} \
           ${config.programs.browserpass.package}/lib/browserpass/hosts/chromium/com.github.browserpass.native.json \
           $out
diff --git a/modules/web/chromium/extensions/inject_extension_key.lua b/modules/web/chromium/extensions/inject_extension_key.lua
new file mode 100644
index 0000000..30ed318
--- /dev/null
+++ b/modules/web/chromium/extensions/inject_extension_key.lua
@@ -0,0 +1,72 @@
+#!/usr/bin/env luajit
+-- inject_extension_key: strip JSON comments and trailing commas from a
+-- manifest, inject the extension's public key, and rewrite it.
+local dkjson = require("dkjson")
+
+local manifest_path = assert(arg[1], "usage: inject_extension_key.lua <manifest> <ext_key>")
+local ext_key = assert(arg[2], "usage: inject_extension_key.lua <manifest> <ext_key>")
+
+local f = assert(io.open(manifest_path, "r"))
+local content = f:read("*a")
+f:close()
+
+-- Hand-rolled scanner that removes // and /* */ comments and mid-JSON
+-- trailing commas while respecting string literals (including escapes).
+local sb = {}
+local i, n = 1, #content
+local in_string = false
+
+local function trim_trailing_comma()
+  while #sb > 0 and (sb[#sb] == " " or sb[#sb] == "\t" or sb[#sb] == "\n" or sb[#sb] == "\r") do
+    sb[#sb] = nil
+  end
+  if #sb > 0 and sb[#sb] == "," then
+    sb[#sb] = nil
+  end
+end
+
+while i <= n do
+  local c = content:sub(i, i)
+  if in_string then
+    sb[#sb + 1] = c
+    if c == "\\" and i < n then
+      sb[#sb + 1] = content:sub(i + 1, i + 1)
+      i = i + 2
+    else
+      if c == '"' then
+        in_string = false
+      end
+      i = i + 1
+    end
+  else
+    local two = content:sub(i, i + 1)
+    if c == '"' then
+      in_string = true
+      sb[#sb + 1] = c
+      i = i + 1
+    elseif two == "//" then
+      local nl = content:find("\n", i) or (n + 1)
+      i = nl
+    elseif two == "/*" then
+      local close = content:find("%*/", i + 2)
+      if not close then
+        break
+      end
+      i = close + 2
+    elseif c == "]" or c == "}" then
+      trim_trailing_comma()
+      sb[#sb + 1] = c
+      i = i + 1
+    else
+      sb[#sb + 1] = c
+      i = i + 1
+    end
+  end
+end
+
+local data = dkjson.decode(table.concat(sb))
+data.key = ext_key
+
+f = assert(io.open(manifest_path, "w"))
+f:write(dkjson.encode(data, { indent = true }))
+f:close()
diff --git a/modules/web/chromium/extensions/inject_extension_key.py b/modules/web/chromium/extensions/inject_extension_key.py
deleted file mode 100644
index f1b7055..0000000
--- a/modules/web/chromium/extensions/inject_extension_key.py
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/usr/bin/env python3
-import json
-import re
-import sys
-
-manifest_path = sys.argv[1]
-ext_key = sys.argv[2]
-
-with open(manifest_path, "r", encoding="utf-8", errors="ignore") as f:
-    content = f.read()
-
-pattern = r"(\"[^\"]*?\")|//.*?$|/\*.*?\*/"
-clean = re.sub(
-    pattern,
-    lambda m: m.group(1) if m.group(1) else "",
-    content,
-    flags=re.DOTALL | re.MULTILINE,
-)
-
-clean = re.sub(r",\s*([\]}])", r"\1", clean)
-
-data = json.loads(clean)
-data["key"] = ext_key
-
-with open(manifest_path, "w", encoding="utf-8") as f:
-    json.dump(data, f, indent=2)
diff --git a/modules/web/chromium/extensions/lib.nix b/modules/web/chromium/extensions/lib.nix
index 6123b63..11ec204 100644
--- a/modules/web/chromium/extensions/lib.nix
+++ b/modules/web/chromium/extensions/lib.nix
@@ -21,7 +21,7 @@
 
       nativeBuildInputs = [
         config.file-management.ouch.package
-        pkgs.python3
+        (pkgs.luajit.withPackages (ps: [ ps.dkjson ]))
       ];
       dontUnpack = true;
 
@@ -61,7 +61,7 @@
         ${lib.optionalString (extensionKey != null) ''
           if [ -f "$out/manifest.json" ]; then
             echo "Injecting extension key into manifest.json to lock the extension ID..."
-            python3 ${./inject_extension_key.py} "$out/manifest.json" "${extensionKey}"
+            luajit ${./inject_extension_key.lua} "$out/manifest.json" "${extensionKey}"
           else
             echo "Warning: No manifest.json found in $out to inject the key!" >&2
           fi
diff --git a/modules/web/chromium/patch_native_host.lua b/modules/web/chromium/patch_native_host.lua
new file mode 100644
index 0000000..d8abebb
--- /dev/null
+++ b/modules/web/chromium/patch_native_host.lua
@@ -0,0 +1,19 @@
+#!/usr/bin/env luajit
+-- patch_native_host: set allowed_origins in a native messaging host manifest.
+local dkjson = require("dkjson")
+
+local extension_id = assert(arg[1], "usage: patch_native_host.lua <extension_id> <input> <output>")
+local input = assert(arg[2], "usage: patch_native_host.lua <extension_id> <input> <output>")
+local output = assert(arg[3], "usage: patch_native_host.lua <extension_id> <input> <output>")
+
+local f = assert(io.open(input, "r"))
+local content = f:read("*a")
+f:close()
+
+local manifest = dkjson.decode(content)
+manifest.allowed_origins = { "chrome-extension://" .. extension_id .. "/" }
+
+f = assert(io.open(output, "w"))
+f:write(dkjson.encode(manifest, { indent = true }))
+f:write("\n")
+f:close()
diff --git a/modules/web/chromium/patch_native_host.py b/modules/web/chromium/patch_native_host.py
deleted file mode 100644
index 38afb44..0000000
--- a/modules/web/chromium/patch_native_host.py
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/usr/bin/env python3
-import argparse
-import json
-
-parser = argparse.ArgumentParser(
-    description="Set allowed_origins in a native messaging host manifest"
-)
-parser.add_argument("extension_id", help="Chrome extension ID")
-parser.add_argument("input", help="Path to the input JSON manifest")
-parser.add_argument("output", help="Path to write the patched JSON manifest")
-args = parser.parse_args()
-
-with open(args.input) as f:
-    manifest = json.load(f)
-
-origin = f"chrome-extension://{args.extension_id}/"
-manifest["allowed_origins"] = [origin]
-
-with open(args.output, "w") as f:
-    json.dump(manifest, f, indent=2)
-    f.write("\n")