中文说明

S3Deck is a fast, local-first object storage manager built as a Chrome extension. It turns everyday S3-compatible storage work into a focused file-browsing experience without introducing an account, a project backend, or a desktop runtime.

The currently verified providers are Kingsoft Cloud KS3, Alibaba Cloud OSS, and Tencent Cloud COS. KS3 uses dedicated Provider behavior, while OSS and COS use the generic S3-compatible Driver. The current source baseline has passed real-service checks for the core object APIs documented in the OSS and COS test report.

Many open-source object storage clients prioritize the widest possible API coverage or reproduce a cloud console. S3Deck deliberately takes a narrower path: make common object operations simple, stable, fast, and consistent across platforms.

• Fast cascading browsing. Prefixes expand in place like a waterfall, while data is fetched and paginated lazily. The object list is virtualized, so the page mounts only the rows it needs instead of turning a large Bucket into a large DOM tree. In practice, browsing deep object hierarchies feels immediate.
• Cross-platform by default. S3Deck runs as a Chrome extension instead of a platform-specific desktop application. The same extension model works on macOS, Windows, Linux, and ChromeOS.
• Local-first. There is no S3Deck account and no S3Deck backend. Connection configuration, encrypted credentials, navigation preferences, and the chosen download folder stay inside the local Chrome extension profile and are not stored with Chrome Sync.
• Small, focused surface. The goal is not to expose every S3 API. S3Deck focuses on the object workflows people use frequently and keeps the interface easy to understand.

1. Download s3deck-0.1.0-chrome.zip.
2. Extract the ZIP into a directory you intend to keep.
3. Open chrome://extensions.
4. Enable Developer mode.
5. Click Load unpacked and select the extracted directory containing manifest.json.
6. Click the S3Deck extension icon to open or focus its full-page workspace.

The Release also provides a matching .sha256 file for package verification.

If you have security concerns or other questions about the implementation, you can audit the code shipped in the extension package directly. Release JavaScript is intentionally unminified and retains readable formatting and names.

To review, modify, or build S3Deck yourself, install:

• Node.js 20.19 or newer
• pnpm 11.21.0

Then build the extension:

git clone https://github.com/lenovobenben/s3deck.git
cd s3deck
pnpm install
pnpm build

Load the generated dist/chrome-mv3 directory from chrome://extensions using the same Load unpacked flow above.

For development, run pnpm dev and load dist/chrome-mv3-dev instead.

Create a Provider profile, then add a Credential and an Endpoint. For KS3, use the Endpoint and Region assigned to your storage service. Alibaba Cloud OSS and Tencent Cloud COS can be configured through a generic S3 Provider with their regional Endpoint and virtual-hosted addressing. S3Deck combines the selected Credential and Endpoint at runtime and discovers accessible Buckets through ListBuckets; Bucket names are not saved as connection records. The Credential therefore needs permission to list Buckets in addition to the permissions required for the object operations you use.

S3Deck requests HTTP/HTTPS host access because S3-compatible Endpoints are supplied by the user and cannot be enumerated in advance. Storage requests go directly from the extension page to the selected Endpoint. The project has no backend path for receiving credentials or object data.

The local encryption prevents AK/SK from being written as plaintext in extension storage. It is not a password vault and does not protect against someone who controls the operating system, the Chrome profile, or trusted extension debugging code. Normal use does not require a master password, so the extension can decrypt credentials locally when it creates an S3 client.

• Provider, Credential, Endpoint, Region, and addressing-style configuration.
• Live Bucket discovery with ListBuckets.
• Fast Bucket/Prefix browsing with breadcrumbs, expandable cascading prefixes, virtualized rows, and continuation-token pagination.
• One-file-at-a-time upload from the file picker or drag and drop, with managed multipart upload, overwrite confirmation, progress, cancellation, and retry.
• Streaming single-file download to a chosen folder, with overwrite confirmation, progress, cancellation, retry, and a browser fallback when the File System Access API is unavailable.
• Folder creation, confirmed single-object deletion, and confirmed recursive folder deletion.
• Bounded text, JSON, and image Preview with safe source rendering for executable text formats.
• Single-object private / public-read ACL management. Public links appear only after the latest remote ACL read confirms public-read; KS3 can provide public-network and internal-network links, while OSS and COS use their configured public Endpoint.

• Real-service compatibility baselines currently cover KS3, Alibaba Cloud OSS, and Tencent Cloud COS. AWS S3, MinIO, and arbitrary generic S3 endpoints have Driver or integration-test foundations, but not the same live-provider compatibility commitment.
• The OSS and COS baseline covers the documented core API matrix, not every region, account policy, vendor-specific feature, or the large-scale stress scenarios already completed for KS3.
• No multi-file or folder upload, bulk download, batch selection, or batch operation.
• No search or current-folder filter. Browser find (Control + F, or Command + F on macOS) cannot search the entire object list because pagination and virtualization mean that only currently mounted rows exist in the DOM.
• No Copy, Move, or Rename action in the current UI.
• Recursive folder deletion removes the keys currently visible through ListObjectsV2; it does not purge historical versions from versioned Buckets.
• No persistent transfer history or resume-after-close support.
• Object ACL is not a complete public-access audit. Bucket policy, public-access blocks, proxies, and network rules may still allow or deny anonymous access.

S3Deck aims to become a broadly compatible object storage manager. Future Provider work may cover Amazon S3 and other widely used S3-compatible services. Batch upload, batch download, and other carefully designed multi-object workflows are also planned.

The product will still be guided by four priorities:

1. Simplicity
2. Stability
3. Performance
4. Broad, consistent compatibility

Feature count is not the goal. New capabilities should earn their place without making ordinary storage work slower or harder to understand.

pnpm dev
pnpm check
pnpm test:unit
pnpm test:integration:minio
pnpm release:check

The unit and MinIO integration checks require Node.js 22 or newer. The MinIO check also requires Docker and uses an isolated container with disposable credentials.

Project decisions are documented in the product design, the technical architecture, and the ADR directory. Current maintenance items and future product work are tracked in the roadmap, while implemented corrections are documented in the change log. Completed large-scale KS3 checks are recorded in the stress-test report, and the real-service Alibaba Cloud OSS and Tencent Cloud COS matrix is recorded in the OSS and COS test report.

S3Deck is released under the MIT License.

English

S3Deck 是一个快速、Local-first 的对象存储管理工具,以 Chrome 扩展的形式运行。它希望把日常的 S3-Compatible 对象存储操作变成专注、直观的文件浏览体验,同时不引入项目账号、项目后端或额外的 桌面运行时。

当前已经完成真实环境验证的 Provider 包括 金山云 KS3、阿里云 OSS 和腾讯云 COS。KS3 使用专用的 Provider 行为,OSS 与 COS 通过 Generic S3-Compatible Driver 接入;当前源码已经通过 阿里云与腾讯云对象存储测试记录所列的核心对象 API 验收。

许多开源对象存储客户端追求覆盖尽可能多的 API,或者复刻一个完整的云控制台。S3Deck 选择更聚焦的 方向:让常用对象操作保持简约、稳定、快速,并尽可能提供一致的跨平台体验。

• 快速的瀑布式展开浏览。 Prefix 可以在当前位置连续展开,数据按需请求、按页加载。对象列表使用 Virtual List,只挂载当前需要显示的行,不会把一个大 Bucket 直接变成庞大的 DOM 树。实际浏览较深的 对象目录时,响应非常快。
• 天然跨平台。 S3Deck 是 Chrome 扩展,不依赖某一个桌面系统的原生框架。同一套扩展可以运行在 macOS、Windows、Linux 和 ChromeOS 上。
• 纯本地存储。 不需要 S3Deck 账号,也没有 S3Deck 后端。连接配置、加密后的 Credential、浏览位置 和下载目录都保存在本机 Chrome 扩展 Profile 中,并且不使用 Chrome Sync。
• 界面简约、目标明确。 S3Deck 不追求暴露所有 S3 API,而是优先做好用户经常使用的对象操作, 避免为了功能数量让界面变得复杂。

1. 下载 s3deck-0.1.0-chrome.zip。
2. 将 ZIP 解压到一个准备长期保留的目录。
3. 打开 chrome://extensions。
4. 开启右上角的开发者模式。
5. 点击加载已解压的扩展程序,选择包含 manifest.json 的解压目录。
6. 点击 S3Deck 扩展图标,即可打开或聚焦全屏工作页。

Release 同时提供对应的 .sha256 文件,用于校验下载包。

如果你对插件安全性存疑,或者对实现有其他疑问,可以直接审核扩展包中实际运行的代码。 发布版 JavaScript 特意不做压缩,保留良好的格式和可读名称。

如果需要自行审核、修改或构建 S3Deck,请先安装:

• Node.js 20.19 或更高版本
• pnpm 11.21.0

然后构建扩展:

git clone https://github.com/lenovobenben/s3deck.git
cd s3deck
pnpm install
pnpm build

构建完成后,在 chrome://extensions 中按照上面相同的加载已解压的扩展程序 流程选择 dist/chrome-mv3 目录。

参与开发时可以运行 pnpm dev,并改为加载 dist/chrome-mv3-dev。

先创建 Provider,再分别添加 Credential 和 Endpoint。使用 KS3 时,请填写对象存储服务分配的 Endpoint 和 Region;阿里云 OSS、腾讯云 COS 可以使用 Generic S3 Provider,填写对应区域 Endpoint,并选择 Virtual-hosted addressing。S3Deck 会在运行时组合当前选择的 Credential 与 Endpoint,并通过 ListBuckets 发现有权访问的 Bucket;Bucket 名称不会作为连接配置保存。因此,除了具体对象操作需要的 权限之外,Credential 还需要具备列举 Bucket 的权限。

由于 S3-Compatible Endpoint 由用户自行填写,无法在发布前枚举,S3Deck 会申请 HTTP/HTTPS 主机访问 权限。对象存储请求直接从扩展页面发送到当前选择的 Endpoint;项目不存在接收 Credential 或对象数据的 后端服务。

本地加密的目的,是避免 AK/SK 以明文形式写入扩展存储。它不是密码保险箱,也不能抵御已经控制操作 系统、Chrome Profile 或可信扩展调试代码的人。正常使用不要求输入主密码,因此扩展在创建 S3 Client 时可以在本机自动解密 Credential。

• Provider、Credential、Endpoint、Region 和 addressing style 配置。
• 通过 ListBuckets 实时发现 Bucket。
• Bucket/Prefix 快速浏览、面包屑、瀑布式 Prefix 展开、Virtual List 和 Continuation Token 懒分页。
• 通过文件选择器或拖拽一次上传一个普通文件,支持 SDK 托管的 Multipart Upload、覆盖确认、进度、 取消和重试。
• 单文件流式下载到选定目录,支持覆盖确认、进度、取消和重试;浏览器不支持 File System Access API 时使用兼容回退。
• 新建目录、经过确认的单对象删除,以及经过确认的递归目录删除。
• 有大小边界的文本、JSON 和图片 Preview;可执行文本格式只按安全源码展示。
• 单对象 private / public-read ACL 管理。只有最新一次远端 ACL 读取确认是 public-read 时才显示 公开链接;KS3 可以同时提供外网和内网候选地址,OSS、COS 使用所配置的公网 Endpoint。

• 当前真实服务兼容基线覆盖 KS3、阿里云 OSS 和腾讯云 COS。AWS S3、MinIO 及任意 Generic S3 Endpoint 已有 Driver 或集成测试基础,但还没有同等级的真实 Provider 兼容承诺。
• OSS、COS 已完成的是测试文档所列核心 API 矩阵,不代表所有区域、账号策略、供应商专属能力或 KS3 已完成的大规模压力场景都经过验证。
• 不支持多文件上传、目录上传、批量下载、批量选择和批量操作。
• 不支持搜索或当前目录过滤。浏览器查找(Control + F,macOS 上为 Command + F)也无法搜索完整 对象列表,因为分页和 Virtual List 决定了 DOM 中只有当前挂载的行。
• 当前界面不提供 Copy、Move 或 Rename。
• 递归目录删除会删除 ListObjectsV2 当前可见的 Key;如果 Bucket 启用了版本控制,不会清除历史版本。
• 不保存传输历史,关闭工作页后不能恢复传输。
• 对象 ACL 不是完整的公开访问审计。Bucket Policy、Public Access Block、代理和网络规则仍可能允许 或阻止匿名访问。

S3Deck 希望逐步成为一个广泛兼容的对象存储管理工具。未来的 Provider 计划可以覆盖 Amazon S3,以及 更多常见的 S3-Compatible 服务。批量上传、批量下载和其他经过认真设计的多对象工作流也会逐步补齐。

但产品始终会坚持四个优先级:

1. 简约
2. 稳定
3. 性能
4. 广泛且一致的兼容性

功能数量本身不是目标。任何新能力都不应该让普通的对象存储操作变慢,或者变得更难理解。

pnpm dev
pnpm check
pnpm test:unit
pnpm test:integration:minio
pnpm release:check

单元测试和 MinIO 集成测试需要 Node.js 22 或更高版本。MinIO 测试还需要 Docker,并会使用一次性 Credential 启动隔离容器。

项目决策记录在产品设计文档、技术架构和 ADR 目录中;当前维护项与后续产品方向记录在路线图与待办中,已实施的 修正记录在变更记录中,已完成的大规模 KS3 验收记录在压力测试记录中。 阿里云 OSS、腾讯云 COS 的真实环境 API 矩阵记录在阿里云与腾讯云对象存储测试记录中。

S3Deck 使用 MIT License。