Skip to content

CoinPay, LogicSRC and TronBrowser installed by default + new-tab Apps widget (pwamart) - #177

Merged
sh1pt-actions-fleet[bot] merged 1 commit into
mainfrom
feat/pwa-defaults-apps-widget
Nov 2, 2026
Merged

sh1pt-actions-fleet[bot] merged 1 commit into
mainfrom
feat/pwa-defaults-apps-widget

Conversation

@sh1pt-actions-fleet

Copy link
Copy Markdown
Contributor
  • tron pwa add/remove/installed: put pwamart apps in the app drawer as a
    .desktop entry running tron --app=<start_url> (icon fetched, https only,
    % escaped per the desktop spec). sync leaves these entries alone.
  • tron pwa defaults: CoinPay, LogicSRC, TronBrowser once per profile; the
    launcher runs it in the background on every start. A removed default stays
    removed; TRONBROWSER_NO_DEFAULT_APPS=1 skips it.
  • tron pwa host/register-host: native messaging host dev.tronbrowser.pwa,
    registered in /NativeMessagingHosts for the unpacked extension id
    (no root).
  • New-tab "Apps" strip: Profullstack's apps from pwamart.com, defaults pinned
    first, filter box, one tap = install (or Open once installed). Without the
    host (macOS/Windows/Tor) it opens the app in its own window.

Why not the engine's own installer: on ungoogled-chromium 152 the PWA DevTools
domain is absent, navigator.install is undefined, --policy is ignored and
chrome.management.generateAppForLink makes a tab-only hosted app. Verified
headless on the real engine: the widget tap wrote tronbrowser-pwa-coinpay.desktop
plus its icon through the native host.

Details: native messaging host is profile-scoped and only allows the bundled extension's unpacked id. Desktop suite: 171 passed / 4 skipped (11 new in test/pwa-apps.test.ts). Headless e2e on ungoogled-chromium 152: 92 tiles, defaults first, tapping Install on CoinPay wrote the .desktop + icon. Not verified: icons painting in headless (lazy images). pwamart answers HeadlessChrome UAs with 402 (x402); real browsers get 200.

🤖 Generated with Claude Code

…ew-tab Apps widget

- tron pwa add/remove/installed: put pwamart apps in the app drawer as a
  .desktop entry running `tron --app=<start_url>` (icon fetched, https only,
  % escaped per the desktop spec). sync leaves these entries alone.
- tron pwa defaults: CoinPay, LogicSRC, TronBrowser once per profile; the
  launcher runs it in the background on every start. A removed default stays
  removed; TRONBROWSER_NO_DEFAULT_APPS=1 skips it.
- tron pwa host/register-host: native messaging host dev.tronbrowser.pwa,
  registered in <profile>/NativeMessagingHosts for the unpacked extension id
  (no root).
- New-tab "Apps" strip: Profullstack's apps from pwamart.com, defaults pinned
  first, filter box, one tap = install (or Open once installed). Without the
  host (macOS/Windows/Tor) it opens the app in its own window.

Why not the engine's own installer: on ungoogled-chromium 152 the PWA DevTools
domain is absent, navigator.install is undefined, --policy is ignored and
chrome.management.generateAppForLink makes a tab-only hosted app. Verified
headless on the real engine: the widget tap wrote tronbrowser-pwa-coinpay.desktop
plus its icon through the native host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

ThreatCrush Security Scan

51 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 28 | LOW: 21

Severity Rule Location
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:303
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:437
MEDIUM js-open-redirect apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:247
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:276
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:346
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/options.js:306
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:78
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:166
MEDIUM redos-nested-quantifier apps/desktop/extensions/ai-sidebar/w3bs.js:17
MEDIUM insecure-randomness-for-secret apps/extensions/public/seal.js:107
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:77
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:286
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:652
MEDIUM js-unescaped-html-sink apps/web/public/app.js:29
MEDIUM js-unescaped-html-sink apps/web/public/dns.js:54
MEDIUM sh-remote-script-execution apps/web/public/install.sh:188
MEDIUM sh-remote-script-execution apps/web/public/install.sh:428
MEDIUM sh-remote-script-execution apps/web/public/install.sh:446
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:122
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:194
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:125
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:68
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:73
MEDIUM js-unescaped-html-sink services/api/src/profile.ts:59
MEDIUM sql-template-interpolation services/api/src/store/db.ts:116
MEDIUM js-dynamic-code-execution services/api/src/store/scanner.ts:44
MEDIUM sh-predictable-temp-path start.sh:24
LOW js-dynamic-code-execution apps/desktop/extensions/ai-sidebar/pit-proxy.test.js:8
LOW js-dynamic-code-execution packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW js-dynamic-code-execution packages/browser-core/src/automation/extract-script.test.ts:6
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:16
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:45
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:57
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:80
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:99
LOW js-dynamic-code-execution packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:62
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:101
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:47
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:170
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:216
LOW js-dynamic-code-execution packages/sdk/src/mcp/automate.test.ts:299
LOW secret-generic-api-key packages/storage/src/config.ts:51
LOW secret-generic-credential packages/storage/src/config.ts:51
LOW js-dynamic-code-execution services/api/src/store/scanner.test.ts:32

…and 1 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@sh1pt-actions-fleet
sh1pt-actions-fleet Bot merged commit d3f9d56 into main Nov 2, 2026
14 of 15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant