Skip to content

tron pwa search / install: pwamart.com listings as TronBrowser app windows - #136

Merged
ralyodio merged 2 commits into
mainfrom
feat/pwa-install-pwamart
Oct 6, 2026
Merged

ralyodio merged 2 commits into
mainfrom
feat/pwa-install-pwamart

Conversation

@ralyodio

@ralyodio ralyodio commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

Integrates TronBrowser with https://pwamart.com, the new app store for web apps.

  • tron pwa search <q>: search the store.
  • tron pwa install <slug|https-url>: resolve the listing's start URL and open it through the launcher with --app (extensions, GPU mode and window class apply). Install in the address bar then keeps it; sync repoints its icon as usual. Counts the install as tron on pwamart.
  • Only https URLs launch; --dry-run prints the command and counts nothing.
  • pwamart's details pages and CLI already detect TronBrowser and use tron --app.

Tests: test/pwa-install.test.ts (3) + existing pwa.test.ts (24) pass.

🤖 Generated with Claude Code

…ndows

tron pwa install <slug|https-url> resolves a pwamart.com listing to its start URL
and opens it through the launcher with --app, so the window gets the extensions,
GPU mode and class every other TronBrowser window has; the icon Install writes is
then repointed by sync as before. Only https URLs launch; a dry run prints the
command and counts nothing. PWAMART_URL points it at another store.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Comment thread apps/desktop/launcher/tron-pwa Fixed
@github-actions

github-actions Bot commented Oct 6, 2026 •

Copy link
Copy Markdown
Contributor

ThreatCrush Security Scan

52 finding(s)

HIGH/CRITICAL: 3 | MEDIUM: 28 | LOW: 21

Severity Rule Location
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:303
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:437
HIGH sh-remote-script-execution apps/web/public/install.sh:882
MEDIUM js-open-redirect apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:237
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:266
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:336
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/options.js:306
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:78
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:166
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:77
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:227
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:569
MEDIUM js-unescaped-html-sink apps/web/public/app.js:29
MEDIUM js-unescaped-html-sink apps/web/public/dns.js:54
MEDIUM sh-remote-script-execution apps/web/public/install.sh:167
MEDIUM sh-remote-script-execution apps/web/public/install.sh:172
MEDIUM sh-remote-script-execution apps/web/public/install.sh:407
MEDIUM sh-remote-script-execution apps/web/public/install.sh:425
MEDIUM sh-remote-script-execution apps/web/public/install.sh:938
MEDIUM sh-remote-script-execution apps/web/public/install.sh:989
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:96
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:168
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:125
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:68
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:73
MEDIUM sql-template-interpolation services/api/src/store/db.ts:116
MEDIUM js-dynamic-code-execution services/api/src/store/scanner.ts:44
MEDIUM sh-predictable-temp-path start.sh:25
LOW js-dynamic-code-execution apps/desktop/extensions/ai-sidebar/pit-proxy.test.js:8
LOW js-dynamic-code-execution packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW js-dynamic-code-execution packages/browser-core/src/automation/extract-script.test.ts:6
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:16
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:45
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:57
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:80
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:99
LOW js-dynamic-code-execution packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:62
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:101
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:47
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:170
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:216
LOW js-dynamic-code-execution packages/sdk/src/mcp/automate.test.ts:261
LOW secret-generic-api-key packages/storage/src/config.ts:51
LOW secret-generic-credential packages/storage/src/config.ts:51

…and 2 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

A hostile or mistyped PWAMART_URL could otherwise point the helper at internal
URLs. The two store requests carry a ThreatCrush suppression naming why.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio

ralyodio commented Oct 6, 2026

Copy link
Copy Markdown
Contributor Author

The one red check, windows-browser (Network helper regression tests), is not this change: the Windows Pit acceptance test loads http://mosh.eggs/, and moshcode dns resolve mosh.eggs currently answers parked: claimed but not pointed at an IP, so the page never loads (timeout on page.goto). The workflow only runs for launcher changes, which is why #134/#135 did not hit it. Re-pointing mosh.eggs (or giving the test its own fixture name) should turn it green; everything else, including ThreatCrush, passes.

@ralyodio
ralyodio merged commit 7cfeaa0 into main Oct 6, 2026
16 of 18 checks passed
@ralyodio
ralyodio deleted the feat/pwa-install-pwamart branch October 6, 2026 11:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants