Skip to content

feat(search): pit.world is the default search (address bar + new tab) - #141

Merged
ralyodio merged 1 commit into
mainfrom
feat/pit-world-default-search
Oct 17, 2026
Merged

ralyodio merged 1 commit into
mainfrom
feat/pit-world-default-search

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Makes pit.world TronBrowser's default search: no logs, no cookies, no account, and it resolves Moshpit names (pairs with the 🤘 Pit toggle).

  • Address bar (launcher): new pit engine, default for fresh profiles. Profiles still on the launcher's previous default (DuckDuckGo) move on next launch; a user's own engine or an explicit tron search ddg is left alone (existing guard). Still no suggestions URL.
  • tron search: pit listed first, reported as default (CLI heredoc extracted and sh -n-checked).
  • New tab + options + tronbrowser.dev settings: pit.world option, default when unset.
  • Mobile: plain-text searches go to pit.world.
  • Tests: desktop 148, web 20, mobile 174 pass; two new launcher tests for the migration and the explicit-ddg case.

Ships as v3.17.0 after merge (install.sh deploys from main; the launcher rides the tagged release).

🤖 Generated with Claude Code

pit.world keeps no logs or cookies, works without an account, and resolves
Moshpit names, which pairs with the Pit toggle.

- Launcher: new `pit` engine and the new default for the address bar. A
  profile still on our previous default (ddg, set by the launcher) moves to
  pit.world on next launch; an engine the user picked, or an explicit
  `tron search ddg`, is left alone (existing guard). No suggestions URL.
- `tron search`: pit is listed first and reported as the default.
- New tab (extension), options page and tronbrowser.dev settings: pit.world
  option, default when nothing was chosen.
- Mobile: plain-text searches go to pit.world.
- Tests updated, plus two for the ddg -> pit migration and the explicit-ddg case.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

ThreatCrush Security Scan

48 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 25 | LOW: 21

Severity Rule Location
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:303
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:437
MEDIUM js-open-redirect apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:239
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:268
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:338
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/options.js:306
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:78
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:166
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:77
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:227
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:569
MEDIUM js-unescaped-html-sink apps/web/public/app.js:29
MEDIUM js-unescaped-html-sink apps/web/public/dns.js:54
MEDIUM sh-remote-script-execution apps/web/public/install.sh:167
MEDIUM sh-remote-script-execution apps/web/public/install.sh:407
MEDIUM sh-remote-script-execution apps/web/public/install.sh:425
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:96
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:168
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:125
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:68
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:73
MEDIUM sql-template-interpolation services/api/src/store/db.ts:116
MEDIUM js-dynamic-code-execution services/api/src/store/scanner.ts:44
MEDIUM sh-predictable-temp-path start.sh:25
LOW js-dynamic-code-execution apps/desktop/extensions/ai-sidebar/pit-proxy.test.js:8
LOW js-dynamic-code-execution packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW js-dynamic-code-execution packages/browser-core/src/automation/extract-script.test.ts:6
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:16
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:45
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:57
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:80
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:99
LOW js-dynamic-code-execution packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:62
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:101
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:47
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:170
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:216
LOW js-dynamic-code-execution packages/sdk/src/mcp/automate.test.ts:261
LOW secret-generic-api-key packages/storage/src/config.ts:51
LOW secret-generic-credential packages/storage/src/config.ts:51
LOW js-dynamic-code-execution services/api/src/store/scanner.test.ts:32
LOW js-hardcoded-crypto-key services/api/src/store/signing.test.ts:24

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit e9e53ba into main Oct 17, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant