Skip to content

w3bs://chovy.hacker opens chovy.hacker itself when Pit is on - #160

Merged
ralyodio merged 1 commit into
mainfrom
feat/w3bs-pit-direct
Oct 20, 2026
Merged

ralyodio merged 1 commit into
mainfrom
feat/w3bs-pit-direct

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

With Moshpit (Pit) on, typing w3bs://chovy.hacker landed on the pit.world gateway (chovy.hacker.pit.world), but Moshpit names resolve in the browser, so it should open https://chovy.hacker/.

While pitEnabled is set, session declarativeNetRequest rules (PIT_DIRECT_RULES, kept in step with the toggle through storage.onChanged) send a search for w3bs://<name>, or the hop to w3bs.org/browse that the search redirects to, straight to https://<name>/. The tab watcher does the same for searches served from prefetch. Resource URIs and paths still go through the resolver. Pit off is unchanged.

Real Chromium with the extension loaded:

  • Pit on: pit.world/search?q=w3bs%3A%2F%2Fchovy.hacker → https://chovy.hacker/
  • Pit off: pit.world/search… → w3bs.org/browse… → https://chovy.hacker.pit.world/

vitest: 163 pass, with new tests that apply PIT_DIRECT_RULES itself.

Keeping w3bs:// in the address bar is not possible here: it needs a scheme handler in the Chromium engine itself.

🤖 Generated with Claude Code

With Pit on, Moshpit names resolve in this browser, so there is no reason to
land on the pit.world gateway. While pitEnabled, session declarativeNetRequest
rules send a search for w3bs://<name>, or the hop to w3bs.org/browse it
redirects to, straight to https://<name>/; the tab watcher does the same for
prefetched searches. Pit off is unchanged. Chromium cannot keep w3bs:// in the
address bar: that needs a scheme handler in the engine itself.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

/** https://chovy.hacker/path for w3bs://chovy.hacker/path (a dotted authority is a site); else null. */
export function w3bsSiteUrl(input) {
const m = /^w3bs:\/\/([a-z0-9-]+(?:\.[a-z0-9-]+)+)(\/\S*)?$/i.exec(String(input ?? '').trim());
@github-actions

Copy link
Copy Markdown
Contributor

ThreatCrush Security Scan

49 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 26 | LOW: 21

Severity Rule Location
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:303
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:437
MEDIUM js-open-redirect apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:246
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:275
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:345
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/options.js:306
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:78
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:166
MEDIUM redos-nested-quantifier apps/desktop/extensions/ai-sidebar/w3bs.js:17
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:77
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:227
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:569
MEDIUM js-unescaped-html-sink apps/web/public/app.js:29
MEDIUM js-unescaped-html-sink apps/web/public/dns.js:54
MEDIUM sh-remote-script-execution apps/web/public/install.sh:182
MEDIUM sh-remote-script-execution apps/web/public/install.sh:422
MEDIUM sh-remote-script-execution apps/web/public/install.sh:440
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:96
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:168
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:125
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:68
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:73
MEDIUM sql-template-interpolation services/api/src/store/db.ts:116
MEDIUM js-dynamic-code-execution services/api/src/store/scanner.ts:44
MEDIUM sh-predictable-temp-path start.sh:28
LOW js-dynamic-code-execution apps/desktop/extensions/ai-sidebar/pit-proxy.test.js:8
LOW js-dynamic-code-execution packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW js-dynamic-code-execution packages/browser-core/src/automation/extract-script.test.ts:6
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:16
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:45
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:57
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:80
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:99
LOW js-dynamic-code-execution packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:62
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:101
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:47
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:170
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:216
LOW js-dynamic-code-execution packages/sdk/src/mcp/automate.test.ts:261
LOW secret-generic-api-key packages/storage/src/config.ts:51
LOW secret-generic-credential packages/storage/src/config.ts:51
LOW js-dynamic-code-execution services/api/src/store/scanner.test.ts:32
LOW js-hardcoded-crypto-key services/api/src/store/signing.test.ts:24

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 2ddbccb into main Oct 20, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants