fix(desktop): start Windows Pit helper and gate HTTPS trust

[phucnguyen1707]

Summary

• Ship the missing network helper in the Windows ZIP and start it from tronbrowser.cmd using a validated Python interpreter. Readiness checks are bounded and proxy-free; ordinary browsing continues if helper startup fails.
• Refuse unknown/stale port owners without killing unrelated processes. Use exclusive Windows socket binding and restrict helper mutations to POST requests from non-web clients or extension origins with literal loopback Host headers.
• Offer a separate, explicitly confirmed Windows HTTPS setup for the existing registry CA. Its SHA-256 is pinned in code, download TLS remains verified, Windows validates the certificate, and nothing is imported automatically.
• Add an offline --remove-pit-https rollback: full SHA-256 selection, CurrentUser only, explicit REMOVE, native Windows confirmation, and verification that the root is no longer trusted.
• Add Linux/Windows regression CI plus real browser acceptance on a disposable Windows runner. Only that explicitly guarded acceptance job imports/removes the test root; ordinary unit tests do not.

Important Trust Boundary

The optional HTTPS setup installs the existing unconstrained Moshpit root into CurrentUser/Root. It can authenticate arbitrary names for applications using that user store; it is not browser-only trust and persists when Pit is off. Setup prints that warning and requires typing TRUST. No LocalMachine trust, DNS changes, TLS bypass, or silent root rotation. Managed machines should not run the setup without administrator approval.

Verification

• Desktop Vitest: 138/138 pass locally, including actual extension background-handler request-shape tests.
• Desktop ESLint and TypeScript: pass.
• Python helper suite: 34/34 on native Windows CI; 32 pass / 2 Windows-only skips on Linux.
• Windows/Linux and real-browser acceptance passes on da7b28d. Subsequent commit 7092646 only updates documentation.
• Actual loopback helper reuse, Pit start/stop, SOCKS/TLS relay, and rejection of an untrusted certificate exercised locally.
• Windows CI executes the native cmd launcher with spaced/punctuated paths and URL arguments, and inspects the pinned CA without modifying the Windows trust store.
• Official portable Ungoogled Chromium 153.0.8010.52 Windows x64 was tested in both headed and headless modes using the actual cmd launcher and extension.
• Four browser phases (32 recorded checks) verify fresh-session proxy reset, exact fallback PAC, ordinary HTTPS while Pit is on, HTTP Moshpit resolution, registry HTTPS rejected before trust, HTTPS 200/TLS 1.3 after real native consent (reused and fresh profiles), continued rejection of unrelated self-signed TLS, Pit off, and HTTPS rejection after supported offline removal.
• Native install/removal warning automation matches the exact inspected root thumbprint; it exists only in the explicitly opted-in disposable-runner harness. Production still requires user consent and Windows confirmation.
• cleanup.json confirms the exact test root was removed; helper ownership is checked by canonical script path before its process tree is stopped. Screenshots and TLS evidence are retained as CI artifacts.
• Independent Opus source review found no remaining product security/correctness blockers in its reviewed delta. Acceptance-harness findings were addressed and actual native CI, rather than the review alone, supplies runtime evidence.
• git diff --check: pass.

Remaining Boundaries

The native browser acceptance gate has now passed. This is evidence for the pinned x64 browser on the GitHub Windows image, not every consumer Windows version, ARM64 build, or managed-device policy. macOS trust behavior is not claimed. No company/developer-machine CA or DNS settings were changed. The broad root trust grant remains a disclosed product risk, not something passing tests removes.

Python 3.9+ is required (3.12+ recommended); the ZIP does not silently download/install Python. Loading the extension alone cannot start the helper. macOS certificate setup and the separate Rust/Web3 contract are out of scope.

[github-actions]

ThreatCrush Security Scan

56 finding(s)

HIGH/CRITICAL: 3 | MEDIUM: 33 | LOW: 20

Severity	Rule	Location
HIGH	py-ssrf-outbound-request	apps/desktop/launcher/tron-tor-helper:303
HIGH	py-ssrf-outbound-request	apps/desktop/launcher/tron-tor-helper:437
HIGH	sh-remote-script-execution	apps/web/public/install.sh:754
MEDIUM	js-open-redirect	apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/newtab.js:237
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/newtab.js:266
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/newtab.js:336
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/options.js:305
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/sidepanel.js:78
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/sidepanel.js:166
MEDIUM	sh-remote-script-execution	apps/desktop/launcher/tronbrowser:156
MEDIUM	sh-remote-script-execution	apps/desktop/launcher/tronbrowser:479
MEDIUM	js-unescaped-html-sink	apps/extensions/public/store.js:77
MEDIUM	js-unescaped-html-sink	apps/extensions/public/store.js:227
MEDIUM	js-unescaped-html-sink	apps/extensions/public/store.js:569
MEDIUM	js-unescaped-html-sink	apps/web/public/app.js:29
MEDIUM	js-unescaped-html-sink	apps/web/public/dns.js:54
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:161
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:166
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:279
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:297
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:810
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:861
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:1150
MEDIUM	js-unescaped-html-sink	apps/web/public/settings.js:96
MEDIUM	js-unescaped-html-sink	apps/web/public/settings.js:168
MEDIUM	js-dynamic-code-execution	packages/sdk/src/mcp/tools.ts:80
MEDIUM	js-dynamic-code-execution	packages/sdk/src/mcp/tools.ts:92
MEDIUM	js-dynamic-code-execution	packages/sdk/src/mcp/tools.ts:103
MEDIUM	js-dynamic-code-execution	packages/sdk/src/page.ts:65
MEDIUM	js-dynamic-code-execution	packages/sdk/src/page.ts:70
MEDIUM	sql-template-interpolation	services/api/src/store/db.ts:116
MEDIUM	js-dynamic-code-execution	services/api/src/store/scanner.ts:44
MEDIUM	sh-predictable-temp-path	start.sh:25
LOW	js-dynamic-code-execution	apps/desktop/extensions/ai-sidebar/pit-proxy.test.js:8
LOW	js-dynamic-code-execution	packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW	js-unescaped-html-sink	packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW	js-unescaped-html-sink	packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW	js-dynamic-code-execution	packages/browser-core/src/automation/extract-script.test.ts:6
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:35
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:47
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:70
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:89
LOW	js-dynamic-code-execution	packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/snapshot-script.test.ts:24
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/snapshot-script.test.ts:63
LOW	js-unescaped-html-sink	packages/provenance/src/scan.test.ts:47
LOW	js-unescaped-html-sink	packages/provenance/src/scan.test.ts:170

…and 6 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	playwright-core@​1.63.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm playwright-core under ms-azure-data-studio License: ms-azure-data-studio - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) From: apps/desktop/test/browser-driver/package-lock.json → npm/playwright-core@1.63.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright-core@1.63.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report