TronBrowser's own Web Push service (a setting, defaulting to tronbrowser.dev) - #120
Merged
Merged
Conversation
ungoogled-chromium ships without a push service and a page cannot choose one, so pushManager.subscribe() failed on every site with 'Registration failed - push service error' (reproduced in the bundled 152 engine). - services/api: an RFC 8030 push service at /api/1/push. Site servers send standard aes128gcm + VAPID pushes (the sender's key must match the one the site subscribed with); ciphertext is queued until the browser acks it and delivered live over a WebSocket. 404/410/413/415/429 as senders expect. - extension: push-page.js (MAIN world) replaces PushManager.subscribe / getSubscription / permissionState; push-client.js holds the subscription keys, registers, decrypts (RFC 8291, WebCrypto) and shows the notification. - setting: Settings -> Push notifications. Default tronbrowser.dev, any compatible https URL (checked against GET / first), or off (engine's own). - /push docs page, privacy entry, migration 0007. Verified end to end in the real engine: subscribe returns a PushSubscription, a real sendPush gets 201, the notification is created with its click URL and the message is acked over the socket within 3s. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Contributor
ThreatCrush Security Scan52 finding(s) HIGH/CRITICAL: 3 | MEDIUM: 28 | LOW: 21
…and 2 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
ungoogled-chromium ships without a push service, and a page can't pick one, so in TronBrowser
pushManager.subscribe()fails on every site withRegistration failed - push service error(reported on agenticjobs.work, reproduced in the bundled 152 engine).What
services/api/src/push, mounted at/api/1/push): standard RFC 8030 receive endpoint. Site servers send the same aes128gcm + VAPID requests they send to FCM/Mozilla (the VAPID key must match the one the site subscribed with). Ciphertext is queued until the browser acks, and delivered live over a WebSocket (@hono/node-ws). It answers 404/410 for gone subscriptions, plus 400/413/415/429.push-page.js(MAIN world, document_start) replacesPushManager.subscribe/getSubscription/permissionState, andpush-bridge.jsrelays page ↔ background.push-client.jsholds the subscription keys, registers, decrypts (RFC 8291, WebCrypto only) and shows it withchrome.notifications; a click opensurl. Adds thealarmspermission (1-minute catch-up poll) andcontentSettings(a site you later block stays silent).GET /before switching), or off, which gives the engine's own behaviour.0007_push.sql, a/pushdocs page, and a privacy entry.Limit: an extension can't fire a site's service-worker
pushevent, so TronBrowser renders the payload (title/body/icon/url,notification.*). Silent data-only pushes show as plain notifications.Verified
services/apipush tests: 13/13 pass. They use a real@profullstack/notificationssender and the extension's own decryptor, covering key mismatch → 403, TTL/encoding/size, Topic replace, 404/410.AbortError: Registration failed - push service error.subscribereturns a real-lookingPushSubscription(instanceofholds,getSubscriptionreturns the same one, stategranted).sendPushgets 201, the notification is created with its click URL, and the message is acked over the socket within 3s.src/mcp/tron.test.tscan't load locally in a fresh worktree because@tronbrowser/browser-coreis unbuilt. That's unrelated to push.🤖 Generated with Claude Code