Skip to content

pit.world global footer + trimmed site footer - #146

Merged
ralyodio merged 1 commit into
mainfrom
pit-footer
Oct 19, 2026
Merged

ralyodio merged 1 commit into
mainfrom
pit-footer

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

tronbrowser.dev is static HTML served by Caddy, so the global footer is injected at runtime by a small Bun process rather than at build time: scripts/pit-footer.mjs (started from start.sh) fetches pit.world/snippets/footer.html?site=tronbrowser.dev at boot and every hour (3s timeout) and writes it into a <!--pit-footer--><!--/pit-footer--> slot placed just before </body> on every page (site + /store). Writes are atomic (temp + rename); on any failure the last good copy (or nothing) stays. Local dev just shows the empty comment.

  • Home footer: one row (copyright, Store, Sign in, Privacy, GitHub, Releases). Dropped the @profullstack/footer embed.js + webring.
  • Store footers: dropped the trailing tagline.
  • Standing rule: the CrawlProof text-link ad that was the last thing above the footer moved to the top of <main> (page's only unit).
  • CSP already has style-src 'self' 'unsafe-inline', no change needed.
  • No version bump: the repo version is the browser release (tag-driven), not the site.

web tests pass; injector verified against a copy of the built /srv tree (idempotent, one footer per page).

🤖 Generated with Claude Code

The site is static HTML behind Caddy, so a small Bun process
(scripts/pit-footer.mjs, started by start.sh) fetches
https://pit.world/snippets/footer.html?site=tronbrowser.dev at boot and
hourly (3s timeout) and writes it into a <!--pit-footer--> slot before
</body> on every page. Failure keeps the last good copy, or nothing.

Home footer is one row: copyright, Store, Sign in, Privacy, GitHub,
Releases; dropped the @profullstack/footer embed and its webring. Store
footers lose the trailing tagline. The CrawlProof text-link unit that sat
directly above the footer now sits at the top of main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

ThreatCrush Security Scan

48 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 25 | LOW: 21

Severity Rule Location
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:303
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:437
MEDIUM js-open-redirect apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:239
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:268
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:338
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/options.js:306
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:78
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:166
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:77
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:227
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:569
MEDIUM js-unescaped-html-sink apps/web/public/app.js:29
MEDIUM js-unescaped-html-sink apps/web/public/dns.js:54
MEDIUM sh-remote-script-execution apps/web/public/install.sh:167
MEDIUM sh-remote-script-execution apps/web/public/install.sh:407
MEDIUM sh-remote-script-execution apps/web/public/install.sh:425
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:96
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:168
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:125
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:68
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:73
MEDIUM sql-template-interpolation services/api/src/store/db.ts:116
MEDIUM js-dynamic-code-execution services/api/src/store/scanner.ts:44
MEDIUM sh-predictable-temp-path start.sh:28
LOW js-dynamic-code-execution apps/desktop/extensions/ai-sidebar/pit-proxy.test.js:8
LOW js-dynamic-code-execution packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW js-dynamic-code-execution packages/browser-core/src/automation/extract-script.test.ts:6
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:16
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:45
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:57
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:80
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:99
LOW js-dynamic-code-execution packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:62
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:101
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:47
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:170
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:216
LOW js-dynamic-code-execution packages/sdk/src/mcp/automate.test.ts:261
LOW secret-generic-api-key packages/storage/src/config.ts:51
LOW secret-generic-credential packages/storage/src/config.ts:51
LOW js-dynamic-code-execution services/api/src/store/scanner.test.ts:32
LOW js-hardcoded-crypto-key services/api/src/store/signing.test.ts:24

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 059056b into main Oct 19, 2026
8 checks passed
ralyodio added a commit that referenced this pull request Oct 19, 2026
The pit.world footer sweep (#146) replaced the baked @profullstack/footer
block with a plain row, so the homepage stopped linking the ring and
rssamplifier's verifier lost the site. Bake the current 0.2.4 markup back
in (links, ring, the one copyright line) with embed.js for @latest
updates. The pit.world footer slot stays last in <body>.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant