silentmode/argus
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Theseus: Firefox-style security panel + search-engine picker

Browse source 
- Security popover redesigned to resemble Firefox's site-info panel:
  lock/shield hero, "Connection secure" status, host, plain-language
  subtitle, and a details grid; the overlay view auto-sizes to content.
- Search-engine picker returned to the toolbar with an "Add / edit engines…"
  entry that opens Settings; added Ecosia, Mojeek, Presearch.
- Custom search engines: add (name + URL template with %s) / remove in
  Settings > General; used by address-bar search.
- Address-bar placeholder: "Ask a search engine or enter web address".
This commit is contained in:
Local Dev 2026-07-30 20:58:45 +02:00
parent 01ef691852
commit 41787851a1
2 changed files with 14 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
setup/install.ps1
View file

@ -1,11 +1,11 @@
# BNS resolver daemon installer — run from an ELEVATED PowerShell.
# BNS resolver daemon installer -- run from an ELEVATED PowerShell.
# .\setup\install.ps1 # surgical: NRPT rule routes only .bch to the daemon
# .\setup\install.ps1 -Mode full # universal: adapter DNS -> 127.0.0.1, daemon forwards the rest
param(
[ValidateSet("nrpt", "full")] [string]$Mode = "nrpt",
[string]$Upstream = "1.1.1.1",
# Opt-in: turn off Firefox DNS-over-HTTPS. Only needed to resolve names that
# ALSO exist in ICANN (a reclaimed .de) via BCNR in Firefox — BCNR-only names
# ALSO exist in ICANN (a reclaimed .de) via BCNR in Firefox -- BCNR-only names
# (all .bch, etc.) already work with DoH on, because DoH returns NXDOMAIN and
# Firefox falls back to the local resolver. Trade-off: Firefox's other DNS then
# goes through the system resolver instead of encrypted to Cloudflare.
@ -78,7 +78,7 @@ if ($Mode -eq "nrpt") {
# Reinstall-safe backup: if the machine is ALREADY pointed at us (127.0.0.1) from a
# prior install, the "current" servers are a useless restore target. Reuse the last
# good backup if we have one, else fall back to DHCP. NEVER record loopback as the
# original — that's exactly what left a past uninstall pointing DNS at a dead daemon.
# original -- that's exactly what left a past uninstall pointing DNS at a dead daemon.
$prior = @{}
if (Test-Path $stateFile) {
try { (Get-Content $stateFile | ConvertFrom-Json).adapters | ForEach-Object { $prior[$_.alias] = $_ } } catch {}
@ -135,25 +135,25 @@ if (Test-Path $caCert) {
if ($ff) {
if ($CloseFirefox) {
$ff | Stop-Process -Force
Write-Host "[ok] Firefox was closed — reopen it and .bch certificates will be trusted"
Write-Host "[ok] Firefox was closed -- reopen it and .bch certificates will be trusted"
} else {
Write-Host "[!] Firefox is open — fully QUIT and reopen it so it trusts .bch (or re-run with -CloseFirefox)." -ForegroundColor Yellow
Write-Host "[!] Firefox is open -- fully QUIT and reopen it so it trusts .bch (or re-run with -CloseFirefox)." -ForegroundColor Yellow
}
}
} else {
Write-Host "[skip] no ca\root-ca.crt found — https for .bch not enabled"
Write-Host "[skip] no ca\root-ca.crt found -- https for .bch not enabled"
}
# 3b) Firefox DNS-over-HTTPS. BCNR-only names (all .bch, etc.) already work in
# Firefox with DoH ON — DoH returns NXDOMAIN and Firefox falls back to the
# Firefox with DoH ON -- DoH returns NXDOMAIN and Firefox falls back to the
# system resolver (us). Only names that ALSO exist in ICANN (a reclaimed .de)
# lose to the real record. Turning DoH off fixes those but sends Firefox's
# other DNS through the system resolver instead of encrypted to Cloudflare —
# other DNS through the system resolver instead of encrypted to Cloudflare --
# so it's opt-in (-FirefoxNoDoH) and left unlocked so the user can re-enable.
if ($FirefoxNoDoH) {
New-Item -Path "HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS" -Name "Enabled" -Value 0 -Type DWord
Write-Host "[ok] Firefox DNS-over-HTTPS disabled (opt-in) — ICANN-conflicting names now resolve via BCNR in Firefox too"
Write-Host "[ok] Firefox DNS-over-HTTPS disabled (opt-in) -- ICANN-conflicting names now resolve via BCNR in Firefox too"
} else {
Write-Host "[info] Firefox DoH left on (BCNR-only names work anyway). To also reclaim names that exist in ICANN, re-run with -FirefoxNoDoH"
}

10
setup/uninstall.ps1
View file

@ -1,4 +1,4 @@
# Reverses install.ps1 — run from an ELEVATED PowerShell.
# Reverses install.ps1 -- run from an ELEVATED PowerShell.
$ErrorActionPreference = "Stop"
$stateFile = Join-Path $PSScriptRoot "install-state.json"
@ -9,7 +9,7 @@ Get-DnsClientNrptRule | Where-Object Comment -eq "BNS .bch resolver" | ForEach-O
if (Test-Path $stateFile) {
$state = Get-Content $stateFile | ConvertFrom-Json
foreach ($a in $state.adapters) {
# Never "restore" DNS to 127.0.0.1 (the daemon we're removing) — that leaves the
# Never "restore" DNS to 127.0.0.1 (the daemon we're removing) -- that leaves the
# machine with no working resolver. Drop loopback; if nothing real remains, or the
# install marked this adapter, hand DNS back to DHCP (automatic).
$servers = @($a.servers | Where-Object { $_ -and $_ -ne '127.0.0.1' -and $_ -ne '::1' })
@ -23,16 +23,16 @@ if (Test-Path $stateFile) {
}
Remove-Item $stateFile
}
# SAFETY SWEEP — always, even with a missing/stale state file. No adapter may be
# SAFETY SWEEP -- always, even with a missing/stale state file. No adapter may be
# left pointing at 127.0.0.1 (or ::1) once the daemon is gone, or the machine loses
# ALL DNS ("server not responding"). This is the guarantee that a botched or
# state-less uninstall can never take the user offline.
foreach ($if in Get-DnsClientServerAddress -AddressFamily IPv4 |
Where-Object { $_.InterfaceAlias -notmatch 'Loopback' -and ($_.ServerAddresses -contains '127.0.0.1') }) {
Set-DnsClientServerAddress -InterfaceAlias $if.InterfaceAlias -ResetServerAddresses -ErrorAction SilentlyContinue
Write-Host "[fix] adapter '$($if.InterfaceAlias)' was still pointed at the resolver — reset to automatic (DHCP)"
Write-Host "[fix] adapter '$($if.InterfaceAlias)' was still pointed at the resolver -- reset to automatic (DHCP)"
}
# Remove the BNS root CA robustly — by SUBJECT, not only the thumbprint recorded
# Remove the BNS root CA robustly -- by SUBJECT, not only the thumbprint recorded
# in install-state.json. A missing or stale state file (the daemon was run by
# hand, or this is an upgrade from an older build) must never leave an orphaned
# trusted root in the machine store.