feat(tor): default Tor OFF on launch + auto-enable on .onion (v3.2.11)

- Tor now defaults OFF on every fresh browser start (onStartup → disableTor).
  Removed the re-apply-on-wake that auto-resumed Tor after a restart — pointing
  at a daemon that isn't running yet, which also broke browsing. Within a
  session the proxy persists across SW restarts on its own.
- Auto-enable Tor when navigating to a .onion host (webNavigation): start Tor,
  wait for the circuit, set the proxy, then reload the page now that it routes.
  Adds the webNavigation permission.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ralyodio

apps/desktop/extensions/ai-sidebar/background.js

@@ -194,11 +194,31 @@ chrome.runtime.onMessage.addListener((msg, _sender, sendResponse) => {
   }
 });
 
-// Re-apply the proxy when the service worker wakes if Tor was left on (extension
-// proxy settings don't always survive a browser restart). Idempotent.
-(async () => {
-  try {
-    const { torEnabled } = await chrome.storage.local.get('torEnabled');
-    if (torEnabled) await enableTor();
-  } catch (_) { /* best effort */ }
-})();
+// Tor defaults OFF on every fresh browser start. Nobody should be routed through
+// Tor unless they ask — and the daemon isn't running yet at launch, so a
+// left-over proxy would just break browsing. (Within a session the proxy is a
+// persisted setting, so Tor stays on across service-worker restarts on its own.)
+chrome.runtime.onStartup.addListener(() => {
+  disableTor().catch(() => {});
+});
+
+// Auto-enable Tor when navigating to a .onion site — those only resolve through
+// Tor. Turn it on, wait for the circuit, then reload the page now that we route.
+chrome.webNavigation.onBeforeNavigate.addListener(async (details) => {
+  if (details.frameId !== 0) return; // top-level navigations only
+  let host;
+  try { host = new URL(details.url).hostname; } catch (_) { return; }
+  if (!host.endsWith('.onion')) return;
+
+  const { torEnabled } = await chrome.storage.local.get('torEnabled');
+  if (torEnabled) return; // already routing through Tor
+
+  const started = await startTorViaHelper();
+  if (started.error === 'unreachable' || started.error === 'tor-not-installed') return;
+  const result = await waitForTor(() => {});
+  if (result.ready) {
+    await enableTor();
+    // Re-issue the navigation now that traffic routes through Tor.
+    try { await chrome.tabs.update(details.tabId, { url: details.url }); } catch (_) { /* tab gone */ }
+  }
+});

apps/desktop/extensions/ai-sidebar/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "TronBrowser",
-  "version": "3.2.10",
+  "version": "3.2.11",
   "description": "TronBrowser — privacy-first, AI-native. Branded new tab, private search, CoinPay login, and a bring-your-own-keys AI sidebar.",
   "icons": {
     "16": "icons/icon-16.png",
@@ -17,7 +17,8 @@
     "scripting",
     "identity",
     "proxy",
-    "privacy"
+    "privacy",
+    "webNavigation"
   ],
   "host_permissions": [
     "https://api.openai.com/*",

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tronbrowser/desktop",
-  "version": "3.2.10",
+  "version": "3.2.11",
   "private": true,
   "description": "Desktop shell for the TronBrowser Chromium fork",
   "type": "module",

apps/docs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tronbrowser/docs",
-  "version": "3.2.10",
+  "version": "3.2.11",
   "private": true,
   "description": "Documentation site",
   "type": "module",

apps/extensions/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tronbrowser/extensions",
-  "version": "3.2.10",
+  "version": "3.2.11",
   "private": true,
   "description": "TronBrowser extension store — pay $1, list your MV3 extension (tronbrowser.dev/store)",
   "type": "module",

apps/mobile/app.json

@@ -4,7 +4,7 @@
     "slug": "tronbrowserdev",
     "owner": "profullstack",
     "scheme": "tronbrowser",
-    "version": "3.2.10",
+    "version": "3.2.11",
     "orientation": "portrait",
     "userInterfaceStyle": "dark",
     "platforms": [

apps/mobile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tronbrowser/mobile",
-  "version": "3.2.10",
+  "version": "3.2.11",
   "private": true,
   "description": "TronBrowser mobile (Expo / React Native) — Phase 2",
   "type": "module",

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tronbrowser/web",
-  "version": "3.2.10",
+  "version": "3.2.11",
   "private": true,
   "description": "TronBrowser marketing site + web dashboard",
   "type": "module",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "tronbrowser",
-  "version": "3.2.10",
+  "version": "3.2.11",
   "private": true,
   "description": "TronBrowser.dev — open-source, privacy-first, AI-native browser",
   "packageManager": "pnpm@9.12.0",

packages/agent-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tronbrowser/agent-runtime",
-  "version": "3.2.10",
+  "version": "3.2.11",
   "private": true,
   "description": "Agent runtime: planner, executor, validator, memory, tools",
   "type": "module",