noraneko · drops

dl.f3liz.casa/drop を読んでいます

newtab-hello

newtab に、drop から来ていることが目で分かる一行を足す(左下に名前と版と、この session で開いた回数)。それ以外は built-in と同じ

uuid df3b5c71-39cf-4abe-b7ba-01fe966e58d0

install

Press inside noraneko. It catches the link, opens its settings with this uuid, downloads the xpi, checks the sha256 and the registry's signature, and shows you everything below again before anything runs.

install in noraneko In another browser this is a plain link to the xpi. Stock Firefox will refuse it as unverified; paste the uuid into about:nora:settings in noraneko instead.

who

gh/nyanrus

what is served

newtab · about-newtab@noraneko.app · version 1.0.4 · 21914 bytes sha256 0f7ee3ca9ef4a0530a6af837aa30dfc30a07099675c91d30602a8030574c114a built from drops/newtab-hello/src @ 59b96c854c (2026-09-14T07:24:00Z) served at https://dl.f3liz.casa/drop/df3b5c71-39cf-4abe-b7ba-01fe966e58d0/

in the registry

drops/newtab-hello/ @ 59b96c854c — この版が出てきた木 actors: newtab

the source, as it is

These come from source.json next to the manifest — the same text the xpi carries under source/, and dl checks its sha256 against the signed manifest before handing it over. Not a copy of the repository: what you read and what runs came out of the same build. 4 files; press one to open it.

_shared/defineActor.ts · 118 lines
// SPDX-License-Identifier: MPL-2.0

// Authoring surface for an "actor": a small xpi whose page side is a
// JSWindowActor (the same shape as Firefox's own about:newtab add-on). Each
// actor lives in one file that exports three things by name:
//
//   export const meta    = { id, namespace, matches, ... };
//   export const parent  = defineParent({ method(...) { ... } });  // main process (JSWindowActorParent)
//   export const content = defineContent((parent, ctx) => { ... }); // page side (run by JSWindowActorChild)
//
// The page side is NOT a WebExtension content script: content scripts are not
// injected into about:* / chrome:* documents in stock Firefox (see README,
// "addon 式が駄目だった理由"). The child actor loads content.js into the page's
// process with `window` / `document` on the scope chain, so the hook is written
// the same way, but it runs with the child actor's privileges.
//
// Named exports (rather than one nested object) are deliberate: the build
// bundles `parent` and `content` into separate outputs, and named exports let
// the bundler tree-shake each side so the content bundle never drags in the
// parent's privileged code and vice versa.
//
// IMPORTANT: the module top level must be pure. Reference Firefox globals
// (Services, ChromeUtils, window, exportFunction, browser) only *inside* method
// or hook bodies — the build imports this file under Deno to read `meta`, and
// top-level use of those globals would throw there.

export interface ActorMeta {
  /** Extension id, e.g. "settings-bridge@noraneko.app". */
  id: string;
  /** Extension version. */
  version: string;
  /** Experiment-API namespace, e.g. "noraSettings". Also the message channel. */
  namespace: string;
  /** Match patterns for the pages the content hook runs in (JSWindowActor `matches`). */
  matches: string[];
  /**
   * When the content hook runs. Maps to a child actor event:
   * document_start → DOMDocElementInserted, document_end → DOMContentLoaded,
   * document_idle → load. Defaults to "document_end".
   */
  runAt?: "document_start" | "document_end" | "document_idle";
  /**
   * JSWindowActor name. Defaults to "Nora" + PascalCase(<dir>), e.g. NoraNewtab.
   * A drop with the same actor name replaces the built-in one (unregister → register).
   */
  actor?: string;
  /** Legacy JSActor (BrowserGlue) this one replaces; it is unregistered when this actor is registered. */
  replaces?: string;
}

import type { Io } from "./io.ts";

type ParentMethods = Record<string, (...args: any[]) => unknown>;

export interface ContentCtx {
  /** True in dev builds (import.meta.env.MODE === "dev"). */
  dev: boolean;
  /** Expose functions on the page window (via exportFunction). */
  expose(funcs: Record<string, (...args: any[]) => unknown>): void;
  /**
   * Run when this actor goes away in this window (the drop is removed or
   * replaced). Put back what the hook changed: DOM, observers, listeners.
   */
  onDestroy(fn: () => void): void;
  /**
   * Place things through these (DOM, styles, listeners, pref observers) and
   * they are taken out again by themselves: each verb puts its way back on
   * the same ledger as onDestroy.
   */
  io: Io;
  /** This actor's own files: `${ctx.base}ops/x.tsubaki` and the like. */
  base: string;
  /**
   * The actor's logic in Tsubaki (when it ships wasm/): run a .tsubaki file of
   * its own with load("ops/x.tsubaki"), then call(name, ...args). Values cross
   * as ordinary JS values; a Tsubaki error is a JS Error. undefined without wasm/.
   *
   * Every verb answers with a Promise, because for an actor of the browser
   * WINDOW the logic lives a process away (wasm can't compile in the parent
   * process, so it runs in a hidden page of this window instead). A drop never
   * has to know which side it got.
   */
  ops: Ops | undefined;
}

export interface Ops {
  ready: Promise<void>;
  call(name: string, ...args: unknown[]): Promise<unknown>;
}

/** Proxy to the parent methods; each call is forwarded to the main process. */
type ParentProxy<T extends ParentMethods> = {
  [K in keyof T]: (...args: Parameters<T[K]>) => Promise<Awaited<ReturnType<T[K]>>>;
};

export type ContentHook<T extends ParentMethods = ParentMethods> = (
  parent: ParentProxy<T>,
  ctx: ContentCtx,
) => void;

// Identity helpers that pin types for authoring:
//
//   export const parent  = defineParent({ method(...) { ... } });
//   export const content = defineContent<typeof parent>((parent, ctx) => { ... });
//
// They are listed in the build's treeshake.manualPureFunctions, so an unused
// call (e.g. defineContent in the parent bundle) is dropped along with anything
// it references (birpc). Without that, the bundler would keep the call for its
// possible side effects and the unused side would not tree-shake.

/** Pins the parent-method types so the content hook's proxy is typed. */
export const defineParent = <T extends ParentMethods>(methods: T): T => methods;

/** Pins the content hook against the parent's method types. */
export const defineContent = <T extends ParentMethods>(
  hook: ContentHook<T>,
): ContentHook<T> => hook;
newtab/actor.ts · 77 lines
// SPDX-License-Identifier: MPL-2.0

// newtab-hello: built-in の newtab actor(Activity Stream のデータを新しいタブに渡す)に、
// 「この新しいタブは drop から来ている」と目で分かる一行を足したもの。
//
// 変わるところは二つだけ:
// - parent に opened() を足す。親プロセスで数える(この session で新しいタブを開いた回数)。
//   数が増えるのは、drop の actor.mjs が親で走っている証拠。
// - content で、ページの左下に小さく「drop newtab-hello · <版> · n 回目」を置く。
// データの取りかた(getData)は built-in と同じ。

import {
  defineContent,
  defineParent,
  type ActorMeta,
} from "../_shared/defineActor.ts";
import { h, mount } from "std";
import { Note } from "./ui/Note.tsx";

export const meta: ActorMeta = {
  id: "about-newtab@noraneko.app",
  version: "1.0.4",
  namespace: "noraNewTab",
  matches: ["about:home*", "about:welcome", "about:newtab*"],
  runAt: "document_start",
};

let opened = 0;

export const parent = defineParent({
  async getData(): Promise<{ topSites: unknown[]; highlights: unknown[] }> {
    try {
      const { NewTabUtils } = ChromeUtils.importESModule(
        "resource://gre/modules/NewTabUtils.sys.mjs",
      );
      const [topSites, highlights] = await Promise.all([
        NewTabUtils.activityStreamLinks.getTopSites({
          withFavicons: true,
          numItems: 16,
        }),
        NewTabUtils.activityStreamLinks.getHighlights({
          withFavicons: true,
          numItems: 16,
        }),
      ]);
      return { topSites: topSites ?? [], highlights: highlights ?? [] };
    } catch (e) {
      console.error("[noraneko] newtab: failed to load data:", e);
      return { topSites: [], highlights: [] };
    }
  },
  // この session で、新しいタブを開いた回数(親プロセスの変数。ブラウザを閉じると 0 に戻る)
  async opened(): Promise<number> {
    opened += 1;
    return opened;
  },
});

export const content = defineContent<typeof parent>((parent, ctx) => {
  // 置くのは ctx.io / ctx.ui を通す。drop を外したとき、この一行も listener も一緒に戻る
  ctx.io.listen(window, "DOMContentLoaded", async () => {
    const data = await parent.getData();
    window.dispatchEvent(
      new window.CustomEvent("noranekoNewtabData", { detail: data }),
    );

    const n = await parent.opened();
    // the words come from ops/hello.tsubaki (Tsubaki, in std-tsubaki-runtime's wasm); the view only shows them
    await ctx.ops!.load("ops/hello.tsubaki");
    const text = (await ctx.ops!.call("greet", "newtab-hello", meta.version, n)) as string;
    mount(ctx.io, h(Note, { text }), {
      parent: document.body,
      tag: "html:div",
    });
  });
});
newtab/ops/hello.tsubaki · 5 lines
# newtab-hello の logic。JS の view はこれを呼ぶだけ。
# (Tsubaki: Julia の書き心地の小さな言語。build 無し、この file がそのまま xpi に入る。runtime は std-tsubaki-runtime)

greet(name, version, n) = "drop $name · $version · $n 回目"
newtab/ui/Note.tsx · 22 lines
// SPDX-License-Identifier: MPL-2.0
// 左下の一行。ページの中身には触らない(足すだけ)

export function Note(props: { text: string }) {
  return (
    <div
      style={{
        position: "fixed",
        left: "0.75rem",
        bottom: "0.6rem",
        font: "11px/1.4 system-ui, sans-serif",
        color: "#6a7180",
        opacity: 0.85,
        pointerEvents: "none",
        zIndex: 2147483647,
      }}
    >
      {props.text}
    </div>
  );
}

What a drop is, how it reaches you, and what it is not: f3liz.casa/noraneko/drops/. Served by https://dl.f3liz.casa/drop, signed by https://github.com/f3liz-casa/noraneko-registry/.github/workflows/verify-and-sign.yml@refs/heads/main.

This page is built when you ask for it, out of what https://dl.f3liz.casa/drop is serving right now (2026-09-23T08:38:28.032Z). Drafted by Shiro, an AI assistant, sitting next to nyanrus.