bearstart: port the native shell's branded start page into the Gecko build

scripts/apply-sourceos-overlays.sh

@@ -363,12 +363,27 @@ if [ -f "$profile_dir/user.js" ]; then
   echo "settings: injected $profile user.js -> source/settings/bearbrowser.cfg (autoconfig)"
 fi
 
+# BearStart new-tab wiring: append the privileged autoconfig JS that points
+# AboutNewTab at resource:///bearstart/bearbrowser-start.html. There is no pref
+# for the new-tab URL — this is the supported enterprise/autoconfig mechanism.
+# Requires general.config.sandbox_enabled=false (set below).
+if [ -f "$repo_root/settings/start/bearstart-autoconfig.js" ] && \
+   [ -f "$workspace/source/settings/bearbrowser.cfg" ]; then
+  cat "$repo_root/settings/start/bearstart-autoconfig.js" \
+    >> "$workspace/source/settings/bearbrowser.cfg"
+  echo "settings: appended bearstart-autoconfig.js -> bearbrowser.cfg (new-tab wiring)"
+fi
+
 # The autoconfig wiring: tell Firefox to load bearbrowser.cfg as the lockable
 # config file. obscure_value 0 means the .cfg is plain text (not byte-shifted).
+# sandbox_enabled=false lets the cfg run privileged JS (the BearStart new-tab
+# override) — the cfg is our own file baked into the package, same trust level
+# as the binary itself (LibreWolf ships its cfg the same way).
 cat > "$inject_pref/local-settings.js" <<'EOF_LOCALSETTINGS'
 // BearBrowser autoconfig wiring — generated by apply-sourceos-overlays.sh
 pref("general.config.obscure_value", 0);
 pref("general.config.filename", "bearbrowser.cfg");
+pref("general.config.sandbox_enabled", false);
 EOF_LOCALSETTINGS
 echo "settings: wrote autoconfig wiring -> source/settings/defaults/pref/local-settings.js"
 

scripts/bearbrowser-package-source-build.sh

@@ -199,6 +199,28 @@ if [ -f "$profile_dir/policies.json" ]; then
   echo "      policies.json → $policy_dest/policies.json (comments stripped)"
 fi
 
+# BearStart new-tab wiring (macOS lane). Linux/Windows get this via the
+# overlay-generated bearbrowser.cfg; on macOS the cfg is not emitted by the
+# build (see the nightly-dmg manifest-relax step), so inject a minimal cfg here
+# that only carries the AboutNewTab override, plus the autoconfig wiring prefs.
+# Prefs themselves already ship via bearbrowser-user.js above — no duplication.
+# NOTE: autoconfig .cfg files skip their FIRST line (must be a comment).
+if [ -f "$repo_root/settings/start/bearstart-autoconfig.js" ]; then
+  cp "$repo_root/settings/start/bearstart-autoconfig.js" \
+    "$out_app/Contents/Resources/bearbrowser.cfg"
+  # Autoconfig wiring must live in defaults/pref/ at the resources root — the
+  # one loose default-pref dir packaged Firefox reads (enterprise-documented).
+  wiring_dest="$out_app/Contents/Resources/defaults/pref"
+  mkdir -p "$wiring_dest"
+  cat > "$wiring_dest/local-settings.js" <<'EOF_BEARSTART_WIRING'
+// BearBrowser autoconfig wiring — injected by bearbrowser-package-source-build.sh
+pref("general.config.obscure_value", 0);
+pref("general.config.filename", "bearbrowser.cfg");
+pref("general.config.sandbox_enabled", false);
+EOF_BEARSTART_WIRING
+  echo "      bearstart-autoconfig.js → Contents/Resources/bearbrowser.cfg (new-tab wiring)"
+fi
+
 # ── Step 5: Ad-hoc sign ───────────────────────────────────────────────────────
 echo "[5/6] Code signing..."
 if [ "$skip_sign" = "true" ]; then

scripts/bearbrowser-patches.py

@@ -347,6 +347,47 @@ def _strip_l10n_base(_path):
     # l10n locale patching skipped for dev build (--with-l10n-base removed from mozconfig)
     print("-> Skipping l10n download (dev build — en-US only)")
 
+    # ── BearStart: branded start page (new tab + home) ──
+    # Ported from the native macOS shell's landing page. Packaged into the
+    # browser omni.ja via FINAL_TARGET_FILES (same mechanism as bearblocker)
+    # so it ships identically on Linux/Windows/macOS with no package-manifest
+    # entries. Served at resource:///bearstart/bearbrowser-start.html; wired
+    # as the new-tab page by settings/start/bearstart-autoconfig.js (appended
+    # to bearbrowser.cfg) and as the homepage by the human-secure user.js.
+    _bs_dir = Path("browser/bearstart")
+    _bs_dir.mkdir(exist_ok=True)
+    _bs_src = Path("../settings/start")
+    _bs_files = ["bearbrowser-start.html", "dm-sans-latin.woff2", "dm-sans-latin-ext.woff2"]
+    _bs_installed = []
+    for _bs_file in _bs_files:
+        _src = _bs_src / _bs_file
+        if _src.exists():
+            _shutil.copy(str(_src), str(_bs_dir / _bs_file))
+            _bs_installed.append(_bs_file)
+            print(f"-> Installed {_bs_file} to browser/bearstart/")
+        else:
+            print(f"warning: {_src} not found — BearStart asset missing")
+    _bs_mozbuild = _bs_dir / "moz.build"
+    if _bs_installed and not _bs_mozbuild.exists():
+        _bs_mozbuild.write_text(
+            "# BearStart start page — packaged to dist/bin/browser/bearstart/\n"
+            "# Accessible at resource:///bearstart/ inside the browser.\n"
+            "FINAL_TARGET_FILES.bearstart += [\n"
+            + "".join(f'    "{f}",\n' for f in _bs_installed)
+            + "]\n"
+        )
+        print("-> Created browser/bearstart/moz.build")
+    _browser_mozbuild_bs = Path("browser/moz.build")
+    if _bs_installed and _browser_mozbuild_bs.exists():
+        _bm_bs = _browser_mozbuild_bs.read_text()
+        if '"bearstart"' not in _bm_bs:
+            _bm_bs = _bm_bs.replace(
+                '    "actors",\n    "base",',
+                '    "actors",\n    "base",\n    "bearstart",',
+            )
+            _browser_mozbuild_bs.write_text(_bm_bs)
+            print("-> Added bearstart to browser/moz.build DIRS")
+
     # ── BearBlocker: native adblock-rust content classifier + cosmetic filtering ──
     # Step 1: Install filter lists into browser/bearblocker/
     _bb_dir = Path("browser/bearblocker")

settings/profiles/human-secure/user.js

@@ -159,10 +159,14 @@ user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features",
 user_pref("extensions.pocket.enabled", false);
 user_pref("extensions.pocket.api", "");
 user_pref("extensions.pocket.site", "");
-// Homepage — BearBrowser custom start page
-user_pref("browser.startup.homepage", "file:///Applications/BearBrowser.app/Contents/Resources/BearBrowser-start.html");
+// Homepage — BearBrowser start page, packaged into the browser omni.ja at
+// browser/bearstart/ (see scripts/bearbrowser-patches.py) so the same URL works
+// on Linux/Windows/macOS regardless of install location. (The old value was the
+// native-shell's absolute /Applications file path — macOS-only and dead.)
+// New-tab uses the same page via settings/start/bearstart-autoconfig.js —
+// browser.newtab.url was removed from Firefox years ago and did nothing.
+user_pref("browser.startup.homepage", "resource:///bearstart/bearbrowser-start.html");
 user_pref("browser.startup.page", 1);
-user_pref("browser.newtab.url", "file:///Applications/BearBrowser.app/Contents/Resources/BearBrowser-start.html");
 
 // ── Search engine ─────────────────────────────────────────────────────────────
 // Remove Google as a preset and default to a privacy-respecting engine.