feat(gnoweb): community-realm notice on packages outside a trusted list

[alexiscolin]

What

gnoweb shows a "community realm" notice on every /r/, /p/ and /u/ page whose namespace is outside a trusted list, on render, $source, $help, ?state and the user profile alike. It renders as a warning strip under the site-wide banner, never instead of it. Third-party realms now deploy on mainnet with the same chrome as the team's own, so the site read as an endorsement.

On by default in the gnoweb binary (-no-realm-notice to disable), list in -trusted-paths, text in GNOWEB_REALM_NOTICE_TEXT. Off in the library default, so gnodev never shows it. Entries are namespaces or package paths without /r/ or /p/; one entry covers both trees and everything under it.

Trust by namespace holds on mainnet: enforcement is enabled and open registration only accepts nym-[a-z]{5,13}\d{3}, so a plain name cannot be squatted. Rationale and alternatives in gno.land/adr/pr6191_gnoweb_realm_notice.md.

Changes

• Feature: realm_notice.go matcher, hook in Get, config plumbing mirroring the existing banner and aliases, flags and env var.
• Templates and CSS: banner markup extracted to ui/banner.html and rendered twice; .b-banner--warning on existing tokens; public/main.css regenerated.
• Security fix, separate commit: $source&file=..%2F..%2F… path-joined into another package and rendered its file under this package's chrome; rpcClient.File now rejects separators and dot segments, and a missing file answers 404 instead of 500.
• Tests: matcher unit test, 13-case handler table, layout warning tone, file-name predicate both ways.

Not in this PR

• A compiled list changed by PR is how gnoweb already carries allowlists (feat(gnoweb): add whitelist image hosts #4058, feat(gnoweb): gnoconnect (1/2) — external-wallet transport: registry, chooser, launch links #5970); restarting the instance on a new image is an infrastructure property.
• When a second reader needs the list, the source of truth moves on chain under GovDAO and reaches gnoweb through a file written by a sidecar, as the home page does today (feat(gnoweb): implementing home override using aliases and md local files #4478). No GitHub fetch, no in-process polling, no timelock.
• End state is disclosure, not endorsement: link qualified audit reports, never warrant. A review pipeline proposes entries; a human lands them.

Verified

gnoweb and cmd test suites, repo-pinned golangci-lint, biome, make generate reproduces the committed assets. Not done: a visual check of the strip in a browser.

Follow-up: ?state&oid= renders any object regardless of the page's realm, pre-existing, to be tracked in its own issue.

AI-assisted; every finding was verified against the code before landing.

🤖 Generated with Claude Code

[Gno2D2]

🛠 PR Checks Summary

🔴 Changes related to gnoweb must be reviewed by its codeowners

Manual Checks (for Reviewers):

• IGNORE the bot requirements for this PR (force green CI check)

Read More

🤖 This bot helps streamline PR reviews by verifying automated checks and providing guidance for contributors and reviewers.

✅ Automated Checks (for Contributors):

🔴 Changes related to gnoweb must be reviewed by its codeowners

☑️ Contributor Actions:

1. Fix any issues flagged by automated checks.
2. Follow the Contributor Checklist to ensure your PR is ready for review.
   • Add new tests, or document why they are unnecessary.
   • Provide clear examples/screenshots, if necessary.
   • Update documentation, if required.
   • Ensure no breaking changes, or include BREAKING CHANGE notes.
   • Link related issues/PRs, where applicable.

☑️ Reviewer Actions:

1. Complete manual checks for the PR, including the guidelines and additional checks if applicable.

📚 Resources:

• Report a bug with the bot.
• View the bot’s configuration file.

Debug

Automated Checks

Changes related to gnoweb must be reviewed by its codeowners

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 A changed file matches this pattern: ^gno.land/pkg/gnoweb/ (filename: gno.land/pkg/gnoweb/app.go)

Then

🔴 Requirement not satisfied
└── 🔴 Or
    ├── 🔴 Or
    │   ├── 🔴 And
    │   │   ├── 🟢 Pull request author is user: alexiscolin
    │   │   └── 🔴 This user reviewed pull request: gfanton (with state "APPROVED")
    │   └── 🔴 And
    │       ├── 🔴 Pull request author is user: gfanton
    │       └── 🔴 This user reviewed pull request: alexiscolin (with state "APPROVED")
    └── 🔴 And
        ├── 🔴 Not (🟢 Pull request author is user: alexiscolin)
        ├── 🟢 Not (🔴 Pull request author is user: gfanton)
        └── 🔴 Or
            ├── 🔴 This user reviewed pull request: alexiscolin (with state "APPROVED")
            └── 🔴 This user reviewed pull request: gfanton (with state "APPROVED")

Manual Checks

**IGNORE** the bot requirements for this PR (force green CI check)

If

🟢 Condition met
└── 🟢 On every pull request

Can be checked by

• Any user with comment edit permission