From 2015cc77563ed614eb62f5c7220bfa5b6075c785 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 18 Nov 2025 21:53:35 +0000
Subject: [PATCH 1/4] Initial plan


From 2b46dd52805457631bea0c3433cf5aa4e3d1af7a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 18 Nov 2025 22:00:44 +0000
Subject: [PATCH 2/4] Implement popup interception system for iframe

Co-authored-by: sriail <225764385+sriail@users.noreply.github.com>
---
 public/popup-interceptor.js | 47 +++++++++++++++++++++++++++++++++
 public/sw.js                | 41 ++++++++++++++++++++++++++---
 src/pages/index.astro       | 52 ++++++++++++++++++++++++++++++++++++-
 3 files changed, 136 insertions(+), 4 deletions(-)
 create mode 100644 public/popup-interceptor.js

diff --git a/public/popup-interceptor.js b/public/popup-interceptor.js
new file mode 100644
index 0000000..2f6e409
--- /dev/null
+++ b/public/popup-interceptor.js
@@ -0,0 +1,47 @@
+/**
+ * Popup Interceptor Script
+ * This script is injected into proxied pages to intercept window.open calls
+ * and redirect them to the parent iframe instead of opening new tabs/windows
+ */
+
+(function() {
+    'use strict';
+    
+    // Only run if we're in an iframe
+    if (window.self === window.top) {
+        return;
+    }
+    
+    // Store the original window.open function
+    const originalWindowOpen = window.open;
+    
+    // Override window.open to intercept popup attempts
+    window.open = function(url, target, features) {
+        console.log('[Radius] Intercepting window.open:', url, target);
+        
+        // If target is _blank, _new, or not specified, intercept it
+        if (!target || target === '_blank' || target === '_new' || target === '') {
+            // Send message to parent window to open the URL in the main iframe
+            try {
+                window.top.postMessage({
+                    type: 'radius-popup-intercept',
+                    url: url ? url.toString() : ''
+                }, '*');
+                
+                console.log('[Radius] Popup intercepted and sent to parent');
+                
+                // Return null since we're not actually opening a new window
+                return null;
+            } catch (e) {
+                console.error('[Radius] Failed to send popup intercept message:', e);
+                // Fallback to original behavior if messaging fails
+                return originalWindowOpen.call(this, url, target, features);
+            }
+        }
+        
+        // For other targets (like named frames), use the original function
+        return originalWindowOpen.call(this, url, target, features);
+    };
+    
+    console.log('[Radius] Popup interceptor initialized');
+})();
diff --git a/public/sw.js b/public/sw.js
index efad95a..7d9c74b 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -59,13 +59,48 @@ self.addEventListener("fetch", function (event) {
                 request = enhanceCaptchaRequest(event.request);
             }
 
+            let response;
             if (url.startsWith(location.origin + __uv$config.prefix)) {
-                return await uv.fetch(event);
+                response = await uv.fetch(event);
             } else if (sj.route(event)) {
-                return await sj.fetch(event);
+                response = await sj.fetch(event);
             } else {
-                return await fetch(request);
+                response = await fetch(request);
             }
+
+            // Inject popup interceptor script into HTML pages
+            if (response && response.headers.get('content-type')?.includes('text/html')) {
+                // Only inject into proxied content
+                if (url.startsWith(location.origin + __uv$config.prefix) || sj.route(event)) {
+                    try {
+                        const text = await response.text();
+                        // Inject the popup interceptor script at the beginning of the body or head
+                        const injectedScript = '<script src="/popup-interceptor.js"></script>';
+                        let modifiedText = text;
+                        
+                        // Try to inject into <head> first, then <body>, then at start of html
+                        if (text.includes('<head>')) {
+                            modifiedText = text.replace('<head>', '<head>' + injectedScript);
+                        } else if (text.includes('<body>')) {
+                            modifiedText = text.replace('<body>', '<body>' + injectedScript);
+                        } else if (text.includes('<html>')) {
+                            modifiedText = text.replace('<html>', '<html>' + injectedScript);
+                        }
+                        
+                        // Create new response with modified content
+                        response = new Response(modifiedText, {
+                            status: response.status,
+                            statusText: response.statusText,
+                            headers: response.headers
+                        });
+                    } catch (e) {
+                        console.error('[Radius SW] Failed to inject popup interceptor:', e);
+                        // Return original response if injection fails
+                    }
+                }
+            }
+
+            return response;
         })()
     );
 });
diff --git a/src/pages/index.astro b/src/pages/index.astro
index 737b9d0..3ecae90 100644
--- a/src/pages/index.astro
+++ b/src/pages/index.astro
@@ -32,7 +32,7 @@ const link = Astro.url.searchParams.get("redir");
                 </div>
             </div> */}
         </div>
-        <iframe id="iframe" class="fixed h-[calc(100%-3.5rem)] mt-14 w-full hidden bg-(--background)" />
+        <iframe id="iframe" sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-modals allow-downloads allow-orientation-lock allow-pointer-lock allow-presentation" class="fixed h-[calc(100%-3.5rem)] mt-14 w-full hidden bg-(--background)" />
         <link-element data-link={link} />
     </div>
 </Layout>
@@ -102,6 +102,50 @@ const link = Astro.url.searchParams.get("redir");
             }); */
         }
 
+        // Intercept popup attempts from within the iframe by injecting a script
+        const interceptPopups = () => {
+            try {
+                if (!iframeWin || !iframeWin.document) return;
+                
+                // Check if we can access the iframe document (same-origin or via proxy)
+                const iframeDoc = iframeWin.document;
+                
+                // Create a script element to inject into the iframe
+                const script = iframeDoc.createElement('script');
+                script.src = '/popup-interceptor.js';
+                script.async = true;
+                
+                // Append the script to the iframe's document
+                if (iframeDoc.head) {
+                    iframeDoc.head.appendChild(script);
+                    console.log('[Radius] Popup interceptor script injected');
+                } else if (iframeDoc.body) {
+                    iframeDoc.body.appendChild(script);
+                    console.log('[Radius] Popup interceptor script injected to body');
+                }
+            } catch (e) {
+                // This will fail due to cross-origin restrictions
+                // In this case, rely on the sandbox attribute to prevent popups from escaping
+                console.debug('[Radius] Could not inject popup interceptor (cross-origin):', e);
+                console.log('[Radius] Relying on sandbox attribute to prevent popup escaping');
+            }
+        };
+
+        // Listen for popup interception messages from iframe
+        window.addEventListener('message', (event) => {
+            // Only accept messages from our iframe
+            if (event.source !== iframeWin) return;
+            
+            if (event.data?.type === 'radius-popup-intercept' && event.data?.url) {
+                console.log('[Radius] Received popup intercept message, loading in iframe:', event.data.url);
+                // Load the URL in the main iframe instead of opening a new window
+                const url = event.data.url;
+                if (url) {
+                    iframe.src = sw.encodeURL(url);
+                }
+            }
+        });
+
         iframe.addEventListener("load", async () => {
             phlTitle.innerHTML = iframeWin!.document.title;
             const pageURL = await getURL();
@@ -111,6 +155,12 @@ const link = Astro.url.searchParams.get("redir");
             phlImage.src = object;
             bhl.classList.add("hidden");
             phl.classList.remove("hidden");
+            
+            // Try to inject popup interceptor after the iframe loads
+            // Use a small delay to ensure the iframe document is ready
+            setTimeout(() => {
+                interceptPopups();
+            }, 100);
         }); 
     }
 

From 00b39342f53afcc4303f20d486764f8874825e35 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 18 Nov 2025 22:05:57 +0000
Subject: [PATCH 3/4] Add clarifying comment to popup interceptor

Co-authored-by: sriail <225764385+sriail@users.noreply.github.com>
---
 public/popup-interceptor.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/public/popup-interceptor.js b/public/popup-interceptor.js
index 2f6e409..6537c47 100644
--- a/public/popup-interceptor.js
+++ b/public/popup-interceptor.js
@@ -1,7 +1,10 @@
 /**
  * Popup Interceptor Script
  * This script is injected into proxied pages to intercept window.open calls
- * and redirect them to the parent iframe instead of opening new tabs/windows
+ * and redirect them to the parent iframe instead of opening new tabs/windows.
+ * 
+ * The script only runs in iframe contexts and intercepts popups that would
+ * normally open in new tabs/windows (target="_blank", "_new", or empty).
  */
 
 (function() {

From c0a068dece85f24c58cb916df832fbe3a6ea4e1e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 18 Nov 2025 22:11:34 +0000
Subject: [PATCH 4/4] Apply code formatting with biome

Co-authored-by: sriail <225764385+sriail@users.noreply.github.com>
---
 public/popup-interceptor.js | 45 ++++++++++++++++++++-----------------
 public/sw.js                | 20 ++++++++---------
 2 files changed, 34 insertions(+), 31 deletions(-)

diff --git a/public/popup-interceptor.js b/public/popup-interceptor.js
index 6537c47..8281dfb 100644
--- a/public/popup-interceptor.js
+++ b/public/popup-interceptor.js
@@ -2,49 +2,52 @@
  * Popup Interceptor Script
  * This script is injected into proxied pages to intercept window.open calls
  * and redirect them to the parent iframe instead of opening new tabs/windows.
- * 
+ *
  * The script only runs in iframe contexts and intercepts popups that would
  * normally open in new tabs/windows (target="_blank", "_new", or empty).
  */
 
-(function() {
-    'use strict';
-    
+(function () {
+    "use strict";
+
     // Only run if we're in an iframe
     if (window.self === window.top) {
         return;
     }
-    
+
     // Store the original window.open function
     const originalWindowOpen = window.open;
-    
+
     // Override window.open to intercept popup attempts
-    window.open = function(url, target, features) {
-        console.log('[Radius] Intercepting window.open:', url, target);
-        
+    window.open = function (url, target, features) {
+        console.log("[Radius] Intercepting window.open:", url, target);
+
         // If target is _blank, _new, or not specified, intercept it
-        if (!target || target === '_blank' || target === '_new' || target === '') {
+        if (!target || target === "_blank" || target === "_new" || target === "") {
             // Send message to parent window to open the URL in the main iframe
             try {
-                window.top.postMessage({
-                    type: 'radius-popup-intercept',
-                    url: url ? url.toString() : ''
-                }, '*');
-                
-                console.log('[Radius] Popup intercepted and sent to parent');
-                
+                window.top.postMessage(
+                    {
+                        type: "radius-popup-intercept",
+                        url: url ? url.toString() : ""
+                    },
+                    "*"
+                );
+
+                console.log("[Radius] Popup intercepted and sent to parent");
+
                 // Return null since we're not actually opening a new window
                 return null;
             } catch (e) {
-                console.error('[Radius] Failed to send popup intercept message:', e);
+                console.error("[Radius] Failed to send popup intercept message:", e);
                 // Fallback to original behavior if messaging fails
                 return originalWindowOpen.call(this, url, target, features);
             }
         }
-        
+
         // For other targets (like named frames), use the original function
         return originalWindowOpen.call(this, url, target, features);
     };
-    
-    console.log('[Radius] Popup interceptor initialized');
+
+    console.log("[Radius] Popup interceptor initialized");
 })();
diff --git a/public/sw.js b/public/sw.js
index 7d9c74b..a7e52a6 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -69,7 +69,7 @@ self.addEventListener("fetch", function (event) {
             }
 
             // Inject popup interceptor script into HTML pages
-            if (response && response.headers.get('content-type')?.includes('text/html')) {
+            if (response && response.headers.get("content-type")?.includes("text/html")) {
                 // Only inject into proxied content
                 if (url.startsWith(location.origin + __uv$config.prefix) || sj.route(event)) {
                     try {
@@ -77,16 +77,16 @@ self.addEventListener("fetch", function (event) {
                         // Inject the popup interceptor script at the beginning of the body or head
                         const injectedScript = '<script src="/popup-interceptor.js"></script>';
                         let modifiedText = text;
-                        
+
                         // Try to inject into <head> first, then <body>, then at start of html
-                        if (text.includes('<head>')) {
-                            modifiedText = text.replace('<head>', '<head>' + injectedScript);
-                        } else if (text.includes('<body>')) {
-                            modifiedText = text.replace('<body>', '<body>' + injectedScript);
-                        } else if (text.includes('<html>')) {
-                            modifiedText = text.replace('<html>', '<html>' + injectedScript);
+                        if (text.includes("<head>")) {
+                            modifiedText = text.replace("<head>", "<head>" + injectedScript);
+                        } else if (text.includes("<body>")) {
+                            modifiedText = text.replace("<body>", "<body>" + injectedScript);
+                        } else if (text.includes("<html>")) {
+                            modifiedText = text.replace("<html>", "<html>" + injectedScript);
                         }
-                        
+
                         // Create new response with modified content
                         response = new Response(modifiedText, {
                             status: response.status,
@@ -94,7 +94,7 @@ self.addEventListener("fetch", function (event) {
                             headers: response.headers
                         });
                     } catch (e) {
-                        console.error('[Radius SW] Failed to inject popup interceptor:', e);
+                        console.error("[Radius SW] Failed to inject popup interceptor:", e);
                         // Return original response if injection fails
                     }
                 }