From 0cd9956c4ce24276ef6a5d04beed7f1e20067499 Mon Sep 17 00:00:00 2001
From: c4ch3c4d3 <bryce@zuccaro.me>
Date: Tue, 18 Aug 2026 20:11:30 -0500
Subject: [PATCH] fix: attacksShell appends content box to root (detached-div
 bug) + cache-bust

The Attacks shell created its content div but never attached it to the
document, so all launcher cards rendered into a detached subtree (tabs
only were visible). Bumped views.js cache version in index.html.
---
 payload/user/remote_access/pager-webui/www/index.html  | 2 +-
 payload/user/remote_access/pager-webui/www/js/views.js | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/payload/user/remote_access/pager-webui/www/index.html b/payload/user/remote_access/pager-webui/www/index.html
index c0eb881..5b465e6 100644
--- a/payload/user/remote_access/pager-webui/www/index.html
+++ b/payload/user/remote_access/pager-webui/www/index.html
@@ -267,7 +267,7 @@
 <script src="js/xterm-addon-fit.min.js"></script>
 <script src="js/terminal.js"></script>
 <script src="js/pager.js"></script>
-<script src="js/views.js?v=20260817-12"></script>
+<script src="js/views.js?v=20260818-1"></script>
 <script src="js/app.js?v=20260811-9"></script>
 </body>
 </html>
diff --git a/payload/user/remote_access/pager-webui/www/js/views.js b/payload/user/remote_access/pager-webui/www/js/views.js
index 8b6649a..ec6ecf0 100644
--- a/payload/user/remote_access/pager-webui/www/js/views.js
+++ b/payload/user/remote_access/pager-webui/www/js/views.js
@@ -1,5 +1,4 @@
 'use strict';
-
 const views = {};
 
 const h = (tag, attrs, ...children) => {
@@ -1157,8 +1156,11 @@ const ATTACK_TABS = [
 function attacksShell(root, activeHash) {
   root.appendChild(h('h1', { class: 'page-title', text: 'Attacks' }));
   tabBar(root, ATTACK_TABS, activeHash);
-  return h('div', {}, h('div', { class: 'muted', style: 'font-size:12px;margin:8px 0' },
+  const box = h('div', {});
+  box.appendChild(h('div', { class: 'muted', style: 'font-size:12px;margin:8px 0' },
     'Targets: only networks you are authorized to test. The device is the source of truth — every change is verified against it.'));
+  root.appendChild(box);
+  return box;
 }
 
 function attackBadge(ap) {