ruby_everywhere 0.0.1 → 0.1.1

data/support/shell/src-tauri/src/main.rs

@@ -0,0 +1,723 @@
+// RubyEverywhere desktop shell.
+//
+// Boot sequence (packaged / repo-dev):
+//   1. load app config (NATIVE_CONFIG env JSON, or Resources/everywhere.json in a .app)
+//   2. pick a free localhost port
+//   3. spawn the tebako-packaged Rails binary with NATIVE_PORT / NATIVE_APPDATA
+//   4. show the splash page while polling until the server accepts connections
+//   5. navigate the webview to http://127.0.0.1:{port}{entry_path}
+//   6. kill the sidecar when the app exits
+//
+// Dev mode (`every dev`): NATIVE_DEV_URL set -> no sidecar, load that URL directly.
+
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+use std::net::{TcpListener, TcpStream};
+use std::process::{Child, Command};
+use std::sync::Mutex;
+use std::time::{Duration, Instant};
+
+use tauri::{Manager, RunEvent, WebviewUrl, WebviewWindowBuilder};
+
+struct Sidecar(Mutex<Option<Child>>);
+
+struct MenuEntry {
+    label: String,
+    path: String,
+    accelerator: Option<String>,
+    separator: bool,
+}
+
+struct AppConfig {
+    raw_json: String,
+    name: String,
+    bundle_id: Option<String>,
+    entry_path: String,
+    remote_url: Option<String>,
+    background_light: Option<(u8, u8, u8)>,
+    menu: Vec<MenuEntry>,
+    tray: Vec<TrayEntry>,
+}
+
+struct TrayEntry {
+    label: String,
+    path: Option<String>,
+    action: Option<String>,
+    separator: bool,
+}
+
+fn load_config() -> AppConfig {
+    let mut value: serde_json::Value = std::env::var("NATIVE_CONFIG")
+        .ok()
+        .and_then(|raw| serde_json::from_str(&raw).ok())
+        .or_else(|| {
+            let exe = std::env::current_exe().ok()?;
+            let path = exe.parent()?.join("../Resources/everywhere.json");
+            serde_json::from_str(&std::fs::read_to_string(path).ok()?).ok()
+        })
+        .unwrap_or(serde_json::Value::Null);
+
+    // The shell knows the OS authoritatively — no user-agent guessing needed
+    // on desktop. ("macos" | "windows" | "linux")
+    if value.is_null() {
+        value = serde_json::json!({});
+    }
+    value["os"] = serde_json::json!(std::env::consts::OS);
+    if std::env::var("NATIVE_DEV_URL").is_ok() {
+        value["dev"] = serde_json::json!(true);
+    }
+
+    AppConfig {
+        raw_json: if value.is_null() { "{}".to_string() } else { value.to_string() },
+        name: value["name"].as_str().unwrap_or("RubyEverywhere App").to_string(),
+        bundle_id: value["bundle_id"].as_str().map(str::to_string),
+        entry_path: value["entry_path"].as_str().unwrap_or("/").to_string(),
+        remote_url: (value["mode"].as_str() == Some("remote"))
+            .then(|| value["remote_url"].as_str().map(str::to_string))
+            .flatten(),
+        background_light: value["background_color"]["light"].as_str().and_then(parse_hex),
+        menu: value["menu"]
+            .as_array()
+            .map(|items| {
+                items
+                    .iter()
+                    .map(|i| MenuEntry {
+                        label: i["label"].as_str().unwrap_or_default().to_string(),
+                        path: i["path"].as_str().unwrap_or_default().to_string(),
+                        accelerator: i["accelerator"].as_str().map(str::to_string),
+                        separator: i["separator"].as_bool().unwrap_or(false),
+                    })
+                    .collect()
+            })
+            .unwrap_or_default(),
+        tray: value["tray"]
+            .as_array()
+            .map(|items| {
+                items
+                    .iter()
+                    .map(|i| TrayEntry {
+                        label: i["label"].as_str().unwrap_or_default().to_string(),
+                        path: i["path"].as_str().map(str::to_string),
+                        action: i["action"].as_str().map(str::to_string),
+                        separator: i["separator"].as_bool().unwrap_or(false),
+                    })
+                    .collect()
+            })
+            .unwrap_or_default(),
+    }
+}
+
+fn parse_hex(hex: &str) -> Option<(u8, u8, u8)> {
+    let h = hex.trim_start_matches('#');
+    match h.len() {
+        3 => {
+            let c = |i: usize| u8::from_str_radix(&h[i..=i], 16).map(|v| v * 17);
+            Some((c(0).ok()?, c(1).ok()?, c(2).ok()?))
+        }
+        6 => {
+            let c = |i: usize| u8::from_str_radix(&h[i..i + 2], 16);
+            Some((c(0).ok()?, c(2).ok()?, c(4).ok()?))
+        }
+        _ => None,
+    }
+}
+
+fn free_port() -> u16 {
+    TcpListener::bind("127.0.0.1:0")
+        .expect("could not bind to a local port")
+        .local_addr()
+        .expect("no local addr")
+        .port()
+}
+
+fn main() {
+    let config = load_config();
+
+    tauri::Builder::default()
+        .plugin(tauri_plugin_notification::init())
+        .plugin(tauri_plugin_dialog::init())
+        .plugin(tauri_plugin_clipboard_manager::init())
+        .invoke_handler(tauri::generate_handler![notify_command])
+        .setup(move |app| {
+            // Bridge channel: pages emit events (the sanctioned webview->shell
+            // path for remote-origin content in Tauri v2; invoke is reserved
+            // for local content). Fire-and-forget, Strada-style.
+            {
+                use tauri::Listener;
+                let handle = app.handle().clone();
+                app.listen_any("everywhere:notify", move |event| {
+                    let v: serde_json::Value =
+                        serde_json::from_str(event.payload()).unwrap_or(serde_json::Value::Null);
+                    notify(
+                        &handle,
+                        v["title"].as_str().unwrap_or("Notification"),
+                        v["body"].as_str().unwrap_or_default(),
+                    );
+                });
+            }
+            build_menu(app, &config)?;
+
+            // Dev mode (`every dev`): no sidecar, just point the webview at the
+            // developer's normal dev server.
+            if let Ok(dev_url) = std::env::var("NATIVE_DEV_URL") {
+                build_window(
+                    app,
+                    &config,
+                    &format!("{} (dev)", config.name),
+                    WebviewUrl::External(dev_url.parse().expect("invalid NATIVE_DEV_URL")),
+                )?;
+                return Ok(());
+            }
+
+            // Test mode: reproduce the packaged splash->navigate flow against an
+            // arbitrary URL (usually the dev server) without a sidecar.
+            if let Ok(nav_url) = std::env::var("NATIVE_NAVIGATE_URL") {
+                let window = build_window(
+                    app,
+                    &config,
+                    &format!("{} (navtest)", config.name),
+                    WebviewUrl::App("index.html".into()),
+                )?;
+                std::thread::spawn(move || {
+                    std::thread::sleep(Duration::from_millis(1500));
+                    if let Err(e) = window.navigate(nav_url.parse().unwrap()) {
+                        eprintln!("navigate failed: {e}");
+                    }
+                });
+                return Ok(());
+            }
+
+            // Remote mode: no sidecar — the app is already deployed somewhere.
+            // The webview is a branded window onto it; native hooks still work
+            // because the bridge rides the webview, not localhost.
+            if let Some(remote_url) = &config.remote_url {
+                // Capabilities are compile-time static and scoped to localhost
+                // (capabilities/default.json), but the remote origin is per-app
+                // (everywhere.yml). Without authorizing it, every page->shell
+                // command (setTitle, event.listen, dialog.ask, notification)
+                // is rejected "not allowed by ACL". Add a capability at runtime
+                // (dynamic-acl) granting the remote origin the same IPC the
+                // local app gets.
+                authorize_remote_origin(app, remote_url)?;
+
+                let url = format!("{}{}", remote_url.trim_end_matches('/'), config.entry_path);
+                build_window(
+                    app,
+                    &config,
+                    &config.name,
+                    WebviewUrl::External(url.parse().expect("invalid remote url")),
+                )?;
+                return Ok(());
+            }
+
+            let port = free_port();
+
+            // Resolution order: explicit env override (repo dev) -> "app-server"
+            // next to this executable (inside a bundled .app) -> repo default.
+            let sidecar_path = std::env::var("NATIVE_SIDECAR_PATH")
+                .ok()
+                .or_else(|| {
+                    let exe = std::env::current_exe().ok()?;
+                    let candidate = exe.parent()?.join("app-server");
+                    candidate
+                        .exists()
+                        .then(|| candidate.to_string_lossy().into_owned())
+                })
+                .unwrap_or_else(|| "../dist/example".to_string());
+
+            // App data lives at <platform data dir>/<bundle_id> so the location
+            // is governed by config/everywhere.yml, not the compile-time
+            // tauri.conf identifier.
+            let app_data = match &config.bundle_id {
+                Some(id) => app.path().data_dir()?.join(id),
+                None => app.path().app_data_dir()?,
+            };
+            std::fs::create_dir_all(&app_data)?;
+
+            let mut sidecar_cmd = Command::new(&sidecar_path);
+            sidecar_cmd
+                .env("NATIVE_PORT", port.to_string())
+                .env("NATIVE_APPDATA", &app_data)
+                // The sidecar watches this pid and shuts itself down if the
+                // shell dies without running cleanup (crash, SIGKILL, pkill).
+                .env("NATIVE_SHELL_PID", std::process::id().to_string());
+            // Own process group so exit cleanup can reap the WHOLE tree —
+            // Solid Queue forks workers that would otherwise outlive Puma.
+            #[cfg(unix)]
+            {
+                use std::os::unix::process::CommandExt;
+                sidecar_cmd.process_group(0);
+            }
+            let child = sidecar_cmd
+                .spawn()
+                .unwrap_or_else(|e| panic!("failed to spawn sidecar {sidecar_path}: {e}"));
+            app.manage(Sidecar(Mutex::new(Some(child))));
+
+            let window = build_window(
+                app,
+                &config,
+                &config.name,
+                custom_splash_url().unwrap_or_else(|| WebviewUrl::App("index.html".into())),
+            )?;
+
+            // Wait for the server, then swap the splash for the real app.
+            let entry_path = config.entry_path.clone();
+            std::thread::spawn(move || {
+                let addr = format!("127.0.0.1:{port}");
+                let started = Instant::now();
+                loop {
+                    if TcpStream::connect_timeout(
+                        &addr.parse().unwrap(),
+                        Duration::from_millis(200),
+                    )
+                    .is_ok()
+                    {
+                        break;
+                    }
+                    if started.elapsed() > Duration::from_secs(60) {
+                        eprintln!("sidecar never came up on {addr}");
+                        return;
+                    }
+                    std::thread::sleep(Duration::from_millis(150));
+                }
+                println!("app up on {addr} after {:?}", started.elapsed());
+                let url: tauri::Url = format!("http://{addr}{entry_path}").parse().unwrap();
+                if let Err(e) = window.navigate(url) {
+                    eprintln!("navigate failed: {e}");
+                }
+            });
+
+            Ok(())
+        })
+        .build(tauri::generate_context!())
+        .expect("error while building tauri application")
+        .run(|app, event| {
+            if let RunEvent::Exit = event {
+                // No sidecar state in dev mode (NATIVE_DEV_URL).
+                if let Some(sidecar) = app.try_state::<Sidecar>() {
+                    if let Some(mut child) = sidecar.0.lock().unwrap().take() {
+                        #[cfg(unix)]
+                        {
+                            // TERM the process group (graceful Puma stop shuts
+                            // down Solid Queue too), then KILL any stragglers.
+                            let group = format!("-{}", child.id());
+                            let _ = Command::new("kill").args(["-TERM", &group]).status();
+                            for _ in 0..50 {
+                                if let Ok(Some(_)) = child.try_wait() {
+                                    break;
+                                }
+                                std::thread::sleep(Duration::from_millis(100));
+                            }
+                            let _ = Command::new("kill").args(["-KILL", &group]).status();
+                        }
+                        #[cfg(not(unix))]
+                        let _ = child.kill();
+                        let _ = child.wait();
+                    }
+                }
+            }
+        });
+}
+
+// Native menu bar: standard App/Edit/Window menus (Edit is what makes
+// Cmd+C/V/X/Z work in a webview app on macOS) plus config-driven items in the
+// app menu. Custom item clicks emit "everywhere:menu" {path} to the page,
+// where the injected listener hands them to Turbo.
+fn build_menu(app: &tauri::App, config: &AppConfig) -> tauri::Result<()> {
+    use tauri::menu::{MenuBuilder, MenuItemBuilder, SubmenuBuilder};
+
+    let about = tauri::menu::AboutMetadataBuilder::new()
+        .name(Some(config.name.clone()))
+        .build();
+    let mut app_menu = SubmenuBuilder::new(app, &config.name).about(Some(about));
+    if !config.menu.is_empty() {
+        app_menu = app_menu.separator();
+        for entry in &config.menu {
+            if entry.separator {
+                app_menu = app_menu.separator();
+                continue;
+            }
+            let mut item = MenuItemBuilder::with_id(format!("nav:{}", entry.path), &entry.label);
+            if let Some(accel) = &entry.accelerator {
+                item = item.accelerator(accel);
+            }
+            app_menu = app_menu.item(&item.build(app)?);
+        }
+    }
+    let app_menu = app_menu
+        .separator()
+        .hide()
+        .hide_others()
+        .show_all()
+        .separator()
+        .quit()
+        .build()?;
+
+    let edit = SubmenuBuilder::new(app, "Edit")
+        .undo()
+        .redo()
+        .separator()
+        .cut()
+        .copy()
+        .paste()
+        .separator()
+        .select_all()
+        .build()?;
+
+    let view = SubmenuBuilder::new(app, "View")
+        .item(
+            &MenuItemBuilder::with_id("reload", "Reload")
+                .accelerator("CmdOrCtrl+R")
+                .build(app)?,
+        )
+        .item(
+            &MenuItemBuilder::with_id("devtools", "Developer Tools")
+                .accelerator("CmdOrCtrl+Alt+I")
+                .build(app)?,
+        )
+        .separator()
+        .fullscreen()
+        .build()?;
+
+    let window_menu = SubmenuBuilder::new(app, "Window")
+        .minimize()
+        .maximize()
+        .separator()
+        .close_window()
+        .build()?;
+
+    let menu = MenuBuilder::new(app)
+        .items(&[&app_menu, &edit, &view, &window_menu])
+        .build()?;
+    app.set_menu(menu)?;
+
+    app.on_menu_event(|app, event| handle_menu_id(app, event.id().0.as_str()));
+
+    build_tray(app, config)?;
+
+    Ok(())
+}
+
+// Shared by the app menu and the tray.
+fn handle_menu_id(app: &tauri::AppHandle, id: &str) {
+    use tauri::Emitter;
+    match id {
+        "quit" => app.exit(0),
+        "show" => focus_main(app),
+        "reload" => {
+            if let Some(w) = app.get_webview_window("main") {
+                let _ = w.eval("location.reload()");
+            }
+        }
+        "devtools" => {
+            if let Some(w) = app.get_webview_window("main") {
+                w.open_devtools();
+            }
+        }
+        _ => {
+            if let Some(path) = id.strip_prefix("nav:") {
+                println!("[bridge] menu -> {path}");
+                focus_main(app);
+                let _ = app.emit_to("main", "everywhere:menu", serde_json::json!({ "path": path }));
+            }
+        }
+    }
+}
+
+fn focus_main(app: &tauri::AppHandle) {
+    if let Some(w) = app.get_webview_window("main") {
+        let _ = w.show();
+        let _ = w.set_focus();
+    }
+}
+
+// System tray from `tray:` in everywhere.yml. Items share the nav/quit/show
+// handling with the app menu.
+fn build_tray(app: &tauri::App, config: &AppConfig) -> tauri::Result<()> {
+    if config.tray.is_empty() {
+        return Ok(());
+    }
+    use tauri::menu::{MenuBuilder, MenuItemBuilder, PredefinedMenuItem};
+    use tauri::tray::TrayIconBuilder;
+
+    let mut menu = MenuBuilder::new(app);
+    for entry in &config.tray {
+        if entry.separator {
+            menu = menu.item(&PredefinedMenuItem::separator(app)?);
+            continue;
+        }
+        let id = match (&entry.action, &entry.path) {
+            (Some(action), _) => action.clone(),
+            (None, Some(path)) => format!("nav:{path}"),
+            _ => continue,
+        };
+        menu = menu.item(&MenuItemBuilder::with_id(id, &entry.label).build(app)?);
+    }
+    let menu = menu.build()?;
+
+    let mut tray = TrayIconBuilder::with_id("main")
+        .menu(&menu)
+        .show_menu_on_left_click(true)
+        .tooltip(&config.name);
+    if let Some(icon) = app.default_window_icon() {
+        tray = tray.icon(icon.clone());
+    }
+    tray.on_menu_event(|app, event| handle_menu_id(app, event.id().0.as_str()))
+        .build(app)?;
+
+    Ok(())
+}
+
+// The page-side half of the shell, injected into every page (app pages, the
+// splash, remote sites). The config JSON is substituted in at window build.
+const INIT_SCRIPT: &str = r#"
+(function() {
+  window.__EVERYWHERE_CONFIG__ = /*__CONFIG_JSON__*/ null || {};
+  const cfg = window.__EVERYWHERE_CONFIG__;
+
+  const report = (kind, msg) => {
+    try { fetch('/?' + kind + '=' + encodeURIComponent(msg)) } catch (_) {}
+  };
+  window.addEventListener('error', e =>
+    report('jserror', e.message + ' @ ' + (e.filename || '?') + ':' + (e.lineno || '?')));
+  window.addEventListener('unhandledrejection', e =>
+    report('jsreject', String(e.reason)));
+  document.addEventListener('DOMContentLoaded', () =>
+    report('jsboot', 'tauri=' + !!window.__TAURI__));
+
+  // WKWebView has no native window.confirm — Turbo's data-turbo-confirm would
+  // silently cancel. Install the shell's native dialog as the DEFAULT confirm
+  // at the exact moment Turbo lands on window (before any app code can run),
+  // so an app that sets its own custom confirm afterwards always wins.
+  (function() {
+    const nativeConfirm = (message) =>
+      window.__TAURI__ && window.__TAURI__.dialog
+        ? window.__TAURI__.dialog.ask(message, { title: cfg.name || 'Confirm', kind: 'warning' })
+        : Promise.resolve(false);
+    nativeConfirm.everywhereDefault = true;
+
+    const install = (t) => {
+      try {
+        if (!t) return;
+        if (t.config && t.config.forms) { t.config.forms.confirm = nativeConfirm; }
+        else if (t.setConfirmMethod) { t.setConfirmMethod(nativeConfirm); }
+      } catch (_) {}
+    };
+
+    let turbo = window.Turbo;
+    if (turbo) { install(turbo); }
+    try {
+      Object.defineProperty(window, 'Turbo', {
+        configurable: true,
+        get() { return turbo; },
+        set(v) { turbo = v; install(v); }
+      });
+    } catch (_) {}
+  })();
+
+  // Window title follows the page title (apps own their <title> tags);
+  // fall back to the app name, suffix "(dev)" in dev mode.
+  const syncTitle = () => {
+    try {
+      const base = document.title || cfg.name || "";
+      const title = cfg.dev ? base + " (dev)" : base;
+      if (title && window.__TAURI__ && window.__TAURI__.window) {
+        window.__TAURI__.window.getCurrentWindow().setTitle(title);
+      }
+    } catch (_) {}
+  };
+  document.addEventListener('DOMContentLoaded', () => {
+    syncTitle();
+    const el = document.querySelector('title');
+    if (el) new MutationObserver(syncTitle).observe(el, { childList: true });
+  });
+  document.addEventListener('turbo:load', syncTitle);
+
+  const hookMenu = () => {
+    if (window.__TAURI__ && window.__TAURI__.event) {
+      window.__TAURI__.event.listen('everywhere:menu', (e) => {
+        const path = e.payload && e.payload.path;
+        if (!path) return;
+        if (window.Turbo) { window.Turbo.visit(path); }
+        else { window.location.assign(path); }
+      });
+    } else {
+      setTimeout(hookMenu, 100);
+    }
+  };
+  hookMenu();
+})();
+"#;
+
+fn build_window(
+    app: &tauri::App,
+    config: &AppConfig,
+    title: &str,
+    url: WebviewUrl,
+) -> tauri::Result<tauri::WebviewWindow> {
+    let mut builder = WebviewWindowBuilder::new(app, "main", url)
+        .title(title)
+        .inner_size(1100.0, 750.0)
+        // Injected into every page: app config global, remote console, native
+        // confirm default, and the menu-navigation listener.
+        .initialization_script(INIT_SCRIPT.replace("/*__CONFIG_JSON__*/ null", &config.raw_json));
+    if let Some((r, g, b)) = config.background_light {
+        builder = builder.background_color(tauri::window::Color(r, g, b, 255));
+    }
+
+    // Cookie / session persistence: give the webview a stable data store so
+    // logins survive relaunches. macOS wants a 16-byte identifier (derived from
+    // bundle_id); Windows/Linux want an explicit directory. Dev mode stays
+    // ephemeral — a persistent cache would keep serving stale dev assets.
+    let dev_mode = std::env::var("NATIVE_DEV_URL").is_ok();
+    if !dev_mode {
+        #[cfg(target_os = "macos")]
+        {
+            builder = builder.data_store_identifier(data_store_id(
+                config.bundle_id.as_deref().unwrap_or("com.rubyeverywhere.app"),
+            ));
+        }
+        #[cfg(any(windows, target_os = "linux"))]
+        {
+            if let Ok(dir) = app.path().data_dir() {
+                let id = config.bundle_id.clone().unwrap_or("com.rubyeverywhere.app".into());
+                builder = builder.data_directory(dir.join(id).join("webview"));
+            }
+        }
+    }
+
+    // External links open in the system browser; only the app's own origins
+    // navigate inside the window.
+    let remote_host = config
+        .remote_url
+        .as_deref()
+        .and_then(|u| u.parse::<tauri::Url>().ok())
+        .and_then(|u| u.host_str().map(str::to_string));
+    builder = builder.on_navigation(move |url| {
+        if is_internal(url, remote_host.as_deref()) {
+            true
+        } else {
+            println!("external link -> system browser: {url}");
+            open_external(url.as_str());
+            false
+        }
+    });
+
+    builder.build()
+}
+
+// An app-provided splash (Resources/splash.html, from `splash:` in
+// everywhere.yml) loads via data: URL — no server needed before Rails boots.
+fn custom_splash_url() -> Option<WebviewUrl> {
+    let exe = std::env::current_exe().ok()?;
+    let html = std::fs::read(exe.parent()?.join("../Resources/splash.html")).ok()?;
+    format!("data:text/html;base64,{}", base64(&html)).parse().ok().map(WebviewUrl::External)
+}
+
+fn base64(data: &[u8]) -> String {
+    const TABLE: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    let mut out = String::with_capacity(data.len().div_ceil(3) * 4);
+    for chunk in data.chunks(3) {
+        let b = [chunk[0], *chunk.get(1).unwrap_or(&0), *chunk.get(2).unwrap_or(&0)];
+        let n = u32::from(b[0]) << 16 | u32::from(b[1]) << 8 | u32::from(b[2]);
+        out.push(TABLE[(n >> 18) as usize & 63] as char);
+        out.push(TABLE[(n >> 12) as usize & 63] as char);
+        out.push(if chunk.len() > 1 { TABLE[(n >> 6) as usize & 63] as char } else { '=' });
+        out.push(if chunk.len() > 2 { TABLE[n as usize & 63] as char } else { '=' });
+    }
+    out
+}
+
+// Grant the configured remote origin the same IPC surface the packaged local
+// app gets from capabilities/default.json. The permission set is mirrored
+// deliberately: whatever the local app can do, the remote app can do — no more.
+// `local: false` keeps it scoped to the remote URL pattern only. The urlpattern
+// treats an origin with no path as matching every path under it.
+fn authorize_remote_origin(app: &tauri::App, remote_url: &str) -> tauri::Result<()> {
+    let Ok(origin) = remote_url.parse::<tauri::Url>() else {
+        eprintln!("[bridge] remote url {remote_url} not a valid URL; skipping ACL grant");
+        return Ok(());
+    };
+    let Some(host) = origin.host_str() else {
+        return Ok(());
+    };
+    let pattern = match origin.port() {
+        Some(port) => format!("{}://{}:{}", origin.scheme(), host, port),
+        None => format!("{}://{}", origin.scheme(), host),
+    };
+
+    let capability = serde_json::json!({
+        "identifier": "remote-app",
+        "description": "IPC for the configured remote origin (remote-mode app)",
+        "windows": ["main"],
+        "local": false,
+        "remote": { "urls": [pattern] },
+        "permissions": [
+            "core:default",
+            "core:window:allow-set-title",
+            "notification:default",
+            "dialog:default",
+            "clipboard-manager:allow-read-text",
+            "clipboard-manager:allow-write-text"
+        ]
+    });
+
+    app.add_capability(capability.to_string())
+}
+
+fn is_internal(url: &tauri::Url, remote_host: Option<&str>) -> bool {
+    match url.scheme() {
+        // splash / injected pages / blank interstitials
+        "tauri" | "app" | "about" | "data" | "blob" => true,
+        "http" | "https" => {
+            let host = url.host_str().unwrap_or("");
+            host == "127.0.0.1" || host == "localhost" || Some(host) == remote_host
+        }
+        _ => false,
+    }
+}
+
+fn open_external(url: &str) {
+    #[cfg(target_os = "macos")]
+    let cmd = ("open", vec![url]);
+    #[cfg(target_os = "linux")]
+    let cmd = ("xdg-open", vec![url]);
+    #[cfg(windows)]
+    let cmd = ("cmd", vec!["/c", "start", "", url]);
+    let _ = Command::new(cmd.0).args(cmd.1).spawn();
+}
+
+// Stable 16-byte webview data-store id derived from the bundle_id.
+#[cfg(target_os = "macos")]
+fn data_store_id(bundle_id: &str) -> [u8; 16] {
+    use std::hash::{Hash, Hasher};
+    let mut out = [0u8; 16];
+    for (i, chunk) in out.chunks_mut(8).enumerate() {
+        let mut hasher = std::collections::hash_map::DefaultHasher::new();
+        (bundle_id, i as u64).hash(&mut hasher);
+        chunk.copy_from_slice(&hasher.finish().to_le_bytes());
+    }
+    out
+}
+
+// First bridge command: fired from the webview (Stimulus) via window.__TAURI__.
+// The notification plugin is the real path (proper Notification Center delivery,
+// attributed to the app). osascript remains only as a dev fallback — bare
+// `cargo run` binaries can't always talk to the notification APIs.
+fn notify(app: &tauri::AppHandle, title: &str, body: &str) {
+    use tauri_plugin_notification::NotificationExt;
+    println!("[bridge] notify: {title} — {body}");
+    if let Err(e) = app.notification().builder().title(title).body(body).show() {
+        eprintln!("[bridge] notification plugin failed ({e}); osascript fallback");
+        #[cfg(target_os = "macos")]
+        {
+            let script = format!("display notification {body:?} with title {title:?}");
+            let _ = Command::new("osascript").arg("-e").arg(script).spawn();
+        }
+    }
+}
+
+#[tauri::command]
+fn notify_command(app: tauri::AppHandle, title: String, body: String) {
+    notify(&app, &title, &body);
+}