@livx.cc/appwrap 0.42.4 → 0.43.0

package/runtime-desktop/src-tauri/src/popup_mac.rs

@@ -0,0 +1,466 @@
+// macOS popup-window support — makes arbitrary wrapped web apps' `window.open` flows work
+// (Firebase signInWithPopup dies with auth/popup-blocked without this).
+//
+// Approach: wrap wry's WKUIDelegate with our own that implements
+//   - webView:createWebViewWithConfiguration:forNavigationAction:windowFeatures:
+//     The child WKWebView is alloc'd with the PASSED configuration — that's what preserves
+//     window.opener / postMessage and the shared session. Hosted in a plain NSWindow.
+//   - webViewDidClose: — pages that call window.close() (Firebase popups do) close their NSWindow.
+// Everything else is forwarded to wry's original delegate via forwardingTargetForSelector /
+// respondsToSelector (wry ALWAYS installs a WryWebViewUIDelegate; `uiDelegate` is a WEAK property,
+// so we keep a strong ref to wry's delegate in our ivars — dropping it would break file-upload
+// panels and media-capture grants).
+//
+// wry 0.55 does have a built-in popup path (NewWindowResponse::Allow via tauri's on_new_window),
+// but it implements NO webViewDidClose and exposes no child handle to patch one in — a Firebase
+// popup would linger as a dead window after auth. Hence the wrapper.
+use std::ffi::c_void;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Mutex;
+
+use objc2::rc::Retained;
+use objc2::runtime::{AnyObject, NSObject, NSObjectProtocol, ProtocolObject, Sel};
+use objc2::{define_class, msg_send, DefinedClass, MainThreadMarker, MainThreadOnly, Message};
+use objc2_app_kit::{NSBackingStoreType, NSWindow, NSWindowDelegate, NSWindowStyleMask};
+use objc2_foundation::{NSNotification, NSPoint, NSRect, NSSize, NSString, NSURL, NSURLRequest};
+use objc2_web_kit::{
+    WKNavigationAction, WKNavigationActionPolicy, WKNavigationDelegate, WKUIDelegate, WKWebView,
+    WKWebViewConfiguration, WKWindowFeatures,
+};
+
+/// When true, Google `signInWithPopup` OAuth popups get `prompt=select_account` appended so a
+/// remembered Google session doesn't auto-sign — the user picks an account (multi-account apps like
+/// Unclaw). Set once from the shell config at install(); read in the child's navigation delegate.
+static GOOGLE_ACCOUNT_PICKER: AtomicBool = AtomicBool::new(false);
+
+/// Rewrite a Google OAuth popup URL to force the account chooser, or None to leave it untouched.
+/// Matches only `accounts.google.com` OAuth authorize / sign-in endpoints that don't already carry a
+/// `prompt` param (so we don't clobber an app that set its own, and don't loop on our own reload).
+fn google_account_picker_rewrite(url: &str) -> Option<String> {
+    let is_oauth = url.starts_with("https://accounts.google.com/o/oauth2")
+        || url.starts_with("https://accounts.google.com/signin/oauth");
+    if !is_oauth {
+        return None;
+    }
+    let query = url.split_once('?').map(|(_, q)| q).unwrap_or("");
+    let has_prompt = query.split('&').any(|kv| kv == "prompt" || kv.starts_with("prompt="));
+    if has_prompt {
+        return None;
+    }
+    let sep = if url.contains('?') { '&' } else { '?' };
+    Some(format!("{url}{sep}prompt=select_account"))
+}
+
+/// Safari-equivalent UA (no wry/Tauri token, full `Version/… Safari/…` suffix) — Google blocks
+/// OAuth in webviews whose UA lacks it (disallowed_useragent). Applied to the shell webview
+/// (main.rs builder) and every child popup.
+pub const SAFARI_UA: &str = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15";
+
+#[cfg(test)]
+mod tests {
+    use super::google_account_picker_rewrite as r;
+    #[test]
+    fn appends_prompt_to_oauth_urls() {
+        assert_eq!(
+            r("https://accounts.google.com/o/oauth2/auth?client_id=x").as_deref(),
+            Some("https://accounts.google.com/o/oauth2/auth?client_id=x&prompt=select_account")
+        );
+        assert_eq!(
+            r("https://accounts.google.com/signin/oauth").as_deref(),
+            Some("https://accounts.google.com/signin/oauth?prompt=select_account")
+        );
+    }
+    #[test]
+    fn leaves_others_untouched() {
+        assert!(r("https://accounts.google.com/o/oauth2/auth?prompt=consent").is_none());
+        assert!(r("https://accounts.google.com/o/oauth2/auth?x=1&prompt=none").is_none());
+        assert!(r("https://example.com/o/oauth2/auth").is_none());
+        assert!(r("https://myapp.firebaseapp.com/__/auth/handler").is_none());
+    }
+
+    #[test]
+    fn descendants_resolve_transitively() {
+        use super::descendants_of;
+        // 1 → 2 → 3, 1 → 4; 5 hangs off an unrelated 9.
+        let pairs = [(2, 1), (3, 2), (4, 1), (5, 9)];
+        let mut d = descendants_of(&pairs, 1);
+        d.sort_unstable();
+        assert_eq!(d, vec![2, 3, 4]);
+        assert_eq!(descendants_of(&pairs, 3), Vec::<usize>::new());
+        assert_eq!(descendants_of(&pairs, 9), vec![5]);
+    }
+
+    #[test]
+    fn descendants_cycle_safe() {
+        // Degenerate cycle must terminate and not include the root.
+        let pairs = [(2, 1), (1, 2)];
+        assert_eq!(super::descendants_of(&pairs, 1), vec![2]);
+    }
+}
+
+/// Strong refs for one open popup. Only touched on the main thread (Send impl exists purely so
+/// the registry can live in a static Mutex — same pattern as oauth_mac::ActiveFlow).
+struct Popup {
+    window: Retained<NSWindow>,
+    webview: Retained<WKWebView>,
+    /// Opener WKWebView pointer (shell webview for top-level popups, another popup's webview for
+    /// nested ones). Identity only — never dereferenced. Drives cascade-close.
+    parent: usize,
+    /// Google account-picker rewrite is applied AT MOST ONCE per popup — only the entry OAuth
+    /// navigation. Otherwise Google's own redirects to chooser/error pages (which drop the `prompt`
+    /// param) would re-match and re-trigger a cancel+reload loop. Tied to the popup so it's dropped
+    /// with the window.
+    rewritten: AtomicBool,
+}
+unsafe impl Send for Popup {}
+static POPUPS: Mutex<Vec<Popup>> = Mutex::new(Vec::new());
+
+/// Single idempotent teardown for a popup. Removes the (only) strong-ref entry from POPUPS so the
+/// NSWindow + child WKWebView (JS timers, network) can finally be released. Both close paths route
+/// here: page-initiated `window.close()` (webViewDidClose:, `close_window = true` — the window is
+/// still open so we close it) and the user clicking the red button (windowWillClose:,
+/// `close_window = false` — AppKit is already closing it). Calling it twice is a no-op (the second
+/// path finds no entry), which is exactly what happens when either close triggers the other.
+/// Main-thread only (guaranteed: both callers are WK/AppKit delegate methods).
+// `&dyn Fn` (not `impl Fn`): cleanup_popup recurses for the cascade — a generic pred would
+// monomorphize a fresh closure type per recursion level (compile error: recursion limit).
+fn cleanup_popup(pred: &dyn Fn(&Popup) -> bool, close_window: bool) {
+    // One critical section: remove the entry AND snapshot the remaining (key, parent) pairs, then
+    // drop the lock BEFORE any window.close() — closing re-enters windowWillClose → cleanup_popup,
+    // which must not deadlock on POPUPS.
+    let (p, descendants) = {
+        let mut popups = POPUPS.lock().unwrap();
+        let Some(i) = popups.iter().position(|p| pred(p)) else {
+            eprintln!("[popup] cleanup: no matching entry (already torn down)");
+            return;
+        };
+        let p = popups.remove(i);
+        let key = Retained::as_ptr(&p.webview) as usize;
+        let pairs: Vec<(usize, usize)> = popups
+            .iter()
+            .map(|q| (Retained::as_ptr(&q.webview) as usize, q.parent))
+            .collect();
+        (p, descendants_of(&pairs, key))
+    };
+    // Stop observing `title` BEFORE releasing the webview (KVO throws if an observed object
+    // deallocates with observers attached). Registered unconditionally in create_web_view.
+    if let Some(observer) = installed_delegate() {
+        let key = NSString::from_str("title");
+        let _: () = unsafe { msg_send![&*p.webview, removeObserver: &*observer, forKeyPath: &*key] };
+    }
+    if close_window {
+        p.window.close();
+    }
+    // Cascade: close this popup's descendants through the same idempotent path. Any that already
+    // tore themselves down (e.g. their windowWillClose fired first) are a no-op above.
+    for key in descendants {
+        eprintln!("[popup] cascade-close child {key:#x}");
+        cleanup_popup(&move |q: &Popup| Retained::as_ptr(&q.webview) as usize == key, true);
+    }
+    // p (window + webview Retained refs) drops here → last strong refs released.
+}
+
+/// All descendant keys of `root` in a (key, parent-key) edge list — breadth-ish order, cycle-safe.
+/// Pure so the registry cascade logic is unit-testable without AppKit.
+fn descendants_of(pairs: &[(usize, usize)], root: usize) -> Vec<usize> {
+    let mut out: Vec<usize> = Vec::new();
+    let mut queue = vec![root];
+    while let Some(k) = queue.pop() {
+        for &(child, parent) in pairs {
+            if parent == k && child != root && !out.contains(&child) {
+                out.push(child);
+                queue.push(child);
+            }
+        }
+    }
+    out
+}
+
+/// Close every popup (main-window close / app teardown). Main-thread only — callers are tauri
+/// window-event handlers, which run on the main thread on macOS.
+pub fn close_all() {
+    loop {
+        let key = POPUPS
+            .lock()
+            .unwrap()
+            .first()
+            .map(|p| Retained::as_ptr(&p.webview) as usize);
+        match key {
+            Some(k) => cleanup_popup(&move |p: &Popup| Retained::as_ptr(&p.webview) as usize == k, true),
+            None => break,
+        }
+    }
+}
+
+/// Strong ref to our installed Delegate (the KVO observer), if install() ran.
+fn installed_delegate() -> Option<Retained<Delegate>> {
+    INSTALLED.lock().unwrap().0.as_ref().map(|(d, _)| d.clone())
+}
+
+/// Strong refs to our delegate + wry's original (uiDelegate is weak on WKWebView).
+struct Installed(Option<(Retained<Delegate>, Retained<AnyObject>)>);
+unsafe impl Send for Installed {}
+static INSTALLED: Mutex<Installed> = Mutex::new(Installed(None));
+
+pub struct DelegateIvars {
+    /// wry's WryWebViewUIDelegate — unhandled WKUIDelegate messages forward here.
+    wry_delegate: Option<Retained<AnyObject>>,
+}
+
+define_class!(
+    #[unsafe(super(NSObject))]
+    #[thread_kind = MainThreadOnly]
+    #[name = "AppwrapUIDelegate"]
+    #[ivars = DelegateIvars]
+    struct Delegate;
+
+    unsafe impl NSObjectProtocol for Delegate {}
+
+    unsafe impl WKUIDelegate for Delegate {
+        #[unsafe(method_id(webView:createWebViewWithConfiguration:forNavigationAction:windowFeatures:))]
+        fn create_web_view(
+            &self,
+            opener: &WKWebView,
+            configuration: &WKWebViewConfiguration,
+            action: &WKNavigationAction,
+            features: &WKWindowFeatures,
+        ) -> Option<Retained<WKWebView>> {
+            let mtm = self.mtm();
+            let url = unsafe { action.request().URL() }
+                .and_then(|u| u.absoluteString())
+                .map(|s| s.to_string())
+                .unwrap_or_default();
+
+            let width = unsafe { features.width() }.map(|n| n.doubleValue()).unwrap_or(720.0).max(200.0);
+            let height = unsafe { features.height() }.map(|n| n.doubleValue()).unwrap_or(640.0).max(200.0);
+            let rect = NSRect::new(NSPoint::new(0.0, 0.0), NSSize::new(width, height));
+
+            let style = NSWindowStyleMask::Titled
+                | NSWindowStyleMask::Closable
+                | NSWindowStyleMask::Miniaturizable
+                | NSWindowStyleMask::Resizable;
+            let window = unsafe {
+                NSWindow::initWithContentRect_styleMask_backing_defer(
+                    mtm.alloc::<NSWindow>(),
+                    rect,
+                    style,
+                    NSBackingStoreType::Buffered,
+                    false,
+                )
+            };
+            // Required for NSWindows created without a window controller; we manage lifetime.
+            unsafe { window.setReleasedWhenClosed(false) };
+
+            // MUST use the PASSED configuration — anything else breaks window.opener/session
+            // (and WebKit raises if the returned webview wasn't made with it).
+            let child = unsafe {
+                WKWebView::initWithFrame_configuration(
+                    mtm.alloc::<WKWebView>(),
+                    window.frame(),
+                    configuration,
+                )
+            };
+            unsafe {
+                child.setCustomUserAgent(Some(&NSString::from_str(SAFARI_UA)));
+                // Route the child's own UI-delegate messages (window.close(), nested
+                // window.open) back through us.
+                child.setUIDelegate(Some(ProtocolObject::from_ref(self)));
+                child.setAutoresizingMask(
+                    objc2_app_kit::NSAutoresizingMaskOptions::ViewWidthSizable
+                        | objc2_app_kit::NSAutoresizingMaskOptions::ViewHeightSizable,
+                );
+                // Google multi-account: intercept the popup's OAuth navigation to append
+                // prompt=select_account (see decide_policy). Only wired when configured so the
+                // default remember-me behavior is untouched.
+                if GOOGLE_ACCOUNT_PICKER.load(Ordering::Relaxed) {
+                    child.setNavigationDelegate(Some(ProtocolObject::from_ref(self)));
+                }
+            }
+            window.setContentView(Some(&child));
+            // Observe the red-button (user) close so we tear the popup down too — otherwise the
+            // NSWindow + live WKWebView leak forever (webViewDidClose: only fires for page-initiated
+            // window.close()). setDelegate is a WEAK ref; our Delegate is held strong for the app's
+            // lifetime in INSTALLED, so it outlives every child window.
+            window.setDelegate(Some(ProtocolObject::from_ref(self)));
+            window.center();
+            window.makeKeyAndOrderFront(None);
+
+            // Bind the NSWindow title to the page's real <title> (KVO on WKWebView.title) — anti-spoof
+            // + UX; removed in cleanup_popup. Options=New(1) so the change dict carries the value
+            // (we re-read from the webview anyway); context unused (we key off the object).
+            unsafe {
+                let key = NSString::from_str("title");
+                let _: () = msg_send![
+                    &*child,
+                    addObserver: self,
+                    forKeyPath: &*key,
+                    options: 1usize,
+                    context: std::ptr::null_mut::<c_void>()
+                ];
+            }
+
+            eprintln!("[popup] createWebView → {url} ({width}x{height})");
+            POPUPS.lock().unwrap().push(Popup {
+                window,
+                webview: child.clone(),
+                parent: opener as *const WKWebView as usize,
+                rewritten: AtomicBool::new(false),
+            });
+            // Returning the webview makes WebKit load the navigation action's request itself.
+            Some(child)
+        }
+
+        #[unsafe(method(webViewDidClose:))]
+        fn web_view_did_close(&self, webview: &WKWebView) {
+            eprintln!("[popup] webViewDidClose → cleanup + close window");
+            // Page called window.close(): window still open, so close it (windowWillClose: then
+            // fires but finds no entry → no-op).
+            cleanup_popup(&|p: &Popup| &*p.webview == webview, true);
+        }
+    }
+
+    // Child-popup navigation policy — only consulted when GOOGLE_ACCOUNT_PICKER wired the child's
+    // navigationDelegate to us (create_web_view). Rewrites the Google OAuth navigation to force the
+    // account chooser; everything else is allowed unchanged.
+    unsafe impl WKNavigationDelegate for Delegate {
+        #[unsafe(method(webView:decidePolicyForNavigationAction:decisionHandler:))]
+        fn decide_policy(
+            &self,
+            webview: &WKWebView,
+            action: &WKNavigationAction,
+            handler: &block2::DynBlock<dyn Fn(WKNavigationActionPolicy)>,
+        ) {
+            let url = unsafe { action.request().URL() }
+                .and_then(|u| u.absoluteString())
+                .map(|s| s.to_string())
+                .unwrap_or_default();
+            // Rewrite AT MOST ONCE per popup, and only the entry OAuth navigation — consume the
+            // once-flag lazily (only when we actually have a rewrite) so a non-OAuth first navigation
+            // doesn't burn it. Prevents re-triggering on Google's own chooser/error redirects.
+            if let Some(rewritten) = google_account_picker_rewrite(&url) {
+                let claim = {
+                    let popups = POPUPS.lock().unwrap();
+                    popups
+                        .iter()
+                        .find(|p| &*p.webview == webview)
+                        .map(|p| !p.rewritten.swap(true, Ordering::Relaxed))
+                        .unwrap_or(true)
+                };
+                if claim {
+                    eprintln!("[popup] google account-picker: reload with prompt=select_account → {rewritten}");
+                    // Cancel THIS load, then reload the SAME child webview with the rewritten URL.
+                    // window.opener/postMessage survive a same-window navigation, so the Firebase flow
+                    // still resolves; the reloaded URL carries `prompt`, so it's allowed (no loop).
+                    handler.call((WKNavigationActionPolicy::Cancel,));
+                    if let Some(nsurl) = NSURL::URLWithString(&NSString::from_str(&rewritten)) {
+                        let req = NSURLRequest::requestWithURL(&nsurl);
+                        let _ = unsafe { webview.loadRequest(&req) };
+                    }
+                    return;
+                }
+            }
+            handler.call((WKNavigationActionPolicy::Allow,));
+        }
+    }
+
+    unsafe impl NSWindowDelegate for Delegate {
+        #[unsafe(method(windowWillClose:))]
+        fn window_will_close(&self, notification: &NSNotification) {
+            let Some(obj) = notification.object() else { return };
+            // NSNotification.object is the closing NSWindow.
+            let window: &NSWindow = unsafe { &*(Retained::as_ptr(&obj) as *const NSWindow) };
+            eprintln!("[popup] windowWillClose → cleanup (red-button or programmatic)");
+            // Window is already closing (AppKit drives it) → don't re-close.
+            cleanup_popup(&|p: &Popup| &*p.window == window, false);
+        }
+    }
+
+    /// Forward every WKUIDelegate message we don't implement to wry's original delegate
+    /// (file-upload open panel, media-capture permission, …).
+    impl Delegate {
+        /// KVO callback — only ever registered for popup WKWebViews' `title` (create_web_view), so
+        /// no context/keyPath dispatch or super call is needed. Mirrors the page title onto the
+        /// popup's NSWindow.
+        #[unsafe(method(observeValueForKeyPath:ofObject:change:context:))]
+        fn observe_value(
+            &self,
+            _key_path: Option<&NSString>,
+            object: Option<&AnyObject>,
+            _change: Option<&AnyObject>,
+            _context: *mut c_void,
+        ) {
+            let Some(object) = object else { return };
+            let key = object as *const AnyObject as usize;
+            let (window, webview) = {
+                let popups = POPUPS.lock().unwrap();
+                let Some(p) = popups.iter().find(|p| Retained::as_ptr(&p.webview) as usize == key)
+                else {
+                    return; // stale notification after teardown
+                };
+                (p.window.clone(), p.webview.clone())
+            };
+            if let Some(title) = unsafe { webview.title() } {
+                window.setTitle(&title);
+            }
+        }
+
+        #[unsafe(method(forwardingTargetForSelector:))]
+        fn forwarding_target(&self, _sel: Sel) -> *mut AnyObject {
+            match &self.ivars().wry_delegate {
+                Some(d) => Retained::as_ptr(d) as *mut AnyObject,
+                None => std::ptr::null_mut(),
+            }
+        }
+
+        #[unsafe(method(respondsToSelector:))]
+        fn responds_to(&self, sel: Sel) -> objc2::runtime::Bool {
+            let own: bool = unsafe { msg_send![super(self), respondsToSelector: sel] };
+            if own {
+                return objc2::runtime::Bool::YES;
+            }
+            let fwd = match &self.ivars().wry_delegate {
+                Some(d) => unsafe { msg_send![&**d, respondsToSelector: sel] },
+                None => false,
+            };
+            objc2::runtime::Bool::new(fwd)
+        }
+    }
+);
+
+/// Install the wrapper on the shell's WKWebView. `webview_ptr` is tauri's
+/// `PlatformWebview::inner()` (a WKWebView on macOS); runs inside `with_webview`,
+/// i.e. on the main thread.
+pub fn install(webview_ptr: *mut std::ffi::c_void, google_account_picker: bool) {
+    GOOGLE_ACCOUNT_PICKER.store(google_account_picker, Ordering::Relaxed);
+    let Some(mtm) = MainThreadMarker::new() else {
+        eprintln!("[popup] install called off the main thread — skipped");
+        return;
+    };
+    if webview_ptr.is_null() {
+        eprintln!("[popup] null webview ptr — skipped");
+        return;
+    }
+    let webview: &WKWebView = unsafe { &*(webview_ptr as *const WKWebView) };
+
+    // Keep wry's delegate alive (weak property) and as the forwarding target.
+    let wry_delegate: Option<Retained<AnyObject>> = unsafe { webview.UIDelegate() }
+        .map(|d| unsafe { Retained::cast_unchecked::<AnyObject>(d.retain()) });
+    eprintln!(
+        "[popup] wrapping uiDelegate (wry delegate present: {})",
+        wry_delegate.is_some()
+    );
+
+    let delegate = Delegate::alloc(mtm).set_ivars(DelegateIvars { wry_delegate: wry_delegate.clone() });
+    let delegate: Retained<Delegate> = unsafe { msg_send![super(delegate), init] };
+    unsafe { webview.setUIDelegate(Some(ProtocolObject::from_ref(&*delegate))) };
+
+    // Shell-webview UA is normalized at BUILD time in main.rs (.user_agent) — setting it here
+    // (setup) is too late for the first document's navigator.userAgent snapshot.
+
+    INSTALLED.lock().unwrap().0 = Some((
+        delegate,
+        wry_delegate.unwrap_or_else(|| unsafe {
+            Retained::cast_unchecked::<AnyObject>(NSObject::new())
+        }),
+    ));
+}

package/runtime-desktop/src-tauri/src/push_mac.rs

@@ -0,0 +1,193 @@
+// APNs device-token registration for the SIGNED desktop lane (push.register / push.unregister).
+//
+// macOS delivers the token via NSApplicationDelegate callbacks. Tauri (tao) owns the app delegate
+// and does not implement the two APNs selectors, so we ADD them to tao's delegate class at runtime
+// (class_addMethod — pure addition, no swizzle, nothing existing is displaced). If a future tao
+// ever implements them, class_addMethod returns false and we fail the request honestly instead of
+// silently double-handling. Envelope mirrors the mobile shell (runtime/app/shell/handlers-push.ts):
+// result = { platform: 'apns', token: <hex>, topic: <bundle id> }, 25s timeout, single-flight.
+use std::ffi::CStr;
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
+use std::sync::Mutex;
+
+use objc2::runtime::{AnyClass, AnyObject, Sel};
+use objc2::{msg_send, sel, MainThreadMarker};
+use objc2_app_kit::NSApplication;
+use objc2_foundation::{NSData, NSError};
+use serde_json::json;
+
+use crate::{deliver, deliver_error, shell};
+
+/// Pending register() waiting for the delegate callback (single-flight, like oauth).
+static PENDING: Mutex<Option<(tauri::WebviewWindow, String)>> = Mutex::new(None);
+/// Cached token — APNs tokens are stable per launch; later register() calls resolve instantly.
+static TOKEN: Mutex<Option<String>> = Mutex::new(None);
+static HOOKS_INSTALLED: AtomicBool = AtomicBool::new(false);
+/// Monotonic id of the current in-flight register. Each new flight bumps it; the timeout thread
+/// captures its own id and only fires if it's STILL the current flight — so a stale timer from a
+/// fast-failed-then-retried flight can't cancel the later one (see `timeout_should_fire`).
+static FLIGHT: AtomicU64 = AtomicU64::new(0);
+
+/// Guard for the timeout thread: fire only if this flight is still the current one. Pure — unit-tested.
+fn timeout_should_fire(my_flight: u64, current_flight: u64) -> bool {
+    my_flight == current_flight
+}
+
+fn deliver_token(window: &tauri::WebviewWindow, id: &str, token: &str) {
+    let resp = json!({ "v": 1, "id": id, "kind": "response", "result": {
+        "platform": "apns", "token": token, "topic": shell().identifier,
+    }});
+    deliver(window, &resp);
+}
+
+/// `push.register` — resolve the APNs device token. Called from appwrap_invoke (any thread);
+/// replies asynchronously from the injected delegate callback (main thread).
+pub fn register(window: tauri::WebviewWindow, id: String) {
+    if let Some(tok) = TOKEN.lock().unwrap().clone() {
+        return deliver_token(&window, &id, &tok);
+    }
+    let my_flight;
+    {
+        let mut p = PENDING.lock().unwrap();
+        if p.is_some() {
+            return deliver_error(&window, &id, "NATIVE_ERROR", "push.register already in progress");
+        }
+        // fetch_add returns the prior value; FLIGHT now holds this flight's unique id.
+        my_flight = FLIGHT.fetch_add(1, Ordering::SeqCst) + 1;
+        *p = Some((window.clone(), id.clone()));
+    }
+    let res = window.run_on_main_thread(|| {
+        let mtm = MainThreadMarker::new().expect("run_on_main_thread guarantees main");
+        if let Err(msg) = install_hooks(mtm) {
+            if let Some((w, id)) = PENDING.lock().unwrap().take() {
+                deliver_error(&w, &id, "NATIVE_ERROR", &msg);
+            }
+            return;
+        }
+        let app = NSApplication::sharedApplication(mtm);
+        app.registerForRemoteNotifications();
+        eprintln!("[push] registerForRemoteNotifications requested");
+    });
+    if let Err(e) = res {
+        if let Some((w, id)) = PENDING.lock().unwrap().take() {
+            deliver_error(&w, &id, "NATIVE_ERROR", &format!("failed to reach main thread: {e}"));
+        }
+        return;
+    }
+    // Mobile-shell parity: 25s cap (kit's push.register timeout is 30s). Only fire if THIS flight
+    // is still current — hold the PENDING lock across the check+take so a concurrent new flight
+    // can't slip in between (else a stale timer could cancel a later register).
+    std::thread::spawn(move || {
+        std::thread::sleep(std::time::Duration::from_secs(25));
+        let mut p = PENDING.lock().unwrap();
+        if timeout_should_fire(my_flight, FLIGHT.load(Ordering::SeqCst)) {
+            if let Some((w, id)) = p.take() {
+                deliver_error(&w, &id, "TIMEOUT", "APNs registration timed out");
+            }
+        }
+    });
+}
+
+/// `push.unregister` — stop receiving remote pushes + drop the cached token.
+pub fn unregister(window: tauri::WebviewWindow, id: String) {
+    TOKEN.lock().unwrap().take();
+    let res = window.clone().run_on_main_thread(move || {
+        let mtm = MainThreadMarker::new().expect("main");
+        NSApplication::sharedApplication(mtm).unregisterForRemoteNotifications();
+        let resp = json!({ "v": 1, "id": id, "kind": "response", "result": null });
+        deliver(&window, &resp);
+    });
+    if let Err(e) = res {
+        eprintln!("[push] unregister failed to reach main thread: {e}");
+    }
+}
+
+/// Add the two APNs delegate methods to tao's NSApplicationDelegate class (once).
+fn install_hooks(mtm: MainThreadMarker) -> Result<(), String> {
+    if HOOKS_INSTALLED.load(Ordering::SeqCst) {
+        return Ok(());
+    }
+    let app = NSApplication::sharedApplication(mtm);
+    let delegate: *mut AnyObject = unsafe { msg_send![&*app, delegate] };
+    if delegate.is_null() {
+        return Err("no NSApplication delegate to hook".into());
+    }
+    let cls: &AnyClass = unsafe { msg_send![delegate, class] };
+    // v@:@@ = void ret, self, _cmd, NSApplication*, NSData*/NSError*.
+    let types: &CStr = c"v@:@@";
+    let ok = unsafe {
+        objc2::ffi::class_addMethod(
+            cls as *const AnyClass as *mut AnyClass,
+            sel!(application:didRegisterForRemoteNotificationsWithDeviceToken:),
+            std::mem::transmute::<
+                extern "C-unwind" fn(*mut AnyObject, Sel, *mut AnyObject, *mut NSData),
+                unsafe extern "C-unwind" fn(),
+            >(did_register),
+            types.as_ptr(),
+        )
+    };
+    let ok2 = unsafe {
+        objc2::ffi::class_addMethod(
+            cls as *const AnyClass as *mut AnyClass,
+            sel!(application:didFailToRegisterForRemoteNotificationsWithError:),
+            std::mem::transmute::<
+                extern "C-unwind" fn(*mut AnyObject, Sel, *mut AnyObject, *mut NSError),
+                unsafe extern "C-unwind" fn(),
+            >(did_fail),
+            types.as_ptr(),
+        )
+    };
+    if !ok.as_bool() || !ok2.as_bool() {
+        return Err(format!(
+            "delegate class {} already implements an APNs selector — refusing to double-handle",
+            cls.name().to_string_lossy()
+        ));
+    }
+    HOOKS_INSTALLED.store(true, Ordering::SeqCst);
+    eprintln!("[push] APNs delegate hooks installed on {}", cls.name().to_string_lossy());
+    Ok(())
+}
+
+extern "C-unwind" fn did_register(_this: *mut AnyObject, _cmd: Sel, _app: *mut AnyObject, token: *mut NSData) {
+    // A null/empty NSData is a failed registration masquerading as success — never cache it or
+    // hand back an empty-string "token" (the app would upload garbage and silently get no pushes).
+    let bytes = if token.is_null() { Vec::new() } else { unsafe { (*token).to_vec() } };
+    if bytes.is_empty() {
+        eprintln!("[push] APNs delivered a null/empty device token — treating as failure");
+        if let Some((w, id)) = PENDING.lock().unwrap().take() {
+            deliver_error(&w, &id, "NATIVE_ERROR", "APNs returned an empty device token");
+        }
+        return;
+    }
+    let hex = bytes.iter().map(|b| format!("{b:02x}")).collect::<String>();
+    eprintln!("[push] APNs token: {hex}");
+    *TOKEN.lock().unwrap() = Some(hex.clone());
+    if let Some((w, id)) = PENDING.lock().unwrap().take() {
+        deliver_token(&w, &id, &hex);
+    }
+}
+
+extern "C-unwind" fn did_fail(_this: *mut AnyObject, _cmd: Sel, _app: *mut AnyObject, error: *mut NSError) {
+    let msg = if error.is_null() {
+        "APNs registration failed".to_string()
+    } else {
+        unsafe { (*error).localizedDescription() }.to_string()
+    };
+    eprintln!("[push] APNs registration failed: {msg}");
+    if let Some((w, id)) = PENDING.lock().unwrap().take() {
+        deliver_error(&w, &id, "NATIVE_ERROR", &msg);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn timeout_fires_only_for_the_current_flight() {
+        // Flight #1's timer must NOT fire once flight #2 has started (fast-fail + retry scenario).
+        assert!(timeout_should_fire(1, 1)); // still current → fire
+        assert!(!timeout_should_fire(1, 2)); // superseded → do NOT cancel the later flight
+        assert!(timeout_should_fire(2, 2));
+    }
+}