@livx.cc/appwrap 0.43.0 → 0.46.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.43.0",
+  "version": "0.46.1",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime-desktop/bridge-shim/build.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+# Build the injectable content bundle. Must run with the bod-browser repo as cwd so its
+# tsconfig `paths` (shared/*) resolve — the bundle reuses extension/src/content/* unmodified.
+set -e
+HERE="$(cd "$(dirname "$0")" && pwd)"
+BOD_BROWSER="${BOD_BROWSER:-$HERE/../../../bod-browser}"
+cd "$BOD_BROWSER"
+bun build "$HERE/content-entry.ts" --outfile "$HERE/dist/content.js"
+echo "built $HERE/dist/content.js"

package/runtime-desktop/bridge-shim/content-entry.ts

@@ -0,0 +1,87 @@
+// SPIKE: browser-bridge content layer for the appwrap desktop (Tauri/WKWebView) shell.
+// Reuses bod-browser's extension/src/content/* modules UNMODIFIED; only the transport differs:
+// instead of chrome.runtime messaging, each page dials a local WS to the shim (bridge-shim/shim.ts)
+// and answers ContentAction messages. Injected per-window via Tauri initialization_script.
+//
+// Build (from the bod-browser repo root so its tsconfig `paths` resolve shared/*):
+//   cd ../bod-browser && bun build <this file> --outfile <appwrap>/runtime-desktop/bridge-shim/dist/content.js
+import type { ContentAction } from 'shared/protocol';
+import { advanceScroll } from '../../../bod-browser/extension/src/content/advance-scroll';
+import {
+  clickElement, typeInElement, fillElement, doScroll, scrollElementIntoView, evalScript,
+  waitForElement, hoverElement, scrollElementBy, hoverNear, sendKey,
+} from '../../../bod-browser/extension/src/content/actions';
+import {
+  queryElements, getLinks, findButtons, clickText, queryByText, getElementValue, setElementAttribute,
+} from '../../../bod-browser/extension/src/content/query';
+import { getA11ySnapshot, queryA11y } from '../../../bod-browser/extension/src/content/a11y';
+import { probePage } from '../../../bod-browser/extension/src/content/probe';
+import { diagnosePage } from '../../../bod-browser/extension/src/content/diagnose';
+
+declare global {
+  interface Window { __BRIDGE_LABEL?: string; __BRIDGE_PORT?: number; __BRIDGE_LOADED?: boolean }
+}
+
+async function handleMessage(msg: ContentAction): Promise<unknown> {
+  switch (msg.action) {
+    case 'getContent':
+      return { url: location.href, title: document.title, html: document.documentElement.outerHTML, text: document.body?.innerText ?? '' };
+    case 'getTextContent':
+      return { url: location.href, title: document.title, text: document.body?.innerText?.slice(0, 20000) || '' };
+    case 'query': return queryElements(msg.selector, msg.multiple);
+    case 'click': return clickElement(msg.selector);
+    case 'type': return typeInElement(msg.selector, msg.value, msg.mode, msg.clear);
+    case 'fill': return fillElement(msg.selector, msg.value, msg.timeout, msg.mode, msg.clear);
+    case 'getValue': return getElementValue(msg.selector);
+    case 'setAttribute': return setElementAttribute(msg.selector, msg.attr, msg.value);
+    case 'scroll': return doScroll(msg.x || 0, msg.y || 0, msg.behavior);
+    case 'scrollIntoView': return scrollElementIntoView(msg.selector, msg.behavior);
+    case 'eval': return evalScript(msg.script);
+    case 'waitFor': return waitForElement(msg.selector, msg.timeout || 5000);
+    case 'hover': return hoverElement(msg.selector);
+    case 'scrollEl': return scrollElementBy(msg.selector, msg.deltaX || 0, msg.deltaY || 0, msg.behavior);
+    case 'advanceScroll':
+      return advanceScroll({ deltaY: msg.deltaY, itemSelector: msg.itemSelector, loadMoreSelector: msg.loadMoreSelector, behavior: msg.behavior });
+    case 'getA11ySnapshot': return getA11ySnapshot(msg.root || null, msg.maxDepth || 10, msg.mode || 'full');
+    case 'probe': return probePage(msg.goal || null);
+    case 'diagnose': return diagnosePage();
+    case 'queryA11y': return queryA11y(msg.role, msg.name, msg.multiple);
+    case 'getLinks': return getLinks(msg.pattern || null, msg.scope || null);
+    case 'clickText': return clickText(msg.text, msg.scope || null);
+    case 'queryByText': return queryByText(msg.text, msg.scope || null);
+    case 'findButtons': return findButtons(msg.scope || null);
+    case 'sendKey': return sendKey(msg.selector || null, msg.key, msg.modifiers);
+    case '_ping': return { pong: true };
+    default:
+      throw new Error(`Unknown action: ${(msg as ContentAction).action}`);
+  }
+}
+
+(() => {
+  // initialization_script can fire more than once per document lifecycle; guard.
+  if (window.__BRIDGE_LOADED) return;
+  window.__BRIDGE_LOADED = true;
+  const label = window.__BRIDGE_LABEL || 'unknown';
+
+  // Transport: WebKit blocks ws://127.0.0.1 (and plain-http beacons) from https pages as mixed
+  // content — no loopback exemption like Chrome. So results go out via the native
+  // WKScriptMessageHandler the shell installs (webkit.messageHandlers.bridgeShim), and commands
+  // come in via window.__bridgeDispatch(...) evaluated by the shell (evalJs op).
+  type WebkitHandlers = { webkit?: { messageHandlers?: { bridgeShim?: { postMessage: (s: string) => void } } } };
+  const post = (o: Record<string, unknown>) => {
+    try { (window as WebkitHandlers).webkit?.messageHandlers?.bridgeShim?.postMessage(JSON.stringify({ label, ...o })); } catch { /* ignore */ }
+  };
+
+  (window as unknown as { __bridgeDispatch: (m: ContentAction & { id: string }) => void }).__bridgeDispatch = (m) => {
+    Promise.resolve()
+      .then(() => handleMessage(m))
+      .then(result => post({ id: m.id, result }))
+      .catch((e: Error) => post({ id: m.id, error: e.message }));
+  };
+
+  const register = () => post({ type: 'register', url: location.href, title: document.title });
+  register();
+  addEventListener('DOMContentLoaded', register);
+  addEventListener('load', register);
+  console.log(`[BridgeDesktop:cs ${label}] loaded on ${location.href.slice(0, 80)}`);
+})();

package/runtime-desktop/bridge-shim/shim.ts

@@ -0,0 +1,317 @@
+#!/usr/bin/env bun
+// SPIKE: browser-bridge "extension instance" shim for the appwrap desktop (Tauri) shell.
+// Speaks the UNMODIFIED bod-browser extension protocol to the bridge server (ws://localhost:9230),
+// backed by Tauri windows instead of Chrome tabs:
+//   - WS client -> bridge server: hello { instanceId: 'appwrap-desktop' }, answers WsCommand.
+//   - WS server :9236 (/page)   : each Tauri window's injected content bundle dials in and
+//                                 executes ContentAction messages (the DOM layer).
+//   - TCP :9237 (line-JSON)     : the Rust shell connects as 'control'; the shim asks it for
+//                                 window ops (createWindow/closeWindow/navigate/screenshot).
+// Run: bun runtime-desktop/bridge-shim/shim.ts
+
+const SERVER_URL = process.env.BRIDGE_SERVER_URL || 'ws://localhost:9230';
+const INSTANCE_ID = process.env.BRIDGE_INSTANCE_ID || 'appwrap-desktop';
+const PAGE_PORT = Number(process.env.APPWRAP_BRIDGE_PAGE_PORT || 9236);
+const RUST_PORT = Number(process.env.APPWRAP_BRIDGE_RUST_PORT || 9237);
+
+const log = (m: string, ...a: unknown[]) => console.log(`[shim] ${m}`, ...a);
+
+// ---------------------------------------------------------------------------
+// Tab registry: Tauri window label <-> numeric tabId (chrome.tabs.Tab-ish shape)
+// ---------------------------------------------------------------------------
+interface TabEntry { tabId: number; label: string; url: string; title: string; registered: boolean; profileId?: string }
+const tabs = new Map<string, TabEntry>(); // by label
+let tabCounter = 0;
+let activeLabel: string | null = null;
+
+function tabShape(t: TabEntry, active = t.label === activeLabel) {
+  return { id: t.tabId, url: t.url, title: t.title, active, windowId: 1, status: t.registered ? 'complete' : 'loading', label: t.label, profileId: t.profileId };
+}
+function byTabId(tabId?: number): TabEntry {
+  if (tabId != null) {
+    const t = [...tabs.values()].find(t => t.tabId === Number(tabId));
+    if (!t) throw new Error(`No such tab: ${tabId}`);
+    return t;
+  }
+  const t = (activeLabel && tabs.get(activeLabel)) || [...tabs.values()].pop();
+  if (!t) throw new Error('No windows open (use newTab first)');
+  return t;
+}
+
+// ---------------------------------------------------------------------------
+// Rust control channel (TCP, newline-delimited JSON)
+// ---------------------------------------------------------------------------
+type Pending = { resolve: (v: unknown) => void; reject: (e: Error) => void; timer: ReturnType<typeof setTimeout> };
+let rustSock: { write: (s: string) => void } | null = null;
+const rustPending = new Map<string, Pending>();
+let reqCounter = 0;
+
+function rustRequest(op: string, params: Record<string, unknown> = {}, timeoutMs = 15000): Promise<unknown> {
+  if (!rustSock) return Promise.reject(new Error('Desktop shell not connected to shim (is the app running with APPWRAP_BRIDGE_JS?)'));
+  const id = `r${++reqCounter}`;
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => { rustPending.delete(id); reject(new Error(`rust op ${op} timed out`)); }, timeoutMs);
+    rustPending.set(id, { resolve, reject, timer });
+    rustSock!.write(JSON.stringify({ id, op, ...params }) + '\n');
+  });
+}
+
+Bun.listen({
+  hostname: '127.0.0.1',
+  port: RUST_PORT,
+  socket: {
+    open(socket) {
+      log('rust control connected');
+      rustSock = { write: (s) => socket.write(s) };
+      (socket as unknown as { __buf: string }).__buf = '';
+    },
+    data(socket, data) {
+      const s = socket as unknown as { __buf: string };
+      s.__buf += data.toString();
+      let idx: number;
+      while ((idx = s.__buf.indexOf('\n')) >= 0) {
+        const line = s.__buf.slice(0, idx).trim();
+        s.__buf = s.__buf.slice(idx + 1);
+        if (!line) continue;
+        try {
+          const msg = JSON.parse(line);
+          if (msg.type === 'pageMsg') { onPageMsg(String(msg.payload)); continue; }
+          const p = rustPending.get(msg.id);
+          if (p) {
+            rustPending.delete(msg.id);
+            clearTimeout(p.timer);
+            if (msg.error) p.reject(new Error(String(msg.error)));
+            else p.resolve(msg.result);
+          }
+        } catch (e) { log('bad rust line:', line.slice(0, 200), (e as Error).message); }
+      }
+    },
+    close() { log('rust control disconnected'); rustSock = null; },
+    error(_s, e) { log('rust control error:', e.message); },
+  },
+});
+
+// ---------------------------------------------------------------------------
+// Page messages (via the shell's WKScriptMessageHandler -> pageMsg lines) and
+// command dispatch (via evalJs -> window.__bridgeDispatch)
+// ---------------------------------------------------------------------------
+const pagePending = new Map<string, Pending>();
+
+function onPageMsg(payload: string) {
+  let msg: Record<string, unknown>;
+  try { msg = JSON.parse(payload); } catch { log('bad pageMsg:', payload.slice(0, 200)); return; }
+  const label = String(msg.label || '');
+  if (msg.type === 'register') {
+    let t = tabs.get(label);
+    if (!t) { t = { tabId: ++tabCounter, label, url: '', title: '', registered: false }; tabs.set(label, t); }
+    t.registered = true;
+    t.url = String(msg.url || t.url);
+    t.title = String(msg.title || t.title);
+    log(`page registered: ${label} tabId=${t.tabId} ${t.url.slice(0, 80)}`);
+    return;
+  }
+  const p = pagePending.get(String(msg.id));
+  if (p) {
+    pagePending.delete(String(msg.id));
+    clearTimeout(p.timer);
+    if (msg.error) p.reject(new Error(String(msg.error)));
+    else p.resolve(msg.result);
+  }
+}
+
+// Debug HTTP endpoint (curl a raw rust op / read page beacons)
+Bun.serve({
+  hostname: '127.0.0.1',
+  port: PAGE_PORT,
+  async fetch(req) {
+    const path = new URL(req.url).pathname;
+    if (path === '/log' && req.method === 'POST') { log('page:', await req.text()); return new Response('ok'); }
+    if (path === '/rust' && req.method === 'POST') {
+      const body = await req.json() as Record<string, unknown>;
+      try { return Response.json({ result: await rustRequest(String(body.op), body) }); }
+      catch (e) { return Response.json({ error: (e as Error).message }); }
+    }
+    return new Response('bridge-shim debug endpoint', { status: 200 });
+  },
+});
+
+function pageExec(t: TabEntry, action: Record<string, unknown>, timeoutMs = 30000): Promise<unknown> {
+  const id = `p${++reqCounter}`;
+  const dispatch = `window.__bridgeDispatch && window.__bridgeDispatch(${JSON.stringify({ id, ...action })})`;
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => { pagePending.delete(id); reject(new Error(`exec ${action.action} timed out on tab ${t.tabId} (page not bridged?)`)); }, timeoutMs);
+    pagePending.set(id, { resolve, reject, timer });
+    rustRequest('evalJs', { label: t.label, js: dispatch }).catch(e => {
+      if (pagePending.delete(id)) { clearTimeout(timer); reject(e as Error); }
+    });
+  });
+}
+
+/** Wait until the tab's page socket is (re)connected — used after newTab/navigate. */
+async function waitForPage(label: string, timeoutMs = 15000): Promise<TabEntry> {
+  const start = Date.now();
+  for (;;) {
+    const t = tabs.get(label);
+    if (t?.registered) return t;
+    if (Date.now() - start > timeoutMs) throw new Error(`page for ${label} did not connect within ${timeoutMs}ms`);
+    await new Promise(r => setTimeout(r, 100));
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Command handling (the extension-background analogue)
+// ---------------------------------------------------------------------------
+async function handleCommand(msg: { id: string; cmd: string; params?: Record<string, unknown> }): Promise<unknown> {
+  const params = (msg.params || {}) as Record<string, unknown> & { tabId?: number; url?: string };
+  switch (msg.cmd) {
+    case 'ping': return { pong: true };
+    case 'getTabs': return [...tabs.values()].map(t => tabShape(t));
+    case 'getActiveTab': return tabShape(byTabId(undefined));
+    case 'newTab': {
+      const url = params.url || 'https://example.com';
+      // Optional profileId → the shell creates a manual window bound to that profile's persistent,
+      // isolated WKWebsiteDataStore (see bridge_mac.rs). Absent → a plain tauri window.
+      const profileId = (params as { profileId?: string }).profileId;
+      // Unique across shim restarts — the app may still hold windows from a previous shim run.
+      const label = `bridge-${Date.now().toString(36)}-${++tabCounter}`;
+      const t: TabEntry = { tabId: tabCounter, label, url: String(url), title: '', registered: false, profileId };
+      tabs.set(label, t);
+      activeLabel = label;
+      await rustRequest('createWindow', { label, url, ...(profileId ? { profileId } : {}) });
+      await waitForPage(label).catch(e => log(`newTab: ${e.message}`)); // tab exists even if slow to load
+      return tabShape(t);
+    }
+    case 'closeTab': {
+      const t = byTabId(params.tabId);
+      await rustRequest('closeWindow', { label: t.label });
+      tabs.delete(t.label);
+      if (activeLabel === t.label) activeLabel = [...tabs.keys()].pop() ?? null;
+      return { success: true };
+    }
+    case 'navigate': {
+      const t = byTabId(params.tabId);
+      t.registered = false; // old document is going away
+      t.url = String(params.url);
+      activeLabel = t.label;
+      await rustRequest('navigate', { label: t.label, url: params.url });
+      await waitForPage(t.label).catch(e => log(`navigate: ${e.message}`));
+      return tabShape(t);
+    }
+    case 'screenshot': {
+      const t = byTabId(params.tabId);
+      const r = await rustRequest('screenshot', { label: t.label }, 20000) as { png: string };
+      return { dataUrl: `data:image/png;base64,${r.png}` };
+    }
+    case 'exec': {
+      const { tabId, frameId: _f, ...action } = params as Record<string, unknown> & { tabId?: number };
+      const t = byTabId(tabId);
+      const timeout = action.action === 'waitFor' ? Number(action.timeout || 5000) + 5000 : 30000;
+      return pageExec(t, action, timeout);
+    }
+    case 'setInput': {
+      // Extension does this via chrome.scripting in MAIN world; our bundle already runs in the
+      // page world, so route through the content eval with a native-setter script.
+      const t = byTabId(params.tabId);
+      const script = `(() => { const el = document.querySelector(${JSON.stringify(params.selector)});
+        if (!el) return { error: 'not found: ' + ${JSON.stringify(params.selector)} };
+        const proto = el instanceof HTMLTextAreaElement ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype;
+        const setter = Object.getOwnPropertyDescriptor(proto, 'value')?.set;
+        if (setter) setter.call(el, ${JSON.stringify(params.value)}); else el.value = ${JSON.stringify(params.value)};
+        el.dispatchEvent(new Event('input', { bubbles: true }));
+        el.dispatchEvent(new Event('change', { bubbles: true }));
+        return { ok: true, value: el.value }; })()`;
+      const r = await rustRequest('evalAsync', { label: t.label, js: `return JSON.stringify(${script});` }) as { json: string };
+      const inner = JSON.parse(r.json || 'null') as { error?: string; ok?: boolean } | null;
+      if (inner?.error) throw new Error(inner.error);
+      return inner;
+    }
+    case 'cdpEval': {
+      // CSP-immune eval — WKWebView callAsyncJavaScript (native compilation, awaits promises).
+      // The bridge server falls back to this when a page's CSP blocks the content-layer eval().
+      const t = byTabId(params.tabId);
+      const expression = String(params.expression || '');
+      const body = `const __r = await (${expression}); return JSON.stringify(__r === undefined ? null : __r);`;
+      const timeoutMs = Number((params as { timeoutMs?: number }).timeoutMs || 30000);
+      try {
+        const r = await rustRequest('evalAsync', { label: t.label, js: body }, timeoutMs) as { json: string };
+        return { result: JSON.parse(r.json || 'null') };
+      } catch (e) {
+        return { result: null, error: (e as Error).message };
+      }
+    }
+    case 'cdpInsertText': {
+      // Controlled text insertion into a contenteditable / input WITHOUT ever submitting.
+      // The extension's real path is CDP Input.insertText (we have no CDP); this replicates it
+      // via focus + beforeinput/insertText/input events. It deliberately dispatches NO Enter/
+      // keydown and never clicks a submit control — a spike delegation auto-submitted a comment
+      // because the earlier execCommand workaround let a stray Enter through; this closes that.
+      const t = byTabId(params.tabId);
+      const selector = (params as { selector?: string }).selector;
+      const text = String((params as { text?: string }).text ?? '');
+      const clear = !!(params as { clear?: boolean }).clear;
+      const body = `
+        const el = ${selector ? `document.querySelector(${JSON.stringify(selector)})` : 'document.activeElement'};
+        if (!el) return JSON.stringify({ error: 'insert target not found' });
+        el.focus();
+        const editable = el.isContentEditable;
+        if (${clear}) {
+          if (editable) { const r = document.createRange(); r.selectNodeContents(el); const s = getSelection(); s.removeAllRanges(); s.addRange(r); document.execCommand('delete'); }
+          else { const proto = el instanceof HTMLTextAreaElement ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype; const set = Object.getOwnPropertyDescriptor(proto,'value')?.set; set ? set.call(el,'') : (el.value=''); }
+        }
+        el.dispatchEvent(new InputEvent('beforeinput', { bubbles: true, cancelable: true, inputType: 'insertText', data: ${JSON.stringify(text)} }));
+        if (editable) {
+          if (!document.execCommand('insertText', false, ${JSON.stringify(text)})) el.textContent += ${JSON.stringify(text)};
+        } else {
+          const proto = el instanceof HTMLTextAreaElement ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype;
+          const set = Object.getOwnPropertyDescriptor(proto,'value')?.set; const nv = (el.value||'') + ${JSON.stringify(text)};
+          set ? set.call(el, nv) : (el.value = nv);
+        }
+        el.dispatchEvent(new InputEvent('input', { bubbles: true, inputType: 'insertText', data: ${JSON.stringify(text)} }));
+        return JSON.stringify({ ok: true, value: editable ? el.innerText : el.value, submitted: false });`;
+      const r = await rustRequest('evalAsync', { label: t.label, js: body }) as { json: string };
+      const out = JSON.parse(r.json || 'null') as { error?: string };
+      if (out?.error) throw new Error(out.error);
+      return out;
+    }
+    case 'getGroup': return { groupId: null };
+    case 'closeGroup': return { success: true };
+    case 'listExtensions': return [];
+    default:
+      throw new Error(`unsupported on appwrap-desktop: ${msg.cmd}`);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Bridge server WS client (the extension background's ws.ts analogue)
+// ---------------------------------------------------------------------------
+let serverWs: WebSocket | null = null;
+function connectServer() {
+  serverWs = new WebSocket(SERVER_URL);
+  serverWs.onopen = () => {
+    log(`connected to bridge server ${SERVER_URL} as ${INSTANCE_ID}`);
+    serverWs!.send(JSON.stringify({ type: 'hello', userAgent: `appwrap-desktop-shell (Tauri/WKWebView; ${process.platform})`, instanceId: INSTANCE_ID, buildHash: 'appwrap-desktop-spike' }));
+    serverWs!.send(JSON.stringify({ type: 'ping', t: Date.now() }));
+  };
+  serverWs.onmessage = async (ev) => {
+    let msg: { id: string; cmd: string; params?: Record<string, unknown>; type?: string } | undefined;
+    try {
+      const parsed = JSON.parse(String(ev.data));
+      if (parsed.type === 'pong' || parsed.type === 'reload' || parsed.type === 'recording_saved') return;
+      msg = parsed;
+      const result = await handleCommand(msg!);
+      log(`cmd=${msg!.cmd} ok`);
+      serverWs!.send(JSON.stringify({ id: msg!.id, result }));
+    } catch (e) {
+      log(`cmd=${msg?.cmd} error: ${(e as Error).message}`);
+      try { serverWs!.send(JSON.stringify({ id: msg?.id, error: (e as Error).message })); } catch { /* ignore */ }
+    }
+  };
+  serverWs.onclose = () => { log('server disconnected, retrying in 3s'); setTimeout(connectServer, 3000); };
+  serverWs.onerror = () => { /* onclose follows */ };
+}
+connectServer();
+setInterval(() => {
+  if (serverWs?.readyState === WebSocket.OPEN) serverWs.send(JSON.stringify({ type: 'ping', t: Date.now() }));
+}, 15000);
+
+log(`page WS :${PAGE_PORT}  rust control :${RUST_PORT}`);

package/runtime-desktop/src-tauri/Cargo.lock

@@ -52,7 +52,9 @@ name = "appwrap-desktop-shell"
 version = "0.1.0"
 dependencies = [
  "arboard",
+ "base64 0.22.1",
  "block2",
+ "libc",
  "objc2",
  "objc2-app-kit",
  "objc2-authentication-services",

package/runtime-desktop/src-tauri/Cargo.toml

@@ -15,10 +15,12 @@ tauri-plugin-autostart = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 arboard = "3"
+libc = "0.2"  # desktop.server: setsid the local-server child + SIGTERM its whole process group on teardown
 
 # macOS oauth.authorize — ASWebAuthenticationSession (system-browser auth sheet, exact parity with the
 # iOS shell path in runtime/app/shell/handlers-oauth.ts: auto-close on redirect, user-cancel signal).
 [target.'cfg(target_os = "macos")'.dependencies]
+base64 = "0.22"  # SPIKE: bridge_mac screenshot PNG encoding
 objc2 = "0.6"
 objc2-foundation = "0.3"
 objc2-app-kit = "0.3"