@livx.cc/appwrap 0.43.0 → 0.46.2

package/runtime-desktop/src-tauri/src/popup_mac.rs

@@ -1,466 +1,5 @@
-// macOS popup-window support — makes arbitrary wrapped web apps' `window.open` flows work
-// (Firebase signInWithPopup dies with auth/popup-blocked without this).
-//
-// Approach: wrap wry's WKUIDelegate with our own that implements
-//   - webView:createWebViewWithConfiguration:forNavigationAction:windowFeatures:
-//     The child WKWebView is alloc'd with the PASSED configuration — that's what preserves
-//     window.opener / postMessage and the shared session. Hosted in a plain NSWindow.
-//   - webViewDidClose: — pages that call window.close() (Firebase popups do) close their NSWindow.
-// Everything else is forwarded to wry's original delegate via forwardingTargetForSelector /
-// respondsToSelector (wry ALWAYS installs a WryWebViewUIDelegate; `uiDelegate` is a WEAK property,
-// so we keep a strong ref to wry's delegate in our ivars — dropping it would break file-upload
-// panels and media-capture grants).
-//
-// wry 0.55 does have a built-in popup path (NewWindowResponse::Allow via tauri's on_new_window),
-// but it implements NO webViewDidClose and exposes no child handle to patch one in — a Firebase
-// popup would linger as a dead window after auth. Hence the wrapper.
-use std::ffi::c_void;
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::Mutex;
-
-use objc2::rc::Retained;
-use objc2::runtime::{AnyObject, NSObject, NSObjectProtocol, ProtocolObject, Sel};
-use objc2::{define_class, msg_send, DefinedClass, MainThreadMarker, MainThreadOnly, Message};
-use objc2_app_kit::{NSBackingStoreType, NSWindow, NSWindowDelegate, NSWindowStyleMask};
-use objc2_foundation::{NSNotification, NSPoint, NSRect, NSSize, NSString, NSURL, NSURLRequest};
-use objc2_web_kit::{
-    WKNavigationAction, WKNavigationActionPolicy, WKNavigationDelegate, WKUIDelegate, WKWebView,
-    WKWebViewConfiguration, WKWindowFeatures,
-};
-
-/// When true, Google `signInWithPopup` OAuth popups get `prompt=select_account` appended so a
-/// remembered Google session doesn't auto-sign — the user picks an account (multi-account apps like
-/// Unclaw). Set once from the shell config at install(); read in the child's navigation delegate.
-static GOOGLE_ACCOUNT_PICKER: AtomicBool = AtomicBool::new(false);
-
-/// Rewrite a Google OAuth popup URL to force the account chooser, or None to leave it untouched.
-/// Matches only `accounts.google.com` OAuth authorize / sign-in endpoints that don't already carry a
-/// `prompt` param (so we don't clobber an app that set its own, and don't loop on our own reload).
-fn google_account_picker_rewrite(url: &str) -> Option<String> {
-    let is_oauth = url.starts_with("https://accounts.google.com/o/oauth2")
-        || url.starts_with("https://accounts.google.com/signin/oauth");
-    if !is_oauth {
-        return None;
-    }
-    let query = url.split_once('?').map(|(_, q)| q).unwrap_or("");
-    let has_prompt = query.split('&').any(|kv| kv == "prompt" || kv.starts_with("prompt="));
-    if has_prompt {
-        return None;
-    }
-    let sep = if url.contains('?') { '&' } else { '?' };
-    Some(format!("{url}{sep}prompt=select_account"))
-}
-
-/// Safari-equivalent UA (no wry/Tauri token, full `Version/… Safari/…` suffix) — Google blocks
-/// OAuth in webviews whose UA lacks it (disallowed_useragent). Applied to the shell webview
-/// (main.rs builder) and every child popup.
-pub const SAFARI_UA: &str = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15";
-
-#[cfg(test)]
-mod tests {
-    use super::google_account_picker_rewrite as r;
-    #[test]
-    fn appends_prompt_to_oauth_urls() {
-        assert_eq!(
-            r("https://accounts.google.com/o/oauth2/auth?client_id=x").as_deref(),
-            Some("https://accounts.google.com/o/oauth2/auth?client_id=x&prompt=select_account")
-        );
-        assert_eq!(
-            r("https://accounts.google.com/signin/oauth").as_deref(),
-            Some("https://accounts.google.com/signin/oauth?prompt=select_account")
-        );
-    }
-    #[test]
-    fn leaves_others_untouched() {
-        assert!(r("https://accounts.google.com/o/oauth2/auth?prompt=consent").is_none());
-        assert!(r("https://accounts.google.com/o/oauth2/auth?x=1&prompt=none").is_none());
-        assert!(r("https://example.com/o/oauth2/auth").is_none());
-        assert!(r("https://myapp.firebaseapp.com/__/auth/handler").is_none());
-    }
-
-    #[test]
-    fn descendants_resolve_transitively() {
-        use super::descendants_of;
-        // 1 → 2 → 3, 1 → 4; 5 hangs off an unrelated 9.
-        let pairs = [(2, 1), (3, 2), (4, 1), (5, 9)];
-        let mut d = descendants_of(&pairs, 1);
-        d.sort_unstable();
-        assert_eq!(d, vec![2, 3, 4]);
-        assert_eq!(descendants_of(&pairs, 3), Vec::<usize>::new());
-        assert_eq!(descendants_of(&pairs, 9), vec![5]);
-    }
-
-    #[test]
-    fn descendants_cycle_safe() {
-        // Degenerate cycle must terminate and not include the root.
-        let pairs = [(2, 1), (1, 2)];
-        assert_eq!(super::descendants_of(&pairs, 1), vec![2]);
-    }
-}
-
-/// Strong refs for one open popup. Only touched on the main thread (Send impl exists purely so
-/// the registry can live in a static Mutex — same pattern as oauth_mac::ActiveFlow).
-struct Popup {
-    window: Retained<NSWindow>,
-    webview: Retained<WKWebView>,
-    /// Opener WKWebView pointer (shell webview for top-level popups, another popup's webview for
-    /// nested ones). Identity only — never dereferenced. Drives cascade-close.
-    parent: usize,
-    /// Google account-picker rewrite is applied AT MOST ONCE per popup — only the entry OAuth
-    /// navigation. Otherwise Google's own redirects to chooser/error pages (which drop the `prompt`
-    /// param) would re-match and re-trigger a cancel+reload loop. Tied to the popup so it's dropped
-    /// with the window.
-    rewritten: AtomicBool,
-}
-unsafe impl Send for Popup {}
-static POPUPS: Mutex<Vec<Popup>> = Mutex::new(Vec::new());
-
-/// Single idempotent teardown for a popup. Removes the (only) strong-ref entry from POPUPS so the
-/// NSWindow + child WKWebView (JS timers, network) can finally be released. Both close paths route
-/// here: page-initiated `window.close()` (webViewDidClose:, `close_window = true` — the window is
-/// still open so we close it) and the user clicking the red button (windowWillClose:,
-/// `close_window = false` — AppKit is already closing it). Calling it twice is a no-op (the second
-/// path finds no entry), which is exactly what happens when either close triggers the other.
-/// Main-thread only (guaranteed: both callers are WK/AppKit delegate methods).
-// `&dyn Fn` (not `impl Fn`): cleanup_popup recurses for the cascade — a generic pred would
-// monomorphize a fresh closure type per recursion level (compile error: recursion limit).
-fn cleanup_popup(pred: &dyn Fn(&Popup) -> bool, close_window: bool) {
-    // One critical section: remove the entry AND snapshot the remaining (key, parent) pairs, then
-    // drop the lock BEFORE any window.close() — closing re-enters windowWillClose → cleanup_popup,
-    // which must not deadlock on POPUPS.
-    let (p, descendants) = {
-        let mut popups = POPUPS.lock().unwrap();
-        let Some(i) = popups.iter().position(|p| pred(p)) else {
-            eprintln!("[popup] cleanup: no matching entry (already torn down)");
-            return;
-        };
-        let p = popups.remove(i);
-        let key = Retained::as_ptr(&p.webview) as usize;
-        let pairs: Vec<(usize, usize)> = popups
-            .iter()
-            .map(|q| (Retained::as_ptr(&q.webview) as usize, q.parent))
-            .collect();
-        (p, descendants_of(&pairs, key))
-    };
-    // Stop observing `title` BEFORE releasing the webview (KVO throws if an observed object
-    // deallocates with observers attached). Registered unconditionally in create_web_view.
-    if let Some(observer) = installed_delegate() {
-        let key = NSString::from_str("title");
-        let _: () = unsafe { msg_send![&*p.webview, removeObserver: &*observer, forKeyPath: &*key] };
-    }
-    if close_window {
-        p.window.close();
-    }
-    // Cascade: close this popup's descendants through the same idempotent path. Any that already
-    // tore themselves down (e.g. their windowWillClose fired first) are a no-op above.
-    for key in descendants {
-        eprintln!("[popup] cascade-close child {key:#x}");
-        cleanup_popup(&move |q: &Popup| Retained::as_ptr(&q.webview) as usize == key, true);
-    }
-    // p (window + webview Retained refs) drops here → last strong refs released.
-}
-
-/// All descendant keys of `root` in a (key, parent-key) edge list — breadth-ish order, cycle-safe.
-/// Pure so the registry cascade logic is unit-testable without AppKit.
-fn descendants_of(pairs: &[(usize, usize)], root: usize) -> Vec<usize> {
-    let mut out: Vec<usize> = Vec::new();
-    let mut queue = vec![root];
-    while let Some(k) = queue.pop() {
-        for &(child, parent) in pairs {
-            if parent == k && child != root && !out.contains(&child) {
-                out.push(child);
-                queue.push(child);
-            }
-        }
-    }
-    out
-}
-
-/// Close every popup (main-window close / app teardown). Main-thread only — callers are tauri
-/// window-event handlers, which run on the main thread on macOS.
-pub fn close_all() {
-    loop {
-        let key = POPUPS
-            .lock()
-            .unwrap()
-            .first()
-            .map(|p| Retained::as_ptr(&p.webview) as usize);
-        match key {
-            Some(k) => cleanup_popup(&move |p: &Popup| Retained::as_ptr(&p.webview) as usize == k, true),
-            None => break,
-        }
-    }
-}
-
-/// Strong ref to our installed Delegate (the KVO observer), if install() ran.
-fn installed_delegate() -> Option<Retained<Delegate>> {
-    INSTALLED.lock().unwrap().0.as_ref().map(|(d, _)| d.clone())
-}
-
-/// Strong refs to our delegate + wry's original (uiDelegate is weak on WKWebView).
-struct Installed(Option<(Retained<Delegate>, Retained<AnyObject>)>);
-unsafe impl Send for Installed {}
-static INSTALLED: Mutex<Installed> = Mutex::new(Installed(None));
-
-pub struct DelegateIvars {
-    /// wry's WryWebViewUIDelegate — unhandled WKUIDelegate messages forward here.
-    wry_delegate: Option<Retained<AnyObject>>,
-}
-
-define_class!(
-    #[unsafe(super(NSObject))]
-    #[thread_kind = MainThreadOnly]
-    #[name = "AppwrapUIDelegate"]
-    #[ivars = DelegateIvars]
-    struct Delegate;
-
-    unsafe impl NSObjectProtocol for Delegate {}
-
-    unsafe impl WKUIDelegate for Delegate {
-        #[unsafe(method_id(webView:createWebViewWithConfiguration:forNavigationAction:windowFeatures:))]
-        fn create_web_view(
-            &self,
-            opener: &WKWebView,
-            configuration: &WKWebViewConfiguration,
-            action: &WKNavigationAction,
-            features: &WKWindowFeatures,
-        ) -> Option<Retained<WKWebView>> {
-            let mtm = self.mtm();
-            let url = unsafe { action.request().URL() }
-                .and_then(|u| u.absoluteString())
-                .map(|s| s.to_string())
-                .unwrap_or_default();
-
-            let width = unsafe { features.width() }.map(|n| n.doubleValue()).unwrap_or(720.0).max(200.0);
-            let height = unsafe { features.height() }.map(|n| n.doubleValue()).unwrap_or(640.0).max(200.0);
-            let rect = NSRect::new(NSPoint::new(0.0, 0.0), NSSize::new(width, height));
-
-            let style = NSWindowStyleMask::Titled
-                | NSWindowStyleMask::Closable
-                | NSWindowStyleMask::Miniaturizable
-                | NSWindowStyleMask::Resizable;
-            let window = unsafe {
-                NSWindow::initWithContentRect_styleMask_backing_defer(
-                    mtm.alloc::<NSWindow>(),
-                    rect,
-                    style,
-                    NSBackingStoreType::Buffered,
-                    false,
-                )
-            };
-            // Required for NSWindows created without a window controller; we manage lifetime.
-            unsafe { window.setReleasedWhenClosed(false) };
-
-            // MUST use the PASSED configuration — anything else breaks window.opener/session
-            // (and WebKit raises if the returned webview wasn't made with it).
-            let child = unsafe {
-                WKWebView::initWithFrame_configuration(
-                    mtm.alloc::<WKWebView>(),
-                    window.frame(),
-                    configuration,
-                )
-            };
-            unsafe {
-                child.setCustomUserAgent(Some(&NSString::from_str(SAFARI_UA)));
-                // Route the child's own UI-delegate messages (window.close(), nested
-                // window.open) back through us.
-                child.setUIDelegate(Some(ProtocolObject::from_ref(self)));
-                child.setAutoresizingMask(
-                    objc2_app_kit::NSAutoresizingMaskOptions::ViewWidthSizable
-                        | objc2_app_kit::NSAutoresizingMaskOptions::ViewHeightSizable,
-                );
-                // Google multi-account: intercept the popup's OAuth navigation to append
-                // prompt=select_account (see decide_policy). Only wired when configured so the
-                // default remember-me behavior is untouched.
-                if GOOGLE_ACCOUNT_PICKER.load(Ordering::Relaxed) {
-                    child.setNavigationDelegate(Some(ProtocolObject::from_ref(self)));
-                }
-            }
-            window.setContentView(Some(&child));
-            // Observe the red-button (user) close so we tear the popup down too — otherwise the
-            // NSWindow + live WKWebView leak forever (webViewDidClose: only fires for page-initiated
-            // window.close()). setDelegate is a WEAK ref; our Delegate is held strong for the app's
-            // lifetime in INSTALLED, so it outlives every child window.
-            window.setDelegate(Some(ProtocolObject::from_ref(self)));
-            window.center();
-            window.makeKeyAndOrderFront(None);
-
-            // Bind the NSWindow title to the page's real <title> (KVO on WKWebView.title) — anti-spoof
-            // + UX; removed in cleanup_popup. Options=New(1) so the change dict carries the value
-            // (we re-read from the webview anyway); context unused (we key off the object).
-            unsafe {
-                let key = NSString::from_str("title");
-                let _: () = msg_send![
-                    &*child,
-                    addObserver: self,
-                    forKeyPath: &*key,
-                    options: 1usize,
-                    context: std::ptr::null_mut::<c_void>()
-                ];
-            }
-
-            eprintln!("[popup] createWebView → {url} ({width}x{height})");
-            POPUPS.lock().unwrap().push(Popup {
-                window,
-                webview: child.clone(),
-                parent: opener as *const WKWebView as usize,
-                rewritten: AtomicBool::new(false),
-            });
-            // Returning the webview makes WebKit load the navigation action's request itself.
-            Some(child)
-        }
-
-        #[unsafe(method(webViewDidClose:))]
-        fn web_view_did_close(&self, webview: &WKWebView) {
-            eprintln!("[popup] webViewDidClose → cleanup + close window");
-            // Page called window.close(): window still open, so close it (windowWillClose: then
-            // fires but finds no entry → no-op).
-            cleanup_popup(&|p: &Popup| &*p.webview == webview, true);
-        }
-    }
-
-    // Child-popup navigation policy — only consulted when GOOGLE_ACCOUNT_PICKER wired the child's
-    // navigationDelegate to us (create_web_view). Rewrites the Google OAuth navigation to force the
-    // account chooser; everything else is allowed unchanged.
-    unsafe impl WKNavigationDelegate for Delegate {
-        #[unsafe(method(webView:decidePolicyForNavigationAction:decisionHandler:))]
-        fn decide_policy(
-            &self,
-            webview: &WKWebView,
-            action: &WKNavigationAction,
-            handler: &block2::DynBlock<dyn Fn(WKNavigationActionPolicy)>,
-        ) {
-            let url = unsafe { action.request().URL() }
-                .and_then(|u| u.absoluteString())
-                .map(|s| s.to_string())
-                .unwrap_or_default();
-            // Rewrite AT MOST ONCE per popup, and only the entry OAuth navigation — consume the
-            // once-flag lazily (only when we actually have a rewrite) so a non-OAuth first navigation
-            // doesn't burn it. Prevents re-triggering on Google's own chooser/error redirects.
-            if let Some(rewritten) = google_account_picker_rewrite(&url) {
-                let claim = {
-                    let popups = POPUPS.lock().unwrap();
-                    popups
-                        .iter()
-                        .find(|p| &*p.webview == webview)
-                        .map(|p| !p.rewritten.swap(true, Ordering::Relaxed))
-                        .unwrap_or(true)
-                };
-                if claim {
-                    eprintln!("[popup] google account-picker: reload with prompt=select_account → {rewritten}");
-                    // Cancel THIS load, then reload the SAME child webview with the rewritten URL.
-                    // window.opener/postMessage survive a same-window navigation, so the Firebase flow
-                    // still resolves; the reloaded URL carries `prompt`, so it's allowed (no loop).
-                    handler.call((WKNavigationActionPolicy::Cancel,));
-                    if let Some(nsurl) = NSURL::URLWithString(&NSString::from_str(&rewritten)) {
-                        let req = NSURLRequest::requestWithURL(&nsurl);
-                        let _ = unsafe { webview.loadRequest(&req) };
-                    }
-                    return;
-                }
-            }
-            handler.call((WKNavigationActionPolicy::Allow,));
-        }
-    }
-
-    unsafe impl NSWindowDelegate for Delegate {
-        #[unsafe(method(windowWillClose:))]
-        fn window_will_close(&self, notification: &NSNotification) {
-            let Some(obj) = notification.object() else { return };
-            // NSNotification.object is the closing NSWindow.
-            let window: &NSWindow = unsafe { &*(Retained::as_ptr(&obj) as *const NSWindow) };
-            eprintln!("[popup] windowWillClose → cleanup (red-button or programmatic)");
-            // Window is already closing (AppKit drives it) → don't re-close.
-            cleanup_popup(&|p: &Popup| &*p.window == window, false);
-        }
-    }
-
-    /// Forward every WKUIDelegate message we don't implement to wry's original delegate
-    /// (file-upload open panel, media-capture permission, …).
-    impl Delegate {
-        /// KVO callback — only ever registered for popup WKWebViews' `title` (create_web_view), so
-        /// no context/keyPath dispatch or super call is needed. Mirrors the page title onto the
-        /// popup's NSWindow.
-        #[unsafe(method(observeValueForKeyPath:ofObject:change:context:))]
-        fn observe_value(
-            &self,
-            _key_path: Option<&NSString>,
-            object: Option<&AnyObject>,
-            _change: Option<&AnyObject>,
-            _context: *mut c_void,
-        ) {
-            let Some(object) = object else { return };
-            let key = object as *const AnyObject as usize;
-            let (window, webview) = {
-                let popups = POPUPS.lock().unwrap();
-                let Some(p) = popups.iter().find(|p| Retained::as_ptr(&p.webview) as usize == key)
-                else {
-                    return; // stale notification after teardown
-                };
-                (p.window.clone(), p.webview.clone())
-            };
-            if let Some(title) = unsafe { webview.title() } {
-                window.setTitle(&title);
-            }
-        }
-
-        #[unsafe(method(forwardingTargetForSelector:))]
-        fn forwarding_target(&self, _sel: Sel) -> *mut AnyObject {
-            match &self.ivars().wry_delegate {
-                Some(d) => Retained::as_ptr(d) as *mut AnyObject,
-                None => std::ptr::null_mut(),
-            }
-        }
-
-        #[unsafe(method(respondsToSelector:))]
-        fn responds_to(&self, sel: Sel) -> objc2::runtime::Bool {
-            let own: bool = unsafe { msg_send![super(self), respondsToSelector: sel] };
-            if own {
-                return objc2::runtime::Bool::YES;
-            }
-            let fwd = match &self.ivars().wry_delegate {
-                Some(d) => unsafe { msg_send![&**d, respondsToSelector: sel] },
-                None => false,
-            };
-            objc2::runtime::Bool::new(fwd)
-        }
-    }
-);
-
-/// Install the wrapper on the shell's WKWebView. `webview_ptr` is tauri's
-/// `PlatformWebview::inner()` (a WKWebView on macOS); runs inside `with_webview`,
-/// i.e. on the main thread.
-pub fn install(webview_ptr: *mut std::ffi::c_void, google_account_picker: bool) {
-    GOOGLE_ACCOUNT_PICKER.store(google_account_picker, Ordering::Relaxed);
-    let Some(mtm) = MainThreadMarker::new() else {
-        eprintln!("[popup] install called off the main thread — skipped");
-        return;
-    };
-    if webview_ptr.is_null() {
-        eprintln!("[popup] null webview ptr — skipped");
-        return;
-    }
-    let webview: &WKWebView = unsafe { &*(webview_ptr as *const WKWebView) };
-
-    // Keep wry's delegate alive (weak property) and as the forwarding target.
-    let wry_delegate: Option<Retained<AnyObject>> = unsafe { webview.UIDelegate() }
-        .map(|d| unsafe { Retained::cast_unchecked::<AnyObject>(d.retain()) });
-    eprintln!(
-        "[popup] wrapping uiDelegate (wry delegate present: {})",
-        wry_delegate.is_some()
-    );
-
-    let delegate = Delegate::alloc(mtm).set_ivars(DelegateIvars { wry_delegate: wry_delegate.clone() });
-    let delegate: Retained<Delegate> = unsafe { msg_send![super(delegate), init] };
-    unsafe { webview.setUIDelegate(Some(ProtocolObject::from_ref(&*delegate))) };
-
-    // Shell-webview UA is normalized at BUILD time in main.rs (.user_agent) — setting it here
-    // (setup) is too late for the first document's navigator.userAgent snapshot.
-
-    INSTALLED.lock().unwrap().0 = Some((
-        delegate,
-        wry_delegate.unwrap_or_else(|| unsafe {
-            Retained::cast_unchecked::<AnyObject>(NSObject::new())
-        }),
-    ));
-}
+// popup_mac moved into the `webview-control` crate (Phase 1 extraction) — this is a re-export shim
+// so existing call sites (`crate::popup_mac::install` / `install_for_profile` / `close_all` /
+// `SAFARI_UA` in main.rs + bridge_mac.rs) resolve unchanged. Edit the source in
+// crates/webview-control/src/popup.rs, not here.
+pub use webview_control::popup::*;

package/runtime-desktop/src-tauri/src/server.rs

@@ -0,0 +1,156 @@
+//! `desktop.server` mode: boot a local server command, wait for its port, then the shell navigates the
+//! window to it (see main.rs setup). This is the desktop analogue of iOS/Android `loader:'server'`, but
+//! the URL is served by a child process THIS shell owns — so we also tear it down on window-close.
+//!
+//! Teardown correctness: the server (e.g. `para-chat`) itself spawns children (a backend + a vite
+//! preview). A plain SIGKILL of the direct child would orphan those grandchildren. So we `setsid()` the
+//! child into its OWN process group at spawn, then SIGTERM the WHOLE group on shutdown — every
+//! descendant gets the signal and the server's own exit-guard can reap cleanly.
+
+use std::io::{BufRead, BufReader};
+use std::net::TcpStream;
+use std::os::unix::process::CommandExt;
+use std::process::{Child, Command, Stdio};
+use std::sync::mpsc::{self, Receiver};
+use std::sync::{Mutex, OnceLock};
+use std::time::{Duration, Instant};
+
+/// The booted child + its process-group id (== pid after setsid). Recorded for teardown.
+struct Running {
+    child: Child,
+    pgid: i32,
+}
+
+static RUNNING: OnceLock<Mutex<Option<Running>>> = OnceLock::new();
+
+fn slot() -> &'static Mutex<Option<Running>> {
+    RUNNING.get_or_init(|| Mutex::new(None))
+}
+
+/// Resolved server config (mirrors `ServerConfig` in main.rs).
+pub struct ServerCfg<'a> {
+    pub command: &'a str,
+    pub args: &'a [String],
+    pub cwd: &'a str,
+    pub path: &'a str,
+    /// Non-empty → capture the printed URL from stdout (see `spawn`). Empty → caller uses wait_for_port.
+    pub url_marker: &'a str,
+}
+
+/// Extract the first `http://…`/`https://…` token from a line (up to the next whitespace). Pure.
+fn extract_url(line: &str) -> Option<String> {
+    let start = line.find("http://").or_else(|| line.find("https://"))?;
+    let rest = &line[start..];
+    let end = rest.find(char::is_whitespace).unwrap_or(rest.len());
+    Some(rest[..end].to_string())
+}
+
+/// Spawn the server command in its own process group (setsid), with the CLI-stamped PATH (a
+/// GUI-launched .app has a minimal launchd PATH). Records the child for teardown.
+///
+/// When `url_marker` is non-empty, stdout is piped and a reader thread tees each line to the shell's
+/// stderr AND, on the first line containing the marker, extracts the printed URL and sends it back —
+/// so the shell loads whatever port the server auto-picked (no hardcoded port). Returns that receiver.
+/// When `url_marker` is empty, stdout is inherited and `None` is returned (caller uses `wait_for_port`).
+pub fn spawn(cfg: &ServerCfg) -> std::io::Result<Option<Receiver<String>>> {
+    let capture = !cfg.url_marker.is_empty();
+    let mut cmd = Command::new(cfg.command);
+    cmd.args(cfg.args);
+    if !cfg.cwd.is_empty() {
+        cmd.current_dir(cfg.cwd);
+    }
+    if !cfg.path.is_empty() {
+        cmd.env("PATH", cfg.path);
+    }
+    cmd.stdin(Stdio::null()).stderr(Stdio::inherit());
+    cmd.stdout(if capture { Stdio::piped() } else { Stdio::inherit() });
+    // New session/process group so we can signal every descendant at teardown. setsid() also makes the
+    // child the group leader → its pgid equals its pid.
+    unsafe {
+        cmd.pre_exec(|| {
+            if libc::setsid() == -1 {
+                return Err(std::io::Error::last_os_error());
+            }
+            Ok(())
+        });
+    }
+    let mut child = cmd.spawn()?;
+    let pgid = child.id() as i32;
+
+    let rx = if capture {
+        let stdout = child.stdout.take().expect("piped stdout");
+        let marker = cfg.url_marker.to_string();
+        let (tx, rx) = mpsc::channel::<String>();
+        std::thread::spawn(move || {
+            let mut sent = false;
+            for line in BufReader::new(stdout).lines().map_while(Result::ok) {
+                eprintln!("[server] {line}");
+                if !sent && line.contains(&marker) {
+                    if let Some(url) = extract_url(&line) {
+                        let _ = tx.send(url);
+                        sent = true; // keep draining stdout so the child never blocks on a full pipe
+                    }
+                }
+            }
+        });
+        Some(rx)
+    } else {
+        None
+    };
+
+    *slot().lock().unwrap() = Some(Running { child, pgid });
+    Ok(rx)
+}
+
+/// Poll `127.0.0.1:port` with a TCP connect until it accepts (server is listening) or the timeout
+/// elapses. TCP-accept is a sufficient readiness signal — vite/preview binds the port only once it's
+/// ready to serve. Returns false on timeout.
+pub fn wait_for_port(port: u16, timeout_ms: u64) -> bool {
+    let deadline = Instant::now() + Duration::from_millis(timeout_ms);
+    let addr: std::net::SocketAddr = ([127, 0, 0, 1], port).into();
+    loop {
+        if TcpStream::connect_timeout(&addr, Duration::from_millis(500)).is_ok() {
+            return true;
+        }
+        if Instant::now() >= deadline {
+            return false;
+        }
+        std::thread::sleep(Duration::from_millis(300));
+    }
+}
+
+/// Signal the child's whole process group and reap (idempotent). Called on app exit so the local stack
+/// never outlives the shell. SIGTERM first (lets the server run its exit-guard + reap its own children),
+/// then a short grace, then SIGKILL as a backstop — the server may TRAP SIGTERM without exiting, and a
+/// blocking `wait()` on such a child would hang the exit forever, so we hard-kill the group and only
+/// `try_wait()` (non-blocking) to reap. The negative pgid targets every descendant.
+pub fn shutdown() {
+    if let Some(m) = RUNNING.get() {
+        if let Some(mut r) = m.lock().unwrap().take() {
+            unsafe { libc::kill(-r.pgid, libc::SIGTERM) };
+            std::thread::sleep(Duration::from_millis(1500));
+            unsafe { libc::kill(-r.pgid, libc::SIGKILL) };
+            let _ = r.child.try_wait();
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::extract_url;
+
+    #[test]
+    fn extracts_first_url_up_to_whitespace() {
+        assert_eq!(
+            extract_url("   Frontend:  https://localhost:5050  (ready)"),
+            Some("https://localhost:5050".to_string())
+        );
+        assert_eq!(extract_url("Backend: http://localhost:5051"), Some("http://localhost:5051".to_string()));
+    }
+
+    #[test]
+    fn none_when_no_url() {
+        assert_eq!(extract_url("Frontend ready on port 5050"), None);
+        assert_eq!(extract_url(""), None);
+    }
+}

package/runtime-desktop/src-tauri/tauri.conf.json

@@ -7,6 +7,7 @@
     "frontendDist": "../../examples/hello-pwa/dist"
   },
   "app": {
+    "withGlobalTauri": true,
     "security": { "csp": null }
   },
   "bundle": { "active": false }