@livx.cc/appwrap 0.46.1 → 0.46.3

package/runtime-desktop/src-tauri/src/bridge_mac.rs

@@ -1,351 +1,86 @@
-// SPIKE: window-ops backend for the browser-bridge shim (bridge-shim/shim.ts).
+// Control-channel ADAPTER for the browser-bridge shim (bridge-shim/shim.ts).
+//
+// Phase 1 extraction: the WKWebView primitive (per-profile persistent+isolated stores, manual
+// window creation, CSP-immune eval, snapshot, the bridgeShim handler, SSO popups) now lives in the
+// `webview-control` crate. This file is the thin transport adapter that OWNS the bod-browser wire
+// format + the TCP control channel:
+//   - dials the shim's TCP control port (line-JSON) and serves window ops,
+//   - frames the crate's RAW page payloads into {type:"pageMsg", payload} lines,
+//   - frames RAW eval/snapshot results into {id,result}/{id,error} responses,
+//   - keeps the legacy tauri-window path (no profileId) for back-compat.
 // Env-gated: fully inert unless APPWRAP_BRIDGE_JS points at the built content bundle.
-// The shell dials the shim's TCP control port (line-JSON) and serves window ops:
-//   createWindow { label, url }  -> new WebviewWindow with the content bundle injected
-//   closeWindow  { label }
-//   navigate     { label, url }
-//   screenshot   { label }       -> WKWebView takeSnapshot -> PNG base64
-//   listWindows
 use base64::Engine;
 use serde_json::{json, Value};
 use std::io::{Read, Write};
 use std::net::TcpStream;
-use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::mpsc::{channel, Sender};
 use std::sync::Mutex;
 use std::time::Duration;
 use tauri::{AppHandle, Manager};
 
 use objc2::rc::Retained;
-use objc2::runtime::ProtocolObject;
-use objc2::{define_class, msg_send, AnyThread, DefinedClass, MainThreadMarker, MainThreadOnly};
-use objc2_app_kit::{
-    NSBackingStoreType, NSBitmapImageFileType, NSBitmapImageRep, NSImage, NSWindow,
-    NSWindowDelegate, NSWindowStyleMask,
-};
-use objc2_foundation::{
-    NSDictionary, NSError, NSNotification, NSObject, NSObjectProtocol, NSPoint, NSRect, NSSize,
-    NSString, NSURL, NSURLRequest, NSUUID,
-};
-use objc2::runtime::AnyObject;
-use objc2_web_kit::{
-    WKContentWorld, WKScriptMessage, WKScriptMessageHandler, WKUserContentController,
-    WKUserScript, WKUserScriptInjectionTime, WKWebView, WKWebViewConfiguration, WKWebsiteDataStore,
-};
-
-// ---------------------------------------------------------------------------
-// Page -> shim transport: a native WKScriptMessageHandler ("bridgeShim").
-// WebKit blocks ws://127.0.0.1 (and http beacons) from https pages as mixed
-// content — NO loopback exemption like Chrome — so the content layer posts
-// results via webkit.messageHandlers.bridgeShim.postMessage(json) instead,
-// and we forward them to the shim as {type:"pageMsg", payload} lines.
-// Commands travel shim -> evalJs(window.__bridgeDispatch(...)).
-// ---------------------------------------------------------------------------
-
-pub struct MsgHandlerIvars {
-    tx: Sender<String>,
-}
-
-define_class!(
-    #[unsafe(super(NSObject))]
-    #[thread_kind = MainThreadOnly]
-    #[name = "AppwrapBridgeMsgHandler"]
-    #[ivars = MsgHandlerIvars]
-    struct MsgHandler;
-
-    unsafe impl NSObjectProtocol for MsgHandler {}
-
-    unsafe impl WKScriptMessageHandler for MsgHandler {
-        #[unsafe(method(userContentController:didReceiveScriptMessage:))]
-        fn did_receive(&self, _ucc: &WKUserContentController, message: &WKScriptMessage) {
-            let body = unsafe { message.body() };
-            if let Ok(s) = body.downcast::<NSString>() {
-                let _ = self.ivars().tx.send(
-                    json!({ "type": "pageMsg", "payload": s.to_string() }).to_string(),
-                );
-            }
-        }
-    }
-);
-
-// ---------------------------------------------------------------------------
-// Per-profile persistent + isolated WKWebsiteDataStore (THE CRUX).
-//
-// A "profile" is a named, persistent cookie/localStorage/IndexedDB jar. On macOS
-// 14+ WebKit gives us persistent, isolated stores via
-// `WKWebsiteDataStore(forIdentifier:)` keyed by a stable NSUUID. We persist a
-// profileId->UUID map on disk so the SAME store is reattached across app quits
-// (persistence) while different profiles get different stores (isolation).
-//
-// Such a store can only be selected on a WKWebViewConfiguration BEFORE the
-// webview is created, and tauri::WebviewWindowBuilder exposes no hook for it — so
-// profile windows are created MANUALLY (NSWindow + WKWebView), mirroring
-// popup_mac.rs. They live in their own registry (below); the bridge ops route to
-// it first and fall back to tauri windows (the main shell window) otherwise.
-// ---------------------------------------------------------------------------
-mod profiles {
-    use objc2_foundation::NSUUID;
-    use std::collections::HashMap;
-    use std::path::PathBuf;
-
-    fn map_path() -> PathBuf {
-        let base = std::env::var("APPWRAP_PROFILE_DIR")
-            .map(PathBuf::from)
-            .unwrap_or_else(|_| {
-                PathBuf::from(std::env::var("HOME").unwrap_or_default())
-                    .join("Library/Application Support/appwrap-desktop")
-            });
-        base.join("browser-profiles.json")
-    }
-
-    fn load() -> HashMap<String, String> {
-        std::fs::read_to_string(map_path())
-            .ok()
-            .and_then(|s| serde_json::from_str(&s).ok())
-            .unwrap_or_default()
-    }
-
-    /// Stable UUID string for a profile id — generated once and persisted so the
-    /// same on-disk data store is reattached on every subsequent launch.
-    pub fn uuid_for(profile_id: &str) -> String {
-        let mut map = load();
-        if let Some(u) = map.get(profile_id) {
-            return u.clone();
-        }
-        let uuid = NSUUID::UUID().UUIDString().to_string();
-        map.insert(profile_id.to_string(), uuid.clone());
-        let p = map_path();
-        if let Some(dir) = p.parent() {
-            let _ = std::fs::create_dir_all(dir);
-        }
-        let _ = std::fs::write(&p, serde_json::to_string_pretty(&map).unwrap_or_default());
-        uuid
-    }
+use objc2::MainThreadMarker;
+use objc2_web_kit::WKWebView;
+
+// The transport-free primitive. This adapter is the ONLY place that knows the bod-browser wire
+// format; the crate stays automation-agnostic.
+use webview_control as wv;
+
+/// Build the page->shim message sink for one webview: wrap the crate's RAW payload into the
+/// {type:"pageMsg", payload} envelope the shim expects. This is the seam — the framing lives here,
+/// never in the crate.
+fn page_sink(tx: Sender<String>) -> wv::MessageSink {
+    Box::new(move |raw: String| {
+        let _ = tx.send(json!({ "type": "pageMsg", "payload": raw }).to_string());
+    })
 }
 
-/// A manually-created profile window. Strong refs kept alive until closeWindow
-/// (or windowWillClose). Only touched on the main thread; the unsafe Send exists
-/// solely so the registry can be a static Mutex (same pattern as popup_mac).
-struct ProfileWindow {
-    label: String,
-    profile_id: String,
-    window: Retained<NSWindow>,
-    webview: Retained<WKWebView>,
-    /// Set true by the window-close delegate on a USER (red-button) close. Entries
-    /// stay in the registry but are filtered out of lookups/listWindows, then reaped
-    /// at a safe point (reap_closed, not inside the delegate callback — which would
-    /// drop the delegate mid-call → UAF).
-    closed: AtomicBool,
-    _handler: Retained<MsgHandler>,
-    /// Per-window SSO-popup delegate (weak uiDelegate → held here). Opaque; lifetime only.
-    _popup_delegate: Retained<AnyObject>,
-    /// NSWindowDelegate that flags `closed` on a user close (weak setDelegate → held here).
-    _win_delegate: Retained<ProfileWinDelegate>,
+fn page_port() -> u16 {
+    std::env::var("APPWRAP_BRIDGE_PAGE_PORT").ok().and_then(|s| s.parse().ok()).unwrap_or(9236)
 }
-unsafe impl Send for ProfileWindow {}
-static PROFILE_WINDOWS: Mutex<Vec<ProfileWindow>> = Mutex::new(Vec::new());
-
-// NSWindowDelegate for profile windows — flags the matching registry entry `closed`
-// when the user closes the window (red button), so it drops out of listWindows/getTabs.
-// Matches by NSWindow identity (the notification's object). Main-thread only.
-define_class!(
-    #[unsafe(super(NSObject))]
-    #[thread_kind = MainThreadOnly]
-    #[name = "AppwrapProfileWinDelegate"]
-    struct ProfileWinDelegate;
 
-    unsafe impl NSObjectProtocol for ProfileWinDelegate {}
+/// The live control-channel page->shim sender, set for the duration of a connected `run()`. Lets a
+/// webview created OUTSIDE the createWindow op (e.g. a browser sub-window in browser_tab.rs) route
+/// its page beacons to the SAME shim, so it registers as a bod-browser tab. None when disconnected.
+static PAGE_TX: Mutex<Option<Sender<String>>> = Mutex::new(None);
 
-    unsafe impl NSWindowDelegate for ProfileWinDelegate {
-        #[unsafe(method(windowWillClose:))]
-        fn window_will_close(&self, notification: &NSNotification) {
-            let Some(obj) = notification.object() else { return };
-            let key = Retained::as_ptr(&obj) as usize;
-            let v = PROFILE_WINDOWS.lock().unwrap();
-            if let Some(p) = v.iter().find(|p| Retained::as_ptr(&p.window) as usize == key) {
-                eprintln!("[bridge-shim] profile window {} user-closed", p.label);
-                p.closed.store(true, Ordering::Relaxed);
-            }
-        }
+/// Clears PAGE_TX on drop, so every `run()` return path (normal or error) leaves it None.
+struct PageTxGuard;
+impl Drop for PageTxGuard {
+    fn drop(&mut self) {
+        *PAGE_TX.lock().unwrap() = None;
     }
-);
-
-/// Retained clone of a profile window's WKWebView (op routing), or None if the
-/// label is a tauri window / unknown / already closed.
-fn profile_webview(label: &str) -> Option<Retained<WKWebView>> {
-    PROFILE_WINDOWS
-        .lock()
-        .unwrap()
-        .iter()
-        .find(|p| p.label == label && !p.closed.load(Ordering::Relaxed))
-        .map(|p| p.webview.clone())
-}
-
-fn profile_labels() -> Vec<(String, String)> {
-    PROFILE_WINDOWS
-        .lock()
-        .unwrap()
-        .iter()
-        .filter(|p| !p.closed.load(Ordering::Relaxed))
-        .map(|p| (p.label.clone(), p.profile_id.clone()))
-        .collect()
 }
 
-/// Drop entries flagged `closed` (user-closed windows). Called at safe points only
-/// (createWindow/listWindows/closeWindow entry) — never from within a delegate callback,
-/// so the delegate isn't released mid-call.
-fn reap_closed() {
-    let mut v = PROFILE_WINDOWS.lock().unwrap();
-    v.retain(|p| !p.closed.load(Ordering::Relaxed));
-}
-
-/// Close + drop a profile window (releases its NSWindow + WKWebView). Main-thread
-/// only. Returns false if no such profile window (caller falls back to tauri).
-/// The removed entry is held on the stack across window.close() so its window
-/// delegate stays alive while AppKit fires windowWillClose.
-fn profile_close(label: &str) -> bool {
-    let entry = {
-        let mut v = PROFILE_WINDOWS.lock().unwrap();
-        v.iter().position(|p| p.label == label).map(|i| v.remove(i))
-    };
-    match entry {
-        Some(p) => {
-            p.window.close();
-            true
+/// Page->shim sink for a webview created outside `createWindow` (browser sub-windows). Unlike a
+/// snapshot of the CURRENT PAGE_TX, this sink reads the LIVE control connection at send-time: a
+/// sub-window opened while the shim is disconnected (PAGE_TX == None) installs this ONE sink and its
+/// beacons are dropped for now, but the moment a later `run()` publishes a PAGE_TX the SAME installed
+/// sink starts delivering — so the window SELF-HEALS into agent-exposure on shim (re)connect, with no
+/// re-injection of the message handler. Framing stays identical to `page_sink`.
+pub fn bridge_sink() -> wv::MessageSink {
+    Box::new(move |raw: String| {
+        if let Some(tx) = PAGE_TX.lock().unwrap().as_ref() {
+            let _ = tx.send(json!({ "type": "pageMsg", "payload": raw }).to_string());
         }
-        None => false,
-    }
+    })
 }
 
-/// Create a manual NSWindow + WKWebView bound to `profile_id`'s persistent data
-/// store, inject the bridge content bundle + bridgeShim handler, and register it.
-/// Runs on the main thread (called inside run_on_main_thread). Returns the
-/// isPersistent flag of the resolved store so the harness can assert it.
-fn create_profile_window(
-    mtm: MainThreadMarker,
-    label: &str,
-    url: &str,
-    profile_id: &str,
-    init_js: &str,
-    tx: Sender<String>,
-) -> Result<Value, String> {
-    let uuid_str = profiles::uuid_for(profile_id);
-    let nsuuid = NSUUID::initWithUUIDString(NSUUID::alloc(), &NSString::from_str(&uuid_str))
-        .ok_or_else(|| format!("bad uuid for profile {profile_id}: {uuid_str}"))?;
-    let store = unsafe { WKWebsiteDataStore::dataStoreForIdentifier(&nsuuid, mtm) };
-    let persistent = unsafe { store.isPersistent() };
-
-    let cfg = unsafe { WKWebViewConfiguration::new(mtm) };
-    unsafe { cfg.setWebsiteDataStore(&store) };
-
-    // bridgeShim message handler + content bundle (documentStart) on this cfg's UCC.
-    let ucc = unsafe { cfg.userContentController() };
-    let handler = MsgHandler::alloc(mtm).set_ivars(MsgHandlerIvars { tx });
-    let handler: Retained<MsgHandler> = unsafe { objc2::msg_send![super(handler), init] };
-    unsafe {
-        ucc.addScriptMessageHandler_name(
-            ProtocolObject::from_ref(&*handler),
-            &NSString::from_str("bridgeShim"),
-        );
-        let script = WKUserScript::initWithSource_injectionTime_forMainFrameOnly(
-            WKUserScript::alloc(mtm),
-            &NSString::from_str(init_js),
-            WKUserScriptInjectionTime::AtDocumentStart,
-            true,
-        );
-        ucc.addUserScript(&script);
-    }
-
-    let rect = NSRect::new(NSPoint::new(0.0, 0.0), NSSize::new(1100.0, 800.0));
-    let style = NSWindowStyleMask::Titled
-        | NSWindowStyleMask::Closable
-        | NSWindowStyleMask::Miniaturizable
-        | NSWindowStyleMask::Resizable;
-    let window = unsafe {
-        NSWindow::initWithContentRect_styleMask_backing_defer(
-            mtm.alloc::<NSWindow>(),
-            rect,
-            style,
-            NSBackingStoreType::Buffered,
-            false,
-        )
-    };
-    unsafe { window.setReleasedWhenClosed(false) };
-
-    let webview = unsafe {
-        WKWebView::initWithFrame_configuration(mtm.alloc::<WKWebView>(), window.frame(), &cfg)
+/// Build the SAME framed init-JS `createWindow` injects, for a webview created elsewhere. Reads the
+/// content bundle from `APPWRAP_BRIDGE_JS`; None when the feature is off (unset/empty) or the read
+/// fails (logged). `label` becomes `window.__BRIDGE_LABEL` so the shim registers this webview by id.
+pub fn bridge_init_js(label: &str) -> Option<String> {
+    let path = match std::env::var("APPWRAP_BRIDGE_JS") {
+        Ok(p) if !p.is_empty() => p,
+        _ => return None,
     };
-    unsafe {
-        webview.setCustomUserAgent(Some(&NSString::from_str(crate::popup_mac::SAFARI_UA)));
-        window.setContentView(Some(&webview));
-        window.setTitle(&NSString::from_str(label));
+    match std::fs::read_to_string(&path) {
+        Ok(bundle) => Some(format!(
+            "window.__BRIDGE_LABEL={};window.__BRIDGE_PORT={};\n{}",
+            serde_json::to_string(&label).unwrap(), page_port(), bundle
+        )),
+        Err(e) => { eprintln!("[bridge-shim] bridge_init_js read {path}: {e}"); None }
     }
-
-    // Per-window SSO-popup delegate (window.open → real child NSWindow inheriting this profile's
-    // data store) + window-close delegate (drop from registry on user close). Both are weak refs on
-    // AppKit/WebKit → retained in the registry entry below.
-    let popup_delegate: Retained<AnyObject> = crate::popup_mac::install_for_profile(
-        Retained::as_ptr(&webview) as *mut std::ffi::c_void,
-        mtm,
-    );
-    let win_delegate = ProfileWinDelegate::alloc(mtm).set_ivars(());
-    let win_delegate: Retained<ProfileWinDelegate> = unsafe { msg_send![super(win_delegate), init] };
-    window.setDelegate(Some(ProtocolObject::from_ref(&*win_delegate)));
-    window.center();
-    window.makeKeyAndOrderFront(None);
-
-    let nsurl = NSURL::URLWithString(&NSString::from_str(url))
-        .ok_or_else(|| format!("bad url: {url}"))?;
-    let req = NSURLRequest::requestWithURL(&nsurl);
-    let _ = unsafe { webview.loadRequest(&req) };
-
-    reap_closed();
-    PROFILE_WINDOWS.lock().unwrap().push(ProfileWindow {
-        label: label.to_string(),
-        profile_id: profile_id.to_string(),
-        window,
-        webview,
-        closed: AtomicBool::new(false),
-        _handler: handler,
-        _popup_delegate: popup_delegate,
-        _win_delegate: win_delegate,
-    });
-    eprintln!(
-        "[bridge-shim] profile window {label} profile={profile_id} store={uuid_str} persistent={persistent}"
-    );
-    Ok(json!({ "ok": true, "label": label, "profileId": profile_id, "storeUuid": uuid_str, "persistent": persistent }))
-}
-
-/// callAsyncJavaScript on a raw WKWebView ptr — CSP-immune eval with an awaited
-/// return value. Shared by the tauri and profile-window paths. Main-thread only.
-unsafe fn eval_async_on(wk: *mut WKWebView, js: String, tx: Sender<String>, id: String) {
-    let wk = &*wk;
-    let mtm = MainThreadMarker::new().expect("eval_async_on runs on main");
-    let block = block2::RcBlock::new(move |result: *mut AnyObject, error: *mut NSError| {
-        if !error.is_null() {
-            respond(&tx, &id, Err((*error).localizedDescription().to_string()));
-            return;
-        }
-        let out = if result.is_null() {
-            "null".to_string()
-        } else if let Ok(ns) = (&*result).downcast_ref::<NSString>().ok_or(()) {
-            ns.to_string()
-        } else {
-            "null".to_string()
-        };
-        respond(&tx, &id, Ok(json!({ "json": out })));
-    });
-    wk.callAsyncJavaScript_arguments_inFrame_inContentWorld_completionHandler(
-        &NSString::from_str(&js),
-        None,
-        None,
-        &WKContentWorld::pageWorld(mtm),
-        Some(&block),
-    );
-}
-
-fn page_port() -> u16 {
-    std::env::var("APPWRAP_BRIDGE_PAGE_PORT").ok().and_then(|s| s.parse().ok()).unwrap_or(9236)
 }
 fn rust_port() -> u16 {
     std::env::var("APPWRAP_BRIDGE_RUST_PORT").ok().and_then(|s| s.parse().ok()).unwrap_or(9237)
@@ -372,6 +107,14 @@ pub fn init(app: AppHandle) {
 fn run(app: &AppHandle, mut stream: TcpStream, js_path: &str) {
     let _ = stream.set_read_timeout(Some(Duration::from_millis(50)));
     let (tx, rx) = channel::<String>();
+    // Publish this connection's sender so sub-window webviews (created outside createWindow) can route
+    // their page beacons here; the guard clears it on ANY return below (disconnect/error).
+    *PAGE_TX.lock().unwrap() = Some(tx.clone());
+    let _tx_guard = PageTxGuard;
+    // Self-heal sub-windows opened BEFORE this connect: their dynamic sink can now deliver, but a
+    // document already loaded won't re-fire its `register` beacon on its own. Nudge every open
+    // sub-window webview to re-post `register` so it (re)appears as a bod-browser tab on this shim.
+    crate::browser_tab::reregister_subwindows(app);
     let mut acc = String::new();
     let mut buf = [0u8; 65536];
     loop {
@@ -427,15 +170,16 @@ fn handle_op(app: &AppHandle, tx: &Sender<String>, v: Value, js_path: &str) {
                 ),
                 Err(e) => { respond(tx, &id, Err(format!("read bundle {js_path}: {e}"))); return; }
             };
-            // Profile windows take the MANUAL creation path (per-profile persistent data store).
+            // Profile windows take the crate's MANUAL creation path (per-profile persistent store).
             // Windows without a profileId keep the original tauri path (back-compat).
             if !profile_id.is_empty() {
                 let idc = id.clone();
                 let init_js2 = init_js.clone();
                 let r = app.run_on_main_thread(move || {
                     let mtm = MainThreadMarker::new().expect("run_on_main_thread is main");
-                    let res = create_profile_window(mtm, &label, &url, &profile_id, &init_js2, tx2.clone());
-                    respond_owned(&tx2, &idc, res);
+                    let res = wv::create_profile_window(mtm, &label, &url, &profile_id, &init_js2, page_sink(tx2.clone()))
+                        .map(|c| json!({ "ok": true, "label": label, "profileId": profile_id, "storeUuid": c.store_uuid, "persistent": c.persistent }));
+                    respond(&tx2, &idc, res);
                 });
                 if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
                 return;
@@ -444,45 +188,36 @@ fn handle_op(app: &AppHandle, tx: &Sender<String>, v: Value, js_path: &str) {
             let r = app.run_on_main_thread(move || {
                 let parsed = match tauri::Url::parse(&url) {
                     Ok(u) => u,
-                    Err(e) => { respond_owned(&tx2, &idc, Err(format!("bad url: {e}"))); return; }
+                    Err(e) => { respond(&tx2, &idc, Err(format!("bad url: {e}"))); return; }
                 };
                 let r = tauri::WebviewWindowBuilder::new(&app2, &label, tauri::WebviewUrl::External(parsed))
                     .title(&label)
                     .inner_size(1100.0, 800.0)
-                    // Safari-normalized UA at BUILD time (same constraint as the main window: the
-                    // first document snapshots navigator.userAgent before any later override).
+                    // Safari-normalized UA at BUILD time (same constraint as the main window).
                     .user_agent(crate::popup_mac::SAFARI_UA)
                     .initialization_script(&init_js)
                     .build();
-                // Install the page->shim message handler on the fresh webview (main thread),
-                // plus the SAME popup machinery the main window gets (WKUIDelegate: window.open ->
-                // real child NSWindow — Google/Firebase SSO popups; silently dropped otherwise).
+                // Install the page->shim message handler on the fresh webview (main thread), plus the
+                // SAME popup machinery the main window gets (SSO window.open child windows).
                 if let Ok(w) = &r {
                     let tx4 = tx2.clone();
                     let _ = w.with_webview(move |pw| unsafe {
                         crate::popup_mac::install(pw.inner() as _, false);
-                        let wk = &*(pw.inner() as *mut WKWebView);
-                        let mtm = objc2::MainThreadMarker::new().expect("with_webview runs on main");
-                        let handler = MsgHandler::alloc(mtm).set_ivars(MsgHandlerIvars { tx: tx4 });
-                        let handler: Retained<MsgHandler> = objc2::msg_send![super(handler), init];
-                        let ucc = wk.configuration().userContentController();
-                        ucc.addScriptMessageHandler_name(
-                            ProtocolObject::from_ref(&*handler),
-                            &NSString::from_str("bridgeShim"),
-                        );
+                        let mtm = MainThreadMarker::new().expect("with_webview runs on main");
+                        wv::install_message_handler(pw.inner() as *mut WKWebView, mtm, page_sink(tx4));
                     });
                 }
-                respond_owned(&tx2, &idc, r.map(|_| json!({ "ok": true, "label": label })).map_err(|e| e.to_string()));
+                respond(&tx2, &idc, r.map(|_| json!({ "ok": true, "label": label })).map_err(|e| e.to_string()));
             });
             if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
         }
         "closeWindow" => {
             let label = v["label"].as_str().unwrap_or_default().to_string();
-            if profile_webview(&label).is_some() {
+            if wv::profile_webview(&label).is_some() {
                 let idc = id.clone();
                 let r = app.run_on_main_thread(move || {
-                    let ok = profile_close(&label);
-                    respond_owned(&tx2, &idc, if ok { Ok(json!({ "ok": true })) } else { Err(format!("no window {label}")) });
+                    let ok = wv::close(&label);
+                    respond(&tx2, &idc, if ok { Ok(json!({ "ok": true })) } else { Err(format!("no window {label}")) });
                 });
                 if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
                 return;
@@ -497,24 +232,18 @@ fn handle_op(app: &AppHandle, tx: &Sender<String>, v: Value, js_path: &str) {
             let url = v["url"].as_str().unwrap_or_default().to_string();
             let idc = id.clone();
             let r = app.run_on_main_thread(move || {
-                if let Some(wk) = profile_webview(&label) {
-                    match NSURL::URLWithString(&NSString::from_str(&url)) {
-                        Some(nsurl) => {
-                            let req = NSURLRequest::requestWithURL(&nsurl);
-                            let _ = unsafe { wk.loadRequest(&req) };
-                            respond_owned(&tx2, &idc, Ok(json!({ "ok": true })));
-                        }
-                        None => respond_owned(&tx2, &idc, Err(format!("bad url: {url}"))),
-                    }
+                if let Some(wk) = wv::profile_webview(&label) {
+                    let res = unsafe { wv::navigate(Retained::as_ptr(&wk) as *mut WKWebView, &url) };
+                    respond(&tx2, &idc, res.map(|_| json!({ "ok": true })));
                     return;
                 }
                 let parsed = match tauri::Url::parse(&url) {
                     Ok(u) => u,
-                    Err(e) => { respond_owned(&tx2, &idc, Err(format!("bad url: {e}"))); return; }
+                    Err(e) => { respond(&tx2, &idc, Err(format!("bad url: {e}"))); return; }
                 };
                 match app2.get_webview_window(&label) {
-                    Some(mut w) => respond_owned(&tx2, &idc, w.navigate(parsed).map(|_| json!({ "ok": true })).map_err(|e| e.to_string())),
-                    None => respond_owned(&tx2, &idc, Err(format!("no window {label}"))),
+                    Some(w) => respond(&tx2, &idc, w.navigate(parsed).map(|_| json!({ "ok": true })).map_err(|e| e.to_string())),
+                    None => respond(&tx2, &idc, Err(format!("no window {label}"))),
                 }
             });
             if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
@@ -523,18 +252,22 @@ fn handle_op(app: &AppHandle, tx: &Sender<String>, v: Value, js_path: &str) {
             let label = v["label"].as_str().unwrap_or_default().to_string();
             let idc = id.clone();
             let r = app.run_on_main_thread(move || {
-                if let Some(wk) = profile_webview(&label) {
-                    unsafe { snapshot(Retained::as_ptr(&wk) as *mut WKWebView, tx2.clone(), idc.clone()) };
+                if let Some(wk) = wv::profile_webview(&label) {
+                    let tx3 = tx2.clone();
+                    let id2 = idc.clone();
+                    unsafe { wv::snapshot(Retained::as_ptr(&wk) as *mut WKWebView, move |r| respond_png(&tx3, &id2, r)) };
                     return;
                 }
                 let Some(w) = app2.get_webview_window(&label) else {
-                    respond_owned(&tx2, &idc, Err(format!("no window {label}")));
+                    respond(&tx2, &idc, Err(format!("no window {label}")));
                     return;
                 };
                 let tx3 = tx2.clone();
                 let id2 = idc.clone();
-                let r = w.with_webview(move |pw| unsafe { snapshot(pw.inner() as *mut WKWebView, tx3, id2) });
-                if let Err(e) = r { respond_owned(&tx2, &idc, Err(e.to_string())); }
+                let r = w.with_webview(move |pw| unsafe {
+                    wv::snapshot(pw.inner() as *mut WKWebView, move |r| respond_png(&tx3, &id2, r))
+                });
+                if let Err(e) = r { respond(&tx2, &idc, Err(e.to_string())); }
             });
             if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
         }
@@ -542,16 +275,14 @@ fn handle_op(app: &AppHandle, tx: &Sender<String>, v: Value, js_path: &str) {
             // Fire-and-forget JS injection into a window (debug aid + transport fallback probe).
             let label = v["label"].as_str().unwrap_or_default().to_string();
             let js = v["js"].as_str().unwrap_or_default().to_string();
-            if profile_webview(&label).is_some() {
+            if wv::profile_webview(&label).is_some() {
                 let idc = id.clone();
                 let r = app.run_on_main_thread(move || {
-                    if let Some(wk) = profile_webview(&label) {
-                        unsafe {
-                            wk.evaluateJavaScript_completionHandler(&NSString::from_str(&js), None);
-                        }
-                        respond_owned(&tx2, &idc, Ok(json!({ "ok": true })));
+                    if let Some(wk) = wv::profile_webview(&label) {
+                        unsafe { wv::inject_script(Retained::as_ptr(&wk) as *mut WKWebView, &js) };
+                        respond(&tx2, &idc, Ok(json!({ "ok": true })));
                     } else {
-                        respond_owned(&tx2, &idc, Err(format!("no window {label}")));
+                        respond(&tx2, &idc, Err(format!("no window {label}")));
                     }
                 });
                 if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
@@ -563,63 +294,52 @@ fn handle_op(app: &AppHandle, tx: &Sender<String>, v: Value, js_path: &str) {
             }
         }
         "evalAsync" => {
-            // CSP-immune eval with a real (awaited) return value — WKWebView callAsyncJavaScript.
-            // The page's CSP can block in-page eval() (content 'eval' action); native compilation
-            // is exempt, and promises are awaited. `js` is a FUNCTION BODY (use `return`).
+            // CSP-immune eval with a real (awaited) return value — callAsyncJavaScript. `js` is a
+            // FUNCTION BODY (use `return`). The crate delivers the RAW return string; we frame {json}.
             let label = v["label"].as_str().unwrap_or_default().to_string();
             let js = v["js"].as_str().unwrap_or_default().to_string();
             let idc = id.clone();
             let r = app.run_on_main_thread(move || {
-                if let Some(wk) = profile_webview(&label) {
-                    unsafe { eval_async_on(Retained::as_ptr(&wk) as *mut WKWebView, js.clone(), tx2.clone(), idc.clone()) };
+                if let Some(wk) = wv::profile_webview(&label) {
+                    let tx3 = tx2.clone();
+                    let id2 = idc.clone();
+                    unsafe { wv::eval_async(Retained::as_ptr(&wk) as *mut WKWebView, js.clone(), move |r| respond_eval(&tx3, &id2, r)) };
                     return;
                 }
                 let Some(w) = app2.get_webview_window(&label) else {
-                    respond_owned(&tx2, &idc, Err(format!("no window {label}")));
+                    respond(&tx2, &idc, Err(format!("no window {label}")));
                     return;
                 };
                 let tx3 = tx2.clone();
                 let id2 = idc.clone();
                 let js2 = js.clone();
                 let r = w.with_webview(move |pw| unsafe {
-                    eval_async_on(pw.inner() as *mut WKWebView, js2, tx3, id2);
+                    wv::eval_async(pw.inner() as *mut WKWebView, js2, move |r| respond_eval(&tx3, &id2, r));
                 });
-                if let Err(e) = r { respond_owned(&tx2, &idc, Err(e.to_string())); }
+                if let Err(e) = r { respond(&tx2, &idc, Err(e.to_string())); }
             });
             if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
         }
         "userClose" => {
-            // Verification aid: drive NSWindow performClose: (the red-button path) WITHOUT touching
-            // the registry, so the windowWillClose delegate is the sole remover — proves user-close
-            // hygiene headlessly (accessibility clicks are TCC-gated in CI/agent contexts).
+            // Verification aid: drive the red-button path WITHOUT touching the registry, so the
+            // windowWillClose delegate is the sole remover — proves user-close hygiene headlessly.
             let label = v["label"].as_str().unwrap_or_default().to_string();
             let idc = id.clone();
             let r = app.run_on_main_thread(move || {
-                let win = PROFILE_WINDOWS
-                    .lock()
-                    .unwrap()
-                    .iter()
-                    .find(|p| p.label == label)
-                    .map(|p| p.window.clone());
-                match win {
-                    Some(w) => {
-                        w.performClose(None);
-                        respond_owned(&tx2, &idc, Ok(json!({ "ok": true })));
-                    }
-                    None => respond_owned(&tx2, &idc, Err(format!("no window {label}"))),
-                }
+                let ok = wv::user_close(&label);
+                respond(&tx2, &idc, if ok { Ok(json!({ "ok": true })) } else { Err(format!("no window {label}")) });
             });
             if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
         }
         "listWindows" => {
-            // Closed windows are filtered by profile_labels; actual reaping (which drops objc
-            // objects) is deferred to createWindow, which runs on the main thread.
+            // Closed windows are filtered by the crate; actual reaping (which drops objc objects) is
+            // deferred to createWindow, which runs on the main thread.
             let mut labels: Vec<String> = app.webview_windows().keys().cloned().collect();
-            let profiles: Vec<Value> = profile_labels()
+            let profiles: Vec<Value> = wv::list_webviews()
                 .into_iter()
-                .map(|(label, profile_id)| {
-                    labels.push(label.clone());
-                    json!({ "label": label, "profileId": profile_id })
+                .map(|info| {
+                    labels.push(info.label.clone());
+                    json!({ "label": info.label, "profileId": info.profile_id })
                 })
                 .collect();
             respond(tx, &id, Ok(json!({ "labels": labels, "profiles": profiles })));
@@ -628,37 +348,12 @@ fn handle_op(app: &AppHandle, tx: &Sender<String>, v: Value, js_path: &str) {
     }
 }
 
-/// respond() twin taking the Sender by ref inside move closures (owned id/tx clones).
-fn respond_owned(tx: &Sender<String>, id: &str, result: Result<Value, String>) {
-    respond(tx, id, result);
+/// Frame a RAW eval return string into the {json} envelope the shim reads (`r.json`).
+fn respond_eval(tx: &Sender<String>, id: &str, r: Result<String, String>) {
+    respond(tx, id, r.map(|out| json!({ "json": out })));
 }
 
-/// WKWebView takeSnapshot -> NSImage -> PNG base64, delivered async via the out-queue.
-/// Runs on the main thread (with_webview closure); the completion block also lands there.
-unsafe fn snapshot(webview: *mut WKWebView, tx: Sender<String>, id: String) {
-    let wk = &*webview;
-    let block = block2::RcBlock::new(move |image: *mut NSImage, error: *mut NSError| {
-        if image.is_null() {
-            let msg = if error.is_null() { "snapshot failed".to_string() } else { (*error).localizedDescription().to_string() };
-            respond(&tx, &id, Err(msg));
-            return;
-        }
-        let img = &*image;
-        let Some(tiff) = img.TIFFRepresentation() else {
-            respond(&tx, &id, Err("no TIFF representation".into()));
-            return;
-        };
-        let Some(rep) = NSBitmapImageRep::initWithData(NSBitmapImageRep::alloc(), &tiff) else {
-            respond(&tx, &id, Err("bitmap rep failed".into()));
-            return;
-        };
-        let props = NSDictionary::new();
-        let Some(png) = rep.representationUsingType_properties(NSBitmapImageFileType::PNG, &props) else {
-            respond(&tx, &id, Err("png encode failed".into()));
-            return;
-        };
-        let b64 = base64::engine::general_purpose::STANDARD.encode(png.to_vec());
-        respond(&tx, &id, Ok(json!({ "png": b64 })));
-    });
-    wk.takeSnapshotWithConfiguration_completionHandler(None, &block);
+/// Base64-encode the crate's RAW PNG bytes and frame into the {png} envelope.
+fn respond_png(tx: &Sender<String>, id: &str, r: Result<Vec<u8>, String>) {
+    respond(tx, id, r.map(|bytes| json!({ "png": base64::engine::general_purpose::STANDARD.encode(bytes) })));
 }