@livx.cc/appwrap 0.46.1 → 0.46.3

package/runtime-desktop/src-tauri/src/browser_tab.rs

@@ -0,0 +1,445 @@
+// browser_tab — Tauri commands for an EMBEDDED, tear-off/dock-able browser tab (project "browser-tab"
+// Phase 3). Thin front-end-facing wrapper over `webview_control::embedded::Controller`: the same live
+// WKWebView (page + WKWebsiteDataStore session + bridgeShim) is mounted `ChildOf` a host pane NSView
+// and torn off / docked with `set_mount`.
+//
+// R2 (agent-drive, DRY): the tab is created in the crate-level registry keyed by `id` (its label), so
+// the control-channel adapter (`bridge_mac.rs`) — and thus the mcp-desktop-browser MCP — can drive
+// this SAME embedded tab (navigate/eval/screenshot/close) by that id, with NO new TS<->Rust binding.
+//
+// Landmine (a): the pane NSView* is fetched + the webview mounted on the MAIN THREAD, AFTER the pane
+// container has non-zero bounds (we create the container at the caller-supplied paneRect), else blank.
+#[cfg(target_os = "macos")]
+mod imp {
+    use std::collections::HashMap;
+    use std::ffi::c_void;
+    use std::sync::mpsc::channel;
+    use std::sync::{Mutex, OnceLock};
+    use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+    use objc2::rc::Retained;
+    use objc2::{MainThreadMarker, MainThreadOnly};
+    use objc2_app_kit::{NSAutoresizingMaskOptions, NSView, NSWindow};
+    use objc2_foundation::{NSPoint, NSRect, NSSize};
+    use objc2_web_kit::WKWebView;
+    use serde::Deserialize;
+    use tauri::{Manager, WebviewUrl, WebviewWindowBuilder};
+
+    use webview_control::embedded::Controller;
+    use webview_control::{CreateSpec, Mount, ViewHandle};
+
+    /// Fixed height (points) of the sub-window chrome strip (‹ › ⟳ + address bar + profile▾). The
+    /// controlled WKWebView pane is pinned BELOW this within the sub-window's contentView.
+    pub const CHROME_H: f64 = 44.0;
+
+    /// Autoresizing mask keeping the controlled-webview container pinned below the chrome bar while it
+    /// tracks window resize: both margins fixed (44pt top gap, 0 bottom), width+height flexible.
+    fn container_mask() -> NSAutoresizingMaskOptions {
+        NSAutoresizingMaskOptions(
+            NSAutoresizingMaskOptions::ViewWidthSizable.0 | NSAutoresizingMaskOptions::ViewHeightSizable.0,
+        )
+    }
+
+    /// A unique sub-window id / bridge tab label.
+    fn new_subwin_id() -> String {
+        let ms = SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_millis()).unwrap_or(0);
+        format!("subwin-{ms}")
+    }
+
+    /// Web-DOM pane rect the front-end reserves (top-left origin, CSS px == points here since the
+    /// shell runs at the window's backing scale). We flip Y to AppKit's bottom-left origin at mount.
+    #[derive(Deserialize, Clone, Copy)]
+    pub struct PaneRect {
+        pub x: f64,
+        pub y: f64,
+        pub width: f64,
+        pub height: f64,
+    }
+
+    // id -> host pane container NSView* (as usize). The container is retained by being a subview of
+    // the window contentView; we hold only its pointer to reposition / reparent / remove it. Access
+    // is main-thread only (all commands marshal via run_on_main_thread), the Mutex just satisfies the
+    // `static` Send/Sync bound for the raw pointer.
+    fn containers() -> &'static Mutex<HashMap<String, usize>> {
+        static CONTAINERS: OnceLock<Mutex<HashMap<String, usize>>> = OnceLock::new();
+        CONTAINERS.get_or_init(|| Mutex::new(HashMap::new()))
+    }
+
+    unsafe fn appkit_rect(content: &NSView, r: PaneRect) -> NSRect {
+        let ch = content.bounds().size.height;
+        NSRect::new(
+            NSPoint::new(r.x, ch - r.y - r.height),
+            NSSize::new(r.width, r.height),
+        )
+    }
+
+    /// The main window's contentView (parent of the shell WKWebView). Main-thread only.
+    unsafe fn content_view(win: &NSWindow) -> Retained<NSView> {
+        win.contentView().expect("main window has a contentView")
+    }
+
+    pub fn create(
+        app: tauri::AppHandle,
+        id: String,
+        url: String,
+        profile_id: String,
+        rect: PaneRect,
+    ) -> Result<(), String> {
+        let win = app.get_webview_window("main").ok_or("no main window")?;
+        // with_webview runs its closure on the AppKit main thread. Build the pane container at
+        // non-zero bounds FIRST (landmine a), then mount the webview ChildOf it — all on main.
+        let (tx, rx) = std::sync::mpsc::channel();
+        win.with_webview(move |w| {
+            let res = (|| -> Result<(), String> {
+                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
+                unsafe {
+                    let wk = &*(w.inner() as *mut WKWebView);
+                    let ns_win = wk.window().ok_or("shell webview has no window")?;
+                    let content = content_view(&ns_win);
+                    let frame = appkit_rect(&content, rect);
+                    let container = NSView::initWithFrame(NSView::alloc(mtm), frame);
+                    content.addSubview(&container);
+                    let cptr = Retained::as_ptr(&container) as *mut c_void;
+                    let handle = ViewHandle::from_ptr(cptr);
+                    let spec = CreateSpec {
+                        label: id.clone(),
+                        url: url.clone(),
+                        profile_id: profile_id.clone(),
+                        init_js: String::new(),
+                        mount: Mount::ChildOf(handle),
+                    };
+                    Controller::new().create_webview(mtm, spec, Box::new(|_raw| {}))?;
+                    // contentView holds a strong ref via addSubview; store only the pointer.
+                    containers().lock().unwrap().insert(id.clone(), cptr as usize);
+                }
+                Ok(())
+            })();
+            let _ = tx.send(res);
+        })
+        .map_err(|e| e.to_string())?;
+        rx.recv().map_err(|e| e.to_string())?
+    }
+
+    pub fn set_mount(app: tauri::AppHandle, id: String, mode: String) -> Result<(), String> {
+        let (tx, rx) = std::sync::mpsc::channel();
+        let win = app.get_webview_window("main").ok_or("no main window")?;
+        win.run_on_main_thread(move || {
+            let res = (|| -> Result<(), String> {
+                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
+                let mount = match mode.as_str() {
+                    "toplevel" => Mount::TopLevel,
+                    "child" => {
+                        let ptr = *containers().lock().unwrap().get(&id).ok_or("no pane for id")?;
+                        unsafe { Mount::ChildOf(ViewHandle::from_ptr(ptr as *mut c_void)) }
+                    }
+                    other => return Err(format!("bad mount mode: {other}")),
+                };
+                if Controller::new().set_mount(mtm, &id, mount) {
+                    Ok(())
+                } else {
+                    Err(format!("no webview {id}"))
+                }
+            })();
+            let _ = tx.send(res);
+        })
+        .map_err(|e| e.to_string())?;
+        rx.recv().map_err(|e| e.to_string())?
+    }
+
+    pub fn navigate(app: tauri::AppHandle, id: String, url: String) -> Result<(), String> {
+        let (tx, rx) = std::sync::mpsc::channel();
+        let win = app.get_webview_window("main").ok_or("no main window")?;
+        win.run_on_main_thread(move || {
+            let res = (|| -> Result<(), String> {
+                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
+                Controller::new().navigate(mtm, &id, &url)
+            })();
+            let _ = tx.send(res);
+        })
+        .map_err(|e| e.to_string())?;
+        rx.recv().map_err(|e| e.to_string())?
+    }
+
+    pub fn close(app: tauri::AppHandle, id: String) -> Result<(), String> {
+        let (tx, rx) = std::sync::mpsc::channel();
+        let win = app.get_webview_window("main").ok_or("no main window")?;
+        win.run_on_main_thread(move || {
+            let res = (|| -> Result<(), String> {
+                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
+                Controller::new().close(mtm, &id);
+                if let Some(ptr) = containers().lock().unwrap().remove(&id) {
+                    unsafe {
+                        let container = &*(ptr as *mut NSView);
+                        container.removeFromSuperview();
+                    }
+                }
+                Ok(())
+            })();
+            let _ = tx.send(res);
+        })
+        .map_err(|e| e.to_string())?;
+        rx.recv().map_err(|e| e.to_string())?
+    }
+
+    // ---- Sub-window: a standalone Tauri chrome window + a controlled WKWebView pane below the bar ----
+
+    /// Bridge init-JS + page sink for a sub-window webview, so it registers as a bod-browser tab when
+    /// the shim is running, and is inert-but-functional otherwise (empty init, no-op sink).
+    fn bridge_wiring(id: &str) -> (String, webview_control::MessageSink) {
+        let init_js = crate::bridge_mac::bridge_init_js(id).unwrap_or_default();
+        // Live self-healing sink: delivers to whichever shim is connected at send-time (None-safe),
+        // so a sub-window created while the shim is down becomes agent-exposed on a later connect.
+        let sink = crate::bridge_mac::bridge_sink();
+        (init_js, sink)
+    }
+
+    /// Mount a controlled WKWebView `ChildOf` a pane pinned below the chrome bar in `win`'s content
+    /// view, wiring the bridge for agent-exposure. Runs on the main thread (via `with_webview`).
+    fn mount_pane(win: &tauri::WebviewWindow, id: &str, profile_id: &str, url: &str) -> Result<(), String> {
+        let (tx, rx) = channel();
+        let (id, profile_id, url) = (id.to_string(), profile_id.to_string(), url.to_string());
+        win.with_webview(move |w| {
+            let res = (|| -> Result<(), String> {
+                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
+                unsafe {
+                    let wk = &*(w.inner() as *mut WKWebView);
+                    let ns_win = wk.window().ok_or("chrome webview has no window")?;
+                    let content = content_view(&ns_win);
+                    let b = content.bounds().size;
+                    let rect = PaneRect { x: 0.0, y: CHROME_H, width: b.width, height: (b.height - CHROME_H).max(0.0) };
+                    let frame = appkit_rect(&content, rect);
+                    let container = NSView::initWithFrame(NSView::alloc(mtm), frame);
+                    container.setAutoresizingMask(container_mask());
+                    content.addSubview(&container);
+                    let cptr = Retained::as_ptr(&container) as *mut c_void;
+                    let handle = ViewHandle::from_ptr(cptr);
+                    let (init_js, sink) = bridge_wiring(&id);
+                    let spec = CreateSpec {
+                        label: id.clone(),
+                        url: url.clone(),
+                        profile_id: profile_id.clone(),
+                        init_js,
+                        mount: Mount::ChildOf(handle),
+                    };
+                    Controller::new().create_webview(mtm, spec, sink)?;
+                    containers().lock().unwrap().insert(id.clone(), cptr as usize);
+                }
+                Ok(())
+            })();
+            let _ = tx.send(res);
+        })
+        .map_err(|e| e.to_string())?;
+        rx.recv().map_err(|e| e.to_string())?
+    }
+
+    /// Clean up a sub-window's controlled webview + container. Main-thread only (called from the
+    /// window's Destroyed event, which fires on the main thread).
+    fn teardown(id: &str, mtm: MainThreadMarker) {
+        Controller::new().close(mtm, id);
+        if let Some(ptr) = containers().lock().unwrap().remove(id) {
+            unsafe { (*(ptr as *mut NSView)).removeFromSuperview() };
+        }
+    }
+
+    /// Open a sub-window: build the Tauri chrome window (loads the bundled chrome HTML asset, `?id=`
+    /// stamped so it binds to this webview), then mount the controlled webview below the chrome bar.
+    pub fn open(app: tauri::AppHandle, profile_id: String) -> Result<String, String> {
+        // Two DISTINCT labels: the Tauri chrome window (`win_id`) and the controlled WKWebView it
+        // hosts (`view_id = <win_id>-view`). Sharing one label double-listed it in `listWindows`
+        // (once from `app.webview_windows()`, once from the crate registry). The chrome HTML, its
+        // invokes, the container/registry key, the bridge `__BRIDGE_LABEL`, and what agents drive all
+        // key on `view_id`; only the OS window keeps `win_id`.
+        let win_id = new_subwin_id();
+        let view_id = format!("{win_id}-view");
+        let chrome_url = format!("appwrap-browser-chrome.html?id={view_id}");
+        let win = WebviewWindowBuilder::new(&app, &win_id, WebviewUrl::App(chrome_url.into()))
+            .title("Browser")
+            .inner_size(1100.0, 800.0)
+            .build()
+            .map_err(|e| e.to_string())?;
+        // Tear the controlled webview down when the sub-window closes, so it doesn't linger as a
+        // registry zombie / stray bod-browser tab.
+        let idc = view_id.clone();
+        win.on_window_event(move |ev| {
+            if matches!(ev, tauri::WindowEvent::Destroyed) {
+                if let Some(mtm) = MainThreadMarker::new() {
+                    teardown(&idc, mtm);
+                }
+            }
+        });
+        mount_pane(&win, &view_id, &profile_id, "about:blank")?;
+        Ok(view_id)
+    }
+
+    /// Re-fire the `register` beacon on every open sub-window controlled webview. Called when the
+    /// shim (re)connects: their live sink can now deliver, but an already-loaded document won't
+    /// re-run its init-JS `register()`, so nudge each via the bridgeShim handler to re-post it.
+    /// Idempotent + inert when the bridge feature is off (no bridgeShim handler → the try/catch eats
+    /// it) and when there are no sub-windows.
+    pub fn reregister_all(app: &tauri::AppHandle) {
+        let ids: Vec<String> = containers().lock().unwrap().keys().cloned().collect();
+        if ids.is_empty() {
+            return;
+        }
+        let _ = app.run_on_main_thread(move || {
+            if let Some(mtm) = MainThreadMarker::new() {
+                let c = Controller::new();
+                for id in &ids {
+                    let js = "try{if(window.__BRIDGE_LABEL){webkit.messageHandlers.bridgeShim.postMessage(JSON.stringify({label:window.__BRIDGE_LABEL,type:'register',url:location.href,title:document.title}))}}catch(e){}".to_string();
+                    let _ = c.inject_script(mtm, id, &js);
+                }
+            }
+        });
+    }
+
+    /// Swap the sub-window's controlled webview to another profile: profile is immutable per-webview,
+    /// so close the current one (keeps the pane container) and recreate `ChildOf` the SAME container
+    /// with the new profile. The Tauri chrome window is untouched.
+    pub fn switch_profile(app: tauri::AppHandle, id: String, profile_id: String) -> Result<(), String> {
+        let win = app.get_webview_window("main").ok_or("no main window")?;
+        let (tx, rx) = channel();
+        win.run_on_main_thread(move || {
+            let res = (|| -> Result<(), String> {
+                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
+                let ptr = *containers().lock().unwrap().get(&id).ok_or("no pane for id")?;
+                Controller::new().close(mtm, &id);
+                unsafe {
+                    let handle = ViewHandle::from_ptr(ptr as *mut c_void);
+                    let (init_js, sink) = bridge_wiring(&id);
+                    let spec = CreateSpec {
+                        label: id.clone(),
+                        url: "about:blank".to_string(),
+                        profile_id: profile_id.clone(),
+                        init_js,
+                        mount: Mount::ChildOf(handle),
+                    };
+                    Controller::new().create_webview(mtm, spec, sink)?;
+                }
+                Ok(())
+            })();
+            let _ = tx.send(res);
+        })
+        .map_err(|e| e.to_string())?;
+        rx.recv().map_err(|e| e.to_string())?
+    }
+
+    /// Route a nav op (`back`/`forward`/`reload`) to the controlled webview `id` on the main thread.
+    pub fn nav_op(app: tauri::AppHandle, id: String, op: &'static str) -> Result<(), String> {
+        let win = app.get_webview_window("main").ok_or("no main window")?;
+        let (tx, rx) = channel();
+        win.run_on_main_thread(move || {
+            let res = (|| -> Result<(), String> {
+                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
+                let c = Controller::new();
+                match op {
+                    "back" => c.go_back(mtm, &id),
+                    "forward" => c.go_forward(mtm, &id),
+                    "reload" => c.reload(mtm, &id),
+                    other => Err(format!("bad nav op: {other}")),
+                }
+            })();
+            let _ = tx.send(res);
+        })
+        .map_err(|e| e.to_string())?;
+        rx.recv().map_err(|e| e.to_string())?
+    }
+
+    /// Read the controlled webview `id`'s current `{href,title}` as a JSON string (for the address bar).
+    pub fn current_url(app: tauri::AppHandle, id: String) -> Result<String, String> {
+        let win = app.get_webview_window("main").ok_or("no main window")?;
+        let (tx, rx) = channel();
+        win.run_on_main_thread(move || {
+            let mtm = match MainThreadMarker::new() {
+                Some(m) => m,
+                None => { let _ = tx.send(Err("not main thread".to_string())); return; }
+            };
+            Controller::new().eval_async(
+                mtm,
+                &id,
+                "return JSON.stringify({href:location.href,title:document.title});".to_string(),
+                move |r| { let _ = tx.send(r); },
+            );
+        })
+        .map_err(|e| e.to_string())?;
+        rx.recv_timeout(Duration::from_secs(5)).map_err(|e| e.to_string())?
+    }
+}
+
+#[cfg(target_os = "macos")]
+#[tauri::command]
+pub fn browser_tab_create(
+    app: tauri::AppHandle,
+    id: String,
+    url: String,
+    profile_id: String,
+    rect: imp::PaneRect,
+) -> Result<String, String> {
+    imp::create(app, id.clone(), url, profile_id, rect).map(|_| id)
+}
+
+#[cfg(target_os = "macos")]
+#[tauri::command]
+pub fn browser_tab_set_mount(app: tauri::AppHandle, id: String, mode: String) -> Result<(), String> {
+    imp::set_mount(app, id, mode)
+}
+
+#[cfg(target_os = "macos")]
+#[tauri::command]
+pub fn browser_tab_navigate(app: tauri::AppHandle, id: String, url: String) -> Result<(), String> {
+    imp::navigate(app, id, url)
+}
+
+#[cfg(target_os = "macos")]
+#[tauri::command]
+pub fn browser_tab_close(app: tauri::AppHandle, id: String) -> Result<(), String> {
+    imp::close(app, id)
+}
+
+#[cfg(target_os = "macos")]
+#[tauri::command]
+pub fn browser_subwindow_open(app: tauri::AppHandle, profile_id: Option<String>) -> Result<String, String> {
+    imp::open(app, profile_id.unwrap_or_else(|| "default".to_string()))
+}
+
+#[cfg(target_os = "macos")]
+#[tauri::command]
+pub fn browser_subwindow_switch_profile(app: tauri::AppHandle, id: String, profile_id: String) -> Result<(), String> {
+    imp::switch_profile(app, id, profile_id)
+}
+
+#[cfg(target_os = "macos")]
+#[tauri::command]
+pub fn browser_tab_back(app: tauri::AppHandle, id: String) -> Result<(), String> {
+    imp::nav_op(app, id, "back")
+}
+
+#[cfg(target_os = "macos")]
+#[tauri::command]
+pub fn browser_tab_forward(app: tauri::AppHandle, id: String) -> Result<(), String> {
+    imp::nav_op(app, id, "forward")
+}
+
+#[cfg(target_os = "macos")]
+#[tauri::command]
+pub fn browser_tab_reload(app: tauri::AppHandle, id: String) -> Result<(), String> {
+    imp::nav_op(app, id, "reload")
+}
+
+#[cfg(target_os = "macos")]
+#[tauri::command]
+pub fn browser_tab_current_url(app: tauri::AppHandle, id: String) -> Result<String, String> {
+    imp::current_url(app, id)
+}
+
+#[cfg(target_os = "macos")]
+#[tauri::command]
+pub fn browser_list_profiles() -> Result<Vec<String>, String> {
+    Ok(webview_control::list_profiles())
+}
+
+/// Nudge every open browser sub-window to re-post its `register` beacon (called by the bridge control
+/// channel when a shim (re)connects, so pre-existing sub-windows self-heal into agent-exposure).
+#[cfg(target_os = "macos")]
+pub fn reregister_subwindows(app: &tauri::AppHandle) {
+    imp::reregister_all(app);
+}

package/runtime-desktop/src-tauri/src/main.rs

@@ -17,6 +17,7 @@ use tauri::Manager;
 mod biometrics_mac;
 #[cfg(target_os = "macos")]
 mod bridge_mac;
+mod browser_tab;
 #[cfg(target_os = "macos")]
 mod notifications_mac;
 #[cfg(target_os = "macos")]
@@ -688,7 +689,20 @@ fn main() {
         builder = builder.plugin(tauri_plugin_window_state::Builder::default().build());
     }
     builder
-        .invoke_handler(tauri::generate_handler![appwrap_invoke])
+        .invoke_handler(tauri::generate_handler![
+            appwrap_invoke,
+            browser_tab::browser_tab_create,
+            browser_tab::browser_tab_set_mount,
+            browser_tab::browser_tab_navigate,
+            browser_tab::browser_tab_close,
+            browser_tab::browser_subwindow_open,
+            browser_tab::browser_subwindow_switch_profile,
+            browser_tab::browser_tab_back,
+            browser_tab::browser_tab_forward,
+            browser_tab::browser_tab_reload,
+            browser_tab::browser_tab_current_url,
+            browser_tab::browser_list_profiles,
+        ])
         // Popups are plain NSWindows tauri doesn't know about; with the main (only tauri) window
         // closed, tauri exits the app — but tear popups down explicitly so no dangling windows or
         // live child webviews outlive the shell during teardown (or if the exit is ever prevented).
@@ -707,6 +721,75 @@ fn main() {
         .setup(|app| {
             // Stash the app handle so off-main-thread handlers can reach plugin state (notifications).
             let _ = APP.set(app.handle().clone());
+            // Native "Browser ▸ New Browser Window" menu — every appwrap desktop app gets the
+            // app-owned browser sub-window affordance. We APPEND to the DEFAULT macOS menu (built via
+            // Menu::default) so Edit's Cut/Copy/Paste/Select-All stay intact; suppressing them would
+            // break Cmd+C/V in inputs. The menu event opens a sub-window for the "default" profile.
+            {
+                use tauri::menu::{Menu, MenuItem, Submenu};
+                let handle = app.handle();
+                match Menu::default(handle).and_then(|menu| {
+                    let new_win = MenuItem::with_id(
+                        handle, "browser_new_window", "New Browser Window", true,
+                        Some("CmdOrCtrl+Shift+N"),
+                    )?;
+                    let browser = Submenu::with_id_and_items(
+                        handle, "browser_menu", "Browser", true, &[&new_win],
+                    )?;
+                    menu.append(&browser)?;
+                    // View ▸ Toggle DevTools (⌥⌘I). Opens/closes Tauri's devtools on the focused
+                    // window; the handler no-ops in release unless APPWRAP_DEVTOOLS is set
+                    // (devtools_enabled), matching the Safari-inspectable gate.
+                    let toggle_devtools = MenuItem::with_id(
+                        handle, "toggle_devtools", "Toggle DevTools", true,
+                        Some("Alt+CmdOrCtrl+I"),
+                    )?;
+                    let view = Submenu::with_id_and_items(
+                        handle, "view_menu", "View", true, &[&toggle_devtools],
+                    )?;
+                    menu.append(&view)?;
+                    Ok(menu)
+                }) {
+                    Ok(menu) => {
+                        if let Err(e) = app.set_menu(menu) {
+                            eprintln!("[browser] set_menu failed: {e}");
+                        }
+                    }
+                    Err(e) => eprintln!("[browser] build Browser menu failed: {e}"),
+                }
+                app.on_menu_event(|app, event| {
+                    match event.id().as_ref() {
+                        "browser_new_window" => {
+                            if let Err(e) = browser_tab::browser_subwindow_open(app.clone(), Some("default".to_string())) {
+                                eprintln!("[browser] open sub-window (menu) failed: {e}");
+                            }
+                        }
+                        "toggle_devtools" => {
+                            // Gate at runtime: inert in a release build unless APPWRAP_DEVTOOLS is set
+                            // (same policy as Safari-inspectable); always on in debug.
+                            #[cfg(target_os = "macos")]
+                            if !webview_control::devtools_enabled() {
+                                eprintln!("[devtools] toggle ignored (set APPWRAP_DEVTOOLS=1 to enable in release)");
+                                return;
+                            }
+                            // Toggle on the focused webview window (sub-windows are their own
+                            // WebviewWindows), falling back to main.
+                            let win = app.webview_windows()
+                                .into_values()
+                                .find(|w| w.is_focused().unwrap_or(false))
+                                .or_else(|| app.get_webview_window("main"));
+                            if let Some(win) = win {
+                                if win.is_devtools_open() {
+                                    win.close_devtools();
+                                } else {
+                                    win.open_devtools();
+                                }
+                            }
+                        }
+                        _ => {}
+                    }
+                });
+            }
             // SPIKE: browser-bridge window-ops backend — inert unless APPWRAP_BRIDGE_JS is set.
             #[cfg(target_os = "macos")]
             bridge_mac::init(app.handle().clone());
@@ -748,7 +831,12 @@ fn main() {
             #[cfg(target_os = "macos")]
             if let Some(window) = app.get_webview_window("main") {
                 let picker = shell().google_account_picker;
-                window.with_webview(move |w| popup_mac::install(w.inner() as _, picker))?;
+                window.with_webview(move |w| {
+                    popup_mac::install(w.inner() as _, picker);
+                    // Safari Web Inspector on the main Tauri window's WKWebView (debug always;
+                    // release only under APPWRAP_DEVTOOLS). Runs on the main thread (with_webview).
+                    unsafe { webview_control::set_inspectable(w.inner() as *mut _) };
+                })?;
             }
             // Reveal after the state plugin's on_window_ready restore has applied (built hidden above).
             if restore {