@livx.cc/appwrap 0.47.0 → 0.47.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.47.0",
+  "version": "0.47.1",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime-desktop/crates/webview-control/examples/host_harness.rs

@@ -248,6 +248,25 @@ fn main() {
     println!("session survived (marker 77):             {session_ok}");
     println!("bridge  survived (pings {:?}):             {bridge_ok}", pings);
 
+    // ---- IDEMPOTENT DOUBLE-INSTALL (bridgeShim) ----
+    // Simulate a SECOND plugin attaching onMessage to the SAME window. Before the fix, a second
+    // addScriptMessageHandler(name:"bridgeShim") on the same UCC threw NSInvalidArgumentException =
+    // hard crash. install_message_handler now does remove-then-add, so this must NOT crash and the
+    // bridge must still route to the newly-installed sink. Runs AFTER the original-sink assertions
+    // above (re-install replaces the sink, which is fine from here on).
+    println!("\n== IDEMPOTENCY: re-install bridgeShim on the live webview (second-plugin attach)");
+    let (tx2, rx2): (_, Receiver<String>) = channel();
+    let sink2 = Box::new(move |raw: String| { let _ = tx2.send(raw); });
+    if let Err(e) = ctrl.reinstall_message_handler(mtm, id, sink2) {
+        eprintln!("FAIL: reinstall_message_handler errored: {e}");
+        std::process::exit(1);
+    }
+    let _ = eval(&ctrl, mtm, id, "webkit.messageHandlers.bridgeShim.postMessage('PING-REINSTALL'); return 'posted';");
+    pump(0.5);
+    let reinstall_pings: Vec<String> = rx2.try_iter().collect();
+    let idempotent_ok = reinstall_pings.iter().any(|p| p == "PING-REINSTALL");
+    println!("   no crash on double-install; post-reinstall pings {reinstall_pings:?} (routed={idempotent_ok})");
+
     // ---- NAV ops (go_back / go_forward / reload via Controller) ----
     // The tab is docked ChildOf(pane) on page 1. Navigate to a distinct page 2, then walk history.
     let page1_href = href(&ctrl, mtm, id);
@@ -321,7 +340,12 @@ fn main() {
 
     println!("pane empty after close (no zombie webview):  {pane_empty_ok}");
 
-    if page_ok && session_ok && bridge_ok && pane_empty_ok && nav_ok && profile_swap_ok {
+    println!("bridge idempotent re-install (no crash, routes):  {idempotent_ok}");
+    if !idempotent_ok {
+        eprintln!("\nFAIL: bridge did not route after idempotent double-install of bridgeShim.");
+    }
+
+    if page_ok && session_ok && bridge_ok && pane_empty_ok && nav_ok && profile_swap_ok && idempotent_ok {
         println!("\nPASS: live webview reparented child->toplevel->child via EMBEDDED API; page+session+bridge intact; nav ops (back/forward/reload) + profile-swap (distinct store) verified; host pane empty after close.");
     } else {
         if !nav_ok { eprintln!("\nFAIL: nav ops (go_back/go_forward/reload) did not land as expected."); }

package/runtime-desktop/crates/webview-control/src/embedded.rs

@@ -115,6 +115,23 @@ impl Controller {
         backend::list_webviews()
     }
 
+    /// Re-install the bridgeShim message handler on an existing webview's UCC. Mirrors a second
+    /// plugin attaching `onMessage` to the same window. Idempotent (remove-then-add) — proves the
+    /// double-install crash (NSInvalidArgumentException) is gone. Test/harness surface only.
+    #[doc(hidden)]
+    pub fn reinstall_message_handler(
+        &self,
+        mtm: MainThreadMarker,
+        id: &str,
+        on_message: crate::MessageSink,
+    ) -> Result<(), String> {
+        let wk = self.webview(id)?;
+        unsafe {
+            backend::install_message_handler(Retained::as_ptr(&wk) as *mut WKWebView, mtm, on_message)
+        };
+        Ok(())
+    }
+
     fn webview(&self, id: &str) -> Result<Retained<WKWebView>, String> {
         backend::profile_webview(id).ok_or_else(|| format!("no webview {id}"))
     }

package/runtime-desktop/crates/webview-control/src/wkwebview_backend.rs

@@ -127,6 +127,11 @@ pub unsafe fn install_message_handler(wk: *mut WKWebView, mtm: MainThreadMarker,
     let handler = MsgHandler::alloc(mtm).set_ivars(MsgHandlerIvars { on_message });
     let handler: Retained<MsgHandler> = msg_send![super(handler), init];
     let ucc = wk.configuration().userContentController();
+    // Idempotent per UCC: WKUserContentController throws NSInvalidArgumentException if a handler is
+    // already registered for a name. A window can already carry `bridgeShim` (a second plugin
+    // attaching onMessage, a browser tab, or the env-gated bridge). removeScriptMessageHandlerForName
+    // is safe when none is present, so remove-then-add makes re-install a no-op instead of a crash.
+    ucc.removeScriptMessageHandlerForName(&NSString::from_str("bridgeShim"));
     ucc.addScriptMessageHandler_name(
         ProtocolObject::from_ref(&*handler),
         &NSString::from_str("bridgeShim"),

package/src/cli.ts

@@ -2081,12 +2081,13 @@ flex-direction:column;gap:20px;background:#0b0b0f;color:#e5e5e5;font:14px -apple
 /**
  * Make `cfg.plugins` LIVE (A.1 loader): resolve each entry (path OR npm package), bun-build its
  * entrypoint to a single embedded file under `native-desktop/plugins/`, bun-build the multiplexed
- * plugin-host once, and stamp `{ pluginHost, plugins:[{namespace, attachTo, bundlePath}] }` into the
+ * plugin-host once, and stamp `{ pluginHost, plugins:[{bundleId, attachTo, bundlePath}] }` into the
  * shell config. The Rust shell (plugin_host.rs) spawns the host with the stamped plugins at boot.
  *
  * A.1 scope: manifest/perms/native-deps merge is STUBBED (noted) — full `capabilities.manifest.ts`
- * reuse (perms/entitlements union) lands later. `namespace` here is the file/package basename; the
- * authoritative namespace is the plugin def's `name`, which the host reads from the bundle.
+ * reuse (perms/entitlements union) lands later. `bundleId` here is the file/package basename (a
+ * pre-load build id for the bundle filename only); the authoritative routing/diagnostic identifier is
+ * the plugin def's `name`, which the host reads from the bundle after `import()`.
  */
 export function regeneratePlugins(cwd: string, cfg: AppwrapConfig, outDir: string, shell: DesktopShellConfig): void {
   const entries = cfg.plugins ?? [];
@@ -2127,10 +2128,10 @@ export function regeneratePlugins(cwd: string, cfg: AppwrapConfig, outDir: strin
         continue;
       }
     }
-    const namespace = name.replace(/[^a-zA-Z0-9_-]/g, '_');
-    const bundlePath = join(outPlugins, `${namespace}.js`);
+    const bundleId = name.replace(/[^a-zA-Z0-9_-]/g, '_');
+    const bundlePath = join(outPlugins, `${bundleId}.js`);
     if (!bunBuild(entrypoint, bundlePath)) continue;
-    stamped.push({ namespace, attachTo, bundlePath });
+    stamped.push({ bundleId, attachTo, bundlePath });
     console.log(`  plugin ← ${name}  (attachTo: ${attachTo ?? 'def-declared'})`);
   }
 

package/src/desktop.ts

@@ -48,7 +48,7 @@ export interface DesktopShellConfig {
    * plugins are configured (the Rust shell skips spawning the host). Stamped by `regeneratePlugins`. */
   pluginHost: string;
   /** Resolved + bun-built plugins the host loads at boot. Empty when none. Stamped by `regeneratePlugins`. */
-  plugins: { namespace: string; attachTo?: string; bundlePath: string }[];
+  plugins: { bundleId: string; attachTo?: string; bundlePath: string }[];
   /** True when `modules` includes 'media' → the .app carries an NSMicrophoneUsageDescription so
    * `getUserMedia` (voice mode) can pass macOS TCC. The WebKit-layer grant (popup_mac) is
    * unconditional; this only adds the OS usage string an app that actually uses the mic needs. */

package/src/plugin/host.ts

@@ -15,6 +15,11 @@
  */
 import type { Dispose, Envelope, PluginDef, StampedPlugin, WindowCtx, WindowIdentity } from './types';
 
+/** Reject an outstanding op after this long if the shell never sends its `result` (a native callback
+ * that never fires would otherwise leak the plugin's pending promise forever). Mirrors the Rust
+ * shell's CALL_TIMEOUT (plugin_host.rs, 30s) for the reverse op direction. */
+const OP_TIMEOUT_MS = 30_000;
+
 /** Resolve `attachTo` against a window identity. Config-string override wins over the def's own scope. */
 export function matchScope(def: PluginDef, override: string | undefined, win: WindowIdentity): boolean {
   const scope = override ?? def.attachTo;
@@ -38,7 +43,7 @@ interface Attach {
 
 export class PluginHost {
   private pluginsRegistry: { pluginId: string; methods: string[] }[];
-  private ops = new Map<string, { resolve: (v: unknown) => void; reject: (e: Error) => void }>();
+  private ops = new Map<string, { resolve: (v: unknown) => void; reject: (e: Error) => void; timer: ReturnType<typeof setTimeout> }>();
   private attaches = new Map<string, Attach>(); // key: `${pluginId}\0${windowId}`
   private opSeq = 0;
 
@@ -66,7 +71,12 @@ export class PluginHost {
     const call = <T>(method: string, params?: unknown): Promise<T> =>
       new Promise<T>((resolve, reject) => {
         const id = `op-${pluginId}-${++this.opSeq}`;
-        this.ops.set(id, { resolve: resolve as (v: unknown) => void, reject });
+        const timer = setTimeout(() => {
+          if (this.ops.delete(id)) reject(new Error(`op ${method} (${id}) timed out after ${OP_TIMEOUT_MS}ms`));
+        }, OP_TIMEOUT_MS);
+        // Don't keep the host process alive just for a pending op timer.
+        (timer as { unref?: () => void }).unref?.();
+        this.ops.set(id, { resolve: resolve as (v: unknown) => void, reject, timer });
         this.send({ kind: 'op', id, pluginId, windowId: win.id, method, params });
       });
     const k = this.key(pluginId, win.id);
@@ -103,6 +113,7 @@ export class PluginHost {
         const p = this.ops.get(env.id);
         if (!p) return;
         this.ops.delete(env.id);
+        clearTimeout(p.timer);
         if (env.ok) p.resolve(env.data);
         else p.reject(new Error(env.error?.message ?? 'op failed'));
         return;

package/src/plugin/types.ts

@@ -97,8 +97,11 @@ export type Envelope =
 
 /** One resolved plugin the host loads at boot (stamped into shell_config by `regeneratePlugins`). */
 export interface StampedPlugin {
-  /** Plugin namespace (== PluginDef.name). */
-  namespace: string;
+  /** Bundle/build id derived from the config source (sanitized filename or package name). This is a
+   * pre-bundle-load stamp — the plugin's real def `name` isn't known until the host `import()`s the
+   * bundle. It is NOT the routing/diagnostic identifier: routing (matchScope, registry) and all
+   * diagnostics key off the loaded def `name` (see host.ts). Used only for the bundle filename. */
+  bundleId: string;
   /** Config-level attachTo OVERRIDE (string forms only). Falls back to the def's own `attachTo`. */
   attachTo?: 'main' | 'all' | string;
   /** Absolute path to the bun-built single-file plugin bundle. */