@livx.cc/appwrap 0.47.2 → 0.48.0

package/runtime-desktop/crates/webview-control/src/wkwebview_backend.rs

@@ -123,19 +123,28 @@ define_class!(
 /// the legacy tauri-window path — the profile-window path installs it on the config's UCC before
 /// creation). The UCC retains the handler, so no external retention is needed here. Main-thread only.
 pub unsafe fn install_message_handler(wk: *mut WKWebView, mtm: MainThreadMarker, on_message: MessageSink) {
+    install_named_message_handler(wk, mtm, "bridgeShim", on_message);
+}
+
+/// Install a WKScriptMessageHandler under `name` on a WKWebView, so page JS reaches native via
+/// `webkit.messageHandlers.<name>.postMessage(str)`. Origin-agnostic and NOT command-ACL-gated —
+/// the ONLY reliable page→native path for a REMOTE-served page (Tauri command IPC is ACL-blocked
+/// for remote origins; ws/http/custom-scheme are mixed-content-blocked from https). Main-thread only.
+pub unsafe fn install_named_message_handler(
+    wk: *mut WKWebView,
+    mtm: MainThreadMarker,
+    name: &str,
+    on_message: MessageSink,
+) {
     let wk = &*wk;
     let handler = MsgHandler::alloc(mtm).set_ivars(MsgHandlerIvars { on_message });
     let handler: Retained<MsgHandler> = msg_send![super(handler), init];
     let ucc = wk.configuration().userContentController();
-    // Idempotent per UCC: WKUserContentController throws NSInvalidArgumentException if a handler is
-    // already registered for a name. A window can already carry `bridgeShim` (a second plugin
-    // attaching onMessage, a browser tab, or the env-gated bridge). removeScriptMessageHandlerForName
-    // is safe when none is present, so remove-then-add makes re-install a no-op instead of a crash.
-    ucc.removeScriptMessageHandlerForName(&NSString::from_str("bridgeShim"));
-    ucc.addScriptMessageHandler_name(
-        ProtocolObject::from_ref(&*handler),
-        &NSString::from_str("bridgeShim"),
-    );
+    // Idempotent per UCC: addScriptMessageHandler throws NSInvalidArgumentException if `name` is
+    // already registered; remove-then-add makes re-install a no-op instead of a crash.
+    let ns_name = NSString::from_str(name);
+    ucc.removeScriptMessageHandlerForName(&ns_name);
+    ucc.addScriptMessageHandler_name(ProtocolObject::from_ref(&*handler), &ns_name);
 }
 
 /// A manually-created profile window. Strong refs kept alive until close (or windowWillClose).
@@ -305,6 +314,10 @@ pub fn create_webview(
 
     let cfg = unsafe { WKWebViewConfiguration::new(mtm) };
     unsafe { cfg.setWebsiteDataStore(&store) };
+    // Allow programmatic window.open (the createWebViewWithConfiguration UI-delegate below hosts the
+    // child popup). Without this WKWebView blocks any window.open NOT fired synchronously in a click —
+    // which silently kills OAuth "Sign in with Google/…" popups that open AFTER an async round-trip.
+    unsafe { cfg.preferences().setJavaScriptCanOpenWindowsAutomatically(true) };
 
     // bridgeShim message handler + content bundle (documentStart) on this cfg's UCC.
     let ucc = unsafe { cfg.userContentController() };

package/runtime-desktop/src-tauri/src/browser_tab.rs

@@ -13,13 +13,15 @@
 mod imp {
     use std::collections::HashMap;
     use std::ffi::c_void;
+    use std::path::PathBuf;
+    use std::sync::atomic::{AtomicBool, Ordering};
     use std::sync::mpsc::channel;
     use std::sync::{Mutex, OnceLock};
     use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
     use objc2::rc::Retained;
     use objc2::{MainThreadMarker, MainThreadOnly};
-    use objc2_app_kit::{NSAutoresizingMaskOptions, NSView, NSWindow};
+    use objc2_app_kit::{NSAutoresizingMaskOptions, NSView, NSWindow, NSWindowStyleMask};
     use objc2_foundation::{NSPoint, NSRect, NSSize};
     use objc2_web_kit::WKWebView;
     use serde::Deserialize;
@@ -40,6 +42,19 @@ mod imp {
         )
     }
 
+    /// Percent-encode a string for safe use as a URL hash-fragment param value (RFC 3986 unreserved
+    /// stay literal; everything else → %XX). URLSearchParams on the chrome side decodes it back.
+    fn hash_encode(s: &str) -> String {
+        let mut out = String::new();
+        for b in s.bytes() {
+            match b {
+                b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => out.push(b as char),
+                _ => out.push_str(&format!("%{b:02X}")),
+            }
+        }
+        out
+    }
+
     /// A unique sub-window id / bridge tab label.
     fn new_subwin_id() -> String {
         let ms = SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_millis()).unwrap_or(0);
@@ -65,6 +80,70 @@ mod imp {
         CONTAINERS.get_or_init(|| Mutex::new(HashMap::new()))
     }
 
+    // ---- Session persistence: restore open browser sub-windows across app restarts ----
+    //
+    // We mirror the live set of open sub-windows (profile + last-navigated url, keyed by view id) to a
+    // JSON file. On the next launch `restore()` re-opens them. A user-closed window is dropped from the
+    // snapshot immediately; on app QUIT the snapshot is left intact (guarded by `APP_QUITTING`), so
+    // whatever was open comes back. Restore-fidelity is "last explicit navigation" (back/fwd history
+    // is not persisted) — deliberately lean.
+
+    /// Set on app exit so the per-window teardown (which fires on BOTH user-close and quit) leaves the
+    /// snapshot intact on quit but prunes it on a genuine user-close.
+    pub static APP_QUITTING: AtomicBool = AtomicBool::new(false);
+
+    fn sessions() -> &'static Mutex<HashMap<String, (String, String)>> {
+        static S: OnceLock<Mutex<HashMap<String, (String, String)>>> = OnceLock::new();
+        S.get_or_init(|| Mutex::new(HashMap::new()))
+    }
+
+    fn state_path() -> PathBuf {
+        PathBuf::from(std::env::var("HOME").unwrap_or_default())
+            .join("Library/Application Support/appwrap-desktop/browser-subwindows.json")
+    }
+
+    /// Write the current live session set (profile,url pairs) to disk. Best-effort (logs on failure).
+    fn persist() {
+        let list: Vec<(String, String)> = sessions().lock().unwrap().values().cloned().collect();
+        let path = state_path();
+        if let Some(dir) = path.parent() {
+            let _ = std::fs::create_dir_all(dir);
+        }
+        if let Err(e) = std::fs::write(&path, serde_json::to_string_pretty(&list).unwrap_or_default()) {
+            eprintln!("[browser] persist sub-window sessions failed: {e}");
+        }
+    }
+
+    fn record_open(id: &str, profile: &str, url: &str) {
+        sessions().lock().unwrap().insert(id.to_string(), (profile.to_string(), url.to_string()));
+        persist();
+    }
+    fn record_url(id: &str, url: &str) {
+        if let Some(e) = sessions().lock().unwrap().get_mut(id) {
+            e.1 = url.to_string();
+        } else {
+            return;
+        }
+        persist();
+    }
+    fn record_profile(id: &str, profile: &str) {
+        if let Some(e) = sessions().lock().unwrap().get_mut(id) {
+            e.0 = profile.to_string();
+            e.1 = "about:blank".to_string();
+        } else {
+            return;
+        }
+        persist();
+    }
+    /// Drop a session on genuine user-close; on app quit keep it so `restore()` re-opens it next launch.
+    fn record_close(id: &str) {
+        if APP_QUITTING.load(Ordering::SeqCst) {
+            return;
+        }
+        sessions().lock().unwrap().remove(id);
+        persist();
+    }
+
     unsafe fn appkit_rect(content: &NSView, r: PaneRect) -> NSRect {
         let ch = content.bounds().size.height;
         NSRect::new(
@@ -73,6 +152,28 @@ mod imp {
         )
     }
 
+    /// Map a DOM rect `r` (SHELL WEBVIEW viewport coords, top-left origin) to an AppKit frame in the
+    /// container's superview (contentView) coordinate space. Two corrections vs a naive `content.bounds`
+    /// flip: (1) `fe_in_content` — the shell webview's own rect in contentView coords (handles the
+    /// webview being offset/nested); (2) `sa` — the webview's SAFE-AREA insets. On a full-size-content
+    /// macOS window WKWebView insets its web VISUAL VIEWPORT under the titlebar (e.g. innerHeight 897 in
+    /// a 929pt webview), so DOM y=0 sits `sa.top` px BELOW the webview's frame top. Without adding
+    /// `sa.top`/`sa.left` the pane rides exactly that inset too high, covering the FE chrome. `cv_h` is
+    /// the contentView height (for the single bottom-left-origin flip). Callers pass
+    /// `wk.convertRect_toView(wk.bounds(), Some(content))` and `wk.safeAreaInsets()`.
+    fn appkit_rect_in(cv_h: f64, fe_in_content: NSRect, sa_top: f64, sa_left: f64, r: PaneRect) -> NSRect {
+        // Shell webview's frame top, measured from the contentView TOP (top-left origin space).
+        let fe_top_from_cv_top = cv_h - (fe_in_content.origin.y + fe_in_content.size.height);
+        // Pane top-left from contentView top: webview offset + safe-area inset + DOM offset.
+        let x = fe_in_content.origin.x + sa_left + r.x;
+        let top_from_cv_top = fe_top_from_cv_top + sa_top + r.y;
+        // Single flip to AppKit bottom-left origin.
+        NSRect::new(
+            NSPoint::new(x, cv_h - top_from_cv_top - r.height),
+            NSSize::new(r.width, r.height),
+        )
+    }
+
     /// The main window's contentView (parent of the shell WKWebView). Main-thread only.
     unsafe fn content_view(win: &NSWindow) -> Retained<NSView> {
         win.contentView().expect("main window has a contentView")
@@ -93,22 +194,39 @@ mod imp {
             let res = (|| -> Result<(), String> {
                 let mtm = MainThreadMarker::new().ok_or("not main thread")?;
                 unsafe {
+                    // Idempotent: a fast unmount→remount (flexlayout re-render / StrictMode) can call
+                    // create for an id whose webview+container still exist. Tear the old one down first
+                    // so we never STACK duplicate WKWebViews for one tab (each is heavy — the prime
+                    // suspect for the runaway memory growth when panes churn).
+                    Controller::new().close(mtm, &id);
+                    if let Some(ptr) = containers().lock().unwrap().remove(&id) {
+                        (*(ptr as *mut NSView)).removeFromSuperview();
+                    }
                     let wk = &*(w.inner() as *mut WKWebView);
                     let ns_win = wk.window().ok_or("shell webview has no window")?;
                     let content = content_view(&ns_win);
-                    let frame = appkit_rect(&content, rect);
+                    let fe_in_content = wk.convertRect_toView(wk.bounds(), Some(&content));
+                    let sa = wk.safeAreaInsets();
+                    let cb = content.bounds().size;
+                    let frame = appkit_rect_in(cb.height, fe_in_content, sa.top, sa.left, rect);
                     let container = NSView::initWithFrame(NSView::alloc(mtm), frame);
                     content.addSubview(&container);
                     let cptr = Retained::as_ptr(&container) as *mut c_void;
                     let handle = ViewHandle::from_ptr(cptr);
+                    // R2 (agent-drive, DRY): wire the SAME bridge init-JS + live self-healing page sink
+                    // the sub-window path uses, so an embedded tab registers as a bod-browser tab
+                    // addressable by `id` over the control channel — thus drivable by mcp-desktop-browser.
+                    // Inert when the bridge feature is off (empty init-JS, None-safe sink); doesn't
+                    // affect mount/rect (init_js/sink only touch page registration, not layout).
+                    let (init_js, sink) = bridge_wiring(&id);
                     let spec = CreateSpec {
                         label: id.clone(),
                         url: url.clone(),
                         profile_id: profile_id.clone(),
-                        init_js: String::new(),
+                        init_js,
                         mount: Mount::ChildOf(handle),
                     };
-                    Controller::new().create_webview(mtm, spec, Box::new(|_raw| {}))?;
+                    Controller::new().create_webview(mtm, spec, sink)?;
                     // contentView holds a strong ref via addSubview; store only the pointer.
                     containers().lock().unwrap().insert(id.clone(), cptr as usize);
                 }
@@ -120,6 +238,37 @@ mod imp {
         rx.recv().map_err(|e| e.to_string())?
     }
 
+    /// Reposition an embedded tab's host pane container to `rect` (front-end DOM coords). The webview
+    /// is a fill-masked subview of the container, so moving/resizing the container carries the live
+    /// webview with it — no webview re-create, session intact. Recomputes `appkit_rect` (Y-flip vs the
+    /// current content-view height) EXACTLY as `create()` does, so a layout move/resize/scroll on the
+    /// FE side keeps the native pane glued to the reserved DOM rect. Runs on the main thread.
+    pub fn set_rect(app: tauri::AppHandle, id: String, rect: PaneRect) -> Result<(), String> {
+        let win = app.get_webview_window("main").ok_or("no main window")?;
+        let (tx, rx) = std::sync::mpsc::channel();
+        win.with_webview(move |w| {
+            let res = (|| -> Result<(), String> {
+                let _mtm = MainThreadMarker::new().ok_or("not main thread")?;
+                unsafe {
+                    let wk = &*(w.inner() as *mut WKWebView);
+                    let ns_win = wk.window().ok_or("shell webview has no window")?;
+                    let content = content_view(&ns_win);
+                    let fe_in_content = wk.convertRect_toView(wk.bounds(), Some(&content));
+                    let sa = wk.safeAreaInsets();
+                    let cb = content.bounds().size;
+                    let frame = appkit_rect_in(cb.height, fe_in_content, sa.top, sa.left, rect);
+                    let ptr = *containers().lock().unwrap().get(&id).ok_or("no pane for id")?;
+                    let container = &*(ptr as *mut NSView);
+                    container.setFrame(frame);
+                }
+                Ok(())
+            })();
+            let _ = tx.send(res);
+        })
+        .map_err(|e| e.to_string())?;
+        rx.recv().map_err(|e| e.to_string())?
+    }
+
     pub fn set_mount(app: tauri::AppHandle, id: String, mode: String) -> Result<(), String> {
         let (tx, rx) = std::sync::mpsc::channel();
         let win = app.get_webview_window("main").ok_or("no main window")?;
@@ -149,6 +298,7 @@ mod imp {
     pub fn navigate(app: tauri::AppHandle, id: String, url: String) -> Result<(), String> {
         let (tx, rx) = std::sync::mpsc::channel();
         let win = app.get_webview_window("main").ok_or("no main window")?;
+        let (id_c, url_c) = (id.clone(), url.clone());
         win.run_on_main_thread(move || {
             let res = (|| -> Result<(), String> {
                 let mtm = MainThreadMarker::new().ok_or("not main thread")?;
@@ -157,7 +307,10 @@ mod imp {
             let _ = tx.send(res);
         })
         .map_err(|e| e.to_string())?;
-        rx.recv().map_err(|e| e.to_string())?
+        rx.recv().map_err(|e| e.to_string())??;
+        // Persist the last-navigated url for sub-window session restore (no-op for embedded tabs).
+        record_url(&id_c, &url_c);
+        Ok(())
     }
 
     pub fn close(app: tauri::AppHandle, id: String) -> Result<(), String> {
@@ -181,6 +334,30 @@ mod imp {
         rx.recv().map_err(|e| e.to_string())?
     }
 
+    /// Tear down EVERY embedded pane (main-window children). Called on ⌘R app reload: `reload()`
+    /// reloads the FE but never runs React's unmount cleanup, so `close` is never called and the panes
+    /// orphan — leaked WKWebViews + visual mixing during the reload gap. The reloaded FE re-creates its
+    /// tabs by the SAME id (`create` is idempotent), so this is a safe pre-reload wipe. Sub-window panes
+    /// (`*-view`) live in their own OS windows, untouched by a main-window reload, so they're skipped.
+    /// Main-thread only: the ⌘R menu handler already runs on main, so we run inline with its
+    /// `MainThreadMarker` — NOT via run_on_main_thread+recv, which would deadlock main against itself.
+    pub fn close_all_embedded(mtm: MainThreadMarker) {
+        let ids: Vec<String> = containers()
+            .lock()
+            .unwrap()
+            .keys()
+            .filter(|id| !id.ends_with("-view"))
+            .cloned()
+            .collect();
+        let c = Controller::new();
+        for id in &ids {
+            c.close(mtm, id);
+            if let Some(ptr) = containers().lock().unwrap().remove(id) {
+                unsafe { (*(ptr as *mut NSView)).removeFromSuperview() };
+            }
+        }
+    }
+
     // ---- Sub-window: a standalone Tauri chrome window + a controlled WKWebView pane below the bar ----
 
     /// Bridge init-JS + page sink for a sub-window webview, so it registers as a bod-browser tab when
@@ -204,6 +381,14 @@ mod imp {
                 unsafe {
                     let wk = &*(w.inner() as *mut WKWebView);
                     let ns_win = wk.window().ok_or("chrome webview has no window")?;
+                    // wry gives the sub-window a FULL-SIZE content view: contentView spans the whole
+                    // frame and the traffic-light titlebar overlays its top, hiding all but a sliver of
+                    // the HTML chrome bar. Drop the full-size-content style so contentView sits BELOW
+                    // the titlebar — the bar + pane then lay out in the visible region with no offset.
+                    ns_win.setStyleMask(NSWindowStyleMask(
+                        ns_win.styleMask().0 & !NSWindowStyleMask::FullSizeContentView.0,
+                    ));
+                    ns_win.setTitlebarAppearsTransparent(false);
                     let content = content_view(&ns_win);
                     let b = content.bounds().size;
                     let rect = PaneRect { x: 0.0, y: CHROME_H, width: b.width, height: (b.height - CHROME_H).max(0.0) };
@@ -239,6 +424,8 @@ mod imp {
         if let Some(ptr) = containers().lock().unwrap().remove(id) {
             unsafe { (*(ptr as *mut NSView)).removeFromSuperview() };
         }
+        // Prune from the restore snapshot on a genuine user-close; kept intact on app quit.
+        record_close(id);
     }
 
     /// Open a sub-window: build the Tauri chrome window (loads the bundled chrome HTML asset, `?id=`
@@ -251,10 +438,28 @@ mod imp {
         // key on `view_id`; only the OS window keeps `win_id`.
         let win_id = new_subwin_id();
         let view_id = format!("{win_id}-view");
-        let chrome_url = format!("appwrap-browser-chrome.html?id={view_id}");
+        // Pass the view id via a hash FRAGMENT, not a query — Tauri's `WebviewUrl::App` treats the
+        // string as a path and the `?…` breaks asset resolution (looks up a literal `…html?id=…` file
+        // → 404 → blank chrome). Fragments are never used for lookup and survive in `location.hash`.
+        // Also pass the profile so the chrome dropdown reflects the ACTUAL mounted profile (a restored
+        // window may be on a non-default profile). Percent-encode it — profile names are user-entered.
+        let chrome_url = format!(
+            "appwrap-browser-chrome.html#id={view_id}&profile={}",
+            hash_encode(&profile_id)
+        );
+        // Open at the main window's size (logical points) so the sub-window matches the app it spawned
+        // from, falling back to a sane default if the main window or its metrics are unavailable.
+        let (w, h) = app
+            .get_webview_window("main")
+            .and_then(|m| {
+                let sf = m.scale_factor().ok()?;
+                let sz = m.inner_size().ok()?;
+                Some((sz.width as f64 / sf, sz.height as f64 / sf))
+            })
+            .unwrap_or((1100.0, 800.0));
         let win = WebviewWindowBuilder::new(&app, &win_id, WebviewUrl::App(chrome_url.into()))
             .title("Browser")
-            .inner_size(1100.0, 800.0)
+            .inner_size(w, h)
             .build()
             .map_err(|e| e.to_string())?;
         // Tear the controlled webview down when the sub-window closes, so it doesn't linger as a
@@ -268,9 +473,31 @@ mod imp {
             }
         });
         mount_pane(&win, &view_id, &profile_id, "about:blank")?;
+        record_open(&view_id, &profile_id, "about:blank");
         Ok(view_id)
     }
 
+    /// Re-open the sub-windows that were open at last quit (profile + last-navigated url). Best-effort:
+    /// a failed re-open is logged and skipped. Called once on app startup.
+    pub fn restore(app: tauri::AppHandle) {
+        let saved: Vec<(String, String)> = std::fs::read_to_string(state_path())
+            .ok()
+            .and_then(|s| serde_json::from_str(&s).ok())
+            .unwrap_or_default();
+        for (profile, url) in saved {
+            match open(app.clone(), profile) {
+                Ok(id) => {
+                    if !url.is_empty() && url != "about:blank" {
+                        if let Err(e) = navigate(app.clone(), id, url) {
+                            eprintln!("[browser] restore navigate failed: {e}");
+                        }
+                    }
+                }
+                Err(e) => eprintln!("[browser] restore open failed: {e}"),
+            }
+        }
+    }
+
     /// Re-fire the `register` beacon on every open sub-window controlled webview. Called when the
     /// shim (re)connects: their live sink can now deliver, but an already-loaded document won't
     /// re-run its init-JS `register()`, so nudge each via the bridgeShim handler to re-post it.
@@ -297,6 +524,7 @@ mod imp {
     /// with the new profile. The Tauri chrome window is untouched.
     pub fn switch_profile(app: tauri::AppHandle, id: String, profile_id: String) -> Result<(), String> {
         let win = app.get_webview_window("main").ok_or("no main window")?;
+        let (id_c, profile_c) = (id.clone(), profile_id.clone());
         let (tx, rx) = channel();
         win.run_on_main_thread(move || {
             let res = (|| -> Result<(), String> {
@@ -320,7 +548,10 @@ mod imp {
             let _ = tx.send(res);
         })
         .map_err(|e| e.to_string())?;
-        rx.recv().map_err(|e| e.to_string())?
+        rx.recv().map_err(|e| e.to_string())??;
+        // Persist the new profile (resets the restored url to about:blank) for session restore.
+        record_profile(&id_c, &profile_c);
+        Ok(())
     }
 
     /// Route a nav op (`back`/`forward`/`reload`) to the controlled webview `id` on the main thread.
@@ -361,13 +592,34 @@ mod imp {
             );
         })
         .map_err(|e| e.to_string())?;
-        rx.recv_timeout(Duration::from_secs(5)).map_err(|e| e.to_string())?
+        // Short timeout: this is a 1s address-bar poll; if the webview is mid-teardown the eval never
+        // resolves, so cap the wait low rather than blocking on a dying window.
+        rx.recv_timeout(Duration::from_millis(1500)).map_err(|e| e.to_string())?
+    }
+
+    /// CSP-immune eval of `js` (a function body that `return`s a value) into the controlled webview
+    /// `id`. Returns the raw JS return value as a string ("null" for non-string/undefined returns —
+    /// callers that need structured data should `return JSON.stringify(...)`). Powers the agent's
+    /// read-page / click / type / scroll (all injected JS) over the SAME embedded WKWebView.
+    pub fn eval(app: tauri::AppHandle, id: String, js: String) -> Result<String, String> {
+        let win = app.get_webview_window("main").ok_or("no main window")?;
+        let (tx, rx) = channel();
+        win.run_on_main_thread(move || {
+            let mtm = match MainThreadMarker::new() {
+                Some(m) => m,
+                None => { let _ = tx.send(Err("not main thread".to_string())); return; }
+            };
+            Controller::new().eval_async(mtm, &id, js, move |r| { let _ = tx.send(r); });
+        })
+        .map_err(|e| e.to_string())?;
+        // Longer than the address-bar poll: page reads/clicks can await layout/network.
+        rx.recv_timeout(Duration::from_secs(10)).map_err(|e| e.to_string())?
     }
 }
 
 #[cfg(target_os = "macos")]
 #[tauri::command]
-pub fn browser_tab_create(
+pub async fn browser_tab_create(
     app: tauri::AppHandle,
     id: String,
     url: String,
@@ -379,61 +631,67 @@ pub fn browser_tab_create(
 
 #[cfg(target_os = "macos")]
 #[tauri::command]
-pub fn browser_tab_set_mount(app: tauri::AppHandle, id: String, mode: String) -> Result<(), String> {
+pub async fn browser_tab_set_rect(app: tauri::AppHandle, id: String, rect: imp::PaneRect) -> Result<(), String> {
+    imp::set_rect(app, id, rect)
+}
+
+#[cfg(target_os = "macos")]
+#[tauri::command]
+pub async fn browser_tab_set_mount(app: tauri::AppHandle, id: String, mode: String) -> Result<(), String> {
     imp::set_mount(app, id, mode)
 }
 
 #[cfg(target_os = "macos")]
 #[tauri::command]
-pub fn browser_tab_navigate(app: tauri::AppHandle, id: String, url: String) -> Result<(), String> {
+pub async fn browser_tab_navigate(app: tauri::AppHandle, id: String, url: String) -> Result<(), String> {
     imp::navigate(app, id, url)
 }
 
 #[cfg(target_os = "macos")]
 #[tauri::command]
-pub fn browser_tab_close(app: tauri::AppHandle, id: String) -> Result<(), String> {
+pub async fn browser_tab_close(app: tauri::AppHandle, id: String) -> Result<(), String> {
     imp::close(app, id)
 }
 
 #[cfg(target_os = "macos")]
 #[tauri::command]
-pub fn browser_subwindow_open(app: tauri::AppHandle, profile_id: Option<String>) -> Result<String, String> {
+pub async fn browser_subwindow_open(app: tauri::AppHandle, profile_id: Option<String>) -> Result<String, String> {
     imp::open(app, profile_id.unwrap_or_else(|| "default".to_string()))
 }
 
 #[cfg(target_os = "macos")]
 #[tauri::command]
-pub fn browser_subwindow_switch_profile(app: tauri::AppHandle, id: String, profile_id: String) -> Result<(), String> {
+pub async fn browser_subwindow_switch_profile(app: tauri::AppHandle, id: String, profile_id: String) -> Result<(), String> {
     imp::switch_profile(app, id, profile_id)
 }
 
 #[cfg(target_os = "macos")]
 #[tauri::command]
-pub fn browser_tab_back(app: tauri::AppHandle, id: String) -> Result<(), String> {
+pub async fn browser_tab_back(app: tauri::AppHandle, id: String) -> Result<(), String> {
     imp::nav_op(app, id, "back")
 }
 
 #[cfg(target_os = "macos")]
 #[tauri::command]
-pub fn browser_tab_forward(app: tauri::AppHandle, id: String) -> Result<(), String> {
+pub async fn browser_tab_forward(app: tauri::AppHandle, id: String) -> Result<(), String> {
     imp::nav_op(app, id, "forward")
 }
 
 #[cfg(target_os = "macos")]
 #[tauri::command]
-pub fn browser_tab_reload(app: tauri::AppHandle, id: String) -> Result<(), String> {
+pub async fn browser_tab_reload(app: tauri::AppHandle, id: String) -> Result<(), String> {
     imp::nav_op(app, id, "reload")
 }
 
 #[cfg(target_os = "macos")]
 #[tauri::command]
-pub fn browser_tab_current_url(app: tauri::AppHandle, id: String) -> Result<String, String> {
+pub async fn browser_tab_current_url(app: tauri::AppHandle, id: String) -> Result<String, String> {
     imp::current_url(app, id)
 }
 
 #[cfg(target_os = "macos")]
 #[tauri::command]
-pub fn browser_list_profiles() -> Result<Vec<String>, String> {
+pub async fn browser_list_profiles() -> Result<Vec<String>, String> {
     Ok(webview_control::list_profiles())
 }
 
@@ -443,3 +701,104 @@ pub fn browser_list_profiles() -> Result<Vec<String>, String> {
 pub fn reregister_subwindows(app: &tauri::AppHandle) {
     imp::reregister_all(app);
 }
+
+// ---- Bridge entry points (served-PWA path via `browser.window.*`, distinct from the Tauri commands
+// which only reach app://-served content). Sync, callable from the appwrap bridge worker thread. ----
+
+/// Open an app-owned browser sub-window; returns its view id. Used by the `browser.window.open` bridge
+/// method so a server-loaded PWA (no injected `__TAURI__`) can spawn one.
+#[cfg(target_os = "macos")]
+pub fn open_subwindow(app: tauri::AppHandle, profile_id: String) -> Result<String, String> {
+    imp::open(app, profile_id)
+}
+
+/// Switch a sub-window to another profile (creating+persisting the profile on first use).
+#[cfg(target_os = "macos")]
+pub fn switch_subwindow_profile(app: tauri::AppHandle, id: String, profile_id: String) -> Result<(), String> {
+    imp::switch_profile(app, id, profile_id)
+}
+
+// ---- Bridge entry points for EMBEDDED tabs (served-PWA path via `browser.tab.*`). Sync, callable
+// from the appwrap bridge worker thread; each marshals to the main thread itself. `rect` arrives as
+// JSON from the wire (kept as `Value` here so the `PaneRect` shape stays private to `imp`). ----
+
+/// Create an embedded browser tab `ChildOf` a front-end-reserved pane; returns its id.
+#[cfg(target_os = "macos")]
+pub fn tab_create(
+    app: tauri::AppHandle,
+    id: String,
+    url: String,
+    profile_id: String,
+    rect: serde_json::Value,
+) -> Result<String, String> {
+    let rect: imp::PaneRect = serde_json::from_value(rect).map_err(|e| format!("bad rect: {e}"))?;
+    imp::create(app, id.clone(), url, profile_id, rect).map(|_| id)
+}
+
+/// Reposition an embedded tab's pane container to a new front-end DOM rect.
+#[cfg(target_os = "macos")]
+pub fn tab_set_rect(app: tauri::AppHandle, id: String, rect: serde_json::Value) -> Result<(), String> {
+    let rect: imp::PaneRect = serde_json::from_value(rect).map_err(|e| format!("bad rect: {e}"))?;
+    imp::set_rect(app, id, rect)
+}
+
+/// Navigate an embedded tab to `url`.
+#[cfg(target_os = "macos")]
+pub fn tab_navigate(app: tauri::AppHandle, id: String, url: String) -> Result<(), String> {
+    imp::navigate(app, id, url)
+}
+
+/// Tear-off (`toplevel`) / dock (`child`) an embedded tab — same live webview, session intact.
+#[cfg(target_os = "macos")]
+pub fn tab_set_mount(app: tauri::AppHandle, id: String, mode: String) -> Result<(), String> {
+    imp::set_mount(app, id, mode)
+}
+
+/// Close + drop an embedded tab and remove its pane container.
+#[cfg(target_os = "macos")]
+pub fn tab_close(app: tauri::AppHandle, id: String) -> Result<(), String> {
+    imp::close(app, id)
+}
+
+/// Tear down every embedded browser pane before a ⌘R app reload. Main-thread only — the ⌘R menu
+/// handler runs on main, so we grab the `MainThreadMarker` inline (no marshalling → no deadlock).
+/// No-op off the main thread. See `imp::close_all_embedded`.
+#[cfg(target_os = "macos")]
+pub fn close_all_embedded() {
+    if let Some(mtm) = objc2::MainThreadMarker::new() {
+        imp::close_all_embedded(mtm);
+    }
+}
+
+/// Route a history/reload op (`back`/`forward`/`reload`) to an embedded tab's controlled webview.
+#[cfg(target_os = "macos")]
+pub fn tab_nav(app: tauri::AppHandle, id: String, op: &'static str) -> Result<(), String> {
+    imp::nav_op(app, id, op)
+}
+
+/// Read an embedded tab's current `{href,title}` (JSON string) — for polling the address bar so it
+/// tracks in-page navigation (link clicks / redirects), not just user-typed URLs.
+#[cfg(target_os = "macos")]
+pub fn tab_current_url(app: tauri::AppHandle, id: String) -> Result<String, String> {
+    imp::current_url(app, id)
+}
+
+/// Eval `js` (a function body) into an embedded tab's controlled webview; returns the raw string
+/// result. Backs the `browser.tab.eval` bridge method so the side-panel agent can read page content
+/// (innerText) and drive clicks/typing/scroll over the SAME embedded WKWebView.
+#[cfg(target_os = "macos")]
+pub fn tab_eval(app: tauri::AppHandle, id: String, js: String) -> Result<String, String> {
+    imp::eval(app, id, js)
+}
+
+/// Re-open the sub-windows that were open at last quit. Called once on app startup.
+#[cfg(target_os = "macos")]
+pub fn restore_subwindows(app: tauri::AppHandle) {
+    imp::restore(app);
+}
+
+/// Mark the app as quitting so per-window teardown keeps (not prunes) the restore snapshot.
+#[cfg(target_os = "macos")]
+pub fn mark_quitting() {
+    imp::APP_QUITTING.store(true, std::sync::atomic::Ordering::SeqCst);
+}