@livx.cc/appwrap 0.47.3 → 0.48.0

package/runtime-desktop/src-tauri/src/main.rs

@@ -73,6 +73,7 @@ fn percent_encode(s: &str) -> String {
     out
 }
 
+
 /// App identity + window shape, stamped by `appwrap dev|build desktop` from the appwrap config into
 /// `shell_config.json` (embedded at compile time). De-hardcodes what the spike baked in. Mirrors
 /// `DesktopShellConfig` in packages/appwrap-cli/src/desktop.ts.
@@ -168,12 +169,18 @@ fn shell() -> &'static ShellConfig {
     })
 }
 
+// Expose `window.appwrapNative` (page -> native bridge). Prefer the WKScriptMessageHandler transport
+// (`webkit.messageHandlers.appwrapNative`, installed on the main webview) — it works from ANY origin
+// including a REMOTE server-loaded page, where Tauri command IPC is ACL-blocked. Fall back to Tauri
+// IPC for app:// pages if the handler isn't present.
 const INIT_JS: &str = r#"
 (() => {
-  const invoke = window.__TAURI_INTERNALS__.invoke;
-  window.appwrapNative = {
-    postMessage: (json) => { invoke('appwrap_invoke', { envelope: json }); },
-  };
+  try {
+    var mh = window.webkit && window.webkit.messageHandlers && window.webkit.messageHandlers.appwrapNative;
+    if (mh) { window.appwrapNative = { postMessage: function (json) { mh.postMessage(json); } }; return; }
+    var i = window.__TAURI_INTERNALS__;
+    if (i && i.invoke) { window.appwrapNative = { postMessage: function (json) { i.invoke('appwrap_invoke', { envelope: json }); } }; }
+  } catch (e) { /* no bridge available on this origin */ }
 })();
 "#;
 
@@ -423,6 +430,105 @@ fn handle(method: &str, params: &Value) -> HandlerResult {
             Ok(json!({ "ok": true }))
         }
         m if m.starts_with("storage.") => storage_handle(m, params),
+        #[cfg(target_os = "macos")]
+        m if m.starts_with("browser.window.") => browser_window_handle(m, params),
+        #[cfg(target_os = "macos")]
+        m if m.starts_with("browser.tab.") => browser_tab_handle(m, params),
+        _ => Err(("UNSUPPORTED", format!("{method} not implemented on desktop"))),
+    }
+}
+
+/// browser.tab.* — create/drive an EMBEDDED browser tab from a served PWA, mounted `ChildOf` a
+/// front-end-reserved pane NSView (the flexlayout tab region). Mirrors `browser.window.*` but for
+/// the in-layout pane surface: the FE tracks the pane's DOM rect and pushes `setRect` on
+/// resize/scroll. Runs on the bridge worker thread; the browser_tab entry points marshal to main.
+#[cfg(target_os = "macos")]
+fn browser_tab_handle(method: &str, params: &Value) -> HandlerResult {
+    let app = APP.get().ok_or(("NATIVE_ERROR", "app handle not ready".to_string()))?;
+    let need_id = || {
+        params["id"]
+            .as_str()
+            .map(str::to_string)
+            .ok_or(("NATIVE_ERROR", "missing id".to_string()))
+    };
+    match method {
+        "browser.tab.create" => {
+            let id = need_id()?;
+            let url = params["url"].as_str().unwrap_or("about:blank").to_string();
+            let profile = params["profileId"].as_str().unwrap_or("default").to_string();
+            let id = browser_tab::tab_create(app.clone(), id, url, profile, params["rect"].clone())
+                .map_err(|e| ("NATIVE_ERROR", e))?;
+            Ok(json!({ "id": id }))
+        }
+        "browser.tab.setRect" => {
+            browser_tab::tab_set_rect(app.clone(), need_id()?, params["rect"].clone())
+                .map_err(|e| ("NATIVE_ERROR", e))?;
+            Ok(json!({ "ok": true }))
+        }
+        "browser.tab.navigate" => {
+            let url = params["url"].as_str().ok_or(("NATIVE_ERROR", "missing url".to_string()))?.to_string();
+            browser_tab::tab_navigate(app.clone(), need_id()?, url).map_err(|e| ("NATIVE_ERROR", e))?;
+            Ok(json!({ "ok": true }))
+        }
+        "browser.tab.setMount" => {
+            let mode = params["mode"].as_str().ok_or(("NATIVE_ERROR", "missing mode".to_string()))?.to_string();
+            browser_tab::tab_set_mount(app.clone(), need_id()?, mode).map_err(|e| ("NATIVE_ERROR", e))?;
+            Ok(json!({ "ok": true }))
+        }
+        "browser.tab.close" => {
+            browser_tab::tab_close(app.clone(), need_id()?).map_err(|e| ("NATIVE_ERROR", e))?;
+            Ok(json!({ "ok": true }))
+        }
+        "browser.tab.back" | "browser.tab.forward" | "browser.tab.reload" => {
+            let op = &method["browser.tab.".len()..];
+            let op = match op { "back" => "back", "forward" => "forward", _ => "reload" };
+            browser_tab::tab_nav(app.clone(), need_id()?, op).map_err(|e| ("NATIVE_ERROR", e))?;
+            Ok(json!({ "ok": true }))
+        }
+        "browser.tab.currentUrl" => {
+            let s = browser_tab::tab_current_url(app.clone(), need_id()?).map_err(|e| ("NATIVE_ERROR", e))?;
+            // `s` is a JSON string {"href":..,"title":..}; embed as an object for the FE.
+            Ok(serde_json::from_str::<Value>(&s).unwrap_or_else(|_| json!({})))
+        }
+        "browser.tab.eval" => {
+            let js = params["js"].as_str().ok_or(("NATIVE_ERROR", "missing js".to_string()))?.to_string();
+            let s = browser_tab::tab_eval(app.clone(), need_id()?, js).map_err(|e| ("NATIVE_ERROR", e))?;
+            Ok(json!({ "result": s }))
+        }
+        "browser.tab.listProfiles" => Ok(json!({ "profiles": webview_control::list_profiles() })),
+        "browser.tab.switchProfile" => {
+            // Reuse switch_profile: closes the embedded webview + recreates it ChildOf the SAME pane
+            // container with the new profile's data store (page reset to about:blank; caller re-navigates
+            // to the profile's remembered url). Container/position is preserved (safe-area-correct).
+            let profile = params["profileId"].as_str()
+                .ok_or(("NATIVE_ERROR", "missing profileId".to_string()))?.to_string();
+            browser_tab::switch_subwindow_profile(app.clone(), need_id()?, profile)
+                .map_err(|e| ("NATIVE_ERROR", e))?;
+            Ok(json!({ "ok": true }))
+        }
+        _ => Err(("UNSUPPORTED", format!("{method} not implemented on desktop"))),
+    }
+}
+
+/// browser.window.* — spawn/control app-owned browser sub-windows from a served PWA (which has no
+/// injected `__TAURI__`, so it can't call the Tauri commands directly). Runs on the bridge worker
+/// thread; the browser_tab entry points marshal to the main thread themselves.
+#[cfg(target_os = "macos")]
+fn browser_window_handle(method: &str, params: &Value) -> HandlerResult {
+    let app = APP.get().ok_or(("NATIVE_ERROR", "app handle not ready".to_string()))?;
+    match method {
+        "browser.window.open" => {
+            let profile = params["profileId"].as_str().unwrap_or("default").to_string();
+            let id = browser_tab::open_subwindow(app.clone(), profile).map_err(|e| ("NATIVE_ERROR", e))?;
+            Ok(json!({ "id": id }))
+        }
+        "browser.window.listProfiles" => Ok(json!({ "profiles": webview_control::list_profiles() })),
+        "browser.window.switchProfile" => {
+            let id = params["id"].as_str().ok_or(("NATIVE_ERROR", "missing id".to_string()))?.to_string();
+            let profile = params["profileId"].as_str().ok_or(("NATIVE_ERROR", "missing profileId".to_string()))?.to_string();
+            browser_tab::switch_subwindow_profile(app.clone(), id, profile).map_err(|e| ("NATIVE_ERROR", e))?;
+            Ok(json!({ "ok": true }))
+        }
         _ => Err(("UNSUPPORTED", format!("{method} not implemented on desktop"))),
     }
 }
@@ -716,6 +822,7 @@ fn main() {
         .invoke_handler(tauri::generate_handler![
             appwrap_invoke,
             browser_tab::browser_tab_create,
+            browser_tab::browser_tab_set_rect,
             browser_tab::browser_tab_set_mount,
             browser_tab::browser_tab_navigate,
             browser_tab::browser_tab_close,
@@ -767,14 +874,35 @@ fn main() {
                     // View ▸ Toggle DevTools (⌥⌘I). Opens/closes Tauri's devtools on the focused
                     // window; the handler no-ops in release unless APPWRAP_DEVTOOLS is set
                     // (devtools_enabled), matching the Safari-inspectable gate.
+                    // Reload App (⌘R) — reloads the shell's main webview (like Slack's ⌘R), handy after
+                    // a hot-reload hiccup or a stuck load.
+                    let reload_app = MenuItem::with_id(
+                        handle, "reload_app", "Reload App", true, Some("CmdOrCtrl+R"),
+                    )?;
                     let toggle_devtools = MenuItem::with_id(
                         handle, "toggle_devtools", "Toggle DevTools", true,
                         Some("Alt+CmdOrCtrl+I"),
                     )?;
-                    let view = Submenu::with_id_and_items(
-                        handle, "view_menu", "View", true, &[&toggle_devtools],
-                    )?;
-                    menu.append(&view)?;
+                    // Menu::default already installs a macOS "View" submenu — APPEND to it rather than
+                    // adding a SECOND "View" (which produced two View menus, with DevTools stranded in
+                    // the second one). Fall back to creating one only if the default lacks it.
+                    let existing_view = menu.items()?.into_iter().find_map(|it| {
+                        it.as_submenu()
+                            .filter(|s| s.text().map(|t| t == "View").unwrap_or(false))
+                            .cloned()
+                    });
+                    match existing_view {
+                        Some(view) => {
+                            view.append(&reload_app)?;
+                            view.append(&toggle_devtools)?;
+                        }
+                        None => {
+                            let view = Submenu::with_id_and_items(
+                                handle, "view_menu", "View", true, &[&reload_app, &toggle_devtools],
+                            )?;
+                            menu.append(&view)?;
+                        }
+                    }
                     Ok(menu)
                 }) {
                     Ok(menu) => {
@@ -786,11 +914,30 @@ fn main() {
                 }
                 app.on_menu_event(|app, event| {
                     match event.id().as_ref() {
-                        "browser_new_window" => {
-                            if let Err(e) = browser_tab::browser_subwindow_open(app.clone(), Some("default".to_string())) {
-                                eprintln!("[browser] open sub-window (menu) failed: {e}");
+                        "reload_app" => {
+                            // Reload the shell's main webview (⌘R). Full app reload — re-fetches the UI
+                            // (served or app://) from scratch, like Slack's ⌘R.
+                            if let Some(win) = app.get_webview_window("main") {
+                                // Tear down embedded browser panes FIRST: reload() never runs React's
+                                // unmount cleanup, so `browser.tab.close` is never called and the panes
+                                // orphan (leaked WKWebViews + visual mixing). Runs inline on the main
+                                // thread (on_menu_event is on main); the reloaded FE re-creates its tabs.
+                                browser_tab::close_all_embedded();
+                                let _ = win.eval("window.location.reload()");
                             }
                         }
+                        "browser_new_window" => {
+                            // MUST spawn off the main thread: on_menu_event runs on the main thread, and
+                            // browser_subwindow_open dispatches work back onto the main thread + blocks on
+                            // it — calling it inline here would deadlock the app (the classic sync-on-main
+                            // freeze). Spawn the async command onto the runtime so the main thread stays free.
+                            let app = app.clone();
+                            tauri::async_runtime::spawn(async move {
+                                if let Err(e) = browser_tab::browser_subwindow_open(app, Some("default".to_string())).await {
+                                    eprintln!("[browser] open sub-window (menu) failed: {e}");
+                                }
+                            });
+                        }
                         "toggle_devtools" => {
                             // Gate at runtime: inert in a release build unless APPWRAP_DEVTOOLS is set
                             // (same policy as Safari-inspectable); always on in debug.
@@ -857,6 +1004,11 @@ fn main() {
             let win_builder = tauri::WebviewWindowBuilder::new(app, "main", tauri::WebviewUrl::App("index.html".into()))
                 .title(shell().title.as_str())
                 .inner_size(shell().width, shell().height)
+                // wry installs a NATIVE OS drag-drop handler on the webview by default, which INTERCEPTS
+                // all drag events — so in-page HTML5 drag-and-drop (dragover/drop) never reaches the DOM
+                // (probe: dragstart fires but dragover never does). That silently breaks any web UI that
+                // relies on HTML5 DnD (e.g. flexlayout tab reorder/dock). Disable it so the page gets DnD.
+                .disable_drag_drop_handler()
                 .initialization_script(INIT_JS);
             // With state restore on, the plugin repositions/resizes AFTER creation — build hidden so
             // the restore lands before first paint (no visible jump), then show below.
@@ -872,11 +1024,28 @@ fn main() {
             #[cfg(target_os = "macos")]
             if let Some(window) = app.get_webview_window("main") {
                 let picker = shell().google_account_picker;
+                let app_for_sink = app.handle().clone();
                 window.with_webview(move |w| {
                     popup_mac::install(w.inner() as _, picker);
                     // Safari Web Inspector on the main Tauri window's WKWebView (debug always;
                     // release only under APPWRAP_DEVTOOLS). Runs on the main thread (with_webview).
                     unsafe { webview_control::set_inspectable(w.inner() as *mut _) };
+                    // Native bridge for SERVED (remote-origin) pages: Tauri command IPC is ACL-blocked
+                    // for remote origins, and ws/http/custom-scheme are mixed-content-blocked from https
+                    // — but a WKScriptMessageHandler works from ANY origin. Served pages reach native via
+                    // `webkit.messageHandlers.appwrapNative.postMessage(envelope)`, routed through the
+                    // same dispatch as the Tauri-IPC `appwrap_invoke` (off-thread + response delivery).
+                    let mtm = objc2::MainThreadMarker::new().expect("with_webview runs on main");
+                    let sink: webview_control::MessageSink = Box::new(move |envelope: String| {
+                        if let Some(win) = app_for_sink.get_webview_window("main") {
+                            appwrap_invoke(win, envelope);
+                        }
+                    });
+                    unsafe {
+                        webview_control::install_named_message_handler(
+                            w.inner() as *mut _, mtm, "appwrapNative", sink,
+                        );
+                    }
                 })?;
             }
             // Reveal after the state plugin's on_window_ready restore has applied (built hidden above).
@@ -889,6 +1058,14 @@ fn main() {
             // `attachTo` matches "main" run their `onWindow(ctx)`. No-op when no host is running.
             #[cfg(target_os = "macos")]
             plugin_host::on_window_created("main", "index.html");
+            // Re-open browser sub-windows that were open at last quit. MUST run off the main thread —
+            // open() marshals to the main thread via with_webview + blocks, so a synchronous call here
+            // (setup runs on the main thread) would deadlock (same class as the ⌘⇧N freeze fix).
+            #[cfg(target_os = "macos")]
+            {
+                let app_handle = app.handle().clone();
+                tauri::async_runtime::spawn(async move { browser_tab::restore_subwindows(app_handle); });
+            }
             // Local-server mode: boot the server child now (the window shows the bundled splash), then a
             // background thread polls its port and navigates the window to it — or, on timeout/spawn
             // failure, writes the reason into the splash. Absent `server` → the bundled dist just loads.
@@ -987,6 +1164,9 @@ fn main() {
                 // so persist geometry here — the window-state plugin's own save only fires on window
                 // CLOSE events, which those quit paths skip, so position/size wouldn't restore next run.
                 tauri::RunEvent::ExitRequested { .. } => {
+                    // Mark quitting BEFORE windows tear down, so sub-window teardown keeps (not prunes)
+                    // the restore snapshot — whatever's open at quit re-opens next launch.
+                    browser_tab::mark_quitting();
                     if shell().restore_window_state {
                         use tauri_plugin_window_state::{AppHandleExt, StateFlags};
                         let _ = app_handle.save_window_state(StateFlags::all());

package/src/cli.ts

@@ -137,6 +137,8 @@ interface NativeReqs {
   androidKotlin: boolean;        // any active module ships Kotlin native source
   androidManifestApp: string[];  // raw XML injected inside AndroidManifest <application>
   nativeSrc: string[];           // active modules' nativeSrc dir names (under runtime/modules-native/)
+  widgetAppGroup?: string;       // 'group.<appId>' when the `widget` module is active (App Group id
+                                 // shared by the app + its widget extension; templated into both)
 }
 
 function nativeReqs(cfg: AppwrapConfig): NativeReqs {
@@ -194,6 +196,9 @@ function nativeReqs(cfg: AppwrapConfig): NativeReqs {
     androidKotlin,
     androidManifestApp,
     nativeSrc,
+    // App Group for the widget extension ↔ app shared container. Derived from the app id so the module
+    // stays app-agnostic; templated into app.entitlements + the extension's entitlements/Swift.
+    widgetAppGroup: active.has('widget') ? `group.${cfg.id}` : undefined,
   };
 }
 
@@ -207,6 +212,7 @@ const OPTIONAL_GROUP_HANDLERS: Record<string, { file: string; fn: string }> = {
   tracking: { file: './handlers-tracking', fn: 'registerTrackingHandlers' },
   appleSignIn: { file: './handlers-apple-signin', fn: 'registerAppleSignInHandlers' },
   backgroundTask: { file: './handlers-background', fn: 'registerBackgroundTaskHandlers' },
+  widget: { file: './handlers-widget', fn: 'registerWidgetHandlers' },
 };
 
 /** Generate the two composition artifacts in the wrapper: the active capability list (drives the
@@ -266,6 +272,9 @@ function stampEntitlements(outDir: string, cfg: AppwrapConfig, req: NativeReqs):
   const file = join(iosDir, 'app.entitlements');
   const ent: Record<string, boolean | string | string[]> = { ...req.iosEntitlements, ...cfg.iosEntitlements };
   if (!!cfg.push?.enabled && cfg.push?.ios !== false) ent['aps-environment'] = cfg.push.apsEnvironment ?? 'development';
+  // Widget module → App Group on the MAIN app target (the extension's own entitlements file gets the
+  // same group via token substitution). Derived from the app id so no per-app config is needed.
+  if (req.widgetAppGroup) ent['com.apple.security.application-groups'] = [req.widgetAppGroup];
   const keys = Object.keys(ent);
   if (keys.length === 0) { rmSync(file, { force: true }); return; }
   const val = (v: boolean | string | string[]): string =>
@@ -306,6 +315,43 @@ function copyModuleNativeSrc(outDir: string, req: NativeReqs): void {
   }
 }
 
+/** Substitute build-time tokens in copied module native source (after copyModuleNativeSrc). Currently
+ * only `__APP_GROUP__` → the derived App Group id, applied to the widget extension's Swift/entitlements/
+ * plist so the module ships app-agnostic and the CLI stamps the app-specific group in. Idempotent (the
+ * source is re-copied verbatim each sync, then re-substituted). */
+function substituteModuleTokens(outDir: string, req: NativeReqs): void {
+  if (!req.widgetAppGroup) return;
+  const extRoot = join(outDir, 'App_Resources/iOS/extensions');
+  if (!existsSync(extRoot)) return;
+  const subst = (file: string) => {
+    const s = readFileSync(file, 'utf8');
+    if (!s.includes('__APP_GROUP__')) return;
+    writeFileSync(file, s.replaceAll('__APP_GROUP__', req.widgetAppGroup!));
+  };
+  const walk = (dir: string) => {
+    for (const e of readdirSync(dir, { withFileTypes: true })) {
+      const p = join(dir, e.name);
+      if (e.isDirectory()) walk(p);
+      else if (/\.(swift|entitlements|plist|json)$/.test(e.name)) subst(p);
+    }
+  };
+  walk(extRoot);
+  console.log(`  tokn ← __APP_GROUP__ = ${req.widgetAppGroup} (widget extension)`);
+}
+
+/** Hosts to register as Android App Links (autoVerify https intent-filters). Explicit
+ * `config.androidAppLinks` wins; otherwise derived from the iOS `associated-domains` `applinks:<host>`
+ * entries so a single universal-link declaration covers both platforms. */
+function androidAppLinkHosts(cfg: AppwrapConfig): string[] {
+  if (cfg.androidAppLinks) return cfg.androidAppLinks.filter(Boolean);
+  const ad = cfg.iosEntitlements?.['com.apple.developer.associated-domains'];
+  const arr = Array.isArray(ad) ? ad : [];
+  return arr
+    .filter((d): d is string => typeof d === 'string' && d.startsWith('applinks:'))
+    .map((d) => d.slice('applinks:'.length).split(/[?/]/)[0].trim())
+    .filter(Boolean);
+}
+
 /** Enable Kotlin in the NS Android build when an active module ships Kotlin native source. Injects
  * useKotlin/kotlinVersion into before-plugins.gradle's project.ext (re-stamped from template each run). */
 function stampKotlin(outDir: string, enable: boolean): void {
@@ -521,6 +567,14 @@ function stampIOSDisplayName(outDir: string, cfg: AppwrapConfig, req: NativeReqs
     const items = cfg.queryUrlSchemes.map((s) => `    <string>${s}</string>`).join('\n');
     extras.push(`  <key>LSApplicationQueriesSchemes</key>\n  <array>\n${items}\n  </array>`);
   }
+  // Communication Notifications (iOS 15+): an app that holds the `usernotifications.communication`
+  // entitlement MUST also declare it supports donating these intents, or SpringBoard denies the
+  // communication API at runtime ("has entitlement but does not support donating [INSendMessageIntent]")
+  // and notifications fall back to a plain banner with the host app icon. native-kit's notification
+  // identity path (INSendMessageIntent → communication notification) needs this to render the sender.
+  if (cfg.iosEntitlements?.['com.apple.developer.usernotifications.communication']) {
+    extras.push(`  <key>NSUserActivityTypes</key>\n  <array>\n    <string>INSendMessageIntent</string>\n    <string>INStartCallIntent</string>\n  </array>`);
+  }
   if (extras.length) {
     src = src.replace(
       /<\/dict>\s*<\/plist>\s*$/,
@@ -1120,6 +1174,25 @@ function stampAndroidAppName(outDir: string, cfg: AppwrapConfig, req: NativeReqs
         `<!-- appwrap:oauth-redirect-schemes -->${body}<!-- /appwrap:oauth-redirect-schemes -->`
       );
     }
+    // App Links: an `android:autoVerify="true"` VIEW intent-filter per https host, so `https://<host>/…`
+    // links open the app directly (Android's Universal-Links equivalent). Hosts come from
+    // config.androidAppLinks or, unset, the iOS associated-domains applinks (one declaration → both
+    // platforms). The host must ALSO serve /.well-known/assetlinks.json (package + signing SHA-256) for
+    // Android to verify the association. Idempotent marker → re-sync-safe.
+    {
+      const hosts = androidAppLinkHosts(cfg);
+      const filter = (h: string) =>
+        `<intent-filter android:autoVerify="true">\n\t\t\t<action android:name="android.intent.action.VIEW" />\n` +
+        `\t\t\t<category android:name="android.intent.category.DEFAULT" />\n` +
+        `\t\t\t<category android:name="android.intent.category.BROWSABLE" />\n` +
+        `\t\t\t<data android:scheme="https" android:host="${esc(h)}" />\n\t\t</intent-filter>`;
+      const body = hosts.length ? '\n\t\t' + hosts.map(filter).join('\n\t\t') + '\n\t\t' : '';
+      src = src.replace(
+        /<!-- appwrap:app-links -->[\s\S]*?<!-- \/appwrap:app-links -->/,
+        `<!-- appwrap:app-links -->${body}<!-- /appwrap:app-links -->`
+      );
+      if (hosts.length) console.log(`  alnk ← Android App Links: ${hosts.join(', ')}`);
+    }
     // Supported orientation (config > manifest) on the main <activity>. Skipped when unset → keep
     // the template default (free); 'any' removes the attribute, so re-sync stays idempotent.
     if (cfg.orientation) src = stampAndroidOrientation(src, androidScreenOrientation(cfg.orientation));
@@ -1640,6 +1713,7 @@ function regenerateCore(cwd: string, outDir: string, cfg: AppwrapConfig, opts: {
   stampKotlin(outDir, req.androidKotlin);
   generateModuleArtifacts(outDir, req);
   copyModuleNativeSrc(outDir, req); // module-owned native source (e.g. health's Kotlin shim)
+  substituteModuleTokens(outDir, req); // stamp __APP_GROUP__ etc. into the copied extension source
   stampLaunchScreen(outDir, cfg);
   stampStoreKit(cwd, outDir, cfg);
   stampPush(cwd, outDir, cfg);

package/src/config.ts

@@ -128,6 +128,13 @@ export interface AppwrapConfig {
   };
   /** Custom URL scheme for deep links (e.g. "hellowrap" → hellowrap://...). */
   urlScheme?: string;
+  /** Android App Links: https hosts whose `https://<host>/...` links open the app directly (the
+   * Android equivalent of iOS Universal Links / associated-domains `applinks:`). Each host gets an
+   * `android:autoVerify="true"` VIEW intent-filter in the manifest. Verification ALSO requires the host
+   * to serve `/.well-known/assetlinks.json` listing the app's package + signing-cert SHA-256.
+   * When OMITTED, the hosts are DERIVED from the iOS `associated-domains` `applinks:<host>` entries in
+   * `iosEntitlements` — so one universal-link declaration covers both platforms. `[]` disables it. */
+  androidAppLinks?: string[];
   /** Custom URL schemes `kit.app.canOpenUrl()` may probe (e.g. `['whatsapp', 'tg']`) — covers BOTH
    * platforms with a single declaration. Since iOS 9 / Android API 30+ a probe of an undeclared custom
    * scheme returns false for privacy. These stamp into iOS Info.plist `LSApplicationQueriesSchemes` AND
@@ -328,7 +335,7 @@ export function defineConfig(config: AppwrapConfig): AppwrapConfig {
  * with no error, then an App Store rejection). A loud warning turns that silent no-op into a signal.
  */
 export const KNOWN_CONFIG_KEYS: ReadonlySet<string> = new Set([
-  'appBoundDomains', 'backendOrigin', 'backgroundAudio', 'backgroundColor', 'backgroundTasks', 'buildNumber', 'debug',
+  'androidAppLinks', 'appBoundDomains', 'backendOrigin', 'backgroundAudio', 'backgroundColor', 'backgroundTasks', 'buildNumber', 'debug',
   'debugLog', 'desktop', 'devMenu', 'edgeToEdge', 'entry', 'icon', 'id', 'iosKeyboardExtraLift', 'loader', 'modules', 'name',
   'iosEntitlements', 'neutralizeServiceWorker', 'oauthRedirectSchemes', 'openNewWindowsInBrowser', 'orientation', 'overrides', 'permissions',
   'plugins', 'push', 'pwaDist', 'queryPackages', 'queryUrlSchemes', 'serverUrl', 'signing', 'signingProfiles', 'statusBarStyle',

package/src/plugin/host.ts

@@ -27,6 +27,11 @@ export function matchScope(def: PluginDef, override: string | undefined, win: Wi
   if (typeof scope === 'function') return scope(win);
   if (scope === 'all') return true;
   if (scope === 'main') return win.id === 'main';
+  // 'browser' is a CATEGORY, not a literal id: the browser sub-windows (browser_tab.rs) whose
+  // controlled webview is labeled `<win_id>-view`. This is the safe default for remote-control.
+  // (Phase A does NOT yet emit window-created for sub-windows — browser_tab keeps its core bridging —
+  // so this matches once that emission lands in Phase B, or any window explicitly labeled `*-view`.)
+  if (scope === 'browser') return win.id.endsWith('-view');
   return scope === win.id;
 }
 

package/src/plugin/types.ts

@@ -21,6 +21,7 @@ export const WINDOW_CTX_VERSION = 1 as const;
  * form is code-only (it lives in the host process). */
 export type WindowScope =
   | 'main' // the app's main window
+  | 'browser' // browser sub-windows (the controlled webview labeled `<win_id>-view`) — remote-control's default
   | 'all' // every window (incl. sub-windows)
   | string // an explicit window label / id
   | ((win: WindowIdentity) => boolean);