@livx.cc/appwrap 0.50.1 → 0.51.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.50.1",
+  "version": "0.51.0",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime/app/shell/env-banner.ts

@@ -194,10 +194,32 @@ function hideIOSBanner(): void {
 }
 
 // ── Android ──────────────────────────────────────────────────────────
+/**
+ * Cold-relaunch safe entry: on a relaunch (main-page onPageLoaded) the Activity's window is not yet
+ * attached, so `foregroundActivity` can be null AND `getRootWindowInsets()` returns null — mounting
+ * inline then lands the pill INSIDE the nav-bar zone (bottomMargin computed off a 0 inset) where it's
+ * occluded by the home affordance and reads as "the banner disappeared". So: wait for an activity, then
+ * defer the actual mount to `decorView.post` (runs after attach + first layout on the UI thread), when
+ * insets are real. In-session callers (refreshEnvBanner) hit the same path — a one-frame post is harmless.
+ */
+let androidMountRetries = 0; // bounds the boot "activity not ready" retry so it can't spin forever
+
 function showAndroidBanner(): void {
   if (androidView) return;
   const activity = Application.android.foregroundActivity || Application.android.startActivity;
-  if (!activity) return;
+  if (!activity) {
+    if (androidMountRetries++ < 20) setTimeout(() => runOnAndroidUi(showAndroidBanner), 100); // boot: activity not ready — retry, bounded (~2s)
+    return;
+  }
+  androidMountRetries = 0;
+  activity.getWindow().getDecorView().post(new java.lang.Runnable({ run() { mountAndroidBanner(activity); } }));
+}
+
+function mountAndroidBanner(activity: android.app.Activity): void {
+  if (androidView) return; // a second deferred mount raced in — keep the first
+  // Re-gate at the final step: the override may have been cleared (reset / switch to default / hideEnvBanner)
+  // during the deferred post or the boot retry window — don't mount a stale banner the caller no longer wants.
+  if (!isEnvSwitcherEnabled() || !isNonDefaultOverride()) return;
   const density = activity.getResources().getDisplayMetrics().density;
   const padH = Math.round(14 * density), padV = Math.round(6 * density);
 
@@ -254,13 +276,15 @@ function showAndroidBanner(): void {
   armShrink();
 }
 
-/** Bottom system-inset (gesture/nav bar) in px; 0 best-effort if unavailable. */
+/** Bottom system-inset (gesture/nav bar) in px. Falls back to ~48dp (a typical nav-bar height) rather
+ * than 0 if the read fails, so the pill never lands INSIDE the nav bar on a device/timing where insets
+ * are unavailable — being a touch too high is harmless; being occluded reads as "missing". */
 function androidBottomInsetPx(activity: android.app.Activity): number {
   try {
     const wi = activity.getWindow().getDecorView().getRootWindowInsets();
     if (wi) return wi.getSystemWindowInsetBottom();
-  } catch (e) { /* pre-attach / older API — fall back to the base margin */ }
-  return 0;
+  } catch (e) { /* pre-attach / older API — fall back below */ }
+  return Math.round(48 * activity.getResources().getDisplayMetrics().density);
 }
 
 function renderAndroid(): void {

package/runtime/app/shell/env-switcher.ts

@@ -143,24 +143,26 @@ export async function showEnvSwitcher(): Promise<void> {
   }
 }
 
-// ── Deep-link entry (`<scheme>://env?url=<encoded-url>`) ──────────────────────────────────────────
-// A PR-preview link can be SHARED and auto-open the app on that env. Same security model as "Other":
-// the decoded target must pass `isUrlAllowed` (anchored allowPattern, default-deny) and a confirm
-// prompt, then applies via the EXACT SAME `applySwitch` path as a manual switch. events.ts owns the
-// WebView-ready timing (warm: now; cold launch: buffered, replayed after the PWA handshake).
+// ── Deep-link entry (`<scheme>://env?to=<name>` | `?url=<encoded-url>`) ────────────────────────────
+// A shared link can auto-open the app on a given env. Two additive forms: `?to=<name>` switches to a
+// CONFIGURED preset by label (TRUSTED — bypasses the allowlist, like the manual switcher's presets);
+// `?url=<encoded>` is a free-form target still gated by `isUrlAllowed` (anchored allowPattern, default-
+// deny). Both go through a confirm prompt and apply via the EXACT SAME `applySwitch` path as a manual
+// switch. events.ts owns the WebView-ready timing (warm: now; cold launch: buffered, replayed after
+// the PWA handshake).
 
 export type EnvDeepLinkDecision =
   | { action: 'switch'; url: string }
   | { action: 'rejected'; url: string }
   | { action: 'ignored' };
 
-/** Decode the `url` query param from a `<scheme>://env?url=<encoded>` link. Null if absent/undecodable. */
-function parseEnvTargetUrl(link: string): string | null {
+/** Decode a query param by name from a `<scheme>://env?…` link. Null if absent/empty/undecodable. */
+function parseQueryParam(link: string, name: string): string | null {
   const q = String(link || '').indexOf('?');
   if (q < 0) return null;
   for (const part of link.slice(q + 1).split('&')) {
     const eq = part.indexOf('=');
-    if ((eq < 0 ? part : part.slice(0, eq)) !== 'url') continue;
+    if ((eq < 0 ? part : part.slice(0, eq)) !== name) continue;
     try {
       const decoded = decodeURIComponent((eq < 0 ? '' : part.slice(eq + 1)).replace(/\+/g, '%20')).trim();
       return decoded || null;
@@ -171,6 +173,19 @@ function parseEnvTargetUrl(link: string): string | null {
   return null;
 }
 
+/** Decode the `url` query param from a `<scheme>://env?url=<encoded>` link. Null if absent/undecodable. */
+function parseEnvTargetUrl(link: string): string | null {
+  return parseQueryParam(link, 'url');
+}
+
+/** Resolve a `?to=`/`?env=` preset NAME against `envs` by label (case-insensitive). Null if no name given. */
+function resolvePresetByName(link: string): { name: string; preset: { label: string; url: string } | undefined } | null {
+  const name = parseQueryParam(link, 'to') ?? parseQueryParam(link, 'env');
+  if (name === null) return null;
+  const preset = (SHELL_CONFIG.envSwitcher?.envs ?? []).find((e) => e.label.toLowerCase() === name.toLowerCase());
+  return { name, preset };
+}
+
 /** Structurally an env-switch deep link (`<scheme>://env…`) AND the switcher is enabled — the signal
  * events.ts uses to CONSUME the link (never forward an env link to the PWA). Inert (false) when the
  * feature is disabled/absent, so such a link simply falls through to the normal PWA deep-link path. */
@@ -179,14 +194,26 @@ export function isEnvDeepLink(link: string): boolean {
 }
 
 /**
- * PURE decision for an inbound `<scheme>://env?url=…` deep link — no dialogs, no side effects (unit-
- * testable, mirrors env-switcher-security.test.ts). SECURITY: the decoded target MUST pass the SAME
- * `isUrlAllowed` gate as the "Other" custom URL (anchored allowPattern, default-deny). Disabled feature
- * / non-env link / malformed (no decodable `url`) → `ignored` (silently dropped); target present but not
- * allowlisted → `rejected` (NEVER switch); allowlisted → `switch`.
+ * PURE decision for an inbound `<scheme>://env?…` deep link — no dialogs, no side effects (unit-testable,
+ * mirrors env-deeplink-security.test.ts). Two additive forms:
+ *
+ *  • `?to=<name>` (alias `?env=<name>`) — switch to a CONFIGURED preset by label, case-insensitive. A
+ *    resolved preset is TRUSTED and BYPASSES the allowlist (it's a declared env, exactly like the manual
+ *    switcher trusts its presets and only allowlists free-form "Other"). A name matching NO preset →
+ *    `rejected` (NEVER switch, NEVER fall through to `?url=`). `to` WINS when both `to`/`env` present, and
+ *    takes PRECEDENCE over `?url=` when both are present.
+ *  • `?url=<encoded>` — free-form target, allowlist-GATED: MUST pass the SAME `isUrlAllowed` gate as the
+ *    "Other" custom URL (anchored allowPattern, default-deny). Allowlisted → `switch`; else → `rejected`.
+ *
+ * Disabled feature / non-env link / neither param present (or malformed/undecodable) → `ignored`.
  */
 export function decideEnvDeepLink(link: string): EnvDeepLinkDecision {
   if (!isEnvSwitcherEnabled() || hostOf(link) !== 'env') return { action: 'ignored' };
+  // Preset-by-name takes precedence and bypasses the allowlist (trusted, configured env).
+  const named = resolvePresetByName(link);
+  if (named) {
+    return named.preset ? { action: 'switch', url: named.preset.url } : { action: 'rejected', url: named.name };
+  }
   const target = parseEnvTargetUrl(link);
   if (!target) return { action: 'ignored' };
   if (!isUrlAllowed(target)) return { action: 'rejected', url: target };