@livx.cc/appwrap 0.55.0 → 0.56.0

package/runtime-desktop/src-tauri/src/browser_tab.rs

@@ -1,804 +0,0 @@
-// browser_tab — Tauri commands for an EMBEDDED, tear-off/dock-able browser tab (project "browser-tab"
-// Phase 3). Thin front-end-facing wrapper over `webview_control::embedded::Controller`: the same live
-// WKWebView (page + WKWebsiteDataStore session + bridgeShim) is mounted `ChildOf` a host pane NSView
-// and torn off / docked with `set_mount`.
-//
-// R2 (agent-drive, DRY): the tab is created in the crate-level registry keyed by `id` (its label), so
-// the control-channel adapter (`bridge_mac.rs`) — and thus the mcp-desktop-browser MCP — can drive
-// this SAME embedded tab (navigate/eval/screenshot/close) by that id, with NO new TS<->Rust binding.
-//
-// Landmine (a): the pane NSView* is fetched + the webview mounted on the MAIN THREAD, AFTER the pane
-// container has non-zero bounds (we create the container at the caller-supplied paneRect), else blank.
-#[cfg(target_os = "macos")]
-mod imp {
-    use std::collections::HashMap;
-    use std::ffi::c_void;
-    use std::path::PathBuf;
-    use std::sync::atomic::{AtomicBool, Ordering};
-    use std::sync::mpsc::channel;
-    use std::sync::{Mutex, OnceLock};
-    use std::time::{Duration, SystemTime, UNIX_EPOCH};
-
-    use objc2::rc::Retained;
-    use objc2::{MainThreadMarker, MainThreadOnly};
-    use objc2_app_kit::{NSAutoresizingMaskOptions, NSView, NSWindow, NSWindowStyleMask};
-    use objc2_foundation::{NSPoint, NSRect, NSSize};
-    use objc2_web_kit::WKWebView;
-    use serde::Deserialize;
-    use tauri::{Manager, WebviewUrl, WebviewWindowBuilder};
-
-    use webview_control::embedded::Controller;
-    use webview_control::{CreateSpec, Mount, ViewHandle};
-
-    /// Fixed height (points) of the sub-window chrome strip (‹ › ⟳ + address bar + profile▾). The
-    /// controlled WKWebView pane is pinned BELOW this within the sub-window's contentView.
-    pub const CHROME_H: f64 = 44.0;
-
-    /// Autoresizing mask keeping the controlled-webview container pinned below the chrome bar while it
-    /// tracks window resize: both margins fixed (44pt top gap, 0 bottom), width+height flexible.
-    fn container_mask() -> NSAutoresizingMaskOptions {
-        NSAutoresizingMaskOptions(
-            NSAutoresizingMaskOptions::ViewWidthSizable.0 | NSAutoresizingMaskOptions::ViewHeightSizable.0,
-        )
-    }
-
-    /// Percent-encode a string for safe use as a URL hash-fragment param value (RFC 3986 unreserved
-    /// stay literal; everything else → %XX). URLSearchParams on the chrome side decodes it back.
-    fn hash_encode(s: &str) -> String {
-        let mut out = String::new();
-        for b in s.bytes() {
-            match b {
-                b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => out.push(b as char),
-                _ => out.push_str(&format!("%{b:02X}")),
-            }
-        }
-        out
-    }
-
-    /// A unique sub-window id / bridge tab label.
-    fn new_subwin_id() -> String {
-        let ms = SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_millis()).unwrap_or(0);
-        format!("subwin-{ms}")
-    }
-
-    /// Web-DOM pane rect the front-end reserves (top-left origin, CSS px == points here since the
-    /// shell runs at the window's backing scale). We flip Y to AppKit's bottom-left origin at mount.
-    #[derive(Deserialize, Clone, Copy)]
-    pub struct PaneRect {
-        pub x: f64,
-        pub y: f64,
-        pub width: f64,
-        pub height: f64,
-    }
-
-    // id -> host pane container NSView* (as usize). The container is retained by being a subview of
-    // the window contentView; we hold only its pointer to reposition / reparent / remove it. Access
-    // is main-thread only (all commands marshal via run_on_main_thread), the Mutex just satisfies the
-    // `static` Send/Sync bound for the raw pointer.
-    fn containers() -> &'static Mutex<HashMap<String, usize>> {
-        static CONTAINERS: OnceLock<Mutex<HashMap<String, usize>>> = OnceLock::new();
-        CONTAINERS.get_or_init(|| Mutex::new(HashMap::new()))
-    }
-
-    // ---- Session persistence: restore open browser sub-windows across app restarts ----
-    //
-    // We mirror the live set of open sub-windows (profile + last-navigated url, keyed by view id) to a
-    // JSON file. On the next launch `restore()` re-opens them. A user-closed window is dropped from the
-    // snapshot immediately; on app QUIT the snapshot is left intact (guarded by `APP_QUITTING`), so
-    // whatever was open comes back. Restore-fidelity is "last explicit navigation" (back/fwd history
-    // is not persisted) — deliberately lean.
-
-    /// Set on app exit so the per-window teardown (which fires on BOTH user-close and quit) leaves the
-    /// snapshot intact on quit but prunes it on a genuine user-close.
-    pub static APP_QUITTING: AtomicBool = AtomicBool::new(false);
-
-    fn sessions() -> &'static Mutex<HashMap<String, (String, String)>> {
-        static S: OnceLock<Mutex<HashMap<String, (String, String)>>> = OnceLock::new();
-        S.get_or_init(|| Mutex::new(HashMap::new()))
-    }
-
-    fn state_path() -> PathBuf {
-        PathBuf::from(std::env::var("HOME").unwrap_or_default())
-            .join("Library/Application Support/appwrap-desktop/browser-subwindows.json")
-    }
-
-    /// Write the current live session set (profile,url pairs) to disk. Best-effort (logs on failure).
-    fn persist() {
-        let list: Vec<(String, String)> = sessions().lock().unwrap().values().cloned().collect();
-        let path = state_path();
-        if let Some(dir) = path.parent() {
-            let _ = std::fs::create_dir_all(dir);
-        }
-        if let Err(e) = std::fs::write(&path, serde_json::to_string_pretty(&list).unwrap_or_default()) {
-            eprintln!("[browser] persist sub-window sessions failed: {e}");
-        }
-    }
-
-    fn record_open(id: &str, profile: &str, url: &str) {
-        sessions().lock().unwrap().insert(id.to_string(), (profile.to_string(), url.to_string()));
-        persist();
-    }
-    fn record_url(id: &str, url: &str) {
-        if let Some(e) = sessions().lock().unwrap().get_mut(id) {
-            e.1 = url.to_string();
-        } else {
-            return;
-        }
-        persist();
-    }
-    fn record_profile(id: &str, profile: &str) {
-        if let Some(e) = sessions().lock().unwrap().get_mut(id) {
-            e.0 = profile.to_string();
-            e.1 = "about:blank".to_string();
-        } else {
-            return;
-        }
-        persist();
-    }
-    /// Drop a session on genuine user-close; on app quit keep it so `restore()` re-opens it next launch.
-    fn record_close(id: &str) {
-        if APP_QUITTING.load(Ordering::SeqCst) {
-            return;
-        }
-        sessions().lock().unwrap().remove(id);
-        persist();
-    }
-
-    unsafe fn appkit_rect(content: &NSView, r: PaneRect) -> NSRect {
-        let ch = content.bounds().size.height;
-        NSRect::new(
-            NSPoint::new(r.x, ch - r.y - r.height),
-            NSSize::new(r.width, r.height),
-        )
-    }
-
-    /// Map a DOM rect `r` (SHELL WEBVIEW viewport coords, top-left origin) to an AppKit frame in the
-    /// container's superview (contentView) coordinate space. Two corrections vs a naive `content.bounds`
-    /// flip: (1) `fe_in_content` — the shell webview's own rect in contentView coords (handles the
-    /// webview being offset/nested); (2) `sa` — the webview's SAFE-AREA insets. On a full-size-content
-    /// macOS window WKWebView insets its web VISUAL VIEWPORT under the titlebar (e.g. innerHeight 897 in
-    /// a 929pt webview), so DOM y=0 sits `sa.top` px BELOW the webview's frame top. Without adding
-    /// `sa.top`/`sa.left` the pane rides exactly that inset too high, covering the FE chrome. `cv_h` is
-    /// the contentView height (for the single bottom-left-origin flip). Callers pass
-    /// `wk.convertRect_toView(wk.bounds(), Some(content))` and `wk.safeAreaInsets()`.
-    fn appkit_rect_in(cv_h: f64, fe_in_content: NSRect, sa_top: f64, sa_left: f64, r: PaneRect) -> NSRect {
-        // Shell webview's frame top, measured from the contentView TOP (top-left origin space).
-        let fe_top_from_cv_top = cv_h - (fe_in_content.origin.y + fe_in_content.size.height);
-        // Pane top-left from contentView top: webview offset + safe-area inset + DOM offset.
-        let x = fe_in_content.origin.x + sa_left + r.x;
-        let top_from_cv_top = fe_top_from_cv_top + sa_top + r.y;
-        // Single flip to AppKit bottom-left origin.
-        NSRect::new(
-            NSPoint::new(x, cv_h - top_from_cv_top - r.height),
-            NSSize::new(r.width, r.height),
-        )
-    }
-
-    /// The main window's contentView (parent of the shell WKWebView). Main-thread only.
-    unsafe fn content_view(win: &NSWindow) -> Retained<NSView> {
-        win.contentView().expect("main window has a contentView")
-    }
-
-    pub fn create(
-        app: tauri::AppHandle,
-        id: String,
-        url: String,
-        profile_id: String,
-        rect: PaneRect,
-    ) -> Result<(), String> {
-        let win = app.get_webview_window("main").ok_or("no main window")?;
-        // with_webview runs its closure on the AppKit main thread. Build the pane container at
-        // non-zero bounds FIRST (landmine a), then mount the webview ChildOf it — all on main.
-        let (tx, rx) = std::sync::mpsc::channel();
-        win.with_webview(move |w| {
-            let res = (|| -> Result<(), String> {
-                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
-                unsafe {
-                    // Idempotent: a fast unmount→remount (flexlayout re-render / StrictMode) can call
-                    // create for an id whose webview+container still exist. Tear the old one down first
-                    // so we never STACK duplicate WKWebViews for one tab (each is heavy — the prime
-                    // suspect for the runaway memory growth when panes churn).
-                    Controller::new().close(mtm, &id);
-                    if let Some(ptr) = containers().lock().unwrap().remove(&id) {
-                        (*(ptr as *mut NSView)).removeFromSuperview();
-                    }
-                    let wk = &*(w.inner() as *mut WKWebView);
-                    let ns_win = wk.window().ok_or("shell webview has no window")?;
-                    let content = content_view(&ns_win);
-                    let fe_in_content = wk.convertRect_toView(wk.bounds(), Some(&content));
-                    let sa = wk.safeAreaInsets();
-                    let cb = content.bounds().size;
-                    let frame = appkit_rect_in(cb.height, fe_in_content, sa.top, sa.left, rect);
-                    let container = NSView::initWithFrame(NSView::alloc(mtm), frame);
-                    content.addSubview(&container);
-                    let cptr = Retained::as_ptr(&container) as *mut c_void;
-                    let handle = ViewHandle::from_ptr(cptr);
-                    // R2 (agent-drive, DRY): wire the SAME bridge init-JS + live self-healing page sink
-                    // the sub-window path uses, so an embedded tab registers as a bod-browser tab
-                    // addressable by `id` over the control channel — thus drivable by mcp-desktop-browser.
-                    // Inert when the bridge feature is off (empty init-JS, None-safe sink); doesn't
-                    // affect mount/rect (init_js/sink only touch page registration, not layout).
-                    let (init_js, sink) = bridge_wiring(&id);
-                    let spec = CreateSpec {
-                        label: id.clone(),
-                        url: url.clone(),
-                        profile_id: profile_id.clone(),
-                        init_js,
-                        mount: Mount::ChildOf(handle),
-                    };
-                    Controller::new().create_webview(mtm, spec, sink)?;
-                    // contentView holds a strong ref via addSubview; store only the pointer.
-                    containers().lock().unwrap().insert(id.clone(), cptr as usize);
-                }
-                Ok(())
-            })();
-            let _ = tx.send(res);
-        })
-        .map_err(|e| e.to_string())?;
-        rx.recv().map_err(|e| e.to_string())?
-    }
-
-    /// Reposition an embedded tab's host pane container to `rect` (front-end DOM coords). The webview
-    /// is a fill-masked subview of the container, so moving/resizing the container carries the live
-    /// webview with it — no webview re-create, session intact. Recomputes `appkit_rect` (Y-flip vs the
-    /// current content-view height) EXACTLY as `create()` does, so a layout move/resize/scroll on the
-    /// FE side keeps the native pane glued to the reserved DOM rect. Runs on the main thread.
-    pub fn set_rect(app: tauri::AppHandle, id: String, rect: PaneRect) -> Result<(), String> {
-        let win = app.get_webview_window("main").ok_or("no main window")?;
-        let (tx, rx) = std::sync::mpsc::channel();
-        win.with_webview(move |w| {
-            let res = (|| -> Result<(), String> {
-                let _mtm = MainThreadMarker::new().ok_or("not main thread")?;
-                unsafe {
-                    let wk = &*(w.inner() as *mut WKWebView);
-                    let ns_win = wk.window().ok_or("shell webview has no window")?;
-                    let content = content_view(&ns_win);
-                    let fe_in_content = wk.convertRect_toView(wk.bounds(), Some(&content));
-                    let sa = wk.safeAreaInsets();
-                    let cb = content.bounds().size;
-                    let frame = appkit_rect_in(cb.height, fe_in_content, sa.top, sa.left, rect);
-                    let ptr = *containers().lock().unwrap().get(&id).ok_or("no pane for id")?;
-                    let container = &*(ptr as *mut NSView);
-                    container.setFrame(frame);
-                }
-                Ok(())
-            })();
-            let _ = tx.send(res);
-        })
-        .map_err(|e| e.to_string())?;
-        rx.recv().map_err(|e| e.to_string())?
-    }
-
-    pub fn set_mount(app: tauri::AppHandle, id: String, mode: String) -> Result<(), String> {
-        let (tx, rx) = std::sync::mpsc::channel();
-        let win = app.get_webview_window("main").ok_or("no main window")?;
-        win.run_on_main_thread(move || {
-            let res = (|| -> Result<(), String> {
-                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
-                let mount = match mode.as_str() {
-                    "toplevel" => Mount::TopLevel,
-                    "child" => {
-                        let ptr = *containers().lock().unwrap().get(&id).ok_or("no pane for id")?;
-                        unsafe { Mount::ChildOf(ViewHandle::from_ptr(ptr as *mut c_void)) }
-                    }
-                    other => return Err(format!("bad mount mode: {other}")),
-                };
-                if Controller::new().set_mount(mtm, &id, mount) {
-                    Ok(())
-                } else {
-                    Err(format!("no webview {id}"))
-                }
-            })();
-            let _ = tx.send(res);
-        })
-        .map_err(|e| e.to_string())?;
-        rx.recv().map_err(|e| e.to_string())?
-    }
-
-    pub fn navigate(app: tauri::AppHandle, id: String, url: String) -> Result<(), String> {
-        let (tx, rx) = std::sync::mpsc::channel();
-        let win = app.get_webview_window("main").ok_or("no main window")?;
-        let (id_c, url_c) = (id.clone(), url.clone());
-        win.run_on_main_thread(move || {
-            let res = (|| -> Result<(), String> {
-                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
-                Controller::new().navigate(mtm, &id, &url)
-            })();
-            let _ = tx.send(res);
-        })
-        .map_err(|e| e.to_string())?;
-        rx.recv().map_err(|e| e.to_string())??;
-        // Persist the last-navigated url for sub-window session restore (no-op for embedded tabs).
-        record_url(&id_c, &url_c);
-        Ok(())
-    }
-
-    pub fn close(app: tauri::AppHandle, id: String) -> Result<(), String> {
-        let (tx, rx) = std::sync::mpsc::channel();
-        let win = app.get_webview_window("main").ok_or("no main window")?;
-        win.run_on_main_thread(move || {
-            let res = (|| -> Result<(), String> {
-                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
-                Controller::new().close(mtm, &id);
-                if let Some(ptr) = containers().lock().unwrap().remove(&id) {
-                    unsafe {
-                        let container = &*(ptr as *mut NSView);
-                        container.removeFromSuperview();
-                    }
-                }
-                Ok(())
-            })();
-            let _ = tx.send(res);
-        })
-        .map_err(|e| e.to_string())?;
-        rx.recv().map_err(|e| e.to_string())?
-    }
-
-    /// Tear down EVERY embedded pane (main-window children). Called on ⌘R app reload: `reload()`
-    /// reloads the FE but never runs React's unmount cleanup, so `close` is never called and the panes
-    /// orphan — leaked WKWebViews + visual mixing during the reload gap. The reloaded FE re-creates its
-    /// tabs by the SAME id (`create` is idempotent), so this is a safe pre-reload wipe. Sub-window panes
-    /// (`*-view`) live in their own OS windows, untouched by a main-window reload, so they're skipped.
-    /// Main-thread only: the ⌘R menu handler already runs on main, so we run inline with its
-    /// `MainThreadMarker` — NOT via run_on_main_thread+recv, which would deadlock main against itself.
-    pub fn close_all_embedded(mtm: MainThreadMarker) {
-        let ids: Vec<String> = containers()
-            .lock()
-            .unwrap()
-            .keys()
-            .filter(|id| !id.ends_with("-view"))
-            .cloned()
-            .collect();
-        let c = Controller::new();
-        for id in &ids {
-            c.close(mtm, id);
-            if let Some(ptr) = containers().lock().unwrap().remove(id) {
-                unsafe { (*(ptr as *mut NSView)).removeFromSuperview() };
-            }
-        }
-    }
-
-    // ---- Sub-window: a standalone Tauri chrome window + a controlled WKWebView pane below the bar ----
-
-    /// Bridge init-JS + page sink for a sub-window webview, so it registers as a bod-browser tab when
-    /// the shim is running, and is inert-but-functional otherwise (empty init, no-op sink).
-    fn bridge_wiring(id: &str) -> (String, webview_control::MessageSink) {
-        let init_js = crate::bridge_mac::bridge_init_js(id).unwrap_or_default();
-        // Live self-healing sink: delivers to whichever shim is connected at send-time (None-safe),
-        // so a sub-window created while the shim is down becomes agent-exposed on a later connect.
-        let sink = crate::bridge_mac::bridge_sink();
-        (init_js, sink)
-    }
-
-    /// Mount a controlled WKWebView `ChildOf` a pane pinned below the chrome bar in `win`'s content
-    /// view, wiring the bridge for agent-exposure. Runs on the main thread (via `with_webview`).
-    fn mount_pane(win: &tauri::WebviewWindow, id: &str, profile_id: &str, url: &str) -> Result<(), String> {
-        let (tx, rx) = channel();
-        let (id, profile_id, url) = (id.to_string(), profile_id.to_string(), url.to_string());
-        win.with_webview(move |w| {
-            let res = (|| -> Result<(), String> {
-                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
-                unsafe {
-                    let wk = &*(w.inner() as *mut WKWebView);
-                    let ns_win = wk.window().ok_or("chrome webview has no window")?;
-                    // wry gives the sub-window a FULL-SIZE content view: contentView spans the whole
-                    // frame and the traffic-light titlebar overlays its top, hiding all but a sliver of
-                    // the HTML chrome bar. Drop the full-size-content style so contentView sits BELOW
-                    // the titlebar — the bar + pane then lay out in the visible region with no offset.
-                    ns_win.setStyleMask(NSWindowStyleMask(
-                        ns_win.styleMask().0 & !NSWindowStyleMask::FullSizeContentView.0,
-                    ));
-                    ns_win.setTitlebarAppearsTransparent(false);
-                    let content = content_view(&ns_win);
-                    let b = content.bounds().size;
-                    let rect = PaneRect { x: 0.0, y: CHROME_H, width: b.width, height: (b.height - CHROME_H).max(0.0) };
-                    let frame = appkit_rect(&content, rect);
-                    let container = NSView::initWithFrame(NSView::alloc(mtm), frame);
-                    container.setAutoresizingMask(container_mask());
-                    content.addSubview(&container);
-                    let cptr = Retained::as_ptr(&container) as *mut c_void;
-                    let handle = ViewHandle::from_ptr(cptr);
-                    let (init_js, sink) = bridge_wiring(&id);
-                    let spec = CreateSpec {
-                        label: id.clone(),
-                        url: url.clone(),
-                        profile_id: profile_id.clone(),
-                        init_js,
-                        mount: Mount::ChildOf(handle),
-                    };
-                    Controller::new().create_webview(mtm, spec, sink)?;
-                    containers().lock().unwrap().insert(id.clone(), cptr as usize);
-                }
-                Ok(())
-            })();
-            let _ = tx.send(res);
-        })
-        .map_err(|e| e.to_string())?;
-        rx.recv().map_err(|e| e.to_string())?
-    }
-
-    /// Clean up a sub-window's controlled webview + container. Main-thread only (called from the
-    /// window's Destroyed event, which fires on the main thread).
-    fn teardown(id: &str, mtm: MainThreadMarker) {
-        Controller::new().close(mtm, id);
-        if let Some(ptr) = containers().lock().unwrap().remove(id) {
-            unsafe { (*(ptr as *mut NSView)).removeFromSuperview() };
-        }
-        // Prune from the restore snapshot on a genuine user-close; kept intact on app quit.
-        record_close(id);
-    }
-
-    /// Open a sub-window: build the Tauri chrome window (loads the bundled chrome HTML asset, `?id=`
-    /// stamped so it binds to this webview), then mount the controlled webview below the chrome bar.
-    pub fn open(app: tauri::AppHandle, profile_id: String) -> Result<String, String> {
-        // Two DISTINCT labels: the Tauri chrome window (`win_id`) and the controlled WKWebView it
-        // hosts (`view_id = <win_id>-view`). Sharing one label double-listed it in `listWindows`
-        // (once from `app.webview_windows()`, once from the crate registry). The chrome HTML, its
-        // invokes, the container/registry key, the bridge `__BRIDGE_LABEL`, and what agents drive all
-        // key on `view_id`; only the OS window keeps `win_id`.
-        let win_id = new_subwin_id();
-        let view_id = format!("{win_id}-view");
-        // Pass the view id via a hash FRAGMENT, not a query — Tauri's `WebviewUrl::App` treats the
-        // string as a path and the `?…` breaks asset resolution (looks up a literal `…html?id=…` file
-        // → 404 → blank chrome). Fragments are never used for lookup and survive in `location.hash`.
-        // Also pass the profile so the chrome dropdown reflects the ACTUAL mounted profile (a restored
-        // window may be on a non-default profile). Percent-encode it — profile names are user-entered.
-        let chrome_url = format!(
-            "appwrap-browser-chrome.html#id={view_id}&profile={}",
-            hash_encode(&profile_id)
-        );
-        // Open at the main window's size (logical points) so the sub-window matches the app it spawned
-        // from, falling back to a sane default if the main window or its metrics are unavailable.
-        let (w, h) = app
-            .get_webview_window("main")
-            .and_then(|m| {
-                let sf = m.scale_factor().ok()?;
-                let sz = m.inner_size().ok()?;
-                Some((sz.width as f64 / sf, sz.height as f64 / sf))
-            })
-            .unwrap_or((1100.0, 800.0));
-        let win = WebviewWindowBuilder::new(&app, &win_id, WebviewUrl::App(chrome_url.into()))
-            .title("Browser")
-            .inner_size(w, h)
-            .build()
-            .map_err(|e| e.to_string())?;
-        // Tear the controlled webview down when the sub-window closes, so it doesn't linger as a
-        // registry zombie / stray bod-browser tab.
-        let idc = view_id.clone();
-        win.on_window_event(move |ev| {
-            if matches!(ev, tauri::WindowEvent::Destroyed) {
-                if let Some(mtm) = MainThreadMarker::new() {
-                    teardown(&idc, mtm);
-                }
-            }
-        });
-        mount_pane(&win, &view_id, &profile_id, "about:blank")?;
-        record_open(&view_id, &profile_id, "about:blank");
-        Ok(view_id)
-    }
-
-    /// Re-open the sub-windows that were open at last quit (profile + last-navigated url). Best-effort:
-    /// a failed re-open is logged and skipped. Called once on app startup.
-    pub fn restore(app: tauri::AppHandle) {
-        let saved: Vec<(String, String)> = std::fs::read_to_string(state_path())
-            .ok()
-            .and_then(|s| serde_json::from_str(&s).ok())
-            .unwrap_or_default();
-        for (profile, url) in saved {
-            match open(app.clone(), profile) {
-                Ok(id) => {
-                    if !url.is_empty() && url != "about:blank" {
-                        if let Err(e) = navigate(app.clone(), id, url) {
-                            eprintln!("[browser] restore navigate failed: {e}");
-                        }
-                    }
-                }
-                Err(e) => eprintln!("[browser] restore open failed: {e}"),
-            }
-        }
-    }
-
-    /// Re-fire the `register` beacon on every open sub-window controlled webview. Called when the
-    /// shim (re)connects: their live sink can now deliver, but an already-loaded document won't
-    /// re-run its init-JS `register()`, so nudge each via the bridgeShim handler to re-post it.
-    /// Idempotent + inert when the bridge feature is off (no bridgeShim handler → the try/catch eats
-    /// it) and when there are no sub-windows.
-    pub fn reregister_all(app: &tauri::AppHandle) {
-        let ids: Vec<String> = containers().lock().unwrap().keys().cloned().collect();
-        if ids.is_empty() {
-            return;
-        }
-        let _ = app.run_on_main_thread(move || {
-            if let Some(mtm) = MainThreadMarker::new() {
-                let c = Controller::new();
-                for id in &ids {
-                    let js = "try{if(window.__BRIDGE_LABEL){webkit.messageHandlers.bridgeShim.postMessage(JSON.stringify({label:window.__BRIDGE_LABEL,type:'register',url:location.href,title:document.title}))}}catch(e){}".to_string();
-                    let _ = c.inject_script(mtm, id, &js);
-                }
-            }
-        });
-    }
-
-    /// Swap the sub-window's controlled webview to another profile: profile is immutable per-webview,
-    /// so close the current one (keeps the pane container) and recreate `ChildOf` the SAME container
-    /// with the new profile. The Tauri chrome window is untouched.
-    pub fn switch_profile(app: tauri::AppHandle, id: String, profile_id: String) -> Result<(), String> {
-        let win = app.get_webview_window("main").ok_or("no main window")?;
-        let (id_c, profile_c) = (id.clone(), profile_id.clone());
-        let (tx, rx) = channel();
-        win.run_on_main_thread(move || {
-            let res = (|| -> Result<(), String> {
-                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
-                let ptr = *containers().lock().unwrap().get(&id).ok_or("no pane for id")?;
-                Controller::new().close(mtm, &id);
-                unsafe {
-                    let handle = ViewHandle::from_ptr(ptr as *mut c_void);
-                    let (init_js, sink) = bridge_wiring(&id);
-                    let spec = CreateSpec {
-                        label: id.clone(),
-                        url: "about:blank".to_string(),
-                        profile_id: profile_id.clone(),
-                        init_js,
-                        mount: Mount::ChildOf(handle),
-                    };
-                    Controller::new().create_webview(mtm, spec, sink)?;
-                }
-                Ok(())
-            })();
-            let _ = tx.send(res);
-        })
-        .map_err(|e| e.to_string())?;
-        rx.recv().map_err(|e| e.to_string())??;
-        // Persist the new profile (resets the restored url to about:blank) for session restore.
-        record_profile(&id_c, &profile_c);
-        Ok(())
-    }
-
-    /// Route a nav op (`back`/`forward`/`reload`) to the controlled webview `id` on the main thread.
-    pub fn nav_op(app: tauri::AppHandle, id: String, op: &'static str) -> Result<(), String> {
-        let win = app.get_webview_window("main").ok_or("no main window")?;
-        let (tx, rx) = channel();
-        win.run_on_main_thread(move || {
-            let res = (|| -> Result<(), String> {
-                let mtm = MainThreadMarker::new().ok_or("not main thread")?;
-                let c = Controller::new();
-                match op {
-                    "back" => c.go_back(mtm, &id),
-                    "forward" => c.go_forward(mtm, &id),
-                    "reload" => c.reload(mtm, &id),
-                    other => Err(format!("bad nav op: {other}")),
-                }
-            })();
-            let _ = tx.send(res);
-        })
-        .map_err(|e| e.to_string())?;
-        rx.recv().map_err(|e| e.to_string())?
-    }
-
-    /// Read the controlled webview `id`'s current `{href,title}` as a JSON string (for the address bar).
-    pub fn current_url(app: tauri::AppHandle, id: String) -> Result<String, String> {
-        let win = app.get_webview_window("main").ok_or("no main window")?;
-        let (tx, rx) = channel();
-        win.run_on_main_thread(move || {
-            let mtm = match MainThreadMarker::new() {
-                Some(m) => m,
-                None => { let _ = tx.send(Err("not main thread".to_string())); return; }
-            };
-            Controller::new().eval_async(
-                mtm,
-                &id,
-                "return JSON.stringify({href:location.href,title:document.title});".to_string(),
-                move |r| { let _ = tx.send(r); },
-            );
-        })
-        .map_err(|e| e.to_string())?;
-        // Short timeout: this is a 1s address-bar poll; if the webview is mid-teardown the eval never
-        // resolves, so cap the wait low rather than blocking on a dying window.
-        rx.recv_timeout(Duration::from_millis(1500)).map_err(|e| e.to_string())?
-    }
-
-    /// CSP-immune eval of `js` (a function body that `return`s a value) into the controlled webview
-    /// `id`. Returns the raw JS return value as a string ("null" for non-string/undefined returns —
-    /// callers that need structured data should `return JSON.stringify(...)`). Powers the agent's
-    /// read-page / click / type / scroll (all injected JS) over the SAME embedded WKWebView.
-    pub fn eval(app: tauri::AppHandle, id: String, js: String) -> Result<String, String> {
-        let win = app.get_webview_window("main").ok_or("no main window")?;
-        let (tx, rx) = channel();
-        win.run_on_main_thread(move || {
-            let mtm = match MainThreadMarker::new() {
-                Some(m) => m,
-                None => { let _ = tx.send(Err("not main thread".to_string())); return; }
-            };
-            Controller::new().eval_async(mtm, &id, js, move |r| { let _ = tx.send(r); });
-        })
-        .map_err(|e| e.to_string())?;
-        // Longer than the address-bar poll: page reads/clicks can await layout/network.
-        rx.recv_timeout(Duration::from_secs(10)).map_err(|e| e.to_string())?
-    }
-}
-
-#[cfg(target_os = "macos")]
-#[tauri::command]
-pub async fn browser_tab_create(
-    app: tauri::AppHandle,
-    id: String,
-    url: String,
-    profile_id: String,
-    rect: imp::PaneRect,
-) -> Result<String, String> {
-    imp::create(app, id.clone(), url, profile_id, rect).map(|_| id)
-}
-
-#[cfg(target_os = "macos")]
-#[tauri::command]
-pub async fn browser_tab_set_rect(app: tauri::AppHandle, id: String, rect: imp::PaneRect) -> Result<(), String> {
-    imp::set_rect(app, id, rect)
-}
-
-#[cfg(target_os = "macos")]
-#[tauri::command]
-pub async fn browser_tab_set_mount(app: tauri::AppHandle, id: String, mode: String) -> Result<(), String> {
-    imp::set_mount(app, id, mode)
-}
-
-#[cfg(target_os = "macos")]
-#[tauri::command]
-pub async fn browser_tab_navigate(app: tauri::AppHandle, id: String, url: String) -> Result<(), String> {
-    imp::navigate(app, id, url)
-}
-
-#[cfg(target_os = "macos")]
-#[tauri::command]
-pub async fn browser_tab_close(app: tauri::AppHandle, id: String) -> Result<(), String> {
-    imp::close(app, id)
-}
-
-#[cfg(target_os = "macos")]
-#[tauri::command]
-pub async fn browser_subwindow_open(app: tauri::AppHandle, profile_id: Option<String>) -> Result<String, String> {
-    imp::open(app, profile_id.unwrap_or_else(|| "default".to_string()))
-}
-
-#[cfg(target_os = "macos")]
-#[tauri::command]
-pub async fn browser_subwindow_switch_profile(app: tauri::AppHandle, id: String, profile_id: String) -> Result<(), String> {
-    imp::switch_profile(app, id, profile_id)
-}
-
-#[cfg(target_os = "macos")]
-#[tauri::command]
-pub async fn browser_tab_back(app: tauri::AppHandle, id: String) -> Result<(), String> {
-    imp::nav_op(app, id, "back")
-}
-
-#[cfg(target_os = "macos")]
-#[tauri::command]
-pub async fn browser_tab_forward(app: tauri::AppHandle, id: String) -> Result<(), String> {
-    imp::nav_op(app, id, "forward")
-}
-
-#[cfg(target_os = "macos")]
-#[tauri::command]
-pub async fn browser_tab_reload(app: tauri::AppHandle, id: String) -> Result<(), String> {
-    imp::nav_op(app, id, "reload")
-}
-
-#[cfg(target_os = "macos")]
-#[tauri::command]
-pub async fn browser_tab_current_url(app: tauri::AppHandle, id: String) -> Result<String, String> {
-    imp::current_url(app, id)
-}
-
-#[cfg(target_os = "macos")]
-#[tauri::command]
-pub async fn browser_list_profiles() -> Result<Vec<String>, String> {
-    Ok(webview_control::list_profiles())
-}
-
-/// Nudge every open browser sub-window to re-post its `register` beacon (called by the bridge control
-/// channel when a shim (re)connects, so pre-existing sub-windows self-heal into agent-exposure).
-#[cfg(target_os = "macos")]
-pub fn reregister_subwindows(app: &tauri::AppHandle) {
-    imp::reregister_all(app);
-}
-
-// ---- Bridge entry points (served-PWA path via `browser.window.*`, distinct from the Tauri commands
-// which only reach app://-served content). Sync, callable from the appwrap bridge worker thread. ----
-
-/// Open an app-owned browser sub-window; returns its view id. Used by the `browser.window.open` bridge
-/// method so a server-loaded PWA (no injected `__TAURI__`) can spawn one.
-#[cfg(target_os = "macos")]
-pub fn open_subwindow(app: tauri::AppHandle, profile_id: String) -> Result<String, String> {
-    imp::open(app, profile_id)
-}
-
-/// Switch a sub-window to another profile (creating+persisting the profile on first use).
-#[cfg(target_os = "macos")]
-pub fn switch_subwindow_profile(app: tauri::AppHandle, id: String, profile_id: String) -> Result<(), String> {
-    imp::switch_profile(app, id, profile_id)
-}
-
-// ---- Bridge entry points for EMBEDDED tabs (served-PWA path via `browser.tab.*`). Sync, callable
-// from the appwrap bridge worker thread; each marshals to the main thread itself. `rect` arrives as
-// JSON from the wire (kept as `Value` here so the `PaneRect` shape stays private to `imp`). ----
-
-/// Create an embedded browser tab `ChildOf` a front-end-reserved pane; returns its id.
-#[cfg(target_os = "macos")]
-pub fn tab_create(
-    app: tauri::AppHandle,
-    id: String,
-    url: String,
-    profile_id: String,
-    rect: serde_json::Value,
-) -> Result<String, String> {
-    let rect: imp::PaneRect = serde_json::from_value(rect).map_err(|e| format!("bad rect: {e}"))?;
-    imp::create(app, id.clone(), url, profile_id, rect).map(|_| id)
-}
-
-/// Reposition an embedded tab's pane container to a new front-end DOM rect.
-#[cfg(target_os = "macos")]
-pub fn tab_set_rect(app: tauri::AppHandle, id: String, rect: serde_json::Value) -> Result<(), String> {
-    let rect: imp::PaneRect = serde_json::from_value(rect).map_err(|e| format!("bad rect: {e}"))?;
-    imp::set_rect(app, id, rect)
-}
-
-/// Navigate an embedded tab to `url`.
-#[cfg(target_os = "macos")]
-pub fn tab_navigate(app: tauri::AppHandle, id: String, url: String) -> Result<(), String> {
-    imp::navigate(app, id, url)
-}
-
-/// Tear-off (`toplevel`) / dock (`child`) an embedded tab — same live webview, session intact.
-#[cfg(target_os = "macos")]
-pub fn tab_set_mount(app: tauri::AppHandle, id: String, mode: String) -> Result<(), String> {
-    imp::set_mount(app, id, mode)
-}
-
-/// Close + drop an embedded tab and remove its pane container.
-#[cfg(target_os = "macos")]
-pub fn tab_close(app: tauri::AppHandle, id: String) -> Result<(), String> {
-    imp::close(app, id)
-}
-
-/// Tear down every embedded browser pane before a ⌘R app reload. Main-thread only — the ⌘R menu
-/// handler runs on main, so we grab the `MainThreadMarker` inline (no marshalling → no deadlock).
-/// No-op off the main thread. See `imp::close_all_embedded`.
-#[cfg(target_os = "macos")]
-pub fn close_all_embedded() {
-    if let Some(mtm) = objc2::MainThreadMarker::new() {
-        imp::close_all_embedded(mtm);
-    }
-}
-
-/// Route a history/reload op (`back`/`forward`/`reload`) to an embedded tab's controlled webview.
-#[cfg(target_os = "macos")]
-pub fn tab_nav(app: tauri::AppHandle, id: String, op: &'static str) -> Result<(), String> {
-    imp::nav_op(app, id, op)
-}
-
-/// Read an embedded tab's current `{href,title}` (JSON string) — for polling the address bar so it
-/// tracks in-page navigation (link clicks / redirects), not just user-typed URLs.
-#[cfg(target_os = "macos")]
-pub fn tab_current_url(app: tauri::AppHandle, id: String) -> Result<String, String> {
-    imp::current_url(app, id)
-}
-
-/// Eval `js` (a function body) into an embedded tab's controlled webview; returns the raw string
-/// result. Backs the `browser.tab.eval` bridge method so the side-panel agent can read page content
-/// (innerText) and drive clicks/typing/scroll over the SAME embedded WKWebView.
-#[cfg(target_os = "macos")]
-pub fn tab_eval(app: tauri::AppHandle, id: String, js: String) -> Result<String, String> {
-    imp::eval(app, id, js)
-}
-
-/// Re-open the sub-windows that were open at last quit. Called once on app startup.
-#[cfg(target_os = "macos")]
-pub fn restore_subwindows(app: tauri::AppHandle) {
-    imp::restore(app);
-}
-
-/// Mark the app as quitting so per-window teardown keeps (not prunes) the restore snapshot.
-#[cfg(target_os = "macos")]
-pub fn mark_quitting() {
-    imp::APP_QUITTING.store(true, std::sync::atomic::Ordering::SeqCst);
-}