@livx.cc/appwrap 0.55.0 → 0.57.0

package/src/config.ts

@@ -312,7 +312,7 @@ export interface AppwrapConfig {
    * local directory OR an npm package name; a pack contributes `ModuleManifest[]` (+ handler files,
    * native source, an optional kit client). Packs apply in order, LAST-WINS by module name, so a pack
    * can add a NEW capability or wholesale-shadow a built-in one (e.g. swap the billing implementation).
-   * This is the single public extension seam — the same mechanism appwrap-ee, consumer apps that vendor
+   * This is the single public extension seam — the same mechanism a host, consumer apps that vendor
    * their own module, and community plugins all use. Absent → built-ins only (unchanged behavior). */
   modulePacks?: string[];
   /** Permitted headless background-task identifiers (for the `backgroundTask` module). iOS REQUIRES

package/src/handlers.ts

@@ -1,7 +1,7 @@
 /**
  * `defineHandlers` — author custom native handlers for the appwrap DESKTOP shell, run as a Bun sidecar.
  *
- * The desktop shell (runtime-desktop) spawns `bun <yourFile>` when `desktop.handlers` is set, and routes
+ * The desktop shell spawns `bun <yourFile>` when `desktop.handlers` is set, and routes
  * any method your map advertises to this process over NDJSON on stdin/stdout (appwrap sidecar protocol v1).
  * The PWA calls them through the kit with a raw invoke: `kit.invoke('myapp.foo', { … })`.
  *

package/src/packs.ts

@@ -14,7 +14,7 @@
  *  - a duplicate name WITHIN one pack → idempotent (later entry wins silently — a pack re-exporting its
  *    own module is not an error).
  *
- * This one mechanism serves three audiences identically: appwrap-ee layers its private packs, a consumer
+ * This one mechanism serves three audiences identically: a host layers its private packs, a consumer
  * app vendors its own copy of a module, and the community ships plugins — none of them patch CE.
  *
  * PURE of CLI I/O: filesystem/npm resolution and pack import are injected ports (`resolvePack`/

package/templates/ci/fastlane/Fastfile

@@ -6,6 +6,21 @@ default_platform(:ios)
 APP_ID = '__APP_ID__'.freeze
 TEAM_ID = '__TEAM_ID__'.freeze
 
+# iOS app-extension targets discovered from the generated wrapper. Each dir under
+# App_Resources/iOS/extensions/ carrying an extension.json is a SEPARATE Xcode target (name = dir
+# name, e.g. AppwrapWidget / NotificationService). Its bundle id MUST be a child `<APP_ID>.<name>`
+# (Apple rejects an extension whose id equals the app's or has >1 extra period), and it needs its
+# OWN App Store profile. NS already stamps the correct child PRODUCT_BUNDLE_IDENTIFIER at prepare —
+# the per-target signing below must NOT clobber it (a single unscoped update_code_signing_settings
+# rewrites EVERY target's bundle id to APP_ID → collision at upload).
+def appwrap_ios_extensions
+  ext_root = File.expand_path('../App_Resources/iOS/extensions', __dir__)
+  return [] unless Dir.exist?(ext_root)
+  Dir.children(ext_root)
+     .select { |name| File.file?(File.join(ext_root, name, 'extension.json')) }
+     .sort
+end
+
 # Run `ns prepare` (which shells out to `pod install`) with a SANITIZED gem env.
 #
 # Why: fastlane runs under its own Ruby and exports GEM_HOME/GEM_PATH into every child process. On a
@@ -50,8 +65,12 @@ def appwrap_archive_and_sign_ios
     is_key_content_base64: true
   )
 
-  # readonly: certs/profiles must be seeded once via `fastlane match appstore` (see workflow header).
-  match(type: 'appstore', readonly: true, app_identifier: APP_ID,
+  # The app AND each extension sign with their OWN App Store profile — pull them all here.
+  # readonly: certs/profiles must be seeded once via `fastlane match appstore` (see workflow header);
+  # regenerate them (incl. per-extension) via the `regen_profiles` lane if capabilities changed.
+  extensions = appwrap_ios_extensions
+  ext_ids = extensions.map { |name| "#{APP_ID}.#{name}" }
+  match(type: 'appstore', readonly: true, app_identifier: [APP_ID, *ext_ids],
         git_url: ENV['MATCH_GIT_URL'], api_key: api_key)
 
   # NativeScript prepares the Xcode project inside the wrapper dir (native/ = parent of fastlane/).
@@ -59,22 +78,44 @@ def appwrap_archive_and_sign_ios
   appwrap_prepare_ios
 
   # NS defaults the project to automatic signing → archive can't find a profile. Pin manual signing
-  # to the match-provided App Store profile (name exported by match into ENV).
-  profile = ENV["sigh_#{APP_ID}_appstore_profile-name"] || "match AppStore #{APP_ID}"
+  # PER TARGET to the match-provided App Store profile (name exported by match into ENV). `targets:`
+  # is REQUIRED so each call scopes to ONE target — an unscoped call rewrites EVERY target's
+  # bundle_identifier to APP_ID, clobbering the extensions' child ids → CFBundleIdentifier collision.
+  provisioning = {}
+  resolve_profile = ->(bundle_id) { ENV["sigh_#{bundle_id}_appstore_profile-name"] || "match AppStore #{bundle_id}" }
+
+  app_profile = resolve_profile.call(APP_ID)
+  provisioning[APP_ID] = app_profile
   update_code_signing_settings(
     use_automatic_signing: false,
     path: 'platforms/ios/native.xcodeproj',
+    targets: ['native'], # main app target only — leave NS's child ids on the extensions untouched
     team_id: TEAM_ID,
     bundle_identifier: APP_ID,
     code_sign_identity: 'Apple Distribution',
-    profile_name: profile
+    profile_name: app_profile
   )
 
+  extensions.each do |name|
+    ext_id = "#{APP_ID}.#{name}"
+    ext_profile = resolve_profile.call(ext_id)
+    provisioning[ext_id] = ext_profile
+    update_code_signing_settings(
+      use_automatic_signing: false,
+      path: 'platforms/ios/native.xcodeproj',
+      targets: [name],
+      team_id: TEAM_ID,
+      bundle_identifier: ext_id,
+      code_sign_identity: 'Apple Distribution',
+      profile_name: ext_profile
+    )
+  end
+
   build_app(
     workspace: 'platforms/ios/native.xcworkspace',
     scheme: 'native',
     export_method: 'app-store',
-    export_options: { provisioningProfiles: { APP_ID => profile } }
+    export_options: { provisioningProfiles: provisioning }
   )
 
   api_key

package/runtime-desktop/autotest/index.html

@@ -1,77 +0,0 @@
-<!doctype html>
-<meta charset="utf-8">
-<title>appwrap desktop autotest</title>
-<body style="font-family:monospace;background:#111;color:#0f0"><pre id="log">autotest</pre>
-<canvas id="cv" width="800" height="600"></canvas>
-<script>
-const logEl = document.getElementById('log');
-const say = (m) => { logEl.textContent += '\n' + m; };
-// Phase markers travel over the real bridge so they interleave with [bridge] eprintln
-// lines next to the watchdog's memory samples. UNSUPPORTED responses are irrelevant.
-const mark = (name) => window.appwrapNative?.postMessage(JSON.stringify({ v: 1, id: 'ph-' + name, kind: 'request', method: 'phase.' + name, params: null }));
-window.__appwrapDeliver = () => {}; // swallow responses
-
-const cleanups = [];
-const phases = [
-  ['idle', () => {}],
-  ['motion-listeners', () => {
-    const h1 = () => {}; const h2 = () => {};
-    window.addEventListener('devicemotion', h1);
-    window.addEventListener('deviceorientation', h2);
-    cleanups.push(() => { window.removeEventListener('devicemotion', h1); window.removeEventListener('deviceorientation', h2); });
-  }],
-  ['raf-canvas', () => {
-    const ctx = document.getElementById('cv').getContext('2d');
-    let run = true, t = 0;
-    const loop = () => { if (!run) return; t++; ctx.fillStyle = `hsl(${t % 360},80%,50%)`; ctx.fillRect(0, 0, 800, 600); ctx.getImageData(0, 0, 100, 100); requestAnimationFrame(loop); };
-    loop();
-    cleanups.push(() => { run = false; });
-  }],
-  ['speech-tts', () => {
-    let run = true;
-    const speak = () => { if (!run) return; const u = new SpeechSynthesisUtterance('test'); u.volume = 0; u.onend = speak; speechSynthesis.speak(u); };
-    speak();
-    cleanups.push(() => { run = false; speechSynthesis.cancel(); });
-  }],
-  ['geo-watch', () => {
-    if (!navigator.geolocation) return say('no geolocation');
-    const id = navigator.geolocation.watchPosition(() => {}, () => {}, { enableHighAccuracy: true });
-    cleanups.push(() => navigator.geolocation.clearWatch(id));
-  }],
-  ['bridge-storage-spam', () => {
-    let run = true, i = 0;
-    const big = 'x'.repeat(100_000);
-    const tick = () => {
-      if (!run) return;
-      for (let j = 0; j < 20; j++) window.appwrapNative.postMessage(JSON.stringify({ v: 1, id: 's' + (++i), kind: 'request', method: 'storage.set', params: { key: 'k' + (i % 50), value: big } }));
-      setTimeout(tick, 100);
-    };
-    tick();
-    cleanups.push(() => { run = false; });
-  }],
-  ['toast-spam', () => {
-    let run = true, i = 0;
-    const tick = () => { if (!run || i > 40) return; i++; window.appwrapNative.postMessage(JSON.stringify({ v: 1, id: 't' + i, kind: 'request', method: 'toast.show', params: { message: 'spam ' + i } })); setTimeout(tick, 500); };
-    tick();
-    cleanups.push(() => { run = false; });
-  }],
-  ['getusermedia', () => {
-    navigator.mediaDevices?.getUserMedia({ video: true, audio: true })
-      .then((s) => { say('gum ok'); cleanups.push(() => s.getTracks().forEach((t) => t.stop())); })
-      .catch((e) => say('gum err ' + e.name));
-  }],
-  ['idle-end', () => {}],
-];
-
-let idx = 0;
-const next = () => {
-  while (cleanups.length) { try { cleanups.pop()(); } catch {} }
-  if (idx >= phases.length) { mark('DONE'); say('DONE'); return; }
-  const [name, fn] = phases[idx++];
-  mark(name); say('phase: ' + name);
-  try { fn(); } catch (e) { say('threw: ' + e.message); }
-  setTimeout(next, 30_000);
-};
-next();
-</script>
-</body>

package/runtime-desktop/bridge-shim/build.sh

@@ -1,9 +0,0 @@
-#!/bin/sh
-# Build the injectable content bundle. Must run with the bod-browser repo as cwd so its
-# tsconfig `paths` (shared/*) resolve — the bundle reuses extension/src/content/* unmodified.
-set -e
-HERE="$(cd "$(dirname "$0")" && pwd)"
-BOD_BROWSER="${BOD_BROWSER:-$HERE/../../../bod-browser}"
-cd "$BOD_BROWSER"
-bun build "$HERE/content-entry.ts" --outfile "$HERE/dist/content.js"
-echo "built $HERE/dist/content.js"

package/runtime-desktop/bridge-shim/content-entry.ts

@@ -1,87 +0,0 @@
-// SPIKE: browser-bridge content layer for the appwrap desktop (Tauri/WKWebView) shell.
-// Reuses bod-browser's extension/src/content/* modules UNMODIFIED; only the transport differs:
-// instead of chrome.runtime messaging, each page dials a local WS to the shim (bridge-shim/shim.ts)
-// and answers ContentAction messages. Injected per-window via Tauri initialization_script.
-//
-// Build (from the bod-browser repo root so its tsconfig `paths` resolve shared/*):
-//   cd ../bod-browser && bun build <this file> --outfile <appwrap>/runtime-desktop/bridge-shim/dist/content.js
-import type { ContentAction } from 'shared/protocol';
-import { advanceScroll } from '../../../bod-browser/extension/src/content/advance-scroll';
-import {
-  clickElement, typeInElement, fillElement, doScroll, scrollElementIntoView, evalScript,
-  waitForElement, hoverElement, scrollElementBy, hoverNear, sendKey,
-} from '../../../bod-browser/extension/src/content/actions';
-import {
-  queryElements, getLinks, findButtons, clickText, queryByText, getElementValue, setElementAttribute,
-} from '../../../bod-browser/extension/src/content/query';
-import { getA11ySnapshot, queryA11y } from '../../../bod-browser/extension/src/content/a11y';
-import { probePage } from '../../../bod-browser/extension/src/content/probe';
-import { diagnosePage } from '../../../bod-browser/extension/src/content/diagnose';
-
-declare global {
-  interface Window { __BRIDGE_LABEL?: string; __BRIDGE_PORT?: number; __BRIDGE_LOADED?: boolean }
-}
-
-async function handleMessage(msg: ContentAction): Promise<unknown> {
-  switch (msg.action) {
-    case 'getContent':
-      return { url: location.href, title: document.title, html: document.documentElement.outerHTML, text: document.body?.innerText ?? '' };
-    case 'getTextContent':
-      return { url: location.href, title: document.title, text: document.body?.innerText?.slice(0, 20000) || '' };
-    case 'query': return queryElements(msg.selector, msg.multiple);
-    case 'click': return clickElement(msg.selector);
-    case 'type': return typeInElement(msg.selector, msg.value, msg.mode, msg.clear);
-    case 'fill': return fillElement(msg.selector, msg.value, msg.timeout, msg.mode, msg.clear);
-    case 'getValue': return getElementValue(msg.selector);
-    case 'setAttribute': return setElementAttribute(msg.selector, msg.attr, msg.value);
-    case 'scroll': return doScroll(msg.x || 0, msg.y || 0, msg.behavior);
-    case 'scrollIntoView': return scrollElementIntoView(msg.selector, msg.behavior);
-    case 'eval': return evalScript(msg.script);
-    case 'waitFor': return waitForElement(msg.selector, msg.timeout || 5000);
-    case 'hover': return hoverElement(msg.selector);
-    case 'scrollEl': return scrollElementBy(msg.selector, msg.deltaX || 0, msg.deltaY || 0, msg.behavior);
-    case 'advanceScroll':
-      return advanceScroll({ deltaY: msg.deltaY, itemSelector: msg.itemSelector, loadMoreSelector: msg.loadMoreSelector, behavior: msg.behavior });
-    case 'getA11ySnapshot': return getA11ySnapshot(msg.root || null, msg.maxDepth || 10, msg.mode || 'full');
-    case 'probe': return probePage(msg.goal || null);
-    case 'diagnose': return diagnosePage();
-    case 'queryA11y': return queryA11y(msg.role, msg.name, msg.multiple);
-    case 'getLinks': return getLinks(msg.pattern || null, msg.scope || null);
-    case 'clickText': return clickText(msg.text, msg.scope || null);
-    case 'queryByText': return queryByText(msg.text, msg.scope || null);
-    case 'findButtons': return findButtons(msg.scope || null);
-    case 'sendKey': return sendKey(msg.selector || null, msg.key, msg.modifiers);
-    case '_ping': return { pong: true };
-    default:
-      throw new Error(`Unknown action: ${(msg as ContentAction).action}`);
-  }
-}
-
-(() => {
-  // initialization_script can fire more than once per document lifecycle; guard.
-  if (window.__BRIDGE_LOADED) return;
-  window.__BRIDGE_LOADED = true;
-  const label = window.__BRIDGE_LABEL || 'unknown';
-
-  // Transport: WebKit blocks ws://127.0.0.1 (and plain-http beacons) from https pages as mixed
-  // content — no loopback exemption like Chrome. So results go out via the native
-  // WKScriptMessageHandler the shell installs (webkit.messageHandlers.bridgeShim), and commands
-  // come in via window.__bridgeDispatch(...) evaluated by the shell (evalJs op).
-  type WebkitHandlers = { webkit?: { messageHandlers?: { bridgeShim?: { postMessage: (s: string) => void } } } };
-  const post = (o: Record<string, unknown>) => {
-    try { (window as WebkitHandlers).webkit?.messageHandlers?.bridgeShim?.postMessage(JSON.stringify({ label, ...o })); } catch { /* ignore */ }
-  };
-
-  (window as unknown as { __bridgeDispatch: (m: ContentAction & { id: string }) => void }).__bridgeDispatch = (m) => {
-    Promise.resolve()
-      .then(() => handleMessage(m))
-      .then(result => post({ id: m.id, result }))
-      .catch((e: Error) => post({ id: m.id, error: e.message }));
-  };
-
-  const register = () => post({ type: 'register', url: location.href, title: document.title });
-  register();
-  addEventListener('DOMContentLoaded', register);
-  addEventListener('load', register);
-  console.log(`[BridgeDesktop:cs ${label}] loaded on ${location.href.slice(0, 80)}`);
-})();

package/runtime-desktop/bridge-shim/shim.ts

@@ -1,132 +0,0 @@
-#!/usr/bin/env bun
-// SPIKE: browser-bridge "extension instance" shim for the appwrap desktop (Tauri) shell.
-// Speaks the UNMODIFIED bod-browser extension protocol to the bridge server (ws://localhost:9230),
-// backed by Tauri windows instead of Chrome tabs:
-//   - WS client -> bridge server: hello { instanceId: 'appwrap-desktop' }, answers WsCommand.
-//   - WS server :9236 (/page)   : each Tauri window's injected content bundle dials in and
-//                                 executes ContentAction messages (the DOM layer).
-//   - TCP :9237 (line-JSON)     : the Rust shell connects as 'control'; the shim asks it for
-//                                 window ops (createWindow/closeWindow/navigate/screenshot).
-// Run: bun runtime-desktop/bridge-shim/shim.ts
-
-const SERVER_URL = process.env.BRIDGE_SERVER_URL || 'ws://localhost:9230';
-const INSTANCE_ID = process.env.BRIDGE_INSTANCE_ID || 'appwrap-desktop';
-const PAGE_PORT = Number(process.env.APPWRAP_BRIDGE_PAGE_PORT || 9236);
-const RUST_PORT = Number(process.env.APPWRAP_BRIDGE_RUST_PORT || 9237);
-
-const log = (m: string, ...a: unknown[]) => console.log(`[shim] ${m}`, ...a);
-
-// The transport-agnostic browser-automation PRODUCT (tab registry + bod-browser routing +
-// handleCommand) was lifted into the `browser-driver` package inside mcp-desktop-browser (Phase 1b).
-// This file is now a thin TRANSPORT shell: WS client + TCP control channel + page WS, delegating all
-// command handling and page-beacon parsing to the driver below. Consumed as a proper package
-// (`mcp-desktop-browser/browser-driver`, a file: dep in the root package.json → resolves by name,
-// not a fragile cross-repo relative path — the TS analogue of the crate-consumption decision).
-import { createBrowserDriver } from 'mcp-desktop-browser/browser-driver';
-
-// ---------------------------------------------------------------------------
-// Rust control channel (TCP, newline-delimited JSON)
-// ---------------------------------------------------------------------------
-type Pending = { resolve: (v: unknown) => void; reject: (e: Error) => void; timer: ReturnType<typeof setTimeout> };
-let rustSock: { write: (s: string) => void } | null = null;
-const rustPending = new Map<string, Pending>();
-let reqCounter = 0;
-
-function rustRequest(op: string, params: Record<string, unknown> = {}, timeoutMs = 15000): Promise<unknown> {
-  if (!rustSock) return Promise.reject(new Error('Desktop shell not connected to shim (is the app running with APPWRAP_BRIDGE_JS?)'));
-  const id = `r${++reqCounter}`;
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => { rustPending.delete(id); reject(new Error(`rust op ${op} timed out`)); }, timeoutMs);
-    rustPending.set(id, { resolve, reject, timer });
-    rustSock!.write(JSON.stringify({ id, op, ...params }) + '\n');
-  });
-}
-
-// The product layer — driven through our transport (rustRequest) + fed page beacons via onPageMsg.
-const driver = createBrowserDriver({ rustRequest, log });
-
-Bun.listen({
-  hostname: '127.0.0.1',
-  port: RUST_PORT,
-  socket: {
-    open(socket) {
-      log('rust control connected');
-      rustSock = { write: (s) => socket.write(s) };
-      (socket as unknown as { __buf: string }).__buf = '';
-    },
-    data(socket, data) {
-      const s = socket as unknown as { __buf: string };
-      s.__buf += data.toString();
-      let idx: number;
-      while ((idx = s.__buf.indexOf('\n')) >= 0) {
-        const line = s.__buf.slice(0, idx).trim();
-        s.__buf = s.__buf.slice(idx + 1);
-        if (!line) continue;
-        try {
-          const msg = JSON.parse(line);
-          if (msg.type === 'pageMsg') { driver.onPageMsg(String(msg.payload)); continue; }
-          const p = rustPending.get(msg.id);
-          if (p) {
-            rustPending.delete(msg.id);
-            clearTimeout(p.timer);
-            if (msg.error) p.reject(new Error(String(msg.error)));
-            else p.resolve(msg.result);
-          }
-        } catch (e) { log('bad rust line:', line.slice(0, 200), (e as Error).message); }
-      }
-    },
-    close() { log('rust control disconnected'); rustSock = null; },
-    error(_s, e) { log('rust control error:', e.message); },
-  },
-});
-
-// Debug HTTP endpoint (curl a raw rust op / read page beacons)
-Bun.serve({
-  hostname: '127.0.0.1',
-  port: PAGE_PORT,
-  async fetch(req) {
-    const path = new URL(req.url).pathname;
-    if (path === '/log' && req.method === 'POST') { log('page:', await req.text()); return new Response('ok'); }
-    if (path === '/rust' && req.method === 'POST') {
-      const body = await req.json() as Record<string, unknown>;
-      try { return Response.json({ result: await rustRequest(String(body.op), body) }); }
-      catch (e) { return Response.json({ error: (e as Error).message }); }
-    }
-    return new Response('bridge-shim debug endpoint', { status: 200 });
-  },
-});
-
-// ---------------------------------------------------------------------------
-// Bridge server WS client (the extension background's ws.ts analogue)
-// ---------------------------------------------------------------------------
-let serverWs: WebSocket | null = null;
-function connectServer() {
-  serverWs = new WebSocket(SERVER_URL);
-  serverWs.onopen = () => {
-    log(`connected to bridge server ${SERVER_URL} as ${INSTANCE_ID}`);
-    serverWs!.send(JSON.stringify({ type: 'hello', userAgent: `appwrap-desktop-shell (Tauri/WKWebView; ${process.platform})`, instanceId: INSTANCE_ID, buildHash: 'appwrap-desktop-spike' }));
-    serverWs!.send(JSON.stringify({ type: 'ping', t: Date.now() }));
-  };
-  serverWs.onmessage = async (ev) => {
-    let msg: { id: string; cmd: string; params?: Record<string, unknown>; type?: string } | undefined;
-    try {
-      const parsed = JSON.parse(String(ev.data));
-      if (parsed.type === 'pong' || parsed.type === 'reload' || parsed.type === 'recording_saved') return;
-      msg = parsed;
-      const result = await driver.handleCommand(msg!);
-      log(`cmd=${msg!.cmd} ok`);
-      serverWs!.send(JSON.stringify({ id: msg!.id, result }));
-    } catch (e) {
-      log(`cmd=${msg?.cmd} error: ${(e as Error).message}`);
-      try { serverWs!.send(JSON.stringify({ id: msg?.id, error: (e as Error).message })); } catch { /* ignore */ }
-    }
-  };
-  serverWs.onclose = () => { log('server disconnected, retrying in 3s'); setTimeout(connectServer, 3000); };
-  serverWs.onerror = () => { /* onclose follows */ };
-}
-connectServer();
-setInterval(() => {
-  if (serverWs?.readyState === WebSocket.OPEN) serverWs.send(JSON.stringify({ type: 'ping', t: Date.now() }));
-}, 15000);
-
-log(`page WS :${PAGE_PORT}  rust control :${RUST_PORT}`);

package/runtime-desktop/chrome/appwrap-browser-chrome.html

@@ -1,185 +0,0 @@
-<!doctype html>
-<html>
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<title>Browser</title>
-<style>
-  :root {
-    --bar-h: 44px;
-    --bg: #f2f2f4; --fg: #1c1c1e; --border: #d0d0d5;
-    --field-bg: #ffffff; --field-border: #c4c4cc; --btn-hover: #e2e2e6;
-  }
-  @media (prefers-color-scheme: dark) {
-    :root {
-      --bg: #2a2a2e; --fg: #f2f2f4; --border: #444;
-      --field-bg: #1c1c1e; --field-border: #555; --btn-hover: #3a3a40;
-    }
-  }
-  * { box-sizing: border-box; }
-  html, body { margin: 0; height: 100%; overflow: hidden;
-    font: 13px -apple-system, system-ui, sans-serif; color: var(--fg); }
-  /* The controlled WKWebView is a native subview covering everything below the bar; the body below
-     the bar is never seen — only this top strip renders. */
-  #bar {
-    display: flex; align-items: center; gap: 6px;
-    height: var(--bar-h); padding: 0 8px;
-    background: var(--bg); border-bottom: 1px solid var(--border);
-    -webkit-user-select: none; user-select: none;
-  }
-  button.nav {
-    width: 30px; height: 28px; flex: none;
-    border: none; border-radius: 6px; background: transparent; color: var(--fg);
-    font-size: 16px; line-height: 1; cursor: default;
-  }
-  button.nav:hover { background: var(--btn-hover); }
-  button.nav:active { background: var(--field-border); }
-  #addr {
-    flex: 1 1 auto; height: 28px; padding: 0 10px;
-    border: 1px solid var(--field-border); border-radius: 7px;
-    background: var(--field-bg); color: var(--fg); font-size: 13px; outline: none;
-  }
-  #addr:focus { border-color: #4c8bf5; }
-  #profile, #newprof {
-    flex: none; height: 28px; max-width: 160px;
-    border: 1px solid var(--field-border); border-radius: 7px;
-    background: var(--field-bg); color: var(--fg); font-size: 12px; padding: 0 4px;
-  }
-  #newprof:focus { border-color: #4c8bf5; outline: none; }
-</style>
-</head>
-<body>
-  <div id="bar">
-    <button class="nav" id="back" title="Back">&#8249;</button>
-    <button class="nav" id="fwd" title="Forward">&#8250;</button>
-    <button class="nav" id="reload" title="Reload">&#8635;</button>
-    <input id="addr" type="text" spellcheck="false" autocomplete="off"
-           placeholder="Enter address (e.g. 127.0.0.1:3000)" />
-    <select id="profile" title="Profile"></select>
-    <input id="newprof" type="text" spellcheck="false" autocomplete="off"
-           placeholder="profile name — Enter" style="display:none" />
-  </div>
-<script>
-(function () {
-  // id + profile arrive via hash fragment (#id=…&profile=…) — a query (?…) breaks Tauri's App-asset
-  // resolution. Read hash first, fall back to search for robustness.
-  var hp = new URLSearchParams(location.hash.replace(/^#/, ''));
-  var sp = new URLSearchParams(location.search);
-  var id = hp.get('id') || sp.get('id') || '';
-  var initProfile = hp.get('profile') || sp.get('profile') || 'default';
-  function invoke(cmd, args) {
-    var core = window.__TAURI__ && window.__TAURI__.core;
-    if (!core) return Promise.reject(new Error('Tauri core unavailable'));
-    return core.invoke(cmd, args || {});
-  }
-
-  var addr = document.getElementById('addr');
-  var profileSel = document.getElementById('profile');
-
-  function normalizeUrl(raw) {
-    var s = (raw || '').trim();
-    if (!s) return '';
-    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(s) || /^about:/i.test(s)) return s;
-    return 'https://' + s;
-  }
-
-  document.getElementById('back').addEventListener('click', function () { invoke('browser_tab_back', { id: id }); });
-  document.getElementById('fwd').addEventListener('click', function () { invoke('browser_tab_forward', { id: id }); });
-  document.getElementById('reload').addEventListener('click', function () { invoke('browser_tab_reload', { id: id }); });
-
-  addr.addEventListener('keydown', function (e) {
-    if (e.key !== 'Enter') return;
-    var url = normalizeUrl(addr.value);
-    if (url) invoke('browser_tab_navigate', { id: id, url: url });
-  });
-
-  var NEW_PROFILE = '__new__';   // sentinel option: reveal an inline input, then switch to the name
-  var current = initProfile;     // the profile actually shown (to revert the <select> on cancel)
-  var newprof = document.getElementById('newprof');
-
-  function addProfileOption(name) {
-    if (!name) return;
-    for (var i = 0; i < profileSel.options.length; i++) {
-      if (profileSel.options[i].value === name) return;   // already listed
-    }
-    var opt = document.createElement('option');
-    opt.value = name; opt.textContent = name;
-    profileSel.insertBefore(opt, profileSel.lastChild);   // before the "+ New profile…" item
-  }
-
-  function switchProfile(name) {
-    // Switching recreates the webview with a fresh, isolated store; the name is persisted on first
-    // use (uuid_for) so it reappears in the list next launch.
-    addProfileOption(name);
-    profileSel.value = name;
-    current = name;
-    invoke('browser_subwindow_switch_profile', { id: id, profileId: name });
-  }
-
-  // Inline "+ New profile" flow — WKWebView has no window.prompt (no text-input panel delegate), so
-  // reveal a small input instead of prompting. Enter commits, Escape/empty-blur cancels.
-  function beginNewProfile() {
-    profileSel.style.display = 'none';
-    newprof.style.display = '';
-    newprof.value = '';
-    newprof.focus();
-  }
-  function endNewProfile(commit) {
-    if (newprof.style.display === 'none') return;   // already closed (guard double-fire)
-    var name = (newprof.value || '').trim();
-    newprof.style.display = 'none';
-    profileSel.style.display = '';
-    profileSel.value = current;                     // reset the sentinel selection
-    if (commit && name && name !== current) switchProfile(name);
-  }
-  newprof.addEventListener('keydown', function (e) {
-    if (e.key === 'Enter') endNewProfile(true);
-    else if (e.key === 'Escape') endNewProfile(false);
-  });
-  newprof.addEventListener('blur', function () { endNewProfile(true); });
-
-  profileSel.addEventListener('change', function () {
-    var val = profileSel.value;
-    if (val === NEW_PROFILE) { beginNewProfile(); return; }
-    current = val;
-    invoke('browser_subwindow_switch_profile', { id: id, profileId: val });
-  });
-
-  // Populate the profile dropdown, then append the "+ New profile…" sentinel.
-  invoke('browser_list_profiles').then(function (profiles) {
-    (profiles || ['default']).forEach(function (p) {
-      var opt = document.createElement('option');
-      opt.value = p; opt.textContent = p;
-      profileSel.appendChild(opt);
-    });
-    var add = document.createElement('option');
-    add.value = NEW_PROFILE; add.textContent = '+ New profile…';
-    profileSel.appendChild(add);
-    // Reflect the window's ACTUAL mounted profile (may be non-default on a restored window).
-    addProfileOption(initProfile);
-    profileSel.value = initProfile;
-  }).catch(function (e) { console.error('list profiles failed', e); });
-
-  // Keep the address bar in sync with the controlled webview (skip while the user is editing it).
-  var focused = false;
-  addr.addEventListener('focus', function () { focused = true; });
-  addr.addEventListener('blur', function () { focused = false; });
-  function poll() {
-    invoke('browser_tab_current_url', { id: id }).then(function (json) {
-      if (focused) return;
-      try {
-        var o = JSON.parse(json);
-        var href = o && o.href ? o.href : '';
-        if (href && href !== 'about:blank') addr.value = href;
-      } catch (_) {}
-    }).catch(function () {});
-  }
-  var pollTimer = setInterval(poll, 1000);
-  poll();
-  // Stop polling as the window unloads — a poll's current_url eval racing the native teardown blocks
-  // the closing window (the webview is gone, so the eval never resolves). Fixes the close-hang.
-  window.addEventListener('pagehide', function () { clearInterval(pollTimer); });
-})();
-</script>
-</body>
-</html>