@livx.cc/appwrap 0.55.0 → 0.57.0

package/runtime-desktop/src-tauri/Cargo.toml

@@ -1,45 +0,0 @@
-[package]
-name = "appwrap-desktop-shell"
-version = "0.1.0"
-edition = "2021"
-
-[build-dependencies]
-tauri-build = { version = "2", features = [] }
-
-[dependencies]
-# `devtools` feature so `open_devtools()`/`close_devtools()` compile in RELEASE too (in debug they're
-# always available); the ⌥⌘I toggle is still gated at runtime by webview_control::devtools_enabled().
-tauri = { version = "2", features = ["devtools"] }
-tauri-plugin-deep-link = "2"
-tauri-plugin-window-state = "2"
-tauri-plugin-notification = "2"
-tauri-plugin-autostart = "2"
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-arboard = "3"
-libc = "0.2"  # desktop.server: setsid the local-server child + SIGTERM its whole process group on teardown
-
-# macOS oauth.authorize — ASWebAuthenticationSession (system-browser auth sheet, exact parity with the
-# iOS shell path in runtime/app/shell/handlers-oauth.ts: auto-close on redirect, user-cancel signal).
-[target.'cfg(target_os = "macos")'.dependencies]
-# The generalized native webview primitive (per-profile store, eval, snapshot, popup, bridgeShim).
-# objc2* versions MUST stay identical to those below — the WKWebView pointer crosses the boundary.
-webview-control = { path = "../crates/webview-control" }
-base64 = "0.22"  # SPIKE: bridge_mac screenshot PNG encoding
-objc2 = "0.6"
-objc2-foundation = "0.3"
-objc2-app-kit = "0.3"
-objc2-authentication-services = "0.3"
-objc2-web-kit = "0.3"
-objc2-local-authentication = "0.3"  # Touch ID — LAContext (biometrics.available / .authenticate)
-block2 = "0.6"
-# local notifications (notifications.schedule): UNUserNotificationCenter + a delegate so a tapped
-# notification carrying a deepLink routes through deeplink.open (tauri-plugin-notification has no click callback).
-objc2-user-notifications = { version = "0.3", default-features = false, features = [
-  "std", "block2",
-  "UNUserNotificationCenter", "UNNotificationContent", "UNNotificationRequest",
-  "UNNotificationResponse", "UNNotificationTrigger", "UNNotification",
-] }
-
-[profile.dev]
-incremental = true

package/runtime-desktop/src-tauri/build.rs

@@ -1,3 +0,0 @@
-fn main() {
-    tauri_build::build()
-}

package/runtime-desktop/src-tauri/capabilities/default.json

@@ -1,6 +0,0 @@
-{
-  "$schema": "../gen/schemas/desktop-schema.json",
-  "identifier": "default",
-  "windows": ["main", "subwin-*"],
-  "permissions": ["core:default", "notification:default"]
-}

package/runtime-desktop/src-tauri/shell_config.json

@@ -1,10 +0,0 @@
-{
-  "appId": "cc.livx.hellopwa.desktop",
-  "name": "Hello PWA (desktop)",
-  "version": "0.1.0",
-  "title": "Hello PWA — appwrap desktop",
-  "width": 430,
-  "height": 800,
-  "urlScheme": "hellowrap",
-  "identifier": "cc.livx.hellopwa.desktop"
-}

package/runtime-desktop/src-tauri/src/biometrics_mac.rs

@@ -1,138 +0,0 @@
-// macOS Touch ID / biometrics — LocalAuthentication LAContext, exact parity with the iOS shell path
-// (runtime/app/shell/handlers-extended.ts):
-//   biometrics.available    → { available: bool, type: 'face' | 'touch' | 'none' }
-//   biometrics.authenticate → { success: true }  OR  rejects with code 'DENIED'
-//
-// Policy: LAPolicyDeviceOwnerAuthenticationWithBiometrics — biometrics ONLY, no passcode fallback.
-// The kit's biometrics.authenticate(reason) contract carries NO "allow passcode" flag (see
-// packages/native-kit/src/modules/biometrics.ts) and the iOS handler uses the WithBiometrics policy,
-// so we mirror that exactly. (DeviceOwnerAuthentication — biometry-or-password — is intentionally not
-// wired: it would over-deliver vs the mobile contract.)
-//
-// Threading: `available` (canEvaluatePolicy) is a pure query, safe off the main thread — computed on
-// the worker thread and delivered inline. `authenticate` is initiated on the main thread (mirrors the
-// other native lanes); its reply block runs on a private LA queue and delivers via the window. The
-// LAContext MUST stay alive for the whole evaluation (ARC would otherwise cancel it mid-prompt), so it
-// is parked in a static for the flight's lifetime — single-flight, like oauth/push.
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::Mutex;
-
-use block2::RcBlock;
-use objc2::rc::Retained;
-use objc2::runtime::Bool;
-use objc2_foundation::{NSError, NSString};
-use objc2_local_authentication::{LABiometryType, LAContext, LAPolicy};
-use serde_json::{json, Value};
-
-use crate::deliver;
-
-/// Human-readable diagnostic for an LAError availability code (kit shape only carries `available:bool`,
-/// so this is for the shell log, not the response). Codes: LocalAuthentication LAError.
-fn availability_reason(code: isize) -> &'static str {
-    match code {
-        -5 => "passcode not set",
-        -6 => "no biometric hardware",
-        -7 => "biometrics not enrolled",
-        -8 => "biometrics locked out (too many attempts)",
-        _ => "unavailable",
-    }
-}
-
-fn biometry_type_str(t: LABiometryType) -> &'static str {
-    match t {
-        LABiometryType::FaceID => "face",
-        LABiometryType::TouchID => "touch",
-        _ => "none",
-    }
-}
-
-/// `biometrics.available` — { available, type }. Synchronous; safe on the worker thread.
-pub fn available() -> Value {
-    let ctx = unsafe { LAContext::new() };
-    // biometryType is only populated AFTER a canEvaluatePolicy call, so evaluate first.
-    let available = match unsafe { ctx.canEvaluatePolicy_error(LAPolicy::DeviceOwnerAuthenticationWithBiometrics) } {
-        Ok(()) => true,
-        Err(e) => {
-            let code = e.code();
-            eprintln!("[biometrics] unavailable: {} (code {code})", availability_reason(code));
-            false
-        }
-    };
-    let ty = biometry_type_str(unsafe { ctx.biometryType() });
-    json!({ "available": available, "type": ty })
-}
-
-/// Strong ref to the in-flight context, held for the evaluation's lifetime. Only ever touched here;
-/// the Send impl exists purely so the (framework-confined) context can live in a static Mutex.
-struct ActiveFlow(Option<Retained<LAContext>>);
-unsafe impl Send for ActiveFlow {}
-static ACTIVE: Mutex<ActiveFlow> = Mutex::new(ActiveFlow(None));
-
-/// Synchronous single-flight reservation, claimed on the INVOKE thread before the main-thread hop
-/// (mirrors main.rs OAUTH_IN_FLIGHT). Guarding on ACTIVE alone is a TOCTOU: ACTIVE is only set
-/// inside the run_on_main_thread closure, so two quick authenticate calls could both pass the check
-/// and the second context would overwrite (and drop) the first mid-prompt.
-static IN_FLIGHT: AtomicBool = AtomicBool::new(false);
-
-fn deliver_success(window: &tauri::WebviewWindow, id: &str) {
-    let resp = json!({ "v": 1, "id": id, "kind": "response", "result": { "success": true } });
-    deliver(window, &resp);
-}
-
-fn deliver_denied(window: &tauri::WebviewWindow, id: &str, msg: &str) {
-    // Kit contract: authenticate rejects with 'DENIED' on user cancel/failure.
-    let resp = json!({ "v": 1, "id": id, "kind": "response", "error": { "code": "DENIED", "message": msg } });
-    deliver(window, &resp);
-}
-
-/// `biometrics.authenticate` — prompt Touch ID; reply delivered from the LA completion block.
-/// Single-flight: a second prompt while one is up is refused (only one LA sheet at a time).
-pub fn authenticate(window: tauri::WebviewWindow, id: String, reason: String) {
-    // Atomic reservation BEFORE the main-thread hop — see IN_FLIGHT doc for why ACTIVE can't guard.
-    if IN_FLIGHT.swap(true, Ordering::SeqCst) {
-        return deliver_denied(&window, &id, "a biometric prompt is already in progress");
-    }
-    let reason = if reason.trim().is_empty() { "Authenticate".to_string() } else { reason };
-    let w = window.clone();
-    let fail_id = id.clone();
-    let res = window.run_on_main_thread(move || {
-        let ctx = unsafe { LAContext::new() };
-
-        let cb_window = w.clone();
-        let cb_id = id.clone();
-        let block = RcBlock::new(move |success: Bool, error: *mut NSError| {
-            // Release the parked context + reservation first — a follow-up authenticate must be
-            // legal from here.
-            ACTIVE.lock().unwrap().0 = None;
-            IN_FLIGHT.store(false, Ordering::SeqCst);
-            if success.as_bool() {
-                eprintln!("[biometrics] authenticate succeeded");
-                deliver_success(&cb_window, &cb_id);
-            } else {
-                let msg = if error.is_null() {
-                    "authentication failed".to_string()
-                } else {
-                    unsafe { (*error).localizedDescription() }.to_string()
-                };
-                eprintln!("[biometrics] authenticate failed: {msg}");
-                deliver_denied(&cb_window, &cb_id, &msg);
-            }
-        });
-
-        // Park the context BEFORE evaluate — the reply can fire from a private queue at any moment.
-        ACTIVE.lock().unwrap().0 = Some(ctx.clone());
-        unsafe {
-            ctx.evaluatePolicy_localizedReason_reply(
-                LAPolicy::DeviceOwnerAuthenticationWithBiometrics,
-                &NSString::from_str(&reason),
-                &block,
-            );
-        }
-        eprintln!("[biometrics] evaluatePolicy started");
-    });
-    if let Err(e) = res {
-        ACTIVE.lock().unwrap().0 = None;
-        IN_FLIGHT.store(false, Ordering::SeqCst);
-        deliver_denied(&window, &fail_id, &format!("failed to reach main thread: {e}"));
-    }
-}

package/runtime-desktop/src-tauri/src/bridge_mac.rs

@@ -1,424 +0,0 @@
-// Control-channel ADAPTER for the browser-bridge shim (bridge-shim/shim.ts).
-//
-// Phase 1 extraction: the WKWebView primitive (per-profile persistent+isolated stores, manual
-// window creation, CSP-immune eval, snapshot, the bridgeShim handler, SSO popups) now lives in the
-// `webview-control` crate. This file is the thin transport adapter that OWNS the bod-browser wire
-// format + the TCP control channel:
-//   - dials the shim's TCP control port (line-JSON) and serves window ops,
-//   - frames the crate's RAW page payloads into {type:"pageMsg", payload} lines,
-//   - frames RAW eval/snapshot results into {id,result}/{id,error} responses,
-//   - keeps the legacy tauri-window path (no profileId) for back-compat.
-// Env-gated: fully inert unless APPWRAP_BRIDGE_JS points at the built content bundle.
-use base64::Engine;
-use serde_json::{json, Value};
-use std::io::{Read, Write};
-use std::net::TcpStream;
-use std::sync::mpsc::{channel, Sender};
-use std::sync::Mutex;
-use std::time::Duration;
-use tauri::{AppHandle, Manager};
-
-use objc2::rc::Retained;
-use objc2::MainThreadMarker;
-use objc2_web_kit::WKWebView;
-
-// The transport-free primitive. This adapter is the ONLY place that knows the bod-browser wire
-// format; the crate stays automation-agnostic.
-use webview_control as wv;
-
-/// Build the page->shim message sink for one webview: wrap the crate's RAW payload into the
-/// {type:"pageMsg", payload} envelope the shim expects. This is the seam — the framing lives here,
-/// never in the crate.
-fn page_sink(tx: Sender<String>) -> wv::MessageSink {
-    Box::new(move |raw: String| {
-        let _ = tx.send(json!({ "type": "pageMsg", "payload": raw }).to_string());
-    })
-}
-
-fn page_port() -> u16 {
-    std::env::var("APPWRAP_BRIDGE_PAGE_PORT").ok().and_then(|s| s.parse().ok()).unwrap_or(9236)
-}
-
-/// The live control-channel page->shim sender, set for the duration of a connected `run()`. Lets a
-/// webview created OUTSIDE the createWindow op (e.g. a browser sub-window in browser_tab.rs) route
-/// its page beacons to the SAME shim, so it registers as a bod-browser tab. None when disconnected.
-static PAGE_TX: Mutex<Option<Sender<String>>> = Mutex::new(None);
-
-/// Clears PAGE_TX on drop, so every `run()` return path (normal or error) leaves it None.
-struct PageTxGuard;
-impl Drop for PageTxGuard {
-    fn drop(&mut self) {
-        *PAGE_TX.lock().unwrap() = None;
-    }
-}
-
-/// Page->shim sink for a webview created outside `createWindow` (browser sub-windows). Unlike a
-/// snapshot of the CURRENT PAGE_TX, this sink reads the LIVE control connection at send-time: a
-/// sub-window opened while the shim is disconnected (PAGE_TX == None) installs this ONE sink and its
-/// beacons are dropped for now, but the moment a later `run()` publishes a PAGE_TX the SAME installed
-/// sink starts delivering — so the window SELF-HEALS into agent-exposure on shim (re)connect, with no
-/// re-injection of the message handler. Framing stays identical to `page_sink`.
-pub fn bridge_sink() -> wv::MessageSink {
-    Box::new(move |raw: String| {
-        if let Some(tx) = PAGE_TX.lock().unwrap().as_ref() {
-            let _ = tx.send(json!({ "type": "pageMsg", "payload": raw }).to_string());
-        }
-    })
-}
-
-/// Build the SAME framed init-JS `createWindow` injects, for a webview created elsewhere. Reads the
-/// content bundle from `APPWRAP_BRIDGE_JS`; None when the feature is off (unset/empty) or the read
-/// fails (logged). `label` becomes `window.__BRIDGE_LABEL` so the shim registers this webview by id.
-pub fn bridge_init_js(label: &str) -> Option<String> {
-    let path = match std::env::var("APPWRAP_BRIDGE_JS") {
-        Ok(p) if !p.is_empty() => p,
-        _ => return None,
-    };
-    match std::fs::read_to_string(&path) {
-        Ok(bundle) => Some(format!(
-            "window.__BRIDGE_LABEL={};window.__BRIDGE_PORT={};\n{}",
-            serde_json::to_string(&label).unwrap(), page_port(), bundle
-        )),
-        Err(e) => { eprintln!("[bridge-shim] bridge_init_js read {path}: {e}"); None }
-    }
-}
-fn rust_port() -> u16 {
-    std::env::var("APPWRAP_BRIDGE_RUST_PORT").ok().and_then(|s| s.parse().ok()).unwrap_or(9237)
-}
-
-// ---- Agent-browser-control gate ------------------------------------------------------------------
-// The bridge control channel can eval arbitrary JS in any embedded tab, so it is OPT-IN and OFF by
-// default. It is env-gated at process launch (APPWRAP_BRIDGE_JS), but an app's opt-in typically lives
-// in the FE and isn't known until after launch — a chicken-and-egg. Resolution: a PERSISTENT marker
-// file (survives relaunch, unlike per-launch web storage). The app writes/removes the marker (e.g. via
-// an `app.setAgentBrowserControl` handler) and asks the user to relaunch; on the next launch
-// `resolve_gate()` reads the marker and, if present, populates the bridge env BEFORE `init()` — so the
-// bridge comes up exactly when the user opted in, and stays fully inert otherwise. The marker path is
-// owned by the caller (main.rs, which knows the app identifier) so this module stays app-agnostic.
-
-/// Derive the built content bundle path from the running binary (dev + bundled layouts), so callers
-/// don't have to know it. Returns the first candidate that exists.
-fn resolve_content_js() -> Option<String> {
-    let exe = std::env::current_exe().ok()?;
-    let mut dir = exe.parent();
-    while let Some(d) = dir {
-        // Dev layout: …/runtime-desktop/… has the built bundle at bridge-shim/dist/content.js.
-        let cand = d.join("bridge-shim/dist/content.js");
-        if cand.exists() {
-            return Some(cand.to_string_lossy().into_owned());
-        }
-        // Bundled .app: content.js is staged into Contents/Resources.
-        let res = d.join("Resources/content.js");
-        if res.exists() {
-            return Some(res.to_string_lossy().into_owned());
-        }
-        dir = d.parent();
-    }
-    None
-}
-
-/// Launch-time gate resolution. The opt-in `marker` is the SINGLE source of truth for the
-/// browser-control bridge: it arms iff the marker is present, regardless of any inherited env.
-///
-/// A controlling daemon (mcp-desktop-browser) ALWAYS spawns us with `APPWRAP_BRIDGE_JS` set (it can't
-/// know the FE opt-in), so trusting an inherited env would let a daemon spawn arm the bridge with no
-/// marker — defeating the gate. Therefore: no marker → forcibly CLEAR the bridge env (`init()` then
-/// returns early, fully inert), no matter what we were spawned with. Marker present (opted in) → keep
-/// a daemon-provided env as-is (correct rendezvous ports), or populate it from the resolved content
-/// bundle + defaults when launched standalone. Must run before `init()` and before any embedded tab.
-pub fn resolve_gate(marker: &std::path::Path) {
-    if !marker.exists() {
-        // Not opted in — the bridge stays inert even if a spawner set the env. The marker, not the
-        // inherited env, is authoritative for the browser-control channel.
-        std::env::remove_var("APPWRAP_BRIDGE_JS");
-        return;
-    }
-    if std::env::var("APPWRAP_BRIDGE_JS").ok().filter(|s| !s.is_empty()).is_some() {
-        return; // opted in + env already provided (daemon-spawned) — respect its rendezvous ports
-    }
-    match resolve_content_js() {
-        Some(js) => {
-            std::env::set_var("APPWRAP_BRIDGE_JS", js);
-            if std::env::var("APPWRAP_BRIDGE_RUST_PORT").is_err() {
-                std::env::set_var("APPWRAP_BRIDGE_RUST_PORT", "3843");
-            }
-            if std::env::var("APPWRAP_BRIDGE_PAGE_PORT").is_err() {
-                std::env::set_var("APPWRAP_BRIDGE_PAGE_PORT", "3842");
-            }
-            eprintln!("[bridge-shim] agent browser control ENABLED via opt-in marker");
-        }
-        None => eprintln!("[bridge-shim] opt-in marker present but content.js not found — bridge stays off"),
-    }
-}
-
-pub fn init(app: AppHandle) {
-    let js_path = match std::env::var("APPWRAP_BRIDGE_JS") {
-        Ok(p) if !p.is_empty() => p,
-        _ => return, // feature off
-    };
-    std::thread::spawn(move || loop {
-        match TcpStream::connect(("127.0.0.1", rust_port())) {
-            Ok(stream) => {
-                eprintln!("[bridge-shim] control connected");
-                run(&app, stream, &js_path);
-                eprintln!("[bridge-shim] control disconnected");
-            }
-            Err(_) => {}
-        }
-        std::thread::sleep(Duration::from_secs(1));
-    });
-}
-
-fn run(app: &AppHandle, mut stream: TcpStream, js_path: &str) {
-    let _ = stream.set_read_timeout(Some(Duration::from_millis(50)));
-    let (tx, rx) = channel::<String>();
-    // Publish this connection's sender so sub-window webviews (created outside createWindow) can route
-    // their page beacons here; the guard clears it on ANY return below (disconnect/error).
-    *PAGE_TX.lock().unwrap() = Some(tx.clone());
-    let _tx_guard = PageTxGuard;
-    // Self-heal sub-windows opened BEFORE this connect: their dynamic sink can now deliver, but a
-    // document already loaded won't re-fire its `register` beacon on its own. Nudge every open
-    // sub-window webview to re-post `register` so it (re)appears as a bod-browser tab on this shim.
-    crate::browser_tab::reregister_subwindows(app);
-    let mut acc = String::new();
-    let mut buf = [0u8; 65536];
-    loop {
-        while let Ok(line) = rx.try_recv() {
-            if stream.write_all(line.as_bytes()).and_then(|_| stream.write_all(b"\n")).is_err() {
-                return;
-            }
-        }
-        match stream.read(&mut buf) {
-            Ok(0) => return,
-            Ok(n) => {
-                acc.push_str(&String::from_utf8_lossy(&buf[..n]));
-                while let Some(idx) = acc.find('\n') {
-                    let line = acc[..idx].trim().to_string();
-                    acc.drain(..=idx);
-                    if line.is_empty() { continue; }
-                    match serde_json::from_str::<Value>(&line) {
-                        Ok(v) => handle_op(app, &tx, v, js_path),
-                        Err(e) => eprintln!("[bridge-shim] bad line: {e}"),
-                    }
-                }
-            }
-            Err(e) if matches!(e.kind(), std::io::ErrorKind::WouldBlock | std::io::ErrorKind::TimedOut) => {}
-            Err(_) => return,
-        }
-    }
-}
-
-fn respond(tx: &Sender<String>, id: &str, result: Result<Value, String>) {
-    let msg = match result {
-        Ok(r) => json!({ "id": id, "result": r }),
-        Err(e) => json!({ "id": id, "error": e }),
-    };
-    let _ = tx.send(msg.to_string());
-}
-
-fn handle_op(app: &AppHandle, tx: &Sender<String>, v: Value, js_path: &str) {
-    let id = v["id"].as_str().unwrap_or_default().to_string();
-    let op = v["op"].as_str().unwrap_or_default().to_string();
-    eprintln!("[bridge-shim] op={op} id={id}");
-    let app2 = app.clone();
-    let tx2 = tx.clone();
-    match op.as_str() {
-        "createWindow" => {
-            let label = v["label"].as_str().unwrap_or_default().to_string();
-            let url = v["url"].as_str().unwrap_or("about:blank").to_string();
-            let profile_id = v["profileId"].as_str().unwrap_or_default().to_string();
-            // Re-read the bundle each time — a rebuilt content.js applies to the next window (dev loop).
-            let init_js = match std::fs::read_to_string(js_path) {
-                Ok(bundle) => format!(
-                    "window.__BRIDGE_LABEL={};window.__BRIDGE_PORT={};\n{}",
-                    serde_json::to_string(&label).unwrap(), page_port(), bundle
-                ),
-                Err(e) => { respond(tx, &id, Err(format!("read bundle {js_path}: {e}"))); return; }
-            };
-            // Profile windows take the crate's MANUAL creation path (per-profile persistent store).
-            // Windows without a profileId keep the original tauri path (back-compat).
-            if !profile_id.is_empty() {
-                let idc = id.clone();
-                let init_js2 = init_js.clone();
-                let r = app.run_on_main_thread(move || {
-                    let mtm = MainThreadMarker::new().expect("run_on_main_thread is main");
-                    let res = wv::create_profile_window(mtm, &label, &url, &profile_id, &init_js2, page_sink(tx2.clone()))
-                        .map(|c| json!({ "ok": true, "label": label, "profileId": profile_id, "storeUuid": c.store_uuid, "persistent": c.persistent }));
-                    respond(&tx2, &idc, res);
-                });
-                if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
-                return;
-            }
-            let idc = id.clone();
-            let r = app.run_on_main_thread(move || {
-                let parsed = match tauri::Url::parse(&url) {
-                    Ok(u) => u,
-                    Err(e) => { respond(&tx2, &idc, Err(format!("bad url: {e}"))); return; }
-                };
-                let r = tauri::WebviewWindowBuilder::new(&app2, &label, tauri::WebviewUrl::External(parsed))
-                    .title(&label)
-                    .inner_size(1100.0, 800.0)
-                    // Safari-normalized UA at BUILD time (same constraint as the main window).
-                    .user_agent(crate::popup_mac::SAFARI_UA)
-                    .initialization_script(&init_js)
-                    .build();
-                // Install the page->shim message handler on the fresh webview (main thread), plus the
-                // SAME popup machinery the main window gets (SSO window.open child windows).
-                if let Ok(w) = &r {
-                    let tx4 = tx2.clone();
-                    let _ = w.with_webview(move |pw| unsafe {
-                        crate::popup_mac::install(pw.inner() as _, false);
-                        let mtm = MainThreadMarker::new().expect("with_webview runs on main");
-                        wv::install_message_handler(pw.inner() as *mut WKWebView, mtm, page_sink(tx4));
-                    });
-                }
-                respond(&tx2, &idc, r.map(|_| json!({ "ok": true, "label": label })).map_err(|e| e.to_string()));
-            });
-            if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
-        }
-        "closeWindow" => {
-            let label = v["label"].as_str().unwrap_or_default().to_string();
-            if wv::profile_webview(&label).is_some() {
-                let idc = id.clone();
-                let r = app.run_on_main_thread(move || {
-                    let ok = wv::close(&label);
-                    respond(&tx2, &idc, if ok { Ok(json!({ "ok": true })) } else { Err(format!("no window {label}")) });
-                });
-                if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
-                return;
-            }
-            match app.get_webview_window(&label) {
-                Some(w) => respond(tx, &id, w.close().map(|_| json!({ "ok": true })).map_err(|e| e.to_string())),
-                None => respond(tx, &id, Err(format!("no window {label}"))),
-            }
-        }
-        "navigate" => {
-            let label = v["label"].as_str().unwrap_or_default().to_string();
-            let url = v["url"].as_str().unwrap_or_default().to_string();
-            let idc = id.clone();
-            let r = app.run_on_main_thread(move || {
-                if let Some(wk) = wv::profile_webview(&label) {
-                    let res = unsafe { wv::navigate(Retained::as_ptr(&wk) as *mut WKWebView, &url) };
-                    respond(&tx2, &idc, res.map(|_| json!({ "ok": true })));
-                    return;
-                }
-                let parsed = match tauri::Url::parse(&url) {
-                    Ok(u) => u,
-                    Err(e) => { respond(&tx2, &idc, Err(format!("bad url: {e}"))); return; }
-                };
-                match app2.get_webview_window(&label) {
-                    Some(w) => respond(&tx2, &idc, w.navigate(parsed).map(|_| json!({ "ok": true })).map_err(|e| e.to_string())),
-                    None => respond(&tx2, &idc, Err(format!("no window {label}"))),
-                }
-            });
-            if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
-        }
-        "screenshot" => {
-            let label = v["label"].as_str().unwrap_or_default().to_string();
-            let idc = id.clone();
-            let r = app.run_on_main_thread(move || {
-                if let Some(wk) = wv::profile_webview(&label) {
-                    let tx3 = tx2.clone();
-                    let id2 = idc.clone();
-                    unsafe { wv::snapshot(Retained::as_ptr(&wk) as *mut WKWebView, move |r| respond_png(&tx3, &id2, r)) };
-                    return;
-                }
-                let Some(w) = app2.get_webview_window(&label) else {
-                    respond(&tx2, &idc, Err(format!("no window {label}")));
-                    return;
-                };
-                let tx3 = tx2.clone();
-                let id2 = idc.clone();
-                let r = w.with_webview(move |pw| unsafe {
-                    wv::snapshot(pw.inner() as *mut WKWebView, move |r| respond_png(&tx3, &id2, r))
-                });
-                if let Err(e) = r { respond(&tx2, &idc, Err(e.to_string())); }
-            });
-            if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
-        }
-        "evalJs" => {
-            // Fire-and-forget JS injection into a window (debug aid + transport fallback probe).
-            let label = v["label"].as_str().unwrap_or_default().to_string();
-            let js = v["js"].as_str().unwrap_or_default().to_string();
-            if wv::profile_webview(&label).is_some() {
-                let idc = id.clone();
-                let r = app.run_on_main_thread(move || {
-                    if let Some(wk) = wv::profile_webview(&label) {
-                        unsafe { wv::inject_script(Retained::as_ptr(&wk) as *mut WKWebView, &js) };
-                        respond(&tx2, &idc, Ok(json!({ "ok": true })));
-                    } else {
-                        respond(&tx2, &idc, Err(format!("no window {label}")));
-                    }
-                });
-                if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
-                return;
-            }
-            match app.get_webview_window(&label) {
-                Some(w) => respond(tx, &id, w.eval(&js).map(|_| json!({ "ok": true })).map_err(|e| e.to_string())),
-                None => respond(tx, &id, Err(format!("no window {label}"))),
-            }
-        }
-        "evalAsync" => {
-            // CSP-immune eval with a real (awaited) return value — callAsyncJavaScript. `js` is a
-            // FUNCTION BODY (use `return`). The crate delivers the RAW return string; we frame {json}.
-            let label = v["label"].as_str().unwrap_or_default().to_string();
-            let js = v["js"].as_str().unwrap_or_default().to_string();
-            let idc = id.clone();
-            let r = app.run_on_main_thread(move || {
-                if let Some(wk) = wv::profile_webview(&label) {
-                    let tx3 = tx2.clone();
-                    let id2 = idc.clone();
-                    unsafe { wv::eval_async(Retained::as_ptr(&wk) as *mut WKWebView, js.clone(), move |r| respond_eval(&tx3, &id2, r)) };
-                    return;
-                }
-                let Some(w) = app2.get_webview_window(&label) else {
-                    respond(&tx2, &idc, Err(format!("no window {label}")));
-                    return;
-                };
-                let tx3 = tx2.clone();
-                let id2 = idc.clone();
-                let js2 = js.clone();
-                let r = w.with_webview(move |pw| unsafe {
-                    wv::eval_async(pw.inner() as *mut WKWebView, js2, move |r| respond_eval(&tx3, &id2, r));
-                });
-                if let Err(e) = r { respond(&tx2, &idc, Err(e.to_string())); }
-            });
-            if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
-        }
-        "userClose" => {
-            // Verification aid: drive the red-button path WITHOUT touching the registry, so the
-            // windowWillClose delegate is the sole remover — proves user-close hygiene headlessly.
-            let label = v["label"].as_str().unwrap_or_default().to_string();
-            let idc = id.clone();
-            let r = app.run_on_main_thread(move || {
-                let ok = wv::user_close(&label);
-                respond(&tx2, &idc, if ok { Ok(json!({ "ok": true })) } else { Err(format!("no window {label}")) });
-            });
-            if let Err(e) = r { respond(tx, &id, Err(e.to_string())); }
-        }
-        "listWindows" => {
-            // Closed windows are filtered by the crate; actual reaping (which drops objc objects) is
-            // deferred to createWindow, which runs on the main thread.
-            let mut labels: Vec<String> = app.webview_windows().keys().cloned().collect();
-            let profiles: Vec<Value> = wv::list_webviews()
-                .into_iter()
-                .map(|info| {
-                    labels.push(info.label.clone());
-                    json!({ "label": info.label, "profileId": info.profile_id })
-                })
-                .collect();
-            respond(tx, &id, Ok(json!({ "labels": labels, "profiles": profiles })));
-        }
-        _ => respond(tx, &id, Err(format!("unknown op: {op}"))),
-    }
-}
-
-/// Frame a RAW eval return string into the {json} envelope the shim reads (`r.json`).
-fn respond_eval(tx: &Sender<String>, id: &str, r: Result<String, String>) {
-    respond(tx, id, r.map(|out| json!({ "json": out })));
-}
-
-/// Base64-encode the crate's RAW PNG bytes and frame into the {png} envelope.
-fn respond_png(tx: &Sender<String>, id: &str, r: Result<Vec<u8>, String>) {
-    respond(tx, id, r.map(|bytes| json!({ "png": base64::engine::general_purpose::STANDARD.encode(bytes) })));
-}