@livx.cc/appwrap 0.61.21 → 0.61.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.61.21",
+  "version": "0.61.23",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime/app/shell/handlers-webview.ts

@@ -2,6 +2,7 @@ import { Utils, isIOS, isAndroid, Application } from '@nativescript/core';
 import { bridge } from './bridge';
 import { createUiDelegate } from './ios-ui-delegate';
 import { handleWebPermissionRequest } from './android-helpers';
+import { SHELL_CONFIG } from './config';
 
 const err = (code: string, message: string) => Object.assign(new Error(message), { code });
 
@@ -20,6 +21,13 @@ const KVO_KEYS = ['URL', 'title', 'canGoBack', 'canGoForward', 'loading'];
  *   webview.close                               — tear down; emits `webview.closed`
  *   webview.cookies {cookies: Cookie[]}         — write cookies into the overlay's (persistent) jar; resolves {set}
  *                                                 once all are stored (Bare Remote's opt-in "sign in like the Mac")
+ *   webview.snapshot {width?, quality?}         — what the overlay shows now as a JPEG ~`width` px wide (default 360,
+ *                                                 quality 0.6); resolves {jpeg: base64, width, height}. Must run while
+ *                                                 it is still shown (take it before hide/close).
+ *   webview.eval {js, world?}                   — run `js` (an ASYNC function body: may `await`, `return`s the result) in the
+ *                                                 overlay's page; resolves {result} (the returned value, JSON round-tripped).
+ *                                                 `world` = a named isolated JS world (iOS; Android has one world). The
+ *                                                 hub's own (trusted) origin only — never in bridge-origin's FOREIGN_ALLOWED.
  * Events: `webview.state` {url,title,canGoBack,canGoForward,loading} on every navigation change.
  *
  * Swipe back/forward on, target=_blank/window.open loads in place (shared ios-ui-delegate), keyboard +
@@ -36,6 +44,22 @@ const cookieList = (p: { cookies?: Cookie[] } | null): Cookie[] => {
   return l.filter((c) => c && c.name && c.domain);
 };
 
+/** webview.eval: the page side wraps the body so any value crosses as JSON (undefined → null). */
+const evalBody = (js: string) => `const __v = await (async () => { ${js}\n })(); return JSON.stringify(__v === undefined ? null : __v);`;
+const evalJs = (p?: { js?: string } | null) => {
+  const js = String(p?.js ?? '');
+  if (!js) throw err('NATIVE_ERROR', 'webview.eval: empty js');
+  return js;
+};
+const parsed = (s: unknown) => { try { return JSON.parse(String(s)); } catch { return s ?? null; } };
+const EVAL_TIMEOUT = 30000;
+
+/** webview.snapshot params → target pixel width (clamped) + JPEG quality 0..1. */
+const snapOpts = (p?: { width?: number; quality?: number } | null) => ({
+  width: Math.round(Math.min(1024, Math.max(64, Number(p?.width) || 360))),
+  quality: Math.min(1, Math.max(0.1, Number(p?.quality) || 0.6)),
+});
+
 export function registerWebViewHandlers(): void {
   if (isIOS) registerIos();
   else if (isAndroid) registerAndroid();
@@ -171,6 +195,32 @@ function registerIos(): void {
   }));
   bridge.register('webview.close', () => onMain(() => { destroy(); }));
 
+  bridge.register('webview.snapshot', (p?: { width?: number; quality?: number } | null) => {
+    const o = snapOpts(p);
+    return onMain(() => new Promise<{ jpeg: string; width: number; height: number }>((resolve, reject) => {
+      if (!wv || wv.hidden) return reject(err('NATIVE_ERROR', 'webview.snapshot: not shown'));
+      const cfg = WKSnapshotConfiguration.new();
+      cfg.snapshotWidth = o.width / (UIScreen.mainScreen.scale || 1) as any; // points; the image comes at screen scale
+      wv.takeSnapshotWithConfigurationCompletionHandler(cfg, (img: UIImage, e: NSError) => {
+        const data = img && UIImageJPEGRepresentation(img, o.quality);
+        if (!data) return reject(err('NATIVE_ERROR', `webview.snapshot: ${e?.localizedDescription || 'no image'}`));
+        resolve({ jpeg: data.base64EncodedStringWithOptions(0 as any), width: Math.round(img.size.width * img.scale), height: Math.round(img.size.height * img.scale) });
+      });
+    }));
+  });
+
+  bridge.register('webview.eval', (p?: { js?: string; world?: string } | null) => {
+    const js = evalJs(p);
+    return onMain(() => new Promise<{ result: unknown }>((resolve, reject) => {
+      if (!wv) return reject(err('NATIVE_ERROR', 'webview.eval: not open'));
+      const world = p?.world ? WKContentWorld.worldWithName(String(p.world)) : WKContentWorld.pageWorld;
+      wv.callAsyncJavaScriptArgumentsInFrameInContentWorldCompletionHandler(evalBody(js), null, null, world, (v: any, e: NSError) => {
+        if (e) return reject(err('NATIVE_ERROR', `webview.eval: ${e.userInfo?.objectForKey('WKJavaScriptExceptionMessage') || e.localizedDescription}`));
+        resolve({ result: parsed(v) });
+      });
+    }));
+  });
+
   bridge.register('webview.cookies', (p: { cookies?: Cookie[] } | null) => {
     const list = cookieList(p);
     return onMain(() => new Promise<{ set: number }>((resolve) => {
@@ -274,7 +324,7 @@ function registerAndroid(): void {
     (view as any)._appwrapClients = [client, chrome]; // keep JS peers alive (NS GC doesn't see the native hold)
     const bg = host?.getBackground?.();
     if (bg instanceof android.graphics.drawable.ColorDrawable) view.setBackgroundColor(bg.getColor());
-    android.webkit.WebView.setWebContentsDebuggingEnabled(true);
+    if (SHELL_CONFIG.debug) android.webkit.WebView.setWebContentsDebuggingEnabled(true); // remote DevTools only in debug builds, never store builds
     wv = view;
     frame.addView(view);
     layout();
@@ -338,6 +388,50 @@ function registerAndroid(): void {
   }));
   bridge.register('webview.close', () => onMain(() => { destroy(); }));
 
+  bridge.register('webview.snapshot', (p?: { width?: number; quality?: number } | null) => {
+    const o = snapOpts(p);
+    return onMain(() => {
+      if (!wv || wv.getVisibility() !== android.view.View.VISIBLE || !wv.getWidth() || !wv.getHeight()) throw err('NATIVE_ERROR', 'webview.snapshot: not shown');
+      const s = o.width / wv.getWidth(), h = Math.max(1, Math.round(wv.getHeight() * s));
+      const bmp = android.graphics.Bitmap.createBitmap(o.width, h, android.graphics.Bitmap.Config.ARGB_8888);
+      const c = new android.graphics.Canvas(bmp);
+      c.scale(s, s);
+      c.translate(-wv.getScrollX(), -wv.getScrollY()); // draw() paints from the content origin
+      wv.draw(c);
+      const out = new java.io.ByteArrayOutputStream();
+      bmp.compress(android.graphics.Bitmap.CompressFormat.JPEG, Math.round(o.quality * 100), out);
+      bmp.recycle();
+      return { jpeg: android.util.Base64.encodeToString(out.toByteArray(), android.util.Base64.NO_WRAP), width: o.width, height: h };
+    });
+  });
+
+  // evaluateJavascript can't await: start the async body under an id, then poll its slot until it settles.
+  let evalSeq = 0;
+  bridge.register('webview.eval', (p?: { js?: string } | null) => {
+    const js = evalJs(p), id = ++evalSeq, slot = `(window.__awEval||(window.__awEval={}))`;
+    const start = `(function(){var s=${slot};(async()=>{ ${evalBody(js)}\n })().then(function(v){s[${id}]={v:v}},function(e){s[${id}]={e:String(e&&e.message||e)}});return 1})()`;
+    const poll = `(function(){var s=window.__awEval,r=s&&s[${id}];if(r)delete s[${id}];return r?JSON.stringify(r):''})()`;
+    const run = (code: string) => onMain(() => new Promise<string>((resolve, reject) => {
+      if (!wv) return reject(err('NATIVE_ERROR', 'webview.eval: not open'));
+      wv.evaluateJavascript(code, new android.webkit.ValueCallback({ onReceiveValue: (v: string) => resolve(parsed(v) as string) }));
+    }));
+    const end = Date.now() + EVAL_TIMEOUT;
+    // Each native call races the deadline: a torn-down overlay never answers its callback.
+    const timed = (code: string) => Promise.race([run(code), new Promise<string>((_, rej) => setTimeout(() => rej(err('NATIVE_ERROR', 'webview.eval: timed out (or the page navigated)')), Math.max(0, end - Date.now())))]);
+    return (async () => {
+      // The start script answers 1 once it runs; anything else = it didn't parse (a syntax error never settles a slot).
+      if (String(await timed(start)) !== '1') throw err('NATIVE_ERROR', 'webview.eval: syntax error');
+      for (; Date.now() < end; await new Promise((r) => setTimeout(r, 50))) {
+        const r = await timed(poll);
+        if (!r) continue;
+        const o = JSON.parse(r);
+        if ('e' in o) throw err('NATIVE_ERROR', `webview.eval: ${o.e}`);
+        return { result: parsed(o.v) };
+      }
+      throw err('NATIVE_ERROR', 'webview.eval: timed out (or the page navigated)');
+    })();
+  });
+
   bridge.register('webview.cookies', (p: { cookies?: Cookie[] } | null) => {
     const list = cookieList(p);
     return onMain(() => new Promise<{ set: number }>((resolve) => {

package/runtime/tests/bridge-origin.test.ts

@@ -34,7 +34,7 @@ describe('Bridge origin gate — a foreign page must not reach the app’s store
   });
 
   test('a foreign page (a LAN/Tailscale server) is FORBIDDEN storage.secure, fs, webview cookies', async () => {
-    for (const m of ['storage.secure.get', 'storage.get', 'fs.read', 'webview.getCookies', 'clipboard.read', 'share.files']) {
+    for (const m of ['storage.secure.get', 'storage.get', 'fs.read', 'webview.getCookies', 'webview.eval', 'webview.snapshot', 'clipboard.read', 'share.files']) {
       const r = await call(m, 'http://192.168.1.5:7707');
       expect(r.result).toBeUndefined();
       expect(r.error.code).toBe('FORBIDDEN');