@livx.cc/appwrap 0.61.22 → 0.61.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.61.22",
+  "version": "0.61.24",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime/app/shell/bridge-origin.ts

@@ -29,6 +29,8 @@ export function isTrustedOrigin(origin: string | null | undefined): boolean {
   const o = originOf(origin);
   if (!o) return false;
   if (o === 'app://localhost' || (SHELL_CONFIG.loader === 'file' && o === 'file://')) return true;
+  // Android serves the bundle from https://appwrap.local (custom-webview.android APP_ORIGIN, intercepted in-process).
+  if (SHELL_CONFIG.loader !== 'server' && SHELL_CONFIG.loader !== 'file' && o === 'https://appwrap.local') return true;
   if (SHELL_CONFIG.loader === 'server' && o === originOf(effectiveServerUrl())) return true;
   return (SHELL_CONFIG.appBoundDomains ?? []).some((h) => o === `https://${String(h).toLowerCase()}`);
 }

package/runtime/app/shell/custom-webview.android.ts

@@ -6,6 +6,7 @@ import { envGlobalsJs } from './env';
 import { handleWebPermissionRequest } from './android-helpers';
 import { showFileChooser } from './file-chooser.android';
 import { hostOf } from './env-switcher';
+import { TRANSPORT_SHIM, PROMPT_PREFIX, CHUNK_PREFIX, takeChunk } from './prompt-transport';
 
 // `android` + `java` resolve to the real types-android namespaces (no declare needed).
 declare const androidx: any; // no NS types: androidx.webkit.* (WebViewFeature/WebViewCompat) not in the android-32 platform typings
@@ -13,18 +14,7 @@ declare const androidx: any; // no NS types: androidx.webkit.* (WebViewFeature/W
 /** Stable in-app origin — secure context, ES modules work (file:// blocks them). */
 export const APP_ORIGIN = 'https://appwrap.local';
 
-/**
- * Web→native transport shim. postMessage tunnels through window.prompt(), which
- * the shell intercepts synchronously in WebChromeClient.onJsPrompt — no compiled
- * @JavascriptInterface class, no polling. Injected at document start (androidx.webkit)
- * with an onPageStarted fallback; the guard makes double-injection a no-op.
- */
-const TRANSPORT_SHIM = `(function(){
-  if (window.appwrapNative) return;
-  window.appwrapNative = { postMessage: function(json){ window.prompt('__appwrap__:' + json); } };
-})();`;
-
-const PROMPT_PREFIX = '__appwrap__:';
+// Web→native transport (prompt() tunnel, chunked past Chromium's ~10K prompt cap): ./prompt-transport.
 
 /** Document-start scripts: env hints + framework globals (backend origin) + bridge transport +
  * native-feel. Globals first so the page can read __APPWRAP__ / __APPWRAP_BACKEND_ORIGIN__ before its
@@ -60,6 +50,12 @@ function getChromeClientClass(): any {
         CustomWebView.forNative(view)?.onAppwrapMessage?.(message.slice(PROMPT_PREFIX.length), url);
         return true;
       }
+      if (typeof message === 'string' && message.startsWith(CHUNK_PREFIX)) {
+        result.confirm('');
+        const json = takeChunk(message.slice(CHUNK_PREFIX.length), url);
+        if (json !== null) CustomWebView.forNative(view)?.onAppwrapMessage?.(json, url);
+        return true;
+      }
       return false; // genuine page prompt — default handling
     },
 
@@ -152,6 +148,10 @@ export class CustomWebView extends WebView {
     settings.setDomStorageEnabled(true);
     settings.setAllowFileAccess(true);
     settings.setMediaPlaybackRequiresUserGesture(false); // speaker: autoplay allowed
+    // The bundle runs at https://appwrap.local, so Chromium blocks its fetch/XHR/ws to plain-http hosts as mixed
+    // content — iOS's app:// origin is not https and never hits this. Parity: a bundled app may talk to http LAN
+    // hosts (cleartext is already allowed in the manifest); a server-loaded page keeps the default block.
+    if (SHELL_CONFIG.loader !== 'server' && SHELL_CONFIG.loader !== 'file') settings.setMixedContentMode(android.webkit.WebSettings.MIXED_CONTENT_ALWAYS_ALLOW);
     // Native feel: no pinch-zoom controls.
     settings.setSupportZoom(false);
     settings.setBuiltInZoomControls(false);

package/runtime/app/shell/handlers-webview.ts

@@ -21,6 +21,13 @@ const KVO_KEYS = ['URL', 'title', 'canGoBack', 'canGoForward', 'loading'];
  *   webview.close                               — tear down; emits `webview.closed`
  *   webview.cookies {cookies: Cookie[]}         — write cookies into the overlay's (persistent) jar; resolves {set}
  *                                                 once all are stored (Bare Remote's opt-in "sign in like the Mac")
+ *   webview.snapshot {width?, quality?}         — what the overlay shows now as a JPEG ~`width` px wide (default 360,
+ *                                                 quality 0.6); resolves {jpeg: base64, width, height}. Must run while
+ *                                                 it is still shown (take it before hide/close).
+ *   webview.eval {js, world?}                   — run `js` (an ASYNC function body: may `await`, `return`s the result) in the
+ *                                                 overlay's page; resolves {result} (the returned value, JSON round-tripped).
+ *                                                 `world` = a named isolated JS world (iOS; Android has one world). The
+ *                                                 hub's own (trusted) origin only — never in bridge-origin's FOREIGN_ALLOWED.
  * Events: `webview.state` {url,title,canGoBack,canGoForward,loading} on every navigation change.
  *
  * Swipe back/forward on, target=_blank/window.open loads in place (shared ios-ui-delegate), keyboard +
@@ -37,6 +44,22 @@ const cookieList = (p: { cookies?: Cookie[] } | null): Cookie[] => {
   return l.filter((c) => c && c.name && c.domain);
 };
 
+/** webview.eval: the page side wraps the body so any value crosses as JSON (undefined → null). */
+const evalBody = (js: string) => `const __v = await (async () => { ${js}\n })(); return JSON.stringify(__v === undefined ? null : __v);`;
+const evalJs = (p?: { js?: string } | null) => {
+  const js = String(p?.js ?? '');
+  if (!js) throw err('NATIVE_ERROR', 'webview.eval: empty js');
+  return js;
+};
+const parsed = (s: unknown) => { try { return JSON.parse(String(s)); } catch { return s ?? null; } };
+const EVAL_TIMEOUT = 30000;
+
+/** webview.snapshot params → target pixel width (clamped) + JPEG quality 0..1. */
+const snapOpts = (p?: { width?: number; quality?: number } | null) => ({
+  width: Math.round(Math.min(1024, Math.max(64, Number(p?.width) || 360))),
+  quality: Math.min(1, Math.max(0.1, Number(p?.quality) || 0.6)),
+});
+
 export function registerWebViewHandlers(): void {
   if (isIOS) registerIos();
   else if (isAndroid) registerAndroid();
@@ -172,6 +195,32 @@ function registerIos(): void {
   }));
   bridge.register('webview.close', () => onMain(() => { destroy(); }));
 
+  bridge.register('webview.snapshot', (p?: { width?: number; quality?: number } | null) => {
+    const o = snapOpts(p);
+    return onMain(() => new Promise<{ jpeg: string; width: number; height: number }>((resolve, reject) => {
+      if (!wv || wv.hidden) return reject(err('NATIVE_ERROR', 'webview.snapshot: not shown'));
+      const cfg = WKSnapshotConfiguration.new();
+      cfg.snapshotWidth = o.width / (UIScreen.mainScreen.scale || 1) as any; // points; the image comes at screen scale
+      wv.takeSnapshotWithConfigurationCompletionHandler(cfg, (img: UIImage, e: NSError) => {
+        const data = img && UIImageJPEGRepresentation(img, o.quality);
+        if (!data) return reject(err('NATIVE_ERROR', `webview.snapshot: ${e?.localizedDescription || 'no image'}`));
+        resolve({ jpeg: data.base64EncodedStringWithOptions(0 as any), width: Math.round(img.size.width * img.scale), height: Math.round(img.size.height * img.scale) });
+      });
+    }));
+  });
+
+  bridge.register('webview.eval', (p?: { js?: string; world?: string } | null) => {
+    const js = evalJs(p);
+    return onMain(() => new Promise<{ result: unknown }>((resolve, reject) => {
+      if (!wv) return reject(err('NATIVE_ERROR', 'webview.eval: not open'));
+      const world = p?.world ? WKContentWorld.worldWithName(String(p.world)) : WKContentWorld.pageWorld;
+      wv.callAsyncJavaScriptArgumentsInFrameInContentWorldCompletionHandler(evalBody(js), null, null, world, (v: any, e: NSError) => {
+        if (e) return reject(err('NATIVE_ERROR', `webview.eval: ${e.userInfo?.objectForKey('WKJavaScriptExceptionMessage') || e.localizedDescription}`));
+        resolve({ result: parsed(v) });
+      });
+    }));
+  });
+
   bridge.register('webview.cookies', (p: { cookies?: Cookie[] } | null) => {
     const list = cookieList(p);
     return onMain(() => new Promise<{ set: number }>((resolve) => {
@@ -339,6 +388,50 @@ function registerAndroid(): void {
   }));
   bridge.register('webview.close', () => onMain(() => { destroy(); }));
 
+  bridge.register('webview.snapshot', (p?: { width?: number; quality?: number } | null) => {
+    const o = snapOpts(p);
+    return onMain(() => {
+      if (!wv || wv.getVisibility() !== android.view.View.VISIBLE || !wv.getWidth() || !wv.getHeight()) throw err('NATIVE_ERROR', 'webview.snapshot: not shown');
+      const s = o.width / wv.getWidth(), h = Math.max(1, Math.round(wv.getHeight() * s));
+      const bmp = android.graphics.Bitmap.createBitmap(o.width, h, android.graphics.Bitmap.Config.ARGB_8888);
+      const c = new android.graphics.Canvas(bmp);
+      c.scale(s, s);
+      c.translate(-wv.getScrollX(), -wv.getScrollY()); // draw() paints from the content origin
+      wv.draw(c);
+      const out = new java.io.ByteArrayOutputStream();
+      bmp.compress(android.graphics.Bitmap.CompressFormat.JPEG, Math.round(o.quality * 100), out);
+      bmp.recycle();
+      return { jpeg: android.util.Base64.encodeToString(out.toByteArray(), android.util.Base64.NO_WRAP), width: o.width, height: h };
+    });
+  });
+
+  // evaluateJavascript can't await: start the async body under an id, then poll its slot until it settles.
+  let evalSeq = 0;
+  bridge.register('webview.eval', (p?: { js?: string } | null) => {
+    const js = evalJs(p), id = ++evalSeq, slot = `(window.__awEval||(window.__awEval={}))`;
+    const start = `(function(){var s=${slot};(async()=>{ ${evalBody(js)}\n })().then(function(v){s[${id}]={v:v}},function(e){s[${id}]={e:String(e&&e.message||e)}});return 1})()`;
+    const poll = `(function(){var s=window.__awEval,r=s&&s[${id}];if(r)delete s[${id}];return r?JSON.stringify(r):''})()`;
+    const run = (code: string) => onMain(() => new Promise<string>((resolve, reject) => {
+      if (!wv) return reject(err('NATIVE_ERROR', 'webview.eval: not open'));
+      wv.evaluateJavascript(code, new android.webkit.ValueCallback({ onReceiveValue: (v: string) => resolve(parsed(v) as string) }));
+    }));
+    const end = Date.now() + EVAL_TIMEOUT;
+    // Each native call races the deadline: a torn-down overlay never answers its callback.
+    const timed = (code: string) => Promise.race([run(code), new Promise<string>((_, rej) => setTimeout(() => rej(err('NATIVE_ERROR', 'webview.eval: timed out (or the page navigated)')), Math.max(0, end - Date.now())))]);
+    return (async () => {
+      // The start script answers 1 once it runs; anything else = it didn't parse (a syntax error never settles a slot).
+      if (String(await timed(start)) !== '1') throw err('NATIVE_ERROR', 'webview.eval: syntax error');
+      for (; Date.now() < end; await new Promise((r) => setTimeout(r, 50))) {
+        const r = await timed(poll);
+        if (!r) continue;
+        const o = JSON.parse(r);
+        if ('e' in o) throw err('NATIVE_ERROR', `webview.eval: ${o.e}`);
+        return { result: parsed(o.v) };
+      }
+      throw err('NATIVE_ERROR', 'webview.eval: timed out (or the page navigated)');
+    })();
+  });
+
   bridge.register('webview.cookies', (p: { cookies?: Cookie[] } | null) => {
     const list = cookieList(p);
     return onMain(() => new Promise<{ set: number }>((resolve) => {

package/runtime/app/shell/prompt-transport.ts

@@ -0,0 +1,37 @@
+/**
+ * Android web→native transport over window.prompt(). Chromium truncates a prompt() message at ~10K chars
+ * (device-measured: a 10.1K envelope arrives, 10.3K arrives cut → unparseable → the call hangs to its timeout),
+ * so an envelope longer than CHUNK goes as numbered parts `__appwrapc__:<id>:<i>:<n>:<part>`, reassembled here.
+ */
+export const PROMPT_PREFIX = '__appwrap__:';
+export const CHUNK_PREFIX = '__appwrapc__:';
+const CHUNK = 8000;
+
+/** Injected at document start; the guard makes double-injection a no-op. Never splits a surrogate pair. */
+export const TRANSPORT_SHIM = `(function(){
+  if (window.appwrapNative) return;
+  var seq = 0;
+  window.appwrapNative = { postMessage: function(json){
+    if (json.length <= ${CHUNK}) return window.prompt('${PROMPT_PREFIX}' + json);
+    var parts = [], i = 0;
+    while (i < json.length) { var e = Math.min(json.length, i + ${CHUNK}); var c = json.charCodeAt(e - 1); if (e < json.length && c >= 0xD800 && c <= 0xDBFF) e--; parts.push(json.slice(i, e)); i = e; }
+    var id = (++seq) + Math.random().toString(36).slice(2);
+    for (var k = 0; k < parts.length; k++) window.prompt('${CHUNK_PREFIX}' + id + ':' + k + ':' + parts.length + ':' + parts[k]);
+  } };
+})();`;
+
+const pending = new Map<string, { url: string; parts: string[]; got: number }>();
+
+/** One chunk in; the whole envelope out once its last part lands (all parts must come from the same page url). */
+export function takeChunk(message: string, url: string): string | null {
+  const m = /^([^:]+):(\d+):(\d+):/.exec(message);
+  if (!m) return null;
+  const [head, id, i, n] = [m[0], m[1], +m[2], +m[3]];
+  let p = pending.get(id);
+  if (!p) { if (pending.size > 32) pending.clear(); p = { url, parts: new Array(n), got: 0 }; pending.set(id, p); }
+  if (p.url !== url || i >= p.parts.length || p.parts[i] !== undefined) { pending.delete(id); return null; }
+  p.parts[i] = message.slice(head.length);
+  if (++p.got < p.parts.length) return null;
+  pending.delete(id);
+  return p.parts.join('');
+}

package/runtime/tests/bridge-origin.test.ts

@@ -34,7 +34,7 @@ describe('Bridge origin gate — a foreign page must not reach the app’s store
   });
 
   test('a foreign page (a LAN/Tailscale server) is FORBIDDEN storage.secure, fs, webview cookies', async () => {
-    for (const m of ['storage.secure.get', 'storage.get', 'fs.read', 'webview.getCookies', 'clipboard.read', 'share.files']) {
+    for (const m of ['storage.secure.get', 'storage.get', 'fs.read', 'webview.getCookies', 'webview.eval', 'webview.snapshot', 'clipboard.read', 'share.files']) {
       const r = await call(m, 'http://192.168.1.5:7707');
       expect(r.result).toBeUndefined();
       expect(r.error.code).toBe('FORBIDDEN');
@@ -60,6 +60,17 @@ describe('Bridge origin gate — a foreign page must not reach the app’s store
     } finally { Object.assign(SHELL_CONFIG, prev); }
   });
 
+  test('Android bundle origin (https://appwrap.local) is trusted for a bundled loader, not for server', () => {
+    const prev = { loader: SHELL_CONFIG.loader, serverUrl: SHELL_CONFIG.serverUrl };
+    try {
+      Object.assign(SHELL_CONFIG, { loader: 'app' });
+      expect(bridgeAllows('https://appwrap.local/index.html', 'webview.eval')).toBe(true);
+      expect(bridgeAllows('https://appwrap.local.evil.io', 'webview.eval')).toBe(false);
+      Object.assign(SHELL_CONFIG, { loader: 'server', serverUrl: 'https://app.example.com' });
+      expect(bridgeAllows('https://appwrap.local', 'webview.eval')).toBe(false);
+    } finally { Object.assign(SHELL_CONFIG, prev); }
+  });
+
   test('originOf normalises', () => {
     expect(originOf('HTTP://U:p@Host:80/a?b#c')).toBe('http://host');
     expect(originOf('app://localhost/index.html')).toBe('app://localhost');

package/runtime/tests/prompt-transport.test.ts

@@ -0,0 +1,39 @@
+import { describe, test, expect } from 'bun:test';
+import { TRANSPORT_SHIM, PROMPT_PREFIX, CHUNK_PREFIX, takeChunk } from '../app/shell/prompt-transport';
+
+/** Run the shim against a fake window; returns what native's onJsPrompt would see. */
+const send = (json: string) => {
+  const prompts: string[] = [];
+  const window: any = { prompt: (m: string) => { prompts.push(m); } };
+  new Function('window', TRANSPORT_SHIM)(window);
+  window.appwrapNative.postMessage(json);
+  return prompts;
+};
+const deliver = (prompts: string[], url = 'https://appwrap.local/') => {
+  const out: string[] = [];
+  for (const m of prompts) {
+    if (m.startsWith(PROMPT_PREFIX)) out.push(m.slice(PROMPT_PREFIX.length));
+    else { const j = takeChunk(m.slice(CHUNK_PREFIX.length), url); if (j !== null) out.push(j); }
+  }
+  return out;
+};
+
+describe('prompt transport', () => {
+  test('a small envelope is one prompt', () => {
+    const p = send('{"a":1}');
+    expect(p).toEqual([PROMPT_PREFIX + '{"a":1}']);
+  });
+  test('a large envelope is chunked under the ~10K prompt cap and reassembled exactly (surrogates intact)', () => {
+    const json = JSON.stringify({ js: 'x'.repeat(7999) + '😀'.repeat(5000) + 'tail' });
+    const p = send(json);
+    expect(p.length).toBeGreaterThan(1);
+    for (const m of p) expect(m.length).toBeLessThan(10000);
+    for (const m of p) expect(/[\uD800-\uDBFF]$/.test(m)).toBe(false);
+    expect(deliver(p)).toEqual([json]);
+  });
+  test('parts from a different page url are dropped', () => {
+    const p = send('y'.repeat(20000));
+    const out: (string | null)[] = p.map((m, i) => takeChunk(m.slice(CHUNK_PREFIX.length), i ? 'https://evil.example/' : 'https://appwrap.local/'));
+    expect(out.every((x) => x === null)).toBe(true);
+  });
+});