@livx.cc/appwrap 0.61.23 → 0.61.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.61.23",
+  "version": "0.61.24",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime/app/shell/bridge-origin.ts

@@ -29,6 +29,8 @@ export function isTrustedOrigin(origin: string | null | undefined): boolean {
   const o = originOf(origin);
   if (!o) return false;
   if (o === 'app://localhost' || (SHELL_CONFIG.loader === 'file' && o === 'file://')) return true;
+  // Android serves the bundle from https://appwrap.local (custom-webview.android APP_ORIGIN, intercepted in-process).
+  if (SHELL_CONFIG.loader !== 'server' && SHELL_CONFIG.loader !== 'file' && o === 'https://appwrap.local') return true;
   if (SHELL_CONFIG.loader === 'server' && o === originOf(effectiveServerUrl())) return true;
   return (SHELL_CONFIG.appBoundDomains ?? []).some((h) => o === `https://${String(h).toLowerCase()}`);
 }

package/runtime/app/shell/custom-webview.android.ts

@@ -6,6 +6,7 @@ import { envGlobalsJs } from './env';
 import { handleWebPermissionRequest } from './android-helpers';
 import { showFileChooser } from './file-chooser.android';
 import { hostOf } from './env-switcher';
+import { TRANSPORT_SHIM, PROMPT_PREFIX, CHUNK_PREFIX, takeChunk } from './prompt-transport';
 
 // `android` + `java` resolve to the real types-android namespaces (no declare needed).
 declare const androidx: any; // no NS types: androidx.webkit.* (WebViewFeature/WebViewCompat) not in the android-32 platform typings
@@ -13,18 +14,7 @@ declare const androidx: any; // no NS types: androidx.webkit.* (WebViewFeature/W
 /** Stable in-app origin — secure context, ES modules work (file:// blocks them). */
 export const APP_ORIGIN = 'https://appwrap.local';
 
-/**
- * Web→native transport shim. postMessage tunnels through window.prompt(), which
- * the shell intercepts synchronously in WebChromeClient.onJsPrompt — no compiled
- * @JavascriptInterface class, no polling. Injected at document start (androidx.webkit)
- * with an onPageStarted fallback; the guard makes double-injection a no-op.
- */
-const TRANSPORT_SHIM = `(function(){
-  if (window.appwrapNative) return;
-  window.appwrapNative = { postMessage: function(json){ window.prompt('__appwrap__:' + json); } };
-})();`;
-
-const PROMPT_PREFIX = '__appwrap__:';
+// Web→native transport (prompt() tunnel, chunked past Chromium's ~10K prompt cap): ./prompt-transport.
 
 /** Document-start scripts: env hints + framework globals (backend origin) + bridge transport +
  * native-feel. Globals first so the page can read __APPWRAP__ / __APPWRAP_BACKEND_ORIGIN__ before its
@@ -60,6 +50,12 @@ function getChromeClientClass(): any {
         CustomWebView.forNative(view)?.onAppwrapMessage?.(message.slice(PROMPT_PREFIX.length), url);
         return true;
       }
+      if (typeof message === 'string' && message.startsWith(CHUNK_PREFIX)) {
+        result.confirm('');
+        const json = takeChunk(message.slice(CHUNK_PREFIX.length), url);
+        if (json !== null) CustomWebView.forNative(view)?.onAppwrapMessage?.(json, url);
+        return true;
+      }
       return false; // genuine page prompt — default handling
     },
 
@@ -152,6 +148,10 @@ export class CustomWebView extends WebView {
     settings.setDomStorageEnabled(true);
     settings.setAllowFileAccess(true);
     settings.setMediaPlaybackRequiresUserGesture(false); // speaker: autoplay allowed
+    // The bundle runs at https://appwrap.local, so Chromium blocks its fetch/XHR/ws to plain-http hosts as mixed
+    // content — iOS's app:// origin is not https and never hits this. Parity: a bundled app may talk to http LAN
+    // hosts (cleartext is already allowed in the manifest); a server-loaded page keeps the default block.
+    if (SHELL_CONFIG.loader !== 'server' && SHELL_CONFIG.loader !== 'file') settings.setMixedContentMode(android.webkit.WebSettings.MIXED_CONTENT_ALWAYS_ALLOW);
     // Native feel: no pinch-zoom controls.
     settings.setSupportZoom(false);
     settings.setBuiltInZoomControls(false);

package/runtime/app/shell/prompt-transport.ts

@@ -0,0 +1,37 @@
+/**
+ * Android web→native transport over window.prompt(). Chromium truncates a prompt() message at ~10K chars
+ * (device-measured: a 10.1K envelope arrives, 10.3K arrives cut → unparseable → the call hangs to its timeout),
+ * so an envelope longer than CHUNK goes as numbered parts `__appwrapc__:<id>:<i>:<n>:<part>`, reassembled here.
+ */
+export const PROMPT_PREFIX = '__appwrap__:';
+export const CHUNK_PREFIX = '__appwrapc__:';
+const CHUNK = 8000;
+
+/** Injected at document start; the guard makes double-injection a no-op. Never splits a surrogate pair. */
+export const TRANSPORT_SHIM = `(function(){
+  if (window.appwrapNative) return;
+  var seq = 0;
+  window.appwrapNative = { postMessage: function(json){
+    if (json.length <= ${CHUNK}) return window.prompt('${PROMPT_PREFIX}' + json);
+    var parts = [], i = 0;
+    while (i < json.length) { var e = Math.min(json.length, i + ${CHUNK}); var c = json.charCodeAt(e - 1); if (e < json.length && c >= 0xD800 && c <= 0xDBFF) e--; parts.push(json.slice(i, e)); i = e; }
+    var id = (++seq) + Math.random().toString(36).slice(2);
+    for (var k = 0; k < parts.length; k++) window.prompt('${CHUNK_PREFIX}' + id + ':' + k + ':' + parts.length + ':' + parts[k]);
+  } };
+})();`;
+
+const pending = new Map<string, { url: string; parts: string[]; got: number }>();
+
+/** One chunk in; the whole envelope out once its last part lands (all parts must come from the same page url). */
+export function takeChunk(message: string, url: string): string | null {
+  const m = /^([^:]+):(\d+):(\d+):/.exec(message);
+  if (!m) return null;
+  const [head, id, i, n] = [m[0], m[1], +m[2], +m[3]];
+  let p = pending.get(id);
+  if (!p) { if (pending.size > 32) pending.clear(); p = { url, parts: new Array(n), got: 0 }; pending.set(id, p); }
+  if (p.url !== url || i >= p.parts.length || p.parts[i] !== undefined) { pending.delete(id); return null; }
+  p.parts[i] = message.slice(head.length);
+  if (++p.got < p.parts.length) return null;
+  pending.delete(id);
+  return p.parts.join('');
+}

package/runtime/tests/bridge-origin.test.ts

@@ -60,6 +60,17 @@ describe('Bridge origin gate — a foreign page must not reach the app’s store
     } finally { Object.assign(SHELL_CONFIG, prev); }
   });
 
+  test('Android bundle origin (https://appwrap.local) is trusted for a bundled loader, not for server', () => {
+    const prev = { loader: SHELL_CONFIG.loader, serverUrl: SHELL_CONFIG.serverUrl };
+    try {
+      Object.assign(SHELL_CONFIG, { loader: 'app' });
+      expect(bridgeAllows('https://appwrap.local/index.html', 'webview.eval')).toBe(true);
+      expect(bridgeAllows('https://appwrap.local.evil.io', 'webview.eval')).toBe(false);
+      Object.assign(SHELL_CONFIG, { loader: 'server', serverUrl: 'https://app.example.com' });
+      expect(bridgeAllows('https://appwrap.local', 'webview.eval')).toBe(false);
+    } finally { Object.assign(SHELL_CONFIG, prev); }
+  });
+
   test('originOf normalises', () => {
     expect(originOf('HTTP://U:p@Host:80/a?b#c')).toBe('http://host');
     expect(originOf('app://localhost/index.html')).toBe('app://localhost');

package/runtime/tests/prompt-transport.test.ts

@@ -0,0 +1,39 @@
+import { describe, test, expect } from 'bun:test';
+import { TRANSPORT_SHIM, PROMPT_PREFIX, CHUNK_PREFIX, takeChunk } from '../app/shell/prompt-transport';
+
+/** Run the shim against a fake window; returns what native's onJsPrompt would see. */
+const send = (json: string) => {
+  const prompts: string[] = [];
+  const window: any = { prompt: (m: string) => { prompts.push(m); } };
+  new Function('window', TRANSPORT_SHIM)(window);
+  window.appwrapNative.postMessage(json);
+  return prompts;
+};
+const deliver = (prompts: string[], url = 'https://appwrap.local/') => {
+  const out: string[] = [];
+  for (const m of prompts) {
+    if (m.startsWith(PROMPT_PREFIX)) out.push(m.slice(PROMPT_PREFIX.length));
+    else { const j = takeChunk(m.slice(CHUNK_PREFIX.length), url); if (j !== null) out.push(j); }
+  }
+  return out;
+};
+
+describe('prompt transport', () => {
+  test('a small envelope is one prompt', () => {
+    const p = send('{"a":1}');
+    expect(p).toEqual([PROMPT_PREFIX + '{"a":1}']);
+  });
+  test('a large envelope is chunked under the ~10K prompt cap and reassembled exactly (surrogates intact)', () => {
+    const json = JSON.stringify({ js: 'x'.repeat(7999) + '😀'.repeat(5000) + 'tail' });
+    const p = send(json);
+    expect(p.length).toBeGreaterThan(1);
+    for (const m of p) expect(m.length).toBeLessThan(10000);
+    for (const m of p) expect(/[\uD800-\uDBFF]$/.test(m)).toBe(false);
+    expect(deliver(p)).toEqual([json]);
+  });
+  test('parts from a different page url are dropped', () => {
+    const p = send('y'.repeat(20000));
+    const out: (string | null)[] = p.map((m, i) => takeChunk(m.slice(CHUNK_PREFIX.length), i ? 'https://evil.example/' : 'https://appwrap.local/'));
+    expect(out.every((x) => x === null)).toBe(true);
+  });
+});