@zogien/native-sdk 0.11.0-fork.3 → 0.11.0-fork.4

package/src/platform/windows/webview2_host.cpp

@@ -421,6 +421,9 @@ struct Window {
     /* The maximized state last reported to the runtime, so WM_SIZE emits
      * a frame event only when it changes. */
     bool maximized = false;
+    /* Same-thread child kept above content children across the top
+     * resize band (see syncTopResizeStrip); created on first need. */
+    HWND top_resize_strip = nullptr;
 };
 
 /* One rectangle of a canvas view's window-drag mirror (runtime push,
@@ -743,6 +746,11 @@ struct Host {
     std::string window_title;
     std::string bundle_id;
     std::string icon_path;
+    /* The WebView2 user data folder every environment in this host
+     * shares, resolved once on first use (webViewUserDataFolder). Empty
+     * means WebView2's own default. */
+    bool webview_user_data_folder_resolved = false;
+    std::wstring webview_user_data_folder;
     EventCallback callback = nullptr;
     void *callback_context = nullptr;
     BridgeCallback bridge_callback = nullptr;
@@ -1171,8 +1179,57 @@ static std::string bridgeOriginForWebViewUrl(const ChildWebView &webview, const
     return isInternalAssetUrl(webview, url) ? assetOrigin(webview) : originForUrl(url);
 }
 
+/* The resources\ directory of a packaged Windows artifact: `native
+ * package` stages the executable in bin\ and the app-relative asset tree
+ * in resources\ beside it. Empty when the executable is not in a bin\
+ * directory. */
+static const std::wstring &packagedResourcesDirectory() {
+    static const std::wstring directory = [] {
+        std::wstring path(MAX_PATH, L'\0');
+        for (;;) {
+            const DWORD length = GetModuleFileNameW(nullptr, path.data(), (DWORD)path.size());
+            if (length == 0) return std::wstring();
+            if (length < path.size()) {
+                path.resize(length);
+                break;
+            }
+            if (path.size() >= 32768) return std::wstring();
+            path.resize(path.size() * 2);
+        }
+        const size_t exe_slash = path.find_last_of(L"\\/");
+        if (exe_slash == std::wstring::npos) return std::wstring();
+        const std::wstring bin = path.substr(0, exe_slash);
+        const size_t bin_slash = bin.find_last_of(L"\\/");
+        if (bin_slash == std::wstring::npos || CompareStringOrdinal(bin.c_str() + bin_slash + 1, -1, L"bin", -1, TRUE) != CSTR_EQUAL) return std::wstring();
+        return bin.substr(0, bin_slash) + L"\\resources";
+    }();
+    return directory;
+}
+
+/* A relative WebView asset root names a directory of the packaged asset
+ * tree when the app runs from a package, the tree the macOS host finds
+ * in its bundle's Resources. In development it stays relative to the
+ * working directory. */
+static std::string assetRootPath(const std::string &root) {
+    const bool absolute = !root.empty() && (root[0] == '\\' || root[0] == '/' || (root.size() > 1 && root[1] == ':'));
+    if (!absolute) {
+        const std::wstring &resources = packagedResourcesDirectory();
+        if (!resources.empty()) {
+            std::wstring candidate = resources;
+            if (!root.empty() && root != ".") {
+                std::wstring relative = widen(root);
+                std::replace(relative.begin(), relative.end(), L'/', L'\\');
+                candidate += L"\\" + relative;
+            }
+            const DWORD attributes = GetFileAttributesW(candidate.c_str());
+            if (attributes != INVALID_FILE_ATTRIBUTES && (attributes & FILE_ATTRIBUTE_DIRECTORY) != 0) return narrow(candidate);
+        }
+    }
+    return root.empty() ? std::string(".") : root;
+}
+
 static std::wstring assetFilePath(const ChildWebView &webview, const std::string &relative) {
-    std::string path = webview.asset_root.empty() ? std::string(".") : webview.asset_root;
+    std::string path = assetRootPath(webview.asset_root);
     if (!path.empty() && path.back() != '/' && path.back() != '\\') path.push_back('\\');
     std::string native_relative = relative;
     std::replace(native_relative.begin(), native_relative.end(), '/', '\\');
@@ -2014,6 +2071,8 @@ static void applyNativeViewState(NativeView &view, bool update_text, const std::
     applyNativeViewAccessibility(view);
 }
 
+static void syncTopResizeStrip(Host *host, uint64_t window_id);
+
 static void reorderWindowChildren(Host *host, uint64_t window_id) {
     if (!host) return;
     struct LayerItem {
@@ -2041,6 +2100,8 @@ static void reorderWindowChildren(Host *host, uint64_t window_id) {
     for (const LayerItem &item : items) {
         SetWindowPos(item.hwnd, HWND_TOP, 0, 0, 0, 0, SWP_NOMOVE | SWP_NOSIZE | SWP_NOACTIVATE);
     }
+    /* Content layers never rise above the window's own resize band. */
+    syncTopResizeStrip(host, window_id);
 }
 
 static bool emitNativeCommandForHwnd(Host *host, HWND hwnd, UINT notification_code) {
@@ -2328,6 +2389,25 @@ static bool windowIsChromeless(const Window &window) {
     return window.titlebar_style == 3;
 }
 
+/* Windows whose top resize frame lives INSIDE the client, answered by
+ * the window's own WM_NCHITTEST and the top resize strip: the hidden
+ * styles, and chromeless windows. On Windows 10 a caption-less frame
+ * with any non-client top draws it as a blank white bar, so chromeless
+ * keeps real left/right/bottom borders (resize and shadow) and hands
+ * the client the top edge, the frame Tauri gives its undecorated
+ * windows. Two chromeless shapes keep the plain popup frame: transparent
+ * windows, whose per-pixel present seeds hit-testable resize bands
+ * around the client, and windows carrying a menu bar, which needs the
+ * non-client top. */
+static bool windowReclaimsTopFrame(const Window &window, bool has_menu) {
+    if (windowUsesHiddenTitlebar(window)) return true;
+    return windowIsChromeless(window) && !window.transparent && !has_menu;
+}
+
+static bool windowReclaimsTopFrame(const Window &window) {
+    return windowReclaimsTopFrame(window, window.hwnd && GetMenu(window.hwnd) != nullptr);
+}
+
 static Window *hiddenTitlebarWindowForHwnd(Host *host, HWND hwnd) {
     if (!host || !hwnd) return nullptr;
     for (auto &entry : host->windows) {
@@ -2438,6 +2518,168 @@ static int hiddenFrameTopThickness(HWND hwnd) {
     return systemMetricForDpi(SM_CYSIZEFRAME, dpi) + systemMetricForDpi(SM_CXPADDEDBORDER, dpi);
 }
 
+/* The top resize band's hit code for a client point: `thickness` rows
+ * tall, with corner slivers as wide as the side borders so the diagonal
+ * grips survive at the very top; HTNOWHERE outside the band. */
+static constexpr LRESULT topResizeBandHitCode(int x, int y, int client_width, int thickness, int corner) {
+    if (y < 0 || y >= thickness || x < 0 || x >= client_width) return HTNOWHERE;
+    if (x < corner) return HTTOPLEFT;
+    if (x >= client_width - corner) return HTTOPRIGHT;
+    return HTTOP;
+}
+
+static_assert(
+    topResizeBandHitCode(3, 2, 1040, 8, 8) == HTTOPLEFT &&
+    topResizeBandHitCode(8, 2, 1040, 8, 8) == HTTOP &&
+    topResizeBandHitCode(1031, 7, 1040, 8, 8) == HTTOP &&
+    topResizeBandHitCode(1032, 7, 1040, 8, 8) == HTTOPRIGHT &&
+    topResizeBandHitCode(520, 8, 1040, 8, 8) == HTNOWHERE &&
+    topResizeBandHitCode(520, -1, 1040, 8, 8) == HTNOWHERE,
+    "the top band is exactly `thickness` rows tall with `corner`-wide diagonal grips");
+
+/* The top resize band of a window that reclaims its top frame, in the
+ * window's client coordinates. Only a restored resizable window has one:
+ * a maximized window does not resize and a fixed one never does. Every
+ * surface that answers for the band — the window itself, canvas children
+ * handing it back, and the top resize strip — asks here. */
+static LRESULT topResizeBandHit(const Window &window, POINT client) {
+    if (!window.hwnd || !windowReclaimsTopFrame(window)) return HTNOWHERE;
+    if (!window.resizable || IsZoomed(window.hwnd) || IsIconic(window.hwnd)) return HTNOWHERE;
+    RECT rect = {};
+    GetClientRect(window.hwnd, &rect);
+    const UINT dpi = dpiForWindow(window.hwnd);
+    const int corner = systemMetricForDpi(SM_CXSIZEFRAME, dpi) + systemMetricForDpi(SM_CXPADDEDBORDER, dpi);
+    return topResizeBandHitCode(client.x, client.y, rect.right - rect.left, hiddenFrameTopThickness(window.hwnd), corner);
+}
+
+/* ------------------------------------------------------------------------
+ * Top resize strip.
+ *
+ * A child covering the top band must hand it back to the window. Canvas
+ * surfaces in hidden-titlebar windows do (they answer HTTRANSPARENT
+ * there), but a WebView2 child belongs to the browser process and never
+ * consults its parent, so under WebView content the band was only
+ * resizable where WebView2's own drag-region windows happened to answer
+ * it. The strip is a same-thread, unpainted child kept above every
+ * content child across the band: it answers the window's band hit codes
+ * itself (the cursor follows from them) and forwards the press to the
+ * window, whose DefWindowProc runs the system size loop. Tauri recovers
+ * the top edge of its undecorated windows the same way. WS_EX_TRANSPARENT
+ * keeps the strip out of its siblings' visible regions: the WebView
+ * containers clip siblings, and without it the band shows the window
+ * background instead of the content under it. */
+
+static Window *windowForTopResizeStrip(Host *host, HWND strip) {
+    if (!host || !strip) return nullptr;
+    for (auto &entry : host->windows) {
+        if (entry.second.top_resize_strip == strip) return &entry.second;
+    }
+    return nullptr;
+}
+
+static LRESULT CALLBACK topResizeStripProc(HWND strip, UINT message, WPARAM wparam, LPARAM lparam) {
+    Host *host = reinterpret_cast<Host *>(GetWindowLongPtrW(strip, GWLP_USERDATA));
+    switch (message) {
+        case WM_NCHITTEST: {
+            Window *window = windowForTopResizeStrip(host, strip);
+            if (!window || !window->hwnd) return HTTRANSPARENT;
+            POINT point = { (int)(short)LOWORD(lparam), (int)(short)HIWORD(lparam) };
+            ScreenToClient(window->hwnd, &point);
+            const LRESULT hit = topResizeBandHit(*window, point);
+            return hit != HTNOWHERE ? hit : HTTRANSPARENT;
+        }
+        case WM_NCLBUTTONDOWN:
+        case WM_NCLBUTTONDBLCLK:
+            /* Same thread, so the window's own non-client handling runs
+             * synchronously with the original screen point: the size loop
+             * for a press, the vertical maximize for a double-click. */
+            if (wparam == HTTOP || wparam == HTTOPLEFT || wparam == HTTOPRIGHT) {
+                Window *window = windowForTopResizeStrip(host, strip);
+                if (window && window->hwnd) return SendMessageW(window->hwnd, message, wparam, lparam);
+            }
+            break;
+        case WM_ERASEBKGND:
+            return 1;
+        case WM_PAINT: {
+            PAINTSTRUCT paint = {};
+            BeginPaint(strip, &paint);
+            EndPaint(strip, &paint);
+            return 0;
+        }
+        default:
+            break;
+    }
+    return DefWindowProcW(strip, message, wparam, lparam);
+}
+
+static const wchar_t *topResizeStripClassName(Host *host) {
+    static bool registered = false;
+    if (!registered) {
+        WNDCLASSEXW wc = {};
+        wc.cbSize = sizeof(wc);
+        wc.lpfnWndProc = topResizeStripProc;
+        wc.hInstance = host->instance;
+        wc.hCursor = LoadCursor(nullptr, IDC_ARROW);
+        wc.lpszClassName = L"NativeSdkTopResizeStrip";
+        registered = RegisterClassExW(&wc) != 0;
+    }
+    return L"NativeSdkTopResizeStrip";
+}
+
+/* Whether any WebView container reaches into the window's top band. */
+static bool webViewCoversTopBand(Host *host, const Window &window, int band) {
+    RECT client = {};
+    GetClientRect(window.hwnd, &client);
+    const RECT band_rect = { 0, 0, client.right - client.left, band };
+    for (auto &entry : host->webviews) {
+        const ChildWebView &webview = entry.second;
+        if (webview.window_id != window.id || !webview.hwnd) continue;
+        if (!(GetWindowLongPtrW(webview.hwnd, GWL_STYLE) & WS_VISIBLE)) continue;
+        RECT bounds = {};
+        GetWindowRect(webview.hwnd, &bounds);
+        POINT top_left = { bounds.left, bounds.top };
+        POINT bottom_right = { bounds.right, bounds.bottom };
+        ScreenToClient(window.hwnd, &top_left);
+        ScreenToClient(window.hwnd, &bottom_right);
+        const RECT local = { top_left.x, top_left.y, bottom_right.x, bottom_right.y };
+        RECT overlap = {};
+        if (IntersectRect(&overlap, &local, &band_rect)) return true;
+    }
+    return false;
+}
+
+/* Show, size and raise the strip over the band of a restored resizable
+ * window that reclaims its top frame; hide it otherwise. Chromeless
+ * windows always take it: their content children answer the band as
+ * client. Hidden-titlebar windows take it only while a WebView covers the
+ * band, so canvas windows keep their own band and the DWM keeps first
+ * claim on its caption buttons. Runs after every geometry, state, or
+ * child z-order change. */
+static void syncTopResizeStrip(Host *host, uint64_t window_id) {
+    if (!host) return;
+    auto found = host->windows.find(window_id);
+    if (found == host->windows.end() || !found->second.hwnd) return;
+    Window &window = found->second;
+    const int band = hiddenFrameTopThickness(window.hwnd);
+    const bool wanted = windowReclaimsTopFrame(window) && window.resizable && !window.click_through &&
+        !IsZoomed(window.hwnd) && !IsIconic(window.hwnd) &&
+        (windowIsChromeless(window) || webViewCoversTopBand(host, window, band));
+    if (!wanted) {
+        if (window.top_resize_strip) ShowWindow(window.top_resize_strip, SW_HIDE);
+        return;
+    }
+    if (!window.top_resize_strip) {
+        HWND strip = CreateWindowExW(WS_EX_TRANSPARENT, topResizeStripClassName(host), L"", WS_CHILD | WS_CLIPSIBLINGS,
+            0, 0, 0, 0, window.hwnd, nullptr, host->instance, nullptr);
+        if (!strip) return;
+        SetWindowLongPtrW(strip, GWLP_USERDATA, reinterpret_cast<LONG_PTR>(host));
+        window.top_resize_strip = strip;
+    }
+    RECT client = {};
+    GetClientRect(window.hwnd, &client);
+    SetWindowPos(window.top_resize_strip, HWND_TOP, 0, 0, client.right - client.left, band, SWP_NOACTIVATE | SWP_SHOWWINDOW);
+}
+
 /* Height of the standard caption band (frame + caption) at the window's
  * dpi — the DWM frame extension depth, and the chrome-channel top inset
  * fallback when the live button rects are unavailable. */
@@ -3448,7 +3690,7 @@ static LRESULT CALLBACK gpuSurfaceProc(HWND hwnd, UINT message, WPARAM wparam, L
             if (!chrome_window) break;
             POINT point = { (int)(short)LOWORD(lparam), (int)(short)HIWORD(lparam) };
             ScreenToClient(chrome_window->hwnd, &point);
-            if (chrome_window->resizable && !IsZoomed(chrome_window->hwnd) && point.y >= 0 && point.y < hiddenFrameTopThickness(chrome_window->hwnd)) return HTTRANSPARENT;
+            if (topResizeBandHit(*chrome_window, point) != HTNOWHERE) return HTTRANSPARENT;
             RECT cluster = {};
             if (captionButtonsClientRect(chrome_window->hwnd, &cluster) && PtInRect(&cluster, point)) return HTTRANSPARENT;
             if (windowDragRegionHit(host, *chrome_window, point)) return HTTRANSPARENT;
@@ -5010,6 +5252,7 @@ static void destroyAllWindows(Host *host) {
         if (entry.second.hwnd) {
             DestroyWindow(entry.second.hwnd);
             entry.second.hwnd = nullptr;
+            entry.second.top_resize_strip = nullptr;
         }
     }
 }
@@ -5335,13 +5578,90 @@ static CreateEnvironmentFn webView2Factory() {
     return reinterpret_cast<CreateEnvironmentFn>(GetProcAddress(loader, "CreateCoreWebView2EnvironmentWithOptions"));
 }
 
+static bool webViewDirectoryExists(const std::wstring &path) {
+    const DWORD attributes = GetFileAttributesW(path.c_str());
+    return attributes != INVALID_FILE_ATTRIBUTES && (attributes & FILE_ATTRIBUTE_DIRECTORY) != 0;
+}
+
+/* The folder WebView2 picks when none is given: "<exe>.WebView2" beside
+ * the executable. Earlier hosts left their data there. */
+static std::wstring webViewLegacyUserDataFolder() {
+    std::wstring path(MAX_PATH, L'\0');
+    for (;;) {
+        const DWORD length = GetModuleFileNameW(nullptr, path.data(), (DWORD)path.size());
+        if (length == 0) return std::wstring();
+        if (length < path.size()) {
+            path.resize(length);
+            return path + L".WebView2";
+        }
+        if (path.size() >= 32768) return std::wstring();
+        path.resize(path.size() * 2);
+    }
+}
+
+/* WebView2 keeps cookies, storage and caches in its user data folder.
+ * Its default sits beside the executable, which is read-only under
+ * Program Files and is replaced together with the program files when
+ * an installed app updates. Keep it with the app's other per-user data
+ * instead: %LOCALAPPDATA%\<bundle id>\WebView2, next to the Data, Cache,
+ * State and Logs folders app_dirs resolves from the same variable and
+ * bundle id. A folder left beside the executable by an earlier host
+ * moves there once. A folder on another volume cannot be renamed there,
+ * so that install keeps its old folder; when the move fails for another
+ * reason (another process still has the folder open) this launch keeps
+ * the old folder and the next launch tries again. Either way no data is
+ * lost. Without LOCALAPPDATA or a usable bundle id, WebView2 keeps its
+ * default. */
+static const wchar_t *webViewUserDataFolder(Host *host) {
+    if (host->webview_user_data_folder_resolved) {
+        return host->webview_user_data_folder.empty() ? nullptr : host->webview_user_data_folder.c_str();
+    }
+    host->webview_user_data_folder_resolved = true;
+    const std::string &bundle_id = host->bundle_id;
+    if (bundle_id.empty() || bundle_id == "." || bundle_id == ".." ||
+        bundle_id.find_first_of("\\/:*?\"<>|") != std::string::npos) return nullptr;
+    for (unsigned char ch : bundle_id) {
+        if (ch < 0x20) return nullptr;
+    }
+    const DWORD needed = GetEnvironmentVariableW(L"LOCALAPPDATA", nullptr, 0);
+    if (needed <= 1) return nullptr;
+    std::wstring local_app_data((size_t)needed, L'\0');
+    const DWORD written = GetEnvironmentVariableW(L"LOCALAPPDATA", local_app_data.data(), needed);
+    if (written == 0 || written >= needed) return nullptr;
+    local_app_data.resize(written);
+    while (!local_app_data.empty() && (local_app_data.back() == L'\\' || local_app_data.back() == L'/')) local_app_data.pop_back();
+    if (local_app_data.empty()) return nullptr;
+
+    const std::wstring app_root = local_app_data + L"\\" + widen(bundle_id);
+    const std::wstring folder = app_root + L"\\WebView2";
+    SHCreateDirectoryExW(nullptr, app_root.c_str(), nullptr);
+    if (!webViewDirectoryExists(app_root)) return nullptr;
+
+    if (!webViewDirectoryExists(folder)) {
+        const std::wstring legacy = webViewLegacyUserDataFolder();
+        if (!legacy.empty() && webViewDirectoryExists(legacy) && !MoveFileExW(legacy.c_str(), folder.c_str(), 0)) {
+            const DWORD error = GetLastError();
+            if (error != ERROR_NOT_SAME_DEVICE) {
+                fprintf(stderr, "native-sdk: keeping WebView2 data in %s for this launch; moving it to %s failed (error %lu)\n",
+                    narrow(legacy).c_str(), narrow(folder).c_str(), static_cast<unsigned long>(error));
+            }
+            host->webview_user_data_folder = legacy;
+            return host->webview_user_data_folder.c_str();
+        }
+    }
+    host->webview_user_data_folder = folder;
+    return host->webview_user_data_folder.c_str();
+}
+
 static void cleanupPendingChildWebView(Host *host, const std::string &key) {
     if (!host) return;
     auto found = host->webviews.find(key);
     if (found == host->webviews.end()) return;
+    const uint64_t window_id = found->second.window_id;
     if (found->second.controller) found->second.controller->Close();
     if (found->second.hwnd) DestroyWindow(found->second.hwnd);
     host->webviews.erase(found);
+    syncTopResizeStrip(host, window_id);
 }
 
 static void failWindowDragInitialization(Host *host, const std::string &key, HRESULT result) {
@@ -5361,7 +5681,7 @@ static bool createChildWebView(Host *host, const std::string &key) {
     HWND parent = found->second.hwnd;
     const uint64_t generation = found->second.window_drag_generation;
     std::weak_ptr<HostLifetime> lifetime = host->lifetime;
-    HRESULT hr = factory(nullptr, nullptr, nullptr, Callback<ICoreWebView2CreateCoreWebView2EnvironmentCompletedHandler>(
+    HRESULT hr = factory(nullptr, webViewUserDataFolder(host), nullptr, Callback<ICoreWebView2CreateCoreWebView2EnvironmentCompletedHandler>(
         [host, key, parent, lifetime, generation](HRESULT result, ICoreWebView2Environment *environment) -> HRESULT {
             auto token = lifetime.lock();
             if (!token) return S_OK;
@@ -5818,21 +6138,11 @@ static LRESULT CALLBACK windowProc(HWND hwnd, UINT message, WPARAM wparam, LPARA
                 if (def_hit != HTCLIENT) return def_hit;
                 POINT point = { (int)(short)LOWORD(lparam), (int)(short)HIWORD(lparam) };
                 ScreenToClient(hwnd, &point);
-                RECT client = {};
-                GetClientRect(hwnd, &client);
                 /* Top resize band: the caption removal moved the top
                  * frame INSIDE the client area, so hand its band back to
-                 * the system — restored and resizable windows only (a
-                 * maximized window does not resize, a fixed one never
-                 * does). Corner slivers widen to the side borders so the
-                 * diagonal grips survive at the very top. */
-                if (chrome_window->resizable && !IsZoomed(hwnd) && point.y >= 0 && point.y < hiddenFrameTopThickness(hwnd)) {
-                    const UINT dpi = dpiForWindow(hwnd);
-                    const int corner = systemMetricForDpi(SM_CXSIZEFRAME, dpi) + systemMetricForDpi(SM_CXPADDEDBORDER, dpi);
-                    if (point.x < corner) return HTTOPLEFT;
-                    if (point.x >= client.right - corner) return HTTOPRIGHT;
-                    return HTTOP;
-                }
+                 * the system. */
+                const LRESULT band_hit = topResizeBandHit(*chrome_window, point);
+                if (band_hit != HTNOWHERE) return band_hit;
                 /* Caption buttons when DwmDefWindowProc stayed silent
                  * (composition off, older cores): DefWindowProc still
                  * performs minimize/maximize/close for these hit codes,
@@ -5865,6 +6175,22 @@ static LRESULT CALLBACK windowProc(HWND hwnd, UINT message, WPARAM wparam, LPARA
                 break;
         }
     }
+    /* Chromeless windows hand the top frame to the client (see
+     * windowReclaimsTopFrame) while restored. A maximized window keeps
+     * DefWindowProc's inset: its frame parks the borders offscreen around
+     * the work area, and the inset is what lands the client exactly on
+     * it. */
+    if (message == WM_NCCALCSIZE && wparam) {
+        Window *chromeless_window = chromelessWindowForHwnd(host, hwnd);
+        if (chromeless_window && windowReclaimsTopFrame(*chromeless_window) && !IsZoomed(hwnd)) {
+            NCCALCSIZE_PARAMS *params = reinterpret_cast<NCCALCSIZE_PARAMS *>(lparam);
+            const LONG original_top = params->rgrc[0].top;
+            const LRESULT def_result = DefWindowProcW(hwnd, WM_NCCALCSIZE, wparam, lparam);
+            if (def_result != 0) return def_result;
+            params->rgrc[0].top = original_top;
+            return 0;
+        }
+    }
     /* Chromeless windows (WS_POPUP, no caption): DefWindowProc owns the
      * resize frame when one exists; the app's window-drag regions are
      * the only caption there is, so a client-area hit inside one
@@ -5877,6 +6203,8 @@ static LRESULT CALLBACK windowProc(HWND hwnd, UINT message, WPARAM wparam, LPARA
             if (def_hit != HTCLIENT) return def_hit;
             POINT point = { (int)(short)LOWORD(lparam), (int)(short)HIWORD(lparam) };
             ScreenToClient(hwnd, &point);
+            const LRESULT band_hit = topResizeBandHit(*chromeless_window, point);
+            if (band_hit != HTNOWHERE) return band_hit;
             if (windowDragRegionHit(host, *chromeless_window, point)) return HTCAPTION;
             return HTCLIENT;
         }
@@ -5990,6 +6318,9 @@ static LRESULT CALLBACK windowProc(HWND hwnd, UINT message, WPARAM wparam, LPARA
                             applyWebViewFrame(main->second);
                         }
 #endif
+                        /* Size, maximize/restore, minimize, and dpi changes
+                         * all land here. */
+                        syncTopResizeStrip(host, entry.first);
                         emit(host, entry.second, kResize);
                     }
                 }
@@ -6109,9 +6440,9 @@ static LRESULT CALLBACK windowProc(HWND hwnd, UINT message, WPARAM wparam, LPARA
                     /* The declared floor is a CONTENT size in LOGICAL
                      * points; scale to physical pixels at this window's
                      * DPI, then convert to the outer track size for its
-                     * current style. Hidden titlebar styles carry no top
-                     * chrome (the custom WM_NCCALCSIZE hands the caption
-                     * band to the client), so their conversion skips it
+                     * current style. Styles that reclaim their top frame
+                     * carry no top chrome (the custom WM_NCCALCSIZE hands
+                     * it to the client), so their conversion skips it
                      * too. */
                     const UINT dpi = dpiForWindow(hwnd);
                     const double scale = (double)dpi / 96.0;
@@ -6124,7 +6455,7 @@ static LRESULT CALLBACK windowProc(HWND hwnd, UINT message, WPARAM wparam, LPARA
                     adjustWindowRectForDpi(&frame, style, has_menu, ex_style, dpi);
                     LONG outer_width = frame.right - frame.left;
                     LONG outer_height = frame.bottom - frame.top;
-                    if (windowUsesHiddenTitlebar(window)) {
+                    if (windowReclaimsTopFrame(window, has_menu)) {
                         const SIZE outer = hiddenOuterSizeForContent(style, ex_style, has_menu, min_content_width, min_content_height, dpi);
                         outer_width = outer.cx;
                         outer_height = outer.cy;
@@ -6183,6 +6514,7 @@ static LRESULT CALLBACK windowProc(HWND hwnd, UINT message, WPARAM wparam, LPARA
                         destroyNativeViewsForWindow(host, entry.first);
                         destroyChildWebViewsForWindow(host, entry.first);
                         entry.second.hwnd = nullptr;
+                        entry.second.top_resize_strip = nullptr;
                         /* Destroyed means closed, never hidden. */
                         entry.second.policy_hidden = false;
                         emit(host, entry.second, kWindowFrame);
@@ -6252,9 +6584,9 @@ static bool createNativeWindow(Host *host, Window &window) {
      * re-derives the frame if it lands on another monitor), then grow
      * it to the outer size for this style so the client rect lands at
      * the request. The menu bar is attached after creation, so account
-     * for it here when menus are declared. Hidden styles use the
-     * custom-calc shape (no top chrome) — plain adjustment would land
-     * their client one caption band tall. */
+     * for it here when menus are declared. Styles that reclaim their top
+     * frame use the custom-calc shape (no top chrome) — plain adjustment
+     * would land their client one caption band (or top border) tall. */
     const bool has_menu = !host->menus.empty();
     const UINT dpi = systemDpi();
     const double scale = (double)dpi / 96.0;
@@ -6264,7 +6596,7 @@ static bool createNativeWindow(Host *host, Window &window) {
     adjustWindowRectForDpi(&frame, style, has_menu ? TRUE : FALSE, 0, dpi);
     LONG outer_width = frame.right - frame.left;
     LONG outer_height = frame.bottom - frame.top;
-    if (windowUsesHiddenTitlebar(window)) {
+    if (windowReclaimsTopFrame(window, has_menu)) {
         const SIZE outer = hiddenOuterSizeForContent(style, 0, has_menu, content_width, content_height, dpi);
         outer_width = outer.cx;
         outer_height = outer.cy;
@@ -6296,13 +6628,14 @@ static bool createNativeWindow(Host *host, Window &window) {
     /* Before the first show, so a dark-scheme launch never flashes a
      * light caption. */
     applyStandardTitlebarColorScheme(window);
-    if (windowUsesHiddenTitlebar(window)) {
-        applyHiddenTitlebarFrame(window);
+    if (windowUsesHiddenTitlebar(window)) applyHiddenTitlebarFrame(window);
+    if (windowReclaimsTopFrame(window)) {
         /* The create-time WM_NCCALCSIZE ran before this window was
          * registered under its HWND, so the custom calc did not apply;
          * force one now that the map entry resolves. The callers keep
          * `window` referencing the stored map entry for exactly this. */
         SetWindowPos(hwnd, nullptr, 0, 0, 0, 0, SWP_NOMOVE | SWP_NOSIZE | SWP_NOZORDER | SWP_NOACTIVATE | SWP_FRAMECHANGED);
+        syncTopResizeStrip(host, window.id);
     }
     /* Initialize WS_EX_LAYERED through the same per-pixel path used by
      * canvas presents. A layered HWND is otherwise not displayable until
@@ -6357,6 +6690,14 @@ Host *native_sdk_windows_create(const char *app_name, size_t app_name_len, const
     host->app_name = slice(app_name, app_name_len);
     host->window_title = slice(window_title, window_title_len);
     host->bundle_id = slice(bundle_id, bundle_id_len);
+    /* The taskbar groups and pins windows by AppUserModelID. Name the
+     * process by its bundle id, the id the installer's Start menu
+     * shortcut carries, so the taskbar follows the app instead of the
+     * path of the executable that happened to start it. */
+    if (!host->bundle_id.empty()) {
+        const std::wstring app_user_model_id = widen(host->bundle_id);
+        SetCurrentProcessExplicitAppUserModelID(app_user_model_id.c_str());
+    }
     host->icon_path = slice(icon_path, icon_path_len);
     Window window;
     window.id = 1;
@@ -6638,6 +6979,7 @@ int native_sdk_windows_load_window_webview(Host *host, uint64_t window_id, const
             host->webviews.erase(key);
             return 0;
         }
+        syncTopResizeStrip(host, window_id);
     }
 
     ChildWebView &webview = found->second;
@@ -8042,6 +8384,7 @@ int native_sdk_windows_create_webview(Host *host, uint64_t window_id, const char
     if (!createChildWebView(host, key)) {
         DestroyWindow(hwnd);
         host->webviews.erase(key);
+        syncTopResizeStrip(host, window_id);
         return 0;
     }
     return 1;
@@ -8066,6 +8409,7 @@ int native_sdk_windows_set_webview_frame(Host *host, uint64_t window_id, const c
         found->second.controller->put_Bounds(bounds);
     }
 #endif
+    syncTopResizeStrip(host, window_id);
     return 1;
 }
 
@@ -8145,6 +8489,7 @@ int native_sdk_windows_close_webview(Host *host, uint64_t window_id, const char
 #endif
     if (found->second.hwnd) DestroyWindow(found->second.hwnd);
     host->webviews.erase(found);
+    syncTopResizeStrip(host, window_id);
     return 1;
 }
 

package/src/primitives/app_manifest/root.zig

@@ -83,6 +83,7 @@ pub const FileAssociation = types.FileAssociation;
 pub const UrlScheme = types.UrlScheme;
 pub const PackageMetadata = types.PackageMetadata;
 pub const UpdateConfig = types.UpdateConfig;
+pub const UpdateMode = types.UpdateMode;
 pub const Manifest = types.Manifest;
 pub const ImagesConfig = types.ImagesConfig;
 pub const validateManifest = validation.validateManifest;

package/src/primitives/app_manifest/tests.zig

@@ -125,6 +125,41 @@ test "updates require paired HTTPS feed and Ed25519 public key" {
     }));
 }
 
+test "app-driven updates need a feed to drive" {
+    try validateUpdates(.{
+        .feed_url = "https://example.com/native-update.json",
+        .public_key = "11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo=",
+        .mode = .app,
+    });
+    try std.testing.expectError(error.MissingRequiredField, validateUpdates(.{ .mode = .app }));
+}
+
+test "update feed URLs may name the target and installed version" {
+    const key = "11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo=";
+    try validateUpdates(.{ .feed_url = "https://example.com/releases/{target}/native-update.json", .public_key = key });
+    try validateUpdates(.{ .feed_url = "https://example.com/feed?target={target}&from={current_version}", .public_key = key });
+    try std.testing.expectError(error.InvalidUrl, validateUpdates(.{ .feed_url = "https://example.com/{arch}/native-update.json", .public_key = key }));
+    try std.testing.expectError(error.InvalidUrl, validateUpdates(.{ .feed_url = "https://example.com/{target/native-update.json", .public_key = key }));
+    try std.testing.expectError(error.InvalidUrl, validateUpdates(.{ .feed_url = "https://example.com/target}/native-update.json", .public_key = key }));
+    try std.testing.expectError(error.InvalidUrl, validateUpdates(.{ .feed_url = "https://{target}.example.com/native-update.json", .public_key = key }));
+}
+
+test "update public_keys add distinct trusted keys beside public_key" {
+    const key = "11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo=";
+    const other = "wFDFY3pE+oYp//PMzOIwDLNipj2Z2V/FQUUmb0MyRFo=";
+    const rotated = [_][]const u8{other};
+    try validateUpdates(.{ .feed_url = "https://example.com/native-update.json", .public_key = key, .public_keys = &rotated });
+    try std.testing.expectError(error.MissingRequiredField, validateUpdates(.{ .public_keys = &rotated }));
+    const repeated = [_][]const u8{key};
+    try std.testing.expectError(error.MissingRequiredField, validateUpdates(.{ .feed_url = "https://example.com/native-update.json", .public_key = key, .public_keys = &repeated }));
+    const duplicated = [_][]const u8{ other, other };
+    try std.testing.expectError(error.MissingRequiredField, validateUpdates(.{ .feed_url = "https://example.com/native-update.json", .public_key = key, .public_keys = &duplicated }));
+    const malformed = [_][]const u8{"not-a-public-key"};
+    try std.testing.expectError(error.MissingRequiredField, validateUpdates(.{ .feed_url = "https://example.com/native-update.json", .public_key = key, .public_keys = &malformed }));
+    const too_many = [_][]const u8{ other, "IBLLkMpg6OXY2vZuInLSIz4EhtVX6MZhQe2JIBd9frc=", "+AzM3OSuHAeuIIoq35mjEK5CB+Awb6AjYRCwaCe7uNA=", "n0lDnp2wlbxBEe0l01eV2DG8VaBH9LHX9q7jd3u0EiA=" };
+    try std.testing.expectError(error.MissingRequiredField, validateUpdates(.{ .feed_url = "https://example.com/native-update.json", .public_key = key, .public_keys = &too_many }));
+}
+
 test "accessory startup requires the tray capability" {
     const tray_capabilities = [_]Capability{.tray};
     try validateManifest(.{

package/src/primitives/app_manifest/types.zig

@@ -647,9 +647,21 @@ pub const PackageMetadata = struct {
 pub const UpdateConfig = struct {
     feed_url: ?[]const u8 = null,
     public_key: ?[]const u8 = null,
+    /// Further trusted keys beside `public_key`, so a release signed with
+    /// a key being rotated out still verifies on installs that know it.
+    public_keys: []const []const u8 = &.{},
     check_on_start: bool = false,
+    /// Who drives updates on macOS: the host's own prompts, or the app
+    /// through the `native-sdk.updates` requests and channel. Windows apps
+    /// always drive updates themselves.
+    mode: UpdateMode = .host,
 };
 
+pub const UpdateMode = enum { host, app };
+
+/// `public_key` plus at most this many `public_keys`.
+pub const max_update_public_keys: usize = 3;
+
 pub const PersistRestore = struct {
     ok: []const u8,
     none: []const u8,