pake-cli 3.11.9 → 3.12.0

package/LICENSE-EXCEPTION

@@ -0,0 +1,20 @@
+Pake Output Exception
+
+This is an exception to the GNU General Public License version 3 (GPLv3),
+under which Pake is licensed (see the LICENSE file).
+
+As an additional permission under section 7 of the GPLv3:
+
+When you use Pake, or a build of Pake produced by the standard Pake build
+and packaging process, to generate a target application ("Pake Output"),
+the portions of Pake incorporated into that Pake Output do not by
+themselves cause the Pake Output as a whole to be or become subject to the
+GPLv3. You may distribute such Pake Output under license terms of your own
+choosing, including proprietary terms.
+
+This permission does NOT apply to Pake itself or to any modified version of
+Pake's own source code: anyone who distributes Pake, or a work derived from
+Pake's source code beyond the configuration and packaging performed by the
+standard build process, remains fully bound by the GPLv3.
+
+Copyright (c) 2024 Tw93 and the Pake contributors.

package/README.md

@@ -202,12 +202,17 @@ Pake's development can not be without these Hackers. They contributed a lot of c
 
 ## Support
 
+- The most direct way to support me is getting [Mole for Mac](https://mole.fit), my paid Mac cleanup app.
 - If Pake helped you, [share it](https://twitter.com/intent/tweet?url=https://github.com/tw93/Pake&text=Pake%20-%20Turn%20any%20webpage%20into%20a%20desktop%20app%20with%20one%20command.%20Nearly%2020x%20smaller%20than%20Electron%20packages,%20supports%20macOS%20Windows%20Linux) with friends or give it a star.
 - Got ideas or bugs? Open an issue or PR, feel free to contribute your best AI model.
 - I have two cats, TangYuan and Coke. If you think Pake delights your life, you can feed them <a href="https://cats.tw93.fun?name=Pake" target="_blank">canned food 🥩</a>.
 
+<details>
+<summary>These lovely people already did 🐱</summary>
+<br/>
 <a href="https://cats.tw93.fun?name=Pake"><img src="https://cdn.jsdelivr.net/gh/tw93/sponsors@main/assets/sponsors.svg" width="1000" loading="lazy" /></a>
+</details>
 
 ## License
 
-Pake is open source under GPL-3.0, see [LICENSE](./LICENSE); apps you build with Pake are entirely yours to use and distribute. If you fork Pake into your own product, to avoid confusion please give it a different name and credit Pake as the source.
+Pake is open source under GPL-3.0, see [LICENSE](./LICENSE) and [Pake Output Exception](./LICENSE-EXCEPTION); apps you build with Pake are entirely yours to use and distribute. If you fork Pake into your own product, to avoid confusion please give it a different name and credit Pake as the source.

package/dist/cli.js

@@ -20,7 +20,7 @@ import { InvalidArgumentError, program as program$1, Option } from 'commander';
 import fs$1 from 'fs';
 
 var name = "pake-cli";
-var version = "3.11.9";
+var version = "3.12.0";
 var description = "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。";
 var engines = {
 	node: ">=18.0.0"
@@ -46,6 +46,7 @@ var keywords = [
 	"productivity"
 ];
 var files = [
+	"LICENSE-EXCEPTION",
 	"dist",
 	"src-tauri"
 ];
@@ -417,6 +418,9 @@ function filterLinuxTargets(targets) {
     const requested = targets.split(',').map((target) => target.trim());
     return LINUX_TARGET_TYPES.filter((target) => requested.includes(target));
 }
+function needsTemporaryDebForZst(targets) {
+    return targets.includes('zst') && !targets.includes('deb');
+}
 
 /**
  * Pure transform from CLI options to the window-config slice that gets
@@ -427,13 +431,14 @@ function filterLinuxTargets(targets) {
  */
 function buildWindowConfigOverrides(options, platform = asSupportedPlatform(process.platform)) {
     const platformHideOnClose = options.hideOnClose ?? platform === 'darwin';
+    const platformHideTitleBar = platform === 'darwin' ? options.hideTitleBar : false;
     return {
         width: options.width,
         height: options.height,
         fullscreen: options.fullscreen,
         maximize: options.maximize,
         resizable: options.resizable ?? true,
-        hide_title_bar: options.hideTitleBar,
+        hide_title_bar: platformHideTitleBar,
         activation_shortcut: options.activationShortcut,
         always_on_top: options.alwaysOnTop,
         dark_mode: options.darkMode,
@@ -708,6 +713,9 @@ async function mergeConfig(url, options, tauriConf) {
     await copyTemplateConfigs();
     const { appVersion, userAgent, showSystemTray, useLocalFile, identifier, name = 'pake-app', installerLanguage, wasm, camera, microphone, } = options;
     const platform = asSupportedPlatform(process.platform);
+    if (options.hideTitleBar && platform !== 'darwin') {
+        logger.warn('✼ --hide-title-bar is only supported on macOS and will be ignored on this platform.');
+    }
     const tauriConfWindowOptions = buildWindowConfigOverrides(options, platform);
     Object.assign(tauriConf.pake.windows[0], { url, ...tauriConfWindowOptions });
     tauriConf.productName = name;
@@ -1158,14 +1166,22 @@ class BaseBuilder {
             return 0; // Disable proxy feature if version detection fails
         }
     }
+    getCargoTargetDir() {
+        return process.env.CARGO_TARGET_DIR || path.join('src-tauri', 'target');
+    }
+    resolveBuildPath(npmDirectory, buildPath) {
+        return path.isAbsolute(buildPath)
+            ? buildPath
+            : path.join(npmDirectory, buildPath);
+    }
     getBasePath() {
         const basePath = this.options.debug ? 'debug' : 'release';
-        return `src-tauri/target/${basePath}/bundle/`;
+        return path.join(this.getCargoTargetDir(), basePath, 'bundle');
     }
     getBuildAppPath(npmDirectory, fileName, fileType) {
         // For app bundles on macOS, the directory is 'macos', not 'app'
         const bundleDir = fileType.toLowerCase() === 'app' ? 'macos' : fileType.toLowerCase();
-        return path.join(npmDirectory, this.getBasePath(), bundleDir, `${fileName}.${fileType}`);
+        return path.join(this.resolveBuildPath(npmDirectory, this.getBasePath()), bundleDir, `${fileName}.${fileType}`);
     }
     /**
      * Copy raw binary file to output directory
@@ -1192,9 +1208,9 @@ class BaseBuilder {
         const binaryName = this.getBinaryName(appName);
         // Handle cross-platform builds
         if (this.options.multiArch || this.hasArchSpecificTarget()) {
-            return path.join(npmDirectory, this.getArchSpecificPath(), basePath, binaryName);
+            return path.join(this.resolveBuildPath(npmDirectory, this.getArchSpecificPath()), basePath, binaryName);
         }
-        return path.join(npmDirectory, 'src-tauri/target', basePath, binaryName);
+        return path.join(this.resolveBuildPath(npmDirectory, this.getCargoTargetDir()), basePath, binaryName);
     }
     /**
      * Get the output path for the raw binary file
@@ -1225,7 +1241,7 @@ class BaseBuilder {
      * Get architecture-specific path for binary
      */
     getArchSpecificPath() {
-        return 'src-tauri/target'; // Override in subclasses if needed
+        return this.getCargoTargetDir(); // Override in subclasses if needed
     }
 }
 BaseBuilder.ARCH_MAPPINGS = {
@@ -1311,7 +1327,10 @@ class MacBuilder extends BaseBuilder {
         const basePath = this.options.debug ? 'debug' : 'release';
         const actualArch = this.getActualArch();
         const target = this.getTauriTarget(actualArch, 'darwin');
-        return `src-tauri/target/${target}/${basePath}/bundle`;
+        if (!target) {
+            throw new Error(`Unsupported architecture: ${actualArch} for macOS`);
+        }
+        return path.join(this.getCargoTargetDir(), target, basePath, 'bundle');
     }
     hasArchSpecificTarget() {
         return true;
@@ -1319,7 +1338,10 @@ class MacBuilder extends BaseBuilder {
     getArchSpecificPath() {
         const actualArch = this.getActualArch();
         const target = this.getTauriTarget(actualArch, 'darwin');
-        return `src-tauri/target/${target}`;
+        if (!target) {
+            throw new Error(`Unsupported architecture: ${actualArch} for macOS`);
+        }
+        return path.join(this.getCargoTargetDir(), target);
     }
 }
 
@@ -1350,14 +1372,26 @@ class WinBuilder extends BaseBuilder {
     getBasePath() {
         const basePath = this.options.debug ? 'debug' : 'release';
         const target = this.getTauriTarget(this.buildArch, 'win32');
-        return `src-tauri/target/${target}/${basePath}/bundle/`;
+        if (!target) {
+            throw new Error(`Unsupported architecture: ${this.buildArch} for Windows`);
+        }
+        return path.join(this.getCargoTargetDir(), target, basePath, 'bundle');
     }
     hasArchSpecificTarget() {
         return true;
     }
     getArchSpecificPath() {
         const target = this.getTauriTarget(this.buildArch, 'win32');
-        return `src-tauri/target/${target}`;
+        if (!target) {
+            throw new Error(`Unsupported architecture: ${this.buildArch} for Windows`);
+        }
+        return path.join(this.getCargoTargetDir(), target);
+    }
+    getRawBinaryPath(appName) {
+        return `${appName}.exe`;
+    }
+    getBinaryName(appName) {
+        return `pake-${generateIdentifierSafeName(appName)}.exe`;
     }
 }
 
@@ -1407,11 +1441,16 @@ class LinuxBuilder extends BaseBuilder {
         if (targets.length === 0) {
             throw new Error(`No valid Linux target in "${this.options.targets}". Valid targets: ${LINUX_TARGET_TYPES.join(', ')}.`);
         }
+        const useTemporaryDebForZst = needsTemporaryDebForZst(targets);
         for (const target of targets) {
             this.currentBuildType = target;
             if (target === 'zst') {
-                await this.buildAndCopy(url, 'deb', false);
-                await this.createArchPackageFromDeb();
+                if (useTemporaryDebForZst) {
+                    await this.buildAndCopy(url, 'deb', false);
+                }
+                await this.createArchPackageFromDeb({
+                    removeSourceDeb: useTemporaryDebForZst,
+                });
             }
             else {
                 await this.buildAndCopy(url, target);
@@ -1432,7 +1471,7 @@ class LinuxBuilder extends BaseBuilder {
             }
         }
     }
-    async createArchPackageFromDeb() {
+    async createArchPackageFromDeb({ removeSourceDeb, }) {
         const { name = 'pake-app' } = this.options;
         const packageName = generateLinuxPackageName(name);
         const version = tauriConfig.version;
@@ -1493,11 +1532,13 @@ post_remove() {
 }
 `);
             await shellExec(`bsdtar --zstd -cf "${packagePath}" -C "${dataDir}" .PKGINFO .INSTALL usr`);
-            await fsExtra.remove(debPath);
             logger.success('✔ Build success!');
             logger.success('✔ App installer located in', packagePath);
         }
         finally {
+            if (removeSourceDeb) {
+                await fsExtra.remove(debPath);
+            }
             await fsExtra.remove(workDir);
         }
     }
@@ -1545,7 +1586,10 @@ post_remove() {
         const basePath = this.options.debug ? 'debug' : 'release';
         if (this.buildArch === 'arm64') {
             const target = this.getTauriTarget(this.buildArch, 'linux');
-            return `src-tauri/target/${target}/${basePath}/bundle/`;
+            if (!target) {
+                throw new Error(`Unsupported architecture: ${this.buildArch} for Linux`);
+            }
+            return path.join(this.getCargoTargetDir(), target, basePath, 'bundle');
         }
         return super.getBasePath();
     }
@@ -1561,7 +1605,10 @@ post_remove() {
     getArchSpecificPath() {
         if (this.buildArch === 'arm64') {
             const target = this.getTauriTarget(this.buildArch, 'linux');
-            return `src-tauri/target/${target}`;
+            if (!target) {
+                throw new Error(`Unsupported architecture: ${this.buildArch} for Linux`);
+            }
+            return path.join(this.getCargoTargetDir(), target);
         }
         return super.getArchSpecificPath();
     }
@@ -2399,6 +2446,20 @@ function normalizeUrl(urlToNormalize) {
         throw new Error(`Your url "${urlWithProtocol}" is invalid: ${err.message}`);
     }
 }
+// Compiles a comma-separated domain list into a regex source for
+// internal_url_regex. Each domain is escaped and matched against the URL host
+// and its subdomains so path or query text cannot accidentally opt a link in.
+// Returns '' for empty input.
+function safeDomainsToRegex(domains) {
+    const escaped = domains
+        .split(',')
+        .map((domain) => domain.trim().toLowerCase())
+        .filter(Boolean)
+        .map((domain) => domain.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+    return escaped.length
+        ? `^https?:\\/\\/(?:[^/?#@]+\\.)*(?:${escaped.join('|')})(?::\\d+)?(?:[/?#]|$)`
+        : '';
+}
 
 /**
  * Error class used for user-facing CLI errors.
@@ -2479,6 +2540,10 @@ async function handleOptions(options, url) {
         name: resolvedName,
         identifier: resolveIdentifier(url, options.name, options.identifier),
     };
+    // --safe-domain is sugar over --internal-url-regex; an explicit regex wins.
+    if (!options.internalUrlRegex && options.safeDomain) {
+        appOptions.internalUrlRegex = safeDomainsToRegex(options.safeDomain);
+    }
     const iconPath = await handleIcon(appOptions, url);
     appOptions.icon = iconPath || '';
     return appOptions;
@@ -2527,6 +2592,7 @@ const DEFAULT_PAKE_OPTIONS = {
     startToTray: false,
     forceInternalNavigation: false,
     internalUrlRegex: '',
+    safeDomain: '',
     enableFind: false,
     iterativeBuild: false,
     zoom: 100,
@@ -2540,6 +2606,9 @@ const DEFAULT_PAKE_OPTIONS = {
 };
 
 function validateNumberInput(value) {
+    if (value.trim() === '') {
+        throw new InvalidArgumentError('Not a number.');
+    }
     const parsedValue = Number(value);
     if (!Number.isFinite(parsedValue)) {
         throw new InvalidArgumentError('Not a number.');
@@ -2576,6 +2645,7 @@ ${green('|_|   \\__,_|_|\\_\\___|  can turn any webpage into a desktop app with
     return program$1
         .addHelpText('beforeAll', logo)
         .usage(`[url] [options]`)
+        .helpOption('-h, --help', 'Show all CLI options')
         .showHelpAfterError()
         .argument('[url]', 'The web URL you want to package', validateUrlInput)
         .option('--name <string>', 'Application name')
@@ -2664,12 +2734,9 @@ ${green('|_|   \\__,_|_|\\_\\___|  can turn any webpage into a desktop app with
         .addOption(new Option('--start-to-tray', 'Start app minimized to tray')
         .default(DEFAULT_PAKE_OPTIONS.startToTray)
         .hideHelp())
-        .addOption(new Option('--force-internal-navigation', 'Keep every link inside the Pake window instead of opening external handlers')
-        .default(DEFAULT_PAKE_OPTIONS.forceInternalNavigation)
-        .hideHelp())
-        .addOption(new Option('--internal-url-regex <string>', 'Regex pattern to match URLs that should be considered internal')
-        .default(DEFAULT_PAKE_OPTIONS.internalUrlRegex)
-        .hideHelp())
+        .addOption(new Option('--force-internal-navigation', 'Keep every link inside the Pake window instead of opening external handlers').default(DEFAULT_PAKE_OPTIONS.forceInternalNavigation))
+        .addOption(new Option('--internal-url-regex <string>', 'Regex pattern to match URLs that should be considered internal').default(DEFAULT_PAKE_OPTIONS.internalUrlRegex))
+        .addOption(new Option('--safe-domain <domains>', 'Comma-separated domains kept inside the app (e.g. SSO/workspace callbacks)').default(DEFAULT_PAKE_OPTIONS.safeDomain))
         .addOption(new Option('--enable-find', 'Enable in-page Find UI with Cmd/Ctrl+F/G shortcuts')
         .default(DEFAULT_PAKE_OPTIONS.enableFind)
         .hideHelp())
@@ -2700,9 +2767,7 @@ ${green('|_|   \\__,_|_|\\_\\___|  can turn any webpage into a desktop app with
         .addOption(new Option('--iterative-build', 'Turn on rapid build mode (app only, no dmg/deb/msi), good for debugging')
         .default(DEFAULT_PAKE_OPTIONS.iterativeBuild)
         .hideHelp())
-        .addOption(new Option('--new-window', 'Allow sites to open new windows (for auth flows, tabs, branches)')
-        .default(DEFAULT_PAKE_OPTIONS.newWindow)
-        .hideHelp())
+        .addOption(new Option('--new-window', 'Allow sites to open new windows (for auth flows, tabs, branches)').default(DEFAULT_PAKE_OPTIONS.newWindow))
         .addOption(new Option('--install', 'Auto-install app to /Applications (macOS) after build and remove local bundle')
         .default(DEFAULT_PAKE_OPTIONS.install)
         .hideHelp())
@@ -2715,14 +2780,19 @@ ${green('|_|   \\__,_|_|\\_\\___|  can turn any webpage into a desktop app with
         .version(packageJson.version, '-v, --version')
         .configureHelp({
         sortSubcommands: true,
+        visibleOptions: (command) => {
+            const options = [...command.options];
+            const helpOption = command
+                ._helpOption;
+            if (helpOption) {
+                options.push(helpOption);
+            }
+            return options;
+        },
         optionTerm: (option) => {
-            if (option.flags === '-v, --version' || option.flags === '-h, --help')
-                return '';
             return option.flags;
         },
         optionDescription: (option) => {
-            if (option.flags === '-v, --version' || option.flags === '-h, --help')
-                return '';
             return option.description;
         },
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pake-cli",
-  "version": "3.11.9",
+  "version": "3.12.0",
   "description": "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。",
   "engines": {
     "node": ">=18.0.0"
@@ -26,6 +26,7 @@
     "productivity"
   ],
   "files": [
+    "LICENSE-EXCEPTION",
     "dist",
     "src-tauri"
   ],

package/src-tauri/Cargo.lock

@@ -2564,7 +2564,7 @@ dependencies = [
 
 [[package]]
 name = "pake"
-version = "3.11.9"
+version = "3.12.0"
 dependencies = [
  "objc2",
  "objc2-app-kit",

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pake"
-version = "3.11.9"
+version = "3.12.0"
 description = "🤱🏻 Turn any webpage into a desktop app with Rust."
 authors = ["Tw93"]
 license = "GPL-3.0-or-later"

package/src-tauri/src/inject/auth.js

@@ -27,12 +27,26 @@ function matchesAuthUrl(url, baseUrl = window.location.href) {
       /\/o\/oauth2/,
     ];
 
-    const isMatch = oauthPatterns.some(
-      (pattern) =>
-        pattern.test(hostname) ||
-        pattern.test(pathname) ||
-        pattern.test(fullUrl),
-    );
+    // Enterprise SSO. Match identity providers on the host, and SAML/SSO/ADFS on
+    // the pathname with endpoint-shaped patterns only, so ordinary pages such as
+    // /settings/sso/providers (or a query string carrying an SSO URL) are not
+    // misread as authentication.
+    const enterpriseHostPatterns = [/(^|\.)okta\.com$/, /(^|\.)onelogin\.com$/];
+    const enterprisePathPatterns = [
+      /\/saml2?\/(sso|acs|login|metadata|consume|redirect|callback|continue)/,
+      /\/sso\/(saml|oidc|oauth|login|authorize|redirect|callback|acs|start|continue|metadata)/,
+      /\/adfs\/ls\b/,
+    ];
+
+    const isMatch =
+      oauthPatterns.some(
+        (pattern) =>
+          pattern.test(hostname) ||
+          pattern.test(pathname) ||
+          pattern.test(fullUrl),
+      ) ||
+      enterpriseHostPatterns.some((pattern) => pattern.test(hostname)) ||
+      enterprisePathPatterns.some((pattern) => pattern.test(pathname));
 
     if (isMatch) {
       console.log("[Pake] OAuth URL detected:", url);

package/src-tauri/src/inject/event.js

@@ -272,6 +272,33 @@ function shouldBypassPakeLinkHandling(rawHref) {
   );
 }
 
+function shouldNavigateAuthInCurrentWindow() {
+  return /macintosh|mac os x/i.test(navigator.userAgent);
+}
+
+function canNavigateAuthUrl(url) {
+  const normalizedUrl = normalizeAnchorHref(url).toLowerCase();
+  return normalizedUrl !== "" && normalizedUrl !== "about:blank";
+}
+
+function navigateInCurrentWindow(url) {
+  window.location.href = url;
+  return window;
+}
+
+function openAuthNavigation(originalWindowOpen, url, name, specs) {
+  if (shouldNavigateAuthInCurrentWindow() && canNavigateAuthUrl(url)) {
+    return navigateInCurrentWindow(url);
+  }
+
+  const authWindow = originalWindowOpen.call(window, url, name, specs);
+  if (!authWindow) {
+    return navigateInCurrentWindow(url);
+  }
+
+  return authWindow;
+}
+
 document.addEventListener("DOMContentLoaded", () => {
   const tauri = window.__TAURI__;
   const appWindow = tauri.window.getCurrentWindow();
@@ -432,24 +459,23 @@ document.addEventListener("DOMContentLoaded", () => {
       const absoluteUrl = hrefUrl.href;
       let filename = anchorElement.download || getFilenameFromUrl(absoluteUrl);
 
-      // Keep OAuth/authentication flows inside the app when popup support is enabled.
+      // Keep OAuth/authentication flows inside the app. Without --new-window,
+      // navigate in place so the SSO redirect chain and callback stay in the
+      // webview instead of falling through to the system browser.
       if (window.isAuthLink(absoluteUrl)) {
         console.log("[Pake] Handling OAuth navigation in-app:", absoluteUrl);
+        e.preventDefault();
+        e.stopImmediatePropagation();
 
         if (window.pakeConfig?.new_window) {
-          e.preventDefault();
-          e.stopImmediatePropagation();
-
-          const authWindow = originalWindowOpen.call(
-            window,
+          openAuthNavigation(
+            originalWindowOpen,
             absoluteUrl,
             "_blank",
             "width=1200,height=800,scrollbars=yes,resizable=yes",
           );
-
-          if (!authWindow) {
-            window.location.href = absoluteUrl;
-          }
+        } else {
+          window.location.href = absoluteUrl;
         }
 
         return;
@@ -465,7 +491,15 @@ document.addEventListener("DOMContentLoaded", () => {
         }
 
         if (isInternalUrl(absoluteUrl)) {
-          // For internal links (based on regex or domain), let the browser handle it naturally
+          // With --new-window the Rust on_new_window handler opens an in-app
+          // window; without it, deferring to the native handler sends the
+          // _blank target to the system browser and strands SSO callbacks.
+          // Navigate in place so internal links stay inside the webview.
+          if (!window.pakeConfig?.new_window) {
+            e.preventDefault();
+            e.stopImmediatePropagation();
+            window.location.href = absoluteUrl;
+          }
           return;
         }
 
@@ -544,9 +578,15 @@ document.addEventListener("DOMContentLoaded", () => {
       return originalWindowOpen.call(window, url, name, specs);
     }
 
-    // Allow authentication popups to open normally
+    // Avoid macOS WebKit auth-popup crashes by navigating auth URLs in-place.
     if (window.isAuthPopup(url, name)) {
-      return originalWindowOpen.call(window, url, name, specs);
+      try {
+        const baseUrl = window.location.origin + window.location.pathname;
+        const absoluteUrl = new URL(url, baseUrl).href;
+        return openAuthNavigation(originalWindowOpen, absoluteUrl, name, specs);
+      } catch (error) {
+        return openAuthNavigation(originalWindowOpen, url, name, specs);
+      }
     }
 
     try {
@@ -563,6 +603,14 @@ document.addEventListener("DOMContentLoaded", () => {
         return null;
       }
 
+      // With --new-window the native handler opens an in-app window; without it,
+      // originalWindowOpen would route the internal target to the system browser
+      // and strand SSO callbacks, so navigate in place instead.
+      if (!window.pakeConfig?.new_window) {
+        window.location.href = absoluteUrl;
+        return window;
+      }
+
       return originalWindowOpen.call(window, absoluteUrl, name, specs);
     } catch (error) {
       return originalWindowOpen.call(window, url, name, specs);

package/src-tauri/src/lib.rs

@@ -10,6 +10,12 @@ use tauri_plugin_window_state::StateFlags;
 use std::time::Duration;
 
 const WINDOW_SHOW_DELAY: u64 = 50;
+#[cfg(target_os = "linux")]
+const PAKE_LINUX_WEBKIT_SAFE_MODE: &str = "PAKE_LINUX_WEBKIT_SAFE_MODE";
+#[cfg(target_os = "linux")]
+const WEBKIT_DISABLE_DMABUF_RENDERER: &str = "WEBKIT_DISABLE_DMABUF_RENDERER";
+#[cfg(target_os = "linux")]
+const WEBKIT_DISABLE_COMPOSITING_MODE: &str = "WEBKIT_DISABLE_COMPOSITING_MODE";
 
 use app::{
     invoke::{
@@ -21,16 +27,83 @@ use app::{
 };
 use util::get_pake_config;
 
+#[cfg(any(target_os = "linux", test))]
+fn is_disabled_env_value(value: &str) -> bool {
+    matches!(
+        value.trim().to_ascii_lowercase().as_str(),
+        "0" | "false" | "off" | "no" | "native" | "disabled"
+    )
+}
+
+#[cfg(any(target_os = "linux", test))]
+fn is_non_empty_env_value(value: Option<&str>) -> bool {
+    value.map(|value| !value.trim().is_empty()).unwrap_or(false)
+}
+
+#[cfg(any(target_os = "linux", test))]
+fn contains_niri(value: &str) -> bool {
+    value
+        .split([':', ';', ',', ' '])
+        .any(|part| part.eq_ignore_ascii_case("niri"))
+}
+
+#[cfg(any(target_os = "linux", test))]
+fn should_enable_linux_webkit_safe_mode_from_values(
+    safe_mode: Option<&str>,
+    niri_socket: Option<&str>,
+    desktop_values: &[Option<&str>],
+) -> bool {
+    if let Some(value) = safe_mode.filter(|value| !value.trim().is_empty()) {
+        return !is_disabled_env_value(value);
+    }
+
+    let is_niri_session = is_non_empty_env_value(niri_socket)
+        || desktop_values
+            .iter()
+            .flatten()
+            .any(|value| contains_niri(value));
+
+    !is_niri_session
+}
+
+#[cfg(target_os = "linux")]
+fn apply_linux_webkit_runtime_flags() {
+    let safe_mode = std::env::var(PAKE_LINUX_WEBKIT_SAFE_MODE).ok();
+    if safe_mode.as_deref().is_some_and(is_disabled_env_value) {
+        std::env::remove_var(WEBKIT_DISABLE_DMABUF_RENDERER);
+        std::env::remove_var(WEBKIT_DISABLE_COMPOSITING_MODE);
+        return;
+    }
+
+    let desktop_values = [
+        std::env::var("XDG_CURRENT_DESKTOP").ok(),
+        std::env::var("XDG_SESSION_DESKTOP").ok(),
+        std::env::var("DESKTOP_SESSION").ok(),
+    ];
+    let desktop_refs = desktop_values
+        .iter()
+        .map(|value| value.as_deref())
+        .collect::<Vec<_>>();
+
+    if !should_enable_linux_webkit_safe_mode_from_values(
+        safe_mode.as_deref(),
+        std::env::var("NIRI_SOCKET").ok().as_deref(),
+        &desktop_refs,
+    ) {
+        return;
+    }
+
+    if std::env::var(WEBKIT_DISABLE_DMABUF_RENDERER).is_err() {
+        std::env::set_var(WEBKIT_DISABLE_DMABUF_RENDERER, "1");
+    }
+    if std::env::var(WEBKIT_DISABLE_COMPOSITING_MODE).is_err() {
+        std::env::set_var(WEBKIT_DISABLE_COMPOSITING_MODE, "1");
+    }
+}
+
 pub fn run_app() {
     #[cfg(target_os = "linux")]
-    {
-        if std::env::var("WEBKIT_DISABLE_DMABUF_RENDERER").is_err() {
-            std::env::set_var("WEBKIT_DISABLE_DMABUF_RENDERER", "1");
-        }
-        if std::env::var("WEBKIT_DISABLE_COMPOSITING_MODE").is_err() {
-            std::env::set_var("WEBKIT_DISABLE_COMPOSITING_MODE", "1");
-        }
-    }
+    apply_linux_webkit_runtime_flags();
 
     let (pake_config, tauri_config) = get_pake_config();
     let tauri_app = tauri::Builder::default();
@@ -202,3 +275,58 @@ pub fn run_app() {
 pub fn run() {
     run_app()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn linux_webkit_safe_mode_stays_on_by_default() {
+        assert!(should_enable_linux_webkit_safe_mode_from_values(
+            None,
+            None,
+            &[None, None, None]
+        ));
+    }
+
+    #[test]
+    fn linux_webkit_safe_mode_is_disabled_for_niri_socket() {
+        assert!(!should_enable_linux_webkit_safe_mode_from_values(
+            None,
+            Some("/run/user/501/niri.sock"),
+            &[None, None, None]
+        ));
+    }
+
+    #[test]
+    fn linux_webkit_safe_mode_is_disabled_for_niri_desktop() {
+        assert!(!should_enable_linux_webkit_safe_mode_from_values(
+            None,
+            None,
+            &[Some("niri"), None, None]
+        ));
+    }
+
+    #[test]
+    fn linux_webkit_safe_mode_can_be_forced_on_for_niri() {
+        assert!(should_enable_linux_webkit_safe_mode_from_values(
+            Some("1"),
+            Some("/run/user/501/niri.sock"),
+            &[Some("niri"), None, None]
+        ));
+    }
+
+    #[test]
+    fn linux_webkit_safe_mode_can_be_disabled_explicitly() {
+        for value in ["0", "false", "off", "no", "native", "disabled"] {
+            assert!(
+                !should_enable_linux_webkit_safe_mode_from_values(
+                    Some(value),
+                    None,
+                    &[None, None, None]
+                ),
+                "expected {value} to disable safe mode"
+            );
+        }
+    }
+}

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "productName": "Weekly",
   "identifier": "com.pake.weekly",
-  "version": "3.11.9",
+  "version": "3.12.0",
   "app": {
     "withGlobalTauri": true,
     "trayIcon": {