pake-cli 3.12.1 → 3.13.1

package/README.md

@@ -203,8 +203,7 @@ Pake's development can not be without these Hackers. They contributed a lot of c
 ## Support
 
 - The most direct way to support me is getting [Mole for Mac](https://mole.fit), my paid Mac cleanup app.
-- If Pake helped you, [share it](https://twitter.com/intent/tweet?url=https://github.com/tw93/Pake&text=Pake%20-%20Turn%20any%20webpage%20into%20a%20desktop%20app%20with%20one%20command.%20Nearly%2020x%20smaller%20than%20Electron%20packages,%20supports%20macOS%20Windows%20Linux) with friends or give it a star.
-- Got ideas or bugs? Open an issue or PR, feel free to contribute your best AI model.
+- If Pake helped you, give it a star, [share it](https://twitter.com/intent/tweet?url=https://github.com/tw93/Pake&text=Pake%20-%20Turn%20any%20webpage%20into%20a%20desktop%20app%20with%20one%20command.%20Nearly%2020x%20smaller%20than%20Electron%20packages,%20supports%20macOS%20Windows%20Linux), or open an issue or PR.
 - I have two cats, TangYuan and Coke. If you think Pake delights your life, you can feed them <a href="https://cats.tw93.fun?name=Pake" target="_blank">canned food 🥩</a>.
 
 <details>

package/dist/cli.js

@@ -10,17 +10,17 @@ import os from 'os';
 import { execa, execaSync } from 'execa';
 import crypto from 'crypto';
 import ora from 'ora';
-import fs from 'fs/promises';
+import fs from 'fs';
+import fs$1 from 'fs/promises';
 import { dir } from 'tmp-promise';
 import { fileTypeFromBuffer } from 'file-type';
 import icongen from 'icon-gen';
 import sharp from 'sharp';
 import * as psl from 'psl';
 import { InvalidArgumentError, program as program$1, Option } from 'commander';
-import fs$1 from 'fs';
 
 var name = "pake-cli";
-var version = "3.12.1";
+var version = "3.13.1";
 var description = "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。";
 var engines = {
 	node: ">=18.0.0"
@@ -230,6 +230,93 @@ const { platform: platform$1 } = process;
 const IS_MAC = platform$1 === 'darwin';
 const IS_WIN = platform$1 === 'win32';
 const IS_LINUX = platform$1 === 'linux';
+// Distro IDs / ID_LIKE families that ship an RPM-based package manager.
+const RPM_FAMILY_IDS = new Set([
+    'rhel',
+    'fedora',
+    'centos',
+    'rocky',
+    'almalinux',
+    'ol', // Oracle Linux
+    'oracle',
+    'amzn', // Amazon Linux
+    'mariner',
+    'azurelinux',
+    'suse',
+    'opensuse',
+    'opensuse-leap',
+    'opensuse-tumbleweed',
+    'sles',
+]);
+// Distro IDs / ID_LIKE families that ship a DEB-based package manager.
+const DEB_FAMILY_IDS = new Set([
+    'debian',
+    'ubuntu',
+    'linuxmint',
+    'pop',
+    'elementary',
+    'kali',
+    'raspbian',
+    'devuan',
+]);
+// Parse the shell-style key=value pairs of an /etc/os-release file, stripping
+// the optional surrounding quotes around values.
+function parseOsRelease(content) {
+    const fields = {};
+    for (const rawLine of content.split('\n')) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const separator = line.indexOf('=');
+        if (separator === -1)
+            continue;
+        const key = line.slice(0, separator).trim();
+        let value = line.slice(separator + 1).trim();
+        if (value.length >= 2 &&
+            ((value.startsWith('"') && value.endsWith('"')) ||
+                (value.startsWith("'") && value.endsWith("'")))) {
+            value = value.slice(1, -1);
+        }
+        if (key)
+            fields[key] = value;
+    }
+    return fields;
+}
+// Detect the package family from /etc/os-release. The distro's own ID wins over
+// ID_LIKE hints, and an unknown distro falls back to 'deb' to preserve Pake's
+// historical default. Accepts content directly so the decision is unit-testable
+// without a real /etc/os-release.
+function detectLinuxPackageFamily(osReleaseContent) {
+    let content = osReleaseContent;
+    if (content === undefined) {
+        try {
+            content = fs.readFileSync('/etc/os-release', 'utf-8');
+        }
+        catch {
+            return 'deb';
+        }
+    }
+    const fields = parseOsRelease(content);
+    const id = (fields.ID ?? '').toLowerCase().trim();
+    const idLike = (fields.ID_LIKE ?? '')
+        .toLowerCase()
+        .split(/\s+/)
+        .filter(Boolean);
+    for (const token of [id, ...idLike]) {
+        if (DEB_FAMILY_IDS.has(token))
+            return 'deb';
+        if (RPM_FAMILY_IDS.has(token))
+            return 'rpm';
+    }
+    return 'deb';
+}
+// Default Linux bundle targets, chosen by the host distro's package family so
+// RPM-based distros (Fedora/RHEL/Oracle/Rocky/Alma/openSUSE) get a native .rpm
+// instead of a .deb their package manager cannot install. AppImage stays as a
+// universal fallback in both cases.
+function getDefaultLinuxTargets() {
+    return detectLinuxPackageFamily() === 'rpm' ? 'rpm,appimage' : 'deb,appimage';
+}
 
 async function shellExec(command, timeout = 300000, env) {
     try {
@@ -339,7 +426,7 @@ function checkRustInstalled() {
 async function combineFiles(files, output) {
     const contents = await Promise.all(files.map(async (file) => {
         if (file.endsWith('.css')) {
-            const fileContent = await fs.readFile(file, 'utf-8');
+            const fileContent = await fs$1.readFile(file, 'utf-8');
             return `window.addEventListener('DOMContentLoaded', (_event) => {
         const css = ${JSON.stringify(fileContent)};
         const style = document.createElement('style');
@@ -347,12 +434,16 @@ async function combineFiles(files, output) {
         document.head.appendChild(style);
       });`;
         }
-        const fileContent = await fs.readFile(file);
-        return ("window.addEventListener('DOMContentLoaded', (_event) => { " +
+        const fileContent = await fs$1.readFile(file);
+        // Keep the closing `});` on its own line. If the injected file ends in a
+        // line comment without a trailing newline, appending ` });` on the same
+        // line would comment it out and break the wrapper (mirrors the .css
+        // branch above, which already closes on a separate line).
+        return ("window.addEventListener('DOMContentLoaded', (_event) => {\n" +
             fileContent +
-            ' });');
+            '\n});');
     }));
-    await fs.writeFile(output, contents.join('\n'));
+    await fs$1.writeFile(output, contents.join('\n'));
     return files;
 }
 
@@ -421,6 +512,18 @@ function filterLinuxTargets(targets) {
 function needsTemporaryDebForZst(targets) {
     return targets.includes('zst') && !targets.includes('deb');
 }
+// Resolves the Tauri `bundle.targets` list for a Linux build from a
+// comma-separated --targets string (e.g. the distro-aware default
+// "deb,appimage"). zst is repacked from the deb payload, so it maps to a deb
+// bundle. hasValidTarget is false only when no known target is present, which
+// is the single case that should warn and fall back to the default.
+function resolveLinuxBundleTargets(targets) {
+    const requested = filterLinuxTargets(targets);
+    const bundleTargets = [
+        ...new Set(requested.map((target) => (target === 'zst' ? 'deb' : target))),
+    ];
+    return { bundleTargets, hasValidTarget: requested.length > 0 };
+}
 
 /**
  * Pure transform from CLI options to the window-config slice that gets
@@ -509,30 +612,31 @@ async function handleLocalFile(url, useLocalFile, tauriConf) {
         tauriConf.pake.windows[0].url_type = 'web';
     }
 }
-async function mergeLinuxConfig(options, name, tauriConf, linuxBinaryName) {
-    const linuxBundle = tauriConf.bundle.linux;
-    if (!linuxBundle) {
-        throw new Error('Linux bundle configuration is missing from tauri.linux.conf.json; cannot build Linux target.');
-    }
-    delete linuxBundle.deb.files;
-    const linuxName = generateLinuxPackageName(name);
-    const desktopFileName = `com.pake.${linuxName}.desktop`;
-    const iconName = `${linuxName}_512`;
-    const { title } = options;
+function buildLinuxDesktopContent(name, title, linuxBinaryName) {
     const chineseName = title && /[\u4e00-\u9fa5]/.test(title) ? title : null;
-    const desktopContent = `[Desktop Entry]
+    return `[Desktop Entry]
 Version=1.0
 Type=Application
 Name=${name}
 ${chineseName ? `Name[zh_CN]=${chineseName}` : ''}
 Comment=${name}
 Exec=${linuxBinaryName}
-Icon=${iconName}
+Icon=${linuxBinaryName}
 Categories=Network;WebBrowser;Utility;
 MimeType=text/html;text/xml;application/xhtml_xml;
 StartupNotify=true
 Terminal=false
 `;
+}
+async function mergeLinuxConfig(options, name, tauriConf, linuxBinaryName) {
+    const linuxBundle = tauriConf.bundle.linux;
+    if (!linuxBundle) {
+        throw new Error('Linux bundle configuration is missing from tauri.linux.conf.json; cannot build Linux target.');
+    }
+    delete linuxBundle.deb.files;
+    const linuxName = generateLinuxPackageName(name);
+    const desktopFileName = `com.pake.${linuxName}.desktop`;
+    const desktopContent = buildLinuxDesktopContent(name, options.title, linuxBinaryName);
     const srcAssetsDir = path.join(npmDirectory, 'src-tauri/assets');
     const srcDesktopFilePath = path.join(srcAssetsDir, desktopFileName);
     await fsExtra.ensureDir(srcAssetsDir);
@@ -547,19 +651,44 @@ Terminal=false
     linuxBundle.rpm.files = {
         [desktopInstallPath]: `assets/${desktopFileName}`,
     };
-    const validTargets = [
-        ...LINUX_TARGET_TYPES,
-        ...LINUX_TARGET_TYPES.map((target) => `${target}-arm64`),
-    ];
-    const baseTarget = options.targets.includes('-arm64')
-        ? options.targets.replace('-arm64', '')
-        : options.targets;
-    if (validTargets.includes(options.targets)) {
-        // zst is repacked from the deb payload, so Tauri itself bundles a deb.
-        tauriConf.bundle.targets = [baseTarget === 'zst' ? 'deb' : baseTarget];
+    // options.targets reaches here already stripped of any -arm64 suffix by the
+    // LinuxBuilder constructor, and may carry several comma-separated formats
+    // (e.g. the distro-aware default "deb,appimage"). Validate the parsed list
+    // rather than string-matching the whole value, so a valid multi-target
+    // default no longer trips the "must be one of ..." warning on every build.
+    const { bundleTargets, hasValidTarget } = resolveLinuxBundleTargets(options.targets);
+    if (hasValidTarget) {
+        tauriConf.bundle.targets = bundleTargets;
     }
     else {
-        logger.warn(`✼ The target must be one of ${validTargets.join(', ')}, the default 'deb' will be used.`);
+        logger.warn(`✼ The target must be one of ${LINUX_TARGET_TYPES.join(', ')}, the default 'deb' will be used.`);
+    }
+}
+async function resolveSystemTrayIconPath(systemTrayIcon, defaultTrayIconPath, safeAppName, iconOutputDir = path.join(npmDirectory, 'src-tauri/png')) {
+    if (systemTrayIcon.length === 0) {
+        return defaultTrayIconPath;
+    }
+    try {
+        const iconExt = path.extname(systemTrayIcon).toLowerCase();
+        if (iconExt !== '.png' && iconExt !== '.ico') {
+            logger.warn(`✼ System tray icon must be .ico or .png, but you provided ${iconExt}.`);
+            logger.warn(`✼ Default system tray icon will be used.`);
+            return defaultTrayIconPath;
+        }
+        if (!(await fsExtra.pathExists(systemTrayIcon))) {
+            logger.warn(`✼ System tray icon "${systemTrayIcon}" was not found.`);
+            logger.warn(`✼ Default system tray icon will be used.`);
+            return defaultTrayIconPath;
+        }
+        const trayIconPath = `png/${safeAppName}${iconExt}`;
+        const trayIcoPath = path.join(iconOutputDir, `${safeAppName}${iconExt}`);
+        await fsExtra.copy(systemTrayIcon, trayIcoPath);
+        return trayIconPath;
+    }
+    catch (err) {
+        logger.warn(`✼ Failed to apply system tray icon "${systemTrayIcon}": ${err instanceof Error ? err.message : String(err)}`);
+        logger.warn(`✼ Default system tray icon will remain unchanged.`);
+        return defaultTrayIconPath;
     }
 }
 async function mergeIcons(options, name, tauriConf, platform, safeAppName) {
@@ -622,26 +751,8 @@ async function mergeIcons(options, name, tauriConf, platform, safeAppName) {
         tauriConf.bundle.icon = [iconInfo.defaultIcon];
     }
     // Set tray icon path.
-    let trayIconPath = platform === 'darwin' ? 'png/icon_512.png' : tauriConf.bundle.icon[0];
-    if (options.systemTrayIcon.length > 0) {
-        try {
-            await fsExtra.pathExists(options.systemTrayIcon);
-            const iconExt = path.extname(options.systemTrayIcon).toLowerCase();
-            if (iconExt === '.png' || iconExt === '.ico') {
-                const trayIcoPath = path.join(npmDirectory, `src-tauri/png/${safeAppName}${iconExt}`);
-                trayIconPath = `png/${safeAppName}${iconExt}`;
-                await fsExtra.copy(options.systemTrayIcon, trayIcoPath);
-            }
-            else {
-                logger.warn(`✼ System tray icon must be .ico or .png, but you provided ${iconExt}.`);
-                logger.warn(`✼ Default system tray icon will be used.`);
-            }
-        }
-        catch (err) {
-            logger.warn(`✼ Failed to apply system tray icon "${options.systemTrayIcon}": ${err instanceof Error ? err.message : String(err)}`);
-            logger.warn(`✼ Default system tray icon will remain unchanged.`);
-        }
-    }
+    const defaultTrayIconPath = platform === 'darwin' ? 'png/icon_512.png' : tauriConf.bundle.icon[0];
+    const trayIconPath = await resolveSystemTrayIconPath(options.systemTrayIcon, defaultTrayIconPath, safeAppName);
     tauriConf.pake.system_tray_path = trayIconPath;
     delete tauriConf.app.trayIcon;
 }
@@ -1054,6 +1165,16 @@ class BaseBuilder {
                 throw retryError;
             }
         }
+        // With --no-bundle there is no installer to copy; surface the raw
+        // executable the build produced instead.
+        if (this.options.bundle === false) {
+            await this.copyRawBinary(npmDirectory, name);
+            if (logSuccess) {
+                logger.success('✔ Build success!');
+                logger.success('✔ Raw binary located in', path.resolve(this.getRawBinaryPath(name)));
+            }
+            return;
+        }
         // Copy app
         const fileName = this.getFileName();
         const fileType = this.getFileType(target);
@@ -1421,17 +1542,11 @@ class LinuxBuilder extends BaseBuilder {
             arch =
                 buildType === 'rpm' || buildType === 'appimage' ? 'aarch64' : 'arm64';
         }
+        else if (this.buildArch === 'x64') {
+            arch = buildType === 'rpm' ? 'x86_64' : 'amd64';
+        }
         else {
-            if (this.buildArch === 'x64') {
-                arch = buildType === 'rpm' ? 'x86_64' : 'amd64';
-            }
-            else {
-                arch = this.buildArch;
-                if (this.buildArch === 'arm64' &&
-                    (buildType === 'rpm' || buildType === 'appimage')) {
-                    arch = 'aarch64';
-                }
-            }
+            arch = this.buildArch;
         }
         if (this.currentBuildType === 'rpm') {
             return `${name}-${version}-1.${arch}`;
@@ -1439,25 +1554,57 @@ class LinuxBuilder extends BaseBuilder {
         return `${name}_${version}_${arch}`;
     }
     async build(url) {
+        // --no-bundle: build the executable once with no per-format packaging loop.
+        if (this.options.bundle === false) {
+            await this.buildAndCopy(url, 'deb');
+            return;
+        }
         const targets = filterLinuxTargets(this.options.targets);
         if (targets.length === 0) {
             throw new Error(`No valid Linux target in "${this.options.targets}". Valid targets: ${LINUX_TARGET_TYPES.join(', ')}.`);
         }
         const useTemporaryDebForZst = needsTemporaryDebForZst(targets);
+        // With a single explicit target, fail fast. With multiple targets (the
+        // distro-aware default, or an explicit comma list) keep building the rest
+        // when one fails, so a usable installer is still produced, e.g. AppImage
+        // survives a .deb bundler abort on RPM-based distros.
+        const isolateFailures = targets.length > 1;
+        const failed = [];
+        let firstError = null;
         for (const target of targets) {
             this.currentBuildType = target;
-            if (target === 'zst') {
-                if (useTemporaryDebForZst) {
-                    await this.buildAndCopy(url, 'deb', false);
+            try {
+                if (target === 'zst') {
+                    if (useTemporaryDebForZst) {
+                        await this.buildAndCopy(url, 'deb', false);
+                    }
+                    await this.createArchPackageFromDeb({
+                        removeSourceDeb: useTemporaryDebForZst,
+                    });
+                }
+                else {
+                    await this.buildAndCopy(url, target);
                 }
-                await this.createArchPackageFromDeb({
-                    removeSourceDeb: useTemporaryDebForZst,
-                });
             }
-            else {
-                await this.buildAndCopy(url, target);
+            catch (error) {
+                const err = error instanceof Error ? error : new Error(String(error));
+                if (!isolateFailures) {
+                    throw err;
+                }
+                if (!firstError) {
+                    firstError = err;
+                }
+                failed.push(target);
+                logger.warn(`✼ Failed to build "${target}" target: ${err.message.split('\n')[0]}`);
             }
         }
+        // Every requested target failed: surface the first real error.
+        if (firstError && failed.length === targets.length) {
+            throw firstError;
+        }
+        if (failed.length > 0) {
+            logger.warn(`✼ Skipped failed Linux targets: ${failed.join(', ')}. Other formats built successfully.`);
+        }
     }
     async ensureArchPackagingTools() {
         const requiredTools = [
@@ -1570,6 +1717,11 @@ post_remove() {
             ? (this.getTauriTarget(this.buildArch, 'linux') ?? undefined)
             : undefined;
         let fullCommand = this.buildBaseCommand(packageManager, configPath, buildTarget);
+        // --no-bundle: build the executable only, skipping .deb/.rpm/.appimage
+        // packaging entirely (e.g. RPM-based distros where the bundler aborts).
+        if (this.options.bundle === false) {
+            return `${fullCommand} --no-bundle`;
+        }
         if (this.currentBuildType) {
             fullCommand += ` --bundles ${this.currentBuildType}`;
         }
@@ -2131,6 +2283,19 @@ async function convertIconFormat(inputPath, appName) {
         return null;
     }
 }
+async function isLinuxBundleIconReady(iconPath) {
+    if (!IS_LINUX || path.extname(iconPath).toLowerCase() !== '.png') {
+        return false;
+    }
+    try {
+        const { width, height } = await sharp(iconPath).metadata();
+        return (width === PLATFORM_CONFIG.linux.size &&
+            height === PLATFORM_CONFIG.linux.size);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Processes downloaded or local icon for platform-specific format
  */
@@ -2140,7 +2305,7 @@ async function processIcon(iconPath, appName) {
     // Check if already in correct platform format
     const ext = path.extname(iconPath).toLowerCase();
     const isCorrectFormat = (IS_WIN && ext === '.ico') ||
-        (IS_LINUX && ext === '.png') ||
+        (IS_LINUX && (await isLinuxBundleIconReady(iconPath))) ||
         (!IS_WIN && !IS_LINUX && ext === '.icns');
     if (isCorrectFormat) {
         return await copyWindowsIconIfNeeded(iconPath, appName);
@@ -2546,6 +2711,11 @@ async function handleOptions(options, url) {
     if (!options.internalUrlRegex && options.safeDomain) {
         appOptions.internalUrlRegex = safeDomainsToRegex(options.safeDomain);
     }
+    // --no-bundle is Linux-only; keep normal packaging on other platforms.
+    if (appOptions.bundle === false && platform !== 'linux') {
+        logger.warn('✼ --no-bundle is only supported on Linux; ignoring it.');
+        appOptions.bundle = true;
+    }
     const iconPath = await handleIcon(appOptions, url);
     appOptions.icon = iconPath || '';
     return appOptions;
@@ -2569,7 +2739,7 @@ const DEFAULT_PAKE_OPTIONS = {
     targets: (() => {
         switch (process.platform) {
             case 'linux':
-                return 'deb,appimage';
+                return getDefaultLinuxTargets();
             case 'darwin':
                 return 'dmg';
             case 'win32':
@@ -2588,6 +2758,7 @@ const DEFAULT_PAKE_OPTIONS = {
     incognito: false,
     wasm: false,
     enableDragDrop: false,
+    bundle: true,
     keepBinary: false,
     multiInstance: false,
     multiWindow: false,
@@ -2621,7 +2792,7 @@ function validateNumberInput(value) {
     return parsedValue;
 }
 function validateUrlInput(url) {
-    const isFile = fs$1.existsSync(url);
+    const isFile = fs.existsSync(url);
     if (!isFile) {
         try {
             return normalizeUrl(url);
@@ -2727,6 +2898,9 @@ ${green('|_|   \\__,_|_|\\_\\___|  can turn any webpage into a desktop app with
         .addOption(new Option('--keep-binary', 'Keep raw binary file alongside installer')
         .default(DEFAULT_PAKE_OPTIONS.keepBinary)
         .hideHelp())
+        .addOption(new Option('--no-bundle', 'Skip packaging, output only the raw executable (Linux; for RPM distros where the bundler aborts)')
+        .default(DEFAULT_PAKE_OPTIONS.bundle)
+        .hideHelp())
         .addOption(new Option('--multi-instance', 'Allow multiple app instances')
         .default(DEFAULT_PAKE_OPTIONS.multiInstance)
         .hideHelp())
@@ -2749,8 +2923,8 @@ ${green('|_|   \\__,_|_|\\_\\___|  can turn any webpage into a desktop app with
         .default(DEFAULT_PAKE_OPTIONS.zoom)
         .argParser((value) => {
         const zoom = Number(value);
-        if (!Number.isFinite(zoom) || zoom < 50 || zoom > 200) {
-            throw new Error('--zoom must be a number between 50 and 200');
+        if (!Number.isInteger(zoom) || zoom < 50 || zoom > 200) {
+            throw new Error('--zoom must be an integer between 50 and 200');
         }
         return zoom;
     })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pake-cli",
-  "version": "3.12.1",
+  "version": "3.13.1",
   "description": "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。",
   "engines": {
     "node": ">=18.0.0"

package/src-tauri/Cargo.lock

@@ -2564,7 +2564,7 @@ dependencies = [
 
 [[package]]
 name = "pake"
-version = "3.12.1"
+version = "3.13.1"
 dependencies = [
  "objc2",
  "objc2-app-kit",

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pake"
-version = "3.12.1"
+version = "3.13.1"
 description = "🤱🏻 Turn any webpage into a desktop app with Rust."
 authors = ["Tw93"]
 license = "GPL-3.0-or-later"

package/src-tauri/src/app/invoke.rs

@@ -1,4 +1,7 @@
-use crate::util::{check_file_or_append, get_download_message_with_lang, show_toast, MessageType};
+use crate::util::{
+    check_file_or_append, get_download_message_with_lang, sanitize_download_filename, show_toast,
+    MessageType,
+};
 use std::fs::File;
 use std::io::Write;
 use std::str::FromStr;
@@ -93,7 +96,7 @@ pub async fn download_file(app: AppHandle, params: DownloadFileParams) -> Result
         .download_dir()
         .map_err(|e| format!("Failed to get download dir: {}", e))?;
 
-    let output_path = download_dir.join(&params.filename);
+    let output_path = download_dir.join(sanitize_download_filename(&params.filename));
 
     let path_str = output_path.to_str().ok_or("Invalid output path")?;
 
@@ -191,3 +194,15 @@ pub async fn update_theme_mode(app: AppHandle, mode: String) {
         let _ = window.set_theme(Some(theme));
     }
 }
+
+// Apply native WebView zoom (WKWebView pageZoom / WebView2 ZoomFactor / WebKitGTK
+// zoom level) instead of CSS hacks. CSS `transform: scale` and `html.style.zoom`
+// break complex SPAs like ChatGPT (fixed positioning shifts, unrepainted layers);
+// native zoom recalculates layout the same way a browser does for Cmd/Ctrl +/-.
+#[command]
+pub fn set_zoom(window: WebviewWindow, percent: f64) -> Result<(), String> {
+    let factor = (percent / 100.0).clamp(0.3, 2.0);
+    window
+        .set_zoom(factor)
+        .map_err(|e| format!("Failed to set zoom: {}", e))
+}

package/src-tauri/src/app/setup.rs

@@ -61,7 +61,12 @@ pub fn set_system_tray(
                 }
             }
             "quit" => {
-                let _ = app.save_window_state(StateFlags::all());
+                let flags = if _init_fullscreen {
+                    StateFlags::all()
+                } else {
+                    StateFlags::all() & !StateFlags::FULLSCREEN
+                };
+                let _ = app.save_window_state(flags);
                 app.exit(0);
             }
             _ => (),

package/src-tauri/src/app/window.rs

@@ -1,6 +1,7 @@
 use crate::app::config::PakeConfig;
 use crate::util::{
-    check_file_or_append, get_data_dir, get_download_message_with_lang, show_toast, MessageType,
+    check_file_or_append, get_data_dir, get_download_message_with_lang, sanitize_download_filename,
+    show_toast, MessageType,
 };
 use std::{
     path::PathBuf,
@@ -289,9 +290,17 @@ fn build_window(
     // any script that reads it (e.g. fullscreen polyfill checks for an opt-out
     // flag), and toast must register `window.pakeToast` before Rust code
     // calls show_toast().
+    window_builder = window_builder.initialization_script(&config_script);
+
+    // find.js is opt-in via --enable-find and no-ops at runtime when disabled,
+    // so only inject its ~700 lines when the feature is on. Avoids parsing the
+    // find UI on every page load in the common (find-off) case. Matches the
+    // enable_find gating already applied to the Find menu item.
+    if window_config.enable_find {
+        window_builder = window_builder.initialization_script(include_str!("../inject/find.js"));
+    }
+
     window_builder = window_builder
-        .initialization_script(&config_script)
-        .initialization_script(include_str!("../inject/find.js"))
         .initialization_script(include_str!("../inject/toast.js"))
         .initialization_script(include_str!("../inject/fullscreen.js"))
         .initialization_script(include_str!("../inject/event.js"))
@@ -456,7 +465,7 @@ fn build_window(
                             })
                             .unwrap_or_else(|| "download".to_string());
 
-                        let target = download_dir.join(filename);
+                        let target = download_dir.join(sanitize_download_filename(&filename));
                         if let Some(path_str) = target.to_str() {
                             *destination = PathBuf::from(check_file_or_append(path_str));
                         }

package/src-tauri/src/inject/event.js

@@ -11,19 +11,13 @@ const shortcuts = {
 };
 
 function setZoom(zoom) {
-  const html = document.getElementsByTagName("html")[0];
-  const body = document.body;
-  const zoomValue = parseFloat(zoom) / 100;
-  const isWindows = /windows/i.test(navigator.userAgent);
-
-  if (isWindows) {
-    body.style.transform = `scale(${zoomValue})`;
-    body.style.transformOrigin = "top left";
-    body.style.width = `${100 / zoomValue}%`;
-    body.style.height = `${100 / zoomValue}%`;
-  } else {
-    html.style.zoom = zoom;
-    window.dispatchEvent(new Event("resize"));
+  // Use native WebView zoom (WKWebView pageZoom / WebView2 ZoomFactor) instead of
+  // CSS hacks. `transform: scale` and `html.style.zoom` break complex SPAs like
+  // ChatGPT: the page shifts right on Windows and parts of the UI stop repainting
+  // on macOS. Native zoom recalculates layout exactly like a browser does.
+  const invoke = window.__TAURI__?.core?.invoke;
+  if (invoke) {
+    invoke("set_zoom", { percent: parseFloat(zoom) }).catch(() => {});
   }
 
   window.localStorage.setItem("htmlZoom", zoom);
@@ -59,6 +53,177 @@ function handleShortcut(event) {
   }
 }
 
+function isNonMacDesktop() {
+  return /windows|linux/i.test(navigator.userAgent);
+}
+
+function isEditableElement(element) {
+  if (!element) return false;
+
+  const tagName = element.tagName;
+  return (
+    tagName === "INPUT" || tagName === "TEXTAREA" || element.isContentEditable
+  );
+}
+
+function hasSelectedText() {
+  return Boolean(window.getSelection?.()?.toString());
+}
+
+const NON_TEXT_INPUT_TYPES = new Set([
+  "button",
+  "checkbox",
+  "color",
+  "file",
+  "hidden",
+  "image",
+  "radio",
+  "range",
+  "reset",
+  "submit",
+]);
+
+function isTextInputElement(element) {
+  return (
+    element?.tagName === "INPUT" &&
+    !NON_TEXT_INPUT_TYPES.has((element.type || "text").toLowerCase())
+  );
+}
+
+function selectEditableElement(element) {
+  if (typeof element.select === "function") {
+    element.select();
+    return true;
+  }
+
+  if (element.isContentEditable) {
+    const range = document.createRange();
+    range.selectNodeContents(element);
+    const selection = window.getSelection?.();
+    if (!selection) return false;
+
+    selection.removeAllRanges();
+    selection.addRange(range);
+    return true;
+  }
+
+  return false;
+}
+
+function canPasteIntoEditableElement(element) {
+  if (!isEditableElement(element)) return false;
+
+  if (element.tagName === "INPUT") {
+    return (
+      isTextInputElement(element) &&
+      element.disabled !== true &&
+      element.readOnly !== true
+    );
+  }
+
+  if (element.tagName === "TEXTAREA") {
+    return element.disabled !== true && element.readOnly !== true;
+  }
+
+  return true;
+}
+
+function insertTextIntoEditableElement(element, text) {
+  if (!text) return false;
+
+  if (document.execCommand("insertText", false, text)) {
+    return true;
+  }
+
+  if (
+    element &&
+    (isTextInputElement(element) || element.tagName === "TEXTAREA") &&
+    typeof element.setRangeText === "function"
+  ) {
+    const valueLength =
+      typeof element.value === "string" ? element.value.length : 0;
+    const start =
+      typeof element.selectionStart === "number"
+        ? element.selectionStart
+        : valueLength;
+    const end =
+      typeof element.selectionEnd === "number" ? element.selectionEnd : start;
+    element.setRangeText(text, start, end, "end");
+    element.dispatchEvent?.(new Event("input", { bubbles: true }));
+    return true;
+  }
+
+  return false;
+}
+
+function runBrowserPasteCommand() {
+  try {
+    return document.execCommand("paste") === true;
+  } catch (error) {
+    return false;
+  }
+}
+
+function pasteClipboardText(activeElement) {
+  if (runBrowserPasteCommand()) {
+    return;
+  }
+
+  const readText = navigator.clipboard?.readText;
+  if (typeof readText !== "function") {
+    return;
+  }
+
+  readText
+    .call(navigator.clipboard)
+    .then((text) => {
+      insertTextIntoEditableElement(activeElement, text);
+    })
+    .catch(() => {});
+}
+
+function handleClipboardShortcut(event) {
+  if (
+    event.isTrusted !== true ||
+    !isNonMacDesktop() ||
+    !event.ctrlKey ||
+    event.metaKey ||
+    event.altKey ||
+    event.shiftKey
+  ) {
+    return false;
+  }
+
+  const key = event.key?.toLowerCase();
+  const activeElement = document.activeElement;
+  const isEditable = isEditableElement(activeElement);
+
+  if (key === "c" && (isEditable || hasSelectedText())) {
+    document.execCommand("copy");
+    event.preventDefault();
+    return true;
+  }
+
+  if (key === "x" && isEditable) {
+    document.execCommand("cut");
+    event.preventDefault();
+    return true;
+  }
+
+  if (key === "v" && canPasteIntoEditableElement(activeElement)) {
+    event.preventDefault();
+    pasteClipboardText(activeElement);
+    return true;
+  }
+
+  if (key === "a" && isEditable && selectEditableElement(activeElement)) {
+    event.preventDefault();
+    return true;
+  }
+
+  return false;
+}
+
 const DOWNLOADABLE_FILE_EXTENSIONS = {
   documents: [
     "pdf",
@@ -281,12 +446,34 @@ function canNavigateAuthUrl(url) {
   return normalizedUrl !== "" && normalizedUrl !== "about:blank";
 }
 
+function isAppleAuthPopup(url, name) {
+  if (name === "AppleAuthentication") {
+    return true;
+  }
+
+  try {
+    return (
+      new URL(url, window.location.href).hostname.toLowerCase() ===
+      "appleid.apple.com"
+    );
+  } catch (error) {
+    return false;
+  }
+}
+
 function navigateInCurrentWindow(url) {
   window.location.href = url;
   return window;
 }
 
 function openAuthNavigation(originalWindowOpen, url, name, specs) {
+  if (isAppleAuthPopup(url, name)) {
+    const authWindow = originalWindowOpen.call(window, url, name, specs);
+    if (authWindow) {
+      return authWindow;
+    }
+  }
+
   if (shouldNavigateAuthInCurrentWindow() && canNavigateAuthUrl(url)) {
     return navigateInCurrentWindow(url);
   }
@@ -351,6 +538,8 @@ document.addEventListener("DOMContentLoaded", () => {
     });
   }
 
+  document.addEventListener("keydown", handleClipboardShortcut, true);
+
   document.addEventListener(
     "paste",
     (event) => {
@@ -492,13 +681,19 @@ document.addEventListener("DOMContentLoaded", () => {
 
         if (isInternalUrl(absoluteUrl)) {
           // With --new-window the Rust on_new_window handler opens an in-app
-          // window; without it, deferring to the native handler sends the
-          // _blank target to the system browser and strands SSO callbacks.
-          // Navigate in place so internal links stay inside the webview.
+          // window. Without it, leaving target="_blank" untouched lets the
+          // native webview escalate the click to a system-browser "new window".
+          //
+          // Many SPAs (e.g. Plane) tag in-app links with target="_blank" but
+          // route the click themselves via a React onClick that calls
+          // preventDefault + client-side navigation. Forcing a full
+          // window.location reload here (and stopping propagation) would defeat
+          // that handler and reload the whole app on every click. Instead,
+          // retarget the link to "_self" so the webview never opens a browser
+          // window, then let the page's own handler run. If nothing intercepts
+          // the click, the default _self navigation keeps it inside the app.
           if (!window.pakeConfig?.new_window) {
-            e.preventDefault();
-            e.stopImmediatePropagation();
-            window.location.href = absoluteUrl;
+            anchorElement.target = "_self";
           }
           return;
         }
@@ -1130,8 +1325,17 @@ function getFilenameFromUrl(url) {
 
       // Detect image type from URL or data URI
       if (url.startsWith("data:image/")) {
-        const mimeType = url.substring(11, url.indexOf(";"));
-        filename = `image-${timestamp}.${mimeType}`;
+        // Read only the MIME subtype: stop at ';' (params) or ',' (data),
+        // whichever comes first, so we never fold the encoding/payload into
+        // the extension. Map structured suffixes (svg+xml -> svg) and jpeg.
+        const semicolon = url.indexOf(";");
+        const comma = url.indexOf(",");
+        let end = url.length;
+        if (semicolon !== -1) end = Math.min(end, semicolon);
+        if (comma !== -1) end = Math.min(end, comma);
+        let ext = url.substring(11, end).split("+")[0];
+        if (ext === "jpeg") ext = "jpg";
+        filename = `image-${timestamp}.${ext}`;
       } else {
         // Default to common image extensions based on common patterns
         if (url.includes("jpg") || url.includes("jpeg")) {

package/src-tauri/src/inject/style.js

@@ -10,7 +10,7 @@ window.addEventListener("DOMContentLoaded", (_event) => {
     #Bottom > div.content > div.inner,
     #Rightbar .sep20:nth-of-type(5),
     #Rightbar > div.box:nth-child(4),
-    #Main > div.box:nth-child(8) > div
+    #Main > div.box:nth-child(8) > div,
     #Wrapper > div.sep20,
     #Main > div.box:nth-child(8),
     #masthead-ad,

package/src-tauri/src/lib.rs

@@ -22,7 +22,7 @@ const GDK_BACKEND: &str = "GDK_BACKEND";
 use app::{
     invoke::{
         clear_dock_badge, download_file, increment_dock_badge, send_notification, set_dock_badge,
-        set_dock_badge_label, update_theme_mode,
+        set_dock_badge_label, set_zoom, update_theme_mode,
     },
     setup::{set_global_shortcut, set_system_tray},
     window::{open_additional_window_safe, set_window, MultiWindowState},
@@ -155,7 +155,9 @@ pub fn run_app() {
             StateFlags::FULLSCREEN
         } else {
             // Prevent flickering on the first open.
-            StateFlags::all() & !StateFlags::VISIBLE
+            // Exclude FULLSCREEN so a prior --fullscreen build's persisted state
+            // doesn't force fullscreen on a rebuild without --fullscreen.
+            StateFlags::all() & !StateFlags::VISIBLE & !StateFlags::FULLSCREEN
         })
         .build();
 
@@ -192,6 +194,7 @@ pub fn run_app() {
             set_dock_badge_label,
             clear_dock_badge,
             update_theme_mode,
+            set_zoom,
         ])
         .setup(move |app| {
             app.manage(MultiWindowState::new(

package/src-tauri/src/util.rs

@@ -111,6 +111,22 @@ pub fn get_download_message_with_lang(
     .to_string()
 }
 
+pub fn sanitize_download_filename(filename: &str) -> String {
+    let Some(candidate) = filename
+        .rsplit(['/', '\\'])
+        .find(|part| !part.trim().is_empty())
+        .map(str::trim)
+    else {
+        return "download".to_string();
+    };
+
+    if candidate == "." || candidate == ".." {
+        "download".to_string()
+    } else {
+        candidate.to_string()
+    }
+}
+
 /// Check if the file exists. If it does, append `-N` to the stem until a free
 /// path is found.
 ///
@@ -218,6 +234,39 @@ mod tests {
         let _ = fs::remove_dir_all(path.parent().unwrap());
     }
 
+    #[test]
+    fn sanitize_download_filename_keeps_plain_names() {
+        assert_eq!(sanitize_download_filename("report.pdf"), "report.pdf");
+        assert_eq!(sanitize_download_filename(" report.pdf "), "report.pdf");
+    }
+
+    #[test]
+    fn sanitize_download_filename_takes_the_final_path_segment() {
+        assert_eq!(
+            sanitize_download_filename("../../private/report.pdf"),
+            "report.pdf"
+        );
+        assert_eq!(
+            sanitize_download_filename("..\\private\\report.pdf"),
+            "report.pdf"
+        );
+        assert_eq!(
+            sanitize_download_filename("nested/path/archive.tar.gz"),
+            "archive.tar.gz"
+        );
+    }
+
+    #[test]
+    fn sanitize_download_filename_falls_back_for_empty_or_parent_segments() {
+        for filename in ["", "   ", "/", "\\", ".", "..", "../..", "..\\.."] {
+            assert_eq!(
+                sanitize_download_filename(filename),
+                "download",
+                "{filename}"
+            );
+        }
+    }
+
     #[test]
     fn download_message_falls_back_to_english_for_unknown_locale() {
         let msg = get_download_message_with_lang(MessageType::Start, Some("fr-FR".to_string()));

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "productName": "Weekly",
   "identifier": "com.pake.weekly",
-  "version": "3.12.1",
+  "version": "3.13.1",
   "app": {
     "withGlobalTauri": true,
     "trayIcon": {