pake-cli 3.13.0 → 3.13.1

package/README.md

@@ -203,8 +203,7 @@ Pake's development can not be without these Hackers. They contributed a lot of c
 ## Support
 
 - The most direct way to support me is getting [Mole for Mac](https://mole.fit), my paid Mac cleanup app.
-- If Pake helped you, [share it](https://twitter.com/intent/tweet?url=https://github.com/tw93/Pake&text=Pake%20-%20Turn%20any%20webpage%20into%20a%20desktop%20app%20with%20one%20command.%20Nearly%2020x%20smaller%20than%20Electron%20packages,%20supports%20macOS%20Windows%20Linux) with friends or give it a star.
-- Got ideas or bugs? Open an issue or PR, feel free to contribute your best AI model.
+- If Pake helped you, give it a star, [share it](https://twitter.com/intent/tweet?url=https://github.com/tw93/Pake&text=Pake%20-%20Turn%20any%20webpage%20into%20a%20desktop%20app%20with%20one%20command.%20Nearly%2020x%20smaller%20than%20Electron%20packages,%20supports%20macOS%20Windows%20Linux), or open an issue or PR.
 - I have two cats, TangYuan and Coke. If you think Pake delights your life, you can feed them <a href="https://cats.tw93.fun?name=Pake" target="_blank">canned food 🥩</a>.
 
 <details>

package/dist/cli.js

@@ -20,7 +20,7 @@ import * as psl from 'psl';
 import { InvalidArgumentError, program as program$1, Option } from 'commander';
 
 var name = "pake-cli";
-var version = "3.13.0";
+var version = "3.13.1";
 var description = "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。";
 var engines = {
 	node: ">=18.0.0"
@@ -435,9 +435,13 @@ async function combineFiles(files, output) {
       });`;
         }
         const fileContent = await fs$1.readFile(file);
-        return ("window.addEventListener('DOMContentLoaded', (_event) => { " +
+        // Keep the closing `});` on its own line. If the injected file ends in a
+        // line comment without a trailing newline, appending ` });` on the same
+        // line would comment it out and break the wrapper (mirrors the .css
+        // branch above, which already closes on a separate line).
+        return ("window.addEventListener('DOMContentLoaded', (_event) => {\n" +
             fileContent +
-            ' });');
+            '\n});');
     }));
     await fs$1.writeFile(output, contents.join('\n'));
     return files;
@@ -508,6 +512,18 @@ function filterLinuxTargets(targets) {
 function needsTemporaryDebForZst(targets) {
     return targets.includes('zst') && !targets.includes('deb');
 }
+// Resolves the Tauri `bundle.targets` list for a Linux build from a
+// comma-separated --targets string (e.g. the distro-aware default
+// "deb,appimage"). zst is repacked from the deb payload, so it maps to a deb
+// bundle. hasValidTarget is false only when no known target is present, which
+// is the single case that should warn and fall back to the default.
+function resolveLinuxBundleTargets(targets) {
+    const requested = filterLinuxTargets(targets);
+    const bundleTargets = [
+        ...new Set(requested.map((target) => (target === 'zst' ? 'deb' : target))),
+    ];
+    return { bundleTargets, hasValidTarget: requested.length > 0 };
+}
 
 /**
  * Pure transform from CLI options to the window-config slice that gets
@@ -596,30 +612,31 @@ async function handleLocalFile(url, useLocalFile, tauriConf) {
         tauriConf.pake.windows[0].url_type = 'web';
     }
 }
-async function mergeLinuxConfig(options, name, tauriConf, linuxBinaryName) {
-    const linuxBundle = tauriConf.bundle.linux;
-    if (!linuxBundle) {
-        throw new Error('Linux bundle configuration is missing from tauri.linux.conf.json; cannot build Linux target.');
-    }
-    delete linuxBundle.deb.files;
-    const linuxName = generateLinuxPackageName(name);
-    const desktopFileName = `com.pake.${linuxName}.desktop`;
-    const iconName = `${linuxName}_512`;
-    const { title } = options;
+function buildLinuxDesktopContent(name, title, linuxBinaryName) {
     const chineseName = title && /[\u4e00-\u9fa5]/.test(title) ? title : null;
-    const desktopContent = `[Desktop Entry]
+    return `[Desktop Entry]
 Version=1.0
 Type=Application
 Name=${name}
 ${chineseName ? `Name[zh_CN]=${chineseName}` : ''}
 Comment=${name}
 Exec=${linuxBinaryName}
-Icon=${iconName}
+Icon=${linuxBinaryName}
 Categories=Network;WebBrowser;Utility;
 MimeType=text/html;text/xml;application/xhtml_xml;
 StartupNotify=true
 Terminal=false
 `;
+}
+async function mergeLinuxConfig(options, name, tauriConf, linuxBinaryName) {
+    const linuxBundle = tauriConf.bundle.linux;
+    if (!linuxBundle) {
+        throw new Error('Linux bundle configuration is missing from tauri.linux.conf.json; cannot build Linux target.');
+    }
+    delete linuxBundle.deb.files;
+    const linuxName = generateLinuxPackageName(name);
+    const desktopFileName = `com.pake.${linuxName}.desktop`;
+    const desktopContent = buildLinuxDesktopContent(name, options.title, linuxBinaryName);
     const srcAssetsDir = path.join(npmDirectory, 'src-tauri/assets');
     const srcDesktopFilePath = path.join(srcAssetsDir, desktopFileName);
     await fsExtra.ensureDir(srcAssetsDir);
@@ -634,19 +651,44 @@ Terminal=false
     linuxBundle.rpm.files = {
         [desktopInstallPath]: `assets/${desktopFileName}`,
     };
-    const validTargets = [
-        ...LINUX_TARGET_TYPES,
-        ...LINUX_TARGET_TYPES.map((target) => `${target}-arm64`),
-    ];
-    const baseTarget = options.targets.includes('-arm64')
-        ? options.targets.replace('-arm64', '')
-        : options.targets;
-    if (validTargets.includes(options.targets)) {
-        // zst is repacked from the deb payload, so Tauri itself bundles a deb.
-        tauriConf.bundle.targets = [baseTarget === 'zst' ? 'deb' : baseTarget];
+    // options.targets reaches here already stripped of any -arm64 suffix by the
+    // LinuxBuilder constructor, and may carry several comma-separated formats
+    // (e.g. the distro-aware default "deb,appimage"). Validate the parsed list
+    // rather than string-matching the whole value, so a valid multi-target
+    // default no longer trips the "must be one of ..." warning on every build.
+    const { bundleTargets, hasValidTarget } = resolveLinuxBundleTargets(options.targets);
+    if (hasValidTarget) {
+        tauriConf.bundle.targets = bundleTargets;
     }
     else {
-        logger.warn(`✼ The target must be one of ${validTargets.join(', ')}, the default 'deb' will be used.`);
+        logger.warn(`✼ The target must be one of ${LINUX_TARGET_TYPES.join(', ')}, the default 'deb' will be used.`);
+    }
+}
+async function resolveSystemTrayIconPath(systemTrayIcon, defaultTrayIconPath, safeAppName, iconOutputDir = path.join(npmDirectory, 'src-tauri/png')) {
+    if (systemTrayIcon.length === 0) {
+        return defaultTrayIconPath;
+    }
+    try {
+        const iconExt = path.extname(systemTrayIcon).toLowerCase();
+        if (iconExt !== '.png' && iconExt !== '.ico') {
+            logger.warn(`✼ System tray icon must be .ico or .png, but you provided ${iconExt}.`);
+            logger.warn(`✼ Default system tray icon will be used.`);
+            return defaultTrayIconPath;
+        }
+        if (!(await fsExtra.pathExists(systemTrayIcon))) {
+            logger.warn(`✼ System tray icon "${systemTrayIcon}" was not found.`);
+            logger.warn(`✼ Default system tray icon will be used.`);
+            return defaultTrayIconPath;
+        }
+        const trayIconPath = `png/${safeAppName}${iconExt}`;
+        const trayIcoPath = path.join(iconOutputDir, `${safeAppName}${iconExt}`);
+        await fsExtra.copy(systemTrayIcon, trayIcoPath);
+        return trayIconPath;
+    }
+    catch (err) {
+        logger.warn(`✼ Failed to apply system tray icon "${systemTrayIcon}": ${err instanceof Error ? err.message : String(err)}`);
+        logger.warn(`✼ Default system tray icon will remain unchanged.`);
+        return defaultTrayIconPath;
     }
 }
 async function mergeIcons(options, name, tauriConf, platform, safeAppName) {
@@ -709,26 +751,8 @@ async function mergeIcons(options, name, tauriConf, platform, safeAppName) {
         tauriConf.bundle.icon = [iconInfo.defaultIcon];
     }
     // Set tray icon path.
-    let trayIconPath = platform === 'darwin' ? 'png/icon_512.png' : tauriConf.bundle.icon[0];
-    if (options.systemTrayIcon.length > 0) {
-        try {
-            await fsExtra.pathExists(options.systemTrayIcon);
-            const iconExt = path.extname(options.systemTrayIcon).toLowerCase();
-            if (iconExt === '.png' || iconExt === '.ico') {
-                const trayIcoPath = path.join(npmDirectory, `src-tauri/png/${safeAppName}${iconExt}`);
-                trayIconPath = `png/${safeAppName}${iconExt}`;
-                await fsExtra.copy(options.systemTrayIcon, trayIcoPath);
-            }
-            else {
-                logger.warn(`✼ System tray icon must be .ico or .png, but you provided ${iconExt}.`);
-                logger.warn(`✼ Default system tray icon will be used.`);
-            }
-        }
-        catch (err) {
-            logger.warn(`✼ Failed to apply system tray icon "${options.systemTrayIcon}": ${err instanceof Error ? err.message : String(err)}`);
-            logger.warn(`✼ Default system tray icon will remain unchanged.`);
-        }
-    }
+    const defaultTrayIconPath = platform === 'darwin' ? 'png/icon_512.png' : tauriConf.bundle.icon[0];
+    const trayIconPath = await resolveSystemTrayIconPath(options.systemTrayIcon, defaultTrayIconPath, safeAppName);
     tauriConf.pake.system_tray_path = trayIconPath;
     delete tauriConf.app.trayIcon;
 }
@@ -1141,6 +1165,16 @@ class BaseBuilder {
                 throw retryError;
             }
         }
+        // With --no-bundle there is no installer to copy; surface the raw
+        // executable the build produced instead.
+        if (this.options.bundle === false) {
+            await this.copyRawBinary(npmDirectory, name);
+            if (logSuccess) {
+                logger.success('✔ Build success!');
+                logger.success('✔ Raw binary located in', path.resolve(this.getRawBinaryPath(name)));
+            }
+            return;
+        }
         // Copy app
         const fileName = this.getFileName();
         const fileType = this.getFileType(target);
@@ -1508,17 +1542,11 @@ class LinuxBuilder extends BaseBuilder {
             arch =
                 buildType === 'rpm' || buildType === 'appimage' ? 'aarch64' : 'arm64';
         }
+        else if (this.buildArch === 'x64') {
+            arch = buildType === 'rpm' ? 'x86_64' : 'amd64';
+        }
         else {
-            if (this.buildArch === 'x64') {
-                arch = buildType === 'rpm' ? 'x86_64' : 'amd64';
-            }
-            else {
-                arch = this.buildArch;
-                if (this.buildArch === 'arm64' &&
-                    (buildType === 'rpm' || buildType === 'appimage')) {
-                    arch = 'aarch64';
-                }
-            }
+            arch = this.buildArch;
         }
         if (this.currentBuildType === 'rpm') {
             return `${name}-${version}-1.${arch}`;
@@ -1526,6 +1554,11 @@ class LinuxBuilder extends BaseBuilder {
         return `${name}_${version}_${arch}`;
     }
     async build(url) {
+        // --no-bundle: build the executable once with no per-format packaging loop.
+        if (this.options.bundle === false) {
+            await this.buildAndCopy(url, 'deb');
+            return;
+        }
         const targets = filterLinuxTargets(this.options.targets);
         if (targets.length === 0) {
             throw new Error(`No valid Linux target in "${this.options.targets}". Valid targets: ${LINUX_TARGET_TYPES.join(', ')}.`);
@@ -1684,6 +1717,11 @@ post_remove() {
             ? (this.getTauriTarget(this.buildArch, 'linux') ?? undefined)
             : undefined;
         let fullCommand = this.buildBaseCommand(packageManager, configPath, buildTarget);
+        // --no-bundle: build the executable only, skipping .deb/.rpm/.appimage
+        // packaging entirely (e.g. RPM-based distros where the bundler aborts).
+        if (this.options.bundle === false) {
+            return `${fullCommand} --no-bundle`;
+        }
         if (this.currentBuildType) {
             fullCommand += ` --bundles ${this.currentBuildType}`;
         }
@@ -2245,6 +2283,19 @@ async function convertIconFormat(inputPath, appName) {
         return null;
     }
 }
+async function isLinuxBundleIconReady(iconPath) {
+    if (!IS_LINUX || path.extname(iconPath).toLowerCase() !== '.png') {
+        return false;
+    }
+    try {
+        const { width, height } = await sharp(iconPath).metadata();
+        return (width === PLATFORM_CONFIG.linux.size &&
+            height === PLATFORM_CONFIG.linux.size);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Processes downloaded or local icon for platform-specific format
  */
@@ -2254,7 +2305,7 @@ async function processIcon(iconPath, appName) {
     // Check if already in correct platform format
     const ext = path.extname(iconPath).toLowerCase();
     const isCorrectFormat = (IS_WIN && ext === '.ico') ||
-        (IS_LINUX && ext === '.png') ||
+        (IS_LINUX && (await isLinuxBundleIconReady(iconPath))) ||
         (!IS_WIN && !IS_LINUX && ext === '.icns');
     if (isCorrectFormat) {
         return await copyWindowsIconIfNeeded(iconPath, appName);
@@ -2660,6 +2711,11 @@ async function handleOptions(options, url) {
     if (!options.internalUrlRegex && options.safeDomain) {
         appOptions.internalUrlRegex = safeDomainsToRegex(options.safeDomain);
     }
+    // --no-bundle is Linux-only; keep normal packaging on other platforms.
+    if (appOptions.bundle === false && platform !== 'linux') {
+        logger.warn('✼ --no-bundle is only supported on Linux; ignoring it.');
+        appOptions.bundle = true;
+    }
     const iconPath = await handleIcon(appOptions, url);
     appOptions.icon = iconPath || '';
     return appOptions;
@@ -2702,6 +2758,7 @@ const DEFAULT_PAKE_OPTIONS = {
     incognito: false,
     wasm: false,
     enableDragDrop: false,
+    bundle: true,
     keepBinary: false,
     multiInstance: false,
     multiWindow: false,
@@ -2841,6 +2898,9 @@ ${green('|_|   \\__,_|_|\\_\\___|  can turn any webpage into a desktop app with
         .addOption(new Option('--keep-binary', 'Keep raw binary file alongside installer')
         .default(DEFAULT_PAKE_OPTIONS.keepBinary)
         .hideHelp())
+        .addOption(new Option('--no-bundle', 'Skip packaging, output only the raw executable (Linux; for RPM distros where the bundler aborts)')
+        .default(DEFAULT_PAKE_OPTIONS.bundle)
+        .hideHelp())
         .addOption(new Option('--multi-instance', 'Allow multiple app instances')
         .default(DEFAULT_PAKE_OPTIONS.multiInstance)
         .hideHelp())
@@ -2863,8 +2923,8 @@ ${green('|_|   \\__,_|_|\\_\\___|  can turn any webpage into a desktop app with
         .default(DEFAULT_PAKE_OPTIONS.zoom)
         .argParser((value) => {
         const zoom = Number(value);
-        if (!Number.isFinite(zoom) || zoom < 50 || zoom > 200) {
-            throw new Error('--zoom must be a number between 50 and 200');
+        if (!Number.isInteger(zoom) || zoom < 50 || zoom > 200) {
+            throw new Error('--zoom must be an integer between 50 and 200');
         }
         return zoom;
     })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pake-cli",
-  "version": "3.13.0",
+  "version": "3.13.1",
   "description": "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。",
   "engines": {
     "node": ">=18.0.0"

package/src-tauri/Cargo.lock

@@ -2564,7 +2564,7 @@ dependencies = [
 
 [[package]]
 name = "pake"
-version = "3.13.0"
+version = "3.13.1"
 dependencies = [
  "objc2",
  "objc2-app-kit",

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pake"
-version = "3.13.0"
+version = "3.13.1"
 description = "🤱🏻 Turn any webpage into a desktop app with Rust."
 authors = ["Tw93"]
 license = "GPL-3.0-or-later"

package/src-tauri/src/app/invoke.rs

@@ -1,4 +1,7 @@
-use crate::util::{check_file_or_append, get_download_message_with_lang, show_toast, MessageType};
+use crate::util::{
+    check_file_or_append, get_download_message_with_lang, sanitize_download_filename, show_toast,
+    MessageType,
+};
 use std::fs::File;
 use std::io::Write;
 use std::str::FromStr;
@@ -93,7 +96,7 @@ pub async fn download_file(app: AppHandle, params: DownloadFileParams) -> Result
         .download_dir()
         .map_err(|e| format!("Failed to get download dir: {}", e))?;
 
-    let output_path = download_dir.join(&params.filename);
+    let output_path = download_dir.join(sanitize_download_filename(&params.filename));
 
     let path_str = output_path.to_str().ok_or("Invalid output path")?;
 

package/src-tauri/src/app/window.rs

@@ -1,6 +1,7 @@
 use crate::app::config::PakeConfig;
 use crate::util::{
-    check_file_or_append, get_data_dir, get_download_message_with_lang, show_toast, MessageType,
+    check_file_or_append, get_data_dir, get_download_message_with_lang, sanitize_download_filename,
+    show_toast, MessageType,
 };
 use std::{
     path::PathBuf,
@@ -289,9 +290,17 @@ fn build_window(
     // any script that reads it (e.g. fullscreen polyfill checks for an opt-out
     // flag), and toast must register `window.pakeToast` before Rust code
     // calls show_toast().
+    window_builder = window_builder.initialization_script(&config_script);
+
+    // find.js is opt-in via --enable-find and no-ops at runtime when disabled,
+    // so only inject its ~700 lines when the feature is on. Avoids parsing the
+    // find UI on every page load in the common (find-off) case. Matches the
+    // enable_find gating already applied to the Find menu item.
+    if window_config.enable_find {
+        window_builder = window_builder.initialization_script(include_str!("../inject/find.js"));
+    }
+
     window_builder = window_builder
-        .initialization_script(&config_script)
-        .initialization_script(include_str!("../inject/find.js"))
         .initialization_script(include_str!("../inject/toast.js"))
         .initialization_script(include_str!("../inject/fullscreen.js"))
         .initialization_script(include_str!("../inject/event.js"))
@@ -456,7 +465,7 @@ fn build_window(
                             })
                             .unwrap_or_else(|| "download".to_string());
 
-                        let target = download_dir.join(filename);
+                        let target = download_dir.join(sanitize_download_filename(&filename));
                         if let Some(path_str) = target.to_str() {
                             *destination = PathBuf::from(check_file_or_append(path_str));
                         }

package/src-tauri/src/inject/event.js

@@ -53,6 +53,177 @@ function handleShortcut(event) {
   }
 }
 
+function isNonMacDesktop() {
+  return /windows|linux/i.test(navigator.userAgent);
+}
+
+function isEditableElement(element) {
+  if (!element) return false;
+
+  const tagName = element.tagName;
+  return (
+    tagName === "INPUT" || tagName === "TEXTAREA" || element.isContentEditable
+  );
+}
+
+function hasSelectedText() {
+  return Boolean(window.getSelection?.()?.toString());
+}
+
+const NON_TEXT_INPUT_TYPES = new Set([
+  "button",
+  "checkbox",
+  "color",
+  "file",
+  "hidden",
+  "image",
+  "radio",
+  "range",
+  "reset",
+  "submit",
+]);
+
+function isTextInputElement(element) {
+  return (
+    element?.tagName === "INPUT" &&
+    !NON_TEXT_INPUT_TYPES.has((element.type || "text").toLowerCase())
+  );
+}
+
+function selectEditableElement(element) {
+  if (typeof element.select === "function") {
+    element.select();
+    return true;
+  }
+
+  if (element.isContentEditable) {
+    const range = document.createRange();
+    range.selectNodeContents(element);
+    const selection = window.getSelection?.();
+    if (!selection) return false;
+
+    selection.removeAllRanges();
+    selection.addRange(range);
+    return true;
+  }
+
+  return false;
+}
+
+function canPasteIntoEditableElement(element) {
+  if (!isEditableElement(element)) return false;
+
+  if (element.tagName === "INPUT") {
+    return (
+      isTextInputElement(element) &&
+      element.disabled !== true &&
+      element.readOnly !== true
+    );
+  }
+
+  if (element.tagName === "TEXTAREA") {
+    return element.disabled !== true && element.readOnly !== true;
+  }
+
+  return true;
+}
+
+function insertTextIntoEditableElement(element, text) {
+  if (!text) return false;
+
+  if (document.execCommand("insertText", false, text)) {
+    return true;
+  }
+
+  if (
+    element &&
+    (isTextInputElement(element) || element.tagName === "TEXTAREA") &&
+    typeof element.setRangeText === "function"
+  ) {
+    const valueLength =
+      typeof element.value === "string" ? element.value.length : 0;
+    const start =
+      typeof element.selectionStart === "number"
+        ? element.selectionStart
+        : valueLength;
+    const end =
+      typeof element.selectionEnd === "number" ? element.selectionEnd : start;
+    element.setRangeText(text, start, end, "end");
+    element.dispatchEvent?.(new Event("input", { bubbles: true }));
+    return true;
+  }
+
+  return false;
+}
+
+function runBrowserPasteCommand() {
+  try {
+    return document.execCommand("paste") === true;
+  } catch (error) {
+    return false;
+  }
+}
+
+function pasteClipboardText(activeElement) {
+  if (runBrowserPasteCommand()) {
+    return;
+  }
+
+  const readText = navigator.clipboard?.readText;
+  if (typeof readText !== "function") {
+    return;
+  }
+
+  readText
+    .call(navigator.clipboard)
+    .then((text) => {
+      insertTextIntoEditableElement(activeElement, text);
+    })
+    .catch(() => {});
+}
+
+function handleClipboardShortcut(event) {
+  if (
+    event.isTrusted !== true ||
+    !isNonMacDesktop() ||
+    !event.ctrlKey ||
+    event.metaKey ||
+    event.altKey ||
+    event.shiftKey
+  ) {
+    return false;
+  }
+
+  const key = event.key?.toLowerCase();
+  const activeElement = document.activeElement;
+  const isEditable = isEditableElement(activeElement);
+
+  if (key === "c" && (isEditable || hasSelectedText())) {
+    document.execCommand("copy");
+    event.preventDefault();
+    return true;
+  }
+
+  if (key === "x" && isEditable) {
+    document.execCommand("cut");
+    event.preventDefault();
+    return true;
+  }
+
+  if (key === "v" && canPasteIntoEditableElement(activeElement)) {
+    event.preventDefault();
+    pasteClipboardText(activeElement);
+    return true;
+  }
+
+  if (key === "a" && isEditable && selectEditableElement(activeElement)) {
+    event.preventDefault();
+    return true;
+  }
+
+  return false;
+}
+
 const DOWNLOADABLE_FILE_EXTENSIONS = {
   documents: [
     "pdf",
@@ -275,12 +446,34 @@ function canNavigateAuthUrl(url) {
   return normalizedUrl !== "" && normalizedUrl !== "about:blank";
 }
 
+function isAppleAuthPopup(url, name) {
+  if (name === "AppleAuthentication") {
+    return true;
+  }
+
+  try {
+    return (
+      new URL(url, window.location.href).hostname.toLowerCase() ===
+      "appleid.apple.com"
+    );
+  } catch (error) {
+    return false;
+  }
+}
+
 function navigateInCurrentWindow(url) {
   window.location.href = url;
   return window;
 }
 
 function openAuthNavigation(originalWindowOpen, url, name, specs) {
+  if (isAppleAuthPopup(url, name)) {
+    const authWindow = originalWindowOpen.call(window, url, name, specs);
+    if (authWindow) {
+      return authWindow;
+    }
+  }
+
   if (shouldNavigateAuthInCurrentWindow() && canNavigateAuthUrl(url)) {
     return navigateInCurrentWindow(url);
   }
@@ -345,6 +538,8 @@ document.addEventListener("DOMContentLoaded", () => {
     });
   }
 
+  document.addEventListener("keydown", handleClipboardShortcut, true);
+
   document.addEventListener(
     "paste",
     (event) => {
@@ -486,13 +681,19 @@ document.addEventListener("DOMContentLoaded", () => {
 
         if (isInternalUrl(absoluteUrl)) {
           // With --new-window the Rust on_new_window handler opens an in-app
-          // window; without it, deferring to the native handler sends the
-          // _blank target to the system browser and strands SSO callbacks.
-          // Navigate in place so internal links stay inside the webview.
+          // window. Without it, leaving target="_blank" untouched lets the
+          // native webview escalate the click to a system-browser "new window".
+          //
+          // Many SPAs (e.g. Plane) tag in-app links with target="_blank" but
+          // route the click themselves via a React onClick that calls
+          // preventDefault + client-side navigation. Forcing a full
+          // window.location reload here (and stopping propagation) would defeat
+          // that handler and reload the whole app on every click. Instead,
+          // retarget the link to "_self" so the webview never opens a browser
+          // window, then let the page's own handler run. If nothing intercepts
+          // the click, the default _self navigation keeps it inside the app.
           if (!window.pakeConfig?.new_window) {
-            e.preventDefault();
-            e.stopImmediatePropagation();
-            window.location.href = absoluteUrl;
+            anchorElement.target = "_self";
           }
           return;
         }
@@ -1124,8 +1325,17 @@ function getFilenameFromUrl(url) {
 
       // Detect image type from URL or data URI
       if (url.startsWith("data:image/")) {
-        const mimeType = url.substring(11, url.indexOf(";"));
-        filename = `image-${timestamp}.${mimeType}`;
+        // Read only the MIME subtype: stop at ';' (params) or ',' (data),
+        // whichever comes first, so we never fold the encoding/payload into
+        // the extension. Map structured suffixes (svg+xml -> svg) and jpeg.
+        const semicolon = url.indexOf(";");
+        const comma = url.indexOf(",");
+        let end = url.length;
+        if (semicolon !== -1) end = Math.min(end, semicolon);
+        if (comma !== -1) end = Math.min(end, comma);
+        let ext = url.substring(11, end).split("+")[0];
+        if (ext === "jpeg") ext = "jpg";
+        filename = `image-${timestamp}.${ext}`;
       } else {
         // Default to common image extensions based on common patterns
         if (url.includes("jpg") || url.includes("jpeg")) {

package/src-tauri/src/inject/style.js

@@ -10,7 +10,7 @@ window.addEventListener("DOMContentLoaded", (_event) => {
     #Bottom > div.content > div.inner,
     #Rightbar .sep20:nth-of-type(5),
     #Rightbar > div.box:nth-child(4),
-    #Main > div.box:nth-child(8) > div
+    #Main > div.box:nth-child(8) > div,
     #Wrapper > div.sep20,
     #Main > div.box:nth-child(8),
     #masthead-ad,

package/src-tauri/src/util.rs

@@ -111,6 +111,22 @@ pub fn get_download_message_with_lang(
     .to_string()
 }
 
+pub fn sanitize_download_filename(filename: &str) -> String {
+    let Some(candidate) = filename
+        .rsplit(['/', '\\'])
+        .find(|part| !part.trim().is_empty())
+        .map(str::trim)
+    else {
+        return "download".to_string();
+    };
+
+    if candidate == "." || candidate == ".." {
+        "download".to_string()
+    } else {
+        candidate.to_string()
+    }
+}
+
 /// Check if the file exists. If it does, append `-N` to the stem until a free
 /// path is found.
 ///
@@ -218,6 +234,39 @@ mod tests {
         let _ = fs::remove_dir_all(path.parent().unwrap());
     }
 
+    #[test]
+    fn sanitize_download_filename_keeps_plain_names() {
+        assert_eq!(sanitize_download_filename("report.pdf"), "report.pdf");
+        assert_eq!(sanitize_download_filename(" report.pdf "), "report.pdf");
+    }
+
+    #[test]
+    fn sanitize_download_filename_takes_the_final_path_segment() {
+        assert_eq!(
+            sanitize_download_filename("../../private/report.pdf"),
+            "report.pdf"
+        );
+        assert_eq!(
+            sanitize_download_filename("..\\private\\report.pdf"),
+            "report.pdf"
+        );
+        assert_eq!(
+            sanitize_download_filename("nested/path/archive.tar.gz"),
+            "archive.tar.gz"
+        );
+    }
+
+    #[test]
+    fn sanitize_download_filename_falls_back_for_empty_or_parent_segments() {
+        for filename in ["", "   ", "/", "\\", ".", "..", "../..", "..\\.."] {
+            assert_eq!(
+                sanitize_download_filename(filename),
+                "download",
+                "{filename}"
+            );
+        }
+    }
+
     #[test]
     fn download_message_falls_back_to_english_for_unknown_locale() {
         let msg = get_download_message_with_lang(MessageType::Start, Some("fr-FR".to_string()));

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "productName": "Weekly",
   "identifier": "com.pake.weekly",
-  "version": "3.13.0",
+  "version": "3.13.1",
   "app": {
     "withGlobalTauri": true,
     "trayIcon": {