pake-cli 3.15.0 → 3.15.2

package/README.md

@@ -194,6 +194,12 @@ First-time packaging requires environment setup and may be slower, subsequent bu
 
 Using Pake from a script or AI agent? Pass `--json` for machine-readable results, describe apps declaratively with `--config app.json` ([schema](schema/pake.schema.json)), and package local build output directly with `pake ./dist --name MyTool`. See [llms.txt](llms.txt) for the full agent contract. Claude Code users can install the official skill with `/plugin marketplace add tw93/Pake` and `/plugin install pake@pake`.
 
+Copy this to your AI agent to get started:
+
+```text
+Use Pake (npm i -g pake-cli) to package webpages as desktop apps. Read https://raw.githubusercontent.com/tw93/Pake/main/llms.txt first; always run pake with --json and parse stdout as a single JSON object. Package <url-or-local-dist> into an app named <AppName>.
+```
+
 ## Development
 
 Requires Rust `>=1.85` and Node `>=22` (recommended LTS; `>=18` also works). For detailed installation guide, see [Tauri documentation](https://v2.tauri.app/start/prerequisites/). If unfamiliar with development environment, use the CLI tool instead.

package/dist/cli.js

@@ -20,7 +20,7 @@ import * as psl from 'psl';
 import { InvalidArgumentError, program as program$1, Option } from 'commander';
 
 var name = "pake-cli";
-var version = "3.15.0";
+var version = "3.15.2";
 var description = "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。";
 var engines = {
 	node: ">=18.0.0"
@@ -680,15 +680,63 @@ async function copyTemplateConfigs() {
 async function stageLocalTree(sourceDir) {
     const distDir = path.join(npmDirectory, 'dist');
     const distBakDir = path.join(npmDirectory, 'dist_bak');
-    if (await fsExtra.pathExists(distBakDir)) {
+    // Resolve symlinked input up front: staging must produce a real copy, or
+    // the cli.js copy-back below would write through the link into the user's
+    // own directory.
+    const resolvedSource = await fsExtra.realpath(sourceDir);
+    const resolvedPackage = await fsExtra
+        .realpath(npmDirectory)
+        .catch(() => path.resolve(npmDirectory));
+    const packageDist = path.join(resolvedPackage, 'dist');
+    if (resolvedSource === resolvedPackage ||
+        resolvedPackage.startsWith(resolvedSource + path.sep) ||
+        resolvedSource === packageDist ||
+        resolvedSource.startsWith(packageDist + path.sep)) {
+        throw new PakeError(`Local input "${sourceDir}" contains the Pake CLI installation itself.`, {
+            code: 'INVALID_INPUT',
+            hint: 'Point Pake at your built output directory, not at a directory containing pake-cli.',
+        });
+    }
+    try {
+        if (await fsExtra.pathExists(distBakDir)) {
+            fsExtra.removeSync(distDir);
+        }
+        else {
+            fsExtra.moveSync(distDir, distBakDir);
+        }
+        fsExtra.copySync(resolvedSource, distDir, {
+            overwrite: true,
+            dereference: true,
+        });
+        const filesToCopyBack = ['cli.js'];
+        await Promise.all(filesToCopyBack.map((file) => fsExtra.copy(path.join(distBakDir, file), path.join(distDir, file))));
+    }
+    catch (error) {
+        // Never leave the package without its own dist/: cli.js lives there and
+        // every later `pake` invocation would fail until a manual reinstall.
+        restoreLocalTree();
+        throw error;
+    }
+}
+// Put the package's original dist/ back once a local-input run is over (or
+// failed). Tauri bakes `frontendDist: ../dist` into every binary, so a stale
+// staged tree would leak this user's files into the next app built from the
+// same install. Safe to call on any run: a present dist_bak always holds the
+// original package dist, including one stranded by an older crashed run.
+function restoreLocalTree() {
+    const distDir = path.join(npmDirectory, 'dist');
+    const distBakDir = path.join(npmDirectory, 'dist_bak');
+    if (!fsExtra.pathExistsSync(distBakDir)) {
+        return;
+    }
+    try {
         fsExtra.removeSync(distDir);
+        fsExtra.moveSync(distBakDir, distDir);
     }
-    else {
-        fsExtra.moveSync(distDir, distBakDir);
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        logger.warn(`Failed to restore the CLI's original dist/ from dist_bak: ${detail}`);
     }
-    fsExtra.copySync(sourceDir, distDir, { overwrite: true });
-    const filesToCopyBack = ['cli.js'];
-    await Promise.all(filesToCopyBack.map((file) => fsExtra.copy(path.join(distBakDir, file), path.join(distDir, file))));
 }
 // Exported for unit tests (web fallback and directory entry guard).
 async function handleLocalFile(url, useLocalFile, tauriConf) {
@@ -3175,6 +3223,15 @@ ${green('|_|   \\__,_|_|\\_\\___|  can turn any webpage into a desktop app with
 const REJECTED_KEYS = new Set(['config', 'json', 'version']);
 // Optional CLI options that have no entry in DEFAULT_PAKE_OPTIONS.
 const EXTRA_STRING_KEYS = new Set(['name', 'title', 'identifier']);
+// Numeric fields share the CLI flag ranges (see cli-program.ts validators),
+// so a config file cannot smuggle a value the same flag would reject.
+const NUMBER_RANGES = {
+    width: { min: 0 },
+    height: { min: 0 },
+    minWidth: { min: 0 },
+    minHeight: { min: 0 },
+    zoom: { min: 50, max: 200 },
+};
 function expectedTypeFor(key) {
     if (key === 'inject')
         return 'string[]';
@@ -3252,6 +3309,20 @@ async function loadConfigFile(configPath, validKeys) {
                 hint: 'See schema/pake.schema.json for field types.',
             });
         }
+        if (typeof value === 'number') {
+            const range = NUMBER_RANGES[key];
+            const min = range?.min ?? 0;
+            const max = range?.max;
+            if (!Number.isFinite(value) ||
+                value < min ||
+                (max !== undefined && value > max)) {
+                const bounds = max !== undefined ? `${min}-${max}` : `>= ${min}`;
+                throw new PakeError(`Config field "${key}" must be a finite number (${bounds}).`, {
+                    code: 'INVALID_INPUT',
+                    hint: 'See schema/pake.schema.json for field ranges.',
+                });
+            }
+        }
         if (!expected && (typeof value === 'object' || value === null)) {
             throw new PakeError(`Config field "${key}" must be a string, number, or boolean.`, {
                 code: 'INVALID_INPUT',
@@ -3314,6 +3385,9 @@ program.action(async (urlArg, options) => {
     let appName = null;
     let url = urlArg;
     try {
+        // Heal a dist_bak stranded by an earlier crashed local-input run before
+        // building, or this build would embed that run's staged files.
+        restoreLocalTree();
         if (!jsonMode) {
             await checkUpdateTips();
         }
@@ -3379,7 +3453,7 @@ program.action(async (urlArg, options) => {
         // program.help() and --help/--version throw under exitOverride with
         // exitCode 0; a clean commander exit is not a failure.
         if (isCommanderExit(error) && error.exitCode === 0) {
-            process.exit(0);
+            return;
         }
         const classified = classifyError(error, phase);
         if (jsonMode) {
@@ -3408,14 +3482,22 @@ program.action(async (urlArg, options) => {
         else {
             console.error(chalk.red(`✕ Unexpected error: ${String(error)}`));
         }
-        process.exit(ERROR_EXIT_CODES[classified.code]);
+        // exitCode + natural exit instead of process.exit: lets the finally
+        // restore run and guarantees the JSON result is flushed on piped stdout.
+        process.exitCode = ERROR_EXIT_CODES[classified.code];
+    }
+    finally {
+        // A local-input run replaces the package's own dist/ during staging; put
+        // it back so the CLI stays intact and later builds cannot embed this
+        // user's files.
+        restoreLocalTree();
     }
 });
 program.parseAsync().catch((error) => {
     if (isCommanderExit(error)) {
         // --help / --version and friends exit clean; commander already printed.
         if (error.exitCode === 0) {
-            process.exit(0);
+            return;
         }
         // Parse errors (unknown option, invalid argument, missing value) are
         // invalid input. Commander already printed the message to stderr; in
@@ -3435,7 +3517,8 @@ program.parseAsync().catch((error) => {
                 },
             });
         }
-        process.exit(ERROR_EXIT_CODES.INVALID_INPUT);
+        process.exitCode = ERROR_EXIT_CODES.INVALID_INPUT;
+        return;
     }
     if (error instanceof Error) {
         console.error(chalk.red(`✕ ${error.message}`));
@@ -3443,5 +3526,5 @@ program.parseAsync().catch((error) => {
     else {
         console.error(chalk.red(`✕ Unexpected error: ${String(error)}`));
     }
-    process.exit(1);
+    process.exitCode = 1;
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pake-cli",
-  "version": "3.15.0",
+  "version": "3.15.2",
   "description": "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。",
   "engines": {
     "node": ">=18.0.0"

package/src-tauri/Cargo.lock

@@ -2564,7 +2564,7 @@ dependencies = [
 
 [[package]]
 name = "pake"
-version = "3.15.0"
+version = "3.15.2"
 dependencies = [
  "objc2",
  "objc2-app-kit",

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pake"
-version = "3.15.0"
+version = "3.15.2"
 description = "🤱🏻 Turn any webpage into a desktop app with Rust."
 authors = ["Tw93"]
 license = "GPL-3.0-or-later"

package/src-tauri/src/app/setup.rs

@@ -1,4 +1,4 @@
-use crate::app::window::open_additional_window_safe;
+use crate::app::window::{open_additional_window_safe, reapply_window_icon};
 use std::str::FromStr;
 use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};
@@ -56,6 +56,7 @@ pub fn set_system_tray(
             "show_app" => {
                 if let Some(window) = app.get_webview_window("pake") {
                     let _ = window.show();
+                    reapply_window_icon(&window);
                     #[cfg(target_os = "linux")]
                     if _init_fullscreen && !window.is_fullscreen().unwrap_or(false) {
                         let _ = window.set_fullscreen(true);
@@ -83,6 +84,7 @@ pub fn set_system_tray(
                             let _ = window.hide();
                         } else {
                             let _ = window.show();
+                            reapply_window_icon(&window);
                             let _ = window.set_focus();
                             #[cfg(target_os = "linux")]
                             if _init_fullscreen && !window.is_fullscreen().unwrap_or(false) {
@@ -153,6 +155,7 @@ pub fn set_global_shortcut(
                                 let _ = window.hide();
                             } else {
                                 let _ = window.show();
+                                reapply_window_icon(&window);
                                 let _ = window.set_focus();
                                 #[cfg(target_os = "linux")]
                                 if _init_fullscreen && !window.is_fullscreen().unwrap_or(false) {

package/src-tauri/src/app/window.rs

@@ -69,6 +69,21 @@ pub fn open_additional_window(app: &AppHandle) -> tauri::Result<WebviewWindow> {
     build_window_with_label(app, &state.pake_config, &state.tauri_config, &label)
 }
 
+// Apps autostarted at Windows logon can register their window icon before
+// Explorer's icon cache is ready, leaving a blank taskbar icon until the icon
+// is asserted again (#1323), so re-apply it whenever a window becomes visible.
+#[cfg(target_os = "windows")]
+pub fn reapply_window_icon(window: &WebviewWindow) {
+    if let Some(icon) = window.app_handle().default_window_icon().cloned() {
+        if let Err(error) = window.set_icon(icon) {
+            eprintln!("[Pake] Failed to re-apply window icon: {error}");
+        }
+    }
+}
+
+#[cfg(not(target_os = "windows"))]
+pub fn reapply_window_icon(_window: &WebviewWindow) {}
+
 struct WindowBuildOptions<'a> {
     label: &'a str,
     url: WebviewUrl,

package/src-tauri/src/inject/event.js

@@ -207,6 +207,11 @@ function insertTextIntoEditableElement(element, text) {
 }
 
 let clipboardPasteFallbackTarget;
+let clipboardPasteFallbackArmedAt = 0;
+// An armed fallback older than this is a leftover from a keyup the window
+// never saw (alt-tab mid-press); firing it on a later plain "v" keyup would
+// paste unexpectedly.
+const CLIPBOARD_PASTE_FALLBACK_TTL_MS = 5000;
 
 function pasteClipboardText(activeElement) {
   const readText = navigator.clipboard?.readText;
@@ -253,8 +258,16 @@ function handleClipboardShortcut(event) {
   if (key === "v" && canPasteIntoEditableElement(activeElement)) {
     // Let the native WebView paste event run first so images, files, and rich
     // clipboard formats remain intact. If the platform does not emit paste,
-    // keyup applies the existing text-only fallback.
-    clipboardPasteFallbackTarget = activeElement;
+    // keyup applies the existing text-only fallback. Key-repeat must not
+    // re-arm: after a native paste already fired and disarmed the fallback,
+    // a repeat keydown re-arming it would make keyup paste text a second
+    // time. Repeats only refresh the TTL of a still-armed target.
+    if (!event.repeat) {
+      clipboardPasteFallbackTarget = activeElement;
+      clipboardPasteFallbackArmedAt = Date.now();
+    } else if (clipboardPasteFallbackTarget === activeElement) {
+      clipboardPasteFallbackArmedAt = Date.now();
+    }
     return false;
   }
 
@@ -276,9 +289,11 @@ function handleClipboardPasteFallback(event) {
   }
 
   const activeElement = clipboardPasteFallbackTarget;
+  const armedAt = clipboardPasteFallbackArmedAt;
   clipboardPasteFallbackTarget = undefined;
   if (
     !activeElement ||
+    Date.now() - armedAt > CLIPBOARD_PASTE_FALLBACK_TTL_MS ||
     document.activeElement !== activeElement ||
     !canPasteIntoEditableElement(activeElement)
   ) {

package/src-tauri/src/lib.rs

@@ -25,7 +25,7 @@ use app::{
         set_dock_badge_label, set_zoom, update_theme_mode,
     },
     setup::{set_global_shortcut, set_system_tray},
-    window::{open_additional_window_safe, set_window, MultiWindowState},
+    window::{open_additional_window_safe, reapply_window_icon, set_window, MultiWindowState},
 };
 use util::get_pake_config;
 
@@ -179,6 +179,7 @@ pub fn run_app() {
                 } else if let Some(window) = app.get_webview_window("pake") {
                     let _ = window.unminimize();
                     let _ = window.show();
+                    reapply_window_icon(&window);
                     let _ = window.set_focus();
                 }
             },
@@ -231,6 +232,7 @@ pub fn run_app() {
                 tauri::async_runtime::spawn(async move {
                     tokio::time::sleep(tokio::time::Duration::from_millis(WINDOW_SHOW_DELAY)).await;
                     let _ = window_clone.show();
+                    reapply_window_icon(&window_clone);
 
                     // Fixed: Linux fullscreen issue with virtual keyboard
                     #[cfg(target_os = "linux")]

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "productName": "Weekly",
   "identifier": "com.pake.weekly",
-  "version": "3.15.0",
+  "version": "3.15.2",
   "app": {
     "withGlobalTauri": true,
     "trayIcon": {