pake-cli 3.15.2 → 3.15.4

package/README.md

@@ -197,7 +197,7 @@ Using Pake from a script or AI agent? Pass `--json` for machine-readable results
 Copy this to your AI agent to get started:
 
 ```text
-Use Pake (npm i -g pake-cli) to package webpages as desktop apps. Read https://raw.githubusercontent.com/tw93/Pake/main/llms.txt first; always run pake with --json and parse stdout as a single JSON object. Package <url-or-local-dist> into an app named <AppName>.
+Use Pake (npm i -g pake-cli) to package webpages as desktop apps. Read https://unpkg.com/pake-cli@latest/llms.txt first; always run pake with --json and parse stdout as a single JSON object. Package <url-or-local-dist> into an app named <AppName>.
 ```
 
 ## Development

package/dist/cli.js

@@ -20,7 +20,7 @@ import * as psl from 'psl';
 import { InvalidArgumentError, program as program$1, Option } from 'commander';
 
 var name = "pake-cli";
-var version = "3.15.2";
+var version = "3.15.4";
 var description = "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。";
 var engines = {
 	node: ">=18.0.0"
@@ -47,7 +47,8 @@ var keywords = [
 ];
 var files = [
 	"LICENSE-EXCEPTION",
-	"dist",
+	"llms.txt",
+	"dist/cli.js",
 	"src-tauri"
 ];
 var scripts = {

package/llms.txt

@@ -0,0 +1,31 @@
+# Pake
+
+> Pake turns any webpage or local web build into a lightweight desktop app (~5MB) for macOS, Windows, and Linux, using Tauri (Rust) and the system webview. One CLI command packages a URL, a local HTML file, or a static directory into a native installer.
+
+## Install and run
+
+- Install: `npm install -g pake-cli` (requires Node 18+ and Rust; the CLI offers to install Rust when missing)
+- Basic: `pake https://example.com --name MyApp`
+- Local build output: `pake ./dist --name MyTool` (directory must contain index.html at its root; hash routing only, history-mode SPA routing unsupported)
+
+## Agent contract
+
+- Always pass `--json` in automation: stdout carries exactly one JSON object `{ok, name, platform, arch, outputs: [{path, sizeBytes, format}], warnings, error: {code, message, hint} | null}`; all logs go to stderr; interactive prompts are disabled.
+- Exit codes: 0 success, 2 invalid input, 3 build failure, 4 missing environment or dependency setup failure, 1 unexpected.
+- On Linux multi-target builds, ok:true can carry fewer outputs than requested formats; failed targets land in warnings. Check outputs[].format.
+- Error codes: INVALID_INPUT, ENV_MISSING, BUILD_FAILED, UNEXPECTED, plus NETWORK (reserved; current versions report network failures under the phase code, e.g. ENV_MISSING or BUILD_FAILED). `error.hint` states how to fix.
+- Declarative config: `pake --config app.json --json`; fields are camelCase CLI option names plus `url`. Explicit CLI flags win over config fields. Unknown fields fail fast. A relative `url` path resolves against the process working directory, not the config file's directory.
+- Config schema: https://raw.githubusercontent.com/tw93/Pake/main/schema/pake.schema.json
+
+## Docs
+
+- [CLI usage, all options](https://github.com/tw93/Pake/blob/main/docs/cli-usage.md): every flag with defaults and examples
+- [Advanced usage](https://github.com/tw93/Pake/blob/main/docs/advanced-usage.md): style injection, containers, customization
+- [FAQ](https://github.com/tw93/Pake/blob/main/docs/faq.md): platform-specific troubleshooting
+
+## Notes
+
+- Output formats: dmg/app (macOS), msi (Windows), deb/AppImage/rpm/zst (Linux); pick with `--targets`.
+- Icons auto-fetch from the site favicon when `--icon` is omitted.
+- `--proxy-url` is baked into the app webview at build time; it does not proxy the icon download itself.
+- Google OAuth and similar providers may reject embedded webviews regardless of flags; `--new-window` and `--safe-domain` help with most SSO flows.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pake-cli",
-  "version": "3.15.2",
+  "version": "3.15.4",
   "description": "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。",
   "engines": {
     "node": ">=18.0.0"
@@ -27,7 +27,8 @@
   ],
   "files": [
     "LICENSE-EXCEPTION",
-    "dist",
+    "llms.txt",
+    "dist/cli.js",
     "src-tauri"
   ],
   "scripts": {

package/src-tauri/Cargo.lock

@@ -2564,8 +2564,10 @@ dependencies = [
 
 [[package]]
 name = "pake"
-version = "3.15.2"
+version = "3.15.4"
 dependencies = [
+ "block2",
+ "dispatch",
  "objc2",
  "objc2-app-kit",
  "objc2-foundation",
@@ -2582,6 +2584,7 @@ dependencies = [
  "tauri-plugin-single-instance",
  "tauri-plugin-window-state",
  "tokio",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pake"
-version = "3.15.2"
+version = "3.15.4"
 description = "🤱🏻 Turn any webpage into a desktop app with Rust."
 authors = ["Tw93"]
 license = "GPL-3.0-or-later"
@@ -25,7 +25,6 @@ tauri = { version = "2.10.2", features = [
   "tray-icon",
   "image-ico",
   "image-png",
-  "macos-proxy",
 ] }
 tauri-plugin-window-state = "2.4.1"
 tauri-plugin-oauth = "2.0.0"
@@ -37,13 +36,25 @@ tauri-plugin-single-instance = "2.4.0"
 tauri-plugin-notification = "2.3.3"
 
 [target.'cfg(target_os = "macos")'.dependencies]
+block2 = "0.6"
+dispatch = "0.2"
 objc2 = "0.6"
 objc2-app-kit = { version = "0.3", features = ["NSApplication", "NSDockTile"] }
 objc2-foundation = { version = "0.3", features = ["NSString"] }
 
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.61.2", features = [
+  "Win32_Foundation",
+  "Win32_UI_Shell",
+  "Win32_UI_WindowsAndMessaging",
+] }
+
 [features]
 # this feature is used for development builds from development cli
 cli-build = []
+# Tauri's macOS proxy APIs require macOS 14 or later. The CLI enables this
+# feature only after checking the host Darwin version.
+macos-proxy = ["tauri/macos-proxy"]
 # by default Tauri runs in production mode
 # when `tauri dev` runs it is executed with `cargo run --no-default-features` if `devPath` is an URL
 default = ["custom-protocol"]

package/src-tauri/src/app/cert.rs

@@ -0,0 +1,187 @@
+// macOS TLS certificate bypass for `--ignore-certificate-errors`.
+//
+// On macOS the webview is a WKWebView, which ignores the Chromium
+// `--ignore-certificate-errors` flag entirely, so Pake's flag was a no-op here
+// (see the Windows/Linux vs macOS split in window.rs). wry's own
+// `WryNavigationDelegate` does not implement
+// `webView:didReceiveAuthenticationChallenge:completionHandler:`, so WKWebView
+// falls back to default validation and rejects self-signed certs.
+//
+// This installs a thin navigation-delegate proxy that accepts server trust only
+// for the configured target host and forwards every other selector to wry's
+// original delegate, so navigation policy, downloads, and page-load callbacks
+// keep working untouched. It is installed only when the user opts in via
+// `--ignore-certificate-errors`.
+
+use objc2::rc::{Retained, Weak};
+use objc2::runtime::{AnyObject, Bool, NSObject, NSObjectProtocol, Sel};
+use objc2::{class, define_class, msg_send, DefinedClass, MainThreadMarker, MainThreadOnly};
+use objc2_foundation::NSString;
+use std::ffi::c_void;
+
+// NSURLSessionAuthChallengeDisposition values.
+const USE_CREDENTIAL: isize = 0;
+const PERFORM_DEFAULT_HANDLING: isize = 1;
+
+pub struct PakeCertDelegateIvars {
+    // wry's real navigation delegate; every non-challenge selector forwards here.
+    inner: Weak<AnyObject>,
+    allowed_host: String,
+}
+
+static CERT_BYPASS_ASSOCIATION_KEY: u8 = 0;
+
+fn hosts_match(allowed_host: &str, challenge_host: &str) -> bool {
+    allowed_host
+        .trim_end_matches('.')
+        .eq_ignore_ascii_case(challenge_host.trim_end_matches('.'))
+}
+
+define_class!(
+    #[unsafe(super(NSObject))]
+    #[name = "PakeCertBypassDelegate"]
+    #[thread_kind = MainThreadOnly]
+    #[ivars = PakeCertDelegateIvars]
+    struct PakeCertBypassDelegate;
+
+    unsafe impl NSObjectProtocol for PakeCertBypassDelegate {}
+
+    impl PakeCertBypassDelegate {
+        #[unsafe(method(webView:didReceiveAuthenticationChallenge:completionHandler:))]
+        fn did_receive_challenge(
+            &self,
+            _webview: &AnyObject,
+            challenge: &AnyObject,
+            handler: &block2::Block<dyn Fn(isize, *mut AnyObject)>,
+        ) {
+            unsafe {
+                let space: *mut AnyObject = msg_send![challenge, protectionSpace];
+                if space.is_null() {
+                    handler.call((PERFORM_DEFAULT_HANDLING, core::ptr::null_mut()));
+                    return;
+                }
+                let host: *mut NSString = msg_send![space, host];
+                if host.is_null()
+                    || !hosts_match(&self.ivars().allowed_host, &(&*host).to_string())
+                {
+                    handler.call((PERFORM_DEFAULT_HANDLING, core::ptr::null_mut()));
+                    return;
+                }
+                // Only server-trust challenges carry a non-null serverTrust; for
+                // anything else (e.g. HTTP basic auth) defer to default handling.
+                let server_trust: *mut AnyObject = msg_send![space, serverTrust];
+                if server_trust.is_null() {
+                    handler.call((PERFORM_DEFAULT_HANDLING, core::ptr::null_mut()));
+                    return;
+                }
+                let credential: *mut AnyObject =
+                    msg_send![class!(NSURLCredential), credentialForTrust: server_trust];
+                handler.call((USE_CREDENTIAL, credential));
+            }
+        }
+
+        // WKWebView probes respondsToSelector: before calling optional delegate
+        // methods, so report our own methods plus everything wry implements.
+        #[unsafe(method(respondsToSelector:))]
+        fn responds_to_selector(&self, selector: Sel) -> Bool {
+            let responds: Bool = unsafe { msg_send![super(self), respondsToSelector: selector] };
+            if responds.as_bool() {
+                return Bool::YES;
+            }
+            self.ivars()
+                .inner
+                .load()
+                .map(|inner| unsafe { msg_send![&*inner, respondsToSelector: selector] })
+                .unwrap_or(Bool::NO)
+        }
+
+        // Fast-forward any selector we do not implement to wry's delegate.
+        #[unsafe(method(forwardingTargetForSelector:))]
+        fn forwarding_target(&self, _selector: Sel) -> *mut AnyObject {
+            self.ivars()
+                .inner
+                .load()
+                .map(|inner| Retained::as_ptr(&inner) as *mut AnyObject)
+                .unwrap_or(core::ptr::null_mut())
+        }
+    }
+);
+
+impl PakeCertBypassDelegate {
+    fn new(
+        inner: &Retained<AnyObject>,
+        allowed_host: String,
+        mtm: MainThreadMarker,
+    ) -> Retained<Self> {
+        let this = mtm
+            .alloc::<PakeCertBypassDelegate>()
+            .set_ivars(PakeCertDelegateIvars {
+                inner: Weak::from_retained(inner),
+                allowed_host,
+            });
+        unsafe { msg_send![super(this), init] }
+    }
+}
+
+/// Replace the WKWebView's navigation delegate with a proxy that accepts
+/// invalid TLS certificates for the configured target host, then navigate to
+/// that target. `webview_ptr` is the raw `WKWebView` from
+/// `PlatformWebview::inner()`. Returns false if setup cannot be completed.
+pub fn install_cert_bypass_and_navigate(
+    webview_ptr: *mut c_void,
+    allowed_host: String,
+    target_url: String,
+) -> bool {
+    if webview_ptr.is_null() || allowed_host.is_empty() || target_url.is_empty() {
+        return false;
+    }
+    let Some(mtm) = MainThreadMarker::new() else {
+        return false;
+    };
+    unsafe {
+        let webview: &AnyObject = &*(webview_ptr as *const AnyObject);
+        let existing: *mut AnyObject = msg_send![webview, navigationDelegate];
+        if existing.is_null() {
+            return false;
+        }
+        let Some(inner) = Retained::retain(existing) else {
+            return false;
+        };
+        let proxy = PakeCertBypassDelegate::new(&inner, allowed_host, mtm);
+        objc2::ffi::objc_setAssociatedObject(
+            webview as *const AnyObject as *mut AnyObject,
+            std::ptr::addr_of!(CERT_BYPASS_ASSOCIATION_KEY).cast(),
+            Retained::as_ptr(&proxy) as *mut AnyObject,
+            objc2::ffi::OBJC_ASSOCIATION_RETAIN_NONATOMIC,
+        );
+        let _: () = msg_send![webview, setNavigationDelegate: &*proxy];
+
+        let target_url = NSString::from_str(&target_url);
+        let ns_url: *mut AnyObject = msg_send![class!(NSURL), URLWithString: &*target_url];
+        if ns_url.is_null() {
+            return false;
+        }
+        let request: *mut AnyObject = msg_send![class!(NSURLRequest), requestWithURL: ns_url];
+        if request.is_null() {
+            return false;
+        }
+        let _: () = msg_send![webview, loadRequest: request];
+        true
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::hosts_match;
+
+    #[test]
+    fn accepts_the_configured_host_case_insensitively() {
+        assert!(hosts_match("INTERNAL.EXAMPLE.COM", "internal.example.com"));
+        assert!(hosts_match("internal.example.com.", "internal.example.com"));
+    }
+
+    #[test]
+    fn rejects_other_hosts() {
+        assert!(!hosts_match("internal.example.com", "login.example.com"));
+    }
+}

package/src-tauri/src/app/menu.rs

@@ -1,7 +1,7 @@
 // Menu functionality is only used on macOS; the module is gated in app/mod.rs.
-use crate::app::window::open_additional_window_safe;
+use crate::app::window::{open_additional_window_safe, MultiWindowState};
 use tauri::menu::{AboutMetadata, Menu, MenuItem, PredefinedMenuItem, Submenu};
-use tauri::{AppHandle, Manager, Wry};
+use tauri::{AppHandle, Manager, WebviewWindow, Wry};
 use tauri_plugin_opener::OpenerExt;
 
 pub fn set_app_menu(
@@ -224,6 +224,36 @@ fn help_menu(app: &AppHandle<Wry>, title: &str) -> tauri::Result<Submenu<Wry>> {
     Ok(help_menu)
 }
 
+// Resolve the app's real home URL from its window config. Split out from
+// `home_url` so the mapping can be unit-tested without an AppHandle.
+fn resolve_home_url(url_type: &str, url: &str) -> Option<tauri::Url> {
+    match url_type {
+        // A web app's configured url is already absolute.
+        "web" => tauri::Url::parse(url).ok(),
+        // A local-file app's url is only a basename; Tauri serves bundled assets
+        // from tauri://localhost on macOS (this menu is macOS-only). Resolving it
+        // against the currently loaded remote origin (as the old eval path did)
+        // would point at the wrong server.
+        "local" => tauri::Url::parse(&format!("tauri://localhost/{url}")).ok(),
+        _ => None,
+    }
+}
+
+fn home_url(app: &AppHandle) -> Option<tauri::Url> {
+    let state = app.try_state::<MultiWindowState>()?;
+    let window_config = state.pake_config.windows.first()?;
+    resolve_home_url(&window_config.url_type, &window_config.url)
+}
+
+fn focused_webview_window(app_handle: &AppHandle) -> Option<WebviewWindow> {
+    let windows = app_handle.webview_windows();
+    windows
+        .values()
+        .find(|window| window.is_focused().unwrap_or(false))
+        .cloned()
+        .or_else(|| windows.get("pake").cloned())
+}
+
 pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
     match id {
         "new_window" => {
@@ -235,13 +265,13 @@ pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
                 .open_url("https://github.com/tw93/Pake", None::<&str>);
         }
         "reload" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.location.reload()");
             }
         }
         "toggle_devtools" => {
             #[cfg(debug_assertions)] // Only allow in debug builds
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 if window.is_devtools_open() {
                     window.close_devtools();
                 } else {
@@ -250,69 +280,79 @@ pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
             }
         }
         "zoom_in" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("zoomIn()");
             }
         }
         "zoom_out" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("zoomOut()");
             }
         }
         "zoom_reset" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("setZoom('100%')");
             }
         }
         "go_back" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.history.back()");
             }
         }
         "go_forward" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.history.forward()");
             }
         }
         "go_home" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
-                let _ = window.eval("window.location.href = window.pakeConfig.url");
+            if let Some(window) = focused_webview_window(app_handle) {
+                // Native navigation works even from a blank error page (where
+                // eval cannot run) and resolves local-file apps to the correct
+                // bundled asset instead of a path on the current origin.
+                match home_url(app_handle) {
+                    Some(url) => {
+                        let _ = window.navigate(url);
+                    }
+                    None => {
+                        let _ = window.eval("window.location.href = window.pakeConfig.url");
+                    }
+                }
             }
         }
         "copy_url" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("navigator.clipboard.writeText(window.location.href)");
             }
         }
         "paste_and_match_style" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("triggerPasteAsPlainText()");
             }
         }
         "find" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.pakeFind?.open()");
             }
         }
         "find_next" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.pakeFind?.next()");
             }
         }
         "find_previous" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.pakeFind?.previous()");
             }
         }
         "clear_cache_restart" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 if window.clear_all_browsing_data().is_ok() {
                     app_handle.restart();
                 }
             }
         }
         "always_on_top" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let is_on_top = window.is_always_on_top().unwrap_or(false);
                 let _ = window.set_always_on_top(!is_on_top);
             }
@@ -320,3 +360,31 @@ pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
         _ => {}
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::resolve_home_url;
+
+    #[test]
+    fn web_url_passes_through_unchanged() {
+        assert_eq!(
+            resolve_home_url("web", "https://github.com").map(|u| u.to_string()),
+            Some("https://github.com/".to_string())
+        );
+    }
+
+    #[test]
+    fn local_basename_resolves_to_bundled_asset_url() {
+        // The fix: a local app's basename must become the bundled asset URL,
+        // not a path resolved against whatever origin is currently loaded.
+        assert_eq!(
+            resolve_home_url("local", "launcher.html").map(|u| u.to_string()),
+            Some("tauri://localhost/launcher.html".to_string())
+        );
+    }
+
+    #[test]
+    fn unknown_url_type_is_none() {
+        assert!(resolve_home_url("bogus", "whatever").is_none());
+    }
+}

package/src-tauri/src/app/mod.rs

@@ -1,3 +1,5 @@
+#[cfg(target_os = "macos")]
+pub mod cert;
 pub mod config;
 pub mod invoke;
 #[cfg(target_os = "macos")]

package/src-tauri/src/app/window.rs

@@ -3,6 +3,10 @@ use crate::util::{
     check_file_or_append, get_data_dir, get_download_message_with_lang, sanitize_download_filename,
     show_toast, MessageType,
 };
+#[cfg(target_os = "macos")]
+use dispatch::Queue;
+#[cfg(target_os = "windows")]
+use std::{os::windows::ffi::OsStrExt, ptr, sync::OnceLock};
 use std::{
     path::PathBuf,
     str::FromStr,
@@ -13,6 +17,12 @@ use tauri::{
     AppHandle, Config, Manager, Url, WebviewUrl, WebviewWindow, WebviewWindowBuilder,
 };
 
+#[cfg(target_os = "windows")]
+use windows_sys::Win32::UI::{
+    Shell::ExtractIconExW,
+    WindowsAndMessaging::{SendMessageW, ICON_BIG, WM_SETICON},
+};
+
 use tauri::Theme;
 
 #[cfg(target_os = "macos")]
@@ -69,14 +79,70 @@ pub fn open_additional_window(app: &AppHandle) -> tauri::Result<WebviewWindow> {
     build_window_with_label(app, &state.pake_config, &state.tauri_config, &label)
 }
 
-// Apps autostarted at Windows logon can register their window icon before
-// Explorer's icon cache is ready, leaving a blank taskbar icon until the icon
-// is asserted again (#1323), so re-apply it whenever a window becomes visible.
+#[cfg(target_os = "windows")]
+fn taskbar_icon_handle() -> Option<isize> {
+    static TASKBAR_ICON: OnceLock<Option<isize>> = OnceLock::new();
+
+    *TASKBAR_ICON.get_or_init(|| {
+        let executable = match std::env::current_exe() {
+            Ok(path) => path,
+            Err(error) => {
+                eprintln!(
+                    "[Pake] Failed to resolve the app executable for its taskbar icon: {error}"
+                );
+                return None;
+            }
+        };
+        let executable_wide: Vec<u16> = executable
+            .as_os_str()
+            .encode_wide()
+            .chain(std::iter::once(0))
+            .collect();
+        let mut large_icon = ptr::null_mut();
+        let extracted = unsafe {
+            ExtractIconExW(
+                executable_wide.as_ptr(),
+                0,
+                &mut large_icon,
+                ptr::null_mut(),
+                1,
+            )
+        };
+        if extracted == 0 || large_icon.is_null() {
+            eprintln!(
+                "[Pake] Failed to extract the taskbar icon from {}.",
+                executable.display()
+            );
+            return None;
+        }
+
+        // WM_SETICON keeps this handle rather than copying it. Cache the single
+        // extracted icon for the process lifetime so repeated tray restores do
+        // not leak a new HICON or leave the window with a dangling handle.
+        Some(large_icon as isize)
+    })
+}
+
+// Apps autostarted at Windows logon can register their icons before Explorer's
+// icon cache is ready (#1323). Re-assert both the small/title-bar icon and the
+// large taskbar icon whenever a window becomes visible.
 #[cfg(target_os = "windows")]
 pub fn reapply_window_icon(window: &WebviewWindow) {
     if let Some(icon) = window.app_handle().default_window_icon().cloned() {
         if let Err(error) = window.set_icon(icon) {
-            eprintln!("[Pake] Failed to re-apply window icon: {error}");
+            eprintln!("[Pake] Failed to re-apply the window icon: {error}");
+        }
+    }
+
+    let Some(taskbar_icon) = taskbar_icon_handle() else {
+        return;
+    };
+    match window.hwnd() {
+        Ok(hwnd) => unsafe {
+            SendMessageW(hwnd.0, WM_SETICON, ICON_BIG as usize, taskbar_icon);
+        },
+        Err(error) => {
+            eprintln!("[Pake] Failed to resolve the window handle for its taskbar icon: {error}");
         }
     }
 }
@@ -114,6 +180,7 @@ fn open_requested_window(
 
     let title = target_url.host_str().unwrap_or(target_url.as_str());
     let _ = window.set_title(title);
+    reapply_window_icon(&window);
     let _ = window.set_focus();
 
     Ok(window)
@@ -126,6 +193,7 @@ pub fn open_additional_window_safe(app: &AppHandle) {
         std::thread::spawn(move || {
             if let Ok(window) = open_additional_window(&app_handle) {
                 let _ = window.show();
+                reapply_window_icon(&window);
                 let _ = window.set_focus();
             }
         });
@@ -135,6 +203,7 @@ pub fn open_additional_window_safe(app: &AppHandle) {
     {
         if let Ok(window) = open_additional_window(app) {
             let _ = window.show();
+            reapply_window_icon(&window);
             let _ = window.set_focus();
         }
     }
@@ -212,6 +281,27 @@ fn build_window(
         ))
     })?;
 
+    #[cfg(target_os = "macos")]
+    let cert_bypass_target = if label == "pake"
+        && window_config.ignore_certificate_errors
+        && window_config.url_type == "web"
+    {
+        Url::parse(&window_config.url).ok()
+    } else {
+        None
+    };
+
+    // The delegate must be installed before the first TLS challenge. Start on
+    // a neutral page, then navigate from the with_webview callback below.
+    #[cfg(target_os = "macos")]
+    let url = if cert_bypass_target.is_some() {
+        WebviewUrl::CustomProtocol(
+            Url::parse("about:blank").expect("about:blank must be a valid URL"),
+        )
+    } else {
+        url
+    };
+
     let user_agent = config.user_agent.get();
 
     let config_script = format!(
@@ -340,11 +430,6 @@ fn build_window(
         {
             linux_browser_args.push_str(" --ignore-certificate-errors");
         }
-
-        #[cfg(target_os = "macos")]
-        {
-            window_builder = window_builder.additional_browser_args("--ignore-certificate-errors");
-        }
     }
 
     if window_config.enable_wasm {
@@ -516,7 +601,35 @@ fn build_window(
 
     window_builder = window_builder.on_navigation(|_| true);
 
-    window_builder.build()
+    let window = window_builder.build()?;
+
+    // macOS WKWebView ignores the Chromium --ignore-certificate-errors flag, so
+    // install a host-scoped delegate on the process-lifetime main window only.
+    // Queue setup after construction so wry cannot replace the proxy while it
+    // finishes initializing its own navigation delegate.
+    #[cfg(target_os = "macos")]
+    if let Some(target_url) = cert_bypass_target {
+        let allowed_host = target_url
+            .host_str()
+            .expect("web URLs must have a host")
+            .to_owned();
+        let cert_window = window.clone();
+        Queue::main().exec_async(move || {
+            if let Err(error) = cert_window.with_webview(move |webview| {
+                if !crate::app::cert::install_cert_bypass_and_navigate(
+                    webview.inner(),
+                    allowed_host,
+                    target_url.to_string(),
+                ) {
+                    eprintln!("[Pake] Failed to configure macOS certificate bypass.");
+                }
+            }) {
+                eprintln!("[Pake] Failed to access the macOS webview: {error}");
+            }
+        });
+    }
+
+    Ok(window)
 }
 
 #[cfg(all(test, target_os = "windows"))]

package/src-tauri/src/inject/event.js

@@ -60,6 +60,20 @@ function handleShortcut(event) {
   }
 }
 
+function handleWebShortcut(event) {
+  if (isNonMacDesktop() && event.ctrlKey) {
+    handleShortcut(event);
+    return;
+  }
+
+  const isMac = /mac/i.test(getDesktopPlatform());
+  const isMacScrollShortcut =
+    event.key === "ArrowUp" || event.key === "ArrowDown";
+  if (isMac && event.metaKey && isMacScrollShortcut) {
+    handleShortcut(event);
+  }
+}
+
 function toggleNativeFullscreen(appWindow) {
   appWindow
     .isFullscreen()
@@ -437,7 +451,6 @@ const DOWNLOAD_PATH_PATTERNS = [
   "/files/",
   "/attachments/",
   "/assets/",
-  "/releases/",
   "/dist/",
 ];
 
@@ -622,14 +635,7 @@ document.addEventListener("DOMContentLoaded", () => {
 
   if (window["pakeConfig"]?.disabled_web_shortcuts !== true) {
     document.addEventListener("keydown", handleWindowFullscreenShortcut, true);
-    document.addEventListener("keyup", (event) => {
-      if (/windows|linux/i.test(navigator.userAgent) && event.ctrlKey) {
-        handleShortcut(event);
-      }
-      if (/macintosh|mac os x/i.test(navigator.userAgent) && event.metaKey) {
-        handleShortcut(event);
-      }
-    });
+    document.addEventListener("keyup", handleWebShortcut);
   }
 
   document.addEventListener("keydown", handleClipboardShortcut, true);

package/src-tauri/src/inject/find.js

@@ -663,9 +663,11 @@
   function getFindShortcutAction(event) {
     const userAgent = navigator.userAgent || "";
     const isMac = /macintosh|mac os x/i.test(userAgent);
-    const hasModifier = isMac
-      ? event.metaKey && !event.ctrlKey
-      : event.ctrlKey && !event.metaKey;
+    if (isMac) {
+      return "";
+    }
+
+    const hasModifier = event.ctrlKey && !event.metaKey;
 
     if (!hasModifier || event.altKey) {
       return "";

package/src-tauri/src/lib.rs

@@ -302,6 +302,7 @@ pub fn run_app() {
                 if !has_visible_windows {
                     if let Some(window) = _app.get_webview_window("pake") {
                         let _ = window.show();
+                        reapply_window_icon(&window);
                         let _ = window.set_focus();
                     }
                 }

package/src-tauri/src/util.rs

@@ -183,16 +183,21 @@ mod tests {
     use std::env;
     use std::fs;
     use std::path::PathBuf;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    static TEMP_PATH_COUNTER: AtomicU64 = AtomicU64::new(0);
 
     fn temp_path(name: &str) -> PathBuf {
         let mut dir = env::temp_dir();
+        let unique = TEMP_PATH_COUNTER.fetch_add(1, Ordering::Relaxed);
         dir.push(format!(
-            "pake-util-test-{}-{}",
+            "pake-util-test-{}-{}-{}",
             std::process::id(),
             std::time::SystemTime::now()
                 .duration_since(std::time::UNIX_EPOCH)
                 .map(|d| d.as_nanos())
-                .unwrap_or(0)
+                .unwrap_or(0),
+            unique
         ));
         fs::create_dir_all(&dir).unwrap();
         dir.push(name);

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "productName": "Weekly",
   "identifier": "com.pake.weekly",
-  "version": "3.15.2",
+  "version": "3.15.4",
   "app": {
     "withGlobalTauri": true,
     "trayIcon": {