pake-cli 3.15.3 → 3.15.4

package/dist/cli.js

@@ -20,7 +20,7 @@ import * as psl from 'psl';
 import { InvalidArgumentError, program as program$1, Option } from 'commander';
 
 var name = "pake-cli";
-var version = "3.15.3";
+var version = "3.15.4";
 var description = "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。";
 var engines = {
 	node: ">=18.0.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pake-cli",
-  "version": "3.15.3",
+  "version": "3.15.4",
   "description": "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。",
   "engines": {
     "node": ">=18.0.0"

package/src-tauri/Cargo.lock

@@ -2564,8 +2564,10 @@ dependencies = [
 
 [[package]]
 name = "pake"
-version = "3.15.3"
+version = "3.15.4"
 dependencies = [
+ "block2",
+ "dispatch",
  "objc2",
  "objc2-app-kit",
  "objc2-foundation",

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pake"
-version = "3.15.3"
+version = "3.15.4"
 description = "🤱🏻 Turn any webpage into a desktop app with Rust."
 authors = ["Tw93"]
 license = "GPL-3.0-or-later"
@@ -25,7 +25,6 @@ tauri = { version = "2.10.2", features = [
   "tray-icon",
   "image-ico",
   "image-png",
-  "macos-proxy",
 ] }
 tauri-plugin-window-state = "2.4.1"
 tauri-plugin-oauth = "2.0.0"
@@ -37,6 +36,8 @@ tauri-plugin-single-instance = "2.4.0"
 tauri-plugin-notification = "2.3.3"
 
 [target.'cfg(target_os = "macos")'.dependencies]
+block2 = "0.6"
+dispatch = "0.2"
 objc2 = "0.6"
 objc2-app-kit = { version = "0.3", features = ["NSApplication", "NSDockTile"] }
 objc2-foundation = { version = "0.3", features = ["NSString"] }
@@ -51,6 +52,9 @@ windows-sys = { version = "0.61.2", features = [
 [features]
 # this feature is used for development builds from development cli
 cli-build = []
+# Tauri's macOS proxy APIs require macOS 14 or later. The CLI enables this
+# feature only after checking the host Darwin version.
+macos-proxy = ["tauri/macos-proxy"]
 # by default Tauri runs in production mode
 # when `tauri dev` runs it is executed with `cargo run --no-default-features` if `devPath` is an URL
 default = ["custom-protocol"]

package/src-tauri/src/app/cert.rs

@@ -0,0 +1,187 @@
+// macOS TLS certificate bypass for `--ignore-certificate-errors`.
+//
+// On macOS the webview is a WKWebView, which ignores the Chromium
+// `--ignore-certificate-errors` flag entirely, so Pake's flag was a no-op here
+// (see the Windows/Linux vs macOS split in window.rs). wry's own
+// `WryNavigationDelegate` does not implement
+// `webView:didReceiveAuthenticationChallenge:completionHandler:`, so WKWebView
+// falls back to default validation and rejects self-signed certs.
+//
+// This installs a thin navigation-delegate proxy that accepts server trust only
+// for the configured target host and forwards every other selector to wry's
+// original delegate, so navigation policy, downloads, and page-load callbacks
+// keep working untouched. It is installed only when the user opts in via
+// `--ignore-certificate-errors`.
+
+use objc2::rc::{Retained, Weak};
+use objc2::runtime::{AnyObject, Bool, NSObject, NSObjectProtocol, Sel};
+use objc2::{class, define_class, msg_send, DefinedClass, MainThreadMarker, MainThreadOnly};
+use objc2_foundation::NSString;
+use std::ffi::c_void;
+
+// NSURLSessionAuthChallengeDisposition values.
+const USE_CREDENTIAL: isize = 0;
+const PERFORM_DEFAULT_HANDLING: isize = 1;
+
+pub struct PakeCertDelegateIvars {
+    // wry's real navigation delegate; every non-challenge selector forwards here.
+    inner: Weak<AnyObject>,
+    allowed_host: String,
+}
+
+static CERT_BYPASS_ASSOCIATION_KEY: u8 = 0;
+
+fn hosts_match(allowed_host: &str, challenge_host: &str) -> bool {
+    allowed_host
+        .trim_end_matches('.')
+        .eq_ignore_ascii_case(challenge_host.trim_end_matches('.'))
+}
+
+define_class!(
+    #[unsafe(super(NSObject))]
+    #[name = "PakeCertBypassDelegate"]
+    #[thread_kind = MainThreadOnly]
+    #[ivars = PakeCertDelegateIvars]
+    struct PakeCertBypassDelegate;
+
+    unsafe impl NSObjectProtocol for PakeCertBypassDelegate {}
+
+    impl PakeCertBypassDelegate {
+        #[unsafe(method(webView:didReceiveAuthenticationChallenge:completionHandler:))]
+        fn did_receive_challenge(
+            &self,
+            _webview: &AnyObject,
+            challenge: &AnyObject,
+            handler: &block2::Block<dyn Fn(isize, *mut AnyObject)>,
+        ) {
+            unsafe {
+                let space: *mut AnyObject = msg_send![challenge, protectionSpace];
+                if space.is_null() {
+                    handler.call((PERFORM_DEFAULT_HANDLING, core::ptr::null_mut()));
+                    return;
+                }
+                let host: *mut NSString = msg_send![space, host];
+                if host.is_null()
+                    || !hosts_match(&self.ivars().allowed_host, &(&*host).to_string())
+                {
+                    handler.call((PERFORM_DEFAULT_HANDLING, core::ptr::null_mut()));
+                    return;
+                }
+                // Only server-trust challenges carry a non-null serverTrust; for
+                // anything else (e.g. HTTP basic auth) defer to default handling.
+                let server_trust: *mut AnyObject = msg_send![space, serverTrust];
+                if server_trust.is_null() {
+                    handler.call((PERFORM_DEFAULT_HANDLING, core::ptr::null_mut()));
+                    return;
+                }
+                let credential: *mut AnyObject =
+                    msg_send![class!(NSURLCredential), credentialForTrust: server_trust];
+                handler.call((USE_CREDENTIAL, credential));
+            }
+        }
+
+        // WKWebView probes respondsToSelector: before calling optional delegate
+        // methods, so report our own methods plus everything wry implements.
+        #[unsafe(method(respondsToSelector:))]
+        fn responds_to_selector(&self, selector: Sel) -> Bool {
+            let responds: Bool = unsafe { msg_send![super(self), respondsToSelector: selector] };
+            if responds.as_bool() {
+                return Bool::YES;
+            }
+            self.ivars()
+                .inner
+                .load()
+                .map(|inner| unsafe { msg_send![&*inner, respondsToSelector: selector] })
+                .unwrap_or(Bool::NO)
+        }
+
+        // Fast-forward any selector we do not implement to wry's delegate.
+        #[unsafe(method(forwardingTargetForSelector:))]
+        fn forwarding_target(&self, _selector: Sel) -> *mut AnyObject {
+            self.ivars()
+                .inner
+                .load()
+                .map(|inner| Retained::as_ptr(&inner) as *mut AnyObject)
+                .unwrap_or(core::ptr::null_mut())
+        }
+    }
+);
+
+impl PakeCertBypassDelegate {
+    fn new(
+        inner: &Retained<AnyObject>,
+        allowed_host: String,
+        mtm: MainThreadMarker,
+    ) -> Retained<Self> {
+        let this = mtm
+            .alloc::<PakeCertBypassDelegate>()
+            .set_ivars(PakeCertDelegateIvars {
+                inner: Weak::from_retained(inner),
+                allowed_host,
+            });
+        unsafe { msg_send![super(this), init] }
+    }
+}
+
+/// Replace the WKWebView's navigation delegate with a proxy that accepts
+/// invalid TLS certificates for the configured target host, then navigate to
+/// that target. `webview_ptr` is the raw `WKWebView` from
+/// `PlatformWebview::inner()`. Returns false if setup cannot be completed.
+pub fn install_cert_bypass_and_navigate(
+    webview_ptr: *mut c_void,
+    allowed_host: String,
+    target_url: String,
+) -> bool {
+    if webview_ptr.is_null() || allowed_host.is_empty() || target_url.is_empty() {
+        return false;
+    }
+    let Some(mtm) = MainThreadMarker::new() else {
+        return false;
+    };
+    unsafe {
+        let webview: &AnyObject = &*(webview_ptr as *const AnyObject);
+        let existing: *mut AnyObject = msg_send![webview, navigationDelegate];
+        if existing.is_null() {
+            return false;
+        }
+        let Some(inner) = Retained::retain(existing) else {
+            return false;
+        };
+        let proxy = PakeCertBypassDelegate::new(&inner, allowed_host, mtm);
+        objc2::ffi::objc_setAssociatedObject(
+            webview as *const AnyObject as *mut AnyObject,
+            std::ptr::addr_of!(CERT_BYPASS_ASSOCIATION_KEY).cast(),
+            Retained::as_ptr(&proxy) as *mut AnyObject,
+            objc2::ffi::OBJC_ASSOCIATION_RETAIN_NONATOMIC,
+        );
+        let _: () = msg_send![webview, setNavigationDelegate: &*proxy];
+
+        let target_url = NSString::from_str(&target_url);
+        let ns_url: *mut AnyObject = msg_send![class!(NSURL), URLWithString: &*target_url];
+        if ns_url.is_null() {
+            return false;
+        }
+        let request: *mut AnyObject = msg_send![class!(NSURLRequest), requestWithURL: ns_url];
+        if request.is_null() {
+            return false;
+        }
+        let _: () = msg_send![webview, loadRequest: request];
+        true
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::hosts_match;
+
+    #[test]
+    fn accepts_the_configured_host_case_insensitively() {
+        assert!(hosts_match("INTERNAL.EXAMPLE.COM", "internal.example.com"));
+        assert!(hosts_match("internal.example.com.", "internal.example.com"));
+    }
+
+    #[test]
+    fn rejects_other_hosts() {
+        assert!(!hosts_match("internal.example.com", "login.example.com"));
+    }
+}

package/src-tauri/src/app/menu.rs

@@ -1,7 +1,7 @@
 // Menu functionality is only used on macOS; the module is gated in app/mod.rs.
-use crate::app::window::open_additional_window_safe;
+use crate::app::window::{open_additional_window_safe, MultiWindowState};
 use tauri::menu::{AboutMetadata, Menu, MenuItem, PredefinedMenuItem, Submenu};
-use tauri::{AppHandle, Manager, Wry};
+use tauri::{AppHandle, Manager, WebviewWindow, Wry};
 use tauri_plugin_opener::OpenerExt;
 
 pub fn set_app_menu(
@@ -224,6 +224,36 @@ fn help_menu(app: &AppHandle<Wry>, title: &str) -> tauri::Result<Submenu<Wry>> {
     Ok(help_menu)
 }
 
+// Resolve the app's real home URL from its window config. Split out from
+// `home_url` so the mapping can be unit-tested without an AppHandle.
+fn resolve_home_url(url_type: &str, url: &str) -> Option<tauri::Url> {
+    match url_type {
+        // A web app's configured url is already absolute.
+        "web" => tauri::Url::parse(url).ok(),
+        // A local-file app's url is only a basename; Tauri serves bundled assets
+        // from tauri://localhost on macOS (this menu is macOS-only). Resolving it
+        // against the currently loaded remote origin (as the old eval path did)
+        // would point at the wrong server.
+        "local" => tauri::Url::parse(&format!("tauri://localhost/{url}")).ok(),
+        _ => None,
+    }
+}
+
+fn home_url(app: &AppHandle) -> Option<tauri::Url> {
+    let state = app.try_state::<MultiWindowState>()?;
+    let window_config = state.pake_config.windows.first()?;
+    resolve_home_url(&window_config.url_type, &window_config.url)
+}
+
+fn focused_webview_window(app_handle: &AppHandle) -> Option<WebviewWindow> {
+    let windows = app_handle.webview_windows();
+    windows
+        .values()
+        .find(|window| window.is_focused().unwrap_or(false))
+        .cloned()
+        .or_else(|| windows.get("pake").cloned())
+}
+
 pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
     match id {
         "new_window" => {
@@ -235,13 +265,13 @@ pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
                 .open_url("https://github.com/tw93/Pake", None::<&str>);
         }
         "reload" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.location.reload()");
             }
         }
         "toggle_devtools" => {
             #[cfg(debug_assertions)] // Only allow in debug builds
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 if window.is_devtools_open() {
                     window.close_devtools();
                 } else {
@@ -250,69 +280,79 @@ pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
             }
         }
         "zoom_in" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("zoomIn()");
             }
         }
         "zoom_out" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("zoomOut()");
             }
         }
         "zoom_reset" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("setZoom('100%')");
             }
         }
         "go_back" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.history.back()");
             }
         }
         "go_forward" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.history.forward()");
             }
         }
         "go_home" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
-                let _ = window.eval("window.location.href = window.pakeConfig.url");
+            if let Some(window) = focused_webview_window(app_handle) {
+                // Native navigation works even from a blank error page (where
+                // eval cannot run) and resolves local-file apps to the correct
+                // bundled asset instead of a path on the current origin.
+                match home_url(app_handle) {
+                    Some(url) => {
+                        let _ = window.navigate(url);
+                    }
+                    None => {
+                        let _ = window.eval("window.location.href = window.pakeConfig.url");
+                    }
+                }
             }
         }
         "copy_url" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("navigator.clipboard.writeText(window.location.href)");
             }
         }
         "paste_and_match_style" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("triggerPasteAsPlainText()");
             }
         }
         "find" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.pakeFind?.open()");
             }
         }
         "find_next" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.pakeFind?.next()");
             }
         }
         "find_previous" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.pakeFind?.previous()");
             }
         }
         "clear_cache_restart" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 if window.clear_all_browsing_data().is_ok() {
                     app_handle.restart();
                 }
             }
         }
         "always_on_top" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let is_on_top = window.is_always_on_top().unwrap_or(false);
                 let _ = window.set_always_on_top(!is_on_top);
             }
@@ -320,3 +360,31 @@ pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
         _ => {}
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::resolve_home_url;
+
+    #[test]
+    fn web_url_passes_through_unchanged() {
+        assert_eq!(
+            resolve_home_url("web", "https://github.com").map(|u| u.to_string()),
+            Some("https://github.com/".to_string())
+        );
+    }
+
+    #[test]
+    fn local_basename_resolves_to_bundled_asset_url() {
+        // The fix: a local app's basename must become the bundled asset URL,
+        // not a path resolved against whatever origin is currently loaded.
+        assert_eq!(
+            resolve_home_url("local", "launcher.html").map(|u| u.to_string()),
+            Some("tauri://localhost/launcher.html".to_string())
+        );
+    }
+
+    #[test]
+    fn unknown_url_type_is_none() {
+        assert!(resolve_home_url("bogus", "whatever").is_none());
+    }
+}

package/src-tauri/src/app/mod.rs

@@ -1,3 +1,5 @@
+#[cfg(target_os = "macos")]
+pub mod cert;
 pub mod config;
 pub mod invoke;
 #[cfg(target_os = "macos")]

package/src-tauri/src/app/window.rs

@@ -3,6 +3,8 @@ use crate::util::{
     check_file_or_append, get_data_dir, get_download_message_with_lang, sanitize_download_filename,
     show_toast, MessageType,
 };
+#[cfg(target_os = "macos")]
+use dispatch::Queue;
 #[cfg(target_os = "windows")]
 use std::{os::windows::ffi::OsStrExt, ptr, sync::OnceLock};
 use std::{
@@ -279,6 +281,27 @@ fn build_window(
         ))
     })?;
 
+    #[cfg(target_os = "macos")]
+    let cert_bypass_target = if label == "pake"
+        && window_config.ignore_certificate_errors
+        && window_config.url_type == "web"
+    {
+        Url::parse(&window_config.url).ok()
+    } else {
+        None
+    };
+
+    // The delegate must be installed before the first TLS challenge. Start on
+    // a neutral page, then navigate from the with_webview callback below.
+    #[cfg(target_os = "macos")]
+    let url = if cert_bypass_target.is_some() {
+        WebviewUrl::CustomProtocol(
+            Url::parse("about:blank").expect("about:blank must be a valid URL"),
+        )
+    } else {
+        url
+    };
+
     let user_agent = config.user_agent.get();
 
     let config_script = format!(
@@ -407,11 +430,6 @@ fn build_window(
         {
             linux_browser_args.push_str(" --ignore-certificate-errors");
         }
-
-        #[cfg(target_os = "macos")]
-        {
-            window_builder = window_builder.additional_browser_args("--ignore-certificate-errors");
-        }
     }
 
     if window_config.enable_wasm {
@@ -583,7 +601,35 @@ fn build_window(
 
     window_builder = window_builder.on_navigation(|_| true);
 
-    window_builder.build()
+    let window = window_builder.build()?;
+
+    // macOS WKWebView ignores the Chromium --ignore-certificate-errors flag, so
+    // install a host-scoped delegate on the process-lifetime main window only.
+    // Queue setup after construction so wry cannot replace the proxy while it
+    // finishes initializing its own navigation delegate.
+    #[cfg(target_os = "macos")]
+    if let Some(target_url) = cert_bypass_target {
+        let allowed_host = target_url
+            .host_str()
+            .expect("web URLs must have a host")
+            .to_owned();
+        let cert_window = window.clone();
+        Queue::main().exec_async(move || {
+            if let Err(error) = cert_window.with_webview(move |webview| {
+                if !crate::app::cert::install_cert_bypass_and_navigate(
+                    webview.inner(),
+                    allowed_host,
+                    target_url.to_string(),
+                ) {
+                    eprintln!("[Pake] Failed to configure macOS certificate bypass.");
+                }
+            }) {
+                eprintln!("[Pake] Failed to access the macOS webview: {error}");
+            }
+        });
+    }
+
+    Ok(window)
 }
 
 #[cfg(all(test, target_os = "windows"))]

package/src-tauri/src/inject/event.js

@@ -60,6 +60,20 @@ function handleShortcut(event) {
   }
 }
 
+function handleWebShortcut(event) {
+  if (isNonMacDesktop() && event.ctrlKey) {
+    handleShortcut(event);
+    return;
+  }
+
+  const isMac = /mac/i.test(getDesktopPlatform());
+  const isMacScrollShortcut =
+    event.key === "ArrowUp" || event.key === "ArrowDown";
+  if (isMac && event.metaKey && isMacScrollShortcut) {
+    handleShortcut(event);
+  }
+}
+
 function toggleNativeFullscreen(appWindow) {
   appWindow
     .isFullscreen()
@@ -437,7 +451,6 @@ const DOWNLOAD_PATH_PATTERNS = [
   "/files/",
   "/attachments/",
   "/assets/",
-  "/releases/",
   "/dist/",
 ];
 
@@ -622,14 +635,7 @@ document.addEventListener("DOMContentLoaded", () => {
 
   if (window["pakeConfig"]?.disabled_web_shortcuts !== true) {
     document.addEventListener("keydown", handleWindowFullscreenShortcut, true);
-    document.addEventListener("keyup", (event) => {
-      if (/windows|linux/i.test(navigator.userAgent) && event.ctrlKey) {
-        handleShortcut(event);
-      }
-      if (/macintosh|mac os x/i.test(navigator.userAgent) && event.metaKey) {
-        handleShortcut(event);
-      }
-    });
+    document.addEventListener("keyup", handleWebShortcut);
   }
 
   document.addEventListener("keydown", handleClipboardShortcut, true);

package/src-tauri/src/inject/find.js

@@ -663,9 +663,11 @@
   function getFindShortcutAction(event) {
     const userAgent = navigator.userAgent || "";
     const isMac = /macintosh|mac os x/i.test(userAgent);
-    const hasModifier = isMac
-      ? event.metaKey && !event.ctrlKey
-      : event.ctrlKey && !event.metaKey;
+    if (isMac) {
+      return "";
+    }
+
+    const hasModifier = event.ctrlKey && !event.metaKey;
 
     if (!hasModifier || event.altKey) {
       return "";

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "productName": "Weekly",
   "identifier": "com.pake.weekly",
-  "version": "3.15.3",
+  "version": "3.15.4",
   "app": {
     "withGlobalTauri": true,
     "trayIcon": {