pake-cli 3.15.3 → 3.15.5

package/dist/cli.js

@@ -20,7 +20,7 @@ import * as psl from 'psl';
 import { InvalidArgumentError, program as program$1, Option } from 'commander';
 
 var name = "pake-cli";
-var version = "3.15.3";
+var version = "3.15.5";
 var description = "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。";
 var engines = {
 	node: ">=18.0.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pake-cli",
-  "version": "3.15.3",
+  "version": "3.15.5",
   "description": "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。",
   "engines": {
     "node": ">=18.0.0"

package/src-tauri/Cargo.lock

@@ -2564,8 +2564,10 @@ dependencies = [
 
 [[package]]
 name = "pake"
-version = "3.15.3"
+version = "3.15.5"
 dependencies = [
+ "block2",
+ "dispatch",
  "objc2",
  "objc2-app-kit",
  "objc2-foundation",

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pake"
-version = "3.15.3"
+version = "3.15.5"
 description = "🤱🏻 Turn any webpage into a desktop app with Rust."
 authors = ["Tw93"]
 license = "GPL-3.0-or-later"
@@ -25,7 +25,6 @@ tauri = { version = "2.10.2", features = [
   "tray-icon",
   "image-ico",
   "image-png",
-  "macos-proxy",
 ] }
 tauri-plugin-window-state = "2.4.1"
 tauri-plugin-oauth = "2.0.0"
@@ -37,6 +36,8 @@ tauri-plugin-single-instance = "2.4.0"
 tauri-plugin-notification = "2.3.3"
 
 [target.'cfg(target_os = "macos")'.dependencies]
+block2 = "0.6"
+dispatch = "0.2"
 objc2 = "0.6"
 objc2-app-kit = { version = "0.3", features = ["NSApplication", "NSDockTile"] }
 objc2-foundation = { version = "0.3", features = ["NSString"] }
@@ -51,6 +52,9 @@ windows-sys = { version = "0.61.2", features = [
 [features]
 # this feature is used for development builds from development cli
 cli-build = []
+# Tauri's macOS proxy APIs require macOS 14 or later. The CLI enables this
+# feature only after checking the host Darwin version.
+macos-proxy = ["tauri/macos-proxy"]
 # by default Tauri runs in production mode
 # when `tauri dev` runs it is executed with `cargo run --no-default-features` if `devPath` is an URL
 default = ["custom-protocol"]

package/src-tauri/src/app/cert.rs

@@ -0,0 +1,187 @@
+// macOS TLS certificate bypass for `--ignore-certificate-errors`.
+//
+// On macOS the webview is a WKWebView, which ignores the Chromium
+// `--ignore-certificate-errors` flag entirely, so Pake's flag was a no-op here
+// (see the Windows/Linux vs macOS split in window.rs). wry's own
+// `WryNavigationDelegate` does not implement
+// `webView:didReceiveAuthenticationChallenge:completionHandler:`, so WKWebView
+// falls back to default validation and rejects self-signed certs.
+//
+// This installs a thin navigation-delegate proxy that accepts server trust only
+// for the configured target host and forwards every other selector to wry's
+// original delegate, so navigation policy, downloads, and page-load callbacks
+// keep working untouched. It is installed only when the user opts in via
+// `--ignore-certificate-errors`.
+
+use objc2::rc::{Retained, Weak};
+use objc2::runtime::{AnyObject, Bool, NSObject, NSObjectProtocol, Sel};
+use objc2::{class, define_class, msg_send, DefinedClass, MainThreadMarker, MainThreadOnly};
+use objc2_foundation::NSString;
+use std::ffi::c_void;
+
+// NSURLSessionAuthChallengeDisposition values.
+const USE_CREDENTIAL: isize = 0;
+const PERFORM_DEFAULT_HANDLING: isize = 1;
+
+pub struct PakeCertDelegateIvars {
+    // wry's real navigation delegate; every non-challenge selector forwards here.
+    inner: Weak<AnyObject>,
+    allowed_host: String,
+}
+
+static CERT_BYPASS_ASSOCIATION_KEY: u8 = 0;
+
+fn hosts_match(allowed_host: &str, challenge_host: &str) -> bool {
+    allowed_host
+        .trim_end_matches('.')
+        .eq_ignore_ascii_case(challenge_host.trim_end_matches('.'))
+}
+
+define_class!(
+    #[unsafe(super(NSObject))]
+    #[name = "PakeCertBypassDelegate"]
+    #[thread_kind = MainThreadOnly]
+    #[ivars = PakeCertDelegateIvars]
+    struct PakeCertBypassDelegate;
+
+    unsafe impl NSObjectProtocol for PakeCertBypassDelegate {}
+
+    impl PakeCertBypassDelegate {
+        #[unsafe(method(webView:didReceiveAuthenticationChallenge:completionHandler:))]
+        fn did_receive_challenge(
+            &self,
+            _webview: &AnyObject,
+            challenge: &AnyObject,
+            handler: &block2::Block<dyn Fn(isize, *mut AnyObject)>,
+        ) {
+            unsafe {
+                let space: *mut AnyObject = msg_send![challenge, protectionSpace];
+                if space.is_null() {
+                    handler.call((PERFORM_DEFAULT_HANDLING, core::ptr::null_mut()));
+                    return;
+                }
+                let host: *mut NSString = msg_send![space, host];
+                if host.is_null()
+                    || !hosts_match(&self.ivars().allowed_host, &(&*host).to_string())
+                {
+                    handler.call((PERFORM_DEFAULT_HANDLING, core::ptr::null_mut()));
+                    return;
+                }
+                // Only server-trust challenges carry a non-null serverTrust; for
+                // anything else (e.g. HTTP basic auth) defer to default handling.
+                let server_trust: *mut AnyObject = msg_send![space, serverTrust];
+                if server_trust.is_null() {
+                    handler.call((PERFORM_DEFAULT_HANDLING, core::ptr::null_mut()));
+                    return;
+                }
+                let credential: *mut AnyObject =
+                    msg_send![class!(NSURLCredential), credentialForTrust: server_trust];
+                handler.call((USE_CREDENTIAL, credential));
+            }
+        }
+
+        // WKWebView probes respondsToSelector: before calling optional delegate
+        // methods, so report our own methods plus everything wry implements.
+        #[unsafe(method(respondsToSelector:))]
+        fn responds_to_selector(&self, selector: Sel) -> Bool {
+            let responds: Bool = unsafe { msg_send![super(self), respondsToSelector: selector] };
+            if responds.as_bool() {
+                return Bool::YES;
+            }
+            self.ivars()
+                .inner
+                .load()
+                .map(|inner| unsafe { msg_send![&*inner, respondsToSelector: selector] })
+                .unwrap_or(Bool::NO)
+        }
+
+        // Fast-forward any selector we do not implement to wry's delegate.
+        #[unsafe(method(forwardingTargetForSelector:))]
+        fn forwarding_target(&self, _selector: Sel) -> *mut AnyObject {
+            self.ivars()
+                .inner
+                .load()
+                .map(|inner| Retained::as_ptr(&inner) as *mut AnyObject)
+                .unwrap_or(core::ptr::null_mut())
+        }
+    }
+);
+
+impl PakeCertBypassDelegate {
+    fn new(
+        inner: &Retained<AnyObject>,
+        allowed_host: String,
+        mtm: MainThreadMarker,
+    ) -> Retained<Self> {
+        let this = mtm
+            .alloc::<PakeCertBypassDelegate>()
+            .set_ivars(PakeCertDelegateIvars {
+                inner: Weak::from_retained(inner),
+                allowed_host,
+            });
+        unsafe { msg_send![super(this), init] }
+    }
+}
+
+/// Replace the WKWebView's navigation delegate with a proxy that accepts
+/// invalid TLS certificates for the configured target host, then navigate to
+/// that target. `webview_ptr` is the raw `WKWebView` from
+/// `PlatformWebview::inner()`. Returns false if setup cannot be completed.
+pub fn install_cert_bypass_and_navigate(
+    webview_ptr: *mut c_void,
+    allowed_host: String,
+    target_url: String,
+) -> bool {
+    if webview_ptr.is_null() || allowed_host.is_empty() || target_url.is_empty() {
+        return false;
+    }
+    let Some(mtm) = MainThreadMarker::new() else {
+        return false;
+    };
+    unsafe {
+        let webview: &AnyObject = &*(webview_ptr as *const AnyObject);
+        let existing: *mut AnyObject = msg_send![webview, navigationDelegate];
+        if existing.is_null() {
+            return false;
+        }
+        let Some(inner) = Retained::retain(existing) else {
+            return false;
+        };
+        let proxy = PakeCertBypassDelegate::new(&inner, allowed_host, mtm);
+        objc2::ffi::objc_setAssociatedObject(
+            webview as *const AnyObject as *mut AnyObject,
+            std::ptr::addr_of!(CERT_BYPASS_ASSOCIATION_KEY).cast(),
+            Retained::as_ptr(&proxy) as *mut AnyObject,
+            objc2::ffi::OBJC_ASSOCIATION_RETAIN_NONATOMIC,
+        );
+        let _: () = msg_send![webview, setNavigationDelegate: &*proxy];
+
+        let target_url = NSString::from_str(&target_url);
+        let ns_url: *mut AnyObject = msg_send![class!(NSURL), URLWithString: &*target_url];
+        if ns_url.is_null() {
+            return false;
+        }
+        let request: *mut AnyObject = msg_send![class!(NSURLRequest), requestWithURL: ns_url];
+        if request.is_null() {
+            return false;
+        }
+        let _: () = msg_send![webview, loadRequest: request];
+        true
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::hosts_match;
+
+    #[test]
+    fn accepts_the_configured_host_case_insensitively() {
+        assert!(hosts_match("INTERNAL.EXAMPLE.COM", "internal.example.com"));
+        assert!(hosts_match("internal.example.com.", "internal.example.com"));
+    }
+
+    #[test]
+    fn rejects_other_hosts() {
+        assert!(!hosts_match("internal.example.com", "login.example.com"));
+    }
+}

package/src-tauri/src/app/invoke.rs

@@ -114,8 +114,18 @@ pub async fn download_file(app: AppHandle, params: DownloadFileParams) -> Result
 
     match response {
         Ok(mut res) => {
+            // Transport success is not download success: 403/404 HTML error pages
+            // must not be written as files or toasted as successful downloads.
+            if !res.status().is_success() {
+                show_toast(
+                    &window,
+                    &get_download_message_with_lang(MessageType::Failure, params.language),
+                );
+                return Err(format!("Download failed with HTTP status {}", res.status()));
+            }
+
             let mut file =
-                File::create(file_path).map_err(|e| format!("Failed to create file: {}", e))?;
+                File::create(&file_path).map_err(|e| format!("Failed to create file: {}", e))?;
 
             while let Some(chunk) = res
                 .chunk()

package/src-tauri/src/app/menu.rs

@@ -1,7 +1,7 @@
 // Menu functionality is only used on macOS; the module is gated in app/mod.rs.
-use crate::app::window::open_additional_window_safe;
+use crate::app::window::{open_additional_window_safe, MultiWindowState};
 use tauri::menu::{AboutMetadata, Menu, MenuItem, PredefinedMenuItem, Submenu};
-use tauri::{AppHandle, Manager, Wry};
+use tauri::{AppHandle, Manager, WebviewWindow, Wry};
 use tauri_plugin_opener::OpenerExt;
 
 pub fn set_app_menu(
@@ -224,6 +224,36 @@ fn help_menu(app: &AppHandle<Wry>, title: &str) -> tauri::Result<Submenu<Wry>> {
     Ok(help_menu)
 }
 
+// Resolve the app's real home URL from its window config. Split out from
+// `home_url` so the mapping can be unit-tested without an AppHandle.
+fn resolve_home_url(url_type: &str, url: &str) -> Option<tauri::Url> {
+    match url_type {
+        // A web app's configured url is already absolute.
+        "web" => tauri::Url::parse(url).ok(),
+        // A local-file app's url is only a basename; Tauri serves bundled assets
+        // from tauri://localhost on macOS (this menu is macOS-only). Resolving it
+        // against the currently loaded remote origin (as the old eval path did)
+        // would point at the wrong server.
+        "local" => tauri::Url::parse(&format!("tauri://localhost/{url}")).ok(),
+        _ => None,
+    }
+}
+
+fn home_url(app: &AppHandle) -> Option<tauri::Url> {
+    let state = app.try_state::<MultiWindowState>()?;
+    let window_config = state.pake_config.windows.first()?;
+    resolve_home_url(&window_config.url_type, &window_config.url)
+}
+
+fn focused_webview_window(app_handle: &AppHandle) -> Option<WebviewWindow> {
+    let windows = app_handle.webview_windows();
+    windows
+        .values()
+        .find(|window| window.is_focused().unwrap_or(false))
+        .cloned()
+        .or_else(|| windows.get("pake").cloned())
+}
+
 pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
     match id {
         "new_window" => {
@@ -235,13 +265,13 @@ pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
                 .open_url("https://github.com/tw93/Pake", None::<&str>);
         }
         "reload" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.location.reload()");
             }
         }
         "toggle_devtools" => {
             #[cfg(debug_assertions)] // Only allow in debug builds
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 if window.is_devtools_open() {
                     window.close_devtools();
                 } else {
@@ -250,69 +280,79 @@ pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
             }
         }
         "zoom_in" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("zoomIn()");
             }
         }
         "zoom_out" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("zoomOut()");
             }
         }
         "zoom_reset" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("setZoom('100%')");
             }
         }
         "go_back" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.history.back()");
             }
         }
         "go_forward" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.history.forward()");
             }
         }
         "go_home" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
-                let _ = window.eval("window.location.href = window.pakeConfig.url");
+            if let Some(window) = focused_webview_window(app_handle) {
+                // Native navigation works even from a blank error page (where
+                // eval cannot run) and resolves local-file apps to the correct
+                // bundled asset instead of a path on the current origin.
+                match home_url(app_handle) {
+                    Some(url) => {
+                        let _ = window.navigate(url);
+                    }
+                    None => {
+                        let _ = window.eval("window.location.href = window.pakeConfig.url");
+                    }
+                }
             }
         }
         "copy_url" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("navigator.clipboard.writeText(window.location.href)");
             }
         }
         "paste_and_match_style" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("triggerPasteAsPlainText()");
             }
         }
         "find" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.pakeFind?.open()");
             }
         }
         "find_next" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.pakeFind?.next()");
             }
         }
         "find_previous" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let _ = window.eval("window.pakeFind?.previous()");
             }
         }
         "clear_cache_restart" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 if window.clear_all_browsing_data().is_ok() {
                     app_handle.restart();
                 }
             }
         }
         "always_on_top" => {
-            if let Some(window) = app_handle.get_webview_window("pake") {
+            if let Some(window) = focused_webview_window(app_handle) {
                 let is_on_top = window.is_always_on_top().unwrap_or(false);
                 let _ = window.set_always_on_top(!is_on_top);
             }
@@ -320,3 +360,31 @@ pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
         _ => {}
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::resolve_home_url;
+
+    #[test]
+    fn web_url_passes_through_unchanged() {
+        assert_eq!(
+            resolve_home_url("web", "https://github.com").map(|u| u.to_string()),
+            Some("https://github.com/".to_string())
+        );
+    }
+
+    #[test]
+    fn local_basename_resolves_to_bundled_asset_url() {
+        // The fix: a local app's basename must become the bundled asset URL,
+        // not a path resolved against whatever origin is currently loaded.
+        assert_eq!(
+            resolve_home_url("local", "launcher.html").map(|u| u.to_string()),
+            Some("tauri://localhost/launcher.html".to_string())
+        );
+    }
+
+    #[test]
+    fn unknown_url_type_is_none() {
+        assert!(resolve_home_url("bogus", "whatever").is_none());
+    }
+}

package/src-tauri/src/app/mod.rs

@@ -1,3 +1,5 @@
+#[cfg(target_os = "macos")]
+pub mod cert;
 pub mod config;
 pub mod invoke;
 #[cfg(target_os = "macos")]

package/src-tauri/src/app/setup.rs

@@ -1,6 +1,7 @@
 use crate::app::window::{open_additional_window_safe, reapply_window_icon};
+use crate::cancel_startup_reveal;
 use std::str::FromStr;
-use std::sync::{Arc, Mutex};
+use std::sync::{atomic::AtomicBool, Arc, Mutex};
 use std::time::{Duration, Instant};
 use tauri::{
     menu::{MenuBuilder, MenuItemBuilder},
@@ -16,6 +17,7 @@ pub fn set_system_tray(
     tray_icon_path: &str,
     _init_fullscreen: bool,
     allow_multi_window: bool,
+    startup_revealed: Arc<AtomicBool>,
 ) -> tauri::Result<()> {
     if !show_system_tray {
         app.remove_tray_by_id("pake-tray");
@@ -42,6 +44,8 @@ pub fn set_system_tray(
 
     app.app_handle().remove_tray_by_id("pake-tray");
 
+    let menu_revealed = startup_revealed.clone();
+    let click_revealed = startup_revealed;
     let mut tray_builder = TrayIconBuilder::new()
         .menu(&menu)
         .on_menu_event(move |app, event| match event.id().as_ref() {
@@ -50,11 +54,13 @@ pub fn set_system_tray(
             }
             "hide_app" => {
                 if let Some(window) = app.get_webview_window("pake") {
+                    cancel_startup_reveal(&menu_revealed);
                     let _ = window.minimize();
                 }
             }
             "show_app" => {
                 if let Some(window) = app.get_webview_window("pake") {
+                    cancel_startup_reveal(&menu_revealed);
                     let _ = window.show();
                     reapply_window_icon(&window);
                     #[cfg(target_os = "linux")]
@@ -79,6 +85,8 @@ pub fn set_system_tray(
             if let TrayIconEvent::Click { button, .. } = event {
                 if button == tauri::tray::MouseButton::Left {
                     if let Some(window) = tray.app_handle().get_webview_window("pake") {
+                        // Any tray toggle claims visibility control from startup reveal.
+                        cancel_startup_reveal(&click_revealed);
                         let is_visible = window.is_visible().unwrap_or(false);
                         if is_visible {
                             let _ = window.hide();
@@ -120,6 +128,7 @@ pub fn set_global_shortcut(
     app: &AppHandle,
     shortcut: String,
     _init_fullscreen: bool,
+    startup_revealed: Arc<AtomicBool>,
 ) -> tauri::Result<()> {
     if shortcut.is_empty() {
         return Ok(());
@@ -139,6 +148,7 @@ pub fn set_global_shortcut(
         tauri_plugin_global_shortcut::Builder::new()
             .with_handler({
                 let last_triggered = Arc::clone(&last_triggered);
+                let startup_revealed = startup_revealed.clone();
                 move |app, event, _shortcut| {
                     let Ok(mut last_triggered) = last_triggered.lock() else {
                         return;
@@ -150,6 +160,7 @@ pub fn set_global_shortcut(
 
                     if shortcut_hotkey.eq(event) {
                         if let Some(window) = app.get_webview_window("pake") {
+                            cancel_startup_reveal(&startup_revealed);
                             let is_visible = window.is_visible().unwrap_or(false);
                             if is_visible {
                                 let _ = window.hide();

package/src-tauri/src/app/window.rs

@@ -3,6 +3,8 @@ use crate::util::{
     check_file_or_append, get_data_dir, get_download_message_with_lang, sanitize_download_filename,
     show_toast, MessageType,
 };
+#[cfg(target_os = "macos")]
+use dispatch::Queue;
 #[cfg(target_os = "windows")]
 use std::{os::windows::ffi::OsStrExt, ptr, sync::OnceLock};
 use std::{
@@ -279,6 +281,27 @@ fn build_window(
         ))
     })?;
 
+    #[cfg(target_os = "macos")]
+    let cert_bypass_target = if label == "pake"
+        && window_config.ignore_certificate_errors
+        && window_config.url_type == "web"
+    {
+        Url::parse(&window_config.url).ok()
+    } else {
+        None
+    };
+
+    // The delegate must be installed before the first TLS challenge. Start on
+    // a neutral page, then navigate from the with_webview callback below.
+    #[cfg(target_os = "macos")]
+    let url = if cert_bypass_target.is_some() {
+        WebviewUrl::CustomProtocol(
+            Url::parse("about:blank").expect("about:blank must be a valid URL"),
+        )
+    } else {
+        url
+    };
+
     let user_agent = config.user_agent.get();
 
     let config_script = format!(
@@ -407,11 +430,6 @@ fn build_window(
         {
             linux_browser_args.push_str(" --ignore-certificate-errors");
         }
-
-        #[cfg(target_os = "macos")]
-        {
-            window_builder = window_builder.additional_browser_args("--ignore-certificate-errors");
-        }
     }
 
     if window_config.enable_wasm {
@@ -583,7 +601,35 @@ fn build_window(
 
     window_builder = window_builder.on_navigation(|_| true);
 
-    window_builder.build()
+    let window = window_builder.build()?;
+
+    // macOS WKWebView ignores the Chromium --ignore-certificate-errors flag, so
+    // install a host-scoped delegate on the process-lifetime main window only.
+    // Queue setup after construction so wry cannot replace the proxy while it
+    // finishes initializing its own navigation delegate.
+    #[cfg(target_os = "macos")]
+    if let Some(target_url) = cert_bypass_target {
+        let allowed_host = target_url
+            .host_str()
+            .expect("web URLs must have a host")
+            .to_owned();
+        let cert_window = window.clone();
+        Queue::main().exec_async(move || {
+            if let Err(error) = cert_window.with_webview(move |webview| {
+                if !crate::app::cert::install_cert_bypass_and_navigate(
+                    webview.inner(),
+                    allowed_host,
+                    target_url.to_string(),
+                ) {
+                    eprintln!("[Pake] Failed to configure macOS certificate bypass.");
+                }
+            }) {
+                eprintln!("[Pake] Failed to access the macOS webview: {error}");
+            }
+        });
+    }
+
+    Ok(window)
 }
 
 #[cfg(all(test, target_os = "windows"))]

package/src-tauri/src/inject/event.js

@@ -60,6 +60,20 @@ function handleShortcut(event) {
   }
 }
 
+function handleWebShortcut(event) {
+  if (isNonMacDesktop() && event.ctrlKey) {
+    handleShortcut(event);
+    return;
+  }
+
+  const isMac = /mac/i.test(getDesktopPlatform());
+  const isMacScrollShortcut =
+    event.key === "ArrowUp" || event.key === "ArrowDown";
+  if (isMac && event.metaKey && isMacScrollShortcut) {
+    handleShortcut(event);
+  }
+}
+
 function toggleNativeFullscreen(appWindow) {
   appWindow
     .isFullscreen()
@@ -432,14 +446,12 @@ const PREVIEWABLE_MEDIA_EXTENSIONS = [
   "m4a",
 ];
 
-const DOWNLOAD_PATH_PATTERNS = [
-  "/download/",
-  "/files/",
-  "/attachments/",
-  "/assets/",
-  "/releases/",
-  "/dist/",
-];
+// Path fragments that often host real file downloads. Do not add broad static
+// asset roots such as "/assets/" or "/dist/": many SPAs use those as in-app
+// routes (e.g. MEXC /assets/future) and would be intercepted as downloads.
+// Extensionless links under these paths still match; prefer real extensions,
+// download attributes, or ?download / ?attachment query hints when possible.
+const DOWNLOAD_PATH_PATTERNS = ["/download/", "/files/", "/attachments/"];
 
 // Language detection utilities
 function getUserLanguage() {
@@ -622,14 +634,7 @@ document.addEventListener("DOMContentLoaded", () => {
 
   if (window["pakeConfig"]?.disabled_web_shortcuts !== true) {
     document.addEventListener("keydown", handleWindowFullscreenShortcut, true);
-    document.addEventListener("keyup", (event) => {
-      if (/windows|linux/i.test(navigator.userAgent) && event.ctrlKey) {
-        handleShortcut(event);
-      }
-      if (/macintosh|mac os x/i.test(navigator.userAgent) && event.metaKey) {
-        handleShortcut(event);
-      }
-    });
+    document.addEventListener("keyup", handleWebShortcut);
   }
 
   document.addEventListener("keydown", handleClipboardShortcut, true);

package/src-tauri/src/inject/find.js

@@ -663,9 +663,11 @@
   function getFindShortcutAction(event) {
     const userAgent = navigator.userAgent || "";
     const isMac = /macintosh|mac os x/i.test(userAgent);
-    const hasModifier = isMac
-      ? event.metaKey && !event.ctrlKey
-      : event.ctrlKey && !event.metaKey;
+    if (isMac) {
+      return "";
+    }
+
+    const hasModifier = event.ctrlKey && !event.metaKey;
 
     if (!hasModifier || event.altKey) {
       return "";

package/src-tauri/src/lib.rs

@@ -2,14 +2,20 @@
 mod app;
 mod util;
 
-use tauri::Manager;
+use std::sync::{
+    atomic::{AtomicBool, Ordering},
+    Arc,
+};
+use tauri::{webview::PageLoadEvent, Manager, Url, WebviewWindow};
 use tauri_plugin_window_state::Builder as WindowStatePlugin;
 use tauri_plugin_window_state::StateFlags;
 
 #[cfg(target_os = "macos")]
 use std::time::Duration;
 
-const WINDOW_SHOW_DELAY: u64 = 50;
+// Fallback when PageLoadEvent::Finished never arrives (offline / stalled).
+// Deliberately longer than a paint tick so the normal path can win first.
+const STARTUP_WINDOW_FALLBACK_DELAY: u64 = 3_000;
 #[cfg(target_os = "linux")]
 const PAKE_LINUX_WEBKIT_SAFE_MODE: &str = "PAKE_LINUX_WEBKIT_SAFE_MODE";
 #[cfg(target_os = "linux")]
@@ -29,6 +35,55 @@ use app::{
 };
 use util::get_pake_config;
 
+/// Placeholder documents used before the real target URL navigates (e.g. macOS
+/// cert-bypass starts on about:blank). Revealing on these would reintroduce the
+/// blank-window flash the page-load gate is meant to prevent.
+fn is_placeholder_startup_url(url: &Url) -> bool {
+    url.scheme().eq_ignore_ascii_case("about")
+}
+
+/// First automatic reveal wins. Returns true if the caller should show the window.
+fn claim_startup_reveal(revealed: &AtomicBool) -> bool {
+    !revealed.swap(true, Ordering::AcqRel)
+}
+
+/// User took control of main-window visibility (tray, shortcut, dock, second
+/// instance, hide-on-close). Drop any pending page-load / fallback reveal so a
+/// slow cold start cannot re-open a window the user just hid.
+pub(crate) fn cancel_startup_reveal(revealed: &AtomicBool) {
+    revealed.store(true, Ordering::Release);
+}
+
+fn reveal_startup_window(window: WebviewWindow, init_fullscreen: bool, revealed: &Arc<AtomicBool>) {
+    if !claim_startup_reveal(revealed) {
+        return;
+    }
+
+    tauri::async_runtime::spawn(async move {
+        let _ = window.show();
+        reapply_window_icon(&window);
+
+        // Fixed: Linux fullscreen issue with virtual keyboard
+        #[cfg(target_os = "linux")]
+        {
+            if init_fullscreen {
+                let _ = window.set_fullscreen(true);
+                // Ensure webview maintains focus for input after fullscreen
+                let _ = window.set_focus();
+            } else {
+                // Fix: Ubuntu 24.04/GNOME window buttons non-functional until resize (#1122)
+                // The window manager needs time to process the MapWindow event before
+                // accepting focus requests. Without this, decorations remain non-interactive.
+                tokio::time::sleep(tokio::time::Duration::from_millis(30)).await;
+                let _ = window.set_focus();
+            }
+        }
+
+        #[cfg(not(target_os = "linux"))]
+        let _ = init_fullscreen;
+    });
+}
+
 #[cfg(any(target_os = "linux", test))]
 fn is_disabled_env_value(value: &str) -> bool {
     matches!(
@@ -149,6 +204,7 @@ pub fn run_app() {
     let multi_instance = pake_config.multi_instance;
     let multi_window = pake_config.multi_window;
     let _enable_find = pake_config.windows[0].enable_find;
+    let startup_window_revealed = Arc::new(AtomicBool::new(false));
 
     let window_state_plugin = WindowStatePlugin::default()
         .with_state_flags(if init_fullscreen {
@@ -172,11 +228,13 @@ pub fn run_app() {
 
     // Only add single instance plugin if multiple instances are not allowed
     if !multi_instance {
+        let instance_revealed = startup_window_revealed.clone();
         app_builder = app_builder.plugin(tauri_plugin_single_instance::init(
             move |app, _args, _cwd| {
                 if multi_window {
                     open_additional_window_safe(app);
                 } else if let Some(window) = app.get_webview_window("pake") {
+                    cancel_startup_reveal(&instance_revealed);
                     let _ = window.unminimize();
                     let _ = window.show();
                     reapply_window_icon(&window);
@@ -186,6 +244,35 @@ pub fn run_app() {
         ));
     }
 
+    // Reveal the main window after the first real document finishes loading so
+    // slow WKWebView cold starts do not expose an empty but interactive shell.
+    // start_to_tray keeps the window hidden for the whole session until the user
+    // opens it from the tray / shortcut.
+    if !start_to_tray {
+        let page_load_revealed = startup_window_revealed.clone();
+        app_builder = app_builder.on_page_load(move |webview, payload| {
+            if webview.label() != "pake" {
+                return;
+            }
+            if !matches!(payload.event(), PageLoadEvent::Finished) {
+                return;
+            }
+            // Skip about:blank (and other about: placeholders) used by the macOS
+            // cert-bypass path before the real target URL navigates.
+            if is_placeholder_startup_url(payload.url()) {
+                return;
+            }
+            if let Some(window) = webview.app_handle().get_webview_window("pake") {
+                reveal_startup_window(window, init_fullscreen, &page_load_revealed);
+            }
+        });
+    }
+
+    // Clone before setup moves the Arc into tray / shortcut / fallback handlers.
+    let close_revealed = startup_window_revealed.clone();
+    #[cfg(target_os = "macos")]
+    let reopen_revealed = startup_window_revealed.clone();
+
     app_builder
         .invoke_handler(tauri::generate_handler![
             download_file,
@@ -222,34 +309,30 @@ pub fn run_app() {
                 &pake_config.system_tray_path,
                 init_fullscreen,
                 multi_window,
+                startup_window_revealed.clone(),
+            )?;
+            set_global_shortcut(
+                app.app_handle(),
+                activation_shortcut,
+                init_fullscreen,
+                startup_window_revealed.clone(),
             )?;
-            set_global_shortcut(app.app_handle(), activation_shortcut, init_fullscreen)?;
 
             // Show window after state restoration to prevent position flashing
-            // Unless start_to_tray is enabled, then keep it hidden
+            // once its first page finishes. A fallback keeps offline or stalled
+            // pages reachable without exposing a blank webview during normal startup.
             if !start_to_tray {
                 let window_clone = window.clone();
                 tauri::async_runtime::spawn(async move {
-                    tokio::time::sleep(tokio::time::Duration::from_millis(WINDOW_SHOW_DELAY)).await;
-                    let _ = window_clone.show();
-                    reapply_window_icon(&window_clone);
-
-                    // Fixed: Linux fullscreen issue with virtual keyboard
-                    #[cfg(target_os = "linux")]
-                    {
-                        if init_fullscreen {
-                            let _ = window_clone.set_fullscreen(true);
-                            // Ensure webview maintains focus for input after fullscreen
-                            let _ = window_clone.set_focus();
-                        } else {
-                            // Fix: Ubuntu 24.04/GNOME window buttons non-functional until resize (#1122)
-                            // The window manager needs time to process the MapWindow event before
-                            // accepting focus requests. Without this, decorations remain non-interactive.
-                            tokio::time::sleep(tokio::time::Duration::from_millis(30)).await;
-                            let _ = window_clone.set_focus();
-                        }
-                    }
+                    tokio::time::sleep(tokio::time::Duration::from_millis(
+                        STARTUP_WINDOW_FALLBACK_DELAY,
+                    ))
+                    .await;
+                    reveal_startup_window(window_clone, init_fullscreen, &startup_window_revealed);
                 });
+            } else {
+                // Tray/shortcut already hold clones that cancel user-driven toggles.
+                drop(startup_window_revealed);
             }
 
             Ok(())
@@ -257,6 +340,8 @@ pub fn run_app() {
         .on_window_event(move |_window, _event| {
             if let tauri::WindowEvent::CloseRequested { api, .. } = _event {
                 if hide_on_close && _window.label() == "pake" {
+                    // User dismissed the window; do not let startup reveal reopen it.
+                    cancel_startup_reveal(&close_revealed);
                     // Hide window when hide_on_close is enabled (regardless of tray status)
                     let window = _window.clone();
                     tauri::async_runtime::spawn(async move {
@@ -291,7 +376,7 @@ pub fn run_app() {
             eprintln!("[Pake] Fatal error while building Tauri application: {error}");
             std::process::exit(1);
         })
-        .run(|_app, _event| {
+        .run(move |_app, _event| {
             // Handle macOS dock icon click to reopen hidden window
             #[cfg(target_os = "macos")]
             if let tauri::RunEvent::Reopen {
@@ -301,6 +386,7 @@ pub fn run_app() {
             {
                 if !has_visible_windows {
                     if let Some(window) = _app.get_webview_window("pake") {
+                        cancel_startup_reveal(&reopen_revealed);
                         let _ = window.show();
                         reapply_window_icon(&window);
                         let _ = window.set_focus();
@@ -318,6 +404,46 @@ pub fn run() {
 mod tests {
     use super::*;
 
+    #[test]
+    fn placeholder_startup_urls_cover_about_blank() {
+        let blank: Url = "about:blank".parse().unwrap();
+        let srcdoc: Url = "about:srcdoc".parse().unwrap();
+        let https: Url = "https://github.com/".parse().unwrap();
+        let tauri: Url = "tauri://localhost/".parse().unwrap();
+
+        assert!(is_placeholder_startup_url(&blank));
+        assert!(is_placeholder_startup_url(&srcdoc));
+        assert!(!is_placeholder_startup_url(&https));
+        assert!(!is_placeholder_startup_url(&tauri));
+    }
+
+    #[test]
+    fn first_claim_wins_startup_reveal() {
+        let revealed = AtomicBool::new(false);
+        assert!(claim_startup_reveal(&revealed));
+        assert!(!claim_startup_reveal(&revealed));
+    }
+
+    #[test]
+    fn user_show_then_hide_blocks_automatic_startup_reveal() {
+        // Slow page load: user opens from tray/shortcut, then hides again.
+        // Page-load finish and the 3s fallback must not reopen the window.
+        let revealed = AtomicBool::new(false);
+        cancel_startup_reveal(&revealed); // explicit show
+        cancel_startup_reveal(&revealed); // explicit hide
+        assert!(
+            !claim_startup_reveal(&revealed),
+            "automatic reveal must stay cancelled after user visibility control"
+        );
+    }
+
+    #[test]
+    fn cancel_before_any_claim_blocks_reveal() {
+        let revealed = AtomicBool::new(false);
+        cancel_startup_reveal(&revealed);
+        assert!(!claim_startup_reveal(&revealed));
+    }
+
     #[test]
     fn linux_webkit_safe_mode_stays_on_by_default() {
         assert!(should_enable_linux_webkit_safe_mode_from_values(

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "productName": "Weekly",
   "identifier": "com.pake.weekly",
-  "version": "3.15.3",
+  "version": "3.15.5",
   "app": {
     "withGlobalTauri": true,
     "trayIcon": {