pake-cli 3.15.5 → 3.15.7

package/README.md

@@ -202,7 +202,7 @@ Use Pake (npm i -g pake-cli) to package webpages as desktop apps. Read https://u
 
 ## Development
 
-Requires Rust `>=1.85` and Node `>=22` (recommended LTS; `>=18` also works). For detailed installation guide, see [Tauri documentation](https://v2.tauri.app/start/prerequisites/). If unfamiliar with development environment, use the CLI tool instead.
+Requires Rust `>=1.85` and Node `>=22` (recommended LTS; `>=20` also works). For detailed installation guide, see [Tauri documentation](https://v2.tauri.app/start/prerequisites/). If unfamiliar with development environment, use the CLI tool instead.
 
 ```bash
 # Install dependencies

package/dist/cli.js

@@ -14,16 +14,14 @@ import fs from 'fs';
 import fs$1 from 'fs/promises';
 import { dir } from 'tmp-promise';
 import { fileTypeFromBuffer } from 'file-type';
-import icongen from 'icon-gen';
-import sharp from 'sharp';
 import * as psl from 'psl';
 import { InvalidArgumentError, program as program$1, Option } from 'commander';
 
 var name = "pake-cli";
-var version = "3.15.5";
+var version = "3.15.7";
 var description = "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。";
 var engines = {
-	node: ">=18.0.0"
+	node: ">=20.9.0"
 };
 var packageManager = "pnpm@10.26.2";
 var bin = {
@@ -78,14 +76,13 @@ var dependencies = {
 	chalk: "^5.6.2",
 	commander: "^14.0.3",
 	execa: "^9.6.1",
-	"file-type": "^21.3.0",
+	"file-type": "^21.3.4",
 	"fs-extra": "^11.3.3",
-	"icon-gen": "^5.0.0",
 	loglevel: "^1.9.2",
 	ora: "^9.3.0",
 	prompts: "^2.4.2",
 	psl: "^1.15.0",
-	sharp: "^0.34.5",
+	sharp: "^0.35.0",
 	"tmp-promise": "^3.0.3",
 	"update-notifier": "^7.3.1"
 };
@@ -111,8 +108,9 @@ var devDependencies = {
 };
 var pnpm = {
 	overrides: {
-		sharp: "^0.34.5",
-		"@img/sharp-libvips-darwin-arm64": "1.2.4"
+		sharp: "^0.35.0",
+		"@img/sharp-libvips-darwin-arm64": "1.3.0",
+		tmp: "0.2.7"
 	},
 	onlyBuiltDependencies: [
 		"esbuild",
@@ -2113,6 +2111,9 @@ function getIconSourcePriority(url, appName) {
         : ['domain', 'dashboard'];
 }
 
+async function loadSharp$1() {
+    return (await import('sharp')).default;
+}
 const ICO_HEADER_SIZE = 6;
 const ICO_DIR_ENTRY_SIZE = 16;
 const ICO_TYPE_ICON = 1;
@@ -2246,6 +2247,7 @@ async function pickLargestFrameAsPng(buffer, entries) {
     // Fallback: let sharp render directly from the ICO buffer. sharp picks the
     // largest embedded frame on its own.
     try {
+        const sharp = await loadSharp$1();
         return await sharp(buffer).png().toBuffer();
     }
     catch {
@@ -2267,6 +2269,7 @@ async function ensureMultiResolutionIco(sourcePath, outputPath, preferredSize =
         if (!sourcePng) {
             return await writeIcoWithPreferredSize(sourcePath, outputPath, preferredSize);
         }
+        const sharp = await loadSharp$1();
         const frames = await Promise.all(desiredSizes.map(async (size) => {
             // Reuse an existing exact-size PNG frame when possible to keep any
             // hand-tuned small icon (e.g. a 16x16 with deliberate pixel hinting).
@@ -2333,6 +2336,9 @@ function buildIcoFromPngBuffers(frames) {
     return output;
 }
 
+async function loadSharp() {
+    return (await import('sharp')).default;
+}
 const ICON_CONFIG = {
     minFileSize: 100,
     supportedFormats: [
@@ -2353,8 +2359,20 @@ const ICON_CONFIG = {
 const PLATFORM_CONFIG = {
     win: { format: '.ico', sizes: [...WIN_STANDARD_ICO_SIZES] },
     linux: { format: '.png', size: 512 },
-    macos: { format: '.icns', sizes: [16, 32, 64, 128, 256, 512, 1024] },
+    macos: { format: '.icns' },
 };
+const MACOS_ICONSET_FILES = [
+    ['icon_16x16.png', 16],
+    ['icon_16x16@2x.png', 32],
+    ['icon_32x32.png', 32],
+    ['icon_32x32@2x.png', 64],
+    ['icon_128x128.png', 128],
+    ['icon_128x128@2x.png', 256],
+    ['icon_256x256.png', 256],
+    ['icon_256x256@2x.png', 512],
+    ['icon_512x512.png', 512],
+    ['icon_512x512@2x.png', 1024],
+];
 const API_KEYS = {
     logoDev: ['pk_JLLMUKGZRpaG5YclhXaTkg', 'pk_Ph745P8mQSeYFfW2Wk039A'],
     brandfetch: ['1idqvJC0CeFSeyp3Yf7', '1idej-yhU_ThggIHFyG'],
@@ -2413,6 +2431,7 @@ async function preprocessIcon(inputPath) {
         if (!shouldNormalize) {
             return inputPath;
         }
+        const sharp = await loadSharp();
         const { path: tempDir } = await dir();
         const outputPath = path.join(tempDir, 'icon-normalized.png');
         await sharp(inputPath).ensureAlpha().png().toFile(outputPath);
@@ -2430,6 +2449,7 @@ async function preprocessIcon(inputPath) {
  */
 async function applyMacOSMask(inputPath) {
     try {
+        const sharp = await loadSharp();
         const { path: tempDir } = await dir();
         const outputPath = path.join(tempDir, 'icon-macos-rounded.png');
         // 1. Create a 1024x1024 rounded rect mask
@@ -2473,6 +2493,32 @@ async function applyMacOSMask(inputPath) {
         return inputPath;
     }
 }
+async function generateMacOSIcns(inputPath, outputDir, iconName) {
+    const sharp = await loadSharp();
+    const iconsetPath = path.join(outputDir, `${iconName}.iconset`);
+    const outputPath = path.join(outputDir, `${iconName}${PLATFORM_CONFIG.macos.format}`);
+    await fsExtra.ensureDir(iconsetPath);
+    const source = sharp(inputPath);
+    await Promise.all(MACOS_ICONSET_FILES.map(async ([fileName, size]) => {
+        await source
+            .clone()
+            .resize(size, size, {
+            fit: 'contain',
+            background: ICON_CONFIG.transparentBackground,
+        })
+            .ensureAlpha()
+            .png()
+            .toFile(path.join(iconsetPath, fileName));
+    }));
+    await execa('/usr/bin/iconutil', [
+        '-c',
+        'icns',
+        iconsetPath,
+        '-o',
+        outputPath,
+    ]);
+    return outputPath;
+}
 /**
  * Converts icon to platform-specific format
  */
@@ -2487,6 +2533,7 @@ async function convertIconFormat(inputPath, appName) {
         const iconName = getIconBaseName(appName);
         // Generate platform-specific format
         if (IS_WIN) {
+            const sharp = await loadSharp();
             const icoPath = path.join(platformOutputDir, `${iconName}_256${PLATFORM_CONFIG.win.format}`);
             const sourceBuffer = await fsExtra.readFile(processedInputPath);
             const frames = await Promise.all(PLATFORM_CONFIG.win.sizes.map(async (size) => {
@@ -2505,6 +2552,7 @@ async function convertIconFormat(inputPath, appName) {
             return icoPath;
         }
         if (IS_LINUX) {
+            const sharp = await loadSharp();
             const outputPath = path.join(platformOutputDir, `${iconName}_${PLATFORM_CONFIG.linux.size}${PLATFORM_CONFIG.linux.format}`);
             // Ensure we convert to proper PNG format with correct size
             await sharp(processedInputPath)
@@ -2519,11 +2567,7 @@ async function convertIconFormat(inputPath, appName) {
         }
         // macOS
         const macIconPath = await applyMacOSMask(processedInputPath);
-        await icongen(macIconPath, platformOutputDir, {
-            report: false,
-            icns: { name: iconName, sizes: PLATFORM_CONFIG.macos.sizes },
-        });
-        const outputPath = path.join(platformOutputDir, `${iconName}${PLATFORM_CONFIG.macos.format}`);
+        const outputPath = await generateMacOSIcns(macIconPath, platformOutputDir, iconName);
         return (await fsExtra.pathExists(outputPath)) ? outputPath : null;
     }
     catch (error) {
@@ -2538,6 +2582,7 @@ async function isLinuxBundleIconReady(iconPath) {
         return false;
     }
     try {
+        const sharp = await loadSharp();
         const { width, height } = await sharp(iconPath).metadata();
         return (width === PLATFORM_CONFIG.linux.size &&
             height === PLATFORM_CONFIG.linux.size);

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "pake-cli",
-  "version": "3.15.5",
+  "version": "3.15.7",
   "description": "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.9.0"
   },
   "packageManager": "pnpm@10.26.2",
   "bin": {
@@ -58,14 +58,13 @@
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "execa": "^9.6.1",
-    "file-type": "^21.3.0",
+    "file-type": "^21.3.4",
     "fs-extra": "^11.3.3",
-    "icon-gen": "^5.0.0",
     "loglevel": "^1.9.2",
     "ora": "^9.3.0",
     "prompts": "^2.4.2",
     "psl": "^1.15.0",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.0",
     "tmp-promise": "^3.0.3",
     "update-notifier": "^7.3.1"
   },
@@ -91,8 +90,9 @@
   },
   "pnpm": {
     "overrides": {
-      "sharp": "^0.34.5",
-      "@img/sharp-libvips-darwin-arm64": "1.2.4"
+      "sharp": "^0.35.0",
+      "@img/sharp-libvips-darwin-arm64": "1.3.0",
+      "tmp": "0.2.7"
     },
     "onlyBuiltDependencies": [
       "esbuild",

package/src-tauri/Cargo.lock

@@ -2564,13 +2564,14 @@ dependencies = [
 
 [[package]]
 name = "pake"
-version = "3.15.5"
+version = "3.15.7"
 dependencies = [
  "block2",
  "dispatch",
  "objc2",
  "objc2-app-kit",
  "objc2-foundation",
+ "objc2-web-kit",
  "serde",
  "serde_json",
  "tauri",
@@ -2584,6 +2585,8 @@ dependencies = [
  "tauri-plugin-single-instance",
  "tauri-plugin-window-state",
  "tokio",
+ "webkit2gtk",
+ "webview2-com",
  "windows-sys 0.61.2",
 ]
 
@@ -3042,9 +3045,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.13"
+version = "0.11.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
+checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
 dependencies = [
  "bytes",
  "getrandom 0.3.4",
@@ -3072,7 +3075,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -3420,9 +3423,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.9"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "ring",
  "rustls-pki-types",

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pake"
-version = "3.15.5"
+version = "3.15.7"
 description = "🤱🏻 Turn any webpage into a desktop app with Rust."
 authors = ["Tw93"]
 license = "GPL-3.0-or-later"
@@ -41,6 +41,17 @@ dispatch = "0.2"
 objc2 = "0.6"
 objc2-app-kit = { version = "0.3", features = ["NSApplication", "NSDockTile"] }
 objc2-foundation = { version = "0.3", features = ["NSString"] }
+objc2-web-kit = { version = "0.3", default-features = false, features = [
+  "std",
+  "WKUserContentController",
+  "WKWebViewConfiguration",
+] }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+# Used for native WebKitGTK go_back/go_forward on error pages (no page JS).
+# Version and features must match what wry resolves, or PlatformWebview::inner
+# hands back a WebView from a different crate instance.
+webkit2gtk = { version = "=2.0.2", features = ["v2_38"] }
 
 [target.'cfg(windows)'.dependencies]
 windows-sys = { version = "0.61.2", features = [
@@ -48,6 +59,8 @@ windows-sys = { version = "0.61.2", features = [
   "Win32_UI_Shell",
   "Win32_UI_WindowsAndMessaging",
 ] }
+# Used for native WebView2 GoBack/GoForward on error pages (no page JS).
+webview2-com = "0.38"
 
 [features]
 # this feature is used for development builds from development cli

package/src-tauri/src/app/invoke.rs

@@ -1,3 +1,4 @@
+use crate::app::navigation::{history_step, reload_window};
 use crate::util::{
     check_file_or_append, get_download_message_with_lang, sanitize_download_filename, show_toast,
     MessageType,
@@ -8,6 +9,7 @@ use std::str::FromStr;
 use std::sync::atomic::{AtomicI64, Ordering};
 use tauri::http::Method;
 use tauri::{command, AppHandle, Manager, Url, WebviewWindow};
+use tauri_plugin_http::reqwest::header::{HeaderValue, COOKIE};
 use tauri_plugin_http::reqwest::{ClientBuilder, Request};
 
 use tauri::Theme;
@@ -82,10 +84,30 @@ pub struct NotificationParams {
     icon: String,
 }
 
-#[command]
-pub async fn download_file(app: AppHandle, params: DownloadFileParams) -> Result<(), String> {
-    let window: WebviewWindow = app.get_webview_window("pake").ok_or("Window not found")?;
+/// Build a Cookie header from the webview session so authenticated downloads
+/// match what the page itself would request. Best-effort: missing cookies
+/// fall through to an anonymous request.
+fn cookie_header_for_url(window: &WebviewWindow, url: &Url) -> Option<HeaderValue> {
+    let cookies = window.cookies_for_url(url.clone()).ok()?;
+    if cookies.is_empty() {
+        return None;
+    }
+    let header = cookies
+        .iter()
+        .map(|cookie| format!("{}={}", cookie.name(), cookie.value()))
+        .collect::<Vec<_>>()
+        .join("; ");
+    HeaderValue::from_str(&header).ok()
+}
 
+#[command]
+pub async fn download_file(
+    window: WebviewWindow,
+    app: AppHandle,
+    params: DownloadFileParams,
+) -> Result<(), String> {
+    // Toast on the calling window (secondary windows included), not a hard-coded
+    // main-window label. Tauri injects the invoker as `window`.
     show_toast(
         &window,
         &get_download_message_with_lang(MessageType::Start, params.language.clone()),
@@ -108,7 +130,10 @@ pub async fn download_file(app: AppHandle, params: DownloadFileParams) -> Result
 
     let url = Url::from_str(&params.url).map_err(|e| format!("Invalid URL: {}", e))?;
 
-    let request = Request::new(Method::GET, url);
+    let mut request = Request::new(Method::GET, url.clone());
+    if let Some(cookie_header) = cookie_header_for_url(&window, &url) {
+        request.headers_mut().insert(COOKIE, cookie_header);
+    }
 
     let response = client.execute(request).await;
 
@@ -195,12 +220,12 @@ pub fn set_dock_badge_label(app: AppHandle, label: Option<String>) -> Result<(),
 
 #[command]
 pub async fn update_theme_mode(app: AppHandle, mode: String) {
-    if let Some(window) = app.get_webview_window("pake") {
-        let theme = if mode == "dark" {
-            Theme::Dark
-        } else {
-            Theme::Light
-        };
+    let theme = if mode == "dark" {
+        Theme::Dark
+    } else {
+        Theme::Light
+    };
+    for window in app.webview_windows().values() {
         let _ = window.set_theme(Some(theme));
     }
 }
@@ -216,3 +241,27 @@ pub fn set_zoom(window: WebviewWindow, percent: f64) -> Result<(), String> {
         .set_zoom(factor)
         .map_err(|e| format!("Failed to set zoom: {}", e))
 }
+
+/// Native navigation for injected shortcuts (Linux/Windows Ctrl+R / [ / ]).
+/// Blank error pages have no JS context, so page `history` / `location` calls
+/// are no-ops; these use the platform webview API instead.
+#[command]
+pub fn webview_navigate(window: WebviewWindow, action: String) -> Result<(), String> {
+    match action.as_str() {
+        "reload" => {
+            reload_window(&window);
+            Ok(())
+        }
+        "back" => {
+            history_step(&window, true);
+            Ok(())
+        }
+        "forward" => {
+            history_step(&window, false);
+            Ok(())
+        }
+        other => Err(format!(
+            "Unknown webview_navigate action '{other}' (expected reload|back|forward)"
+        )),
+    }
+}

package/src-tauri/src/app/menu.rs

@@ -1,5 +1,8 @@
 // Menu functionality is only used on macOS; the module is gated in app/mod.rs.
+use crate::app::navigation::{history_step, reload_window};
 use crate::app::window::{open_additional_window_safe, MultiWindowState};
+use std::io::Write;
+use std::process::{Command, Stdio};
 use tauri::menu::{AboutMetadata, Menu, MenuItem, PredefinedMenuItem, Submenu};
 use tauri::{AppHandle, Manager, WebviewWindow, Wry};
 use tauri_plugin_opener::OpenerExt;
@@ -254,6 +257,18 @@ fn focused_webview_window(app_handle: &AppHandle) -> Option<WebviewWindow> {
         .or_else(|| windows.get("pake").cloned())
 }
 
+/// Copy text via pbcopy so it works when the page has no JS context (error
+/// shells) and when the Clipboard API is blocked by the site CSP.
+fn copy_text_to_pasteboard(text: &str) {
+    let Ok(mut child) = Command::new("pbcopy").stdin(Stdio::piped()).spawn() else {
+        return;
+    };
+    if let Some(stdin) = child.stdin.as_mut() {
+        let _ = stdin.write_all(text.as_bytes());
+    }
+    let _ = child.wait();
+}
+
 pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
     match id {
         "new_window" => {
@@ -266,7 +281,8 @@ pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
         }
         "reload" => {
             if let Some(window) = focused_webview_window(app_handle) {
-                let _ = window.eval("window.location.reload()");
+                // Native reload works on blank error pages where eval cannot.
+                reload_window(&window);
             }
         }
         "toggle_devtools" => {
@@ -296,12 +312,12 @@ pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
         }
         "go_back" => {
             if let Some(window) = focused_webview_window(app_handle) {
-                let _ = window.eval("window.history.back()");
+                history_step(&window, true);
             }
         }
         "go_forward" => {
             if let Some(window) = focused_webview_window(app_handle) {
-                let _ = window.eval("window.history.forward()");
+                history_step(&window, false);
             }
         }
         "go_home" => {
@@ -321,7 +337,11 @@ pub fn handle_menu_click(app_handle: &AppHandle, id: &str) {
         }
         "copy_url" => {
             if let Some(window) = focused_webview_window(app_handle) {
-                let _ = window.eval("navigator.clipboard.writeText(window.location.href)");
+                // Prefer the native webview URL so copy still works on error
+                // pages that have no document.location / clipboard API.
+                if let Ok(url) = window.url() {
+                    copy_text_to_pasteboard(url.as_str());
+                }
             }
         }
         "paste_and_match_style" => {

package/src-tauri/src/app/mod.rs

@@ -4,5 +4,6 @@ pub mod config;
 pub mod invoke;
 #[cfg(target_os = "macos")]
 pub mod menu;
+pub mod navigation;
 pub mod setup;
 pub mod window;

package/src-tauri/src/app/navigation.rs

@@ -0,0 +1,83 @@
+//! Cross-platform webview navigation that does not depend on page JS.
+//! Blank error shells have no JS context, so `eval("history.back()")` and
+//! `location.reload()` are dead exactly when the user is stuck.
+
+use tauri::WebviewWindow;
+
+/// Reload the current document via the native webview API.
+pub fn reload_window(window: &WebviewWindow) {
+    if let Err(error) = window.reload() {
+        eprintln!("[Pake] Failed to reload webview: {error}");
+    }
+}
+
+/// Step the webview history without requiring a live page JS context.
+pub fn history_step(window: &WebviewWindow, back: bool) {
+    let stepped = window.with_webview(move |webview| {
+        history_step_platform(&webview, back);
+    });
+
+    if stepped.is_err() {
+        // Last resort when with_webview is unavailable (rare). Still fails on
+        // blank error shells, but preserves SPA history when the page is live.
+        let script = if back {
+            "window.history.back()"
+        } else {
+            "window.history.forward()"
+        };
+        if let Err(error) = window.eval(script) {
+            eprintln!("[Pake] Failed to step webview history: {error}");
+        }
+    }
+}
+
+#[cfg(target_os = "macos")]
+fn history_step_platform(webview: &tauri::webview::PlatformWebview, back: bool) {
+    use objc2::msg_send;
+    use objc2::runtime::AnyObject;
+
+    let ptr = webview.inner() as *mut AnyObject;
+    if ptr.is_null() {
+        return;
+    }
+    unsafe {
+        if back {
+            let _: *mut AnyObject = msg_send![ptr, goBack];
+        } else {
+            let _: *mut AnyObject = msg_send![ptr, goForward];
+        }
+    }
+}
+
+#[cfg(target_os = "linux")]
+fn history_step_platform(webview: &tauri::webview::PlatformWebview, back: bool) {
+    use webkit2gtk::WebViewExt;
+
+    let gtk_webview = webview.inner();
+    if back {
+        gtk_webview.go_back();
+    } else {
+        gtk_webview.go_forward();
+    }
+}
+
+#[cfg(windows)]
+fn history_step_platform(webview: &tauri::webview::PlatformWebview, back: bool) {
+    use webview2_com::Microsoft::Web::WebView2::Win32::ICoreWebView2Controller;
+
+    let controller = webview.controller();
+    unsafe {
+        // ICoreWebView2Controller::CoreWebView2 returns the underlying browser.
+        let Ok(core) = controller.CoreWebView2() else {
+            return;
+        };
+        if back {
+            let _ = core.GoBack();
+        } else {
+            let _ = core.GoForward();
+        }
+    }
+}
+
+#[cfg(not(any(target_os = "macos", target_os = "linux", windows)))]
+fn history_step_platform(_webview: &tauri::webview::PlatformWebview, _back: bool) {}

package/src-tauri/src/app/setup.rs

@@ -1,11 +1,13 @@
-use crate::app::window::{open_additional_window_safe, reapply_window_icon};
+use crate::app::window::{
+    hide_all_app_windows, open_additional_window_safe, show_all_app_windows, toggle_all_app_windows,
+};
 use crate::cancel_startup_reveal;
 use std::str::FromStr;
 use std::sync::{atomic::AtomicBool, Arc, Mutex};
 use std::time::{Duration, Instant};
 use tauri::{
     menu::{MenuBuilder, MenuItemBuilder},
-    tray::{TrayIconBuilder, TrayIconEvent},
+    tray::{MouseButton, MouseButtonState, TrayIconBuilder, TrayIconEvent},
     AppHandle, Manager,
 };
 use tauri_plugin_global_shortcut::{GlobalShortcutExt, Shortcut};
@@ -53,22 +55,13 @@ pub fn set_system_tray(
                 open_additional_window_safe(app);
             }
             "hide_app" => {
-                if let Some(window) = app.get_webview_window("pake") {
-                    cancel_startup_reveal(&menu_revealed);
-                    let _ = window.minimize();
-                }
+                // Hide every webview (main + multi-window clones), not only "pake".
+                cancel_startup_reveal(&menu_revealed);
+                hide_all_app_windows(app);
             }
             "show_app" => {
-                if let Some(window) = app.get_webview_window("pake") {
-                    cancel_startup_reveal(&menu_revealed);
-                    let _ = window.show();
-                    reapply_window_icon(&window);
-                    #[cfg(target_os = "linux")]
-                    if _init_fullscreen && !window.is_fullscreen().unwrap_or(false) {
-                        let _ = window.set_fullscreen(true);
-                        let _ = window.set_focus();
-                    }
-                }
+                cancel_startup_reveal(&menu_revealed);
+                show_all_app_windows(app, _init_fullscreen);
             }
             "quit" => {
                 let flags = if _init_fullscreen {
@@ -82,24 +75,19 @@ pub fn set_system_tray(
             _ => (),
         })
         .on_tray_icon_event(move |tray, event| {
-            if let TrayIconEvent::Click { button, .. } = event {
-                if button == tauri::tray::MouseButton::Left {
-                    if let Some(window) = tray.app_handle().get_webview_window("pake") {
-                        // Any tray toggle claims visibility control from startup reveal.
-                        cancel_startup_reveal(&click_revealed);
-                        let is_visible = window.is_visible().unwrap_or(false);
-                        if is_visible {
-                            let _ = window.hide();
-                        } else {
-                            let _ = window.show();
-                            reapply_window_icon(&window);
-                            let _ = window.set_focus();
-                            #[cfg(target_os = "linux")]
-                            if _init_fullscreen && !window.is_fullscreen().unwrap_or(false) {
-                                let _ = window.set_fullscreen(true);
-                            }
-                        }
-                    }
+            if let TrayIconEvent::Click {
+                button,
+                button_state,
+                ..
+            } = event
+            {
+                // Windows emits Click twice per physical click (Down then Up).
+                // Reacting to both runs the toggle twice, so a hidden window is
+                // shown and immediately re-hidden and the tray looks dead (#1343).
+                if button == MouseButton::Left && button_state == MouseButtonState::Up {
+                    // Any tray toggle claims visibility control from startup reveal.
+                    cancel_startup_reveal(&click_revealed);
+                    toggle_all_app_windows(tray.app_handle(), _init_fullscreen);
                 }
             }
         });
@@ -159,21 +147,8 @@ pub fn set_global_shortcut(
                     *last_triggered = Instant::now();
 
                     if shortcut_hotkey.eq(event) {
-                        if let Some(window) = app.get_webview_window("pake") {
-                            cancel_startup_reveal(&startup_revealed);
-                            let is_visible = window.is_visible().unwrap_or(false);
-                            if is_visible {
-                                let _ = window.hide();
-                            } else {
-                                let _ = window.show();
-                                reapply_window_icon(&window);
-                                let _ = window.set_focus();
-                                #[cfg(target_os = "linux")]
-                                if _init_fullscreen && !window.is_fullscreen().unwrap_or(false) {
-                                    let _ = window.set_fullscreen(true);
-                                }
-                            }
-                        }
+                        cancel_startup_reveal(&startup_revealed);
+                        toggle_all_app_windows(app, _init_fullscreen);
                     }
                 }
             })

package/src-tauri/src/app/window.rs

@@ -5,6 +5,10 @@ use crate::util::{
 };
 #[cfg(target_os = "macos")]
 use dispatch::Queue;
+#[cfg(target_os = "macos")]
+use objc2::MainThreadMarker;
+#[cfg(target_os = "macos")]
+use objc2_web_kit::WKUserContentController;
 #[cfg(target_os = "windows")]
 use std::{os::windows::ffi::OsStrExt, ptr, sync::OnceLock};
 use std::{
@@ -28,6 +32,24 @@ use tauri::Theme;
 #[cfg(target_os = "macos")]
 use tauri::TitleBarStyle;
 
+#[cfg(target_os = "macos")]
+fn prepare_macos_new_window_configuration(features: &NewWindowFeatures) -> tauri::Result<()> {
+    let mtm = MainThreadMarker::new().ok_or_else(|| {
+        std::io::Error::other("macOS new-window configuration must run on the main thread")
+    })?;
+    // WebKit requires the exact target configuration it supplied to be used
+    // for the new page. Replace only the inherited content controller so Wry
+    // can register Pake's IPC handler and scripts once on the new webview.
+    let controller = unsafe { WKUserContentController::new(mtm) };
+    unsafe {
+        features
+            .opener()
+            .target_configuration
+            .setUserContentController(&controller);
+    }
+    Ok(())
+}
+
 #[cfg(target_os = "windows")]
 fn build_proxy_browser_arg(url: &Url) -> Option<String> {
     let host = url.host_str()?;
@@ -186,15 +208,21 @@ fn open_requested_window(
     Ok(window)
 }
 
+/// Open a multi-window clone of the home app. The window is built hidden and
+/// revealed on its first real page load (see `lib.rs` on_page_load) so Cmd+N
+/// does not flash an empty shell the way the main window used to.
 pub fn open_additional_window_safe(app: &AppHandle) {
     #[cfg(target_os = "windows")]
     {
         let app_handle = app.clone();
         std::thread::spawn(move || {
             if let Ok(window) = open_additional_window(&app_handle) {
-                let _ = window.show();
-                reapply_window_icon(&window);
-                let _ = window.set_focus();
+                // Fallback if PageLoadEvent::Finished never arrives.
+                let fallback = window.clone();
+                tauri::async_runtime::spawn(async move {
+                    tokio::time::sleep(tokio::time::Duration::from_millis(3_000)).await;
+                    reveal_built_window(&fallback);
+                });
             }
         });
     }
@@ -202,13 +230,79 @@ pub fn open_additional_window_safe(app: &AppHandle) {
     #[cfg(not(target_os = "windows"))]
     {
         if let Ok(window) = open_additional_window(app) {
-            let _ = window.show();
-            reapply_window_icon(&window);
-            let _ = window.set_focus();
+            let fallback = window.clone();
+            tauri::async_runtime::spawn(async move {
+                tokio::time::sleep(tokio::time::Duration::from_millis(3_000)).await;
+                reveal_built_window(&fallback);
+            });
         }
     }
 }
 
+/// Show a window that was built hidden once content is ready (or the fallback
+/// timer fires). No-ops when already visible so page-load and fallback can race.
+pub fn reveal_built_window(window: &WebviewWindow) {
+    if window.is_visible().unwrap_or(true) {
+        return;
+    }
+    let _ = window.show();
+    reapply_window_icon(window);
+    let _ = window.set_focus();
+}
+
+/// True when any Pake webview window is currently on screen.
+///
+/// A minimized window does not count. Windows keeps `IsWindowVisible` true while
+/// a window is iconic, and `hide_on_close` minimizes before hiding, so treating
+/// minimized as visible makes the tray toggle hide an already-invisible window
+/// instead of restoring it (#1343).
+pub fn any_app_window_visible(app: &AppHandle) -> bool {
+    app.webview_windows().values().any(|window| {
+        window.is_visible().unwrap_or(false) && !window.is_minimized().unwrap_or(false)
+    })
+}
+
+/// Hide every webview window (main + multi-window clones). Used by tray Hide
+/// and the activation shortcut so secondary windows are not left on screen.
+pub fn hide_all_app_windows(app: &AppHandle) {
+    for window in app.webview_windows().values() {
+        let _ = window.hide();
+    }
+}
+
+/// Show every webview window, reassert icons, and focus the main window.
+pub fn show_all_app_windows(app: &AppHandle, init_fullscreen: bool) {
+    let windows = app.webview_windows();
+    for window in windows.values() {
+        let _ = window.unminimize();
+        let _ = window.show();
+        reapply_window_icon(window);
+        #[cfg(target_os = "linux")]
+        if init_fullscreen && !window.is_fullscreen().unwrap_or(false) {
+            let _ = window.set_fullscreen(true);
+        }
+    }
+    #[cfg(not(target_os = "linux"))]
+    let _ = init_fullscreen;
+
+    if let Some(main) = windows.get("pake") {
+        let _ = main.set_focus();
+    } else if let Some(any) = windows.values().next() {
+        let _ = any.set_focus();
+    }
+}
+
+/// Tray-click / activation-shortcut toggle: hide all if anything is visible,
+/// otherwise show all. Cancels startup reveal when the caller has already done
+/// so; this helper only touches visibility.
+pub fn toggle_all_app_windows(app: &AppHandle, init_fullscreen: bool) {
+    if any_app_window_visible(app) {
+        hide_all_app_windows(app);
+    } else {
+        show_all_app_windows(app, init_fullscreen);
+    }
+}
+
 fn build_window_with_label(
     app: &AppHandle,
     config: &PakeConfig,
@@ -522,26 +616,10 @@ fn build_window(
     }
 
     if let Some(features) = new_window_features {
-        // Reuse only opener-provided position/size on macOS; sharing the opener
-        // WKWebViewConfiguration triggers duplicate WKScriptMessageHandler
-        // registrations on macOS 26+ and crashes the app (issue #1194).
         #[cfg(target_os = "macos")]
-        {
-            if let Some(position) = features.position() {
-                window_builder = window_builder.position(position.x, position.y);
-            }
-
-            if let Some(size) = features.size() {
-                window_builder = window_builder.inner_size(size.width, size.height);
-            }
+        prepare_macos_new_window_configuration(&features)?;
 
-            window_builder = window_builder.focused(true);
-        }
-
-        #[cfg(not(target_os = "macos"))]
-        {
-            window_builder = window_builder.window_features(features).focused(true);
-        }
+        window_builder = window_builder.window_features(features).focused(true);
     }
 
     // Capture webview-initiated downloads (blob:, data:, Content-Disposition,
@@ -553,7 +631,7 @@ fn build_window(
     // catching it here is independent of the page CSP and the IPC channel.
     {
         let download_handle = app.clone();
-        window_builder = window_builder.on_download(move |_webview, event| match event {
+        window_builder = window_builder.on_download(move |webview, event| match event {
             DownloadEvent::Requested { url, destination } => {
                 match download_handle.path().download_dir() {
                     Ok(download_dir) => {
@@ -585,7 +663,12 @@ fn build_window(
                 path: _,
                 success,
             } => {
-                if let Some(window) = download_handle.get_webview_window("pake") {
+                // Toast on the window that started the download (including
+                // secondary multi-window labels), not a hard-coded "pake".
+                let toast_window = download_handle
+                    .get_webview_window(webview.label())
+                    .or_else(|| download_handle.get_webview_window("pake"));
+                if let Some(window) = toast_window {
                     let message_type = if success {
                         MessageType::Success
                     } else {

package/src-tauri/src/inject/event.js

@@ -1,11 +1,35 @@
+// Prefer native webview navigation over page JS so Ctrl+R / [ / ] still work
+// on blank error shells (no JS context). Falls back to history/location when
+// the IPC bridge is unavailable.
+function nativeNavigate(action) {
+  const invoke = window.__TAURI__?.core?.invoke;
+  if (invoke) {
+    invoke("webview_navigate", { action }).catch(() => {
+      fallbackNavigate(action);
+    });
+    return;
+  }
+  fallbackNavigate(action);
+}
+
+function fallbackNavigate(action) {
+  if (action === "reload") {
+    window.location.reload();
+  } else if (action === "back") {
+    window.history.back();
+  } else if (action === "forward") {
+    window.history.forward();
+  }
+}
+
 const shortcuts = {
-  "[": () => window.history.back(),
-  "]": () => window.history.forward(),
+  "[": () => nativeNavigate("back"),
+  "]": () => nativeNavigate("forward"),
   "-": () => zoomOut(),
   "=": () => zoomIn(),
   "+": () => zoomIn(),
   0: () => setZoom("100%"),
-  r: () => window.location.reload(),
+  r: () => nativeNavigate("reload"),
   ArrowUp: () => scrollTo(0, 0),
   ArrowDown: () => scrollTo(0, document.body.scrollHeight),
 };
@@ -370,34 +394,12 @@ const DOWNLOADABLE_FILE_EXTENSIONS = {
     "apk",
     "ipa",
   ],
-  data: [
-    "json",
-    "xml",
-    "csv",
-    "sql",
-    "db",
-    "sqlite",
-    "yaml",
-    "yml",
-    "toml",
-    "ini",
-    "cfg",
-    "conf",
-    "log",
-  ],
-  code: [
-    "js",
-    "ts",
-    "jsx",
-    "tsx",
-    "css",
-    "scss",
-    "sass",
-    "less",
-    "sh",
-    "bat",
-    "ps1",
-  ],
+  // Navigable web formats (json/xml/js/css/html and friends) are intentionally
+  // omitted: documentation and SPA content negotiation often serve them as
+  // in-app pages. Real file downloads still match via the download attribute,
+  // ?download / ?attachment, or binary extensions below.
+  data: ["csv", "sql", "db", "sqlite"],
+  scripts: ["sh", "bat", "ps1"],
   fonts: ["ttf", "otf", "woff", "woff2", "eot"],
   design: ["ai", "psd", "sketch", "fig", "xd"],
   system: [
@@ -446,12 +448,12 @@ const PREVIEWABLE_MEDIA_EXTENSIONS = [
   "m4a",
 ];
 
-// Path fragments that often host real file downloads. Do not add broad static
-// asset roots such as "/assets/" or "/dist/": many SPAs use those as in-app
-// routes (e.g. MEXC /assets/future) and would be intercepted as downloads.
-// Extensionless links under these paths still match; prefer real extensions,
-// download attributes, or ?download / ?attachment query hints when possible.
-const DOWNLOAD_PATH_PATTERNS = ["/download/", "/files/", "/attachments/"];
+// Path fragments that often host real file downloads. Keep this list narrow:
+// SPA roots such as "/assets/", "/dist/", "/files/", "/releases/", and
+// "/attachments/" have already been mistaken for downloads in the wild.
+// Prefer real file extensions, the download attribute, or ?download /
+// ?attachment query hints whenever possible.
+const DOWNLOAD_PATH_PATTERNS = ["/download/"];
 
 // Language detection utilities
 function getUserLanguage() {
@@ -527,6 +529,52 @@ function isDownloadableFile(url) {
   }
 }
 
+// Public suffixes where the registrable domain needs more than two labels.
+// Not exhaustive; covers common packaging targets that last-two-label
+// matching would collapse incorrectly (e.g. amazon.co.uk vs evil.co.uk,
+// or every *.github.io site into one "domain").
+const MULTI_PART_PUBLIC_SUFFIXES = [
+  "co.uk",
+  "org.uk",
+  "ac.uk",
+  "gov.uk",
+  "com.au",
+  "net.au",
+  "org.au",
+  "co.jp",
+  "ne.jp",
+  "or.jp",
+  "co.kr",
+  "co.in",
+  "com.br",
+  "com.cn",
+  "com.tw",
+  "com.hk",
+  "com.sg",
+  "github.io",
+  "gitlab.io",
+  "pages.dev",
+];
+
+function getRootDomain(hostname) {
+  const normalized = String(hostname || "").toLowerCase();
+  if (!normalized) {
+    return "";
+  }
+
+  const parts = normalized.split(".").filter(Boolean);
+  if (parts.length <= 1) {
+    return normalized;
+  }
+
+  const lastTwo = parts.slice(-2).join(".");
+  if (MULTI_PART_PUBLIC_SUFFIXES.includes(lastTwo) && parts.length >= 3) {
+    return parts.slice(-3).join(".");
+  }
+
+  return lastTwo;
+}
+
 function normalizeAnchorHref(rawHref) {
   return typeof rawHref === "string" ? rawHref.trim() : "";
 }
@@ -660,8 +708,11 @@ document.addEventListener("DOMContentLoaded", () => {
   const isSpecialDownload = (url) =>
     ["blob", "data"].some((protocol) => url.startsWith(protocol));
 
-  const isDownloadRequired = (url, anchorElement, e) =>
-    anchorElement.download || e.metaKey || e.ctrlKey || isDownloadableFile(url);
+  // Cmd/Ctrl+click is a browser "open related" gesture, not "save as".
+  // Only the download attribute and downloadable-file heuristics force a
+  // download; modifiers must not rewrite ordinary navigation.
+  const isDownloadRequired = (url, anchorElement, _e) =>
+    Boolean(anchorElement.download) || isDownloadableFile(url);
 
   const handleExternalLink = (url) => {
     // Don't try to open blob: or data: URLs with shell
@@ -685,12 +736,8 @@ document.addEventListener("DOMContentLoaded", () => {
 
       if (linkUrl.hostname === currentUrl.hostname) return true;
 
-      // Extract root domain (e.g., bilibili.com from www.bilibili.com)
-      const getRootDomain = (hostname) => {
-        const parts = hostname.split(".");
-        return parts.length >= 2 ? parts.slice(-2).join(".") : hostname;
-      };
-
+      // e.g. www.bilibili.com and m.bilibili.com share bilibili.com;
+      // amazon.co.uk must not share a root with evil.co.uk.
       return (
         getRootDomain(currentUrl.hostname) === getRootDomain(linkUrl.hostname)
       );

package/src-tauri/src/lib.rs

@@ -28,10 +28,13 @@ const GDK_BACKEND: &str = "GDK_BACKEND";
 use app::{
     invoke::{
         clear_dock_badge, download_file, increment_dock_badge, send_notification, set_dock_badge,
-        set_dock_badge_label, set_zoom, update_theme_mode,
+        set_dock_badge_label, set_zoom, update_theme_mode, webview_navigate,
     },
     setup::{set_global_shortcut, set_system_tray},
-    window::{open_additional_window_safe, reapply_window_icon, set_window, MultiWindowState},
+    window::{
+        open_additional_window_safe, reapply_window_icon, reveal_built_window, set_window,
+        MultiWindowState,
+    },
 };
 use util::get_pake_config;
 
@@ -244,16 +247,14 @@ pub fn run_app() {
         ));
     }
 
-    // Reveal the main window after the first real document finishes loading so
+    // Reveal hidden windows after the first real document finishes loading so
     // slow WKWebView cold starts do not expose an empty but interactive shell.
-    // start_to_tray keeps the window hidden for the whole session until the user
-    // opens it from the tray / shortcut.
-    if !start_to_tray {
+    // - Main label "pake": once-only latch + start_to_tray opt-out.
+    // - Secondary multi-window labels ("pake-N"): reveal if still hidden (Cmd+N).
+    // start_to_tray keeps the main window hidden until the user opens it.
+    {
         let page_load_revealed = startup_window_revealed.clone();
         app_builder = app_builder.on_page_load(move |webview, payload| {
-            if webview.label() != "pake" {
-                return;
-            }
             if !matches!(payload.event(), PageLoadEvent::Finished) {
                 return;
             }
@@ -262,8 +263,24 @@ pub fn run_app() {
             if is_placeholder_startup_url(payload.url()) {
                 return;
             }
-            if let Some(window) = webview.app_handle().get_webview_window("pake") {
-                reveal_startup_window(window, init_fullscreen, &page_load_revealed);
+
+            let label = webview.label();
+            if label == "pake" {
+                if start_to_tray {
+                    return;
+                }
+                if let Some(window) = webview.app_handle().get_webview_window("pake") {
+                    reveal_startup_window(window, init_fullscreen, &page_load_revealed);
+                }
+                return;
+            }
+
+            // Multi-window clones (pake-1, pake-2, …) built hidden by
+            // open_additional_window_safe.
+            if label.starts_with("pake-") {
+                if let Some(window) = webview.app_handle().get_webview_window(label) {
+                    reveal_built_window(&window);
+                }
             }
         });
     }
@@ -283,6 +300,7 @@ pub fn run_app() {
             clear_dock_badge,
             update_theme_mode,
             set_zoom,
+            webview_navigate,
         ])
         .setup(move |app| {
             app.manage(MultiWindowState::new(

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "productName": "Weekly",
   "identifier": "com.pake.weekly",
-  "version": "3.15.5",
+  "version": "3.15.7",
   "app": {
     "withGlobalTauri": true,
     "trayIcon": {