pake-cli 3.15.6 → 3.16.0

package/src-tauri/src/app/window.rs

@@ -5,6 +5,10 @@ use crate::util::{
 };
 #[cfg(target_os = "macos")]
 use dispatch::Queue;
+#[cfg(target_os = "macos")]
+use objc2::MainThreadMarker;
+#[cfg(target_os = "macos")]
+use objc2_web_kit::WKUserContentController;
 #[cfg(target_os = "windows")]
 use std::{os::windows::ffi::OsStrExt, ptr, sync::OnceLock};
 use std::{
@@ -28,6 +32,24 @@ use tauri::Theme;
 #[cfg(target_os = "macos")]
 use tauri::TitleBarStyle;
 
+#[cfg(target_os = "macos")]
+fn prepare_macos_new_window_configuration(features: &NewWindowFeatures) -> tauri::Result<()> {
+    let mtm = MainThreadMarker::new().ok_or_else(|| {
+        std::io::Error::other("macOS new-window configuration must run on the main thread")
+    })?;
+    // WebKit requires the exact target configuration it supplied to be used
+    // for the new page. Replace only the inherited content controller so Wry
+    // can register Pake's IPC handler and scripts once on the new webview.
+    let controller = unsafe { WKUserContentController::new(mtm) };
+    unsafe {
+        features
+            .opener()
+            .target_configuration
+            .setUserContentController(&controller);
+    }
+    Ok(())
+}
+
 #[cfg(target_os = "windows")]
 fn build_proxy_browser_arg(url: &Url) -> Option<String> {
     let host = url.host_str()?;
@@ -340,6 +362,11 @@ fn build_window(
         visible,
         new_window_features,
     } = opts;
+    #[cfg(target_os = "macos")]
+    let use_native_window_tabbing = config.multi_window && new_window_features.is_none();
+    #[cfg(target_os = "macos")]
+    let prefer_native_window_tabbing = use_native_window_tabbing && label != "pake";
+
     let package_name = tauri_config
         .product_name
         .clone()
@@ -353,10 +380,13 @@ fn build_window(
         ))
     })?;
 
+    // On macOS both HTTP Basic auth and certificate bypass use the same
+    // navigation-delegate proxy. Start on a neutral page so the proxy is in
+    // place before the target can issue its first authentication challenge.
     #[cfg(target_os = "macos")]
-    let cert_bypass_target = if label == "pake"
-        && window_config.ignore_certificate_errors
+    let auth_target = if label == "pake"
         && window_config.url_type == "web"
+        && (config.basic_auth || window_config.ignore_certificate_errors)
     {
         Url::parse(&window_config.url).ok()
     } else {
@@ -366,7 +396,7 @@ fn build_window(
     // The delegate must be installed before the first TLS challenge. Start on
     // a neutral page, then navigate from the with_webview callback below.
     #[cfg(target_os = "macos")]
-    let url = if cert_bypass_target.is_some() {
+    let url = if auth_target.is_some() {
         WebviewUrl::CustomProtocol(
             Url::parse("about:blank").expect("about:blank must be a valid URL"),
         )
@@ -467,12 +497,18 @@ fn build_window(
     // any script that reads it (e.g. fullscreen polyfill checks for an opt-out
     // flag), and toast must register `window.pakeToast` before Rust code
     // calls show_toast().
-    window_builder = window_builder.initialization_script(&config_script);
+    window_builder = window_builder
+        .initialization_script_for_all_frames(&config_script)
+        .initialization_script_for_all_frames(include_str!("../inject/link_policy.js"))
+        .initialization_script_for_all_frames(include_str!("../inject/auth.js"))
+        .initialization_script_for_all_frames(include_str!("../inject/frame_links.js"));
 
     // find.js is opt-in via --enable-find and no-ops at runtime when disabled,
     // so only inject its ~700 lines when the feature is on. Avoids parsing the
     // find UI on every page load in the common (find-off) case. Matches the
     // enable_find gating already applied to the Find menu item.
+    window_builder = window_builder.initialization_script(include_str!("../inject/styles.js"));
+
     if window_config.enable_find {
         window_builder = window_builder.initialization_script(include_str!("../inject/find.js"));
     }
@@ -483,7 +519,6 @@ fn build_window(
         .initialization_script(include_str!("../inject/event.js"))
         .initialization_script(include_str!("../inject/style.js"))
         .initialization_script(include_str!("../inject/theme_refresh.js"))
-        .initialization_script(include_str!("../inject/auth.js"))
         .initialization_script(include_str!("../inject/custom.js"));
 
     #[cfg(target_os = "windows")]
@@ -545,6 +580,22 @@ fn build_window(
         };
         window_builder = window_builder.title_bar_style(title_bar_style);
         window_builder = window_builder.theme(theme);
+
+        // Tauri disables automatic tabbing unless an identifier is provided.
+        // Existing multi-window apps already have a stable bundle identifier,
+        // so use it without exposing another CLI/config option. Web-created
+        // popups keep their own native window.
+        if use_native_window_tabbing {
+            window_builder = window_builder
+                .tabbing_identifier(&tauri_config.identifier)
+                .on_document_title_changed(|window, title| {
+                    if !title.trim().is_empty() {
+                        if let Err(error) = window.set_title(&title) {
+                            eprintln!("[Pake] Failed to update the macOS tab title: {error}");
+                        }
+                    }
+                });
+        }
     }
 
     // Windows and Linux: set data_directory before proxy_url
@@ -594,26 +645,10 @@ fn build_window(
     }
 
     if let Some(features) = new_window_features {
-        // Reuse only opener-provided position/size on macOS; sharing the opener
-        // WKWebViewConfiguration triggers duplicate WKScriptMessageHandler
-        // registrations on macOS 26+ and crashes the app (issue #1194).
         #[cfg(target_os = "macos")]
-        {
-            if let Some(position) = features.position() {
-                window_builder = window_builder.position(position.x, position.y);
-            }
-
-            if let Some(size) = features.size() {
-                window_builder = window_builder.inner_size(size.width, size.height);
-            }
-
-            window_builder = window_builder.focused(true);
-        }
+        prepare_macos_new_window_configuration(&features)?;
 
-        #[cfg(not(target_os = "macos"))]
-        {
-            window_builder = window_builder.window_features(features).focused(true);
-        }
+        window_builder = window_builder.window_features(features).focused(true);
     }
 
     // Capture webview-initiated downloads (blob:, data:, Content-Disposition,
@@ -680,25 +715,51 @@ fn build_window(
 
     let window = window_builder.build()?;
 
-    // macOS WKWebView ignores the Chromium --ignore-certificate-errors flag, so
-    // install a host-scoped delegate on the process-lifetime main window only.
-    // Queue setup after construction so wry cannot replace the proxy while it
-    // finishes initializing its own navigation delegate.
+    // A shared identifier alone leaves each NSWindow in automatic mode.
+    // Prefer tabs only for Cmd+N clones so they join the main window's tab
+    // group. The main window stays bar-less until another tab exists, while
+    // web-auth and window.open popups remain separate native windows.
+    #[cfg(target_os = "macos")]
+    if prefer_native_window_tabbing {
+        let tabbing_window = window.clone();
+        Queue::main().exec_async(move || match tabbing_window.ns_window() {
+            Ok(ns_window_ptr) => unsafe {
+                let Some(ns_window) =
+                    objc2::rc::Retained::retain(ns_window_ptr as *mut objc2_app_kit::NSWindow)
+                else {
+                    eprintln!("[Pake] Failed to retain the macOS window for tabbing.");
+                    return;
+                };
+                ns_window.setTabbingMode(objc2_app_kit::NSWindowTabbingMode::Preferred);
+            },
+            Err(error) => {
+                eprintln!("[Pake] Failed to access the macOS window for tabbing: {error}");
+            }
+        });
+    }
+
+    // WKWebView does not show an HTTP Basic login dialog and ignores Chromium's
+    // certificate-error flag. Install one host-scoped delegate for both flows
+    // on the process-lifetime main window, then navigate to the real target.
     #[cfg(target_os = "macos")]
-    if let Some(target_url) = cert_bypass_target {
+    if let Some(target_url) = auth_target {
         let allowed_host = target_url
             .host_str()
             .expect("web URLs must have a host")
             .to_owned();
-        let cert_window = window.clone();
+        let prompt_for_basic_auth = config.basic_auth;
+        let allow_invalid_certificates = window_config.ignore_certificate_errors;
+        let auth_window = window.clone();
         Queue::main().exec_async(move || {
-            if let Err(error) = cert_window.with_webview(move |webview| {
-                if !crate::app::cert::install_cert_bypass_and_navigate(
+            if let Err(error) = auth_window.with_webview(move |webview| {
+                if !crate::app::auth::install_auth_delegate_and_navigate(
                     webview.inner(),
                     allowed_host,
                     target_url.to_string(),
+                    prompt_for_basic_auth,
+                    allow_invalid_certificates,
                 ) {
-                    eprintln!("[Pake] Failed to configure macOS certificate bypass.");
+                    eprintln!("[Pake] Failed to configure macOS authentication handling.");
                 }
             }) {
                 eprintln!("[Pake] Failed to access the macOS webview: {error}");

package/src-tauri/src/inject/event.js

@@ -529,52 +529,6 @@ function isDownloadableFile(url) {
   }
 }
 
-// Public suffixes where the registrable domain needs more than two labels.
-// Not exhaustive; covers common packaging targets that last-two-label
-// matching would collapse incorrectly (e.g. amazon.co.uk vs evil.co.uk,
-// or every *.github.io site into one "domain").
-const MULTI_PART_PUBLIC_SUFFIXES = [
-  "co.uk",
-  "org.uk",
-  "ac.uk",
-  "gov.uk",
-  "com.au",
-  "net.au",
-  "org.au",
-  "co.jp",
-  "ne.jp",
-  "or.jp",
-  "co.kr",
-  "co.in",
-  "com.br",
-  "com.cn",
-  "com.tw",
-  "com.hk",
-  "com.sg",
-  "github.io",
-  "gitlab.io",
-  "pages.dev",
-];
-
-function getRootDomain(hostname) {
-  const normalized = String(hostname || "").toLowerCase();
-  if (!normalized) {
-    return "";
-  }
-
-  const parts = normalized.split(".").filter(Boolean);
-  if (parts.length <= 1) {
-    return normalized;
-  }
-
-  const lastTwo = parts.slice(-2).join(".");
-  if (MULTI_PART_PUBLIC_SUFFIXES.includes(lastTwo) && parts.length >= 3) {
-    return parts.slice(-3).join(".");
-  }
-
-  return lastTwo;
-}
-
 function normalizeAnchorHref(rawHref) {
   return typeof rawHref === "string" ? rawHref.trim() : "";
 }
@@ -591,7 +545,10 @@ function shouldBypassPakeLinkHandling(rawHref) {
 }
 
 function shouldNavigateAuthInCurrentWindow() {
-  return /macintosh|mac os x/i.test(navigator.userAgent);
+  // WKWebView can abort on auth popups, while WebKitGTK may return a truthy
+  // proxy even when the native side denies the window. Keep those platforms
+  // in-place without changing the working WebView2 popup path on Windows.
+  return /mac|linux/i.test(getDesktopPlatform());
 }
 
 function canNavigateAuthUrl(url) {
@@ -639,21 +596,55 @@ function openAuthNavigation(originalWindowOpen, url, name, specs) {
   return authWindow;
 }
 
+// Install the receiver at document start: a subframe can open a link before
+// the main page's DOMContentLoaded routing setup has run.
+let openFrameLink = null;
+const pendingFrameLinks = [];
+function isDescendantFrame(source, parent = window) {
+  for (let index = 0; index < parent.frames.length; index++) {
+    const frame = parent.frames[index];
+    if (frame === source || isDescendantFrame(source, frame)) return true;
+  }
+  return false;
+}
+function routeFrameLink(source, href) {
+  try {
+    // Recheck on delivery because the frame may have been removed meanwhile.
+    if (!isDescendantFrame(source)) return;
+    const url = new URL(href);
+    if (!["http:", "https:", "mailto:", "tel:"].includes(url.protocol)) return;
+    if (openFrameLink) {
+      openFrameLink.call(window, url.href, "_blank");
+    } else {
+      pendingFrameLinks.push({ source, href: url.href });
+    }
+  } catch (error) {
+    console.error("[Pake] Failed to route frame link:", error);
+  }
+}
+window.addEventListener("message", (event) => {
+  if (
+    event.data?.type !== "pake:frame-external-link" ||
+    typeof event.data.url !== "string" ||
+    !event.source ||
+    event.source === window
+  )
+    return;
+  routeFrameLink(event.source, event.data.url);
+});
+window.addEventListener("pagehide", () => {
+  pendingFrameLinks.length = 0;
+});
+
 document.addEventListener("DOMContentLoaded", () => {
   const tauri = window.__TAURI__;
   const appWindow = tauri.window.getCurrentWindow();
   const invoke = tauri.core.invoke;
   const pakeConfig = window["pakeConfig"] || {};
   const forceInternalNavigation = pakeConfig.force_internal_navigation === true;
-  const internalUrlRegex = pakeConfig.internal_url_regex || "";
-  let internalUrlPattern = null;
-  if (internalUrlRegex) {
-    try {
-      internalUrlPattern = new RegExp(internalUrlRegex);
-    } catch (e) {
-      console.error("[Pake] Invalid internal_url_regex pattern:", e);
-    }
-  }
+  const matchesInternalUrl = createInternalUrlMatcher(
+    pakeConfig.internal_url_regex,
+  );
 
   if (!document.getElementById("pake-top-dom") && hasImmersiveHeader()) {
     const topDom = document.createElement("div");
@@ -728,39 +719,7 @@ document.addEventListener("DOMContentLoaded", () => {
     });
   };
 
-  // Check if URL belongs to the same domain (including subdomains)
-  const isSameDomain = (url) => {
-    try {
-      const linkUrl = new URL(url);
-      const currentUrl = new URL(window.location.href);
-
-      if (linkUrl.hostname === currentUrl.hostname) return true;
-
-      // e.g. www.bilibili.com and m.bilibili.com share bilibili.com;
-      // amazon.co.uk must not share a root with evil.co.uk.
-      return (
-        getRootDomain(currentUrl.hostname) === getRootDomain(linkUrl.hostname)
-      );
-    } catch (e) {
-      return false;
-    }
-  };
-
-  // Check if URL should be treated as internal based on regex pattern or domain
-  const isInternalUrl = (url) => {
-    // If regex pattern is configured, use it as the primary check
-    if (internalUrlPattern) {
-      try {
-        return internalUrlPattern.test(url);
-      } catch (e) {
-        console.error("[Pake] Error testing internal_url_regex:", e);
-        // Fall back to domain check on error
-        return isSameDomain(url);
-      }
-    }
-    // Default to domain-based check
-    return isSameDomain(url);
-  };
+  const isInternalUrl = (url) => matchesInternalUrl(url, window.location.href);
 
   const detectAnchorElementClick = (e) => {
     // Safety check: ensure e.target exists and is an Element with closest method
@@ -944,6 +903,23 @@ document.addEventListener("DOMContentLoaded", () => {
     }
   };
 
+  // The sender is untrusted even when it belongs to this webview. This bridge
+  // may only open external links, never navigate the top page or create auth
+  // windows on a sandboxed frame's behalf.
+  openFrameLink = (url) => {
+    if (
+      forceInternalNavigation ||
+      isInternalUrl(url) ||
+      window.isAuthLink(url)
+    ) {
+      return;
+    }
+    handleExternalLink(url);
+  };
+  for (const { source, href } of pendingFrameLinks.splice(0)) {
+    routeFrameLink(source, href);
+  }
+
   // Set the default zoom, There are problems with Loop without using try-catch.
   try {
     setDefaultZoom();

package/src-tauri/src/inject/find.js

@@ -199,9 +199,7 @@
       return;
     }
 
-    const style = document.createElement("style");
-    style.id = STYLE_ID;
-    style.textContent = `
+    const css = `
       #${PANEL_ID} {
         position: fixed;
         top: 14px;
@@ -312,9 +310,16 @@
       }
     `;
 
-    (document.head || document.body || document.documentElement)?.appendChild(
-      style,
-    );
+    if (typeof window.__PAKE_INJECT_STYLE__ === "function") {
+      window.__PAKE_INJECT_STYLE__(css, STYLE_ID);
+    } else {
+      const style = document.createElement("style");
+      style.id = STYLE_ID;
+      style.textContent = css;
+      (document.head || document.body || document.documentElement)?.appendChild(
+        style,
+      );
+    }
   }
 
   function createButton(label, title, onClick) {
@@ -522,29 +527,39 @@
   }
 
   function runSearch(query = state.query) {
+    clearTimeout(state.searchTimer);
     state.query = query;
-    clearHighlights();
+    // A full scan includes any pending page edits. Disconnect while replacing
+    // DOM marks so our own mutations cannot schedule another search.
+    stopObservingDocumentChanges();
+    try {
+      clearHighlights();
+
+      if (!query) {
+        state.matches = [];
+        state.activeIndex = -1;
+        state.truncated = false;
+        updateCounter();
+        return getState();
+      }
 
-    if (!query) {
-      state.matches = [];
-      state.activeIndex = -1;
-      state.truncated = false;
-      updateCounter();
-      return getState();
-    }
+      const result = collectMatches(query);
+      state.matches = result.matches;
+      state.truncated = result.truncated;
+      state.activeIndex = state.matches.length > 0 ? 0 : -1;
 
-    const result = collectMatches(query);
-    state.matches = result.matches;
-    state.truncated = result.truncated;
-    state.activeIndex = state.matches.length > 0 ? 0 : -1;
+      if (!applyCustomHighlights()) {
+        applyDomHighlights();
+      }
 
-    if (!applyCustomHighlights()) {
-      applyDomHighlights();
+      updateCounter();
+      scrollActiveIntoView();
+      return getState();
+    } finally {
+      if (state.isOpen) {
+        observeDocumentChanges();
+      }
     }
-
-    updateCounter();
-    scrollActiveIntoView();
-    return getState();
   }
 
   function debounceSearch(query) {

package/src-tauri/src/inject/frame_links.js

@@ -0,0 +1,62 @@
+// Subframes do not receive the main page's Tauri/event injection on WebKit.
+// Forward only known external destinations; native internal/auth/blank popup
+// behavior, including its WindowProxy return value, stays with the frame.
+(function () {
+  if (window === window.top) return;
+  const config = window.pakeConfig || {};
+  if (config.force_internal_navigation === true) return;
+  const isInternalUrl = createInternalUrlMatcher(config.internal_url_regex);
+  const originalOpen = window.open;
+
+  function externalDestination(rawUrl, name) {
+    if (
+      typeof rawUrl !== "string" ||
+      !rawUrl.trim() ||
+      rawUrl.trim().startsWith("#")
+    ) {
+      return null;
+    }
+    try {
+      const url = new URL(rawUrl, document.baseURI);
+      if (!["http:", "https:", "mailto:", "tel:"].includes(url.protocol))
+        return null;
+      if (window.isAuthPopup(url.href, name)) return null;
+      if (isInternalUrl(url.href, config.url)) return null;
+      return url.href;
+    } catch (error) {
+      return null;
+    }
+  }
+
+  function forward(url) {
+    window.top.postMessage({ type: "pake:frame-external-link", url }, "*");
+  }
+
+  window.open = function (url, name, specs) {
+    // Named targets can navigate an existing frame and must retain its proxy.
+    if (name && String(name).toLowerCase() !== "_blank") {
+      return originalOpen.call(window, url, name, specs);
+    }
+    const external = externalDestination(url, name);
+    if (!external) return originalOpen.call(window, url, name, specs);
+    forward(external);
+    return null;
+  };
+
+  document.addEventListener(
+    "click",
+    (event) => {
+      const anchor = event.target?.closest?.("a[href]");
+      if (!anchor || anchor.hasAttribute("download")) return;
+      // Named browsing contexts may be part of the page's own frame layout.
+      if (anchor.target && !["_blank", "_new", "_self"].includes(anchor.target))
+        return;
+      const external = externalDestination(anchor.getAttribute("href"), "");
+      if (!external) return;
+      event.preventDefault();
+      event.stopImmediatePropagation();
+      forward(external);
+    },
+    true,
+  );
+})();

package/src-tauri/src/inject/fullscreen.js

@@ -25,9 +25,7 @@
     let monitorId = null;
 
     if (!document.getElementById("pake-fullscreen-style")) {
-      const styleEl = document.createElement("style");
-      styleEl.id = "pake-fullscreen-style";
-      styleEl.textContent = `
+      const css = `
       body.pake-fullscreen-active {
         overflow: hidden !important;
       }
@@ -51,7 +49,14 @@
         object-fit: contain !important;
       }
     `;
-      document.head.appendChild(styleEl);
+      if (typeof window.__PAKE_INJECT_STYLE__ === "function") {
+        window.__PAKE_INJECT_STYLE__(css, "pake-fullscreen-style");
+      } else {
+        const styleEl = document.createElement("style");
+        styleEl.id = "pake-fullscreen-style";
+        styleEl.textContent = css;
+        document.head.appendChild(styleEl);
+      }
     }
 
     function startFullscreenMonitor() {

package/src-tauri/src/inject/link_policy.js

@@ -0,0 +1,60 @@
+// Shared by the main page and the lightweight subframe bridge.
+// This list intentionally preserves Pake's existing domain routing policy.
+const MULTI_PART_PUBLIC_SUFFIXES = [
+  "co.uk",
+  "org.uk",
+  "ac.uk",
+  "gov.uk",
+  "com.au",
+  "net.au",
+  "org.au",
+  "co.jp",
+  "ne.jp",
+  "or.jp",
+  "co.kr",
+  "co.in",
+  "com.br",
+  "com.cn",
+  "com.tw",
+  "com.hk",
+  "com.sg",
+  "github.io",
+  "gitlab.io",
+  "pages.dev",
+];
+
+function getRootDomain(hostname) {
+  const normalized = String(hostname || "").toLowerCase();
+  if (!normalized) return "";
+  const parts = normalized.split(".").filter(Boolean);
+  if (parts.length <= 1) return normalized;
+  const lastTwo = parts.slice(-2).join(".");
+  if (MULTI_PART_PUBLIC_SUFFIXES.includes(lastTwo) && parts.length >= 3) {
+    return parts.slice(-3).join(".");
+  }
+  return lastTwo;
+}
+
+function createInternalUrlMatcher(pattern) {
+  let regex = null;
+  if (pattern) {
+    try {
+      regex = new RegExp(pattern);
+    } catch (error) {
+      console.error("[Pake] Invalid internal_url_regex pattern:", error);
+    }
+  }
+  return (url, baseUrl) => {
+    if (regex) return regex.test(url);
+    try {
+      const target = new URL(url);
+      const current = new URL(baseUrl);
+      return (
+        target.hostname === current.hostname ||
+        getRootDomain(target.hostname) === getRootDomain(current.hostname)
+      );
+    } catch (error) {
+      return false;
+    }
+  };
+}