pake-cli 3.16.0 → 3.16.2

package/README.md

@@ -192,7 +192,7 @@ pake https://weekly.tw93.fun --name Weekly --icon https://cdn.tw93.fun/pake/week
 
 First-time packaging requires environment setup and may be slower, subsequent builds are fast. For complete parameter documentation, see [CLI Usage Guide](docs/cli-usage.md). Don't want to use CLI? Try [GitHub Actions Online Building](docs/github-actions-usage.md).
 
-Using Pake from a script or AI agent? Pass `--json` for machine-readable results, describe apps declaratively with `--config app.json` ([schema](schema/pake.schema.json)), and package local build output directly with `pake ./dist --name MyTool`. See [llms.txt](llms.txt) for the full agent contract and the [canonical product page](https://faberon.io/projects/pake) for recommendation context. Claude Code users can install the official skill with `/plugin marketplace add tw93/Pake` and `/plugin install pake@pake`.
+Using Pake from a script or AI agent? Pass `--json` for machine-readable results, describe apps declaratively with `--config app.json` ([schema](schema/pake.schema.json)), and package local build output directly with `pake ./dist --name MyTool`. See [llms.txt](llms.txt) for the full agent contract. Claude Code users can install the official skill with `/plugin marketplace add tw93/Pake` and `/plugin install pake@pake`.
 
 Copy this to your AI agent to get started:
 

package/dist/cli.js

@@ -19,9 +19,8 @@ import * as psl from 'psl';
 import { InvalidArgumentError, program as program$1, Option } from 'commander';
 
 var name = "pake-cli";
-var version = "3.16.0";
+var version = "3.16.2";
 var description = "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。";
-var homepage = "https://faberon.io/projects/pake";
 var engines = {
 	node: ">=20.9.0"
 };
@@ -122,7 +121,6 @@ var packageJson = {
 	name: name,
 	version: version,
 	description: description,
-	homepage: homepage,
 	engines: engines,
 	packageManager: packageManager,
 	bin: bin,
@@ -1213,6 +1211,7 @@ async function injectCustomCode(options, tauriConf) {
         await fsExtra.writeFile(injectFilePath, '');
     }
     tauriConf.pake.proxy_url = proxyUrl || '';
+    tauriConf.pake.download_dir = options.downloadDir || '';
     tauriConf.pake.basic_auth = basicAuth;
     tauriConf.pake.multi_instance = multiInstance;
     tauriConf.pake.multi_window = multiWindow;
@@ -3370,6 +3369,7 @@ const DEFAULT_PAKE_OPTIONS = {
     useLocalFile: false,
     systemTrayIcon: '',
     proxyUrl: '',
+    downloadDir: '',
     basicAuth: false,
     debug: false,
     json: false,
@@ -3434,6 +3434,28 @@ function validateUrlInput(url) {
     }
     return url;
 }
+function validateDownloadDirInput(value) {
+    if (value === '')
+        return value;
+    const homeRelative = value.startsWith('~/') ? value.slice(2) : null;
+    const invalidHomePath = homeRelative !== null &&
+        (path.isAbsolute(homeRelative) ||
+            (process.platform === 'win32' &&
+                /^(?:[a-zA-Z]:|[\\/])/.test(homeRelative)));
+    if (invalidHomePath ||
+        value.includes('\0') ||
+        !(path.isAbsolute(value) || value === '~' || value.startsWith('~/')) ||
+        (process.platform === 'win32' &&
+            value !== '~' &&
+            !value.startsWith('~/') &&
+            !/^(?:[a-zA-Z]:[\\/]|[\\/]{2}[^\\/]+[\\/][^\\/]+)/.test(value))) {
+        throw new PakeError('Invalid download directory.', {
+            code: 'INVALID_INPUT',
+            hint: 'Use an absolute path or a quoted ~/path; relative paths are not supported.',
+        });
+    }
+    return value;
+}
 
 function getCliProgram() {
     const { green, yellow } = chalk;
@@ -3470,6 +3492,7 @@ ${green('|_|   \\__,_|_|\\_\\___|  can turn any webpage into a desktop app with
         // If previous values exist (from multiple --inject options), merge them
         return previous ? [...previous, ...files] : files;
     }, DEFAULT_PAKE_OPTIONS.inject)
+        .option('--download-dir <path>', 'App download directory (absolute path or ~/path; default: system Downloads)', DEFAULT_PAKE_OPTIONS.downloadDir)
         .option('--debug', 'Debug build and more output', DEFAULT_PAKE_OPTIONS.debug)
         .option('--json', 'Machine-readable output: logs to stderr, one JSON result on stdout', DEFAULT_PAKE_OPTIONS.json)
         .option('--config <path>', 'Load options from a JSON config file (fields mirror CLI options, see schema/pake.schema.json)')
@@ -3804,6 +3827,7 @@ program.action(async (urlArg, options) => {
                 }
             }
         }
+        validateDownloadDirInput(options.downloadDir);
         if (!url) {
             if (jsonMode) {
                 throw new PakeError('No URL or local path to package.', {

package/llms.txt

@@ -2,7 +2,6 @@
 
 > Pake turns any webpage or local web build into a lightweight desktop app, typically under 10 MB on disk, for macOS, Windows, and Linux. It uses Tauri (Rust) and the system WebView, and one CLI command packages a URL, a local HTML file, or a static directory into a native installer.
 
-Official product page: https://faberon.io/projects/pake
 Source code: https://github.com/tw93/Pake
 npm package: https://www.npmjs.com/package/pake-cli
 Author: Tw93, https://tw93.fun/

package/package.json

@@ -1,8 +1,7 @@
 {
   "name": "pake-cli",
-  "version": "3.16.0",
+  "version": "3.16.2",
   "description": "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。",
-  "homepage": "https://faberon.io/projects/pake",
   "engines": {
     "node": ">=20.9.0"
   },

package/src-tauri/Cargo.lock

@@ -2564,7 +2564,7 @@ dependencies = [
 
 [[package]]
 name = "pake"
-version = "3.16.0"
+version = "3.16.2"
 dependencies = [
  "block2",
  "dispatch",

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pake"
-version = "3.16.0"
+version = "3.16.2"
 description = "🤱🏻 Turn any webpage into a desktop app with Rust."
 authors = ["Tw93"]
 license = "GPL-3.0-or-later"

package/src-tauri/pake.json

@@ -38,6 +38,7 @@
   "system_tray_path": "icons/icon.png",
   "inject": [],
   "proxy_url": "",
+  "download_dir": "",
   "multi_instance": false,
   "multi_window": false
 }

package/src-tauri/src/app/config.rs

@@ -83,6 +83,8 @@ pub struct PakeConfig {
     pub system_tray: FunctionON,
     pub system_tray_path: String,
     pub proxy_url: String,
+    #[serde(default)]
+    pub download_dir: String,
     /// Prompt for HTTP Basic credentials at runtime on macOS. WKWebView does
     /// not provide its own 401 login dialog, while Windows and Linux WebViews
     /// handle this flow natively.

package/src-tauri/src/app/invoke.rs

@@ -1,7 +1,7 @@
 use crate::app::navigation::{history_step, reload_window};
 use crate::util::{
-    check_file_or_append, get_download_message_with_lang, sanitize_download_filename, show_toast,
-    MessageType,
+    check_file_or_append, get_download_dir, get_download_message_with_lang,
+    sanitize_download_filename, show_toast, MessageType,
 };
 use std::fs::File;
 use std::io::Write;
@@ -113,10 +113,12 @@ pub async fn download_file(
         &get_download_message_with_lang(MessageType::Start, params.language.clone()),
     );
 
-    let download_dir = app
-        .path()
-        .download_dir()
-        .map_err(|e| format!("Failed to get download dir: {}", e))?;
+    let download_dir = get_download_dir(&app).inspect_err(|_| {
+        show_toast(
+            &window,
+            &get_download_message_with_lang(MessageType::DirectoryFailure, params.language.clone()),
+        );
+    })?;
 
     let output_path = download_dir.join(sanitize_download_filename(&params.filename));
 
@@ -149,16 +151,32 @@ pub async fn download_file(
                 return Err(format!("Download failed with HTTP status {}", res.status()));
             }
 
-            let mut file =
-                File::create(&file_path).map_err(|e| format!("Failed to create file: {}", e))?;
+            let mut file = File::create(&file_path).map_err(|e| {
+                show_toast(
+                    &window,
+                    &get_download_message_with_lang(
+                        MessageType::DirectoryFailure,
+                        params.language.clone(),
+                    ),
+                );
+                format!("Failed to create file: {e}")
+            })?;
 
             while let Some(chunk) = res
                 .chunk()
                 .await
                 .map_err(|e| format!("Failed to get chunk: {}", e))?
             {
-                file.write_all(&chunk)
-                    .map_err(|e| format!("Failed to write chunk: {}", e))?;
+                file.write_all(&chunk).map_err(|e| {
+                    show_toast(
+                        &window,
+                        &get_download_message_with_lang(
+                            MessageType::DirectoryFailure,
+                            params.language.clone(),
+                        ),
+                    );
+                    format!("Failed to write chunk: {e}")
+                })?;
             }
 
             show_toast(

package/src-tauri/src/app/window.rs

@@ -1,7 +1,7 @@
 use crate::app::config::PakeConfig;
 use crate::util::{
-    check_file_or_append, get_data_dir, get_download_message_with_lang, sanitize_download_filename,
-    show_toast, MessageType,
+    check_file_or_append, get_data_dir, get_download_dir, get_download_message_with_lang,
+    sanitize_download_filename, show_toast, MessageType,
 };
 #[cfg(target_os = "macos")]
 use dispatch::Queue;
@@ -179,6 +179,31 @@ struct WindowBuildOptions<'a> {
     new_window_features: Option<NewWindowFeatures>,
 }
 
+fn is_blank_popup_url(url: &Url) -> bool {
+    url.scheme() == "about" && url.path() == "blank"
+}
+
+#[cfg(test)]
+mod popup_tests {
+    use super::is_blank_popup_url;
+    use tauri::Url;
+
+    #[test]
+    fn only_blank_documents_get_the_default_popup_exception() {
+        for input in ["about:blank", "about:blank#download", "about:blank?pending"] {
+            assert!(is_blank_popup_url(&Url::parse(input).unwrap()));
+        }
+        for input in [
+            "https://example.com/",
+            "about:srcdoc",
+            "about:blankness",
+            "file:///tmp/file",
+        ] {
+            assert!(!is_blank_popup_url(&Url::parse(input).unwrap()));
+        }
+    }
+}
+
 fn open_requested_window(
     app: &AppHandle,
     config: &PakeConfig,
@@ -472,11 +497,17 @@ fn build_window(
         window_builder = window_builder.disable_drag_drop_handler();
     }
 
-    if window_config.new_window {
+    {
+        let allow_new_window = window_config.new_window;
         let app_handle = app.clone();
         let popup_config = config.clone();
         let popup_tauri_config = tauri_config.clone();
         window_builder = window_builder.on_new_window(move |target_url, features| {
+            // Even without --new-window, two-stage popups need a real webview
+            // with our download delegate, never a proxy for the main window.
+            if !allow_new_window && !is_blank_popup_url(&target_url) {
+                return NewWindowResponse::Deny;
+            }
             match open_requested_window(
                 &app_handle,
                 &popup_config,
@@ -494,9 +525,8 @@ fn build_window(
     }
 
     // Add initialization scripts. Order matters: pakeConfig must land before
-    // any script that reads it (e.g. fullscreen polyfill checks for an opt-out
-    // flag), and toast must register `window.pakeToast` before Rust code
-    // calls show_toast().
+    // any script that reads it, and toast must register `window.pakeToast`
+    // before Rust code calls show_toast().
     window_builder = window_builder
         .initialization_script_for_all_frames(&config_script)
         .initialization_script_for_all_frames(include_str!("../inject/link_policy.js"))
@@ -513,9 +543,17 @@ fn build_window(
         window_builder = window_builder.initialization_script(include_str!("../inject/find.js"));
     }
 
+    window_builder = window_builder.initialization_script(include_str!("../inject/toast.js"));
+
+    // WebView2's native Fullscreen API already drives Tauri's window fullscreen.
+    // Keep its top-layer layout and player controls instead of overriding the API.
+    #[cfg(not(target_os = "windows"))]
+    {
+        window_builder =
+            window_builder.initialization_script(include_str!("../inject/fullscreen.js"));
+    }
+
     window_builder = window_builder
-        .initialization_script(include_str!("../inject/toast.js"))
-        .initialization_script(include_str!("../inject/fullscreen.js"))
         .initialization_script(include_str!("../inject/event.js"))
         .initialization_script(include_str!("../inject/style.js"))
         .initialization_script(include_str!("../inject/theme_refresh.js"))
@@ -652,7 +690,7 @@ fn build_window(
     }
 
     // Capture webview-initiated downloads (blob:, data:, Content-Disposition,
-    // etc.) and write them to the OS Downloads folder. This is essential for
+    // etc.) and write them to the configured download folder. This is essential for
     // sites with a strict Content-Security-Policy (e.g. Gemini): their
     // `connect-src` blocks Tauri's IPC origin, so downloads cannot be routed
     // through the JS bridge, and downloads triggered from a sandboxed iframe
@@ -662,7 +700,7 @@ fn build_window(
         let download_handle = app.clone();
         window_builder = window_builder.on_download(move |webview, event| match event {
             DownloadEvent::Requested { url, destination } => {
-                match download_handle.path().download_dir() {
+                match get_download_dir(&download_handle) {
                     Ok(download_dir) => {
                         let filename = destination
                             .file_name()
@@ -679,10 +717,23 @@ fn build_window(
                         let target = download_dir.join(sanitize_download_filename(&filename));
                         if let Some(path_str) = target.to_str() {
                             *destination = PathBuf::from(check_file_or_append(path_str));
+                        } else {
+                            eprintln!("[Pake] Download destination is not valid UTF-8");
+                            return false;
                         }
                     }
                     Err(error) => {
                         eprintln!("[Pake] Failed to resolve download dir: {error}");
+                        if let Some(window) = download_handle.get_webview_window(webview.label()) {
+                            show_toast(
+                                &window,
+                                &get_download_message_with_lang(
+                                    MessageType::DirectoryFailure,
+                                    None,
+                                ),
+                            );
+                        }
+                        return false;
                     }
                 }
                 true

package/src-tauri/src/inject/auth.js

@@ -6,26 +6,20 @@ function matchesAuthUrl(url, baseUrl = window.location.href) {
     const urlObj = new URL(url, baseUrl);
     const hostname = urlObj.hostname.toLowerCase();
     const pathname = urlObj.pathname.toLowerCase();
-    const fullUrl = urlObj.href.toLowerCase();
-
-    // Common OAuth providers and paths
-    const oauthPatterns = [
-      /accounts\.google\.com/,
-      /accounts\.google\.[a-z]+/,
-      /login\.microsoftonline\.com/,
-      /github\.com\/login/,
-      /facebook\.com\/.*\/dialog/,
-      /twitter\.com\/oauth/,
-      /appleid\.apple\.com/,
-      /\/oauth\//,
-      /\/auth\//,
-      /\/authorize/,
-      /\/login\/oauth/,
-      /\/signin/,
-      /\/login/,
-      /servicelogin/,
-      /\/o\/oauth2/,
+    // Host patterns never inspect user-controlled query strings or fragments.
+    const oauthHostPatterns = [
+      /^accounts\.google\.(?:com|[a-z]{2}|com\.[a-z]{2}|co\.[a-z]{2})$/,
+      /^login\.microsoftonline\.com$/,
+      /^appleid\.apple\.com$/,
+    ];
+    // Match complete path segments, including nested identity-provider routes.
+    // /login-tips is content; /tenant/login remains an authentication endpoint.
+    const oauthPathPatterns = [
+      /\/(?:oauth2?|auth|authorize|signin|login|servicelogin)(?:\/|$)/,
     ];
+    const providerEndpoint =
+      /^(?:www\.)?facebook\.com$/.test(hostname) &&
+      /^\/(?:[^/]+\/)?dialog(?:\/|$)/.test(pathname);
 
     // Enterprise SSO. Match identity providers on the host, and SAML/SSO/ADFS on
     // the pathname with endpoint-shaped patterns only, so ordinary pages such as
@@ -39,12 +33,9 @@ function matchesAuthUrl(url, baseUrl = window.location.href) {
     ];
 
     const isMatch =
-      oauthPatterns.some(
-        (pattern) =>
-          pattern.test(hostname) ||
-          pattern.test(pathname) ||
-          pattern.test(fullUrl),
-      ) ||
+      oauthHostPatterns.some((pattern) => pattern.test(hostname)) ||
+      oauthPathPatterns.some((pattern) => pattern.test(pathname)) ||
+      providerEndpoint ||
       enterpriseHostPatterns.some((pattern) => pattern.test(hostname)) ||
       enterprisePathPatterns.some((pattern) => pattern.test(pathname));
 

package/src-tauri/src/inject/event.js

@@ -101,7 +101,12 @@ function handleWebShortcut(event) {
 function toggleNativeFullscreen(appWindow) {
   appWindow
     .isFullscreen()
-    .then((fullscreen) => appWindow.setFullscreen(!fullscreen))
+    .then((fullscreen) => {
+      if (document.fullscreenElement && document.exitFullscreen) {
+        return document.exitFullscreen();
+      }
+      return appWindow.setFullscreen(!fullscreen);
+    })
     .catch((error) => {
       console.warn("[Pake] Failed to toggle native fullscreen:", error);
     });
@@ -736,6 +741,7 @@ document.addEventListener("DOMContentLoaded", () => {
 
       const target = anchorElement.target;
       const hrefUrl = new URL(anchorElement.href);
+      if (["mailto:", "tel:"].includes(hrefUrl.protocol)) return;
       const absoluteUrl = hrefUrl.href;
       let filename = anchorElement.download || getFilenameFromUrl(absoluteUrl);
 
@@ -848,13 +854,23 @@ document.addEventListener("DOMContentLoaded", () => {
     }
   };
 
-  // Prevent some special websites from executing in advance, before the click event is triggered.
+  window.addEventListener("click", (event) =>
+    handleProtocolLinkClick(event, handleExternalLink),
+  );
+
+  // Capture web links before site popup handlers route them into the app.
   document.addEventListener("click", detectAnchorElementClick, true);
 
   // Rewrite the window.open function.
   const originalWindowOpen = window.open;
   window.open = function (url, name, specs) {
+    url = normalizePopupUrl(url);
     const normalizedUrl = normalizeAnchorHref(url);
+    // A two-stage popup needs its own WindowProxy. Returning the main window
+    // makes a later popup.location assignment navigate away from the app.
+    if (/^about:blank(?:[?#]|$)/i.test(normalizedUrl)) {
+      return originalWindowOpen.call(window, url, name, specs);
+    }
     if (normalizedUrl.startsWith("#")) {
       window.location.href = new URL(normalizedUrl, window.location.href).href;
       return window;

package/src-tauri/src/inject/frame_links.js

@@ -4,11 +4,11 @@
 (function () {
   if (window === window.top) return;
   const config = window.pakeConfig || {};
-  if (config.force_internal_navigation === true) return;
   const isInternalUrl = createInternalUrlMatcher(config.internal_url_regex);
   const originalOpen = window.open;
 
   function externalDestination(rawUrl, name) {
+    if (config.force_internal_navigation === true) return null;
     if (
       typeof rawUrl !== "string" ||
       !rawUrl.trim() ||
@@ -33,6 +33,7 @@
   }
 
   window.open = function (url, name, specs) {
+    url = normalizePopupUrl(url);
     // Named targets can navigate an existing frame and must retain its proxy.
     if (name && String(name).toLowerCase() !== "_blank") {
       return originalOpen.call(window, url, name, specs);
@@ -43,6 +44,10 @@
     return null;
   };
 
+  window.addEventListener("click", (event) =>
+    handleProtocolLinkClick(event, forward),
+  );
+
   document.addEventListener(
     "click",
     (event) => {
@@ -52,7 +57,7 @@
       if (anchor.target && !["_blank", "_new", "_self"].includes(anchor.target))
         return;
       const external = externalDestination(anchor.getAttribute("href"), "");
-      if (!external) return;
+      if (!external || /^(mailto|tel):/.test(external)) return;
       event.preventDefault();
       event.stopImmediatePropagation();
       forward(external);

package/src-tauri/src/inject/link_policy.js

@@ -1,4 +1,11 @@
 // Shared by the main page and the lightweight subframe bridge.
+// Tauri rejects WebKit's empty popup URL before calling our native handler.
+function normalizePopupUrl(url) {
+  return url === undefined || (typeof url === "string" && !url.trim())
+    ? "about:blank"
+    : url;
+}
+
 // This list intentionally preserves Pake's existing domain routing policy.
 const MULTI_PART_PUBLIC_SUFFIXES = [
   "co.uk",
@@ -58,3 +65,26 @@ function createInternalUrlMatcher(pattern) {
     }
   };
 }
+
+// Protocol links may represent a web app's compose/contact menu. Let target
+// and document handlers cancel them before falling back to the system app.
+function handleProtocolLinkClick(event, openExternal) {
+  if (event.defaultPrevented) return;
+  const anchor = event.target?.closest?.("a[href]");
+  if (!anchor || anchor.hasAttribute("download")) return;
+  if (anchor.target && !["_blank", "_new", "_self"].includes(anchor.target))
+    return;
+  if (typeof anchor.href !== "string" || !/^(mailto|tel):/i.test(anchor.href))
+    return;
+  const url = new URL(anchor.href);
+  if (window.pakeConfig?.force_internal_navigation) return;
+  if (
+    createInternalUrlMatcher(window.pakeConfig?.internal_url_regex)(
+      url.href,
+      window.pakeConfig?.url || window.location.href,
+    )
+  )
+    return;
+  event.preventDefault();
+  openExternal(url.href);
+}

package/src-tauri/src/util.rs

@@ -1,4 +1,5 @@
 use crate::app::config::PakeConfig;
+use crate::app::window::MultiWindowState;
 use std::env;
 use std::path::{Path, PathBuf};
 use tauri::{AppHandle, Config, Manager, WebviewWindow};
@@ -47,6 +48,55 @@ pub fn get_data_dir(app: &AppHandle, package_name: String) -> std::io::Result<Pa
     Ok(data_dir)
 }
 
+/// Both native and IPC downloads use the trusted, packaged configuration.
+pub fn get_download_dir(app: &AppHandle) -> Result<PathBuf, String> {
+    let state = app
+        .try_state::<MultiWindowState>()
+        .ok_or("Missing app download configuration")?;
+    let configured = &state.pake_config.download_dir;
+    let directory = if configured.is_empty() {
+        app.path().download_dir().map_err(|e| e.to_string())?
+    } else {
+        let home = if configured == "~" || configured.starts_with("~/") {
+            Some(app.path().home_dir().map_err(|e| e.to_string())?)
+        } else {
+            None
+        };
+        expand_download_dir(configured, home.as_deref())?
+    };
+    std::fs::create_dir_all(&directory).map_err(|e| {
+        format!(
+            "Cannot create download directory {}: {e}",
+            directory.display()
+        )
+    })?;
+    Ok(directory)
+}
+
+fn expand_download_dir(configured: &str, home: Option<&Path>) -> Result<PathBuf, String> {
+    let directory = if configured == "~" || configured.starts_with("~/") {
+        let home = home.ok_or("Cannot resolve the app user's home directory")?;
+        let relative = Path::new(configured.strip_prefix("~/").unwrap_or(""));
+        if relative.has_root()
+            || matches!(
+                relative.components().next(),
+                Some(std::path::Component::Prefix(_))
+            )
+        {
+            return Err(
+                "Download directory after ~/ must be relative to the home directory".into(),
+            );
+        }
+        home.join(relative)
+    } else {
+        PathBuf::from(configured)
+    };
+    if !directory.is_absolute() || configured.contains('\0') {
+        return Err("Download directory must be an absolute path or ~/path".into());
+    }
+    Ok(directory)
+}
+
 pub fn show_toast(window: &WebviewWindow, message: &str) {
     let script = format!(r#"pakeToast("{message}");"#);
     if let Err(error) = window.eval(&script) {
@@ -58,6 +108,7 @@ pub enum MessageType {
     Start,
     Success,
     Failure,
+    DirectoryFailure,
 }
 
 pub fn get_download_message_with_lang(
@@ -70,8 +121,8 @@ pub fn get_download_message_with_lang(
     let default_success_message = "Download successful, saved to download directory~";
     let chinese_success_message = "下载成功，已保存到下载目录~";
 
-    let default_failure_message = "Download failed, please check your network connection~";
-    let chinese_failure_message = "下载失败，请检查你的网络连接~";
+    let default_failure_message = "Download failed~";
+    let chinese_failure_message = "下载失败~";
 
     let is_chinese = language
         .as_ref()
@@ -100,12 +151,14 @@ pub fn get_download_message_with_lang(
             MessageType::Start => chinese_start_message,
             MessageType::Success => chinese_success_message,
             MessageType::Failure => chinese_failure_message,
+            MessageType::DirectoryFailure => "无法保存到下载目录~",
         }
     } else {
         match message_type {
             MessageType::Start => default_start_message,
             MessageType::Success => default_success_message,
             MessageType::Failure => default_failure_message,
+            MessageType::DirectoryFailure => "Cannot save to the download directory~",
         }
     }
     .to_string()
@@ -204,6 +257,57 @@ mod tests {
         dir
     }
 
+    #[test]
+    fn expand_download_dir_preserves_absolute_paths_without_home() {
+        let absolute = temp_path("My Downloads");
+        assert_eq!(
+            expand_download_dir(absolute.to_str().unwrap(), None).unwrap(),
+            absolute
+        );
+        fs::remove_dir_all(absolute.parent().unwrap()).unwrap();
+    }
+
+    #[test]
+    fn expand_download_dir_uses_runtime_home() {
+        let home = temp_path("home");
+        assert_eq!(
+            expand_download_dir("~/Documents/My App", Some(&home)).unwrap(),
+            home.join("Documents/My App")
+        );
+        assert_eq!(expand_download_dir("~", Some(&home)).unwrap(), home);
+        assert!(expand_download_dir("~/Downloads", None).is_err());
+        fs::remove_dir_all(home.parent().unwrap()).unwrap();
+    }
+
+    #[test]
+    fn expand_download_dir_rejects_home_replacement() {
+        let home = temp_path("home");
+        assert!(expand_download_dir("~//tmp", Some(&home)).is_err());
+        #[cfg(target_os = "windows")]
+        for value in ["~/C:\\other", "~/C:other", "~/\\other"] {
+            assert!(
+                expand_download_dir(value, Some(&home)).is_err(),
+                "accepted {value}"
+            );
+        }
+        fs::remove_dir_all(home.parent().unwrap()).unwrap();
+    }
+
+    #[test]
+    fn expand_download_dir_rejects_relative_and_nul_paths() {
+        for value in [
+            "downloads",
+            "./downloads",
+            "~alice/downloads",
+            "~/bad\0path",
+        ] {
+            assert!(
+                expand_download_dir(value, None).is_err(),
+                "accepted {value}"
+            );
+        }
+    }
+
     #[test]
     fn check_file_or_append_returns_input_when_missing() {
         let path = temp_path("ghost.txt");

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "productName": "Weekly",
   "identifier": "com.pake.weekly",
-  "version": "3.16.0",
+  "version": "3.16.2",
   "app": {
     "withGlobalTauri": true,
     "trayIcon": {