pake-cli 3.16.1 → 3.16.3

package/README.md

@@ -192,7 +192,7 @@ pake https://weekly.tw93.fun --name Weekly --icon https://cdn.tw93.fun/pake/week
 
 First-time packaging requires environment setup and may be slower, subsequent builds are fast. For complete parameter documentation, see [CLI Usage Guide](docs/cli-usage.md). Don't want to use CLI? Try [GitHub Actions Online Building](docs/github-actions-usage.md).
 
-Using Pake from a script or AI agent? Pass `--json` for machine-readable results, describe apps declaratively with `--config app.json` ([schema](schema/pake.schema.json)), and package local build output directly with `pake ./dist --name MyTool`. See [llms.txt](llms.txt) for the full agent contract and the [canonical product page](https://faberon.io/projects/pake) for recommendation context. Claude Code users can install the official skill with `/plugin marketplace add tw93/Pake` and `/plugin install pake@pake`.
+Using Pake from a script or AI agent? Pass `--json` for machine-readable results, describe apps declaratively with `--config app.json` ([schema](schema/pake.schema.json)), and package local build output directly with `pake ./dist --name MyTool`. See [llms.txt](llms.txt) for the full agent contract. Claude Code users can install the official skill with `/plugin marketplace add tw93/Pake` and `/plugin install pake@pake`.
 
 Copy this to your AI agent to get started:
 

package/dist/cli.js

@@ -19,9 +19,8 @@ import * as psl from 'psl';
 import { InvalidArgumentError, program as program$1, Option } from 'commander';
 
 var name = "pake-cli";
-var version = "3.16.1";
+var version = "3.16.3";
 var description = "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。";
-var homepage = "https://faberon.io/projects/pake";
 var engines = {
 	node: ">=20.9.0"
 };
@@ -122,7 +121,6 @@ var packageJson = {
 	name: name,
 	version: version,
 	description: description,
-	homepage: homepage,
 	engines: engines,
 	packageManager: packageManager,
 	bin: bin,
@@ -540,15 +538,8 @@ async function acquireBuildCache(targetDirectory) {
 async function enterBuildWorkspace() {
     const previousTarget = process.env.CARGO_TARGET_DIR;
     const targetDirectory = path.resolve(packageDirectory, previousTarget || 'src-tauri/target');
-    const release = await acquireBuildCache(targetDirectory);
-    let directory;
-    try {
-        directory = await createBuildWorkspace(packageDirectory);
-    }
-    catch (error) {
-        await release();
-        throw error;
-    }
+    const directory = await createBuildWorkspace(packageDirectory);
+    let release;
     setBuildDirectory(directory);
     process.env.CARGO_TARGET_DIR = targetDirectory;
     const leave = async () => {
@@ -569,7 +560,7 @@ async function enterBuildWorkspace() {
         }
         finally {
             try {
-                await release();
+                await release?.();
             }
             catch (error) {
                 logger.warn(`Could not release the compilation cache lock: ${String(error)}`);
@@ -580,7 +571,11 @@ async function enterBuildWorkspace() {
         await leave();
         throwIfBuildCancelled();
     }
-    return leave;
+    return Object.assign(leave, {
+        async lockCache() {
+            release = await acquireBuildCache(targetDirectory);
+        },
+    });
 }
 
 async function terminateBuildTree(pid) {
@@ -1213,6 +1208,7 @@ async function injectCustomCode(options, tauriConf) {
         await fsExtra.writeFile(injectFilePath, '');
     }
     tauriConf.pake.proxy_url = proxyUrl || '';
+    tauriConf.pake.download_dir = options.downloadDir || '';
     tauriConf.pake.basic_auth = basicAuth;
     tauriConf.pake.multi_instance = multiInstance;
     tauriConf.pake.multi_window = multiWindow;
@@ -1664,9 +1660,14 @@ class BaseBuilder {
         await shellExec({ executable: packageManager, args });
     }
     async buildAndCopy(url, target, logSuccess = true) {
-        const { name = 'pake-app' } = this.options;
+        await this.prepareBuild(url);
+        await this.runBuildCommand(this.getBuildCommand(await detectPackageManager()), target);
+        await this.copyBuildArtifacts(target, logSuccess);
+    }
+    async prepareBuild(url) {
         await mergeConfig(url, this.options, structuredClone(tauriConfig));
-        const packageManager = await detectPackageManager();
+    }
+    async runBuildCommand(buildCommand, target) {
         // Build app
         const buildSpinner = getSpinner('Building app...');
         buildSpinner.stop();
@@ -1685,7 +1686,6 @@ class BaseBuilder {
         if (isLinuxAppImage && !buildEnv.NO_STRIP && this.options.debug) {
             logger.warn('⚠ AppImage strip step can fail on glibc 2.38+; Pake will auto-retry with NO_STRIP=1.');
         }
-        const buildCommand = this.getBuildCommand(packageManager);
         const buildTimeout = getBuildTimeout();
         try {
             await shellExec(buildCommand, buildTimeout, resolveExecEnv());
@@ -1712,6 +1712,9 @@ class BaseBuilder {
                 throw retryError;
             }
         }
+    }
+    async copyBuildArtifacts(target, logSuccess = true) {
+        const { name = 'pake-app' } = this.options;
         // With --no-bundle there is no installer to copy; surface the raw
         // executable the build produced instead.
         if (this.options.bundle === false) {
@@ -2084,6 +2087,7 @@ class LinuxBuilder extends BaseBuilder {
     constructor(options) {
         super(options);
         this.currentBuildType = '';
+        this.compiled = false;
         const target = options.targets || 'deb';
         if (target.includes('-arm64')) {
             this.buildFormat = target.replace('-arm64', '');
@@ -2119,6 +2123,8 @@ class LinuxBuilder extends BaseBuilder {
         return `${name}_${version}_${arch}`;
     }
     async build(url) {
+        this.compiled = false;
+        this.currentBuildType = '';
         // --no-bundle: build the executable once with no per-format packaging loop.
         if (this.options.bundle === false) {
             await this.buildAndCopy(url, 'deb');
@@ -2129,6 +2135,13 @@ class LinuxBuilder extends BaseBuilder {
             throw new Error(`No valid Linux target in "${this.options.targets}". Valid targets: ${LINUX_TARGET_TYPES.join(', ')}.`);
         }
         const useTemporaryDebForZst = needsTemporaryDebForZst(targets);
+        if (targets.length > 1) {
+            await this.prepareBuild(url);
+            const command = this.getBuildCommand(await detectPackageManager());
+            command.args.push('--no-bundle');
+            await this.runBuildCommand(command, 'compile');
+            this.compiled = true;
+        }
         // With a single explicit target, fail fast. With multiple targets (the
         // distro-aware default, or an explicit comma list) keep building the rest
         // when one fails, so a usable installer is still produced, e.g. AppImage
@@ -2294,7 +2307,24 @@ post_remove() {
     // Override buildAndCopy to ensure currentBuildType is synced if called directly, though the loop above handles it most of the time.
     async buildAndCopy(url, target, logSuccess = true) {
         this.currentBuildType = target;
-        await super.buildAndCopy(url, target, logSuccess);
+        if (!this.compiled) {
+            await super.buildAndCopy(url, target, logSuccess);
+            return;
+        }
+        const packageManager = await detectPackageManager();
+        const args = ['run', 'tauri'];
+        if (packageManager === 'npm')
+            args.push('--');
+        args.push('bundle', '--config', path.join('src-tauri', '.pake', 'tauri.conf.json'));
+        args.push('--bundles', target, '--features', this.getBuildFeatures().join(','));
+        if (this.options.debug)
+            args.push('--debug');
+        if (this.options.debug || target === 'appimage' || process.env.PAKE_VERBOSE)
+            args.push('--verbose');
+        if (this.buildArch === 'arm64')
+            args.push('--target', this.getTauriTarget('arm64', 'linux'));
+        await this.runBuildCommand({ executable: packageManager, args }, target);
+        await this.copyBuildArtifacts(target, logSuccess);
     }
     getBuildCommand(packageManager = 'pnpm') {
         const configPath = path.join('src-tauri', '.pake', 'tauri.conf.json');
@@ -3370,6 +3400,7 @@ const DEFAULT_PAKE_OPTIONS = {
     useLocalFile: false,
     systemTrayIcon: '',
     proxyUrl: '',
+    downloadDir: '',
     basicAuth: false,
     debug: false,
     json: false,
@@ -3434,6 +3465,28 @@ function validateUrlInput(url) {
     }
     return url;
 }
+function validateDownloadDirInput(value) {
+    if (value === '')
+        return value;
+    const homeRelative = value.startsWith('~/') ? value.slice(2) : null;
+    const invalidHomePath = homeRelative !== null &&
+        (path.isAbsolute(homeRelative) ||
+            (process.platform === 'win32' &&
+                /^(?:[a-zA-Z]:|[\\/])/.test(homeRelative)));
+    if (invalidHomePath ||
+        value.includes('\0') ||
+        !(path.isAbsolute(value) || value === '~' || value.startsWith('~/')) ||
+        (process.platform === 'win32' &&
+            value !== '~' &&
+            !value.startsWith('~/') &&
+            !/^(?:[a-zA-Z]:[\\/]|[\\/]{2}[^\\/]+[\\/][^\\/]+)/.test(value))) {
+        throw new PakeError('Invalid download directory.', {
+            code: 'INVALID_INPUT',
+            hint: 'Use an absolute path or a quoted ~/path; relative paths are not supported.',
+        });
+    }
+    return value;
+}
 
 function getCliProgram() {
     const { green, yellow } = chalk;
@@ -3470,6 +3523,7 @@ ${green('|_|   \\__,_|_|\\_\\___|  can turn any webpage into a desktop app with
         // If previous values exist (from multiple --inject options), merge them
         return previous ? [...previous, ...files] : files;
     }, DEFAULT_PAKE_OPTIONS.inject)
+        .option('--download-dir <path>', 'App download directory (absolute path or ~/path; default: system Downloads)', DEFAULT_PAKE_OPTIONS.downloadDir)
         .option('--debug', 'Debug build and more output', DEFAULT_PAKE_OPTIONS.debug)
         .option('--json', 'Machine-readable output: logs to stderr, one JSON result on stdout', DEFAULT_PAKE_OPTIONS.json)
         .option('--config <path>', 'Load options from a JSON config file (fields mirror CLI options, see schema/pake.schema.json)')
@@ -3804,6 +3858,7 @@ program.action(async (urlArg, options) => {
                 }
             }
         }
+        validateDownloadDirInput(options.downloadDir);
         if (!url) {
             if (jsonMode) {
                 throw new PakeError('No URL or local path to package.', {
@@ -3823,7 +3878,8 @@ program.action(async (urlArg, options) => {
         }
         endCancellation = beginBuildCancellation();
         phase = 'prepare';
-        leaveWorkspace = await enterBuildWorkspace();
+        const workspace = await enterBuildWorkspace();
+        leaveWorkspace = workspace;
         phase = 'input';
         const appOptions = await handleOptions(options, url);
         throwIfBuildCancelled();
@@ -3833,6 +3889,8 @@ program.action(async (urlArg, options) => {
         await builder.prepare();
         throwIfBuildCancelled();
         phase = 'build';
+        await workspace.lockCache();
+        throwIfBuildCancelled();
         await builder.build(url);
         throwIfBuildCancelled();
         await leaveWorkspace();

package/llms.txt

@@ -2,7 +2,6 @@
 
 > Pake turns any webpage or local web build into a lightweight desktop app, typically under 10 MB on disk, for macOS, Windows, and Linux. It uses Tauri (Rust) and the system WebView, and one CLI command packages a URL, a local HTML file, or a static directory into a native installer.
 
-Official product page: https://faberon.io/projects/pake
 Source code: https://github.com/tw93/Pake
 npm package: https://www.npmjs.com/package/pake-cli
 Author: Tw93, https://tw93.fun/

package/package.json

@@ -1,8 +1,7 @@
 {
   "name": "pake-cli",
-  "version": "3.16.1",
+  "version": "3.16.3",
   "description": "🤱🏻 Turn any webpage into a desktop app with one command. 🤱🏻 一键打包网页生成轻量桌面应用。",
-  "homepage": "https://faberon.io/projects/pake",
   "engines": {
     "node": ">=20.9.0"
   },

package/src-tauri/Cargo.lock

@@ -2564,7 +2564,7 @@ dependencies = [
 
 [[package]]
 name = "pake"
-version = "3.16.1"
+version = "3.16.3"
 dependencies = [
  "block2",
  "dispatch",

package/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pake"
-version = "3.16.1"
+version = "3.16.3"
 description = "🤱🏻 Turn any webpage into a desktop app with Rust."
 authors = ["Tw93"]
 license = "GPL-3.0-or-later"

package/src-tauri/pake.json

@@ -38,6 +38,7 @@
   "system_tray_path": "icons/icon.png",
   "inject": [],
   "proxy_url": "",
+  "download_dir": "",
   "multi_instance": false,
   "multi_window": false
 }

package/src-tauri/src/app/config.rs

@@ -83,6 +83,8 @@ pub struct PakeConfig {
     pub system_tray: FunctionON,
     pub system_tray_path: String,
     pub proxy_url: String,
+    #[serde(default)]
+    pub download_dir: String,
     /// Prompt for HTTP Basic credentials at runtime on macOS. WKWebView does
     /// not provide its own 401 login dialog, while Windows and Linux WebViews
     /// handle this flow natively.

package/src-tauri/src/app/invoke.rs

@@ -1,7 +1,7 @@
 use crate::app::navigation::{history_step, reload_window};
 use crate::util::{
-    check_file_or_append, get_download_message_with_lang, sanitize_download_filename, show_toast,
-    MessageType,
+    check_file_or_append, get_download_dir, get_download_message_with_lang,
+    sanitize_download_filename, show_toast, MessageType,
 };
 use std::fs::File;
 use std::io::Write;
@@ -113,10 +113,12 @@ pub async fn download_file(
         &get_download_message_with_lang(MessageType::Start, params.language.clone()),
     );
 
-    let download_dir = app
-        .path()
-        .download_dir()
-        .map_err(|e| format!("Failed to get download dir: {}", e))?;
+    let download_dir = get_download_dir(&app).inspect_err(|_| {
+        show_toast(
+            &window,
+            &get_download_message_with_lang(MessageType::DirectoryFailure, params.language.clone()),
+        );
+    })?;
 
     let output_path = download_dir.join(sanitize_download_filename(&params.filename));
 
@@ -149,16 +151,32 @@ pub async fn download_file(
                 return Err(format!("Download failed with HTTP status {}", res.status()));
             }
 
-            let mut file =
-                File::create(&file_path).map_err(|e| format!("Failed to create file: {}", e))?;
+            let mut file = File::create(&file_path).map_err(|e| {
+                show_toast(
+                    &window,
+                    &get_download_message_with_lang(
+                        MessageType::DirectoryFailure,
+                        params.language.clone(),
+                    ),
+                );
+                format!("Failed to create file: {e}")
+            })?;
 
             while let Some(chunk) = res
                 .chunk()
                 .await
                 .map_err(|e| format!("Failed to get chunk: {}", e))?
             {
-                file.write_all(&chunk)
-                    .map_err(|e| format!("Failed to write chunk: {}", e))?;
+                file.write_all(&chunk).map_err(|e| {
+                    show_toast(
+                        &window,
+                        &get_download_message_with_lang(
+                            MessageType::DirectoryFailure,
+                            params.language.clone(),
+                        ),
+                    );
+                    format!("Failed to write chunk: {e}")
+                })?;
             }
 
             show_toast(

package/src-tauri/src/app/window.rs

@@ -1,7 +1,7 @@
 use crate::app::config::PakeConfig;
 use crate::util::{
-    check_file_or_append, get_data_dir, get_download_message_with_lang, sanitize_download_filename,
-    show_toast, MessageType,
+    check_file_or_append, get_data_dir, get_download_dir, get_download_message_with_lang,
+    sanitize_download_filename, show_toast, MessageType,
 };
 #[cfg(target_os = "macos")]
 use dispatch::Queue;
@@ -179,6 +179,31 @@ struct WindowBuildOptions<'a> {
     new_window_features: Option<NewWindowFeatures>,
 }
 
+fn is_blank_popup_url(url: &Url) -> bool {
+    url.scheme() == "about" && url.path() == "blank"
+}
+
+#[cfg(test)]
+mod popup_tests {
+    use super::is_blank_popup_url;
+    use tauri::Url;
+
+    #[test]
+    fn only_blank_documents_get_the_default_popup_exception() {
+        for input in ["about:blank", "about:blank#download", "about:blank?pending"] {
+            assert!(is_blank_popup_url(&Url::parse(input).unwrap()));
+        }
+        for input in [
+            "https://example.com/",
+            "about:srcdoc",
+            "about:blankness",
+            "file:///tmp/file",
+        ] {
+            assert!(!is_blank_popup_url(&Url::parse(input).unwrap()));
+        }
+    }
+}
+
 fn open_requested_window(
     app: &AppHandle,
     config: &PakeConfig,
@@ -472,11 +497,17 @@ fn build_window(
         window_builder = window_builder.disable_drag_drop_handler();
     }
 
-    if window_config.new_window {
+    {
+        let allow_new_window = window_config.new_window;
         let app_handle = app.clone();
         let popup_config = config.clone();
         let popup_tauri_config = tauri_config.clone();
         window_builder = window_builder.on_new_window(move |target_url, features| {
+            // Even without --new-window, two-stage popups need a real webview
+            // with our download delegate, never a proxy for the main window.
+            if !allow_new_window && !is_blank_popup_url(&target_url) {
+                return NewWindowResponse::Deny;
+            }
             match open_requested_window(
                 &app_handle,
                 &popup_config,
@@ -494,9 +525,8 @@ fn build_window(
     }
 
     // Add initialization scripts. Order matters: pakeConfig must land before
-    // any script that reads it (e.g. fullscreen polyfill checks for an opt-out
-    // flag), and toast must register `window.pakeToast` before Rust code
-    // calls show_toast().
+    // any script that reads it, and toast must register `window.pakeToast`
+    // before Rust code calls show_toast().
     window_builder = window_builder
         .initialization_script_for_all_frames(&config_script)
         .initialization_script_for_all_frames(include_str!("../inject/link_policy.js"))
@@ -513,9 +543,17 @@ fn build_window(
         window_builder = window_builder.initialization_script(include_str!("../inject/find.js"));
     }
 
+    window_builder = window_builder.initialization_script(include_str!("../inject/toast.js"));
+
+    // WebView2's native Fullscreen API already drives Tauri's window fullscreen.
+    // Keep its top-layer layout and player controls instead of overriding the API.
+    #[cfg(not(target_os = "windows"))]
+    {
+        window_builder =
+            window_builder.initialization_script(include_str!("../inject/fullscreen.js"));
+    }
+
     window_builder = window_builder
-        .initialization_script(include_str!("../inject/toast.js"))
-        .initialization_script(include_str!("../inject/fullscreen.js"))
         .initialization_script(include_str!("../inject/event.js"))
         .initialization_script(include_str!("../inject/style.js"))
         .initialization_script(include_str!("../inject/theme_refresh.js"))
@@ -652,7 +690,7 @@ fn build_window(
     }
 
     // Capture webview-initiated downloads (blob:, data:, Content-Disposition,
-    // etc.) and write them to the OS Downloads folder. This is essential for
+    // etc.) and write them to the configured download folder. This is essential for
     // sites with a strict Content-Security-Policy (e.g. Gemini): their
     // `connect-src` blocks Tauri's IPC origin, so downloads cannot be routed
     // through the JS bridge, and downloads triggered from a sandboxed iframe
@@ -662,7 +700,7 @@ fn build_window(
         let download_handle = app.clone();
         window_builder = window_builder.on_download(move |webview, event| match event {
             DownloadEvent::Requested { url, destination } => {
-                match download_handle.path().download_dir() {
+                match get_download_dir(&download_handle) {
                     Ok(download_dir) => {
                         let filename = destination
                             .file_name()
@@ -679,10 +717,23 @@ fn build_window(
                         let target = download_dir.join(sanitize_download_filename(&filename));
                         if let Some(path_str) = target.to_str() {
                             *destination = PathBuf::from(check_file_or_append(path_str));
+                        } else {
+                            eprintln!("[Pake] Download destination is not valid UTF-8");
+                            return false;
                         }
                     }
                     Err(error) => {
                         eprintln!("[Pake] Failed to resolve download dir: {error}");
+                        if let Some(window) = download_handle.get_webview_window(webview.label()) {
+                            show_toast(
+                                &window,
+                                &get_download_message_with_lang(
+                                    MessageType::DirectoryFailure,
+                                    None,
+                                ),
+                            );
+                        }
+                        return false;
                     }
                 }
                 true

package/src-tauri/src/inject/auth.js

@@ -6,26 +6,20 @@ function matchesAuthUrl(url, baseUrl = window.location.href) {
     const urlObj = new URL(url, baseUrl);
     const hostname = urlObj.hostname.toLowerCase();
     const pathname = urlObj.pathname.toLowerCase();
-    const fullUrl = urlObj.href.toLowerCase();
-
-    // Common OAuth providers and paths
-    const oauthPatterns = [
-      /accounts\.google\.com/,
-      /accounts\.google\.[a-z]+/,
-      /login\.microsoftonline\.com/,
-      /github\.com\/login/,
-      /facebook\.com\/.*\/dialog/,
-      /twitter\.com\/oauth/,
-      /appleid\.apple\.com/,
-      /\/oauth\//,
-      /\/auth\//,
-      /\/authorize/,
-      /\/login\/oauth/,
-      /\/signin/,
-      /\/login/,
-      /servicelogin/,
-      /\/o\/oauth2/,
+    // Host patterns never inspect user-controlled query strings or fragments.
+    const oauthHostPatterns = [
+      /^accounts\.google\.(?:com|[a-z]{2}|com\.[a-z]{2}|co\.[a-z]{2})$/,
+      /^login\.microsoftonline\.com$/,
+      /^appleid\.apple\.com$/,
+    ];
+    // Match complete path segments, including nested identity-provider routes.
+    // /login-tips is content; /tenant/login remains an authentication endpoint.
+    const oauthPathPatterns = [
+      /\/(?:oauth2?|auth|authorize|signin|login|servicelogin)(?:\/|$)/,
     ];
+    const providerEndpoint =
+      /^(?:www\.)?facebook\.com$/.test(hostname) &&
+      /^\/(?:[^/]+\/)?dialog(?:\/|$)/.test(pathname);
 
     // Enterprise SSO. Match identity providers on the host, and SAML/SSO/ADFS on
     // the pathname with endpoint-shaped patterns only, so ordinary pages such as
@@ -39,12 +33,9 @@ function matchesAuthUrl(url, baseUrl = window.location.href) {
     ];
 
     const isMatch =
-      oauthPatterns.some(
-        (pattern) =>
-          pattern.test(hostname) ||
-          pattern.test(pathname) ||
-          pattern.test(fullUrl),
-      ) ||
+      oauthHostPatterns.some((pattern) => pattern.test(hostname)) ||
+      oauthPathPatterns.some((pattern) => pattern.test(pathname)) ||
+      providerEndpoint ||
       enterpriseHostPatterns.some((pattern) => pattern.test(hostname)) ||
       enterprisePathPatterns.some((pattern) => pattern.test(pathname));
 

package/src-tauri/src/inject/event.js

@@ -101,7 +101,12 @@ function handleWebShortcut(event) {
 function toggleNativeFullscreen(appWindow) {
   appWindow
     .isFullscreen()
-    .then((fullscreen) => appWindow.setFullscreen(!fullscreen))
+    .then((fullscreen) => {
+      if (document.fullscreenElement && document.exitFullscreen) {
+        return document.exitFullscreen();
+      }
+      return appWindow.setFullscreen(!fullscreen);
+    })
     .catch((error) => {
       console.warn("[Pake] Failed to toggle native fullscreen:", error);
     });
@@ -859,7 +864,13 @@ document.addEventListener("DOMContentLoaded", () => {
   // Rewrite the window.open function.
   const originalWindowOpen = window.open;
   window.open = function (url, name, specs) {
+    url = normalizePopupUrl(url);
     const normalizedUrl = normalizeAnchorHref(url);
+    // A two-stage popup needs its own WindowProxy. Returning the main window
+    // makes a later popup.location assignment navigate away from the app.
+    if (/^about:blank(?:[?#]|$)/i.test(normalizedUrl)) {
+      return originalWindowOpen.call(window, url, name, specs);
+    }
     if (normalizedUrl.startsWith("#")) {
       window.location.href = new URL(normalizedUrl, window.location.href).href;
       return window;

package/src-tauri/src/inject/frame_links.js

@@ -4,11 +4,11 @@
 (function () {
   if (window === window.top) return;
   const config = window.pakeConfig || {};
-  if (config.force_internal_navigation === true) return;
   const isInternalUrl = createInternalUrlMatcher(config.internal_url_regex);
   const originalOpen = window.open;
 
   function externalDestination(rawUrl, name) {
+    if (config.force_internal_navigation === true) return null;
     if (
       typeof rawUrl !== "string" ||
       !rawUrl.trim() ||
@@ -33,6 +33,7 @@
   }
 
   window.open = function (url, name, specs) {
+    url = normalizePopupUrl(url);
     // Named targets can navigate an existing frame and must retain its proxy.
     if (name && String(name).toLowerCase() !== "_blank") {
       return originalOpen.call(window, url, name, specs);

package/src-tauri/src/inject/link_policy.js

@@ -1,4 +1,11 @@
 // Shared by the main page and the lightweight subframe bridge.
+// Tauri rejects WebKit's empty popup URL before calling our native handler.
+function normalizePopupUrl(url) {
+  return url === undefined || (typeof url === "string" && !url.trim())
+    ? "about:blank"
+    : url;
+}
+
 // This list intentionally preserves Pake's existing domain routing policy.
 const MULTI_PART_PUBLIC_SUFFIXES = [
   "co.uk",

package/src-tauri/src/util.rs

@@ -1,4 +1,5 @@
 use crate::app::config::PakeConfig;
+use crate::app::window::MultiWindowState;
 use std::env;
 use std::path::{Path, PathBuf};
 use tauri::{AppHandle, Config, Manager, WebviewWindow};
@@ -47,6 +48,55 @@ pub fn get_data_dir(app: &AppHandle, package_name: String) -> std::io::Result<Pa
     Ok(data_dir)
 }
 
+/// Both native and IPC downloads use the trusted, packaged configuration.
+pub fn get_download_dir(app: &AppHandle) -> Result<PathBuf, String> {
+    let state = app
+        .try_state::<MultiWindowState>()
+        .ok_or("Missing app download configuration")?;
+    let configured = &state.pake_config.download_dir;
+    let directory = if configured.is_empty() {
+        app.path().download_dir().map_err(|e| e.to_string())?
+    } else {
+        let home = if configured == "~" || configured.starts_with("~/") {
+            Some(app.path().home_dir().map_err(|e| e.to_string())?)
+        } else {
+            None
+        };
+        expand_download_dir(configured, home.as_deref())?
+    };
+    std::fs::create_dir_all(&directory).map_err(|e| {
+        format!(
+            "Cannot create download directory {}: {e}",
+            directory.display()
+        )
+    })?;
+    Ok(directory)
+}
+
+fn expand_download_dir(configured: &str, home: Option<&Path>) -> Result<PathBuf, String> {
+    let directory = if configured == "~" || configured.starts_with("~/") {
+        let home = home.ok_or("Cannot resolve the app user's home directory")?;
+        let relative = Path::new(configured.strip_prefix("~/").unwrap_or(""));
+        if relative.has_root()
+            || matches!(
+                relative.components().next(),
+                Some(std::path::Component::Prefix(_))
+            )
+        {
+            return Err(
+                "Download directory after ~/ must be relative to the home directory".into(),
+            );
+        }
+        home.join(relative)
+    } else {
+        PathBuf::from(configured)
+    };
+    if !directory.is_absolute() || configured.contains('\0') {
+        return Err("Download directory must be an absolute path or ~/path".into());
+    }
+    Ok(directory)
+}
+
 pub fn show_toast(window: &WebviewWindow, message: &str) {
     let script = format!(r#"pakeToast("{message}");"#);
     if let Err(error) = window.eval(&script) {
@@ -58,6 +108,7 @@ pub enum MessageType {
     Start,
     Success,
     Failure,
+    DirectoryFailure,
 }
 
 pub fn get_download_message_with_lang(
@@ -70,8 +121,8 @@ pub fn get_download_message_with_lang(
     let default_success_message = "Download successful, saved to download directory~";
     let chinese_success_message = "下载成功，已保存到下载目录~";
 
-    let default_failure_message = "Download failed, please check your network connection~";
-    let chinese_failure_message = "下载失败，请检查你的网络连接~";
+    let default_failure_message = "Download failed~";
+    let chinese_failure_message = "下载失败~";
 
     let is_chinese = language
         .as_ref()
@@ -100,12 +151,14 @@ pub fn get_download_message_with_lang(
             MessageType::Start => chinese_start_message,
             MessageType::Success => chinese_success_message,
             MessageType::Failure => chinese_failure_message,
+            MessageType::DirectoryFailure => "无法保存到下载目录~",
         }
     } else {
         match message_type {
             MessageType::Start => default_start_message,
             MessageType::Success => default_success_message,
             MessageType::Failure => default_failure_message,
+            MessageType::DirectoryFailure => "Cannot save to the download directory~",
         }
     }
     .to_string()
@@ -204,6 +257,57 @@ mod tests {
         dir
     }
 
+    #[test]
+    fn expand_download_dir_preserves_absolute_paths_without_home() {
+        let absolute = temp_path("My Downloads");
+        assert_eq!(
+            expand_download_dir(absolute.to_str().unwrap(), None).unwrap(),
+            absolute
+        );
+        fs::remove_dir_all(absolute.parent().unwrap()).unwrap();
+    }
+
+    #[test]
+    fn expand_download_dir_uses_runtime_home() {
+        let home = temp_path("home");
+        assert_eq!(
+            expand_download_dir("~/Documents/My App", Some(&home)).unwrap(),
+            home.join("Documents/My App")
+        );
+        assert_eq!(expand_download_dir("~", Some(&home)).unwrap(), home);
+        assert!(expand_download_dir("~/Downloads", None).is_err());
+        fs::remove_dir_all(home.parent().unwrap()).unwrap();
+    }
+
+    #[test]
+    fn expand_download_dir_rejects_home_replacement() {
+        let home = temp_path("home");
+        assert!(expand_download_dir("~//tmp", Some(&home)).is_err());
+        #[cfg(target_os = "windows")]
+        for value in ["~/C:\\other", "~/C:other", "~/\\other"] {
+            assert!(
+                expand_download_dir(value, Some(&home)).is_err(),
+                "accepted {value}"
+            );
+        }
+        fs::remove_dir_all(home.parent().unwrap()).unwrap();
+    }
+
+    #[test]
+    fn expand_download_dir_rejects_relative_and_nul_paths() {
+        for value in [
+            "downloads",
+            "./downloads",
+            "~alice/downloads",
+            "~/bad\0path",
+        ] {
+            assert!(
+                expand_download_dir(value, None).is_err(),
+                "accepted {value}"
+            );
+        }
+    }
+
     #[test]
     fn check_file_or_append_returns_input_when_missing() {
         let path = temp_path("ghost.txt");

package/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "productName": "Weekly",
   "identifier": "com.pake.weekly",
-  "version": "3.16.1",
+  "version": "3.16.3",
   "app": {
     "withGlobalTauri": true,
     "trayIcon": {