stupidpythonbrowser 1.0.4__py3-none-any.whl → 1.1.0__py3-none-any.whl

pybrowser/browser.py

@@ -39,7 +39,7 @@ from pybrowser.settings import (
     sanitize_for_json
 )
 from pybrowser.doh_server import (
-    DNS_CACHE, DNS_LOCK, STEVENBLACK_DOMAINS, BASE_ADBLOCK_DOMAINS, ADBLOCK_LOCK,
+    DNS_CACHE, DNS_LOCK, STEVENBLACK_DOMAINS, ADBLOCK_LOCK,
     WK_RULE_LIST, is_domain_blocked, search_blocked_domains, load_dns_cache,
     start_proxy_server, create_nw_proxy_config, load_adblock_filters_from_disk,
     compile_webkit_adblock_rules, update_adblock_filters_from_web,
@@ -210,18 +210,27 @@ try:
     SecKeychainFindGenericPassword = sec.SecKeychainFindGenericPassword
     SecKeychainFindGenericPassword.argtypes = [c_void_p, c_uint32, c_char_p, c_uint32, c_char_p, POINTER(c_uint32), POINTER(c_void_p), POINTER(c_void_p)]
     SecKeychainItemFreeContent = sec.SecKeychainItemFreeContent
+    SecKeychainItemFreeContent.argtypes = [c_void_p, c_void_p]
     SecKeychainItemDelete = sec.SecKeychainItemDelete
     SecKeychainItemDelete.argtypes = [c_void_p]
+    
+    cf = ctypes.cdll.LoadLibrary("/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation")
+    CFRelease = cf.CFRelease
+    CFRelease.argtypes = [c_void_p]
 except Exception:
-    pass
+    CFRelease = None
 
 def save_to_keychain(host, username, password):
     try:
         srv, acc, pwd = host.encode('utf-8'), username.encode('utf-8'), password.encode('utf-8')
         length, data_ptr, item_ref = c_uint32(), c_void_p(), c_void_p()
         if SecKeychainFindGenericPassword(None, len(srv), srv, len(acc), acc, byref(length), byref(data_ptr), byref(item_ref)) == 0:
-            if data_ptr.value: SecKeychainItemFreeContent(None, data_ptr)
-            if item_ref.value: SecKeychainItemDelete(item_ref.value)
+            if data_ptr.value:
+                SecKeychainItemFreeContent(None, data_ptr.value)
+            if item_ref.value:
+                SecKeychainItemDelete(item_ref.value)
+            elif item_ref.value and CFRelease:
+                CFRelease(item_ref.value)
         SecKeychainAddGenericPassword(None, len(srv), srv, len(acc), acc, len(pwd), pwd, None)
     except Exception:
         pass
@@ -232,12 +241,14 @@ def get_from_keychain(host, username):
         length, data_ptr, item_ref = c_uint32(), c_void_p(), c_void_p()
         if SecKeychainFindGenericPassword(None, len(srv), srv, len(acc), acc, byref(length), byref(data_ptr), byref(item_ref)) == 0:
             pwd = string_at(data_ptr.value, length.value).decode('utf-8')
-            SecKeychainItemFreeContent(None, data_ptr)
+            if data_ptr.value:
+                SecKeychainItemFreeContent(None, data_ptr.value)
+            if item_ref.value and CFRelease:
+                CFRelease(item_ref.value)
             return pwd
     except Exception:
         pass
     return None
-
 # ============================================================================
 # USERSCRIPTS & EXTENSIONS (CRX)
 # ============================================================================
@@ -361,7 +372,7 @@ def init_history_db():
         print(f"[History DB Error] {e}")
 
 def record_history(url, title):
-    if not url or url.startswith("browser://"):
+    if not url or url.startswith("browser://") or url.startswith("about:"):
         return
     try:
         with sqlite3.connect(HISTORY_FILE) as conn:
@@ -867,6 +878,7 @@ class ChromeTabView(Cocoa.NSView):
                         if target_idx != self.index:
                             from_idx = self.index
                             self.controller.move_tab(from_idx, target_idx)
+                            self.index = target_idx
                             self.drag_start = cur_pt
                             break
 
@@ -1016,22 +1028,26 @@ class DownloadDelegate(Cocoa.NSObject):
         handler(Foundation.NSURL.fileURLWithPath_(dest_path))
 
     def downloadDidFinish_(self, download):
-        if hasattr(download, "progress") and download.progress():
+        ctrl = self.controller
+        if ctrl and hasattr(download, "progress") and download.progress():
             try:
-                download.progress().removeObserver_forKeyPath_(self.controller, "fractionCompleted")
+                download.progress().removeObserver_forKeyPath_(ctrl, "fractionCompleted")
             except Exception:
                 pass
         path = self.dest_paths.pop(download, None)
-        self.controller.finish_download(download, "Completed", dl_path=path)
+        if ctrl:
+            ctrl.finish_download(download, "Completed", dl_path=path)
 
     def download_didFailWithError_resumeData_(self, download, error, resumeData):
-        if hasattr(download, "progress") and download.progress():
+        ctrl = self.controller
+        if ctrl and hasattr(download, "progress") and download.progress():
             try:
-                download.progress().removeObserver_forKeyPath_(self.controller, "fractionCompleted")
+                download.progress().removeObserver_forKeyPath_(ctrl, "fractionCompleted")
             except Exception:
                 pass
         path = self.dest_paths.pop(download, None)
-        self.controller.finish_download(download, "Failed", dl_path=path)
+        if ctrl:
+            ctrl.finish_download(download, "Failed", dl_path=path)
 
 # ============================================================================
 # SCHEME HANDLER
@@ -1151,11 +1167,11 @@ term.onData(d => {{
         window.webkit.messageHandlers.terminalInput.postMessage(d);
     }}
 }});
-
+const termDecoder = new TextDecoder();
 window.writeToTerm = b => {{
     const s = atob(b), u = new Uint8Array(s.length);
     for (let i = 0; i < s.length; i++) u[i] = s.charCodeAt(i);
-    term.write(new TextDecoder().decode(u));
+    term.write(termDecoder.decode(u, {{ stream: true }}));
 }};
 </script></body></html>"""
 
@@ -1171,34 +1187,55 @@ window.writeToTerm = b => {{
         for b in bms:
             if isinstance(b, dict) and b.get("url"):
                 u = b["url"]
-                # Bug 16 Fix: Guard title against None
                 t = b.get("title") or u or ""
                 safe_u = json.dumps(u)
                 esc_u = html.escape(u)
                 esc_t = html.escape(t)
                 host = urllib.parse.urlparse(u).netloc
                 fav_tag = f"<img src='https://www.google.com/s2/favicons?domain={urllib.parse.quote(host)}&sz=32' width='16' height='16' style='vertical-align:middle;margin-right:8px;border-radius:3px;' onerror=\"this.style.display='none'\">" if host else ""
-                del_call = f"if(window.webkit?.messageHandlers?.bridge) window.webkit.messageHandlers.bridge.postMessage({{cmd: 'delete_bookmark', url: {safe_u}}}); setTimeout(() => location.reload(), 100);"
-                items.append(f"<li style='display:flex;align-items:center;padding:6px 0;'><span style='flex:1;display:flex;align-items:center;'>{fav_tag}<a href='{esc_u}' style='color:#1a73e8;text-decoration:none;'>{esc_t}</a></span> <button onclick='{del_call}' style='margin-left:12px;padding:3px 8px;'>Delete</button></li>")
+                items.append(f"<li style='display:flex;align-items:center;padding:6px 0;'><span style='flex:1;display:flex;align-items:center;'>{fav_tag}<a href='{esc_u}' style='color:#1a73e8;text-decoration:none;'>{esc_t}</a></span> <button onclick='deleteBm({safe_u})' style='margin-left:12px;padding:3px 8px;'>Delete</button></li>")
         rows = "".join(items)
-        return f"<!DOCTYPE html><html><body style='font-family:-apple-system,sans-serif;padding:30px;'><h2>Bookmarks</h2><div style='margin-bottom:15px;'><input id='t' placeholder='Title' style='padding:4px 8px;margin-right:8px;'><input id='u' placeholder='https://...' style='padding:4px 8px;margin-right:8px;width:260px;'><button onclick='if(window.webkit?.messageHandlers?.bridge) window.webkit.messageHandlers.bridge.postMessage({{cmd:\"add_bookmark\",title:document.getElementById(\"t\").value,url:document.getElementById(\"u\").value}});setTimeout(()=>location.reload(),100)' style='padding:4px 12px;'>Add</button></div><ul style='list-style:none;padding:0;'>{rows or '<li>No bookmarks</li>'}</ul></body></html>"
+        return f"""<!DOCTYPE html><html><head><meta charset='utf-8'><script>
+function deleteBm(url) {{
+    if (window.webkit?.messageHandlers?.bridge) {{
+        window.webkit.messageHandlers.bridge.postMessage({{cmd: 'delete_bookmark', url: url}});
+    }}
+    setTimeout(() => location.reload(), 100);
+}}
+function addBm() {{
+    const t = document.getElementById('t').value;
+    const u = document.getElementById('u').value;
+    if (u && window.webkit?.messageHandlers?.bridge) {{
+        window.webkit.messageHandlers.bridge.postMessage({{cmd: 'add_bookmark', title: t, url: u}});
+    }}
+    setTimeout(() => location.reload(), 100);
+}}
+</script></head><body style='font-family:-apple-system,sans-serif;padding:30px;'><h2>Bookmarks</h2><div style='margin-bottom:15px;'><input id='t' placeholder='Title' style='padding:4px 8px;margin-right:8px;'><input id='u' placeholder='https://...' style='padding:4px 8px;margin-right:8px;width:260px;'><button onclick='addBm()' style='padding:4px 12px;'>Add</button></div><ul style='list-style:none;padding:0;'>{rows or '<li>No bookmarks</li>'}</ul></body></html>"""
 
     def get_history_html(self):
         records = query_history()
         items = []
         for r in records:
-            del_call = f"if(window.webkit?.messageHandlers?.bridge) window.webkit.messageHandlers.bridge.postMessage({{cmd: 'delete_history_item', id: {r[0]}}}); this.closest('tr').remove();"
-            # Bug 16 Fix: Guard title against None and avoid backslashes inside f-string expressions
             title_text = r[2] or r[1] or ""
             url_str = r[1] or ""
             esc_url = html.escape(url_str)
             esc_title = html.escape(title_text)
-            items.append(f"<tr><td>{r[3]}</td><td><a href='{esc_url}'>{esc_title}</a></td><td><button onclick='{del_call}'>✕</button></td></tr>")
+            items.append(f"<tr><td>{r[3]}</td><td><a href='{esc_url}'>{esc_title}</a></td><td><button onclick='deleteHist({r[0]}, this)'>✕</button></td></tr>")
         rows = "".join(items)
-        return f"<!DOCTYPE html><html><body style='font-family:-apple-system,sans-serif;padding:30px;'><h2>History</h2><button onclick=\"if(window.webkit?.messageHandlers?.bridge) window.webkit.messageHandlers.bridge.postMessage({{cmd:'clear_browsing_data',targets:['history']}});setTimeout(()=>location.reload(),100)\">Clear All</button><table style='width:100%;margin-top:15px;'>{rows or '<tr><td>No history</td></tr>'}</table></body></html>"
-
-    def get_downloads_html(self):
-        return "<!DOCTYPE html><html><body style='font-family:-apple-system,sans-serif;padding:30px;'><h2>Downloads</h2><div id='dl-list'>No active downloads.</div><script>const dls={};window.updateDownload=(id,name,path,status,progress)=>{dls[id]={name,path,status,progress};render()};function render(){const el=document.getElementById('dl-list');el.innerHTML=Object.values(dls).map(d=>`<div style='border:1px solid #ccc;padding:10px;margin-bottom:8px;'><b>${d.name}</b> (${d.status}) <button onclick=\"if(window.webkit?.messageHandlers?.bridge) window.webkit.messageHandlers.bridge.postMessage({cmd:'dl_show',path:d.path})\">Show in Finder</button></div>`).join('')};if(window.webkit?.messageHandlers?.bridge) window.webkit.messageHandlers.bridge.postMessage({cmd:'dl_request_sync'});</script></body></html>"
+        return f"""<!DOCTYPE html><html><head><meta charset='utf-8'><script>
+function deleteHist(id, btn) {{
+    if (window.webkit?.messageHandlers?.bridge) {{
+        window.webkit.messageHandlers.bridge.postMessage({{cmd: 'delete_history_item', id: id}});
+    }}
+    btn.closest('tr')?.remove();
+}}
+function clearAllHist() {{
+    if (window.webkit?.messageHandlers?.bridge) {{
+        window.webkit.messageHandlers.bridge.postMessage({{cmd: 'clear_browsing_data', targets: ['history']}});
+    }}
+    setTimeout(() => location.reload(), 100);
+}}
+</script></head><body style='font-family:-apple-system,sans-serif;padding:30px;'><h2>History</h2><button onclick='clearAllHist()'>Clear All</button><table style='width:100%;margin-top:15px;'>{rows or '<tr><td>No history</td></tr>'}</table></body></html>"""
 
     def get_extensions_html(self):
         scripts = get_installed_userscripts()
@@ -1207,17 +1244,35 @@ window.writeToTerm = b => {{
             f = s["file"]
             safe_f = json.dumps(f)
             checked = "checked" if s["enabled"] else ""
-            toggle_call = f"if(window.webkit?.messageHandlers?.bridge) window.webkit.messageHandlers.bridge.postMessage({{cmd: 'toggle_script', file: {safe_f}, enabled: this.checked}})"
-            del_call = f"if(confirm('Delete?')){{if(window.webkit?.messageHandlers?.bridge) window.webkit.messageHandlers.bridge.postMessage({{cmd: 'delete_script', file: {safe_f}}}); setTimeout(() => location.reload(), 100);}}"
             items.append(
                 f"<div style='border:1px solid #ccc;padding:10px;margin-bottom:8px;'>"
                 f"<b>{html.escape(s['name'])}</b> ({html.escape(f)}) "
-                f"<label><input type='checkbox' {checked} onchange='{toggle_call}'> Enabled</label> "
-                f"<button onclick=\"{del_call}\">Delete</button>"
+                f"<label><input type='checkbox' {checked} onchange='toggleScript({safe_f}, this.checked)'> Enabled</label> "
+                f"<button onclick='deleteScript({safe_f})'>Delete</button>"
                 f"</div>"
             )
         rows = "".join(items)
-        return f"<!DOCTYPE html><html><body style='font-family:-apple-system,sans-serif;padding:30px;'><h2>Extensions & Userscripts</h2><button onclick='let id=prompt(\"CRX ID or URL:\");if(id && window.webkit?.messageHandlers?.bridge)window.webkit.messageHandlers.bridge.postMessage({{cmd:\"install_crx\",id:id}})'>Install CRX</button><div style='margin-top:15px;'>{rows or 'No userscripts installed.'}</div></body></html>"
+        return f"""<!DOCTYPE html><html><head><meta charset='utf-8'><script>
+function toggleScript(file, enabled) {{
+    if (window.webkit?.messageHandlers?.bridge) {{
+        window.webkit.messageHandlers.bridge.postMessage({{cmd: 'toggle_script', file: file, enabled: enabled}});
+    }}
+}}
+function deleteScript(file) {{
+    if (confirm('Delete this userscript?')) {{
+        if (window.webkit?.messageHandlers?.bridge) {{
+            window.webkit.messageHandlers.bridge.postMessage({{cmd: 'delete_script', file: file}});
+        }}
+        setTimeout(() => location.reload(), 100);
+    }}
+}}
+function installCrxPrompt() {{
+    const id = prompt('CRX Extension ID or URL:');
+    if (id && window.webkit?.messageHandlers?.bridge) {{
+        window.webkit.messageHandlers.bridge.postMessage({{cmd: 'install_crx', id: id}});
+    }}
+}}
+</script></head><body style='font-family:-apple-system,sans-serif;padding:30px;'><h2>Extensions & Userscripts</h2><button onclick='installCrxPrompt()'>Install CRX</button><div style='margin-top:15px;'>{rows or 'No userscripts installed.'}</div></body></html>"""
 
 # ============================================================================
 # WEBKIT SUBCLASS & IMAGE CONTEXT MENU
@@ -1421,9 +1476,11 @@ class OmniboxPanelCoordinator:
         for h in query_history(query_str)[:4]:
             results.append({"type": "history", "text": h[2] or h[1] or "", "url": h[1]})
 
+        # Show local suggestions immediately without waiting for remote network I/O
+        self.show(results)
+
         def fetch_remote():
             try:
-                # Secured endpoint via HTTPS to avoid keystroke sniffing
                 url = f"https://suggestqueries.google.com/complete/search?client=chrome&q={urllib.parse.quote(query_str)}"
                 req = urllib.request.Request(url, headers={"User-Agent": UA_PRESETS["chrome_mac"]})
                 with urllib.request.urlopen(req, timeout=1.0) as resp:
@@ -1432,8 +1489,7 @@ class OmniboxPanelCoordinator:
                     if req_id == self.current_req_id:
                         dispatch_to_main(lambda: self.show(results + remote))
             except Exception:
-                if req_id == self.current_req_id:
-                    dispatch_to_main(lambda: self.show(results))
+                pass
 
         threading.Thread(target=fetch_remote, daemon=True).start()
 
@@ -1477,8 +1533,9 @@ class OmniboxPanelCoordinator:
 
     def hide(self):
         if self.suggestion_window and self.suggestion_window.isVisible():
-            if self.suggestion_window.parentWindow():
-                self.wc.window().removeChildWindow_(self.suggestion_window)
+            parent = self.suggestion_window.parentWindow()
+            if parent:
+                parent.removeChildWindow_(self.suggestion_window)
             self.suggestion_window.orderOut_(None)
 
     def select_suggestion(self, sugg):
@@ -1876,9 +1933,16 @@ class BrowserWindowController(Cocoa.NSWindowController):
     def save_session(self):
         if self.is_incognito:
             return
+        valid_tabs = [
+            {"url": t.get("url"), "group_id": t.get("group_id"), "pinned": t.get("pinned", False)}
+            for t in self.tabs
+            if t.get("url") and not t.get("url").startswith("browser://") and not t.get("url").startswith("about:")
+        ]
+        if not valid_tabs and os.path.exists(SESSION_FILE):
+            return
         data = {
-            "active_index": self.active_tab_index,
-            "tabs": [{"url": t.get("url"), "group_id": t.get("group_id"), "pinned": t.get("pinned", False)} for t in self.tabs if t.get("url") and not t.get("url").startswith("browser://")],
+            "active_index": max(0, min(self.active_tab_index, len(valid_tabs) - 1)) if valid_tabs else 0,
+            "tabs": valid_tabs,
             "groups": [asdict(g) for g in self.groups]
         }
         atomic_write_json(SESSION_FILE, data)
@@ -2169,7 +2233,22 @@ class BrowserWindowController(Cocoa.NSWindowController):
         uc.addUserScript_(WebKit.WKUserScript.alloc().initWithSource_injectionTime_forMainFrameOnly_(IN_WINDOW_FULLSCREEN_JS, WebKit.WKUserScriptInjectionTimeAtDocumentEnd, False))
 
         if SETTINGS.settings.get("cosmetic_adblock_enabled", True):
-            cosmetic_js = "(function() { const st = document.createElement('style'); st.id = '__pybrowser_cosmetic_adblock'; st.textContent = `" + COSMETIC_ADBLOCK_CSS + "`; (document.head || document.documentElement).appendChild(st); })();"
+            cosmetic_js = """(function() {
+                function inject() {
+                    const target = document.head || document.documentElement;
+                    if (target && !document.getElementById('__pybrowser_cosmetic_adblock')) {
+                        const st = document.createElement('style');
+                        st.id = '__pybrowser_cosmetic_adblock';
+                        st.textContent = `""" + COSMETIC_ADBLOCK_CSS + """`;
+                        target.appendChild(st);
+                        return true;
+                    }
+                    return false;
+                }
+                if (!inject()) {
+                    document.addEventListener('DOMContentLoaded', inject);
+                }
+            })();"""
             uc.addUserScript_(WebKit.WKUserScript.alloc().initWithSource_injectionTime_forMainFrameOnly_(cosmetic_js, WebKit.WKUserScriptInjectionTimeAtDocumentStart, False))
 
         if SETTINGS.settings.get("yt_adblock_enabled", True):
@@ -2899,25 +2978,31 @@ class BrowserWindowController(Cocoa.NSWindowController):
             if cid:
                 threading.Thread(target=lambda: install_crx(cid), daemon=True).start()
         elif cmd == "prompt_save_password":
-            self.show_password_banner(body.get("host", ""), body.get("username", ""), body.get("password", ""))
+            calling_wv = message.webView()
+            verified_host = calling_wv.URL().host() if (calling_wv and calling_wv.URL()) else None
+            if verified_host:
+                self.show_password_banner(verified_host, body.get("username", ""), body.get("password", ""))
         elif cmd == "check_autofill":
-            # Bug 18 & 19 Fix: Apply credentials specifically to requesting webview using safe JSON encoding
-            host = body.get("host")
-            saved_user = SETTINGS.settings.get("saved_logins", {}).get(host)
+            calling_wv = message.webView()
+            if not calling_wv or not calling_wv.URL():
+                return
+            verified_host = calling_wv.URL().host()
+            if not verified_host:
+                return
+            saved_user = SETTINGS.settings.get("saved_logins", {}).get(verified_host)
             if saved_user:
-                pwd = get_from_keychain(host, saved_user)
+                pwd = get_from_keychain(verified_host, saved_user)
                 if pwd:
-                    calling_wv = message.webView()
-                    if calling_wv:
-                        pwd_json = json.dumps(pwd)
-                        user_json = json.dumps(saved_user)
-                        js = f"""(function() {{
-                            let pw = document.querySelector('input[type=password]');
-                            let user = document.querySelector('input[type=text], input[type=email]');
-                            if (pw) pw.value = {pwd_json};
-                            if (user) user.value = {user_json};
-                        }})();"""
-                        calling_wv.evaluateJavaScript_completionHandler_(js, None)
+                    pwd_json = json.dumps(pwd)
+                    user_json = json.dumps(saved_user)
+                    js = f"""(function() {{
+                        let pw = document.querySelector('input[type=password]');
+                        let user = document.querySelector('input[type=text], input[type=email]');
+                        if (pw) pw.value = {pwd_json};
+                        if (user) user.value = {user_json};
+                    }})();"""
+                    calling_wv.evaluateJavaScript_completionHandler_(js, None)
+
         elif cmd == "save_setting":
             raw_key, raw_val = body.get("key"), body.get("val")
             if raw_key is None:
@@ -3110,9 +3195,11 @@ class BrowserWindowController(Cocoa.NSWindowController):
                 elif pending_action == "copy_address": self.perform_copy_image_address(img_url)
             return None
 
-        url = act.request().URL().absoluteString() if act.request().URL() else None
-        if url:
-            self.add_tab(url)
+        url = act.request().URL().absoluteString() if act.request().URL() else ""
+        new_tab_idx = len(self.tabs)
+        self.add_tab(url or "about:blank")
+        if 0 <= new_tab_idx < len(self.tabs):
+            return self.tabs[new_tab_idx].get("webview")
         return None
 
     def webView_decidePolicyForNavigationAction_decisionHandler_(self, wv, action, handler):
@@ -3247,13 +3334,23 @@ class BrowserWindowController(Cocoa.NSWindowController):
             self.omnibox_panel.hide()
 
     def windowWillClose_(self, notif):
-        # Bug 4 Fix: Invalidate repeating NSTimer to prevent memory retain cycle
         if hasattr(self, 'sleep_timer') and self.sleep_timer:
             self.sleep_timer.invalidate()
             self.sleep_timer = None
 
-        if hasattr(self, 'omnibox_panel') and self.omnibox_panel.is_visible():
-            self.omnibox_panel.hide()
+        if hasattr(self, 'omnibox_panel') and self.omnibox_panel:
+            if self.omnibox_panel.is_visible():
+                self.omnibox_panel.hide()
+            self.omnibox_panel.wc = None
+
+        # Unregister KVO observers from active downloads to prevent deallocation crash
+        for d in self.downloads:
+            dl_obj = d.get("obj")
+            if dl_obj and hasattr(dl_obj, "progress") and dl_obj.progress():
+                try:
+                    dl_obj.progress().removeObserver_forKeyPath_(self, "fractionCompleted")
+                except Exception:
+                    pass
 
         self.save_session()
         for t in self.tabs:
@@ -3265,13 +3362,21 @@ class BrowserWindowController(Cocoa.NSWindowController):
                         wv.removeObserver_forKeyPath_(self, k)
                     except Exception:
                         pass
-                # Bug 20 Fix: Clean up userContentController message handlers
                 uc = wv.configuration().userContentController()
                 for name in SCRIPT_HANDLER_NAMES:
                     try:
                         uc.removeScriptMessageHandlerForName_(name)
                     except Exception:
                         pass
+
+        # Break circular references
+        if hasattr(self, 'download_delegate'):
+            self.download_delegate.controller = None
+        if hasattr(self, 'find_bar'):
+            self.find_bar.controller = None
+        if hasattr(self, 'bookmarks_bar'):
+            self.bookmarks_bar.controller = None
+
         app_delegate = Cocoa.NSApp.delegate()
         if app_delegate and hasattr(app_delegate, "controllers") and self in app_delegate.controllers:
             app_delegate.controllers.remove(self)
@@ -3299,7 +3404,7 @@ class AppDelegate(Cocoa.NSObject):
             Cocoa.NSApp.activateIgnoringOtherApps_(True)
 
             def click_monitor(event):
-                for c in self.controllers:
+                for c in list(self.controllers):
                     if c.omnibox_panel.is_visible():
                         if c.omnibox_panel.suggestion_window and event.window() == c.omnibox_panel.suggestion_window:
                             return event
@@ -3326,7 +3431,7 @@ class AppDelegate(Cocoa.NSObject):
                 if win and isinstance(win.delegate(), BrowserWindowController):
                     wc = win.delegate()
                 elif hasattr(self, 'controllers') and self.controllers:
-                    for c in self.controllers:
+                    for c in list(self.controllers):
                         if c.window() == win:
                             wc = c
                             break

pybrowser/doh_server.py

@@ -4,6 +4,8 @@ Provides encrypted local DNS proxying and WebKit content rule compilation.
 """
 
 import os
+import sys
+import tempfile
 import json
 import time
 import threading
@@ -104,12 +106,23 @@ def load_dns_cache():
 
 def flush_dns_cache_to_disk():
     global DNS_CACHE_DIRTY
+    snapshot = None
     with DNS_LOCK:
         if DNS_CACHE_DIRTY:
+            snapshot = dict(DNS_CACHE)
+            DNS_CACHE_DIRTY = False
+
+    if snapshot is not None:
+        try:
+            dir_name = os.path.dirname(DNS_CACHE_FILE) or "."
+            fd, temp_path = tempfile.mkstemp(dir=dir_name)
+            with os.fdopen(fd, 'w', encoding='utf-8') as f:
+                json.dump(snapshot, f, indent=2)
+            os.replace(temp_path, DNS_CACHE_FILE)
+        except Exception:
             try:
-                with open(DNS_CACHE_FILE, 'w', encoding='utf-8') as f:
-                    json.dump(DNS_CACHE, f, indent=2)
-                DNS_CACHE_DIRTY = False
+                if 'temp_path' in locals() and os.path.exists(temp_path):
+                    os.remove(temp_path)
             except Exception:
                 pass
 
@@ -130,7 +143,10 @@ def doh_resolve(hostname):
     now = time.time()
     clean_host = hostname.strip("[]").strip()
 
-    # If already an IPv4 or IPv6 address literal, bypass DNS lookup
+# Localhost and IP literals bypass external DoH
+    if clean_host in ("localhost", "127.0.0.1", "::1") or clean_host.endswith(".local"):
+        return "127.0.0.1" if clean_host in ("localhost", "127.0.0.1") else clean_host
+
     try:
         ipaddress.ip_address(clean_host)
         return clean_host
@@ -207,30 +223,49 @@ def doh_resolve(hostname):
     return clean_host
 
 class DoHProxyHandler(http.server.BaseHTTPRequestHandler):
+    rbufsize = 0
+    wbufsize = 0
+
     def log_message(self, format, *args):
         pass
 
     def do_CONNECT(self):
+        self.close_connection = True
         try:
             host, port = (self.path.rsplit(":", 1) if ":" in self.path else (self.path, 443))
             port = int(port)
             host = host.strip("[]")
         except Exception:
-            self.send_error(400, "Bad Request")
+            try:
+                self.send_error(400, "Bad Request")
+            except (BrokenPipeError, ConnectionResetError, OSError):
+                pass
             return
 
         if SETTINGS.settings.get("adblock_enabled", True) and is_domain_blocked(host):
-            self.send_error(403, "Blocked by PyBrowser uBlock Engine")
+            try:
+                self.send_error(403, "Blocked by PyBrowser uBlock Engine")
+            except (BrokenPipeError, ConnectionResetError, OSError):
+                pass
             return
 
         ip = doh_resolve(host)
+        upstream = None
         try:
             upstream = socket.create_connection((ip, port), timeout=6)
             self.send_response(200, "Connection Established")
             self.end_headers()
             self._tunnel(self.connection, upstream)
         except Exception:
-            self.send_error(502, "Bad Gateway")
+            if upstream:
+                try:
+                    upstream.close()
+                except Exception:
+                    pass
+            try:
+                self.send_error(502, "Bad Gateway")
+            except (BrokenPipeError, ConnectionResetError, OSError):
+                pass
 
     def do_GET(self): self._proxy_plain_http()
     def do_POST(self): self._proxy_plain_http()
@@ -299,25 +334,29 @@ class DoHProxyHandler(http.server.BaseHTTPRequestHandler):
             except Exception:
                 pass
 
+class ReusableTCPServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
+    allow_reuse_address = True
+    daemon_threads = True
+
+    def server_bind(self):
+        if hasattr(socket, "SO_REUSEPORT"):
+            try:
+                self.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEPORT, 1)
+            except Exception:
+                pass
+        super().server_bind()
+
+    def handle_error(self, request, client_address):
+        exc_type = sys.exc_info()[0]
+        if exc_type in (BrokenPipeError, ConnectionResetError, ConnectionAbortedError):
+            return
+        super().handle_error(request, client_address)
+
 def start_proxy_server():
-    # Bug 23 Fix: Prevent multiple TCP server instances & duplicate worker threads
     global _PROXY_STARTED
     with _PROXY_START_LOCK:
         if _PROXY_STARTED:
             return
-
-        class ReusableTCPServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
-            allow_reuse_address = True
-            daemon_threads = True
-
-            def server_bind(self):
-                if hasattr(socket, "SO_REUSEPORT"):
-                    try:
-                        self.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEPORT, 1)
-                    except Exception:
-                        pass
-                super().server_bind()
-
         try:
             server = ReusableTCPServer(("127.0.0.1", LOCAL_PROXY_PORT), DoHProxyHandler)
             threading.Thread(target=server.serve_forever, daemon=True).start()
@@ -445,4 +484,4 @@ def update_adblock_filters_from_web():
         return len(STEVENBLACK_DOMAINS)
     except Exception as e:
         print(f"[Adblock Web Update Error] {e}")
-        return len(STEVENBLACK_DOMAINS)
+        return len(STEVENBLACK_DOMAINS)