v1.1.54

.gitignore

@@ -1,5 +1,4 @@
 node_modules/
-package-lock.json
 
 dist/
 dist-build/
@@ -36,3 +35,5 @@ yarn-error.log*
 *.tmp
 *.temp
 download-temp.zip
+
+.env

DOCUEMENTATION/CLEAR.bash

@@ -0,0 +1 @@
+bash -c 'pkill -9 -x node 2>/dev/null; pkill -9 -x "Vyla Home" 2>/dev/null; pkill -9 -x "vyla-home" 2>/dev/null; rm -rf "$HOME/Library/Application Support/com.vyla.home" "$HOME/Library/Application Support/vyla-home" "$HOME/Library/Application Support/Vyla Home" "$HOME/Library/Caches/com.vyla.home" "$HOME/Library/Caches/vyla-home" "$HOME/Library/Caches/Vyla Home" "$HOME/Library/WebKit/com.vyla.home" "$HOME/Library/WebKit/vyla-home" "$HOME/Library/WebKit/Vyla Home" "$HOME/Library/Logs/Vyla Home" "$HOME/Library/Preferences/com.vyla.home.plist" "$HOME/.vyla-home" "/Applications/Vyla Home.app" "/Applications/vyla-home.app" "$HOME/Applications/Vyla Home.app" "$HOME/Applications/vyla-home.app" "src-tauri/target" "dist-build" "temp-validation-extract" "dist" "frontend" "player" "auth-proxy" "stream-api" "logs" "*.log" "download-temp.zip" "update-payload.zip" "manifest.json" "validation-report.json" "config/encrypted-credentials.json" "config/credentials.json"; echo "Vyla Home cleanup complete."'

DOCUEMENTATION/FIXES.md

@@ -0,0 +1,3 @@
+If someone get's a Webview2 error, they need to download the WebView2Loader.dll and drag it in bin
+
+bin\WebView2Loader.dll

DOCUEMENTATION/FORDEV.md

@@ -23,3 +23,15 @@ Fixing os error 32
 ```powershell
 Stop-Process -Name "vyla-home", "node", "cargo" -Force -ErrorAction SilentlyContinue
 ```
+
+Fake an old local version:
+
+```powershell
+'{"version":"0.0.1","sha256":null}' | Set-Content "$env:APPDATA\vyla-home\vyla-home-files\version.json"
+```
+
+Fake a test?
+
+```powershell
+$env:VYLA_TEST_UI="1"; npm run dev
+```

LICENSE

@@ -0,0 +1,47 @@
+Vyla Home Attribution License (VHAL) v1.0
+
+Copyright (c) 2026 Vyla Entertainment
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of the Vyla Home source code and associated documentation (the “Software”), to use, copy, modify, merge, publish, and distribute the Software, subject to the following conditions:
+
+1. Attribution
+
+Any public distribution, publication, derivative work, modified version, or substantial use of the Software must provide clear and visible credit to Vyla Entertainment and Vyla Home.
+
+The attribution must substantially state:
+
+“Based on Vyla Home by Vyla Entertainment”
+
+The attribution must appear in a location reasonably visible to users of the Software, such as an About page, credits section, documentation, repository, application information page, or other comparable location.
+
+2. Preservation of License
+
+Copies or substantial portions of the Software must include a copy of this license and the original copyright notice.
+
+3. Modified Versions
+
+Modified versions may be created and distributed under different terms, provided that the attribution requirements of Section 1 and the preservation requirements of Section 2 remain in effect.
+
+4. No Implication of Endorsement
+
+Use of the Software does not grant permission to imply that Vyla Entertainment endorses, sponsors, or officially supports any modified version or derivative work unless Vyla Entertainment has provided explicit written permission.
+
+5. Trademarks
+
+This license does not grant permission to use the Vyla Entertainment or Vyla Home names, logos, trademarks, service marks, or other branding except as necessary to satisfy the attribution requirement of this license.
+
+6. Commercial Use
+
+Commercial use, sale, and distribution of the Software and derivative works are permitted, provided that all applicable requirements of this license are satisfied.
+
+7. No Warranty
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.
+
+IN NO EVENT SHALL VYLA ENTERTAINMENT OR THE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+8. Acceptance
+
+By using, copying, modifying, publishing, or distributing the Software, you agree to the terms of this license.
+
+If any provision of this license is found to be unenforceable, the remaining provisions shall remain in effect.

README.md

@@ -1,30 +1,24 @@
-# Vyla Home Engine
+# Vyla Home
 
-A high-performance, locally executed environment for the Vyla media ecosystem. Built on the Tauri v2 framework, Vyla Home acts as a secure native bridge between local microservices and a lightweight WebView2 rendering engine.
+A desktop application that provides a fast, secure, and private way to access the Vyla media ecosystem. Vyla Home runs everything locally on your computer, giving you quick access to streaming services without relying on external servers.
 
-## Architecture & Security
+## What It Does
 
-Vyla Home is designed around complete local isolation to maximize speed, privacy, and reliability:
+Vyla Home is a native desktop app that:
 
-- **Zero External Reverse-Proxies**: All routing, API endpoints, and authentication middleware run strictly on local loopback interfaces (`127.0.0.1`), eliminating ISP throttling and data-center IP bans.
+- **Runs locally** - All services run on your computer for maximum privacy and speed
-- **Native Memory Management**: Background Node.js lifecycle states are managed directly via OS-level memory handles (bypassing slow shell wrappers) for instant startup and teardown.
+- **Manages streaming services** - Handles authentication and streaming APIs automatically
-- **Cryptographic Obfuscation**: Client configurations and credentials are secured on-disk via hardware-derived AES-256-GCM encryption.
+- **Updates automatically** - Keeps itself up to date with the latest features and fixes
-- **Automated Integrity Patching**: Payloads are dynamically verified using SHA-256 checksums and patched in-memory via C-level buffer scans.
+- **Works offline** - Core functionality doesn't require constant internet connectivity
+- **Keeps your data secure** - Your credentials and settings are encrypted and stored locally
 
-## Build Requirements
+## How It Works
 
-- [Rust](https://www.rust-lang.org/) (Latest Stable)
+When you launch Vyla Home, it:
-- [Node.js](https://nodejs.org/) (v20+ LTS)
-- Tauri CLI (`npm install -g @tauri-apps/cli`)
 
-## Compilation
+1. Starts the necessary background services (media player server)
+2. Loads your saved settings and credentials (encrypted for security)
+3. Checks for updates and installs them if available
+4. Opens the user interface in a secure, embedded browser window
 
-The build pipeline has been optimized with Fat LTO and aggressive panic aborts to generate the smallest possible binary footprint.
+Everything happens on your machine - your data never leaves your computer except when communicating directly with streaming services.
-
-```bash
-npm install
-
-npm run build:payload
-
-npm run build
-```

build-pipeline.js

@@ -5,7 +5,7 @@ const AdmZip = require('adm-zip');
 const { execSync } = require('child_process');
 
 const BUILD_DIR = path.join(__dirname, 'dist-build');
-const REPOS = ['frontend', 'player', 'auth-proxy', 'stream-api'];
+const REPOS = ['frontend', 'player'];
 
 const TEMP_EXTRACT_DIR = path.join(__dirname, 'temp-validation-extract');
 
@@ -14,8 +14,6 @@ const GITLAB_GROUP = 'vyla-entertainment';
 const REPO_CONFIG = {
   'frontend': { name: 'frontend', branch: 'main' },
   'player': { name: 'player', branch: 'main' },
-  'auth-proxy': { name: 'auth-proxy', branch: 'main' },
-  'stream-api': { name: 'stream-api', branch: 'main' },
 };
 
 const clonedRepos = new Set();
@@ -174,9 +172,6 @@ function validatePayload(zipPath) {
   zip.extractAllTo(TEMP_EXTRACT_DIR, true);
 
   const requiredFiles = [
-    'player/index.html',
-    'auth-proxy/server.js',
-    'stream-api/server.js',
     'frontend/index.html'
   ];
 

codemagic.yaml

@@ -21,7 +21,7 @@ workflows:
       - name: Install dependencies
         script: |
           export PATH="$HOME/.cargo/bin:$PATH"
-          npm install
+          npm ci
       - name: Build & Publish macOS Release
         script: |
           export PATH="$HOME/.cargo/bin:$PATH"

config/credentials-template.json

@@ -1,16 +1,5 @@
 {
     "player": {
-        "TMDB_KEY": "YOUR_TMDB_KEY_HERE",
+        "TMDB_KEY": "YOUR_TMDB_KEY_HERE"
-        "API_KEY": "YOUR_API_KEY_HERE"
-    },
-    "auth-proxy": {
-        "VITE_API_KEY": "YOUR_VITE_API_KEY_HERE",
-        "PROXY_VITE_API_KEY": "YOUR_PROXY_VITE_API_KEY_HERE"
-    },
-    "stream-api": {
-        "TMDB_API_KEY": "YOUR_TMDB_API_KEY_HERE",
-        "GA_MEASUREMENT_ID": "YOUR_GA_MEASUREMENT_ID_HERE",
-        "GA_API_SECRET": "YOUR_GA_API_SECRET_HERE",
-        "TOKEN_SECRET": "YOUR_TOKEN_SECRET_HERE"
     }
 }

config/env.json

@@ -1,20 +1,5 @@
 {
   "player": {
-    "PORT": "3001",
+    "PORT": "3000"
-    "BASE_URL": "http://localhost:7860",
-    "BYPASS_AUTH": "true"
-  },
-  "auth-proxy": {
-    "PORT": "3000",
-    "VITE_BASE_URL": "http://localhost:7860",
-    "DEV_BYPASS_AUTH": "true"
-  },
-  "stream-api": {
-    "PORT": "7860",
-    "PROXY_URL": "https://txt.primebox.workers.dev",
-    "PROXY_STREAMS": "true",
-    "ENABLE_DEBUG_ROUTE": "true",
-    "BYPASS_AUTH": "true",
-    "TOKEN_SECRET": "vyla_default_secure_token_secret_local_dev_32chars"
   }
 }

config/replacements.json

@@ -2,40 +2,17 @@
   "frontend": [
     {
       "find": "https://player.vyla.cc",
-      "replace": "http://localhost:3001"
+      "replace": "http://localhost:3000"
     },
     {
       "find": "http://player.vyla.cc",
-      "replace": "http://localhost:3001"
-    },
-    {
-      "find": "https://api.vyla.cc",
-      "replace": "http://localhost:7860"
-    },
-    {
-      "find": "https://auth.vyla.cc",
       "replace": "http://localhost:3000"
     }
   ],
   "player": [
-    {
-      "find": "https://api.vyla.cc",
-      "replace": "http://localhost:7860"
-    },
-    {
-      "find": "https://auth.vyla.cc",
-      "replace": "http://localhost:3000"
-    },
     {
       "find": "https://player.vyla.cc",
       "replace": "http://localhost:4890"
     }
-  ],
+  ]
-  "auth-proxy": [
-    {
-      "find": "https://player.vyla.cc",
-      "replace": "http://localhost:3001"
-    }
-  ],
-  "stream-api": []
 }

crypto-utils.js

@@ -1,17 +1,16 @@
 const crypto = require('crypto');
 const os = require('os');
-const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
 
 class CryptoUtils {
   static getMachineKey(cacheDir) {
-    const path = require('path');
-    const fs = require('fs');
     const cachePath = cacheDir ? path.join(cacheDir, '.machine-key-cache') : null;
 
     if (cachePath && fs.existsSync(cachePath)) {
       try {
         const cached = fs.readFileSync(cachePath, 'utf8').trim();
-        if (cached) return cached;
+        if (cached && cached.length === 64) return cached;
       } catch (e) {
       }
     }
@@ -22,8 +21,7 @@ class CryptoUtils {
         os.hostname(),
         os.platform(),
         os.arch(),
-        os.cpus()[0].model,
+        os.cpus()[0] ? os.cpus()[0].model : '',
-        this.getMachineId(),
         process.env.COMPUTERNAME || '',
         process.env.USERNAME || ''
       ].join('|');
@@ -46,36 +44,6 @@ class CryptoUtils {
     return key;
   }
 
-  static getMachineId() {
-    const fs = require('fs');
-    if (os.platform() === 'win32') {
-      try {
-        const { spawnSync } = require('child_process');
-        const res = spawnSync('reg', ['query', 'HKLM\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid'], { encoding: 'utf8' });
-        if (res.stdout) {
-          const match = res.stdout.match(/MachineGuid\s+REG_SZ\s+([^\r\n]+)/);
-          if (match) return match[1].trim();
-        }
-      } catch (e) { }
-      return 'windows-node-' + os.hostname();
-    } else if (os.platform() === 'darwin') {
-      try {
-        const { spawnSync } = require('child_process');
-        const res = spawnSync('ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice'], { encoding: 'utf8' });
-        const match = res.stdout.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
-        if (match) return match[1].trim();
-      } catch (e) { }
-      return 'darwin-node-' + os.hostname();
-    } else {
-      for (const idPath of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
-        try {
-          if (fs.existsSync(idPath)) return fs.readFileSync(idPath, 'utf8').trim();
-        } catch (e) { }
-      }
-      return 'linux-node-' + os.hostname();
-    }
-  }
-
   static deriveKey(machineKey, salt = 'vyla-home-salt') {
     const hash = crypto.createHash('sha256');
     hash.update(machineKey + salt);
@@ -98,11 +66,11 @@ class CryptoUtils {
     }
   }
 
-  static decrypt(encryptedData, key) {
+  static decrypt(ciphertext, key) {
     try {
-      const parts = encryptedData.split(':');
+      const parts = ciphertext.split(':');
       if (parts.length !== 3) {
-        throw new Error('Invalid encrypted data format');
+        throw new Error('Invalid ciphertext format');
       }
 
       const iv = Buffer.from(parts[0], 'hex');
@@ -122,24 +90,13 @@ class CryptoUtils {
   }
 
   static encryptObject(obj, key) {
-    const json = JSON.stringify(obj);
+    const jsonString = JSON.stringify(obj);
-    return this.encrypt(json, key);
+    return this.encrypt(jsonString, key);
   }
 
-  static decryptObject(encryptedData, key) {
+  static decryptObject(ciphertext, key) {
-    const json = this.decrypt(encryptedData, key);
+    const jsonString = this.decrypt(ciphertext, key);
-    return JSON.parse(json);
+    return JSON.parse(jsonString);
-  }
-
-  static hashData(data) {
-    const hash = crypto.createHash('sha256');
-    hash.update(data);
-    return hash.digest('hex');
-  }
-
-  static verifyHash(data, expectedHash) {
-    const actualHash = this.hashData(data);
-    return actualHash === expectedHash;
   }
 }
 

file-updater.js

@@ -0,0 +1,612 @@
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const zlib = require('zlib');
+const https = require('https');
+const AdmZip = require('adm-zip');
+
+const SDK_NAME = '@vyla-entertainment/sdk';
+const SDK_LATEST_URL = 'https://registry.npmjs.org/@vyla-entertainment%2Fsdk/latest';
+const ALLOWED_ROOTS = ['frontend', 'player'];
+const MAX_TARBALL = 100 * 1024 * 1024;
+const MAX_FILE = 50 * 1024 * 1024;
+const LIVE_HOSTS = ['gitlab.com'];
+const REPO_API = 'https://gitlab.com/api/v4/projects/vyla-entertainment%2F';
+
+const verParts = (v) => String(v || '').replace(/^v/, '').split(/[.\-+]/).map((n) => parseInt(n, 10) || 0);
+const cmpVer = (a, b) => {
+    const x = verParts(a);
+    const y = verParts(b);
+    for (let i = 0; i < Math.max(x.length, y.length); i++) {
+        if ((x[i] || 0) !== (y[i] || 0)) return (x[i] || 0) - (y[i] || 0);
+    }
+    return 0;
+};
+
+const sha256Buf = (buf) => crypto.createHash('sha256').update(buf).digest('hex');
+const sha256File = (p) => sha256Buf(fs.readFileSync(p));
+const gitBlobSha = (buf) => crypto.createHash('sha1').update(Buffer.concat([Buffer.from(`blob ${buf.length}\0`), buf])).digest('hex');
+
+const hooks = { notice: null };
+
+function fetchBuffer(url, { headers = {}, maxBytes, hosts, redirects = 0, retries = 0 }) {
+    return new Promise((resolve, reject) => {
+        if (redirects > 5) return reject(new Error('Too many redirects'));
+        let u;
+        try { u = new URL(url); } catch (e) { return reject(new Error('Invalid URL')); }
+        if (u.protocol !== 'https:' || !hosts.includes(u.hostname)) {
+            return reject(new Error(`Host not allowed: ${u.hostname}`));
+        }
+        const req = https.get({
+            hostname: u.hostname,
+            port: 443,
+            path: u.pathname + u.search,
+            headers: { 'User-Agent': 'VylaHome-Client', ...headers }
+        }, (res) => {
+            if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+                res.resume();
+                const next = new URL(res.headers.location, url).toString();
+                const keep = new URL(next).hostname === u.hostname ? headers : {};
+                fetchBuffer(next, { headers: keep, maxBytes, hosts, redirects: redirects + 1 }).then(resolve, reject);
+                return;
+            }
+            if (res.statusCode === 429 && retries < 4) {
+                res.resume();
+                const wait = Math.min(parseInt(res.headers['retry-after'], 10) || 5, 30) * 1000;
+                if (hooks.notice) hooks.notice(`GitLab rate limit (HTTP 429). Retrying in ${Math.round(wait / 1000)}s (${retries + 1}/4)...`);
+                setTimeout(() => {
+                    fetchBuffer(url, { headers, maxBytes, hosts, redirects, retries: retries + 1 }).then(resolve, reject);
+                }, wait);
+                return;
+            }
+            if (res.statusCode !== 200) {
+                res.resume();
+                reject(new Error(`HTTP ${res.statusCode}`));
+                return;
+            }
+            const chunks = [];
+            let size = 0;
+            res.on('data', (c) => {
+                size += c.length;
+                if (size > maxBytes) {
+                    req.destroy();
+                    reject(new Error('Response too large'));
+                    return;
+                }
+                chunks.push(c);
+            });
+            res.on('end', () => resolve(Buffer.concat(chunks)));
+            res.on('error', reject);
+        });
+        req.on('error', reject);
+        req.setTimeout(30000, () => {
+            req.destroy();
+            reject(new Error('Request timeout'));
+        });
+    });
+}
+
+function safeRel(rel) {
+    if (typeof rel !== 'string' || !rel || rel.includes('\0') || rel.includes('\\')) return null;
+    const norm = path.posix.normalize(rel);
+    if (norm !== rel || norm.startsWith('/') || norm.endsWith('/')) return null;
+    const parts = norm.split('/');
+    if (parts.length < 2 || !ALLOWED_ROOTS.includes(parts[0])) return null;
+    if (parts.some((p) => p === '..' || p === '.' || p === 'node_modules' || p === '.git')) return null;
+    return norm;
+}
+
+function extractTar(tar, destDir) {
+    const root = path.resolve(destDir);
+    let offset = 0;
+    while (offset + 512 <= tar.length) {
+        const header = tar.subarray(offset, offset + 512);
+        if (header.every((b) => b === 0)) break;
+        let name = header.toString('utf8', 0, 100).replace(/\0.*$/, '');
+        const prefix = header.toString('utf8', 345, 500).replace(/\0.*$/, '');
+        if (prefix) name = `${prefix}/${name}`;
+        const size = parseInt(header.toString('utf8', 124, 136).replace(/\0.*$/, '').trim(), 8) || 0;
+        const type = String.fromCharCode(header[156]);
+        offset += 512;
+        const data = tar.subarray(offset, offset + size);
+        offset += Math.ceil(size / 512) * 512;
+        if ((type !== '0' && type !== '\0') || !name.startsWith('package/')) continue;
+        const rel = path.posix.normalize(name.slice('package/'.length));
+        if (!rel || rel.startsWith('..') || rel.startsWith('/') || rel.endsWith('/')) {
+            throw new Error(`Unsafe path in tarball: ${name}`);
+        }
+        const full = path.resolve(root, rel);
+        if (!full.startsWith(root + path.sep)) {
+            throw new Error(`Unsafe path in tarball: ${name}`);
+        }
+        fs.mkdirSync(path.dirname(full), { recursive: true });
+        fs.writeFileSync(full, data);
+    }
+}
+
+class FileUpdater {
+    constructor(appDataPath, updateClient) {
+        this.appDataPath = appDataPath;
+        this.updateClient = updateClient;
+        this.onProgress = null;
+        this.statePath = path.join(appDataPath, 'file-state.json');
+    }
+
+    set onNotice(fn) {
+        hooks.notice = fn;
+    }
+
+    sdkHeaders() {
+        const h = { Accept: 'application/json' };
+        if (process.env.NPM_TOKEN) h.Authorization = `Bearer ${process.env.NPM_TOKEN}`;
+        return h;
+    }
+
+    liveHeaders(extra = {}) {
+        const t = this.updateClient && this.updateClient.token;
+        return t ? { ...extra, 'PRIVATE-TOKEN': t } : extra;
+    }
+
+    target(rel) {
+        const root = path.resolve(this.appDataPath);
+        const full = path.resolve(root, ...rel.split('/'));
+        if (!full.startsWith(root + path.sep)) throw new Error(`Path escape: ${rel}`);
+        return full;
+    }
+
+    readState() {
+        try {
+            const s = JSON.parse(fs.readFileSync(this.statePath, 'utf8'));
+            return {
+                seq: typeof s.seq === 'number' ? s.seq : null,
+                base: s.base && typeof s.base === 'object' ? s.base : {},
+                remote: s.remote && typeof s.remote === 'object' ? s.remote : {},
+                local: s.local && typeof s.local === 'object' ? s.local : {},
+                commits: s.commits && typeof s.commits === 'object' ? s.commits : {}
+            };
+        } catch (e) {
+            return { seq: null, base: {}, remote: {}, local: {}, commits: {} };
+        }
+    }
+
+    writeState(state) {
+        const cur = this.readState();
+        const next = {
+            seq: state.seq !== undefined ? state.seq : cur.seq,
+            base: state.base || cur.base,
+            remote: state.remote || cur.remote,
+            local: state.local || cur.local,
+            commits: state.commits || cur.commits
+        };
+        fs.mkdirSync(this.appDataPath, { recursive: true });
+        const tmp = `${this.statePath}.tmp`;
+        fs.writeFileSync(tmp, JSON.stringify(next), 'utf8');
+        fs.renameSync(tmp, this.statePath);
+    }
+
+    snapshotBase() {
+        const base = {};
+        const walk = (dir, rel) => {
+            for (const name of fs.readdirSync(dir)) {
+                if (name === 'node_modules' || name === '.git') continue;
+                const full = path.join(dir, name);
+                const r = `${rel}/${name}`;
+                const st = fs.lstatSync(full);
+                if (st.isDirectory()) walk(full, r);
+                else if (st.isFile()) base[r] = sha256File(full);
+            }
+        };
+        for (const root of ALLOWED_ROOTS) {
+            const dir = path.join(this.appDataPath, root);
+            if (fs.existsSync(dir)) walk(dir, root);
+        }
+        this.writeState({ seq: this.readState().seq, base, remote: {}, local: {}, commits: {} });
+    }
+
+    zipMatches(zipPath, sha256) {
+        try {
+            return sha256File(zipPath) === String(sha256).trim().toLowerCase();
+        } catch (e) {
+            return false;
+        }
+    }
+
+    async checkFiles() {
+        const versionFile = path.join(this.appDataPath, 'version.json');
+        let local;
+        try {
+            local = JSON.parse(fs.readFileSync(versionFile, 'utf8'));
+        } catch (e) {
+            return { seq: 0, changes: [] };
+        }
+        const release = await this.updateClient.checkForUpdates();
+        const norm = (v) => String(v || '').replace(/^v/, '').trim();
+        if (!release || !release.sha256 || !local.sha256) return { seq: 0, changes: [] };
+        if (norm(release.version) !== norm(local.version) || release.sha256 === local.sha256) {
+            return { seq: 0, changes: [] };
+        }
+
+        const zipPath = path.join(this.appDataPath, 'pending-ui.zip');
+        if (!this.zipMatches(zipPath, release.sha256)) {
+            fs.rmSync(zipPath, { force: true });
+            await this.updateClient.downloadUpdate(release, zipPath, this.onProgress);
+            if (!this.zipMatches(zipPath, release.sha256)) {
+                fs.rmSync(zipPath, { force: true });
+                throw new Error('Update archive checksum mismatch');
+            }
+        }
+
+        const state = this.readState();
+        const zip = new AdmZip(zipPath);
+        const changes = [];
+        for (const entry of zip.getEntries()) {
+            if (entry.isDirectory) continue;
+            const rel = safeRel(entry.entryName);
+            if (!rel) continue;
+            const data = entry.getData();
+            const hash = sha256Buf(data);
+            const full = this.target(rel);
+            if (!fs.existsSync(full)) {
+                changes.push({ path: rel, sha256: hash, size: data.length, status: 'added' });
+                continue;
+            }
+            const baseline = state.base[rel] || sha256File(full);
+            if (baseline !== hash) {
+                changes.push({ path: rel, sha256: hash, size: data.length, status: 'modified' });
+            }
+        }
+
+        if (changes.length === 0) {
+            fs.writeFileSync(versionFile, JSON.stringify({ version: release.version, sha256: release.sha256 }, null, 2), 'utf8');
+            fs.rmSync(zipPath, { force: true });
+            return { seq: 0, changes: [] };
+        }
+
+        this.pending = { release, zipPath, total: changes.length };
+        return { seq: 0, changes };
+    }
+
+    async applyFiles(changes, seq, replacements, onFile) {
+        if (!this.pending) throw new Error('No pending update');
+        const { release, zipPath, total } = this.pending;
+        const zip = new AdmZip(zipPath);
+        const staged = [];
+        for (let i = 0; i < changes.length; i++) {
+            const c = changes[i];
+            const entry = zip.getEntry(c.path);
+            if (!entry) throw new Error(`Missing in archive: ${c.path}`);
+            const data = entry.getData();
+            if (sha256Buf(data) !== c.sha256) throw new Error(`Checksum mismatch: ${c.path}`);
+            staged.push({ c, data: this.applyReplacements(c.path, data, replacements) });
+            if (onFile) onFile(c.path, i + 1, changes.length);
+        }
+
+        const done = [];
+        try {
+            for (const s of staged) {
+                const full = this.target(s.c.path);
+                const prev = fs.existsSync(full) ? fs.readFileSync(full) : null;
+                fs.mkdirSync(path.dirname(full), { recursive: true });
+                fs.writeFileSync(`${full}.vyla-tmp`, s.data);
+                fs.renameSync(`${full}.vyla-tmp`, full);
+                done.push({ full, prev });
+            }
+        } catch (e) {
+            for (const d of done.reverse()) {
+                try {
+                    if (d.prev === null) fs.rmSync(d.full, { force: true });
+                    else fs.writeFileSync(d.full, d.prev);
+                } catch (x) { }
+            }
+            throw e;
+        }
+
+        const state = this.readState();
+        for (const s of staged) state.base[s.c.path] = s.c.sha256;
+        this.writeState({ seq: state.seq, base: state.base });
+
+        if (changes.length === total) {
+            fs.writeFileSync(
+                path.join(this.appDataPath, 'version.json'),
+                JSON.stringify({ version: release.version, sha256: release.sha256 }, null, 2),
+                'utf8'
+            );
+            fs.rmSync(zipPath, { force: true });
+            this.pending = null;
+        }
+    }
+
+    applyReplacements(rel, buf, replacements) {
+        const list = (replacements && replacements[rel.split('/')[0]]) || [];
+        if (!list.length) return buf;
+        let text = buf.toString('utf8');
+        let changed = false;
+        for (const rep of list) {
+            if (rep && rep.find && text.includes(rep.find)) {
+                text = text.split(rep.find).join(rep.replace);
+                changed = true;
+            }
+        }
+        return changed ? Buffer.from(text, 'utf8') : buf;
+    }
+
+    async repoTree(root) {
+        const out = [];
+        for (let page = 1; page <= 50; page++) {
+            const url = `${REPO_API}${root}/repository/tree?recursive=true&per_page=100&ref=main&page=${page}`;
+            return fetchBuffer(`${REPO_API}${root}/repository/files/${file}/raw?ref=main`, { headers: this.liveHeaders(), maxBytes: MAX_FILE, hosts: LIVE_HOSTS });
+            const items = JSON.parse(raw.toString('utf8'));
+            if (!Array.isArray(items) || items.length === 0) break;
+            out.push(...items);
+            if (items.length < 100) break;
+        }
+        return out;
+    }
+
+    async loadArchive(root) {
+        const buf = await fetchBuffer(`${REPO_API}${root}/repository/archive.zip?sha=main`, { headers: this.liveHeaders(), maxBytes: 600 * 1024 * 1024, hosts: LIVE_HOSTS });
+        const zip = new AdmZip(buf);
+        const map = new Map();
+        for (const entry of zip.getEntries()) {
+            if (entry.isDirectory) continue;
+            const name = entry.entryName;
+            const i = name.indexOf('/');
+            if (i < 0) continue;
+            map.set(`${root}/${name.slice(i + 1)}`, entry);
+        }
+        return map;
+    }
+
+    fetchRepoFile(rel) {
+        const hit = this.archive && this.archive.get(rel);
+        if (hit) return Promise.resolve(hit.getData());
+        const parts = rel.split('/');
+        const root = parts.shift();
+        const file = encodeURIComponent(parts.join('/'));
+        return fetchBuffer(`${REPO_API}${root}/repository/files/${file}/raw?ref=main`, { maxBytes: MAX_FILE, hosts: LIVE_HOSTS });
+    }
+
+    async headCommit(root) {
+        try {
+            const raw = await fetchBuffer(`${REPO_API}${root}/repository/commits/main`, {
+                headers: this.liveHeaders({ Accept: 'application/json' }),
+                maxBytes: 1024 * 1024,
+                hosts: LIVE_HOSTS,
+                retries: 3
+            });
+            const id = JSON.parse(raw.toString('utf8')).id;
+            return /^[0-9a-f]{40}$/.test(id) ? id : null;
+        } catch (e) {
+            return null;
+        }
+    }
+
+    localIntact(root, state) {
+        const prefix = `${root}/`;
+        const keys = Object.keys(state.remote).filter((k) => k.startsWith(prefix));
+        if (keys.length === 0) return false;
+        for (const rel of keys) {
+            try {
+                if (sha256File(this.target(rel)) !== state.local[rel]) return false;
+            } catch (e) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    async checkRepos() {
+        const state = this.readState();
+        const changes = [];
+        const remoteIds = {};
+        const checkedRoots = [];
+        const errors = [];
+        const verified = { remote: {}, local: {} };
+        const commits = {};
+        this.archive = new Map();
+        for (const root of ALLOWED_ROOTS) {
+            const head = await this.headCommit(root);
+            if (this.localIntact(root, state) && (!head || head === state.commits[root])) continue;
+            let map;
+            try {
+                map = await this.loadArchive(root);
+            } catch (e) {
+                errors.push(`${root}: ${e.message}`);
+                continue;
+            }
+            if (map.size === 0) {
+                errors.push(`${root}: empty archive`);
+                continue;
+            }
+            checkedRoots.push(root);
+            if (head) commits[root] = head;
+            for (const [key, entry] of map) {
+                const rel = safeRel(key);
+                if (!rel) continue;
+                const data = entry.getData();
+                const id = gitBlobSha(data);
+                remoteIds[rel] = id;
+                const full = this.target(rel);
+                let ok = false;
+                let localHash = null;
+                if (fs.existsSync(full)) {
+                    const buf = fs.readFileSync(full);
+                    localHash = sha256Buf(buf);
+                    ok = gitBlobSha(buf) === id || (state.remote[rel] === id && state.local[rel] === localHash);
+                }
+                if (ok) {
+                    verified.remote[rel] = id;
+                    verified.local[rel] = localHash;
+                } else {
+                    changes.push({ path: rel, sha256: id, size: data.length });
+                    this.archive.set(rel, entry);
+                }
+            }
+        }
+        if (checkedRoots.length === 0) {
+            if (errors.length) throw new Error(errors.join(' | '));
+            return { seq: state.seq === null ? 0 : state.seq, changes: [], removed: [], verified, commits };
+        }
+        const tracked = new Set([...Object.keys(state.base), ...Object.keys(state.remote)]);
+        const removed = [...tracked].filter((rel) =>
+            checkedRoots.includes(rel.split('/')[0]) &&
+            !remoteIds[rel] &&
+            safeRel(rel) &&
+            fs.existsSync(this.target(rel))
+        );
+        if (changes.length === 0 && removed.length === 0) {
+            for (const k of Object.keys(verified.remote)) {
+                state.remote[k] = verified.remote[k];
+                state.local[k] = verified.local[k];
+            }
+            this.writeState({ remote: state.remote, local: state.local, commits: { ...state.commits, ...commits } });
+            this.archive = null;
+        }
+        return { seq: state.seq === null ? 0 : state.seq, changes, removed, verified, commits };
+    }
+
+    async applyLive(info, replacements, onFile) {
+        const staged = [];
+        const total = info.changes.length;
+        let next = 0;
+        if (!this.archive) this.archive = new Map();
+        let finished = 0;
+        let failure = null;
+        const worker = async () => {
+            while (next < total && !failure) {
+                const c = info.changes[next++];
+                try {
+                    const data = await this.fetchRepoFile(c.path);
+                    if (gitBlobSha(data) !== c.sha256) throw new Error(`Checksum mismatch: ${c.path}`);
+                    staged.push({ c, data: this.applyReplacements(c.path, data, replacements) });
+                    finished++;
+                    if (onFile) onFile(c.path, finished, total);
+                } catch (e) {
+                    failure = e;
+                }
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(4, total) }, worker));
+        this.archive = null;
+        if (failure) throw failure;
+
+        const done = [];
+        try {
+            for (const s of staged) {
+                const full = this.target(s.c.path);
+                const prev = fs.existsSync(full) ? fs.readFileSync(full) : null;
+                fs.mkdirSync(path.dirname(full), { recursive: true });
+                fs.writeFileSync(`${full}.vyla-tmp`, s.data);
+                fs.renameSync(`${full}.vyla-tmp`, full);
+                done.push({ full, prev });
+            }
+            for (const rel of info.removed) {
+                const full = this.target(rel);
+                if (!fs.existsSync(full)) continue;
+                const prev = fs.readFileSync(full);
+                fs.rmSync(full, { force: true });
+                done.push({ full, prev });
+            }
+        } catch (e) {
+            for (const d of done.reverse()) {
+                try {
+                    if (d.prev === null) fs.rmSync(d.full, { force: true });
+                    else fs.writeFileSync(d.full, d.prev);
+                } catch (x) { }
+            }
+            throw e;
+        }
+
+        const state = this.readState();
+        for (const s of staged) {
+            state.base[s.c.path] = s.c.sha256;
+            state.remote[s.c.path] = s.c.sha256;
+            state.local[s.c.path] = sha256Buf(s.data);
+        }
+        for (const rel of info.removed) {
+            delete state.base[rel];
+            delete state.remote[rel];
+            delete state.local[rel];
+        }
+        const v = info.verified || { remote: {}, local: {} };
+        for (const k of Object.keys(v.remote)) {
+            state.remote[k] = v.remote[k];
+            state.local[k] = v.local[k];
+        }
+        state.commits = { ...state.commits, ...(info.commits || {}) };
+        this.writeState({ seq: info.seq, base: state.base, remote: state.remote, local: state.local, commits: state.commits });
+    }
+
+    installedSdk() {
+        const roots = [this.appDataPath, path.join(this.appDataPath, 'frontend'), path.join(this.appDataPath, 'player')];
+        const found = [];
+        for (const root of roots) {
+            const dir = path.join(root, 'node_modules', ...SDK_NAME.split('/'));
+            try {
+                const version = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
+                if (version) found.push({ dir, version });
+            } catch (e) { }
+        }
+        return found;
+    }
+
+    async checkSdk() {
+        const raw = await fetchBuffer(SDK_LATEST_URL, {
+            headers: this.sdkHeaders(),
+            maxBytes: 5 * 1024 * 1024,
+            hosts: ['registry.npmjs.org']
+        });
+        const meta = JSON.parse(raw.toString('utf8'));
+        const integrity = String((meta.dist && meta.dist.integrity) || '').split(' ').find((s) => s.startsWith('sha512-'));
+        if (!meta.version || !meta.dist || !meta.dist.tarball || !integrity) {
+            throw new Error('Registry response missing version or integrity');
+        }
+        const installed = this.installedSdk();
+        const targets = installed.filter((i) => cmpVer(i.version, meta.version) < 0);
+        const current = targets.length ? targets.map((t) => t.version).sort(cmpVer)[0] : meta.version;
+        return {
+            outdated: targets.length > 0,
+            current,
+            latest: meta.version,
+            tarball: meta.dist.tarball,
+            integrity,
+            dirs: targets.map((t) => t.dir)
+        };
+    }
+
+    async installSdk(info) {
+        const tgz = await fetchBuffer(info.tarball, {
+            headers: this.sdkHeaders(),
+            maxBytes: MAX_TARBALL,
+            hosts: ['registry.npmjs.org']
+        });
+        const digest = `sha512-${crypto.createHash('sha512').update(tgz).digest('base64')}`;
+        if (digest !== info.integrity) throw new Error('SDK integrity check failed');
+        const tar = zlib.gunzipSync(tgz, { maxOutputLength: 300 * 1024 * 1024 });
+
+        for (const dir of info.dirs) {
+            const stage = `${dir}.vyla-new`;
+            const old = `${dir}.vyla-old`;
+            fs.rmSync(stage, { recursive: true, force: true });
+            fs.rmSync(old, { recursive: true, force: true });
+            fs.mkdirSync(stage, { recursive: true });
+            extractTar(tar, stage);
+            const version = JSON.parse(fs.readFileSync(path.join(stage, 'package.json'), 'utf8')).version;
+            if (version !== info.latest) {
+                fs.rmSync(stage, { recursive: true, force: true });
+                throw new Error('SDK version mismatch in tarball');
+            }
+            const had = fs.existsSync(dir);
+            if (had) fs.renameSync(dir, old);
+            try {
+                fs.renameSync(stage, dir);
+            } catch (e) {
+                if (had) fs.renameSync(old, dir);
+                throw e;
+            }
+            fs.rmSync(old, { recursive: true, force: true });
+        }
+    }
+}
+
+module.exports = FileUpdater;

github-client.js

@@ -1,178 +0,0 @@
-const { execSync, spawnSync } = require('child_process');
-const fs = require('fs');
-const path = require('path');
-
-const REPOS = {
-    frontend: { branch: 'main' },
-    player: { branch: 'main' },
-    'stream-api': { branch: 'main' },
-    'auth-proxy': { branch: 'main' }
-};
-
-const GITLAB_GROUP = 'vyla-entertainment';
-
-class GitlabClient {
-    constructor(appDataPath, credentialManager) {
-        this.appDataPath = appDataPath;
-        this.credentialManager = credentialManager;
-    }
-
-    getToken() {
-        return this.credentialManager.getCredential('gitlab', 'TOKEN') || null;
-    }
-
-    setToken(token) {
-        this.credentialManager.setCredential('gitlab', 'TOKEN', token);
-    }
-
-    hasToken() {
-        return !!this.getToken();
-    }
-
-    buildRepoUrl(repoName) {
-        const token = this.getToken();
-        if (token) {
-            return `https://oauth2:${token}@gitlab.com/${GITLAB_GROUP}/${repoName}.git`;
-        }
-        return `https://gitlab.com/${GITLAB_GROUP}/${repoName}.git`;
-    }
-
-    repoDir(repoName) {
-        return path.join(this.appDataPath, repoName);
-    }
-
-    isRepoCloned(repoName) {
-        const gitDir = path.join(this.repoDir(repoName), '.git');
-        return fs.existsSync(gitDir);
-    }
-
-    allReposCloned() {
-        return Object.keys(REPOS).every((name) => this.isRepoCloned(name));
-    }
-
-    cloneRepo(repoName, onLog) {
-        const { branch } = REPOS[repoName];
-        const targetDir = this.repoDir(repoName);
-        const url = this.buildRepoUrl(repoName);
-
-        if (fs.existsSync(targetDir)) {
-            fs.rmSync(targetDir, { recursive: true, force: true });
-        }
-
-        if (onLog) onLog(`Cloning ${repoName}...`);
-
-        const result = spawnSync('git', ['clone', '--depth', '1', '--branch', branch, url, targetDir], {
-            stdio: 'pipe',
-            env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }
-        });
-
-        if (result.status !== 0) {
-            const stderr = result.stderr ? result.stderr.toString() : 'unknown error';
-            throw new Error(`Failed to clone ${repoName}: ${stderr}`);
-        }
-    }
-
-    cloneAll(onLog) {
-        for (const repoName of Object.keys(REPOS)) {
-            this.cloneRepo(repoName, onLog);
-        }
-    }
-
-    installDependencies(repoName, onLog) {
-        const repoDir = this.repoDir(repoName);
-        const pkgJsonPath = path.join(repoDir, 'package.json');
-
-        if (!fs.existsSync(pkgJsonPath)) {
-            return;
-        }
-
-        if (onLog) onLog(`Installing dependencies for ${repoName}...`);
-
-        const result = spawnSync('npm', ['install', '--omit=dev'], {
-            cwd: repoDir,
-            stdio: 'pipe',
-            shell: process.platform === 'win32'
-        });
-
-        if (result.status !== 0) {
-            const stderr = result.stderr ? result.stderr.toString() : 'unknown error';
-            throw new Error(`npm install failed for ${repoName}: ${stderr}`);
-        }
-    }
-
-    installAllDependencies(onLog) {
-        for (const repoName of Object.keys(REPOS)) {
-            this.installDependencies(repoName, onLog);
-        }
-    }
-
-    getLocalHead(repoName) {
-        const repoDir = this.repoDir(repoName);
-        try {
-            return execSync('git rev-parse HEAD', { cwd: repoDir }).toString().trim();
-        } catch (e) {
-            return null;
-        }
-    }
-
-    getRemoteHead(repoName) {
-        const { branch } = REPOS[repoName];
-        const repoDir = this.repoDir(repoName);
-        const url = this.buildRepoUrl(repoName);
-        try {
-            const output = execSync(`git ls-remote "${url}" refs/heads/${branch}`, { cwd: repoDir }).toString().trim();
-            return output.split('\t')[0] || null;
-        } catch (e) {
-            return null;
-        }
-    }
-
-    checkForUpdates() {
-        const outdated = [];
-        for (const repoName of Object.keys(REPOS)) {
-            const local = this.getLocalHead(repoName);
-            const remote = this.getRemoteHead(repoName);
-            if (local && remote && local !== remote) {
-                outdated.push(repoName);
-            }
-        }
-        return outdated;
-    }
-
-    updateRepo(repoName, onLog) {
-        const { branch } = REPOS[repoName];
-        const repoDir = this.repoDir(repoName);
-
-        if (onLog) onLog(`Updating ${repoName}...`);
-
-        const fetchResult = spawnSync('git', ['fetch', 'origin', branch], {
-            cwd: repoDir,
-            stdio: 'pipe',
-            env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }
-        });
-
-        if (fetchResult.status !== 0) {
-            const stderr = fetchResult.stderr ? fetchResult.stderr.toString() : 'unknown error';
-            throw new Error(`Failed to fetch ${repoName}: ${stderr}`);
-        }
-
-        const resetResult = spawnSync('git', ['reset', '--hard', `origin/${branch}`], {
-            cwd: repoDir,
-            stdio: 'pipe'
-        });
-
-        if (resetResult.status !== 0) {
-            const stderr = resetResult.stderr ? resetResult.stderr.toString() : 'unknown error';
-            throw new Error(`Failed to reset ${repoName}: ${stderr}`);
-        }
-    }
-
-    updateAll(repoNames, onLog) {
-        for (const repoName of repoNames) {
-            this.updateRepo(repoName, onLog);
-            this.installDependencies(repoName, onLog);
-        }
-    }
-}
-
-module.exports = GitlabClient

main.js

@@ -5,6 +5,7 @@ const express = require('express');
 const ServiceManager = require('./service-manager');
 const Patcher = require('./patcher');
 const UpdateClient = require('./update-client');
+const FileUpdater = require('./file-updater');
 
 function getDefaultAppData() {
   if (process.platform === 'darwin') {
@@ -32,10 +33,7 @@ function debugLog(msg) {
 debugLog("--- Node.js Process Started ---");
 
 let serviceManager;
-let expressApp;
+let updateDecisionHandler = null;
-let expressServer;
-let playerExpressApp;
-let playerExpressServer;
 
 debugLog(`AppData Dir: ${APPDATA_DIR}`);
 
@@ -44,55 +42,6 @@ function sendToTauri(event, data) {
   process.stdout.write(JSON.stringify({ event, data }) + '\n');
 }
 
-function sameTabNavMiddleware(rootDir) {
-  return (req, res, next) => {
-    if (req.method !== 'GET') return next();
-    const isHtmlRequest = req.path === '/' || req.path.endsWith('/') || req.path.endsWith('.html');
-    if (!isHtmlRequest) return next();
-
-    const filePath = req.path === '/' || req.path.endsWith('/')
-      ? path.join(rootDir, req.path, 'index.html')
-      : path.join(rootDir, req.path);
-
-    fs.readFile(filePath, 'utf8', (err, data) => {
-      if (err) return next();
-      const injected = data.replace(
-        '</head>',
-        `<script>
-document.addEventListener('click', function(e) {
-  const a = e.target.closest('a[target]');
-  if (a && a.target === '_blank') a.removeAttribute('target');
-}, true);
-window.open = function(url) {
-  if (url) window.location.href = url;
-  return window;
-};
-</script></head>`
-      );
-      res.set('Content-Type', 'text/html');
-      res.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
-      res.set('Expires', '-1');
-      res.set('Pragma', 'no-cache');
-      res.send(injected);
-    });
-  };
-}
-
-const cmdApp = express();
-cmdApp.use((req, res, next) => {
-  res.header('Access-Control-Allow-Origin', '*');
-  res.header('Access-Control-Allow-Methods', 'GET,POST,OPTIONS');
-  res.header('Access-Control-Allow-Headers', '*');
-  if (req.method === 'OPTIONS') return res.sendStatus(200);
-  next();
-});
-cmdApp.get('/__tauri_cmd/:cmd', (req, res) => {
-  debugLog(`[CMD-SERVER:4892] Command received: ${req.params.cmd} (window: ${req.query.window || 'main'})`);
-  sendToTauri('tauri-cmd', { cmd: req.params.cmd, url: req.query.url, window: req.query.window });
-  res.sendStatus(200);
-});
-cmdApp.listen(4892, '127.0.0.1', () => debugLog("[CMD-SERVER] Dedicated command server listening on 127.0.0.1:4892"));
-
 process.stdin.resume();
 process.stdin.on('end', () => {
   debugLog('stdin closed - parent died. Self-terminating...');
@@ -134,6 +83,37 @@ function getReplacementsConfig() {
 }
 
 const updateClient = new UpdateClient(APPDATA_DIR);
+const fileUpdater = new FileUpdater(APPDATA_DIR, updateClient);
+fileUpdater.onNotice = (message) => sendToTauri('notice', { message });
+let lastFilePercent = -1;
+fileUpdater.onProgress = (downloaded, total) => {
+  const percent = total > 0 ? Math.round((downloaded / total) * 100) : 0;
+  if (percent === lastFilePercent) return;
+  lastFilePercent = percent;
+  sendToTauri('download-progress', { downloaded, total, percent });
+};
+
+function withTimeout(promise, ms) {
+  return Promise.race([promise, new Promise((resolve) => setTimeout(() => resolve(null), ms))]);
+}
+
+function portInUse(port) {
+  return new Promise((resolve) => {
+    const socket = new (require('net').Socket)();
+    socket.setTimeout(500);
+    socket.once('connect', () => {
+      socket.destroy();
+      resolve(true);
+    });
+    socket.once('error', () => resolve(false));
+    socket.once('timeout', () => {
+      socket.destroy();
+      resolve(false);
+    });
+    socket.connect(port, '127.0.0.1');
+  });
+}
+
 
 async function start() {
   debugLog("Inside start() function");
@@ -167,22 +147,40 @@ async function start() {
 
         debugLog('Download complete. Verifying checksum...');
         sendToTauri('status', { message: 'Verifying SHA-256 integrity...' });
+        if (!release.sha256) {
+          throw new Error('Release has no SHA-256 in manifest.json; refusing unverified install.');
+        }
         if (!patcher.verifyChecksum(tempZipPath, release.sha256)) {
           throw new Error('SHA-256 checksum verification failed.');
         }
 
-        debugLog('Checksum verified. Extracting...');
+        debugLog('Checksum verified. Extracting to staging...');
         sendToTauri('status', { message: 'Unpacking update archive...' });
-        patcher.purgeOldCode();
+        let lastEmit = 0;
-        patcher.extractZipPayload(tempZipPath);
+        const stagingDir = await patcher.extractToStaging(tempZipPath, (file, done, total) => {
+          const now = Date.now();
+          if (done !== total && now - lastEmit < 40) return;
+          lastEmit = now;
+          sendToTauri('extract-progress', {
+            file,
+            done,
+            total,
+            percent: Math.round((done / total) * 100)
+          });
+        });
 
         sendToTauri('status', { message: 'Verifying file integrity...' });
-        if (!patcher.verifyExtraction()) {
+        if (!patcher.verifyExtraction(stagingDir)) {
+          fs.rmSync(stagingDir, { recursive: true, force: true });
           throw new Error('Extraction verification failed: critical startup files missing.');
         }
 
+        sendToTauri('status', { message: 'Replacing old version...' });
+        patcher.commitStaging(stagingDir);
+
         debugLog('Extraction complete. Applying patches...');
         sendToTauri('status', { message: 'Applying configuration patches...' });
+        fileUpdater.snapshotBase();
         patcher.applyPatches(getReplacementsConfig());
 
         sendToTauri('status', { message: 'Migrating security credentials...' });
@@ -212,35 +210,11 @@ async function start() {
 
   try {
     sendToTauri('status', { message: 'Inspecting local workspace and installed files...' });
-    let isFirstRun = !patcher.verifyExtraction();
+    const isFirstRun = !patcher.verifyExtraction();
-    let localVersion = patcher.getCurrentVersion();
+    const localVersion = patcher.getCurrentVersion();
-    let localSha = patcher.getCurrentSha();
+    const localSha = patcher.getCurrentSha();
     debugLog(`Is First Run: ${isFirstRun}, Local Version: ${localVersion}, Local SHA: ${localSha}`);
 
-    const localZipPath = path.join(__dirname, 'update-payload.zip');
-    const localManifestPath = path.join(__dirname, 'manifest.json');
-    let localZipManifest = null;
-
-    if (fs.existsSync(localZipPath) && fs.existsSync(localManifestPath)) {
-      try { localZipManifest = JSON.parse(fs.readFileSync(localManifestPath, 'utf8')); } catch (e) { }
-    }
-
-    if (localZipManifest && (isFirstRun || localZipManifest.sha256 !== localSha)) {
-      debugLog("New local payload detected! Applying local build...");
-      sendToTauri('status', { message: 'Extracting local development payload...' });
-      patcher.purgeOldCode();
-      patcher.extractZipPayload(localZipPath);
-      patcher.applyPatches(getReplacementsConfig());
-      patcher.bridgeCredentials(serviceManager.credentialManager);
-      patcher.saveCurrentVersion(localZipManifest.version, localZipManifest.sha256);
-      serviceManager.envConfig = getEnvConfig();
-
-      isFirstRun = false;
-      localVersion = localZipManifest.version;
-      localSha = localZipManifest.sha256;
-      debugLog("Local payload applied successfully.");
-    }
-
     sendToTauri('status', { message: 'Connecting to update servers...' });
     let release = null;
     try {
@@ -249,53 +223,36 @@ async function start() {
       debugLog(`Update check finished. Found: ${release ? release.version : 'None'}`);
     } catch (e) {
       debugLog(`Update check failed (offline?): ${e.message}`);
-      sendToTauri('status', { message: `Update server check skipped (${e.message})` });
+      sendToTauri('notice', { message: `Update check skipped: ${e.message}` });
     }
 
+    const normalizeVer = (v) => (v || '').toString().replace(/^v/, '').trim();
+    const parseVer = (v) => normalizeVer(v).split(/[.\-+]/).map((n) => parseInt(n, 10) || 0);
+    const isNewer = (remote, local) => {
+      const a = parseVer(remote);
+      const b = parseVer(local);
+      for (let i = 0; i < Math.max(a.length, b.length); i++) {
+        const x = a[i] || 0;
+        const y = b[i] || 0;
+        if (x !== y) return x > y;
+      }
+      return false;
+    };
+
     if (release) {
-      const hasUpdate = release.version !== localVersion || (release.sha256 && release.sha256 !== localSha);
+      const versionNewer = isNewer(release.version, localVersion);
+      const sameVerNewBuild = normalizeVer(release.version) === normalizeVer(localVersion) &&
+        !!release.sha256 && !!localSha && release.sha256 !== localSha;
+      const hasUpdate = versionNewer || sameVerNewBuild;
+
       if (isFirstRun) {
-        debugLog("First run. Installing remote build...");
+        debugLog("First run with no local payload. Installing remote build...");
         sendToTauri('status', { message: 'First run detected. Preparing initial installation...' });
         await installBuild(release);
       } else if (hasUpdate) {
-        debugLog("Update available. Prompting user...");
+        debugLog("Update available. Installing update...");
-        sendToTauri('status', { message: `New update available (${release.version}). Awaiting confirmation...` });
+        sendToTauri('status', { message: `Updating to ${release.version}...` });
-
+        await installBuild(release);
-        const tempApp = express();
-        let userDecision = null;
-        tempApp.use((req, res, next) => {
-          res.header('Access-Control-Allow-Origin', '*');
-          res.header('Access-Control-Allow-Methods', 'GET,POST,OPTIONS');
-          res.header('Access-Control-Allow-Headers', '*');
-          if (req.method === 'OPTIONS') return res.sendStatus(200);
-          next();
-        });
-        tempApp.get('/update/info', (req, res) => {
-          res.json({ available: true, current: localVersion, latest: release.version });
-        });
-        tempApp.post('/update/yes', (req, res) => { userDecision = true; res.sendStatus(200); });
-        tempApp.post('/update/no', (req, res) => { userDecision = false; res.sendStatus(200); });
-
-        const tempServer = await new Promise((resolve) => {
-          const s = tempApp.listen(4891, '127.0.0.1', () => resolve(s));
-        });
-
-        sendToTauri('update-available', { current: localVersion, latest: release.version });
-
-        while (userDecision === null) {
-          await new Promise(r => setTimeout(r, 25));
-        }
-
-        await new Promise((resolve) => tempServer.close(resolve));
-
-        if (userDecision) {
-          debugLog("User accepted update.");
-          await installBuild(release);
-        } else {
-          debugLog("User skipped update.");
-          sendToTauri('status', { message: 'Update skipped. Continuing startup...' });
-        }
       } else {
         debugLog("Already on the latest version.");
         sendToTauri('status', { message: 'Up to date.' });
@@ -308,16 +265,19 @@ async function start() {
         sendToTauri('status', { message: 'Extracting local baseline payload...' });
         patcher.purgeOldCode();
         patcher.extractZipPayload(localZip);
+        fileUpdater.snapshotBase();
         patcher.applyPatches(getReplacementsConfig());
         patcher.bridgeCredentials(serviceManager.credentialManager);
 
         let ver = "1.0.0";
+        let manSha = null;
         try {
           const man = JSON.parse(fs.readFileSync(path.join(__dirname, 'manifest.json'), 'utf8'));
           ver = man.version || ver;
+          manSha = man.sha256 || null;
         } catch (e) { }
 
-        patcher.saveCurrentVersion(ver);
+        patcher.saveCurrentVersion(ver, manSha);
         serviceManager.envConfig = getEnvConfig();
         debugLog("Local payload extracted successfully.");
       } else {
@@ -327,91 +287,77 @@ async function start() {
 
     sendToTauri('status', { message: 'Validating critical components...' });
     if (!patcher.verifyExtraction()) {
-      throw new Error('No application files found. Check your internet connection and try again.');
+      throw new Error('Could not download the app files. Check your internet connection and relaunch.');
+    }
+
+    sendToTauri('status', { message: 'Checking UI files and SDK...' });
+    const [filesCheck, sdkCheck] = await Promise.all([
+      withTimeout(fileUpdater.checkRepos().catch((e) => {
+        debugLog(`Live file check failed: ${e.message}`);
+        sendToTauri('notice', { message: `File check failed: ${e.message}` });
+        return null;
+      }), 240000),
+      withTimeout(fileUpdater.checkSdk().catch((e) => {
+        debugLog(`SDK check failed: ${e.message}`);
+        sendToTauri('notice', { message: `SDK check failed: ${e.message}` });
+        return null;
+      }), 12000)
+    ]);
+    debugLog(`Repo check result: ${filesCheck ? `${filesCheck.changes.length} change(s)` : 'failed or timed out'}`);
+
+    if (filesCheck && (filesCheck.changes.length > 0 || filesCheck.removed.length > 0)) {
+      sendToTauri('status', { message: `Updating ${filesCheck.changes.length} file(s)...` });
+      try {
+        await fileUpdater.applyLive(filesCheck, getReplacementsConfig(), (file, done, total) => {
+          sendToTauri('extract-progress', { file, done, total, percent: Math.round((done / total) * 100) });
+        });
+        sendToTauri('status', { message: `Updated ${filesCheck.changes.length} file(s).` });
+      } catch (e) {
+        debugLog(`File update failed: ${e.message}`);
+        sendToTauri('notice', { message: `File update failed: ${e.message}` });
+      }
+    }
+
+    if (sdkCheck && sdkCheck.outdated) {
+      sendToTauri('status', { message: `Updating SDK (${sdkCheck.latest})...` });
+      try {
+        await fileUpdater.installSdk(sdkCheck);
+        sendToTauri('status', { message: `SDK updated to ${sdkCheck.latest}.` });
+      } catch (e) {
+        debugLog(`SDK install failed: ${e.message}`);
+        sendToTauri('status', { message: `SDK update failed: ${e.message}` });
+      }
     }
 
     sendToTauri('status', { message: 'Loading encrypted credentials...' });
     serviceManager.credentialManager.loadCredentials();
 
-    sendToTauri('status', { message: 'Starting background services (auth-proxy, stream-api)...' });
+    const busyPorts = [];
+    for (const port of [3000, 4890]) {
+      if (await portInUse(port)) busyPorts.push(port);
+    }
+    if (busyPorts.length > 0) {
+      throw new Error(`Port ${busyPorts.join(' and ')} is already in use by another program. Close it or any other running Vyla Home, then relaunch.`);
+    }
+
+    sendToTauri('status', { message: 'Starting services (player, frontend)...' });
     await serviceManager.startServices([
-      { name: 'auth-proxy', relativeDir: 'auth-proxy' },
+      { name: 'player', relativeDir: 'player', startScript: 'server.js' },
-      { name: 'stream-api', relativeDir: 'stream-api' },
+      { name: 'frontend', relativeDir: 'frontend', startScript: 'server.js' }
     ]);
     debugLog("Backend services spawn requested.");
 
-    sendToTauri('status', { message: 'Binding player web server on port 3001...' });
+    sendToTauri('status', { message: 'Waiting for microservices to bind...' });
-    const playerDir = path.join(APPDATA_DIR, 'player');
+    try {
-    playerExpressApp = express();
+      await serviceManager.waitForPorts([3000, 4890], 60000);
-    playerExpressApp.use((req, res, next) => {
+    } catch (e) {
-      res.header('Access-Control-Allow-Origin', '*');
+      throw new Error(`${e.message}. Check logs in ${LOGS_DIR}`);
-      res.header('Access-Control-Allow-Methods', 'GET,POST,OPTIONS');
-      res.header('Access-Control-Allow-Headers', '*');
-      if (req.method === 'OPTIONS') return res.sendStatus(200);
-      next();
-    });
-    playerExpressApp.get('/__tauri_cmd/:cmd', (req, res) => {
-      debugLog(`[PLAYER-SERVER:3001] Command received: ${req.params.cmd} (window: ${req.query.window || 'main'})`);
-      sendToTauri('tauri-cmd', { cmd: req.params.cmd, url: req.query.url, window: req.query.window });
-      res.sendStatus(200);
-    });
-    playerExpressApp.use(sameTabNavMiddleware(playerDir));
-    playerExpressApp.use(express.static(playerDir, {
-      etag: false,
-      setHeaders: (res) => {
-        res.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
-      }
-    }));
-    playerExpressApp.get('*', (req, res) => {
-      res.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
-      res.sendFile(path.join(playerDir, 'index.html'));
-    });
-    playerExpressServer = playerExpressApp.listen(3001, '127.0.0.1');
-    debugLog("Player Express running on 3001");
-
-    sendToTauri('status', { message: 'Waiting for microservices to bind ports (3000, 3001, 7860)...' });
-    await serviceManager.waitForPorts([3000, 3001, 7860]);
-    debugLog("Ports 3000, 3001, 7860 are ready.");
-
-    sendToTauri('status', { message: 'Binding UI server on port 4890...' });
-    const frontendDir = path.join(APPDATA_DIR, 'frontend');
-    expressApp = express();
-    expressApp.use((req, res, next) => {
-      res.header('Access-Control-Allow-Origin', '*');
-      res.header('Access-Control-Allow-Methods', 'GET,POST,OPTIONS');
-      res.header('Access-Control-Allow-Headers', '*');
-      if (req.method === 'OPTIONS') return res.sendStatus(200);
-      next();
-    });
-    expressApp.get('/__tauri_cmd/:cmd', (req, res) => {
-      debugLog(`[FRONTEND-SERVER:4890] Command received: ${req.params.cmd} (window: ${req.query.window || 'main'})`);
-      sendToTauri('tauri-cmd', { cmd: req.params.cmd, url: req.query.url, window: req.query.window });
-      res.sendStatus(200);
-    });
-
-    expressApp.use(sameTabNavMiddleware(frontendDir));
-    expressApp.use(express.static(frontendDir, {
-      etag: false,
-      setHeaders: (res) => {
-        res.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
-      }
-    }));
-    expressApp.get('*', (req, res) => {
-      res.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
-      res.sendFile(path.join(frontendDir, 'index.html'));
-    });
-
-    const FRONTEND_PORT = 4890;
-    expressApp.use('/build', express.static(path.join(__dirname, 'build')));
-    if (playerExpressApp) {
-      playerExpressApp.use('/build', express.static(path.join(__dirname, 'build')));
     }
+    debugLog("Ports 3000 and 4890 are ready.");
 
-    expressServer = expressApp.listen(FRONTEND_PORT, '127.0.0.1', () => {
+    sendToTauri('status', { message: 'All backend services running and healthy.' });
-      sendToTauri('status', { message: 'All backend services running and healthy.' });
+    debugLog("Sending READY to Tauri.");
-      debugLog("Frontend Express running on 4890. Sending READY to Tauri.");
+    sendToTauri('ready', { url: 'http://127.0.0.1:4890' });
-      sendToTauri('ready', { url: `http://localhost:${FRONTEND_PORT}` });
-    });
 
   } catch (error) {
     debugLog(`Fatal Start Error: ${error.message}`);
@@ -421,18 +367,7 @@ async function start() {
 
 process.on('exit', () => {
   if (serviceManager) {
-    for (const name of Object.keys(serviceManager.processes)) {
+    serviceManager.stopAll();
-      const proc = serviceManager.processes[name];
-      if (proc && proc.child && proc.child.pid) {
-        try {
-          if (process.platform === 'win32') {
-            require('child_process').spawnSync('taskkill', ['/F', '/T', '/PID', proc.child.pid.toString()], { stdio: 'ignore', windowsHide: true });
-          } else {
-            process.kill(-proc.child.pid, 'SIGKILL');
-          }
-        } catch (e) { }
-      }
-    }
   }
 });
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "vyla-home",
-  "version": "1.1.23",
+  "version": "1.1.54",
   "description": "Vyla Home Desktop App Launcher",
   "main": "main.js",
   "scripts": {
@@ -11,47 +11,15 @@
     "release:full": "node release.js --installer"
   },
   "dependencies": {
-    "@tauri-apps/api": "^2.0.0",
+    "@tauri-apps/api": "2.12.1",
-    "@tauri-apps/plugin-opener": "^2.0.0",
+    "@tauri-apps/plugin-opener": "2.7.0",
-    "@tauri-apps/plugin-process": "^2.0.0",
+    "@tauri-apps/plugin-process": "2.4.0",
-    "@tauri-apps/plugin-shell": "^2.0.0",
+    "@tauri-apps/plugin-shell": "2.5.0",
-    "@vyla-entertainment/sdk": "^1.11.0",
+    "@vyla-entertainment/sdk": "^1.20.0",
-    "adm-zip": "^0.6.0",
+    "adm-zip": "^0.6.1",
-    "express": "^4.19.2"
+    "express": "^4.22.3"
   },
   "devDependencies": {
-    "@tauri-apps/cli": "^2.0.0"
+    "@tauri-apps/cli": "2.12.1"
-  },
-  "build": {
-    "appId": "com.vyla.home",
-    "productName": "Vyla Home",
-    "directories": {
-      "output": "dist"
-    },
-    "files": [
-      "main.js",
-      "preload.js",
-      "service-manager.js",
-      "patcher.js",
-      "crypto-utils.js",
-      "credential-manager.js",
-      "update-client.js",
-      "gitlab-client.js",
-      "config/**/*",
-      "build/icon.ico",
-      "build/logo.txt",
-      "package.json"
-    ],
-    "win": {
-      "target": "nsis",
-      "icon": "build/icon.ico"
-    },
-    "nsis": {
-      "oneClick": false,
-      "allowToChangeInstallationDirectory": true,
-      "installerIcon": "build/icon.ico",
-      "uninstallerIcon": "build/icon.ico",
-      "installerHeaderIcon": "build/icon.ico"
-    }
   }
 }

patcher.js

@@ -63,50 +63,87 @@ class Patcher {
       const fullPath = path.join(this.appDataPath, dir);
       if (fs.existsSync(fullPath)) {
         try {
-          const trashPath = path.join(this.appDataPath, `.trash_${dir}_${Date.now()}`);
+          fs.rmSync(fullPath, { recursive: true, force: true });
-          fs.renameSync(fullPath, trashPath);
+        } catch (e) { }
-          fs.rmSync(trashPath, { recursive: true, force: true });
-        } catch (e) {
-          try {
-            fs.rmSync(fullPath, { recursive: true, force: true });
-          } catch (err2) { }
-        }
       }
     }
-    try {
-      const files = fs.readdirSync(this.appDataPath);
-      for (const file of files) {
-        if (file.startsWith('.trash_')) {
-          fs.rmSync(path.join(this.appDataPath, file), { recursive: true, force: true });
-        }
-      }
-    } catch (e) { }
   }
 
   extractZipPayload(zipPath) {
     const zip = new AdmZip(zipPath);
+    const entries = zip.getEntries();
+
+    if (!entries || entries.length === 0) {
+      throw new Error('Archive is empty, invalid, or truncated.');
+    }
+
+    const targetDir = path.resolve(this.appDataPath);
+    for (const entry of entries) {
+      const entryPath = path.normalize(entry.entryName);
+      const resolvedPath = path.resolve(targetDir, entryPath);
+      if (!resolvedPath.startsWith(targetDir)) {
+        throw new Error(`Directory traversal attempt detected in archive: ${entry.entryName}`);
+      }
+    }
+
     zip.extractAllTo(this.appDataPath, true);
   }
 
+  async extractToStaging(zipPath, onFile) {
+    const stagingDir = path.join(this.appDataPath, '.staging');
+    fs.rmSync(stagingDir, { recursive: true, force: true });
+    fs.mkdirSync(stagingDir, { recursive: true });
+    const zip = new AdmZip(zipPath);
+    const entries = zip.getEntries().filter((e) => !e.isDirectory);
+    if (entries.length === 0) {
+      throw new Error('Downloaded archive is empty, invalid, or truncated.');
+    }
+
+    const resolvedStaging = path.resolve(stagingDir);
+    for (const entry of entries) {
+      const entryPath = path.normalize(entry.entryName);
+      const resolvedPath = path.resolve(resolvedStaging, entryPath);
+      if (!resolvedPath.startsWith(resolvedStaging)) {
+        throw new Error(`Directory traversal attempt detected: ${entry.entryName}`);
+      }
+    }
+
+    for (let i = 0; i < entries.length; i++) {
+      const entry = entries[i];
+      zip.extractEntryTo(entry, stagingDir, true, true);
+      if (onFile) onFile(entry.entryName, i + 1, entries.length);
+      if (i % 20 === 0) await new Promise((resolve) => setImmediate(resolve));
+    }
+    return stagingDir;
+  }
+
+  commitStaging(stagingDir) {
+    this.purgeOldCode();
+    for (const name of fs.readdirSync(stagingDir)) {
+      const dest = path.join(this.appDataPath, name);
+      fs.rmSync(dest, { recursive: true, force: true });
+      fs.renameSync(path.join(stagingDir, name), dest);
+    }
+    fs.rmSync(stagingDir, { recursive: true, force: true });
+  }
+
   verifyChecksum(zipPath, expectedSha256) {
-    if (!expectedSha256) return true;
+    if (!expectedSha256) return false;
     const hash = crypto.createHash('sha256');
     const data = fs.readFileSync(zipPath);
     hash.update(data);
     const calculated = hash.digest('hex');
-    return calculated === expectedSha256;
+    return calculated === String(expectedSha256).trim().toLowerCase();
   }
 
-  verifyExtraction() {
+  verifyExtraction(root = this.appDataPath) {
     const requiredFiles = [
-      'player/index.html',
+      'frontend/server.js',
-      'auth-proxy/server.js',
+      'player/server.js'
-      'stream-api/server.js',
-      'frontend/index.html'
     ];
 
     for (const file of requiredFiles) {
-      const fullPath = path.join(this.appDataPath, file);
+      const fullPath = path.join(root, file);
       if (!fs.existsSync(fullPath)) {
         return false;
       }
@@ -114,12 +151,16 @@ class Patcher {
       if (stat.size === 0) {
         return false;
       }
-      const sampleSize = Math.min(stat.size, 4096);
+      try {
-      const fd = fs.openSync(fullPath, 'r');
+        const sampleSize = Math.min(stat.size, 4096);
-      const buffer = Buffer.alloc(sampleSize);
+        const fd = fs.openSync(fullPath, 'r');
-      fs.readSync(fd, buffer, 0, sampleSize, 0);
+        const buffer = Buffer.alloc(sampleSize);
-      fs.closeSync(fd);
+        fs.readSync(fd, buffer, 0, sampleSize, 0);
-      if (buffer.every(byte => byte === 0)) {
+        fs.closeSync(fd);
+        if (buffer.every(byte => byte === 0)) {
+          return false;
+        }
+      } catch (e) {
         return false;
       }
     }
@@ -136,7 +177,6 @@ class Patcher {
         if (file === 'node_modules' || file === '.git') continue;
         this.processDirectory(fullPath, replacementList);
       } else if (stat.isFile()) {
-        const ext = path.extname(fullPath).toLowerCase();
         let content = fs.readFileSync(fullPath, 'utf8');
         let modified = false;
 
@@ -155,7 +195,7 @@ class Patcher {
   }
 
   applyPatches(replacements) {
-    const targetDirs = ['frontend', 'player', 'auth-proxy', 'stream-api'];
+    const targetDirs = ['frontend', 'player'];
     for (const dirName of targetDirs) {
       const dirPath = path.join(this.appDataPath, dirName);
       if (!fs.existsSync(dirPath)) continue;

preload.js

@@ -1,5 +0,0 @@
-const { contextBridge, ipcRenderer } = require('electron');
-
-contextBridge.exposeInMainWorld('vylaHome', {
-  sendUpdateChoice: (choice) => ipcRenderer.send('update-choice', choice)
-});

service-manager.js

@@ -40,18 +40,22 @@ class ServiceManager {
     }
 
     let tokenSecret = process.env.TOKEN_SECRET ||
-      process.env.STREAM_API_TOKEN_SECRET ||
+      this.credentialManager.getCredential('player', 'TOKEN_SECRET');
-      this.credentialManager.getCredential('stream-api', 'TOKEN_SECRET');
 
     if (!tokenSecret || tokenSecret.length < 32) {
       tokenSecret = require('crypto').randomBytes(32).toString('hex');
-      this.credentialManager.setCredential('stream-api', 'TOKEN_SECRET', tokenSecret);
+      this.credentialManager.setCredential('player', 'TOKEN_SECRET', tokenSecret);
     }
 
+    const defaultPorts = {
+      player: 3000,
+      frontend: 4890
+    };
+
     const env = {
       ...process.env,
+      PORT: (this.envConfig[name] && this.envConfig[name].PORT) || defaultPorts[name] || process.env.PORT || 3000,
       TOKEN_SECRET: tokenSecret,
-      STREAM_API_TOKEN_SECRET: tokenSecret,
       ...(this.envConfig[name] || {}),
       ...(this.credentialManager.getServiceCredentials(name) || {})
     };
@@ -89,25 +93,6 @@ class ServiceManager {
     child.stderr.on('data', (data) => {
       const text = data.toString().trim();
       this.logToFile(name, `STDERR: ${text}`);
-
-      if (text.includes('EADDRINUSE')) {
-        const match = text.match(/:(\d+)/);
-        const port = match ? match[1] : null;
-        if (port) {
-          try {
-            if (process.platform === 'win32') {
-              require('child_process').spawnSync('powershell.exe', [
-                '-NoProfile',
-                '-NonInteractive',
-                '-Command',
-                `Get-NetTCPConnection -LocalPort ${port} -ErrorAction SilentlyContinue | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force }`
-              ], { stdio: 'ignore', windowsHide: true });
-            } else {
-              require('child_process').spawnSync('fuser', ['-k', '-9', `${port}/tcp`], { stdio: 'ignore' });
-            }
-          } catch (_) { }
-        }
-      }
     });
 
     child.on('exit', (code, signal) => {
@@ -140,7 +125,7 @@ class ServiceManager {
     ));
   }
 
-  async stopAll() {
+  stopAll() {
     this.isStopping = true;
     for (const name of Object.keys(this.stableTimers)) {
       if (this.stableTimers[name]) {
@@ -148,20 +133,14 @@ class ServiceManager {
       }
     }
     this.stableTimers = {};
-    const killPromises = Object.keys(this.processes).map((name) => {
+    for (const name of Object.keys(this.processes)) {
       const procInfo = this.processes[name];
       if (procInfo && procInfo.child) {
-        this.logToFile(name, `Killing service`);
+        try {
-        return new Promise((resolve) => {
+          procInfo.child.kill('SIGTERM');
-          procInfo.child.removeAllListeners('exit');
+        } catch (e) { }
-          procInfo.child.on('exit', () => resolve());
-          procInfo.child.kill();
-        });
       }
-      return Promise.resolve();
+    }
-    });
-
-    await Promise.all(killPromises);
     this.processes = {};
   }
 

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "vyla-home"
-version = "1.1.23"
+version = "1.1.54"
 description = "Vyla Home Desktop App Launcher"
 edition = "2021"
 
@@ -8,13 +8,14 @@ edition = "2021"
 tauri-build = { version = "2", features = [] }
 
 [dependencies]
-tauri = { version = "2", features = ["devtools"] }
+tauri = { version = "2", features = [] }
 tauri-plugin-opener = "2"
-tauri-plugin-process = "2"
-tauri-plugin-shell = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-base64 = "0.22"
+window-vibrancy = "0.8"
+
+[target.'cfg(target_os = "macos")'.dependencies]
+objc2 = "0.5"
 
 [profile.release]
 opt-level = 3

src-tauri/Info.plist

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>NSAppTransportSecurity</key>
+  <dict>
+    <key>NSAllowsLocalNetworking</key>
+    <true/>
+    <key>NSAllowsArbitraryLoads</key>
+    <true/>
+  </dict>
+</dict>
+</plist>

src-tauri/build.rs

@@ -1,6 +1,19 @@
 fn main() {
     println!("cargo:rerun-if-changed=src/main.rs");
     println!("cargo:rerun-if-changed=tauri.conf.json");
+    println!("cargo:rerun-if-changed=capabilities");
+    for f in [
+        "main.js",
+        "service-manager.js",
+        "file-updater.js",
+        "patcher.js",
+        "crypto-utils.js",
+        "credential-manager.js",
+        "update-client.js",
+    ] {
+        println!("cargo:rerun-if-changed=../{}", f);
+    }
+    println!("cargo:rerun-if-changed=../config");
     
     if std::env::var("CARGO_CFG_TARGET_OS").unwrap_or_default() == "windows" {
         if let (Ok(manifest_dir), Ok(out_dir)) = (std::env::var("CARGO_MANIFEST_DIR"), std::env::var("OUT_DIR")) {
@@ -16,5 +29,28 @@ fn main() {
         }
     }
 
-    tauri_build::build();
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let node_path = std::path::Path::new("../bin/node");
+        if node_path.exists() {
+            let _ = std::fs::set_permissions(
+                node_path,
+                std::fs::Permissions::from_mode(0o755),
+            );
+        }
+    }
+    
+    tauri_build::try_build(
+        tauri_build::Attributes::new().app_manifest(
+            tauri_build::AppManifest::new().commands(&[
+                "win_minimize",
+                "win_maximize",
+                "win_close",
+                "win_drag",
+                "open_new_window",
+            ]),
+        ),
+    )
+    .expect("failed to run tauri-build");
 }

src-tauri/capabilities/default.json

@@ -1,40 +1,42 @@
 {
     "$schema": "../gen/schemas/desktop-schema.json",
     "identifier": "default",
-    "description": "Default permissions for Vyla Home main window and popups",
+    "description": "Window and opener permissions for local and localhost-served pages",
+    "local": true,
     "windows": [
-        "main",
+        "*"
-        "win_*"
+    ],
+    "webviews": [
+        "*"
     ],
     "remote": {
         "urls": [
-            "http://localhost:4890/*",
+            "http://localhost:*",
-            "http://localhost:3001/*",
+            "http://localhost:*/*",
-            "http://localhost:3000/*",
+            "http://127.0.0.1:*",
-            "http://localhost:7860/*",
+            "http://127.0.0.1:*/*"
-            "http://127.0.0.1:4890/*",
-            "http://127.0.0.1:3001/*",
-            "http://127.0.0.1:3000/*",
-            "http://127.0.0.1:7860/*"
         ]
     },
     "permissions": [
-        "core:default",
-        "core:window:allow-minimize",
-        "core:window:allow-maximize",
-        "core:window:allow-unmaximize",
-        "core:window:allow-is-maximized",
-        "core:window:allow-close",
-        "core:window:allow-start-dragging",
-        "core:webview:allow-create-webview-window",
-        "core:webview:allow-print",
-        "shell:allow-open",
-        "process:allow-exit",
-        "core:app:default",
         "allow-win-minimize",
         "allow-win-maximize",
         "allow-win-close",
         "allow-win-drag",
-        "allow-open-new-window"
+        "allow-open-new-window",
+        "core:default",
+        "core:window:allow-start-dragging",
+        "core:window:allow-minimize",
+        "core:window:allow-maximize",
+        "core:window:allow-unmaximize",
+        "core:window:allow-toggle-maximize",
+        "core:window:allow-close",
+        "core:window:allow-destroy",
+        "core:window:allow-is-maximized",
+        "core:window:allow-is-fullscreen",
+        "core:window:allow-set-fullscreen",
+        "core:window:allow-set-focus",
+        "core:window:allow-show",
+        "core:window:allow-hide",
+        "opener:default"
     ]
 }

src-tauri/gen/schemas/capabilities.json

@@ -1 +1 @@
-{"default":{"identifier":"default","description":"Default permissions for Vyla Home main window and popups","remote":{"urls":["http://localhost:4890/*","http://localhost:3001/*","http://localhost:3000/*","http://localhost:7860/*","http://127.0.0.1:4890/*","http://127.0.0.1:3001/*","http://127.0.0.1:3000/*","http://127.0.0.1:7860/*"]},"local":true,"windows":["main","win_*"],"permissions":["core:default","core:window:allow-minimize","core:window:allow-maximize","core:window:allow-unmaximize","core:window:allow-is-maximized","core:window:allow-close","core:window:allow-start-dragging","core:webview:allow-create-webview-window","core:webview:allow-print","shell:allow-open","process:allow-exit","core:app:default","allow-win-minimize","allow-win-maximize","allow-win-close","allow-win-drag","allow-open-new-window"]}}
+{"default":{"identifier":"default","description":"Window and opener permissions for local and localhost-served pages","remote":{"urls":["http://localhost:*","http://localhost:*/*","http://127.0.0.1:*","http://127.0.0.1:*/*"]},"local":true,"windows":["*"],"webviews":["*"],"permissions":["allow-win-minimize","allow-win-maximize","allow-win-close","allow-win-drag","allow-open-new-window","core:default","core:window:allow-start-dragging","core:window:allow-minimize","core:window:allow-maximize","core:window:allow-unmaximize","core:window:allow-toggle-maximize","core:window:allow-close","core:window:allow-destroy","core:window:allow-is-maximized","core:window:allow-is-fullscreen","core:window:allow-set-fullscreen","core:window:allow-set-focus","core:window:allow-show","core:window:allow-hide","opener:default"]}}

src-tauri/gen/schemas/desktop-schema.json

@@ -302,216 +302,6 @@
                 }
               }
             },
-            {
-              "if": {
-                "properties": {
-                  "identifier": {
-                    "anyOf": [
-                      {
-                        "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
-                        "type": "string",
-                        "const": "shell:default",
-                        "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
-                      },
-                      {
-                        "description": "Enables the execute command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-execute",
-                        "markdownDescription": "Enables the execute command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the kill command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-kill",
-                        "markdownDescription": "Enables the kill command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the open command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-open",
-                        "markdownDescription": "Enables the open command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the spawn command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-spawn",
-                        "markdownDescription": "Enables the spawn command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the stdin_write command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-stdin-write",
-                        "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the execute command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-execute",
-                        "markdownDescription": "Denies the execute command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the kill command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-kill",
-                        "markdownDescription": "Denies the kill command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the open command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-open",
-                        "markdownDescription": "Denies the open command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the spawn command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-spawn",
-                        "markdownDescription": "Denies the spawn command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the stdin_write command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-stdin-write",
-                        "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
-                      }
-                    ]
-                  }
-                }
-              },
-              "then": {
-                "properties": {
-                  "allow": {
-                    "items": {
-                      "title": "ShellScopeEntry",
-                      "description": "Shell scope entry.",
-                      "anyOf": [
-                        {
-                          "type": "object",
-                          "required": [
-                            "cmd",
-                            "name"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "cmd": {
-                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
-                              "type": "string"
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            }
-                          },
-                          "additionalProperties": false
-                        },
-                        {
-                          "type": "object",
-                          "required": [
-                            "name",
-                            "sidecar"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            },
-                            "sidecar": {
-                              "description": "If this command is a sidecar command.",
-                              "type": "boolean"
-                            }
-                          },
-                          "additionalProperties": false
-                        }
-                      ]
-                    }
-                  },
-                  "deny": {
-                    "items": {
-                      "title": "ShellScopeEntry",
-                      "description": "Shell scope entry.",
-                      "anyOf": [
-                        {
-                          "type": "object",
-                          "required": [
-                            "cmd",
-                            "name"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "cmd": {
-                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
-                              "type": "string"
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            }
-                          },
-                          "additionalProperties": false
-                        },
-                        {
-                          "type": "object",
-                          "required": [
-                            "name",
-                            "sidecar"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            },
-                            "sidecar": {
-                              "description": "If this command is a sidecar command.",
-                              "type": "boolean"
-                            }
-                          },
-                          "additionalProperties": false
-                        }
-                      ]
-                    }
-                  }
-                }
-              },
-              "properties": {
-                "identifier": {
-                  "description": "Identifier of the permission or permission set.",
-                  "allOf": [
-                    {
-                      "$ref": "#/definitions/Identifier"
-                    }
-                  ]
-                }
-              }
-            },
             {
               "properties": {
                 "identifier": {
@@ -590,6 +380,36 @@
           "const": "allow-win-minimize",
           "markdownDescription": "Allows minimizing the window"
         },
+        {
+          "description": "Denies the open_new_window command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-open-new-window",
+          "markdownDescription": "Denies the open_new_window command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_close command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-close",
+          "markdownDescription": "Denies the win_close command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_drag command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-drag",
+          "markdownDescription": "Denies the win_drag command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_maximize command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-maximize",
+          "markdownDescription": "Denies the win_maximize command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_minimize command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-minimize",
+          "markdownDescription": "Denies the win_minimize command without any pre-configured scope."
+        },
         {
           "description": "Default core plugins set.\n#### This default permission set includes:\n\n- `core:path:default`\n- `core:event:default`\n- `core:window:default`\n- `core:webview:default`\n- `core:app:default`\n- `core:image:default`\n- `core:resources:default`\n- `core:menu:default`\n- `core:tray:default`",
           "type": "string",
@@ -626,6 +446,12 @@
           "const": "core:app:allow-default-window-icon",
           "markdownDescription": "Enables the default_window_icon command without any pre-configured scope."
         },
+        {
+          "description": "Enables the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-exit",
+          "markdownDescription": "Enables the exit command without any pre-configured scope."
+        },
         {
           "description": "Enables the fetch_data_store_identifiers command without any pre-configured scope.",
           "type": "string",
@@ -716,6 +542,12 @@
           "const": "core:app:deny-default-window-icon",
           "markdownDescription": "Denies the default_window_icon command without any pre-configured scope."
         },
+        {
+          "description": "Denies the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-exit",
+          "markdownDescription": "Denies the exit command without any pre-configured scope."
+        },
         {
           "description": "Denies the fetch_data_store_identifiers command without any pre-configured scope.",
           "type": "string",
@@ -1976,6 +1808,12 @@
           "const": "core:window:allow-set-fullscreen",
           "markdownDescription": "Enables the set_fullscreen command without any pre-configured scope."
         },
+        {
+          "description": "Enables the set_fullscreen_on_monitor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-fullscreen-on-monitor",
+          "markdownDescription": "Enables the set_fullscreen_on_monitor command without any pre-configured scope."
+        },
         {
           "description": "Enables the set_icon command without any pre-configured scope.",
           "type": "string",
@@ -2444,6 +2282,12 @@
           "const": "core:window:deny-set-fullscreen",
           "markdownDescription": "Denies the set_fullscreen command without any pre-configured scope."
         },
+        {
+          "description": "Denies the set_fullscreen_on_monitor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-fullscreen-on-monitor",
+          "markdownDescription": "Denies the set_fullscreen_on_monitor command without any pre-configured scope."
+        },
         {
           "description": "Denies the set_icon command without any pre-configured scope.",
           "type": "string",
@@ -2653,102 +2497,6 @@
           "type": "string",
           "const": "opener:deny-reveal-item-in-dir",
           "markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
-        },
-        {
-          "description": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`",
-          "type": "string",
-          "const": "process:default",
-          "markdownDescription": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`"
-        },
-        {
-          "description": "Enables the exit command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:allow-exit",
-          "markdownDescription": "Enables the exit command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the restart command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:allow-restart",
-          "markdownDescription": "Enables the restart command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the exit command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:deny-exit",
-          "markdownDescription": "Denies the exit command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the restart command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:deny-restart",
-          "markdownDescription": "Denies the restart command without any pre-configured scope."
-        },
-        {
-          "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
-          "type": "string",
-          "const": "shell:default",
-          "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
-        },
-        {
-          "description": "Enables the execute command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-execute",
-          "markdownDescription": "Enables the execute command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the kill command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-kill",
-          "markdownDescription": "Enables the kill command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the open command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-open",
-          "markdownDescription": "Enables the open command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the spawn command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-spawn",
-          "markdownDescription": "Enables the spawn command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the stdin_write command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-stdin-write",
-          "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the execute command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-execute",
-          "markdownDescription": "Denies the execute command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the kill command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-kill",
-          "markdownDescription": "Denies the kill command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the open command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-open",
-          "markdownDescription": "Denies the open command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the spawn command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-spawn",
-          "markdownDescription": "Denies the spawn command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the stdin_write command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-stdin-write",
-          "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
         }
       ]
     },
@@ -2862,50 +2610,6 @@
           "type": "string"
         }
       ]
-    },
-    "ShellScopeEntryAllowedArg": {
-      "description": "A command argument allowed to be executed by the webview API.",
-      "anyOf": [
-        {
-          "description": "A non-configurable argument that is passed to the command in the order it was specified.",
-          "type": "string"
-        },
-        {
-          "description": "A variable that is set while calling the command from the webview API.",
-          "type": "object",
-          "required": [
-            "validator"
-          ],
-          "properties": {
-            "raw": {
-              "description": "Marks the validator as a raw regex, meaning the plugin should not make any modification at runtime.\n\nThis means the regex will not match on the entire string by default, which might be exploited if your regex allow unexpected input to be considered valid. When using this option, make sure your regex is correct.",
-              "default": false,
-              "type": "boolean"
-            },
-            "validator": {
-              "description": "[regex] validator to require passed values to conform to an expected input.\n\nThis will require the argument value passed to this variable to match the `validator` regex before it will be executed.\n\nThe regex string is by default surrounded by `^...$` to match the full string. For example the `https?://\\w+` regex would be registered as `^https?://\\w+$`.\n\n[regex]: <https://docs.rs/regex/latest/regex/#syntax>",
-              "type": "string"
-            }
-          },
-          "additionalProperties": false
-        }
-      ]
-    },
-    "ShellScopeEntryAllowedArgs": {
-      "description": "A set of command arguments allowed to be executed by the webview API.\n\nA value of `true` will allow any arguments to be passed to the command. `false` will disable all arguments. A list of [`ShellScopeEntryAllowedArg`] will set those arguments as the only valid arguments to be passed to the attached command configuration.",
-      "anyOf": [
-        {
-          "description": "Use a simple boolean to allow all or disable all arguments to this command configuration.",
-          "type": "boolean"
-        },
-        {
-          "description": "A specific set of [`ShellScopeEntryAllowedArg`] that are valid to call for the command configuration.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/ShellScopeEntryAllowedArg"
-          }
-        }
-      ]
     }
   }
 }

src-tauri/gen/schemas/windows-schema.json

@@ -302,216 +302,6 @@
                 }
               }
             },
-            {
-              "if": {
-                "properties": {
-                  "identifier": {
-                    "anyOf": [
-                      {
-                        "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
-                        "type": "string",
-                        "const": "shell:default",
-                        "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
-                      },
-                      {
-                        "description": "Enables the execute command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-execute",
-                        "markdownDescription": "Enables the execute command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the kill command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-kill",
-                        "markdownDescription": "Enables the kill command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the open command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-open",
-                        "markdownDescription": "Enables the open command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the spawn command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-spawn",
-                        "markdownDescription": "Enables the spawn command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the stdin_write command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-stdin-write",
-                        "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the execute command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-execute",
-                        "markdownDescription": "Denies the execute command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the kill command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-kill",
-                        "markdownDescription": "Denies the kill command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the open command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-open",
-                        "markdownDescription": "Denies the open command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the spawn command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-spawn",
-                        "markdownDescription": "Denies the spawn command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the stdin_write command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-stdin-write",
-                        "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
-                      }
-                    ]
-                  }
-                }
-              },
-              "then": {
-                "properties": {
-                  "allow": {
-                    "items": {
-                      "title": "ShellScopeEntry",
-                      "description": "Shell scope entry.",
-                      "anyOf": [
-                        {
-                          "type": "object",
-                          "required": [
-                            "cmd",
-                            "name"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "cmd": {
-                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
-                              "type": "string"
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            }
-                          },
-                          "additionalProperties": false
-                        },
-                        {
-                          "type": "object",
-                          "required": [
-                            "name",
-                            "sidecar"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            },
-                            "sidecar": {
-                              "description": "If this command is a sidecar command.",
-                              "type": "boolean"
-                            }
-                          },
-                          "additionalProperties": false
-                        }
-                      ]
-                    }
-                  },
-                  "deny": {
-                    "items": {
-                      "title": "ShellScopeEntry",
-                      "description": "Shell scope entry.",
-                      "anyOf": [
-                        {
-                          "type": "object",
-                          "required": [
-                            "cmd",
-                            "name"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "cmd": {
-                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
-                              "type": "string"
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            }
-                          },
-                          "additionalProperties": false
-                        },
-                        {
-                          "type": "object",
-                          "required": [
-                            "name",
-                            "sidecar"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            },
-                            "sidecar": {
-                              "description": "If this command is a sidecar command.",
-                              "type": "boolean"
-                            }
-                          },
-                          "additionalProperties": false
-                        }
-                      ]
-                    }
-                  }
-                }
-              },
-              "properties": {
-                "identifier": {
-                  "description": "Identifier of the permission or permission set.",
-                  "allOf": [
-                    {
-                      "$ref": "#/definitions/Identifier"
-                    }
-                  ]
-                }
-              }
-            },
             {
               "properties": {
                 "identifier": {
@@ -590,6 +380,36 @@
           "const": "allow-win-minimize",
           "markdownDescription": "Allows minimizing the window"
         },
+        {
+          "description": "Denies the open_new_window command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-open-new-window",
+          "markdownDescription": "Denies the open_new_window command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_close command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-close",
+          "markdownDescription": "Denies the win_close command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_drag command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-drag",
+          "markdownDescription": "Denies the win_drag command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_maximize command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-maximize",
+          "markdownDescription": "Denies the win_maximize command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_minimize command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-minimize",
+          "markdownDescription": "Denies the win_minimize command without any pre-configured scope."
+        },
         {
           "description": "Default core plugins set.\n#### This default permission set includes:\n\n- `core:path:default`\n- `core:event:default`\n- `core:window:default`\n- `core:webview:default`\n- `core:app:default`\n- `core:image:default`\n- `core:resources:default`\n- `core:menu:default`\n- `core:tray:default`",
           "type": "string",
@@ -626,6 +446,12 @@
           "const": "core:app:allow-default-window-icon",
           "markdownDescription": "Enables the default_window_icon command without any pre-configured scope."
         },
+        {
+          "description": "Enables the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-exit",
+          "markdownDescription": "Enables the exit command without any pre-configured scope."
+        },
         {
           "description": "Enables the fetch_data_store_identifiers command without any pre-configured scope.",
           "type": "string",
@@ -716,6 +542,12 @@
           "const": "core:app:deny-default-window-icon",
           "markdownDescription": "Denies the default_window_icon command without any pre-configured scope."
         },
+        {
+          "description": "Denies the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-exit",
+          "markdownDescription": "Denies the exit command without any pre-configured scope."
+        },
         {
           "description": "Denies the fetch_data_store_identifiers command without any pre-configured scope.",
           "type": "string",
@@ -1976,6 +1808,12 @@
           "const": "core:window:allow-set-fullscreen",
           "markdownDescription": "Enables the set_fullscreen command without any pre-configured scope."
         },
+        {
+          "description": "Enables the set_fullscreen_on_monitor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-fullscreen-on-monitor",
+          "markdownDescription": "Enables the set_fullscreen_on_monitor command without any pre-configured scope."
+        },
         {
           "description": "Enables the set_icon command without any pre-configured scope.",
           "type": "string",
@@ -2444,6 +2282,12 @@
           "const": "core:window:deny-set-fullscreen",
           "markdownDescription": "Denies the set_fullscreen command without any pre-configured scope."
         },
+        {
+          "description": "Denies the set_fullscreen_on_monitor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-fullscreen-on-monitor",
+          "markdownDescription": "Denies the set_fullscreen_on_monitor command without any pre-configured scope."
+        },
         {
           "description": "Denies the set_icon command without any pre-configured scope.",
           "type": "string",
@@ -2653,102 +2497,6 @@
           "type": "string",
           "const": "opener:deny-reveal-item-in-dir",
           "markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
-        },
-        {
-          "description": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`",
-          "type": "string",
-          "const": "process:default",
-          "markdownDescription": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`"
-        },
-        {
-          "description": "Enables the exit command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:allow-exit",
-          "markdownDescription": "Enables the exit command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the restart command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:allow-restart",
-          "markdownDescription": "Enables the restart command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the exit command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:deny-exit",
-          "markdownDescription": "Denies the exit command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the restart command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:deny-restart",
-          "markdownDescription": "Denies the restart command without any pre-configured scope."
-        },
-        {
-          "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
-          "type": "string",
-          "const": "shell:default",
-          "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
-        },
-        {
-          "description": "Enables the execute command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-execute",
-          "markdownDescription": "Enables the execute command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the kill command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-kill",
-          "markdownDescription": "Enables the kill command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the open command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-open",
-          "markdownDescription": "Enables the open command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the spawn command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-spawn",
-          "markdownDescription": "Enables the spawn command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the stdin_write command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-stdin-write",
-          "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the execute command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-execute",
-          "markdownDescription": "Denies the execute command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the kill command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-kill",
-          "markdownDescription": "Denies the kill command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the open command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-open",
-          "markdownDescription": "Denies the open command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the spawn command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-spawn",
-          "markdownDescription": "Denies the spawn command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the stdin_write command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-stdin-write",
-          "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
         }
       ]
     },
@@ -2862,50 +2610,6 @@
           "type": "string"
         }
       ]
-    },
-    "ShellScopeEntryAllowedArg": {
-      "description": "A command argument allowed to be executed by the webview API.",
-      "anyOf": [
-        {
-          "description": "A non-configurable argument that is passed to the command in the order it was specified.",
-          "type": "string"
-        },
-        {
-          "description": "A variable that is set while calling the command from the webview API.",
-          "type": "object",
-          "required": [
-            "validator"
-          ],
-          "properties": {
-            "raw": {
-              "description": "Marks the validator as a raw regex, meaning the plugin should not make any modification at runtime.\n\nThis means the regex will not match on the entire string by default, which might be exploited if your regex allow unexpected input to be considered valid. When using this option, make sure your regex is correct.",
-              "default": false,
-              "type": "boolean"
-            },
-            "validator": {
-              "description": "[regex] validator to require passed values to conform to an expected input.\n\nThis will require the argument value passed to this variable to match the `validator` regex before it will be executed.\n\nThe regex string is by default surrounded by `^...$` to match the full string. For example the `https?://\\w+` regex would be registered as `^https?://\\w+$`.\n\n[regex]: <https://docs.rs/regex/latest/regex/#syntax>",
-              "type": "string"
-            }
-          },
-          "additionalProperties": false
-        }
-      ]
-    },
-    "ShellScopeEntryAllowedArgs": {
-      "description": "A set of command arguments allowed to be executed by the webview API.\n\nA value of `true` will allow any arguments to be passed to the command. `false` will disable all arguments. A list of [`ShellScopeEntryAllowedArg`] will set those arguments as the only valid arguments to be passed to the attached command configuration.",
-      "anyOf": [
-        {
-          "description": "Use a simple boolean to allow all or disable all arguments to this command configuration.",
-          "type": "boolean"
-        },
-        {
-          "description": "A specific set of [`ShellScopeEntryAllowedArg`] that are valid to call for the command configuration.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/ShellScopeEntryAllowedArg"
-          }
-        }
-      ]
     }
   }
 }

src-tauri/permissions/autogenerated/open_new_window.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-open-new-window"
+description = "Enables the open_new_window command without any pre-configured scope."
+commands.allow = ["open_new_window"]
+
+[[permission]]
+identifier = "deny-open-new-window"
+description = "Denies the open_new_window command without any pre-configured scope."
+commands.deny = ["open_new_window"]

src-tauri/permissions/autogenerated/win_close.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-win-close"
+description = "Enables the win_close command without any pre-configured scope."
+commands.allow = ["win_close"]
+
+[[permission]]
+identifier = "deny-win-close"
+description = "Denies the win_close command without any pre-configured scope."
+commands.deny = ["win_close"]

src-tauri/permissions/autogenerated/win_drag.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-win-drag"
+description = "Enables the win_drag command without any pre-configured scope."
+commands.allow = ["win_drag"]
+
+[[permission]]
+identifier = "deny-win-drag"
+description = "Denies the win_drag command without any pre-configured scope."
+commands.deny = ["win_drag"]

src-tauri/permissions/autogenerated/win_maximize.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-win-maximize"
+description = "Enables the win_maximize command without any pre-configured scope."
+commands.allow = ["win_maximize"]
+
+[[permission]]
+identifier = "deny-win-maximize"
+description = "Denies the win_maximize command without any pre-configured scope."
+commands.deny = ["win_maximize"]

src-tauri/permissions/autogenerated/win_minimize.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-win-minimize"
+description = "Enables the win_minimize command without any pre-configured scope."
+commands.allow = ["win_minimize"]
+
+[[permission]]
+identifier = "deny-win-minimize"
+description = "Denies the win_minimize command without any pre-configured scope."
+commands.deny = ["win_minimize"]

src-tauri/permissions/default.toml

@@ -3,27 +3,32 @@
 [[permission]]
 identifier = "allow-win-minimize"
 description = "Allows minimizing the window"
-commands.allow = ["win_minimize"]
+[[permission.allow]]
+cmd = "win_minimize"
 
 [[permission]]
 identifier = "allow-win-maximize"
 description = "Allows maximizing/unmaximizing the window"
-commands.allow = ["win_maximize"]
+[[permission.allow]]
+cmd = "win_maximize"
 
 [[permission]]
 identifier = "allow-win-close"
 description = "Allows closing the window"
-commands.allow = ["win_close"]
+[[permission.allow]]
+cmd = "win_close"
 
 [[permission]]
 identifier = "allow-win-drag"
 description = "Allows dragging the window"
-commands.allow = ["win_drag"]
+[[permission.allow]]
+cmd = "win_drag"
 
 [[permission]]
 identifier = "allow-open-new-window"
 description = "Allows opening a new webview window"
-commands.allow = ["open_new_window"]
+[[permission.allow]]
+cmd = "open_new_window"
 
 [[set]]
 identifier = "default"

src-tauri/src/main.rs

@@ -2,16 +2,25 @@
 
 use std::path::PathBuf;
 use std::process::{Child, Command, Stdio};
-use std::sync::Mutex;
+use std::sync::{Arc, Mutex};
-use tauri::{Emitter, Manager, State, WebviewUrl, WebviewWindowBuilder};
+use tauri::webview::NewWindowResponse;
+use tauri::{AppHandle, Emitter, Manager, State, WebviewUrl, WebviewWindowBuilder};
 
 fn debug_log(msg: &str) {
     let log_dir = if let Ok(app_data) = std::env::var("APPDATA") {
-        std::path::PathBuf::from(app_data).join("vyla-home").join("vyla-home-files").join("logs")
+        std::path::PathBuf::from(app_data)
-    } else if let Ok(home) = std::env::var("HOME") {
+            .join("vyla-home")
-        std::path::PathBuf::from(home).join("Library").join("Logs").join("VylaHome")
+            .join("vyla-home-files")
+            .join("logs")
+    } else if let Ok(_home) = std::env::var("HOME") {
+        std::path::PathBuf::from(_home)
+            .join("Library")
+            .join("Logs")
+            .join("VylaHome")
     } else if let Ok(user_profile) = std::env::var("USERPROFILE") {
-        std::path::PathBuf::from(user_profile).join(".vyla-home").join("logs")
+        std::path::PathBuf::from(user_profile)
+            .join(".vyla-home")
+            .join("logs")
     } else {
         std::env::temp_dir().join("vyla-home-logs")
     };
@@ -19,7 +28,11 @@ fn debug_log(msg: &str) {
     let _ = std::fs::create_dir_all(&log_dir);
     let log_path = log_dir.join("rust-debug.log");
 
-    if let Ok(mut file) = std::fs::OpenOptions::new().create(true).append(true).open(&log_path) {
+    if let Ok(mut file) = std::fs::OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(&log_path)
+    {
         use std::io::Write;
         let _ = writeln!(file, "[RUST] {}", msg);
     }
@@ -27,15 +40,44 @@ fn debug_log(msg: &str) {
 
 struct NodeServices(Mutex<Option<Child>>);
 
+static WINDOW_COUNTER: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(1);
+
+static READY_URL: Mutex<Option<String>> = Mutex::new(None);
+
+fn js_log(app: &AppHandle, msg: &str) {
+    debug_log(msg);
+    if let Some(w) = app.get_webview_window("main") {
+        let text = serde_json::to_string(&format!("[rust] {}", msg)).unwrap_or_default();
+        let _ = w.eval(&format!("console.log({});", text));
+    }
+}
+
 #[derive(serde::Deserialize, serde::Serialize, Clone)]
 struct BackendMessage {
     event: String,
     data: serde_json::Value,
 }
 
+struct UiGate {
+    ready: bool,
+    queue: Vec<BackendMessage>,
+}
+
+type SharedGate = Arc<Mutex<UiGate>>;
+
+fn dispatch(w: &tauri::WebviewWindow, gate: &SharedGate, msg: BackendMessage) {
+    if let Ok(mut lock) = gate.lock() {
+        if lock.ready {
+            let _ = w.emit(&msg.event, msg.data);
+        } else {
+            lock.queue.push(msg);
+        }
+    }
+}
+
 fn clean_path(path: &std::path::Path) -> String {
     let s = path.to_string_lossy().to_string();
-    if s.starts_with("\\\\?\\") {
+    if s.starts_with(r"\\?\") {
         s[4..].to_string()
     } else {
         s
@@ -109,6 +151,7 @@ fn find_node_binary(app: &tauri::App) -> Option<String> {
             if node_exe.exists() {
                 return Some(clean_path(&node_exe));
             }
+
             let node = p.join("node");
             if node.exists() {
                 return Some(clean_path(&node));
@@ -166,7 +209,6 @@ fn resolve_script_and_root(app: &tauri::App) -> (String, String) {
             resource_dir.join("_up_").join("main.js"),
             resource_dir.join("up").join("main.js"),
         ];
-
         for candidate in candidates {
             if candidate.exists() {
                 let root_dir = candidate.parent().unwrap();
@@ -191,28 +233,89 @@ const LINK_HANDLER_SCRIPT: &str = r##"
         return Promise.resolve(null);
     }
 
-    function minimizeWindow() { doInvoke('win_minimize'); }
+    function callWindow(method, fallbackCmd) {
-    function maximizeWindow() { doInvoke('win_maximize'); }
+        const fallback = () => doInvoke(fallbackCmd).catch(err => console.error(fallbackCmd + ' failed:', err));
-    function closeWindow() { doInvoke('win_close'); }
+        try {
-    function dragWindow() { doInvoke('win_drag'); }
+            if (window.__TAURI__ && window.__TAURI__.window) {
+                return window.__TAURI__.window.getCurrentWindow()[method]().catch(fallback);
+            }
+        } catch (err) {}
+        return fallback();
+    }
+    function minimizeWindow() {
+        return callWindow('minimize', 'win_minimize');
+    }
+    function maximizeWindow() {
+        return callWindow('toggleMaximize', 'win_maximize');
+    }
+    function closeWindow() {
+        return callWindow('close', 'win_close');
+    }
+    function dragWindow() {
+        return callWindow('startDragging', 'win_drag');
+    }
 
     function openExternalUrl(url) {
         if (window.__TAURI__ && window.__TAURI__.opener) {
             window.__TAURI__.opener.openUrl(url);
-        } else if (window.__TAURI__ && window.__TAURI__.shell) {
-            window.__TAURI__.shell.open(url);
         } else {
             window.open(url, '_blank');
         }
     }
 
+    const nativeWindowOpen = window.open.bind(window);
+
+    function openInNewWindow(rawUrl) {
+        let abs;
+        try {
+            abs = new URL(rawUrl, location.href).href;
+        } catch (err) {
+            console.log('[vyla] bad url', rawUrl);
+            return;
+        }
+        console.log('[vyla] open new window', abs);
+        nativeWindowOpen(abs, '_blank');
+    }
+
     window.open = function(url, target, features) {
-        doInvoke('open_new_window', { url: url });
+        console.log('[vyla] window.open called', url, target, features);
-        return null;
+        const go = (v) => {
+            if (v && !/^(about:|javascript:|blob:|data:)/i.test(String(v))) {
+                openInNewWindow(String(v));
+            }
+        };
+        go(url);
+        const stub = {
+            closed: false,
+            close() {},
+            focus() {},
+            blur() {},
+            postMessage() {},
+            document: { write() {}, writeln() {}, close() {}, open() {} }
+        };
+        Object.defineProperty(stub, 'location', {
+            get() {
+                return { href: '', replace: go, assign: go };
+            },
+            set(v) {
+                go(v);
+            }
+        });
+        return stub;
     };
 
-    document.addEventListener('click', (e) => {
+    const origAnchorClick = HTMLAnchorElement.prototype.click;
-        const a = e.target.closest('a');
+    HTMLAnchorElement.prototype.click = function() {
+        if (this.href && this.target === '_blank' && !this.isConnected) {
+            console.log('[vyla] detached anchor click', this.href);
+            openInNewWindow(this.href);
+            return;
+        }
+        return origAnchorClick.apply(this, arguments);
+    };
+
+    function handleLinkClick(e) {
+        const a = e.target.closest && e.target.closest('a');
         if (!a || !a.href) return;
 
         if (a.href.includes('discord.gg') || a.href.includes('discord.com')) {
@@ -225,118 +328,19 @@ const LINK_HANDLER_SCRIPT: &str = r##"
         if (a.target === '_blank' || e.ctrlKey || e.metaKey || e.button === 1) {
             e.preventDefault();
             e.stopPropagation();
-            doInvoke('open_new_window', { url: a.href });
+            openInNewWindow(a.href);
         }
-    }, true);
+    }
+
+    document.addEventListener('click', handleLinkClick, true);
+    document.addEventListener('auxclick', handleLinkClick, true);
 
     function injectLiquidNavBar() {
-        if (document.getElementById('vyla-floating-nav')) return;
+        if (document.getElementById('tauri-custom-titlebar')) return;
         if (!document.body) return;
 
         const style = document.createElement('style');
         style.innerHTML = `
-            #vyla-floating-nav {
-                position: fixed !important;
-                top: 12px !important;
-                left: 12px !important;
-                z-index: 2147483647 !important;
-                height: 42px !important;
-                width: 42px !important;
-                border-radius: 9999px !important;
-                display: flex !important;
-                align-items: center !important;
-                background: rgba(255, 255, 255, 0.04) !important;
-                backdrop-filter: blur(16px) saturate(1.8) contrast(1.1) !important;
-                -webkit-backdrop-filter: blur(16px) saturate(1.8) contrast(1.1) !important;
-                box-shadow: 0 8px 32px rgba(0, 0, 0, 0.45) !important;
-                transition: width 0.3s cubic-bezier(0.16, 1, 0.3, 1), padding 0.3s cubic-bezier(0.16, 1, 0.3, 1) !important;
-                overflow: hidden !important;
-                padding: 0 !important;
-                user-select: none !important;
-                pointer-events: auto !important;
-                -webkit-app-region: no-drag !important;
-            }
-
-            #vyla-floating-nav:hover {
-                width: 82px !important;
-                padding-right: 6px !important;
-            }
-
-            .vyla-nav-logo-wrap {
-                width: 42px !important;
-                min-width: 42px !important;
-                height: 42px !important;
-                display: flex !important;
-                align-items: center !important;
-                justify-content: center !important;
-                cursor: pointer !important;
-                border-radius: 9999px !important;
-                position: relative !important;
-                z-index: 2147483647 !important;
-                pointer-events: auto !important;
-                padding: 0 !important;
-            }
-
-            .vyla-nav-logo-wrap img {
-                width: 26px !important;
-                height: 26px !important;
-                min-width: 26px !important;
-                min-height: 26px !important;
-                object-fit: contain !important;
-                pointer-events: none !important;
-                display: block !important;
-            }
-
-            .vyla-nav-links {
-                display: flex !important;
-                align-items: center !important;
-                gap: 4px !important;
-                opacity: 0 !important;
-                transform: translateX(-6px) !important;
-                transition: opacity 0.2s ease, transform 0.25s cubic-bezier(0.16, 1, 0.3, 1) !important;
-                pointer-events: none !important;
-                position: relative !important;
-                z-index: 2 !important;
-                margin-left: 2px !important;
-            }
-
-            #vyla-floating-nav:hover .vyla-nav-links {
-                opacity: 1 !important;
-                transform: translateX(0) !important;
-                pointer-events: auto !important;
-            }
-
-            .vyla-nav-btn {
-                width: 32px !important;
-                min-width: 32px !important;
-                height: 32px !important;
-                border-radius: 9999px !important;
-                border: none !important;
-                outline: none !important;
-                background: transparent !important;
-                box-shadow: none !important;
-                color: #ffffff !important;
-                display: flex !important;
-                align-items: center !important;
-                justify-content: center !important;
-                cursor: pointer !important;
-                transition: transform 0.15s ease, opacity 0.2s ease !important;
-                opacity: 0.85 !important;
-                padding: 0 !important;
-            }
-
-            .vyla-nav-btn:hover {
-                opacity: 1 !important;
-            }
-
-            .vyla-nav-btn svg {
-                width: 20px !important;
-                height: 20px !important;
-                fill: #ffffff !important;
-                pointer-events: none !important;
-                display: block !important;
-            }
-
             #tauri-custom-titlebar {
                 position: fixed !important;
                 top: 0 !important;
@@ -385,44 +389,16 @@ const LINK_HANDLER_SCRIPT: &str = r##"
                 justify-content: center !important;
                 cursor: pointer !important;
                 outline: none !important;
+                pointer-events: auto !important;
             }
 
             button.tauri-btn:hover { background: rgba(255, 255, 255, 0.2) !important; }
             button#tauri-btn-close:hover { background: #e81123 !important; color: #ffffff !important; }
             button.tauri-btn svg { width: 10px !important; height: 10px !important; fill: currentColor !important; pointer-events: none !important; }
         `;
-        document.head.appendChild(style);
+        if (!document.getElementById('tauri-custom-titlebar-style')) {
-
+            style.id = 'tauri-custom-titlebar-style';
-        const nav = document.createElement('div');
+            (document.head || document.documentElement).appendChild(style);
-        nav.id = 'vyla-floating-nav';
-        nav.innerHTML = `
-            <div class="vyla-nav-logo-wrap" title="Go to Home">
-                <img src="https://gitlab.com/vyla-entertainment/home-frontend/-/raw/main/assets/images/icons/logo_white.png" alt="Logo" />
-            </div>
-            <div class="vyla-nav-links">
-                <button class="vyla-nav-btn" id="vyla-btn-discord" title="Discord Community">
-                    <svg viewBox="0 0 127.14 96.36"><path d="M107.7,8.07A105.15,105.15,0,0,0,81.47,0a72.06,72.06,0,0,0-3.36,6.83A97.68,97.68,0,0,0,49,6.83,72.37,72.37,0,0,0,45.64,0,105.89,105.89,0,0,0,19.39,8.09C2.79,32.65-1.71,56.6.54,80.21h0A105.73,105.73,0,0,0,32.71,96.36,77.7,77.7,0,0,0,39.6,85.25a68.42,68.42,0,0,1-10.85-5.18c.91-.66,1.8-1.34,2.66-2a75.57,75.57,0,0,0,64.32,0c.87.71,1.76,1.39,2.66,2a68.68,68.68,0,0,1-10.87,5.19,77,77,0,0,0,6.89,11.1A105.25,105.25,0,0,0,126.6,80.22h0C129.24,52.84,122.09,29.11,107.7,8.07ZM42.45,65.69C36.18,65.69,31,60,31,53s5-12.74,11.43-12.74S54,45.91,53.89,53,48.84,65.69,42.45,65.69Zm42.24,0C78.41,65.69,73.25,60,73.25,53s5-12.74,11.44-12.74S96.23,45.91,96.12,53,91.08,65.69,84.69,65.69Z"/></svg>
-                </button>
-            </div>
-        `;
-        document.body.appendChild(nav);
-
-        const logoBtn = nav.querySelector('.vyla-nav-logo-wrap');
-        if (logoBtn) {
-            logoBtn.onclick = (e) => {
-                e.preventDefault();
-                e.stopPropagation();
-                window.location.href = 'http://localhost:4890';
-            };
-        }
-
-        const btnDiscord = nav.querySelector('#vyla-btn-discord');
-        if (btnDiscord) {
-            btnDiscord.onclick = (e) => {
-                e.preventDefault();
-                e.stopPropagation();
-                openExternalUrl('https://discord.gg/5eqRhKeywG');
-            };
         }
 
         const tb = document.createElement('div');
@@ -442,30 +418,60 @@ const LINK_HANDLER_SCRIPT: &str = r##"
         const btnClose = tb.querySelector('#tauri-btn-close');
         const dragEl = tb.querySelector('.tauri-drag-region');
 
-        if (btnMin) btnMin.onclick = (e) => { e.preventDefault(); e.stopPropagation(); minimizeWindow(); };
+        if (btnMin) {
-        if (btnMax) btnMax.onclick = (e) => { e.preventDefault(); e.stopPropagation(); maximizeWindow(); };
+            btnMin.addEventListener('click', (e) => {
-        if (btnClose) btnClose.onclick = (e) => { e.preventDefault(); e.stopPropagation(); closeWindow(); };
+                e.preventDefault();
+                e.stopPropagation();
+                e.stopImmediatePropagation();
+                minimizeWindow();
+            }, true);
+        }
+        if (btnMax) {
+            btnMax.addEventListener('click', (e) => {
+                e.preventDefault();
+                e.stopPropagation();
+                e.stopImmediatePropagation();
+                maximizeWindow();
+            }, true);
+        }
+        if (btnClose) {
+            btnClose.addEventListener('click', (e) => {
+                e.preventDefault();
+                e.stopPropagation();
+                e.stopImmediatePropagation();
+                closeWindow();
+            }, true);
+        }
         if (dragEl) {
-            dragEl.onmousedown = (e) => {
+            dragEl.addEventListener('mousedown', (e) => {
-                if (e.buttons === 1) {
+                if (e.button === 0) {
                     e.preventDefault();
                     dragWindow();
                 }
-            };
+            });
         }
     }
 
-  if (document.readyState === 'loading') {
+    function startNavObserver() {
+        const root = document.documentElement;
+        if (!root) {
+            setTimeout(startNavObserver, 5);
+            return;
+        }
+        const navObserver = new MutationObserver(() => {
+            if (!document.getElementById('tauri-custom-titlebar')) {
+                injectLiquidNavBar();
+            }
+        });
+        navObserver.observe(root, { childList: true, subtree: true });
+    }
+
+    if (document.readyState === 'loading') {
         document.addEventListener('DOMContentLoaded', injectLiquidNavBar);
     } else {
         injectLiquidNavBar();
     }
-    const navObserver = new MutationObserver(() => {
+    startNavObserver();
-        if (!document.getElementById('vyla-floating-nav')) {
-            injectLiquidNavBar();
-        }
-    });
-    navObserver.observe(document.documentElement, { childList: true, subtree: true });
 "##;
 
 #[tauri::command]
@@ -496,103 +502,122 @@ fn win_drag(window: tauri::Window) -> Result<(), String> {
     window.start_dragging().map_err(|e| e.to_string())
 }
 
-#[tauri::command]
+fn normalize_url(url: &str) -> Option<tauri::Url> {
-fn open_new_window(app: tauri::AppHandle, url: String) -> Result<(), String> {
-    debug_log(&format!("[SAME-TAB] Redirecting main window to: {}", url));
-
     let final_url = if url.starts_with("http") || url.starts_with("tauri://") {
-        url.clone()
+        url.to_string()
     } else if url.starts_with('/') {
-        format!("http://localhost:4890{}", url)
+        format!("http://127.0.0.1:4890{}", url)
     } else {
-        format!("http://localhost:4890/{}", url)
+        format!("http://127.0.0.1:4890/{}", url)
     };
-
+    match final_url.parse::<tauri::Url>() {
-    if let Some(window) = app.get_webview_window("main") {
+        Ok(u) => Some(u),
-        window
+        Err(e) => {
-            .eval(&format!(
+            debug_log(&format!("[NEW-WINDOW] bad url '{}': {}", final_url, e));
-                "window.location.href = '{}';",
+            None
-                final_url.replace('\'', "\\'")
+        }
-            ))
-            .map_err(|e| e.to_string())?;
-        Ok(())
-    } else {
-        Err("main window not found".to_string())
     }
 }
 
-#[tauri::command]
+fn open_app_window(app: &AppHandle, url: tauri::Url) -> Result<(), String> {
-async fn kill_orphans() -> Result<(), String> {
+    js_log(app, &format!("[NEW-WINDOW] Opening: {}", url));
-    debug_log("[KILL] User requested orphan process kill");
 
-    #[cfg(windows)]
+    let n = WINDOW_COUNTER.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+    let label = format!("win_{}", n);
+    let nw_handle = app.clone();
+
+    let window = WebviewWindowBuilder::new(app, &label, WebviewUrl::External(url))
+        .title("Vyla Home")
+        .inner_size(1100.0, 700.0)
+        .center()
+        .decorations(false)
+        .resizable(true)
+        .transparent(true)
+        .devtools(true)
+        .focused(true)
+        .initialization_script(&format!("window.__VYLA_WINDOW_LABEL = '{}';", label))
+        .initialization_script(LINK_HANDLER_SCRIPT)
+        .on_new_window(move |new_url, _features| {
+            js_log(&nw_handle, &format!("[NEW-WINDOW] handler fired (child): {}", new_url));
+            let h = nw_handle.clone();
+            std::thread::spawn(move || {
+                let _ = open_app_window(&h, new_url);
+            });
+            NewWindowResponse::Deny
+        })
+        .build()
+        .map_err(|e| {
+            js_log(app, &format!("[NEW-WINDOW] build failed: {}", e));
+            e.to_string()
+        })?;
+
+    #[cfg(target_os = "windows")]
     {
-        use std::os::windows::process::CommandExt;
+        use window_vibrancy::{apply_acrylic, apply_mica};
-        const CREATE_NO_WINDOW: u32 = 0x08000000;
+        if apply_mica(&window, Some(true)).is_err() {
-        let _ = std::process::Command::new("taskkill")
+            let _ = apply_acrylic(&window, Some((15, 18, 25, 125)));
-            .args(&["/F", "/T", "/IM", "node.exe"])
+        }
-            .creation_flags(CREATE_NO_WINDOW)
-            .output();
     }
 
-    #[cfg(not(windows))]
+    #[cfg(target_os = "macos")]
     {
-        let _ = std::process::Command::new("pkill")
+        use window_vibrancy::{apply_vibrancy, NSVisualEffectMaterial};
-            .args(&["-9", "-f", "node"])
+        let _ = apply_vibrancy(&window, NSVisualEffectMaterial::HudWindow, None, None);
-            .output();
     }
 
+    let _ = &window;
     Ok(())
 }
 
 #[tauri::command]
-fn get_logo_base64(app: tauri::AppHandle) -> Result<String, String> {
+fn open_new_window(app: AppHandle, url: String) -> Result<(), String> {
-    use std::io::Read;
+    let parsed = normalize_url(&url).ok_or_else(|| "invalid url".to_string())?;
-    let mut candidate_paths = Vec::new();
+    std::thread::spawn(move || {
+        let _ = open_app_window(&app, parsed);
+    });
+    Ok(())
+}
 
-    if let Ok(res_dir) = app.path().resource_dir() {
+fn handle_ready(w: &tauri::WebviewWindow, msg: &BackendMessage) {
-        candidate_paths.push(res_dir.join("build").join("icon_white.png"));
+    let url_str = match msg.data.get("url").and_then(|u| u.as_str()) {
-        candidate_paths.push(res_dir.join("_up_").join("build").join("icon_white.png"));
+        Some(u) => u,
+        None => return,
+    };
+
+    let url_parsed = match url_str.parse::<tauri::Url>() {
+        Ok(u) => u,
+        Err(_) => return,
+    };
+
+    #[cfg(target_os = "macos")]
+    {
+        use objc2::msg_send;
+        use objc2::runtime::AnyObject;
+        debug_log("Attempting with_webview on ready event");
+        let result = w.with_webview(|webview| unsafe {
+            debug_log("Inside with_webview closure");
+            let wk_webview = webview.inner() as *mut AnyObject;
+            let config: *mut AnyObject = msg_send![wk_webview, configuration];
+            let _: () = msg_send![config, setUpgradeKnownHostsToHTTPS: false];
+            debug_log("setUpgradeKnownHostsToHTTPS set to false");
+        });
+        debug_log(&format!("with_webview result: {:?}", result));
     }
 
-    if let Ok(mut cur) = std::env::current_dir() {
+    let _ = w.navigate(url_parsed);
-        candidate_paths.push(cur.join("build").join("icon_white.png"));
-        if cur.ends_with("src-tauri") {
-            cur.pop();
-            candidate_paths.push(cur.join("build").join("icon_white.png"));
-        }
-    }
-
-    for path in candidate_paths {
-        if path.exists() {
-            if let Ok(mut file) = std::fs::File::open(&path) {
-                let mut buffer = Vec::new();
-                if file.read_to_end(&mut buffer).is_ok() {
-                    use base64::Engine;
-                    return Ok(base64::engine::general_purpose::STANDARD.encode(buffer));
-                }
-            }
-        }
-    }
-
-    Err("icon_white.png not found".to_string())
 }
 
 fn main() {
     debug_log("=== Vyla Home Executable Started ===");
 
     tauri::Builder::default()
-        .plugin(tauri_plugin_shell::init())
-        .plugin(tauri_plugin_process::init())
         .plugin(tauri_plugin_opener::init())
         .invoke_handler(tauri::generate_handler![
             win_minimize,
             win_maximize,
             win_close,
             win_drag,
-            open_new_window,
+            open_new_window
-            get_logo_base64,
-            kill_orphans
         ])
         .manage(NodeServices(Mutex::new(None)))
         .setup(|app| {
@@ -603,13 +628,13 @@ fn main() {
                 std::path::PathBuf::from(appdata_env)
                     .join("vyla-home")
                     .join("vyla-home-files")
-                } else if let Ok(home) = std::env::var("HOME") {
+            } else if let Ok(_home) = std::env::var("HOME") {
                 #[cfg(target_os = "macos")]
-                let base = std::path::PathBuf::from(&home)
+                let base = std::path::PathBuf::from(&_home)
                     .join("Library")
                     .join("Application Support");
                 #[cfg(target_os = "linux")]
-                let base = std::path::PathBuf::from(&home)
+                let base = std::path::PathBuf::from(&_home)
                     .join(".local")
                     .join("share");
                 #[cfg(not(any(target_os = "macos", target_os = "linux")))]
@@ -619,47 +644,75 @@ fn main() {
                 app_data.join("vyla-home-files")
             };
 
-            let version_file = vyla_files.join("version.json");
+            let _ = std::fs::create_dir_all(&vyla_files);
-            let current_app_version = app.package_info().version.to_string();
-            let mut version_mismatch = false;
 
-            if version_file.exists() {
+            let main_nw_handle = app.handle().clone();
-                if let Ok(content) = std::fs::read_to_string(&version_file) {
+            let gate: SharedGate = Arc::new(Mutex::new(UiGate {
-                    if let Ok(json) = serde_json::from_str::<serde_json::Value>(&content) {
+                ready: false,
-                        if let Some(version) = json.get("version").and_then(|v| v.as_str()) {
+                queue: Vec::new(),
-                            if version != current_app_version {
+            }));
-                                version_mismatch = true;
+            let load_gate = gate.clone();
-                            }
-                        } else {
-                            version_mismatch = true;
-                        }
-                    } else {
-                        version_mismatch = true;
-                    }
-                }
-            }
-
-            if version_mismatch {
-                debug_log(&format!("App version updated to {}. Cleaning old files.", current_app_version));
-                let dirs_to_remove = ["frontend", "player", "stream-api", "auth-proxy", "config"];
-                for d in dirs_to_remove {
-                    let _ = std::fs::remove_dir_all(vyla_files.join(d));
-                }
-                let _ = std::fs::remove_file(&version_file);
-            }
 
             let window = WebviewWindowBuilder::new(app, "main", WebviewUrl::App("index.html".into()))
                 .title("Vyla Home")
                 .inner_size(1280.0, 800.0)
                 .decorations(false)
                 .resizable(true)
-                .devtools(cfg!(debug_assertions))
+                .transparent(true)
+                .devtools(true)
                 .initialization_script("window.__VYLA_WINDOW_LABEL = 'main';")
+                .on_page_load(move |wv, payload| {
+                    if matches!(payload.event(), tauri::webview::PageLoadEvent::Finished) {
+                        if payload.url().host_str() != Some("127.0.0.1") {
+                            let known = READY_URL.lock().ok().and_then(|g| g.clone());
+                            if let Some(u) = known {
+                                if let Ok(parsed) = u.parse::<tauri::Url>() {
+                                    let _ = wv.navigate(parsed);
+                                    return;
+                                }
+                            }
+                        }
+                        let g = load_gate.clone();
+                        std::thread::spawn(move || {
+                            std::thread::sleep(std::time::Duration::from_millis(400));
+                            if let Ok(mut lock) = g.lock() {
+                                lock.ready = true;
+                                let pending: Vec<BackendMessage> = lock.queue.drain(..).collect();
+                                for m in pending {
+                                    let _ = wv.emit(&m.event, m.data);
+                                }
+                            }
+                        });
+                    }
+                })
                 .initialization_script(LINK_HANDLER_SCRIPT)
+                .on_new_window(move |new_url, _features| {
+                    js_log(&main_nw_handle, &format!("[NEW-WINDOW] handler fired (main): {}", new_url));
+                    let h = main_nw_handle.clone();
+                    std::thread::spawn(move || {
+                        let _ = open_app_window(&h, new_url);
+                    });
+                    NewWindowResponse::Deny
+                })
                 .build()?;
 
+            #[cfg(target_os = "windows")]
+            {
+                use window_vibrancy::{apply_acrylic, apply_mica};
+                if apply_mica(&window, Some(true)).is_err() {
+                    let _ = apply_acrylic(&window, Some((15, 18, 25, 125)));
+                }
+            }
+
+            #[cfg(target_os = "macos")]
+            {
+                use window_vibrancy::{apply_vibrancy, NSVisualEffectMaterial};
+                let _ = apply_vibrancy(&window, NSVisualEffectMaterial::HudWindow, None, None);
+            }
+
             let (main_js, root_dir) = resolve_script_and_root(app);
             debug_log("Searching for node binary...");
+
             let node_bin = match find_node_binary(app) {
                 Some(bin) => {
                     debug_log(&format!("Found node binary: {}", bin));
@@ -667,7 +720,6 @@ fn main() {
                 }
                 None => {
                     debug_log("FATAL: No node binary found in bundle or PATH.");
-                    std::thread::sleep(std::time::Duration::from_millis(600));
                     let _ = window.eval("document.getElementById('status-message').textContent='Error: Node runtime missing. Please reinstall.';");
                     let _ = window.eval("var b=document.getElementById('debug-log-box');b.style.display='block';b.textContent='Node binary not found. bin/node missing from app bundle or not executable.';");
                     return Ok(());
@@ -676,8 +728,6 @@ fn main() {
 
             let vyla_files_str = clean_path(&vyla_files);
 
-            std::thread::sleep(std::time::Duration::from_millis(400));
-
             let mut cmd = Command::new(&node_bin);
             cmd.arg(&main_js)
                 .current_dir(&root_dir)
@@ -700,15 +750,27 @@ fn main() {
                         "Node child process spawned successfully, PID: {}",
                         child.id()
                     ));
+
                     if let Some(stderr) = child.stderr.take() {
                         let w = window.clone();
+                        let g = gate.clone();
                         std::thread::spawn(move || {
                             use std::io::{BufRead, BufReader};
                             let reader = BufReader::new(stderr);
                             for line in reader.lines().flatten() {
                                 debug_log(&format!("[NODE STDERR] {}", line));
-                                if line.contains("Error") || line.contains("Exception") || line.contains("MODULE_NOT_FOUND") {
+                                if line.contains("Error")
-                                    let _ = w.emit("error", serde_json::json!({ "message": format!("Backend failed: {}", line) }));
+                                    || line.contains("Exception")
+                                    || line.contains("MODULE_NOT_FOUND")
+                                {
+                                    dispatch(
+                                        &w,
+                                        &g,
+                                        BackendMessage {
+                                            event: "error".to_string(),
+                                            data: serde_json::json!({ "message": format!("Backend failed: {}", line) }),
+                                        },
+                                    );
                                 }
                             }
                         });
@@ -716,151 +778,33 @@ fn main() {
 
                     if let Some(stdout) = child.stdout.take() {
                         let w = window.clone();
+                        let g = gate.clone();
                         std::thread::spawn(move || {
                             use std::io::{BufRead, BufReader};
                             let reader = BufReader::new(stdout);
                             for line in reader.lines().flatten() {
                                 debug_log(&format!("[NODE STDOUT] {}", line));
-                                if let Ok(msg) = serde_json::from_str::<BackendMessage>(&line) {
-                                    debug_log(&format!("[MAIN-DEBUG] Received event: {}", msg.event));
-                                    debug_log(&format!(
-                                        "[MAIN-DEBUG] Event data: {}",
-                                        serde_json::to_string(&msg.data).unwrap_or_default()
-                                    ));
-                                    if msg.event == "tauri-cmd" {
-                                        let window_label = msg
-                                            .data
-                                            .get("window")
-                                            .and_then(|val| val.as_str())
-                                            .unwrap_or("main");
-                                        debug_log(&format!(
-                                            "[MAIN-DEBUG] Finding window by label: {}",
-                                            window_label
-                                        ));
 
-                                        if let Some(cmd_window) =
+                                let msg = match serde_json::from_str::<BackendMessage>(&line) {
-                                            w.app_handle().get_webview_window(window_label)
+                                    Ok(m) => m,
-                                        {
+                                    Err(_) => {
-                                            if let Some(cmd) =
+                                        if !line.trim().is_empty() {
-                                                msg.data.get("cmd").and_then(|c| c.as_str())
+                                            debug_log(&format!("[NODE RAW] {}", line));
-                                            {
-                                                debug_log(&format!(
-                                                    "[TAURI-CMD] Executing action: {}",
-                                                    cmd
-                                                ));
-                                                match cmd {
-                                                    "win_minimize" => {
-                                                        let res = cmd_window.minimize();
-                                                        debug_log(&format!(
-                                                            "[TAURI-CMD] Minimize result: {:?}",
-                                                            res
-                                                        ));
-                                                    }
-                                                    "win_maximize" => {
-                                                        let is_max = cmd_window
-                                                            .is_maximized()
-                                                            .unwrap_or(false);
-                                                        debug_log(&format!(
-                                                            "[TAURI-CMD] Currently maximized: {}",
-                                                            is_max
-                                                        ));
-                                                        let res = if is_max {
-                                                            cmd_window.unmaximize()
-                                                        } else {
-                                                            cmd_window.maximize()
-                                                        };
-                                                        debug_log(&format!(
-                                                            "[TAURI-CMD] Maximize/Unmaximize result: {:?}",
-                                                            res
-                                                        ));
-                                                    }
-                                                    "win_close" => {
-                                                        let res = cmd_window.close();
-                                                        debug_log(&format!(
-                                                            "[TAURI-CMD] Close result: {:?}",
-                                                            res
-                                                        ));
-                                                    }
-                                                    "win_drag" => {
-                                                        let res = cmd_window.start_dragging();
-                                                        debug_log(&format!(
-                                                            "[TAURI-CMD] Drag result: {:?}",
-                                                            res
-                                                        ));
-                                                    }
-                                                    "open_new_window" => {
-                                                        debug_log("[TAURI-CMD-DEBUG] open_new_window command received");
-                                                        debug_log(&format!(
-                                                            "[TAURI-CMD-DEBUG] Full message data: {}",
-                                                            serde_json::to_string(&msg.data)
-                                                                .unwrap_or_default()
-                                                        ));
-                                                        if let Some(url) = msg
-                                                            .data
-                                                            .get("url")
-                                                            .and_then(|u| u.as_str())
-                                                        {
-                                                            debug_log(&format!(
-                                                                "[TAURI-CMD-DEBUG] URL extracted: {}",
-                                                                url
-                                                            ));
-                                                            debug_log(&format!(
-                                                                "[TAURI-CMD-DEBUG] URL length: {}",
-                                                                url.len()
-                                                            ));
-                                                            debug_log("[TAURI-CMD-DEBUG] Attempting to dispatch to main thread");
-                                                            let app_handle = w.app_handle().clone();
-                                                            let closure_handle = app_handle.clone();
-                                                            let url_owned = url.to_string();
-                                                            let dispatch_result = app_handle
-                                                                .run_on_main_thread(move || {
-                                                                    debug_log("[TAURI-CMD-DEBUG] Now on main thread, calling open_new_window");
-                                                                    match open_new_window(
-                                                                        closure_handle,
-                                                                        url_owned,
-                                                                    ) {
-                                                                        Ok(_) => {
-                                                                            debug_log("[TAURI-CMD-DEBUG] open_new_window succeeded");
-                                                                        }
-                                                                        Err(e) => {
-                                                                            debug_log(&format!(
-                                                                                "[TAURI-CMD-DEBUG] open_new_window error: {}",
-                                                                                e
-                                                                            ));
-                                                                        }
-                                                                    }
-                                                                });
-                                                            match dispatch_result {
-                                                                Ok(_) => debug_log(
-                                                                    "[TAURI-CMD-DEBUG] Main thread dispatch succeeded",
-                                                                ),
-                                                                Err(e) => debug_log(&format!(
-                                                                    "[TAURI-CMD-DEBUG] Main thread dispatch failed: {}",
-                                                                    e
-                                                                )),
-                                                            }
-                                                        } else {
-                                                            debug_log("[TAURI-CMD-DEBUG] ERROR: No URL found in message data");
-                                                            debug_log(&format!(
-                                                                "[TAURI-CMD-DEBUG] Available keys: {:?}",
-                                                                msg.data
-                                                                    .as_object()
-                                                                    .map(|o| o.keys().collect::<Vec<_>>())
-                                                            ));
-                                                        }
-                                                    }
-                                                    _ => {}
-                                                }
-                                            }
-                                        } else {
-                                            debug_log(&format!(
-                                                "[TAURI-CMD] Window '{}' NOT FOUND!",
-                                                window_label
-                                            ));
                                         }
-                                    } else {
+                                        continue;
-                                        let _ = w.emit(&msg.event, msg.data.clone());
                                     }
+                                };
+
+                                match msg.event.as_str() {
+                                    "ready" => {
+                                        if let Some(u) = msg.data.get("url").and_then(|u| u.as_str()) {
+                                            if let Ok(mut g) = READY_URL.lock() {
+                                                *g = Some(u.to_string());
+                                            }
+                                        }
+                                        handle_ready(&w, &msg)
+                                    }
+                                    _ => dispatch(&w, &g, msg.clone()),
                                 }
                             }
                         });
@@ -884,7 +828,7 @@ fn main() {
 
             Ok(())
         })
- .on_window_event(|window, event| {
+        .on_window_event(|window, event| {
             if let tauri::WindowEvent::Destroyed = event {
                 if window.label() == "main" {
                     let state: State<NodeServices> = window.state();
@@ -894,6 +838,7 @@ fn main() {
                             kill_child_process(&mut child);
                         }
                     };
+                    window.app_handle().exit(0);
                 }
             }
         })

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
     "$schema": "https://schema.tauri.app/config/2",
     "productName": "Vyla Home",
-    "version": "1.1.23",
+    "version": "1.1.54",
     "identifier": "com.vyla.home",
     "build": {
         "frontendDist": "../ui"
@@ -9,7 +9,7 @@
     "app": {
         "withGlobalTauri": true,
         "security": {
-            "csp": null
+            "csp": "default-src 'self' http://localhost:* http://127.0.0.1:*; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:* http://127.0.0.1:*; style-src 'self' 'unsafe-inline' http://localhost:* http://127.0.0.1:*; img-src 'self' data: blob: https: http://localhost:* http://127.0.0.1:*; font-src 'self' data: http://localhost:* http://127.0.0.1:*; connect-src 'self' ipc: http://ipc.localhost http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:*"
         }
     },
     "bundle": {
@@ -23,7 +23,8 @@
             "icons/icon.ico"
         ],
         "macOS": {
-            "exceptionDomain": "localhost"
+            "exceptionDomain": "localhost",
+            "infoPlist": "Info.plist"
         },
         "windows": {
             "webviewInstallMode": {
@@ -34,8 +35,8 @@
             "WebView2Loader.dll",
             "../bin/**/*",
             "../main.js",
-            "../preload.js",
             "../service-manager.js",
+            "../file-updater.js",
             "../patcher.js",
             "../crypto-utils.js",
             "../credential-manager.js",

update-client.js

@@ -36,7 +36,9 @@ class UpdateClient {
       const urlObj = new URL(url);
       const headers = {
         'User-Agent': 'VylaHome-Client',
-        'Accept': 'application/json'
+        'Accept': 'application/json',
+        'Cache-Control': 'no-cache',
+        'Pragma': 'no-cache'
       };
 
       if (this.token) {
@@ -136,7 +138,14 @@ class UpdateClient {
           });
 
           file.on('finish', () => {
-            file.close(resolve);
+            file.close(() => {
+              if (totalSize && downloadedSize < totalSize) {
+                fs.unlink(destPath, () => { });
+                reject(new Error(`Download truncated: Received ${downloadedSize} of ${totalSize} bytes.`));
+              } else {
+                resolve();
+              }
+            });
           });
 
           file.on('error', (err) => {
@@ -150,10 +159,10 @@ class UpdateClient {
           reject(err);
         });
 
-        req.setTimeout(120000, () => {
+        req.setTimeout(900000, () => {
           req.destroy();
           fs.unlink(destPath, () => { });
-          reject(new Error('Download timeout'));
+          reject(new Error('Download timeout (15 minutes reached)'));
         });
       };
 
@@ -228,12 +237,21 @@ class UpdateClient {
   }
 
   async checkForUpdates() {
-    const cacheBuster = `?cb=${Date.now()}`;
+    const query = `?per_page=20&order_by=released_at&sort=desc&cb=${Date.now()}`;
-    const releases = await this.fetchJson(RELEASES_API + cacheBuster);
+    const releases = await this.fetchJson(RELEASES_API + query);
     if (!releases || releases.length === 0) {
       return null;
     }
-    const release = releases[0];
+    const verParts = (v) => String(v || '').replace(/^v/, '').split(/[.\-+]/).map((n) => parseInt(n, 10) || 0);
+    const cmp = (a, b) => {
+      const x = verParts(a);
+      const y = verParts(b);
+      for (let i = 0; i < Math.max(x.length, y.length); i++) {
+        if ((x[i] || 0) !== (y[i] || 0)) return (x[i] || 0) - (y[i] || 0);
+      }
+      return 0;
+    };
+    const release = releases.slice().sort((a, b) => cmp(b.tag_name, a.tag_name))[0];
 
     const payloadAsset = (release.assets && release.assets.links ? release.assets.links : []).find(a => a.name === 'update-payload.zip');
     const manifestAsset = (release.assets && release.assets.links ? release.assets.links : []).find(a => a.name === 'manifest.json');