fixed image issue

.gitignore

@@ -1,5 +1,4 @@
 node_modules/
-package-lock.json
 
 dist/
 dist-build/

DOCUEMENTATION/FORDEV.md

@@ -22,4 +22,16 @@ Fixing os error 32
 
 ```powershell
 Stop-Process -Name "vyla-home", "node", "cargo" -Force -ErrorAction SilentlyContinue
-```
+```
+
+Fake an old local version:
+
+```powershell
+'{"version":"0.0.1","sha256":null}' | Set-Content "$env:APPDATA\vyla-home\vyla-home-files\version.json"
+```
+
+Fake a test?
+
+```powershell
+$env:VYLA_TEST_UI="1"; npm run dev
+```

LICENSE

@@ -0,0 +1,47 @@
+Vyla Home Attribution License (VHAL) v1.0
+
+Copyright (c) 2026 Vyla Entertainment
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of the Vyla Home source code and associated documentation (the “Software”), to use, copy, modify, merge, publish, and distribute the Software, subject to the following conditions:
+
+1. Attribution
+
+Any public distribution, publication, derivative work, modified version, or substantial use of the Software must provide clear and visible credit to Vyla Entertainment and Vyla Home.
+
+The attribution must substantially state:
+
+“Based on Vyla Home by Vyla Entertainment”
+
+The attribution must appear in a location reasonably visible to users of the Software, such as an About page, credits section, documentation, repository, application information page, or other comparable location.
+
+2. Preservation of License
+
+Copies or substantial portions of the Software must include a copy of this license and the original copyright notice.
+
+3. Modified Versions
+
+Modified versions may be created and distributed under different terms, provided that the attribution requirements of Section 1 and the preservation requirements of Section 2 remain in effect.
+
+4. No Implication of Endorsement
+
+Use of the Software does not grant permission to imply that Vyla Entertainment endorses, sponsors, or officially supports any modified version or derivative work unless Vyla Entertainment has provided explicit written permission.
+
+5. Trademarks
+
+This license does not grant permission to use the Vyla Entertainment or Vyla Home names, logos, trademarks, service marks, or other branding except as necessary to satisfy the attribution requirement of this license.
+
+6. Commercial Use
+
+Commercial use, sale, and distribution of the Software and derivative works are permitted, provided that all applicable requirements of this license are satisfied.
+
+7. No Warranty
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.
+
+IN NO EVENT SHALL VYLA ENTERTAINMENT OR THE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+8. Acceptance
+
+By using, copying, modifying, publishing, or distributing the Software, you agree to the terms of this license.
+
+If any provision of this license is found to be unenforceable, the remaining provisions shall remain in effect.

build-pipeline.js

@@ -174,7 +174,7 @@ function validatePayload(zipPath) {
   const requiredFiles = [
     'frontend/index.html'
   ];
-  
+
   const validationResults = {
     valid: true,
     errors: [],

codemagic.yaml

@@ -21,7 +21,7 @@ workflows:
       - name: Install dependencies
         script: |
           export PATH="$HOME/.cargo/bin:$PATH"
-          npm install
+          npm ci
       - name: Build & Publish macOS Release
         script: |
           export PATH="$HOME/.cargo/bin:$PATH"

crypto-utils.js

@@ -1,17 +1,16 @@
 const crypto = require('crypto');
 const os = require('os');
-const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
 
 class CryptoUtils {
   static getMachineKey(cacheDir) {
-    const path = require('path');
-    const fs = require('fs');
     const cachePath = cacheDir ? path.join(cacheDir, '.machine-key-cache') : null;
 
     if (cachePath && fs.existsSync(cachePath)) {
       try {
         const cached = fs.readFileSync(cachePath, 'utf8').trim();
-        if (cached) return cached;
+        if (cached && cached.length === 64) return cached;
       } catch (e) {
       }
     }
@@ -22,8 +21,7 @@ class CryptoUtils {
         os.hostname(),
         os.platform(),
         os.arch(),
-        os.cpus()[0].model,
-        this.getMachineId(),
+        os.cpus()[0] ? os.cpus()[0].model : '',
         process.env.COMPUTERNAME || '',
         process.env.USERNAME || ''
       ].join('|');
@@ -46,36 +44,6 @@ class CryptoUtils {
     return key;
   }
 
-  static getMachineId() {
-    const fs = require('fs');
-    if (os.platform() === 'win32') {
-      try {
-        const { spawnSync } = require('child_process');
-        const res = spawnSync('reg', ['query', 'HKLM\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid'], { encoding: 'utf8' });
-        if (res.stdout) {
-          const match = res.stdout.match(/MachineGuid\s+REG_SZ\s+([^\r\n]+)/);
-          if (match) return match[1].trim();
-        }
-      } catch (e) { }
-      return 'windows-node-' + os.hostname();
-    } else if (os.platform() === 'darwin') {
-      try {
-        const { spawnSync } = require('child_process');
-        const res = spawnSync('ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice'], { encoding: 'utf8' });
-        const match = res.stdout.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
-        if (match) return match[1].trim();
-      } catch (e) { }
-      return 'darwin-node-' + os.hostname();
-    } else {
-      for (const idPath of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
-        try {
-          if (fs.existsSync(idPath)) return fs.readFileSync(idPath, 'utf8').trim();
-        } catch (e) { }
-      }
-      return 'linux-node-' + os.hostname();
-    }
-  }
-
   static deriveKey(machineKey, salt = 'vyla-home-salt') {
     const hash = crypto.createHash('sha256');
     hash.update(machineKey + salt);
@@ -98,11 +66,11 @@ class CryptoUtils {
     }
   }
 
-  static decrypt(encryptedData, key) {
+  static decrypt(ciphertext, key) {
     try {
-      const parts = encryptedData.split(':');
+      const parts = ciphertext.split(':');
       if (parts.length !== 3) {
-        throw new Error('Invalid encrypted data format');
+        throw new Error('Invalid ciphertext format');
       }
 
       const iv = Buffer.from(parts[0], 'hex');
@@ -122,25 +90,14 @@ class CryptoUtils {
   }
 
   static encryptObject(obj, key) {
-    const json = JSON.stringify(obj);
-    return this.encrypt(json, key);
+    const jsonString = JSON.stringify(obj);
+    return this.encrypt(jsonString, key);
   }
 
-  static decryptObject(encryptedData, key) {
-    const json = this.decrypt(encryptedData, key);
-    return JSON.parse(json);
-  }
-
-  static hashData(data) {
-    const hash = crypto.createHash('sha256');
-    hash.update(data);
-    return hash.digest('hex');
-  }
-
-  static verifyHash(data, expectedHash) {
-    const actualHash = this.hashData(data);
-    return actualHash === expectedHash;
+  static decryptObject(ciphertext, key) {
+    const jsonString = this.decrypt(ciphertext, key);
+    return JSON.parse(jsonString);
   }
 }
 
-module.exports = CryptoUtils;
+module.exports = CryptoUtils;

file-updater.js

@@ -0,0 +1,467 @@
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const zlib = require('zlib');
+const https = require('https');
+const AdmZip = require('adm-zip');
+
+const SDK_NAME = '@vyla-entertainment/sdk';
+const SDK_LATEST_URL = 'https://registry.npmjs.org/@vyla-entertainment%2Fsdk/latest';
+const ALLOWED_ROOTS = ['frontend', 'player'];
+const MAX_TARBALL = 100 * 1024 * 1024;
+const MAX_FILE = 50 * 1024 * 1024;
+const LIVE_HOSTS = ['gitlab.com'];
+const REPO_API = 'https://gitlab.com/api/v4/projects/vyla-entertainment%2F';
+
+const verParts = (v) => String(v || '').replace(/^v/, '').split(/[.\-+]/).map((n) => parseInt(n, 10) || 0);
+const cmpVer = (a, b) => {
+    const x = verParts(a);
+    const y = verParts(b);
+    for (let i = 0; i < Math.max(x.length, y.length); i++) {
+        if ((x[i] || 0) !== (y[i] || 0)) return (x[i] || 0) - (y[i] || 0);
+    }
+    return 0;
+};
+
+const sha256Buf = (buf) => crypto.createHash('sha256').update(buf).digest('hex');
+const sha256File = (p) => sha256Buf(fs.readFileSync(p));
+const gitBlobSha = (buf) => crypto.createHash('sha1').update(Buffer.concat([Buffer.from(`blob ${buf.length}\0`), buf])).digest('hex');
+
+function fetchBuffer(url, { headers = {}, maxBytes, hosts, redirects = 0 }) {
+    return new Promise((resolve, reject) => {
+        if (redirects > 5) return reject(new Error('Too many redirects'));
+        let u;
+        try { u = new URL(url); } catch (e) { return reject(new Error('Invalid URL')); }
+        if (u.protocol !== 'https:' || !hosts.includes(u.hostname)) {
+            return reject(new Error(`Host not allowed: ${u.hostname}`));
+        }
+        const req = https.get({
+            hostname: u.hostname,
+            port: 443,
+            path: u.pathname + u.search,
+            headers: { 'User-Agent': 'VylaHome-Client', ...headers }
+        }, (res) => {
+            if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+                res.resume();
+                const next = new URL(res.headers.location, url).toString();
+                const keep = new URL(next).hostname === u.hostname ? headers : {};
+                fetchBuffer(next, { headers: keep, maxBytes, hosts, redirects: redirects + 1 }).then(resolve, reject);
+                return;
+            }
+            if (res.statusCode !== 200) {
+                res.resume();
+                reject(new Error(`HTTP ${res.statusCode}`));
+                return;
+            }
+            const chunks = [];
+            let size = 0;
+            res.on('data', (c) => {
+                size += c.length;
+                if (size > maxBytes) {
+                    req.destroy();
+                    reject(new Error('Response too large'));
+                    return;
+                }
+                chunks.push(c);
+            });
+            res.on('end', () => resolve(Buffer.concat(chunks)));
+            res.on('error', reject);
+        });
+        req.on('error', reject);
+        req.setTimeout(30000, () => {
+            req.destroy();
+            reject(new Error('Request timeout'));
+        });
+    });
+}
+
+function safeRel(rel) {
+    if (typeof rel !== 'string' || !rel || rel.includes('\0') || rel.includes('\\')) return null;
+    const norm = path.posix.normalize(rel);
+    if (norm !== rel || norm.startsWith('/') || norm.endsWith('/')) return null;
+    const parts = norm.split('/');
+    if (parts.length < 2 || !ALLOWED_ROOTS.includes(parts[0])) return null;
+    if (parts.some((p) => p === '..' || p === '.' || p === 'node_modules' || p === '.git')) return null;
+    return norm;
+}
+
+function extractTar(tar, destDir) {
+    const root = path.resolve(destDir);
+    let offset = 0;
+    while (offset + 512 <= tar.length) {
+        const header = tar.subarray(offset, offset + 512);
+        if (header.every((b) => b === 0)) break;
+        let name = header.toString('utf8', 0, 100).replace(/\0.*$/, '');
+        const prefix = header.toString('utf8', 345, 500).replace(/\0.*$/, '');
+        if (prefix) name = `${prefix}/${name}`;
+        const size = parseInt(header.toString('utf8', 124, 136).replace(/\0.*$/, '').trim(), 8) || 0;
+        const type = String.fromCharCode(header[156]);
+        offset += 512;
+        const data = tar.subarray(offset, offset + size);
+        offset += Math.ceil(size / 512) * 512;
+        if ((type !== '0' && type !== '\0') || !name.startsWith('package/')) continue;
+        const rel = path.posix.normalize(name.slice('package/'.length));
+        if (!rel || rel.startsWith('..') || rel.startsWith('/') || rel.endsWith('/')) {
+            throw new Error(`Unsafe path in tarball: ${name}`);
+        }
+        const full = path.resolve(root, rel);
+        if (!full.startsWith(root + path.sep)) {
+            throw new Error(`Unsafe path in tarball: ${name}`);
+        }
+        fs.mkdirSync(path.dirname(full), { recursive: true });
+        fs.writeFileSync(full, data);
+    }
+}
+
+class FileUpdater {
+    constructor(appDataPath, updateClient) {
+        this.appDataPath = appDataPath;
+        this.updateClient = updateClient;
+        this.onProgress = null;
+        this.statePath = path.join(appDataPath, 'file-state.json');
+    }
+
+    sdkHeaders() {
+        const h = { Accept: 'application/json' };
+        if (process.env.NPM_TOKEN) h.Authorization = `Bearer ${process.env.NPM_TOKEN}`;
+        return h;
+    }
+
+    target(rel) {
+        const root = path.resolve(this.appDataPath);
+        const full = path.resolve(root, ...rel.split('/'));
+        if (!full.startsWith(root + path.sep)) throw new Error(`Path escape: ${rel}`);
+        return full;
+    }
+
+    readState() {
+        try {
+            const s = JSON.parse(fs.readFileSync(this.statePath, 'utf8'));
+            return {
+                seq: typeof s.seq === 'number' ? s.seq : null,
+                base: s.base && typeof s.base === 'object' ? s.base : {}
+            };
+        } catch (e) {
+            return { seq: null, base: {} };
+        }
+    }
+
+    writeState(state) {
+        fs.mkdirSync(this.appDataPath, { recursive: true });
+        const tmp = `${this.statePath}.tmp`;
+        fs.writeFileSync(tmp, JSON.stringify(state), 'utf8');
+        fs.renameSync(tmp, this.statePath);
+    }
+
+    snapshotBase() {
+        const base = {};
+        const walk = (dir, rel) => {
+            for (const name of fs.readdirSync(dir)) {
+                if (name === 'node_modules' || name === '.git') continue;
+                const full = path.join(dir, name);
+                const r = `${rel}/${name}`;
+                const st = fs.lstatSync(full);
+                if (st.isDirectory()) walk(full, r);
+                else if (st.isFile()) base[r] = sha256File(full);
+            }
+        };
+        for (const root of ALLOWED_ROOTS) {
+            const dir = path.join(this.appDataPath, root);
+            if (fs.existsSync(dir)) walk(dir, root);
+        }
+        this.writeState({ seq: this.readState().seq, base });
+    }
+
+    zipMatches(zipPath, sha256) {
+        try {
+            return sha256File(zipPath) === String(sha256).trim().toLowerCase();
+        } catch (e) {
+            return false;
+        }
+    }
+
+    async checkFiles() {
+        const versionFile = path.join(this.appDataPath, 'version.json');
+        let local;
+        try {
+            local = JSON.parse(fs.readFileSync(versionFile, 'utf8'));
+        } catch (e) {
+            return { seq: 0, changes: [] };
+        }
+        const release = await this.updateClient.checkForUpdates();
+        const norm = (v) => String(v || '').replace(/^v/, '').trim();
+        if (!release || !release.sha256 || !local.sha256) return { seq: 0, changes: [] };
+        if (norm(release.version) !== norm(local.version) || release.sha256 === local.sha256) {
+            return { seq: 0, changes: [] };
+        }
+
+        const zipPath = path.join(this.appDataPath, 'pending-ui.zip');
+        if (!this.zipMatches(zipPath, release.sha256)) {
+            fs.rmSync(zipPath, { force: true });
+            await this.updateClient.downloadUpdate(release, zipPath, this.onProgress);
+            if (!this.zipMatches(zipPath, release.sha256)) {
+                fs.rmSync(zipPath, { force: true });
+                throw new Error('Update archive checksum mismatch');
+            }
+        }
+
+        const state = this.readState();
+        const zip = new AdmZip(zipPath);
+        const changes = [];
+        for (const entry of zip.getEntries()) {
+            if (entry.isDirectory) continue;
+            const rel = safeRel(entry.entryName);
+            if (!rel) continue;
+            const data = entry.getData();
+            const hash = sha256Buf(data);
+            const full = this.target(rel);
+            if (!fs.existsSync(full)) {
+                changes.push({ path: rel, sha256: hash, size: data.length, status: 'added' });
+                continue;
+            }
+            const baseline = state.base[rel] || sha256File(full);
+            if (baseline !== hash) {
+                changes.push({ path: rel, sha256: hash, size: data.length, status: 'modified' });
+            }
+        }
+
+        if (changes.length === 0) {
+            fs.writeFileSync(versionFile, JSON.stringify({ version: release.version, sha256: release.sha256 }, null, 2), 'utf8');
+            fs.rmSync(zipPath, { force: true });
+            return { seq: 0, changes: [] };
+        }
+
+        this.pending = { release, zipPath, total: changes.length };
+        return { seq: 0, changes };
+    }
+
+    async applyFiles(changes, seq, replacements, onFile) {
+        if (!this.pending) throw new Error('No pending update');
+        const { release, zipPath, total } = this.pending;
+        const zip = new AdmZip(zipPath);
+        const staged = [];
+        for (let i = 0; i < changes.length; i++) {
+            const c = changes[i];
+            const entry = zip.getEntry(c.path);
+            if (!entry) throw new Error(`Missing in archive: ${c.path}`);
+            const data = entry.getData();
+            if (sha256Buf(data) !== c.sha256) throw new Error(`Checksum mismatch: ${c.path}`);
+            staged.push({ c, data: this.applyReplacements(c.path, data, replacements) });
+            if (onFile) onFile(c.path, i + 1, changes.length);
+        }
+
+        const done = [];
+        try {
+            for (const s of staged) {
+                const full = this.target(s.c.path);
+                const prev = fs.existsSync(full) ? fs.readFileSync(full) : null;
+                fs.mkdirSync(path.dirname(full), { recursive: true });
+                fs.writeFileSync(`${full}.vyla-tmp`, s.data);
+                fs.renameSync(`${full}.vyla-tmp`, full);
+                done.push({ full, prev });
+            }
+        } catch (e) {
+            for (const d of done.reverse()) {
+                try {
+                    if (d.prev === null) fs.rmSync(d.full, { force: true });
+                    else fs.writeFileSync(d.full, d.prev);
+                } catch (x) { }
+            }
+            throw e;
+        }
+
+        const state = this.readState();
+        for (const s of staged) state.base[s.c.path] = s.c.sha256;
+        this.writeState({ seq: state.seq, base: state.base });
+
+        if (changes.length === total) {
+            fs.writeFileSync(
+                path.join(this.appDataPath, 'version.json'),
+                JSON.stringify({ version: release.version, sha256: release.sha256 }, null, 2),
+                'utf8'
+            );
+            fs.rmSync(zipPath, { force: true });
+            this.pending = null;
+        }
+    }
+
+    applyReplacements(rel, buf, replacements) {
+        const list = (replacements && replacements[rel.split('/')[0]]) || [];
+        if (!list.length) return buf;
+        let text = buf.toString('utf8');
+        let changed = false;
+        for (const rep of list) {
+            if (rep && rep.find && text.includes(rep.find)) {
+                text = text.split(rep.find).join(rep.replace);
+                changed = true;
+            }
+        }
+        return changed ? Buffer.from(text, 'utf8') : buf;
+    }
+
+    async repoTree(root) {
+        const out = [];
+        for (let page = 1; page <= 50; page++) {
+            const url = `${REPO_API}${root}/repository/tree?recursive=true&per_page=100&ref=main&page=${page}`;
+            const raw = await fetchBuffer(url, { headers: { Accept: 'application/json' }, maxBytes: 5 * 1024 * 1024, hosts: LIVE_HOSTS });
+            const items = JSON.parse(raw.toString('utf8'));
+            if (!Array.isArray(items) || items.length === 0) break;
+            out.push(...items);
+            if (items.length < 100) break;
+        }
+        return out;
+    }
+
+    fetchRepoFile(rel) {
+        const parts = rel.split('/');
+        const root = parts.shift();
+        const file = encodeURIComponent(parts.join('/'));
+        return fetchBuffer(`${REPO_API}${root}/repository/files/${file}/raw?ref=main`, { maxBytes: MAX_FILE, hosts: LIVE_HOSTS });
+    }
+
+    async checkRepos() {
+        const state = this.readState();
+        const changes = [];
+        for (const root of ALLOWED_ROOTS) {
+            const tree = await this.repoTree(root);
+            for (const item of tree) {
+                if (item.type !== 'blob') continue;
+                const rel = safeRel(`${root}/${item.path}`);
+                if (!rel || !/^[0-9a-f]{40}$/.test(item.id)) continue;
+                const full = this.target(rel);
+                if (fs.existsSync(full) && (state.base[rel] === item.id || gitBlobSha(fs.readFileSync(full)) === item.id)) continue;
+                changes.push({ path: rel, sha256: item.id, size: 0 });
+            }
+        }
+        return { seq: state.seq === null ? 0 : state.seq, changes, removed: [] };
+    }
+
+    async applyLive(info, replacements, onFile) {
+        const staged = [];
+        const total = info.changes.length;
+        let next = 0;
+        let finished = 0;
+        let failure = null;
+        const worker = async () => {
+            while (next < total && !failure) {
+                const c = info.changes[next++];
+                try {
+                    const data = await this.fetchRepoFile(c.path);
+                    if (gitBlobSha(data) !== c.sha256) throw new Error(`Checksum mismatch: ${c.path}`);
+                    staged.push({ c, data: this.applyReplacements(c.path, data, replacements) });
+                    finished++;
+                    if (onFile) onFile(c.path, finished, total);
+                } catch (e) {
+                    failure = e;
+                }
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(8, total) }, worker));
+        if (failure) throw failure;
+
+        const done = [];
+        try {
+            for (const s of staged) {
+                const full = this.target(s.c.path);
+                const prev = fs.existsSync(full) ? fs.readFileSync(full) : null;
+                fs.mkdirSync(path.dirname(full), { recursive: true });
+                fs.writeFileSync(`${full}.vyla-tmp`, s.data);
+                fs.renameSync(`${full}.vyla-tmp`, full);
+                done.push({ full, prev });
+            }
+            for (const rel of info.removed) {
+                const full = this.target(rel);
+                if (!fs.existsSync(full)) continue;
+                const prev = fs.readFileSync(full);
+                fs.rmSync(full, { force: true });
+                done.push({ full, prev });
+            }
+        } catch (e) {
+            for (const d of done.reverse()) {
+                try {
+                    if (d.prev === null) fs.rmSync(d.full, { force: true });
+                    else fs.writeFileSync(d.full, d.prev);
+                } catch (x) { }
+            }
+            throw e;
+        }
+
+        const state = this.readState();
+        for (const s of staged) state.base[s.c.path] = s.c.sha256;
+        for (const rel of info.removed) delete state.base[rel];
+        this.writeState({ seq: info.seq, base: state.base });
+    }
+
+    installedSdk() {
+        const roots = [this.appDataPath, path.join(this.appDataPath, 'frontend'), path.join(this.appDataPath, 'player')];
+        const found = [];
+        for (const root of roots) {
+            const dir = path.join(root, 'node_modules', ...SDK_NAME.split('/'));
+            try {
+                const version = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
+                if (version) found.push({ dir, version });
+            } catch (e) { }
+        }
+        return found;
+    }
+
+    async checkSdk() {
+        const raw = await fetchBuffer(SDK_LATEST_URL, {
+            headers: this.sdkHeaders(),
+            maxBytes: 5 * 1024 * 1024,
+            hosts: ['registry.npmjs.org']
+        });
+        const meta = JSON.parse(raw.toString('utf8'));
+        const integrity = String((meta.dist && meta.dist.integrity) || '').split(' ').find((s) => s.startsWith('sha512-'));
+        if (!meta.version || !meta.dist || !meta.dist.tarball || !integrity) {
+            throw new Error('Registry response missing version or integrity');
+        }
+        const installed = this.installedSdk();
+        const targets = installed.filter((i) => cmpVer(i.version, meta.version) < 0);
+        const current = targets.length ? targets.map((t) => t.version).sort(cmpVer)[0] : meta.version;
+        return {
+            outdated: targets.length > 0,
+            current,
+            latest: meta.version,
+            tarball: meta.dist.tarball,
+            integrity,
+            dirs: targets.map((t) => t.dir)
+        };
+    }
+
+    async installSdk(info) {
+        const tgz = await fetchBuffer(info.tarball, {
+            headers: this.sdkHeaders(),
+            maxBytes: MAX_TARBALL,
+            hosts: ['registry.npmjs.org']
+        });
+        const digest = `sha512-${crypto.createHash('sha512').update(tgz).digest('base64')}`;
+        if (digest !== info.integrity) throw new Error('SDK integrity check failed');
+        const tar = zlib.gunzipSync(tgz, { maxOutputLength: 300 * 1024 * 1024 });
+
+        for (const dir of info.dirs) {
+            const stage = `${dir}.vyla-new`;
+            const old = `${dir}.vyla-old`;
+            fs.rmSync(stage, { recursive: true, force: true });
+            fs.rmSync(old, { recursive: true, force: true });
+            fs.mkdirSync(stage, { recursive: true });
+            extractTar(tar, stage);
+            const version = JSON.parse(fs.readFileSync(path.join(stage, 'package.json'), 'utf8')).version;
+            if (version !== info.latest) {
+                fs.rmSync(stage, { recursive: true, force: true });
+                throw new Error('SDK version mismatch in tarball');
+            }
+            const had = fs.existsSync(dir);
+            if (had) fs.renameSync(dir, old);
+            try {
+                fs.renameSync(stage, dir);
+            } catch (e) {
+                if (had) fs.renameSync(old, dir);
+                throw e;
+            }
+            fs.rmSync(old, { recursive: true, force: true });
+        }
+    }
+}
+
+module.exports = FileUpdater;

github-client.js

@@ -1,176 +0,0 @@
-const { execSync, spawnSync } = require('child_process');
-const fs = require('fs');
-const path = require('path');
-
-const REPOS = {
-    frontend: { branch: 'main' },
-    player: { branch: 'main' }
-};
-
-const GITLAB_GROUP = 'vyla-entertainment';
-
-class GitlabClient {
-    constructor(appDataPath, credentialManager) {
-        this.appDataPath = appDataPath;
-        this.credentialManager = credentialManager;
-    }
-
-    getToken() {
-        return this.credentialManager.getCredential('gitlab', 'TOKEN') || null;
-    }
-
-    setToken(token) {
-        this.credentialManager.setCredential('gitlab', 'TOKEN', token);
-    }
-
-    hasToken() {
-        return !!this.getToken();
-    }
-
-    buildRepoUrl(repoName) {
-        const token = this.getToken();
-        if (token) {
-            return `https://oauth2:${token}@gitlab.com/${GITLAB_GROUP}/${repoName}.git`;
-        }
-        return `https://gitlab.com/${GITLAB_GROUP}/${repoName}.git`;
-    }
-
-    repoDir(repoName) {
-        return path.join(this.appDataPath, repoName);
-    }
-
-    isRepoCloned(repoName) {
-        const gitDir = path.join(this.repoDir(repoName), '.git');
-        return fs.existsSync(gitDir);
-    }
-
-    allReposCloned() {
-        return Object.keys(REPOS).every((name) => this.isRepoCloned(name));
-    }
-
-    cloneRepo(repoName, onLog) {
-        const { branch } = REPOS[repoName];
-        const targetDir = this.repoDir(repoName);
-        const url = this.buildRepoUrl(repoName);
-
-        if (fs.existsSync(targetDir)) {
-            fs.rmSync(targetDir, { recursive: true, force: true });
-        }
-
-        if (onLog) onLog(`Cloning ${repoName}...`);
-
-        const result = spawnSync('git', ['clone', '--depth', '1', '--branch', branch, url, targetDir], {
-            stdio: 'pipe',
-            env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }
-        });
-
-        if (result.status !== 0) {
-            const stderr = result.stderr ? result.stderr.toString() : 'unknown error';
-            throw new Error(`Failed to clone ${repoName}: ${stderr}`);
-        }
-    }
-
-    cloneAll(onLog) {
-        for (const repoName of Object.keys(REPOS)) {
-            this.cloneRepo(repoName, onLog);
-        }
-    }
-
-    installDependencies(repoName, onLog) {
-        const repoDir = this.repoDir(repoName);
-        const pkgJsonPath = path.join(repoDir, 'package.json');
-
-        if (!fs.existsSync(pkgJsonPath)) {
-            return;
-        }
-
-        if (onLog) onLog(`Installing dependencies for ${repoName}...`);
-
-        const result = spawnSync('npm', ['install', '--omit=dev'], {
-            cwd: repoDir,
-            stdio: 'pipe',
-            shell: process.platform === 'win32'
-        });
-
-        if (result.status !== 0) {
-            const stderr = result.stderr ? result.stderr.toString() : 'unknown error';
-            throw new Error(`npm install failed for ${repoName}: ${stderr}`);
-        }
-    }
-
-    installAllDependencies(onLog) {
-        for (const repoName of Object.keys(REPOS)) {
-            this.installDependencies(repoName, onLog);
-        }
-    }
-
-    getLocalHead(repoName) {
-        const repoDir = this.repoDir(repoName);
-        try {
-            return execSync('git rev-parse HEAD', { cwd: repoDir }).toString().trim();
-        } catch (e) {
-            return null;
-        }
-    }
-
-    getRemoteHead(repoName) {
-        const { branch } = REPOS[repoName];
-        const repoDir = this.repoDir(repoName);
-        const url = this.buildRepoUrl(repoName);
-        try {
-            const output = execSync(`git ls-remote "${url}" refs/heads/${branch}`, { cwd: repoDir }).toString().trim();
-            return output.split('\t')[0] || null;
-        } catch (e) {
-            return null;
-        }
-    }
-
-    checkForUpdates() {
-        const outdated = [];
-        for (const repoName of Object.keys(REPOS)) {
-            const local = this.getLocalHead(repoName);
-            const remote = this.getRemoteHead(repoName);
-            if (local && remote && local !== remote) {
-                outdated.push(repoName);
-            }
-        }
-        return outdated;
-    }
-
-    updateRepo(repoName, onLog) {
-        const { branch } = REPOS[repoName];
-        const repoDir = this.repoDir(repoName);
-
-        if (onLog) onLog(`Updating ${repoName}...`);
-
-        const fetchResult = spawnSync('git', ['fetch', 'origin', branch], {
-            cwd: repoDir,
-            stdio: 'pipe',
-            env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }
-        });
-
-        if (fetchResult.status !== 0) {
-            const stderr = fetchResult.stderr ? fetchResult.stderr.toString() : 'unknown error';
-            throw new Error(`Failed to fetch ${repoName}: ${stderr}`);
-        }
-
-        const resetResult = spawnSync('git', ['reset', '--hard', `origin/${branch}`], {
-            cwd: repoDir,
-            stdio: 'pipe'
-        });
-
-        if (resetResult.status !== 0) {
-            const stderr = resetResult.stderr ? resetResult.stderr.toString() : 'unknown error';
-            throw new Error(`Failed to reset ${repoName}: ${stderr}`);
-        }
-    }
-
-    updateAll(repoNames, onLog) {
-        for (const repoName of repoNames) {
-            this.updateRepo(repoName, onLog);
-            this.installDependencies(repoName, onLog);
-        }
-    }
-}
-
-module.exports = GitlabClient

main.js

@@ -5,6 +5,7 @@ const express = require('express');
 const ServiceManager = require('./service-manager');
 const Patcher = require('./patcher');
 const UpdateClient = require('./update-client');
+const FileUpdater = require('./file-updater');
 
 function getDefaultAppData() {
   if (process.platform === 'darwin') {
@@ -32,8 +33,7 @@ function debugLog(msg) {
 debugLog("--- Node.js Process Started ---");
 
 let serviceManager;
-let expressApp;
-let expressServer;
+let updateDecisionHandler = null;
 
 debugLog(`AppData Dir: ${APPDATA_DIR}`);
 
@@ -42,55 +42,6 @@ function sendToTauri(event, data) {
   process.stdout.write(JSON.stringify({ event, data }) + '\n');
 }
 
-function sameTabNavMiddleware(rootDir) {
-  return (req, res, next) => {
-    if (req.method !== 'GET') return next();
-    const isHtmlRequest = req.path === '/' || req.path.endsWith('/') || req.path.endsWith('.html');
-    if (!isHtmlRequest) return next();
-
-    const filePath = req.path === '/' || req.path.endsWith('/')
-      ? path.join(rootDir, req.path, 'index.html')
-      : path.join(rootDir, req.path);
-
-    fs.readFile(filePath, 'utf8', (err, data) => {
-      if (err) return next();
-      const injected = data.replace(
-        '</head>',
-        `<script>
-document.addEventListener('click', function(e) {
-  const a = e.target.closest('a[target]');
-  if (a && a.target === '_blank') a.removeAttribute('target');
-}, true);
-window.open = function(url) {
-  if (url) window.location.href = url;
-  return window;
-};
-</script></head>`
-      );
-      res.set('Content-Type', 'text/html');
-      res.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
-      res.set('Expires', '-1');
-      res.set('Pragma', 'no-cache');
-      res.send(injected);
-    });
-  };
-}
-
-const cmdApp = express();
-cmdApp.use((req, res, next) => {
-  res.header('Access-Control-Allow-Origin', '*');
-  res.header('Access-Control-Allow-Methods', 'GET,POST,OPTIONS');
-  res.header('Access-Control-Allow-Headers', '*');
-  if (req.method === 'OPTIONS') return res.sendStatus(200);
-  next();
-});
-cmdApp.get('/__tauri_cmd/:cmd', (req, res) => {
-  debugLog(`[CMD-SERVER:4892] Command received: ${req.params.cmd} (window: ${req.query.window || 'main'})`);
-  sendToTauri('tauri-cmd', { cmd: req.params.cmd, url: req.query.url, window: req.query.window });
-  res.sendStatus(200);
-});
-cmdApp.listen(4892, '127.0.0.1', () => debugLog("[CMD-SERVER] Dedicated command server listening on 127.0.0.1:4892"));
-
 process.stdin.resume();
 process.stdin.on('end', () => {
   debugLog('stdin closed - parent died. Self-terminating...');
@@ -132,6 +83,36 @@ function getReplacementsConfig() {
 }
 
 const updateClient = new UpdateClient(APPDATA_DIR);
+const fileUpdater = new FileUpdater(APPDATA_DIR, updateClient);
+let lastFilePercent = -1;
+fileUpdater.onProgress = (downloaded, total) => {
+  const percent = total > 0 ? Math.round((downloaded / total) * 100) : 0;
+  if (percent === lastFilePercent) return;
+  lastFilePercent = percent;
+  sendToTauri('download-progress', { downloaded, total, percent });
+};
+
+function withTimeout(promise, ms) {
+  return Promise.race([promise, new Promise((resolve) => setTimeout(() => resolve(null), ms))]);
+}
+
+function portInUse(port) {
+  return new Promise((resolve) => {
+    const socket = new (require('net').Socket)();
+    socket.setTimeout(500);
+    socket.once('connect', () => {
+      socket.destroy();
+      resolve(true);
+    });
+    socket.once('error', () => resolve(false));
+    socket.once('timeout', () => {
+      socket.destroy();
+      resolve(false);
+    });
+    socket.connect(port, '127.0.0.1');
+  });
+}
+
 
 async function start() {
   debugLog("Inside start() function");
@@ -165,22 +146,40 @@ async function start() {
 
         debugLog('Download complete. Verifying checksum...');
         sendToTauri('status', { message: 'Verifying SHA-256 integrity...' });
+        if (!release.sha256) {
+          throw new Error('Release has no SHA-256 in manifest.json; refusing unverified install.');
+        }
         if (!patcher.verifyChecksum(tempZipPath, release.sha256)) {
           throw new Error('SHA-256 checksum verification failed.');
         }
 
-        debugLog('Checksum verified. Extracting...');
+        debugLog('Checksum verified. Extracting to staging...');
         sendToTauri('status', { message: 'Unpacking update archive...' });
-        patcher.purgeOldCode();
-        patcher.extractZipPayload(tempZipPath);
+        let lastEmit = 0;
+        const stagingDir = await patcher.extractToStaging(tempZipPath, (file, done, total) => {
+          const now = Date.now();
+          if (done !== total && now - lastEmit < 40) return;
+          lastEmit = now;
+          sendToTauri('extract-progress', {
+            file,
+            done,
+            total,
+            percent: Math.round((done / total) * 100)
+          });
+        });
 
         sendToTauri('status', { message: 'Verifying file integrity...' });
-        if (!patcher.verifyExtraction()) {
+        if (!patcher.verifyExtraction(stagingDir)) {
+          fs.rmSync(stagingDir, { recursive: true, force: true });
           throw new Error('Extraction verification failed: critical startup files missing.');
         }
 
+        sendToTauri('status', { message: 'Replacing old version...' });
+        patcher.commitStaging(stagingDir);
+
         debugLog('Extraction complete. Applying patches...');
         sendToTauri('status', { message: 'Applying configuration patches...' });
+        fileUpdater.snapshotBase();
         patcher.applyPatches(getReplacementsConfig());
 
         sendToTauri('status', { message: 'Migrating security credentials...' });
@@ -210,165 +209,49 @@ async function start() {
 
   try {
     sendToTauri('status', { message: 'Inspecting local workspace and installed files...' });
-    let isFirstRun = !patcher.verifyExtraction();
-    let localVersion = patcher.getCurrentVersion();
-    let localSha = patcher.getCurrentSha();
+    const isFirstRun = !patcher.verifyExtraction();
+    const localVersion = patcher.getCurrentVersion();
+    const localSha = patcher.getCurrentSha();
     debugLog(`Is First Run: ${isFirstRun}, Local Version: ${localVersion}, Local SHA: ${localSha}`);
 
-    function findLocalZip() {
-      const searchRoots = [__dirname, process.cwd(), path.join(__dirname, '../../..')];
-      for (const root of searchRoots) {
-        let cur = root;
-        for (let i = 0; i < 6; i++) {
-          try {
-            const zp = path.join(cur, 'update-payload.zip');
-            if (fs.existsSync(zp)) {
-              const mp = path.join(cur, 'manifest.json');
-              return { zipPath: zp, manifestPath: fs.existsSync(mp) ? mp : null };
-            }
-            const parent = path.dirname(cur);
-            if (parent === cur) break;
-            cur = parent;
-          } catch (e) { }
-        }
-      }
-      return null;
-    }
-
-    const localFound = findLocalZip();
-    let localZipPath = localFound ? localFound.zipPath : null;
-    let localManifestPath = localFound ? localFound.manifestPath : null;
-    let localZipManifest = null;
-
-    if (localManifestPath) {
-      try {
-        localZipManifest = JSON.parse(fs.readFileSync(localManifestPath, 'utf8'));
-      } catch (e) { }
-    }
-
-    if (localZipPath && (isFirstRun || (localZipManifest && localZipManifest.sha256 !== localSha))) {
-      debugLog(`Applying local development payload from: ${localZipPath}`);
-      sendToTauri('status', { message: 'Extracting local development payload...' });
-      patcher.purgeOldCode();
-      patcher.extractZipPayload(localZipPath);
-      patcher.applyPatches(getReplacementsConfig());
-      patcher.bridgeCredentials(serviceManager.credentialManager);
-
-      const ver = localZipManifest ? localZipManifest.version : '1.1.32';
-      const sha = localZipManifest ? localZipManifest.sha256 : null;
-      patcher.saveCurrentVersion(ver, sha);
-      serviceManager.envConfig = getEnvConfig();
-
-      isFirstRun = false;
-      localVersion = ver;
-      localSha = sha;
-      debugLog("Local payload applied successfully.");
-    }
-
     sendToTauri('status', { message: 'Connecting to update servers...' });
     let release = null;
     try {
       debugLog("Fetching updates from updateClient...");
       release = await updateClient.checkForUpdates();
       debugLog(`Update check finished. Found: ${release ? release.version : 'None'}`);
-
-      let appPkgVer = '0.0.0';
-      try {
-        appPkgVer = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf8')).version || '0.0.0';
-      } catch (e) { }
-
-      if (release && release.version) {
-        const rVer = release.version.replace('v', '').split('.').map(Number);
-        const aVer = appPkgVer.split('.').map(Number);
-        let isOlder = false;
-        for (let i = 0; i < 3; i++) {
-          if ((rVer[i] || 0) < (aVer[i] || 0)) { isOlder = true; break; }
-          if ((rVer[i] || 0) > (aVer[i] || 0)) { break; }
-        }
-        if (isOlder) {
-          debugLog(`Remote version ${release.version} is older than local package ${appPkgVer}. Ignoring remote release.`);
-          release = null;
-        }
-      }
     } catch (e) {
       debugLog(`Update check failed (offline?): ${e.message}`);
       sendToTauri('status', { message: `Update server check skipped (${e.message})` });
     }
 
     const normalizeVer = (v) => (v || '').toString().replace(/^v/, '').trim();
+    const parseVer = (v) => normalizeVer(v).split(/[.\-+]/).map((n) => parseInt(n, 10) || 0);
+    const isNewer = (remote, local) => {
+      const a = parseVer(remote);
+      const b = parseVer(local);
+      for (let i = 0; i < Math.max(a.length, b.length); i++) {
+        const x = a[i] || 0;
+        const y = b[i] || 0;
+        if (x !== y) return x > y;
+      }
+      return false;
+    };
 
     if (release) {
-      const isNewerSha = release.sha256 && localSha && release.sha256 !== localSha;
-      const isDifferentVer = normalizeVer(release.version) !== normalizeVer(localVersion);
-      const hasUpdate = (isDifferentVer || isNewerSha) && !localZipPath;
+      const versionNewer = isNewer(release.version, localVersion);
+      const sameVerNewBuild = normalizeVer(release.version) === normalizeVer(localVersion) &&
+        !!release.sha256 && !!localSha && release.sha256 !== localSha;
+      const hasUpdate = versionNewer || sameVerNewBuild;
 
       if (isFirstRun) {
         debugLog("First run with no local payload. Installing remote build...");
         sendToTauri('status', { message: 'First run detected. Preparing initial installation...' });
         await installBuild(release);
       } else if (hasUpdate) {
-
-        debugLog("Update available. Prompting user...");
-        sendToTauri('status', { message: `New update available (${release.version}). Awaiting confirmation...` });
-
-        try {
-          if (process.platform === 'win32') {
-            require('child_process').spawnSync('powershell.exe', [
-              '-NoProfile', '-NonInteractive', '-Command',
-              `Get-NetTCPConnection -LocalPort 4891 -ErrorAction SilentlyContinue | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force }`
-            ], { stdio: 'ignore', windowsHide: true });
-          } else {
-            require('child_process').spawnSync('fuser', ['-k', '-9', `4891/tcp`], { stdio: 'ignore' });
-          }
-        } catch (e) { }
-
-        const tempApp = express();
-        let userDecision = null;
-        tempApp.use((req, res, next) => {
-          res.header('Access-Control-Allow-Origin', '*');
-          res.header('Access-Control-Allow-Methods', 'GET,POST,OPTIONS');
-          res.header('Access-Control-Allow-Headers', '*');
-          res.header('Connection', 'close');
-          if (req.method === 'OPTIONS') return res.sendStatus(200);
-          next();
-        });
-        tempApp.get('/update/info', (req, res) => {
-          res.json({ available: true, current: localVersion, latest: release.version });
-        });
-        tempApp.post('/update/yes', (req, res) => { userDecision = true; res.sendStatus(200); });
-        tempApp.post('/update/no', (req, res) => { userDecision = false; res.sendStatus(200); });
-
-        const tempServer = await new Promise((resolve) => {
-          const s = tempApp.listen(4891, '127.0.0.1', () => resolve(s));
-          s.on('error', (err) => {
-            debugLog(`Update server bind error: ${err.message}`);
-            resolve(null);
-          });
-        });
-
-        sendToTauri('update-available', { current: localVersion, latest: release.version });
-
-        let waitLoops = 0;
-        while (userDecision === null) {
-          if (!tempServer && waitLoops > 400) {
-            userDecision = false;
-            break;
-          }
-          waitLoops++;
-          await new Promise(r => setTimeout(r, 25));
-        }
-
-        if (tempServer) {
-          tempServer.close();
-        }
-
-        if (userDecision) {
-          debugLog("User accepted update.");
-          await installBuild(release);
-        } else {
-          debugLog("User skipped update.");
-          sendToTauri('status', { message: 'Update skipped. Continuing startup...' });
-        }
+        debugLog("Update available. Installing update...");
+        sendToTauri('status', { message: `Updating to ${release.version}...` });
+        await installBuild(release);
       } else {
         debugLog("Already on the latest version.");
         sendToTauri('status', { message: 'Up to date.' });
@@ -381,16 +264,19 @@ async function start() {
         sendToTauri('status', { message: 'Extracting local baseline payload...' });
         patcher.purgeOldCode();
         patcher.extractZipPayload(localZip);
+        fileUpdater.snapshotBase();
         patcher.applyPatches(getReplacementsConfig());
         patcher.bridgeCredentials(serviceManager.credentialManager);
 
         let ver = "1.0.0";
+        let manSha = null;
         try {
           const man = JSON.parse(fs.readFileSync(path.join(__dirname, 'manifest.json'), 'utf8'));
           ver = man.version || ver;
+          manSha = man.sha256 || null;
         } catch (e) { }
 
-        patcher.saveCurrentVersion(ver);
+        patcher.saveCurrentVersion(ver, manSha);
         serviceManager.envConfig = getEnvConfig();
         debugLog("Local payload extracted successfully.");
       } else {
@@ -400,64 +286,75 @@ async function start() {
 
     sendToTauri('status', { message: 'Validating critical components...' });
     if (!patcher.verifyExtraction()) {
-      throw new Error('No application files found. Ensure you ran "npm run build:payload" and the extraction succeeded.');
+      throw new Error('Could not download the app files. Check your internet connection and relaunch.');
+    }
+
+    sendToTauri('status', { message: 'Checking UI files and SDK...' });
+    const [filesCheck, sdkCheck] = await Promise.all([
+      withTimeout(fileUpdater.checkRepos().catch((e) => {
+        debugLog(`Live file check failed: ${e.message}`);
+        return null;
+      }), 60000),
+      withTimeout(fileUpdater.checkSdk().catch((e) => {
+        debugLog(`SDK check failed: ${e.message}`);
+        return null;
+      }), 12000)
+    ]);
+    debugLog(`Repo check result: ${filesCheck ? `${filesCheck.changes.length} change(s)` : 'failed or timed out'}`);
+
+    if (filesCheck && (filesCheck.changes.length > 0 || filesCheck.removed.length > 0)) {
+      sendToTauri('status', { message: `Updating ${filesCheck.changes.length} file(s)...` });
+      try {
+        await fileUpdater.applyLive(filesCheck, getReplacementsConfig(), (file, done, total) => {
+          sendToTauri('extract-progress', { file, done, total, percent: Math.round((done / total) * 100) });
+        });
+        sendToTauri('status', { message: `Updated ${filesCheck.changes.length} file(s).` });
+      } catch (e) {
+        debugLog(`File update failed: ${e.message}`);
+        sendToTauri('status', { message: `File update failed: ${e.message}` });
+      }
+    }
+
+    if (sdkCheck && sdkCheck.outdated) {
+      sendToTauri('status', { message: `Updating SDK (${sdkCheck.latest})...` });
+      try {
+        await fileUpdater.installSdk(sdkCheck);
+        sendToTauri('status', { message: `SDK updated to ${sdkCheck.latest}.` });
+      } catch (e) {
+        debugLog(`SDK install failed: ${e.message}`);
+        sendToTauri('status', { message: `SDK update failed: ${e.message}` });
+      }
     }
 
     sendToTauri('status', { message: 'Loading encrypted credentials...' });
     serviceManager.credentialManager.loadCredentials();
 
-    sendToTauri('status', { message: 'Starting background services (player)...' });
+    const busyPorts = [];
+    for (const port of [3000, 4890]) {
+      if (await portInUse(port)) busyPorts.push(port);
+    }
+    if (busyPorts.length > 0) {
+      throw new Error(`Port ${busyPorts.join(' and ')} is already in use by another program. Close it or any other running Vyla Home, then relaunch.`);
+    }
+
+    sendToTauri('status', { message: 'Starting services (player, frontend)...' });
     await serviceManager.startServices([
-      { name: 'player', relativeDir: 'player', startScript: 'server.js' }
+      { name: 'player', relativeDir: 'player', startScript: 'server.js' },
+      { name: 'frontend', relativeDir: 'frontend', startScript: 'server.js' }
     ]);
     debugLog("Backend services spawn requested.");
 
-    sendToTauri('status', { message: 'Waiting for microservices to bind port 3000...' });
-    await serviceManager.waitForPorts([3000]);
-    debugLog("Port 3000 is ready.");
+    sendToTauri('status', { message: 'Waiting for microservices to bind...' });
+    try {
+      await serviceManager.waitForPorts([3000, 4890], 60000);
+    } catch (e) {
+      throw new Error(`${e.message}. Check logs in ${LOGS_DIR}`);
+    }
+    debugLog("Ports 3000 and 4890 are ready.");
 
-    sendToTauri('status', { message: 'Binding UI server on port 4890...' });
-    const frontendDir = path.join(APPDATA_DIR, 'frontend');
-    expressApp = express();
-    expressApp.use((req, res, next) => {
-      res.header('Access-Control-Allow-Origin', '*');
-      res.header('Access-Control-Allow-Methods', 'GET,POST,OPTIONS');
-      res.header('Access-Control-Allow-Headers', '*');
-      if (req.method === 'OPTIONS') return res.sendStatus(200);
-      next();
-    });
-    expressApp.get('/__tauri_cmd/:cmd', (req, res) => {
-      debugLog(`[FRONTEND-SERVER:4890] Command received: ${req.params.cmd} (window: ${req.query.window || 'main'})`);
-      sendToTauri('tauri-cmd', { cmd: req.params.cmd, url: req.query.url, window: req.query.window });
-      res.sendStatus(200);
-    });
-
-    expressApp.use(sameTabNavMiddleware(frontendDir));
-    expressApp.use(express.static(frontendDir, {
-      etag: false,
-      setHeaders: (res) => {
-        res.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
-      }
-    }));
-    expressApp.use(express.static(path.join(frontendDir, 'src'), {
-      etag: false,
-      setHeaders: (res) => {
-        res.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
-      }
-    }));
-    expressApp.get('*', (req, res) => {
-      res.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
-      res.sendFile(path.join(frontendDir, 'index.html'));
-    });
-
-    const FRONTEND_PORT = 4890;
-    expressApp.use('/build', express.static(path.join(__dirname, 'build')));
-
-    expressServer = expressApp.listen(FRONTEND_PORT, () => {
-      sendToTauri('status', { message: 'All backend services running and healthy.' });
-      debugLog("Frontend Express running on 4890. Sending READY to Tauri.");
-      sendToTauri('ready', { url: `http://localhost:${FRONTEND_PORT}` });
-    });
+    sendToTauri('status', { message: 'All backend services running and healthy.' });
+    debugLog("Sending READY to Tauri.");
+    sendToTauri('ready', { url: 'http://127.0.0.1:4890' });
 
   } catch (error) {
     debugLog(`Fatal Start Error: ${error.message}`);
@@ -467,18 +364,7 @@ async function start() {
 
 process.on('exit', () => {
   if (serviceManager) {
-    for (const name of Object.keys(serviceManager.processes)) {
-      const proc = serviceManager.processes[name];
-      if (proc && proc.child && proc.child.pid) {
-        try {
-          if (process.platform === 'win32') {
-            require('child_process').spawnSync('taskkill', ['/F', '/T', '/PID', proc.child.pid.toString()], { stdio: 'ignore', windowsHide: true });
-          } else {
-            process.kill(-proc.child.pid, 'SIGKILL');
-          }
-        } catch (e) { }
-      }
-    }
+    serviceManager.stopAll();
   }
 });
 
@@ -489,4 +375,4 @@ process.on('SIGTERM', () => {
   process.exit(0);
 });
 
-start();
+start();

package.json

@@ -1,6 +1,6 @@
 {
   "name": "vyla-home",
-  "version": "1.1.35",
+  "version": "1.1.52",
   "description": "Vyla Home Desktop App Launcher",
   "main": "main.js",
   "scripts": {
@@ -11,47 +11,15 @@
     "release:full": "node release.js --installer"
   },
   "dependencies": {
-    "@tauri-apps/api": "^2.0.0",
-    "@tauri-apps/plugin-opener": "^2.0.0",
-    "@tauri-apps/plugin-process": "^2.0.0",
-    "@tauri-apps/plugin-shell": "^2.0.0",
-    "@vyla-entertainment/sdk": "^1.12.0",
-    "adm-zip": "^0.6.0",
-    "express": "^4.19.2"
+    "@tauri-apps/api": "2.12.1",
+    "@tauri-apps/plugin-opener": "2.7.0",
+    "@tauri-apps/plugin-process": "2.4.0",
+    "@tauri-apps/plugin-shell": "2.5.0",
+    "@vyla-entertainment/sdk": "^1.20.0",
+    "adm-zip": "^0.6.1",
+    "express": "^4.22.3"
   },
   "devDependencies": {
-    "@tauri-apps/cli": "^2.0.0"
-  },
-  "build": {
-    "appId": "com.vyla.home",
-    "productName": "Vyla Home",
-    "directories": {
-      "output": "dist"
-    },
-    "files": [
-      "main.js",
-      "preload.js",
-      "service-manager.js",
-      "patcher.js",
-      "crypto-utils.js",
-      "credential-manager.js",
-      "update-client.js",
-      "gitlab-client.js",
-      "config/**/*",
-      "build/icon.ico",
-      "build/logo.txt",
-      "package.json"
-    ],
-    "win": {
-      "target": "nsis",
-      "icon": "build/icon.ico"
-    },
-    "nsis": {
-      "oneClick": false,
-      "allowToChangeInstallationDirectory": true,
-      "installerIcon": "build/icon.ico",
-      "uninstallerIcon": "build/icon.ico",
-      "installerHeaderIcon": "build/icon.ico"
-    }
+    "@tauri-apps/cli": "2.12.1"
   }
 }

patcher.js

@@ -63,65 +63,87 @@ class Patcher {
       const fullPath = path.join(this.appDataPath, dir);
       if (fs.existsSync(fullPath)) {
         try {
-          const trashPath = path.join(this.appDataPath, `.trash_${dir}_${Date.now()}`);
-          fs.renameSync(fullPath, trashPath);
-          fs.rmSync(trashPath, { recursive: true, force: true });
-        } catch (e) {
-          try {
-            fs.rmSync(fullPath, { recursive: true, force: true });
-          } catch (err2) { }
-        }
+          fs.rmSync(fullPath, { recursive: true, force: true });
+        } catch (e) { }
       }
     }
-    try {
-      const files = fs.readdirSync(this.appDataPath);
-      for (const file of files) {
-        if (file.startsWith('.trash_')) {
-          fs.rmSync(path.join(this.appDataPath, file), { recursive: true, force: true });
-        }
-      }
-    } catch (e) { }
   }
 
   extractZipPayload(zipPath) {
-    const AdmZip = require('adm-zip');
     const zip = new AdmZip(zipPath);
     const entries = zip.getEntries();
 
     if (!entries || entries.length === 0) {
-      throw new Error('Downloaded archive is empty, invalid, or truncated.');
+      throw new Error('Archive is empty, invalid, or truncated.');
+    }
+
+    const targetDir = path.resolve(this.appDataPath);
+    for (const entry of entries) {
+      const entryPath = path.normalize(entry.entryName);
+      const resolvedPath = path.resolve(targetDir, entryPath);
+      if (!resolvedPath.startsWith(targetDir)) {
+        throw new Error(`Directory traversal attempt detected in archive: ${entry.entryName}`);
+      }
     }
 
     zip.extractAllTo(this.appDataPath, true);
+  }
 
-    const testPath = path.join(this.appDataPath, 'frontend', 'index.html');
-    if (!fs.existsSync(testPath)) {
-      const { execSync } = require('child_process');
-      if (process.platform === 'win32') {
-        execSync(`powershell.exe -NoProfile -NonInteractive -Command "Expand-Archive -Path '${zipPath}' -DestinationPath '${this.appDataPath}' -Force"`, { windowsHide: true });
-      } else {
-        execSync(`unzip -o "${zipPath}" -d "${this.appDataPath}"`);
+  async extractToStaging(zipPath, onFile) {
+    const stagingDir = path.join(this.appDataPath, '.staging');
+    fs.rmSync(stagingDir, { recursive: true, force: true });
+    fs.mkdirSync(stagingDir, { recursive: true });
+    const zip = new AdmZip(zipPath);
+    const entries = zip.getEntries().filter((e) => !e.isDirectory);
+    if (entries.length === 0) {
+      throw new Error('Downloaded archive is empty, invalid, or truncated.');
+    }
+
+    const resolvedStaging = path.resolve(stagingDir);
+    for (const entry of entries) {
+      const entryPath = path.normalize(entry.entryName);
+      const resolvedPath = path.resolve(resolvedStaging, entryPath);
+      if (!resolvedPath.startsWith(resolvedStaging)) {
+        throw new Error(`Directory traversal attempt detected: ${entry.entryName}`);
       }
     }
+
+    for (let i = 0; i < entries.length; i++) {
+      const entry = entries[i];
+      zip.extractEntryTo(entry, stagingDir, true, true);
+      if (onFile) onFile(entry.entryName, i + 1, entries.length);
+      if (i % 20 === 0) await new Promise((resolve) => setImmediate(resolve));
+    }
+    return stagingDir;
+  }
+
+  commitStaging(stagingDir) {
+    this.purgeOldCode();
+    for (const name of fs.readdirSync(stagingDir)) {
+      const dest = path.join(this.appDataPath, name);
+      fs.rmSync(dest, { recursive: true, force: true });
+      fs.renameSync(path.join(stagingDir, name), dest);
+    }
+    fs.rmSync(stagingDir, { recursive: true, force: true });
   }
 
   verifyChecksum(zipPath, expectedSha256) {
-    if (!expectedSha256) return true;
+    if (!expectedSha256) return false;
     const hash = crypto.createHash('sha256');
     const data = fs.readFileSync(zipPath);
     hash.update(data);
     const calculated = hash.digest('hex');
-    return calculated === expectedSha256;
+    return calculated === String(expectedSha256).trim().toLowerCase();
   }
 
-  verifyExtraction() {
+  verifyExtraction(root = this.appDataPath) {
     const requiredFiles = [
-      'frontend/index.html',
+      'frontend/server.js',
       'player/server.js'
     ];
 
     for (const file of requiredFiles) {
-      const fullPath = path.join(this.appDataPath, file);
+      const fullPath = path.join(root, file);
       if (!fs.existsSync(fullPath)) {
         return false;
       }
@@ -155,7 +177,6 @@ class Patcher {
         if (file === 'node_modules' || file === '.git') continue;
         this.processDirectory(fullPath, replacementList);
       } else if (stat.isFile()) {
-        const ext = path.extname(fullPath).toLowerCase();
         let content = fs.readFileSync(fullPath, 'utf8');
         let modified = false;
 
@@ -184,4 +205,4 @@ class Patcher {
   }
 }
 
-module.exports = Patcher;
+module.exports = Patcher;

preload.js

@@ -1,5 +0,0 @@
-const { contextBridge, ipcRenderer } = require('electron');
-
-contextBridge.exposeInMainWorld('vylaHome', {
-  sendUpdateChoice: (choice) => ipcRenderer.send('update-choice', choice)
-});

service-manager.js

@@ -47,8 +47,14 @@ class ServiceManager {
       this.credentialManager.setCredential('player', 'TOKEN_SECRET', tokenSecret);
     }
 
+    const defaultPorts = {
+      player: 3000,
+      frontend: 4890
+    };
+
     const env = {
       ...process.env,
+      PORT: (this.envConfig[name] && this.envConfig[name].PORT) || defaultPorts[name] || process.env.PORT || 3000,
       TOKEN_SECRET: tokenSecret,
       ...(this.envConfig[name] || {}),
       ...(this.credentialManager.getServiceCredentials(name) || {})
@@ -87,25 +93,6 @@ class ServiceManager {
     child.stderr.on('data', (data) => {
       const text = data.toString().trim();
       this.logToFile(name, `STDERR: ${text}`);
-
-      if (text.includes('EADDRINUSE')) {
-        const match = text.match(/:(\d+)/);
-        const port = match ? match[1] : null;
-        if (port) {
-          try {
-            if (process.platform === 'win32') {
-              require('child_process').spawnSync('powershell.exe', [
-                '-NoProfile',
-                '-NonInteractive',
-                '-Command',
-                `Get-NetTCPConnection -LocalPort ${port} -ErrorAction SilentlyContinue | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force }`
-              ], { stdio: 'ignore', windowsHide: true });
-            } else {
-              require('child_process').spawnSync('fuser', ['-k', '-9', `${port}/tcp`], { stdio: 'ignore' });
-            }
-          } catch (_) { }
-        }
-      }
     });
 
     child.on('exit', (code, signal) => {
@@ -138,7 +125,7 @@ class ServiceManager {
     ));
   }
 
-  async stopAll() {
+  stopAll() {
     this.isStopping = true;
     for (const name of Object.keys(this.stableTimers)) {
       if (this.stableTimers[name]) {
@@ -146,20 +133,14 @@ class ServiceManager {
       }
     }
     this.stableTimers = {};
-    const killPromises = Object.keys(this.processes).map((name) => {
+    for (const name of Object.keys(this.processes)) {
       const procInfo = this.processes[name];
       if (procInfo && procInfo.child) {
-        this.logToFile(name, `Killing service`);
-        return new Promise((resolve) => {
-          procInfo.child.removeAllListeners('exit');
-          procInfo.child.on('exit', () => resolve());
-          procInfo.child.kill();
-        });
+        try {
+          procInfo.child.kill('SIGTERM');
+        } catch (e) { }
       }
-      return Promise.resolve();
-    });
-
-    await Promise.all(killPromises);
+    }
     this.processes = {};
   }
 
@@ -197,4 +178,4 @@ class ServiceManager {
   }
 }
 
-module.exports = ServiceManager;
+module.exports = ServiceManager;

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "vyla-home"
-version = "1.1.35"
+version = "1.1.52"
 description = "Vyla Home Desktop App Launcher"
 edition = "2021"
 
@@ -8,13 +8,11 @@ edition = "2021"
 tauri-build = { version = "2", features = [] }
 
 [dependencies]
-tauri = { version = "2", features = ["devtools"] }
+tauri = { version = "2", features = [] }
 tauri-plugin-opener = "2"
-tauri-plugin-process = "2"
-tauri-plugin-shell = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-base64 = "0.22"
+window-vibrancy = "0.8"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 objc2 = "0.5"

src-tauri/build.rs

@@ -1,6 +1,7 @@
 fn main() {
     println!("cargo:rerun-if-changed=src/main.rs");
     println!("cargo:rerun-if-changed=tauri.conf.json");
+    println!("cargo:rerun-if-changed=capabilities");
     
     if std::env::var("CARGO_CFG_TARGET_OS").unwrap_or_default() == "windows" {
         if let (Ok(manifest_dir), Ok(out_dir)) = (std::env::var("CARGO_MANIFEST_DIR"), std::env::var("OUT_DIR")) {
@@ -28,5 +29,16 @@ fn main() {
         }
     }
     
-    tauri_build::build();
+    tauri_build::try_build(
+        tauri_build::Attributes::new().app_manifest(
+            tauri_build::AppManifest::new().commands(&[
+                "win_minimize",
+                "win_maximize",
+                "win_close",
+                "win_drag",
+                "open_new_window",
+            ]),
+        ),
+    )
+    .expect("failed to run tauri-build");
 }

src-tauri/capabilities/default.json

@@ -1,40 +1,42 @@
 {
     "$schema": "../gen/schemas/desktop-schema.json",
     "identifier": "default",
-    "description": "Default permissions for Vyla Home main window and popups",
+    "description": "Window and opener permissions for local and localhost-served pages",
+    "local": true,
     "windows": [
-        "main",
-        "win_*"
+        "*"
+    ],
+    "webviews": [
+        "*"
     ],
     "remote": {
         "urls": [
-            "http://localhost:4890/*",
-            "http://localhost:3001/*",
-            "http://localhost:3000/*",
-            "http://localhost:7860/*",
-            "http://127.0.0.1:4890/*",
-            "http://127.0.0.1:3001/*",
-            "http://127.0.0.1:3000/*",
-            "http://127.0.0.1:7860/*"
+            "http://localhost:*",
+            "http://localhost:*/*",
+            "http://127.0.0.1:*",
+            "http://127.0.0.1:*/*"
         ]
     },
     "permissions": [
-        "core:default",
-        "core:window:allow-minimize",
-        "core:window:allow-maximize",
-        "core:window:allow-unmaximize",
-        "core:window:allow-is-maximized",
-        "core:window:allow-close",
-        "core:window:allow-start-dragging",
-        "core:webview:allow-create-webview-window",
-        "core:webview:allow-print",
-        "shell:allow-open",
-        "process:allow-exit",
-        "core:app:default",
         "allow-win-minimize",
         "allow-win-maximize",
         "allow-win-close",
         "allow-win-drag",
-        "allow-open-new-window"
+        "allow-open-new-window",
+        "core:default",
+        "core:window:allow-start-dragging",
+        "core:window:allow-minimize",
+        "core:window:allow-maximize",
+        "core:window:allow-unmaximize",
+        "core:window:allow-toggle-maximize",
+        "core:window:allow-close",
+        "core:window:allow-destroy",
+        "core:window:allow-is-maximized",
+        "core:window:allow-is-fullscreen",
+        "core:window:allow-set-fullscreen",
+        "core:window:allow-set-focus",
+        "core:window:allow-show",
+        "core:window:allow-hide",
+        "opener:default"
     ]
 }

src-tauri/gen/schemas/capabilities.json

@@ -1 +1 @@
-{"default":{"identifier":"default","description":"Default permissions for Vyla Home main window and popups","remote":{"urls":["http://localhost:4890/*","http://localhost:3001/*","http://localhost:3000/*","http://localhost:7860/*","http://127.0.0.1:4890/*","http://127.0.0.1:3001/*","http://127.0.0.1:3000/*","http://127.0.0.1:7860/*"]},"local":true,"windows":["main","win_*"],"permissions":["core:default","core:window:allow-minimize","core:window:allow-maximize","core:window:allow-unmaximize","core:window:allow-is-maximized","core:window:allow-close","core:window:allow-start-dragging","core:webview:allow-create-webview-window","core:webview:allow-print","shell:allow-open","process:allow-exit","core:app:default","allow-win-minimize","allow-win-maximize","allow-win-close","allow-win-drag","allow-open-new-window"]}}
+{"default":{"identifier":"default","description":"Window and opener permissions for local and localhost-served pages","remote":{"urls":["http://localhost:*","http://localhost:*/*","http://127.0.0.1:*","http://127.0.0.1:*/*"]},"local":true,"windows":["*"],"webviews":["*"],"permissions":["allow-win-minimize","allow-win-maximize","allow-win-close","allow-win-drag","allow-open-new-window","core:default","core:window:allow-start-dragging","core:window:allow-minimize","core:window:allow-maximize","core:window:allow-unmaximize","core:window:allow-toggle-maximize","core:window:allow-close","core:window:allow-destroy","core:window:allow-is-maximized","core:window:allow-is-fullscreen","core:window:allow-set-fullscreen","core:window:allow-set-focus","core:window:allow-show","core:window:allow-hide","opener:default"]}}

src-tauri/gen/schemas/desktop-schema.json

@@ -302,216 +302,6 @@
                 }
               }
             },
-            {
-              "if": {
-                "properties": {
-                  "identifier": {
-                    "anyOf": [
-                      {
-                        "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
-                        "type": "string",
-                        "const": "shell:default",
-                        "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
-                      },
-                      {
-                        "description": "Enables the execute command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-execute",
-                        "markdownDescription": "Enables the execute command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the kill command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-kill",
-                        "markdownDescription": "Enables the kill command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the open command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-open",
-                        "markdownDescription": "Enables the open command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the spawn command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-spawn",
-                        "markdownDescription": "Enables the spawn command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the stdin_write command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-stdin-write",
-                        "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the execute command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-execute",
-                        "markdownDescription": "Denies the execute command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the kill command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-kill",
-                        "markdownDescription": "Denies the kill command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the open command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-open",
-                        "markdownDescription": "Denies the open command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the spawn command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-spawn",
-                        "markdownDescription": "Denies the spawn command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the stdin_write command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-stdin-write",
-                        "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
-                      }
-                    ]
-                  }
-                }
-              },
-              "then": {
-                "properties": {
-                  "allow": {
-                    "items": {
-                      "title": "ShellScopeEntry",
-                      "description": "Shell scope entry.",
-                      "anyOf": [
-                        {
-                          "type": "object",
-                          "required": [
-                            "cmd",
-                            "name"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "cmd": {
-                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
-                              "type": "string"
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            }
-                          },
-                          "additionalProperties": false
-                        },
-                        {
-                          "type": "object",
-                          "required": [
-                            "name",
-                            "sidecar"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            },
-                            "sidecar": {
-                              "description": "If this command is a sidecar command.",
-                              "type": "boolean"
-                            }
-                          },
-                          "additionalProperties": false
-                        }
-                      ]
-                    }
-                  },
-                  "deny": {
-                    "items": {
-                      "title": "ShellScopeEntry",
-                      "description": "Shell scope entry.",
-                      "anyOf": [
-                        {
-                          "type": "object",
-                          "required": [
-                            "cmd",
-                            "name"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "cmd": {
-                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
-                              "type": "string"
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            }
-                          },
-                          "additionalProperties": false
-                        },
-                        {
-                          "type": "object",
-                          "required": [
-                            "name",
-                            "sidecar"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            },
-                            "sidecar": {
-                              "description": "If this command is a sidecar command.",
-                              "type": "boolean"
-                            }
-                          },
-                          "additionalProperties": false
-                        }
-                      ]
-                    }
-                  }
-                }
-              },
-              "properties": {
-                "identifier": {
-                  "description": "Identifier of the permission or permission set.",
-                  "allOf": [
-                    {
-                      "$ref": "#/definitions/Identifier"
-                    }
-                  ]
-                }
-              }
-            },
             {
               "properties": {
                 "identifier": {
@@ -590,6 +380,36 @@
           "const": "allow-win-minimize",
           "markdownDescription": "Allows minimizing the window"
         },
+        {
+          "description": "Denies the open_new_window command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-open-new-window",
+          "markdownDescription": "Denies the open_new_window command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_close command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-close",
+          "markdownDescription": "Denies the win_close command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_drag command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-drag",
+          "markdownDescription": "Denies the win_drag command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_maximize command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-maximize",
+          "markdownDescription": "Denies the win_maximize command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_minimize command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-minimize",
+          "markdownDescription": "Denies the win_minimize command without any pre-configured scope."
+        },
         {
           "description": "Default core plugins set.\n#### This default permission set includes:\n\n- `core:path:default`\n- `core:event:default`\n- `core:window:default`\n- `core:webview:default`\n- `core:app:default`\n- `core:image:default`\n- `core:resources:default`\n- `core:menu:default`\n- `core:tray:default`",
           "type": "string",
@@ -626,6 +446,12 @@
           "const": "core:app:allow-default-window-icon",
           "markdownDescription": "Enables the default_window_icon command without any pre-configured scope."
         },
+        {
+          "description": "Enables the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-exit",
+          "markdownDescription": "Enables the exit command without any pre-configured scope."
+        },
         {
           "description": "Enables the fetch_data_store_identifiers command without any pre-configured scope.",
           "type": "string",
@@ -716,6 +542,12 @@
           "const": "core:app:deny-default-window-icon",
           "markdownDescription": "Denies the default_window_icon command without any pre-configured scope."
         },
+        {
+          "description": "Denies the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-exit",
+          "markdownDescription": "Denies the exit command without any pre-configured scope."
+        },
         {
           "description": "Denies the fetch_data_store_identifiers command without any pre-configured scope.",
           "type": "string",
@@ -1976,6 +1808,12 @@
           "const": "core:window:allow-set-fullscreen",
           "markdownDescription": "Enables the set_fullscreen command without any pre-configured scope."
         },
+        {
+          "description": "Enables the set_fullscreen_on_monitor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-fullscreen-on-monitor",
+          "markdownDescription": "Enables the set_fullscreen_on_monitor command without any pre-configured scope."
+        },
         {
           "description": "Enables the set_icon command without any pre-configured scope.",
           "type": "string",
@@ -2444,6 +2282,12 @@
           "const": "core:window:deny-set-fullscreen",
           "markdownDescription": "Denies the set_fullscreen command without any pre-configured scope."
         },
+        {
+          "description": "Denies the set_fullscreen_on_monitor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-fullscreen-on-monitor",
+          "markdownDescription": "Denies the set_fullscreen_on_monitor command without any pre-configured scope."
+        },
         {
           "description": "Denies the set_icon command without any pre-configured scope.",
           "type": "string",
@@ -2653,102 +2497,6 @@
           "type": "string",
           "const": "opener:deny-reveal-item-in-dir",
           "markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
-        },
-        {
-          "description": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`",
-          "type": "string",
-          "const": "process:default",
-          "markdownDescription": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`"
-        },
-        {
-          "description": "Enables the exit command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:allow-exit",
-          "markdownDescription": "Enables the exit command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the restart command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:allow-restart",
-          "markdownDescription": "Enables the restart command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the exit command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:deny-exit",
-          "markdownDescription": "Denies the exit command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the restart command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:deny-restart",
-          "markdownDescription": "Denies the restart command without any pre-configured scope."
-        },
-        {
-          "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
-          "type": "string",
-          "const": "shell:default",
-          "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
-        },
-        {
-          "description": "Enables the execute command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-execute",
-          "markdownDescription": "Enables the execute command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the kill command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-kill",
-          "markdownDescription": "Enables the kill command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the open command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-open",
-          "markdownDescription": "Enables the open command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the spawn command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-spawn",
-          "markdownDescription": "Enables the spawn command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the stdin_write command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-stdin-write",
-          "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the execute command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-execute",
-          "markdownDescription": "Denies the execute command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the kill command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-kill",
-          "markdownDescription": "Denies the kill command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the open command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-open",
-          "markdownDescription": "Denies the open command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the spawn command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-spawn",
-          "markdownDescription": "Denies the spawn command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the stdin_write command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-stdin-write",
-          "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
         }
       ]
     },
@@ -2862,50 +2610,6 @@
           "type": "string"
         }
       ]
-    },
-    "ShellScopeEntryAllowedArg": {
-      "description": "A command argument allowed to be executed by the webview API.",
-      "anyOf": [
-        {
-          "description": "A non-configurable argument that is passed to the command in the order it was specified.",
-          "type": "string"
-        },
-        {
-          "description": "A variable that is set while calling the command from the webview API.",
-          "type": "object",
-          "required": [
-            "validator"
-          ],
-          "properties": {
-            "raw": {
-              "description": "Marks the validator as a raw regex, meaning the plugin should not make any modification at runtime.\n\nThis means the regex will not match on the entire string by default, which might be exploited if your regex allow unexpected input to be considered valid. When using this option, make sure your regex is correct.",
-              "default": false,
-              "type": "boolean"
-            },
-            "validator": {
-              "description": "[regex] validator to require passed values to conform to an expected input.\n\nThis will require the argument value passed to this variable to match the `validator` regex before it will be executed.\n\nThe regex string is by default surrounded by `^...$` to match the full string. For example the `https?://\\w+` regex would be registered as `^https?://\\w+$`.\n\n[regex]: <https://docs.rs/regex/latest/regex/#syntax>",
-              "type": "string"
-            }
-          },
-          "additionalProperties": false
-        }
-      ]
-    },
-    "ShellScopeEntryAllowedArgs": {
-      "description": "A set of command arguments allowed to be executed by the webview API.\n\nA value of `true` will allow any arguments to be passed to the command. `false` will disable all arguments. A list of [`ShellScopeEntryAllowedArg`] will set those arguments as the only valid arguments to be passed to the attached command configuration.",
-      "anyOf": [
-        {
-          "description": "Use a simple boolean to allow all or disable all arguments to this command configuration.",
-          "type": "boolean"
-        },
-        {
-          "description": "A specific set of [`ShellScopeEntryAllowedArg`] that are valid to call for the command configuration.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/ShellScopeEntryAllowedArg"
-          }
-        }
-      ]
     }
   }
 }

src-tauri/gen/schemas/windows-schema.json

@@ -302,216 +302,6 @@
                 }
               }
             },
-            {
-              "if": {
-                "properties": {
-                  "identifier": {
-                    "anyOf": [
-                      {
-                        "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
-                        "type": "string",
-                        "const": "shell:default",
-                        "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
-                      },
-                      {
-                        "description": "Enables the execute command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-execute",
-                        "markdownDescription": "Enables the execute command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the kill command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-kill",
-                        "markdownDescription": "Enables the kill command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the open command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-open",
-                        "markdownDescription": "Enables the open command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the spawn command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-spawn",
-                        "markdownDescription": "Enables the spawn command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Enables the stdin_write command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:allow-stdin-write",
-                        "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the execute command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-execute",
-                        "markdownDescription": "Denies the execute command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the kill command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-kill",
-                        "markdownDescription": "Denies the kill command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the open command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-open",
-                        "markdownDescription": "Denies the open command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the spawn command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-spawn",
-                        "markdownDescription": "Denies the spawn command without any pre-configured scope."
-                      },
-                      {
-                        "description": "Denies the stdin_write command without any pre-configured scope.",
-                        "type": "string",
-                        "const": "shell:deny-stdin-write",
-                        "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
-                      }
-                    ]
-                  }
-                }
-              },
-              "then": {
-                "properties": {
-                  "allow": {
-                    "items": {
-                      "title": "ShellScopeEntry",
-                      "description": "Shell scope entry.",
-                      "anyOf": [
-                        {
-                          "type": "object",
-                          "required": [
-                            "cmd",
-                            "name"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "cmd": {
-                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
-                              "type": "string"
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            }
-                          },
-                          "additionalProperties": false
-                        },
-                        {
-                          "type": "object",
-                          "required": [
-                            "name",
-                            "sidecar"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            },
-                            "sidecar": {
-                              "description": "If this command is a sidecar command.",
-                              "type": "boolean"
-                            }
-                          },
-                          "additionalProperties": false
-                        }
-                      ]
-                    }
-                  },
-                  "deny": {
-                    "items": {
-                      "title": "ShellScopeEntry",
-                      "description": "Shell scope entry.",
-                      "anyOf": [
-                        {
-                          "type": "object",
-                          "required": [
-                            "cmd",
-                            "name"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "cmd": {
-                              "description": "The command name. It can start with a variable that resolves to a system base directory. The variables are: `$AUDIO`, `$CACHE`, `$CONFIG`, `$DATA`, `$LOCALDATA`, `$DESKTOP`, `$DOCUMENT`, `$DOWNLOAD`, `$EXE`, `$FONT`, `$HOME`, `$PICTURE`, `$PUBLIC`, `$RUNTIME`, `$TEMPLATE`, `$VIDEO`, `$RESOURCE`, `$LOG`, `$TEMP`, `$APPCONFIG`, `$APPDATA`, `$APPLOCALDATA`, `$APPCACHE`, `$APPLOG`.",
-                              "type": "string"
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            }
-                          },
-                          "additionalProperties": false
-                        },
-                        {
-                          "type": "object",
-                          "required": [
-                            "name",
-                            "sidecar"
-                          ],
-                          "properties": {
-                            "args": {
-                              "description": "The allowed arguments for the command execution.",
-                              "allOf": [
-                                {
-                                  "$ref": "#/definitions/ShellScopeEntryAllowedArgs"
-                                }
-                              ]
-                            },
-                            "name": {
-                              "description": "The name for this allowed shell command configuration.\n\nThis name will be used inside of the webview API to call this command along with any specified arguments.",
-                              "type": "string"
-                            },
-                            "sidecar": {
-                              "description": "If this command is a sidecar command.",
-                              "type": "boolean"
-                            }
-                          },
-                          "additionalProperties": false
-                        }
-                      ]
-                    }
-                  }
-                }
-              },
-              "properties": {
-                "identifier": {
-                  "description": "Identifier of the permission or permission set.",
-                  "allOf": [
-                    {
-                      "$ref": "#/definitions/Identifier"
-                    }
-                  ]
-                }
-              }
-            },
             {
               "properties": {
                 "identifier": {
@@ -590,6 +380,36 @@
           "const": "allow-win-minimize",
           "markdownDescription": "Allows minimizing the window"
         },
+        {
+          "description": "Denies the open_new_window command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-open-new-window",
+          "markdownDescription": "Denies the open_new_window command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_close command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-close",
+          "markdownDescription": "Denies the win_close command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_drag command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-drag",
+          "markdownDescription": "Denies the win_drag command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_maximize command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-maximize",
+          "markdownDescription": "Denies the win_maximize command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the win_minimize command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-win-minimize",
+          "markdownDescription": "Denies the win_minimize command without any pre-configured scope."
+        },
         {
           "description": "Default core plugins set.\n#### This default permission set includes:\n\n- `core:path:default`\n- `core:event:default`\n- `core:window:default`\n- `core:webview:default`\n- `core:app:default`\n- `core:image:default`\n- `core:resources:default`\n- `core:menu:default`\n- `core:tray:default`",
           "type": "string",
@@ -626,6 +446,12 @@
           "const": "core:app:allow-default-window-icon",
           "markdownDescription": "Enables the default_window_icon command without any pre-configured scope."
         },
+        {
+          "description": "Enables the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:allow-exit",
+          "markdownDescription": "Enables the exit command without any pre-configured scope."
+        },
         {
           "description": "Enables the fetch_data_store_identifiers command without any pre-configured scope.",
           "type": "string",
@@ -716,6 +542,12 @@
           "const": "core:app:deny-default-window-icon",
           "markdownDescription": "Denies the default_window_icon command without any pre-configured scope."
         },
+        {
+          "description": "Denies the exit command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:app:deny-exit",
+          "markdownDescription": "Denies the exit command without any pre-configured scope."
+        },
         {
           "description": "Denies the fetch_data_store_identifiers command without any pre-configured scope.",
           "type": "string",
@@ -1976,6 +1808,12 @@
           "const": "core:window:allow-set-fullscreen",
           "markdownDescription": "Enables the set_fullscreen command without any pre-configured scope."
         },
+        {
+          "description": "Enables the set_fullscreen_on_monitor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:allow-set-fullscreen-on-monitor",
+          "markdownDescription": "Enables the set_fullscreen_on_monitor command without any pre-configured scope."
+        },
         {
           "description": "Enables the set_icon command without any pre-configured scope.",
           "type": "string",
@@ -2444,6 +2282,12 @@
           "const": "core:window:deny-set-fullscreen",
           "markdownDescription": "Denies the set_fullscreen command without any pre-configured scope."
         },
+        {
+          "description": "Denies the set_fullscreen_on_monitor command without any pre-configured scope.",
+          "type": "string",
+          "const": "core:window:deny-set-fullscreen-on-monitor",
+          "markdownDescription": "Denies the set_fullscreen_on_monitor command without any pre-configured scope."
+        },
         {
           "description": "Denies the set_icon command without any pre-configured scope.",
           "type": "string",
@@ -2653,102 +2497,6 @@
           "type": "string",
           "const": "opener:deny-reveal-item-in-dir",
           "markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
-        },
-        {
-          "description": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`",
-          "type": "string",
-          "const": "process:default",
-          "markdownDescription": "This permission set configures which\nprocess features are by default exposed.\n\n#### Granted Permissions\n\nThis enables to quit via `allow-exit` and restart via `allow-restart`\nthe application.\n\n#### This default permission set includes:\n\n- `allow-exit`\n- `allow-restart`"
-        },
-        {
-          "description": "Enables the exit command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:allow-exit",
-          "markdownDescription": "Enables the exit command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the restart command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:allow-restart",
-          "markdownDescription": "Enables the restart command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the exit command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:deny-exit",
-          "markdownDescription": "Denies the exit command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the restart command without any pre-configured scope.",
-          "type": "string",
-          "const": "process:deny-restart",
-          "markdownDescription": "Denies the restart command without any pre-configured scope."
-        },
-        {
-          "description": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`",
-          "type": "string",
-          "const": "shell:default",
-          "markdownDescription": "This permission set configures which\nshell functionality is exposed by default.\n\n#### Granted Permissions\n\nIt allows to use the `open` functionality with a reasonable\nscope pre-configured. It will allow opening `http(s)://`,\n`tel:` and `mailto:` links.\n\n#### This default permission set includes:\n\n- `allow-open`"
-        },
-        {
-          "description": "Enables the execute command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-execute",
-          "markdownDescription": "Enables the execute command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the kill command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-kill",
-          "markdownDescription": "Enables the kill command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the open command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-open",
-          "markdownDescription": "Enables the open command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the spawn command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-spawn",
-          "markdownDescription": "Enables the spawn command without any pre-configured scope."
-        },
-        {
-          "description": "Enables the stdin_write command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:allow-stdin-write",
-          "markdownDescription": "Enables the stdin_write command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the execute command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-execute",
-          "markdownDescription": "Denies the execute command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the kill command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-kill",
-          "markdownDescription": "Denies the kill command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the open command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-open",
-          "markdownDescription": "Denies the open command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the spawn command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-spawn",
-          "markdownDescription": "Denies the spawn command without any pre-configured scope."
-        },
-        {
-          "description": "Denies the stdin_write command without any pre-configured scope.",
-          "type": "string",
-          "const": "shell:deny-stdin-write",
-          "markdownDescription": "Denies the stdin_write command without any pre-configured scope."
         }
       ]
     },
@@ -2862,50 +2610,6 @@
           "type": "string"
         }
       ]
-    },
-    "ShellScopeEntryAllowedArg": {
-      "description": "A command argument allowed to be executed by the webview API.",
-      "anyOf": [
-        {
-          "description": "A non-configurable argument that is passed to the command in the order it was specified.",
-          "type": "string"
-        },
-        {
-          "description": "A variable that is set while calling the command from the webview API.",
-          "type": "object",
-          "required": [
-            "validator"
-          ],
-          "properties": {
-            "raw": {
-              "description": "Marks the validator as a raw regex, meaning the plugin should not make any modification at runtime.\n\nThis means the regex will not match on the entire string by default, which might be exploited if your regex allow unexpected input to be considered valid. When using this option, make sure your regex is correct.",
-              "default": false,
-              "type": "boolean"
-            },
-            "validator": {
-              "description": "[regex] validator to require passed values to conform to an expected input.\n\nThis will require the argument value passed to this variable to match the `validator` regex before it will be executed.\n\nThe regex string is by default surrounded by `^...$` to match the full string. For example the `https?://\\w+` regex would be registered as `^https?://\\w+$`.\n\n[regex]: <https://docs.rs/regex/latest/regex/#syntax>",
-              "type": "string"
-            }
-          },
-          "additionalProperties": false
-        }
-      ]
-    },
-    "ShellScopeEntryAllowedArgs": {
-      "description": "A set of command arguments allowed to be executed by the webview API.\n\nA value of `true` will allow any arguments to be passed to the command. `false` will disable all arguments. A list of [`ShellScopeEntryAllowedArg`] will set those arguments as the only valid arguments to be passed to the attached command configuration.",
-      "anyOf": [
-        {
-          "description": "Use a simple boolean to allow all or disable all arguments to this command configuration.",
-          "type": "boolean"
-        },
-        {
-          "description": "A specific set of [`ShellScopeEntryAllowedArg`] that are valid to call for the command configuration.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/ShellScopeEntryAllowedArg"
-          }
-        }
-      ]
     }
   }
 }

src-tauri/permissions/autogenerated/open_new_window.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-open-new-window"
+description = "Enables the open_new_window command without any pre-configured scope."
+commands.allow = ["open_new_window"]
+
+[[permission]]
+identifier = "deny-open-new-window"
+description = "Denies the open_new_window command without any pre-configured scope."
+commands.deny = ["open_new_window"]

src-tauri/permissions/autogenerated/win_close.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-win-close"
+description = "Enables the win_close command without any pre-configured scope."
+commands.allow = ["win_close"]
+
+[[permission]]
+identifier = "deny-win-close"
+description = "Denies the win_close command without any pre-configured scope."
+commands.deny = ["win_close"]

src-tauri/permissions/autogenerated/win_drag.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-win-drag"
+description = "Enables the win_drag command without any pre-configured scope."
+commands.allow = ["win_drag"]
+
+[[permission]]
+identifier = "deny-win-drag"
+description = "Denies the win_drag command without any pre-configured scope."
+commands.deny = ["win_drag"]

src-tauri/permissions/autogenerated/win_maximize.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-win-maximize"
+description = "Enables the win_maximize command without any pre-configured scope."
+commands.allow = ["win_maximize"]
+
+[[permission]]
+identifier = "deny-win-maximize"
+description = "Denies the win_maximize command without any pre-configured scope."
+commands.deny = ["win_maximize"]

src-tauri/permissions/autogenerated/win_minimize.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-win-minimize"
+description = "Enables the win_minimize command without any pre-configured scope."
+commands.allow = ["win_minimize"]
+
+[[permission]]
+identifier = "deny-win-minimize"
+description = "Denies the win_minimize command without any pre-configured scope."
+commands.deny = ["win_minimize"]

src-tauri/permissions/default.toml

@@ -3,27 +3,32 @@
 [[permission]]
 identifier = "allow-win-minimize"
 description = "Allows minimizing the window"
-commands.allow = ["win_minimize"]
+[[permission.allow]]
+cmd = "win_minimize"
 
 [[permission]]
 identifier = "allow-win-maximize"
 description = "Allows maximizing/unmaximizing the window"
-commands.allow = ["win_maximize"]
+[[permission.allow]]
+cmd = "win_maximize"
 
 [[permission]]
 identifier = "allow-win-close"
 description = "Allows closing the window"
-commands.allow = ["win_close"]
+[[permission.allow]]
+cmd = "win_close"
 
 [[permission]]
 identifier = "allow-win-drag"
 description = "Allows dragging the window"
-commands.allow = ["win_drag"]
+[[permission.allow]]
+cmd = "win_drag"
 
 [[permission]]
 identifier = "allow-open-new-window"
 description = "Allows opening a new webview window"
-commands.allow = ["open_new_window"]
+[[permission.allow]]
+cmd = "open_new_window"
 
 [[set]]
 identifier = "default"
@@ -34,4 +39,4 @@ permissions = [
     "allow-win-close",
     "allow-win-drag",
     "allow-open-new-window"
-]
+]

src-tauri/src/main.rs

@@ -2,8 +2,9 @@
 
 use std::path::PathBuf;
 use std::process::{Child, Command, Stdio};
-use std::sync::Mutex;
-use tauri::{Emitter, Manager, State, WebviewUrl, WebviewWindowBuilder};
+use std::sync::{Arc, Mutex};
+use tauri::webview::NewWindowResponse;
+use tauri::{AppHandle, Emitter, Manager, State, WebviewUrl, WebviewWindowBuilder};
 
 fn debug_log(msg: &str) {
     let log_dir = if let Ok(app_data) = std::env::var("APPDATA") {
@@ -11,8 +12,8 @@ fn debug_log(msg: &str) {
             .join("vyla-home")
             .join("vyla-home-files")
             .join("logs")
-    } else if let Ok(home) = std::env::var("HOME") {
-        std::path::PathBuf::from(home)
+    } else if let Ok(_home) = std::env::var("HOME") {
+        std::path::PathBuf::from(_home)
             .join("Library")
             .join("Logs")
             .join("VylaHome")
@@ -39,15 +40,44 @@ fn debug_log(msg: &str) {
 
 struct NodeServices(Mutex<Option<Child>>);
 
+static WINDOW_COUNTER: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(1);
+
+static READY_URL: Mutex<Option<String>> = Mutex::new(None);
+
+fn js_log(app: &AppHandle, msg: &str) {
+    debug_log(msg);
+    if let Some(w) = app.get_webview_window("main") {
+        let text = serde_json::to_string(&format!("[rust] {}", msg)).unwrap_or_default();
+        let _ = w.eval(&format!("console.log({});", text));
+    }
+}
+
 #[derive(serde::Deserialize, serde::Serialize, Clone)]
 struct BackendMessage {
     event: String,
     data: serde_json::Value,
 }
 
+struct UiGate {
+    ready: bool,
+    queue: Vec<BackendMessage>,
+}
+
+type SharedGate = Arc<Mutex<UiGate>>;
+
+fn dispatch(w: &tauri::WebviewWindow, gate: &SharedGate, msg: BackendMessage) {
+    if let Ok(mut lock) = gate.lock() {
+        if lock.ready {
+            let _ = w.emit(&msg.event, msg.data);
+        } else {
+            lock.queue.push(msg);
+        }
+    }
+}
+
 fn clean_path(path: &std::path::Path) -> String {
     let s = path.to_string_lossy().to_string();
-    if s.starts_with("\\\\?\\") {
+    if s.starts_with(r"\\?\") {
         s[4..].to_string()
     } else {
         s
@@ -121,7 +151,7 @@ fn find_node_binary(app: &tauri::App) -> Option<String> {
             if node_exe.exists() {
                 return Some(clean_path(&node_exe));
             }
-                
+
             let node = p.join("node");
             if node.exists() {
                 return Some(clean_path(&node));
@@ -203,28 +233,89 @@ const LINK_HANDLER_SCRIPT: &str = r##"
         return Promise.resolve(null);
     }
 
-    function minimizeWindow() { doInvoke('win_minimize'); }
-    function maximizeWindow() { doInvoke('win_maximize'); }
-    function closeWindow() { doInvoke('win_close'); }
-    function dragWindow() { doInvoke('win_drag'); }
+    function callWindow(method, fallbackCmd) {
+        const fallback = () => doInvoke(fallbackCmd).catch(err => console.error(fallbackCmd + ' failed:', err));
+        try {
+            if (window.__TAURI__ && window.__TAURI__.window) {
+                return window.__TAURI__.window.getCurrentWindow()[method]().catch(fallback);
+            }
+        } catch (err) {}
+        return fallback();
+    }
+    function minimizeWindow() {
+        return callWindow('minimize', 'win_minimize');
+    }
+    function maximizeWindow() {
+        return callWindow('toggleMaximize', 'win_maximize');
+    }
+    function closeWindow() {
+        return callWindow('close', 'win_close');
+    }
+    function dragWindow() {
+        return callWindow('startDragging', 'win_drag');
+    }
 
     function openExternalUrl(url) {
         if (window.__TAURI__ && window.__TAURI__.opener) {
             window.__TAURI__.opener.openUrl(url);
-        } else if (window.__TAURI__ && window.__TAURI__.shell) {
-            window.__TAURI__.shell.open(url);
         } else {
             window.open(url, '_blank');
         }
     }
 
+    const nativeWindowOpen = window.open.bind(window);
+
+    function openInNewWindow(rawUrl) {
+        let abs;
+        try {
+            abs = new URL(rawUrl, location.href).href;
+        } catch (err) {
+            console.log('[vyla] bad url', rawUrl);
+            return;
+        }
+        console.log('[vyla] open new window', abs);
+        nativeWindowOpen(abs, '_blank');
+    }
+
     window.open = function(url, target, features) {
-        doInvoke('open_new_window', { url: url });
-        return null;
+        console.log('[vyla] window.open called', url, target, features);
+        const go = (v) => {
+            if (v && !/^(about:|javascript:|blob:|data:)/i.test(String(v))) {
+                openInNewWindow(String(v));
+            }
+        };
+        go(url);
+        const stub = {
+            closed: false,
+            close() {},
+            focus() {},
+            blur() {},
+            postMessage() {},
+            document: { write() {}, writeln() {}, close() {}, open() {} }
+        };
+        Object.defineProperty(stub, 'location', {
+            get() {
+                return { href: '', replace: go, assign: go };
+            },
+            set(v) {
+                go(v);
+            }
+        });
+        return stub;
     };
 
-    document.addEventListener('click', (e) => {
-        const a = e.target.closest('a');
+    const origAnchorClick = HTMLAnchorElement.prototype.click;
+    HTMLAnchorElement.prototype.click = function() {
+        if (this.href && this.target === '_blank' && !this.isConnected) {
+            console.log('[vyla] detached anchor click', this.href);
+            openInNewWindow(this.href);
+            return;
+        }
+        return origAnchorClick.apply(this, arguments);
+    };
+
+    function handleLinkClick(e) {
+        const a = e.target.closest && e.target.closest('a');
         if (!a || !a.href) return;
 
         if (a.href.includes('discord.gg') || a.href.includes('discord.com')) {
@@ -237,115 +328,19 @@ const LINK_HANDLER_SCRIPT: &str = r##"
         if (a.target === '_blank' || e.ctrlKey || e.metaKey || e.button === 1) {
             e.preventDefault();
             e.stopPropagation();
-            doInvoke('open_new_window', { url: a.href });
+            openInNewWindow(a.href);
         }
-    }, true);
+    }
+
+    document.addEventListener('click', handleLinkClick, true);
+    document.addEventListener('auxclick', handleLinkClick, true);
 
     function injectLiquidNavBar() {
-        if (document.getElementById('vyla-floating-nav')) return;
+        if (document.getElementById('tauri-custom-titlebar')) return;
         if (!document.body) return;
 
         const style = document.createElement('style');
         style.innerHTML = `
-            #vyla-floating-nav {
-                position: fixed !important;
-                top: 12px !important;
-                left: 12px !important;
-                z-index: 2147483647 !important;
-                height: 42px !important;
-                width: 42px !important;
-                border-radius: 9999px !important;
-                display: flex !important;
-                align-items: center !important;
-                background: rgba(255, 255, 255, 0.04) !important;
-                backdrop-filter: blur(16px) saturate(1.8) contrast(1.1) !important;
-                -webkit-backdrop-filter: blur(16px) saturate(1.8) contrast(1.1) !important;
-                box-shadow: 0 8px 32px rgba(0, 0, 0, 0.45) !important;
-                transition: width 0.3s cubic-bezier(0.16, 1, 0.3, 1), padding 0.3s cubic-bezier(0.16, 1, 0.3, 1) !important;
-                overflow: hidden !important;
-                padding: 0 !important;
-                user-select: none !important;
-                pointer-events: auto !important;
-                -webkit-app-region: no-drag !important;
-            }
-                
-            #vyla-floating-nav:hover {
-                width: 82px !important;
-                padding-right: 6px !important;
-            }
-                
-            .vyla-nav-logo-wrap {
-                width: 42px !important;
-                min-width: 42px !important;
-                height: 42px !important;
-                display: flex !important;
-                align-items: center !important;
-                justify-content: center !important;
-                cursor: pointer !important;
-                border-radius: 9999px !important;
-                position: relative !important;
-                z-index: 2147483647 !important;
-                pointer-events: auto !important;
-                padding: 0 !important;
-            }
-                
-            .vyla-nav-logo-wrap img {
-                width: 26px !important;
-                height: 26px !important;
-                min-width: 26px !important;
-                min-height: 26px !important;
-                object-fit: contain !important;
-                pointer-events: none !important;
-                display: block !important;
-            }
-                
-            .vyla-nav-links {
-                display: flex !important;
-                align-items: center !important;
-                gap: 4px !important;
-                opacity: 0 !important;
-                transform: translateX(-6px) !important;
-                transition: opacity 0.2s ease, transform 0.25s cubic-bezier(0.16, 1, 0.3, 1) !important;
-                pointer-events: none !important;
-                position: relative !important;
-                z-index: 2 !important;
-                margin-left: 2px !important;
-            }
-                
-            #vyla-floating-nav:hover .vyla-nav-links {
-                opacity: 1 !important;
-                transform: translateX(0) !important;
-                pointer-events: auto !important;
-            }
-                
-            .vyla-nav-btn {
-                width: 32px !important;
-                min-width: 32px !important;
-                height: 32px !important;
-                border-radius: 9999px !important;
-                border: none !important;
-                outline: none !important;
-                background: transparent !important;
-                box-shadow: none !important;
-                color: #ffffff !important;
-                display: flex !important;
-                align-items: center !important;
-                justify-content: center !important;
-                cursor: pointer !important;
-                transition: transform 0.15s ease, opacity 0.2s ease !important;
-                opacity: 0.85 !important;
-                padding: 0 !important;
-            }
-                
-            .vyla-nav-btn:hover { opacity: 1 !important; }
-            .vyla-nav-btn svg {
-                width: 20px !important;
-                height: 20px !important;
-                fill: #ffffff !important;
-                pointer-events: none !important;
-                display: block !important;
-            }
-                
             #tauri-custom-titlebar {
                 position: fixed !important;
                 top: 0 !important;
@@ -363,7 +358,7 @@ const LINK_HANDLER_SCRIPT: &str = r##"
                 margin: 0 !important;
                 padding: 0 !important;
             }
-                
+
             .tauri-drag-region {
                 position: absolute !important;
                 inset: 0 !important;
@@ -371,7 +366,7 @@ const LINK_HANDLER_SCRIPT: &str = r##"
                 cursor: default !important;
                 pointer-events: auto !important;
             }
-                
+
             .tauri-window-controls {
                 display: flex !important;
                 height: 32px !important;
@@ -380,7 +375,7 @@ const LINK_HANDLER_SCRIPT: &str = r##"
                 pointer-events: auto !important;
                 z-index: 2147483648 !important;
             }
-                
+
             button.tauri-btn {
                 width: 46px !important;
                 min-width: 46px !important;
@@ -394,44 +389,16 @@ const LINK_HANDLER_SCRIPT: &str = r##"
                 justify-content: center !important;
                 cursor: pointer !important;
                 outline: none !important;
+                pointer-events: auto !important;
             }
-                
+
             button.tauri-btn:hover { background: rgba(255, 255, 255, 0.2) !important; }
             button#tauri-btn-close:hover { background: #e81123 !important; color: #ffffff !important; }
             button.tauri-btn svg { width: 10px !important; height: 10px !important; fill: currentColor !important; pointer-events: none !important; }
         `;
-        document.head.appendChild(style);
-
-        const nav = document.createElement('div');
-        nav.id = 'vyla-floating-nav';
-        nav.innerHTML = `
-            <div class="vyla-nav-logo-wrap" title="Go to Home">
-                <img src="https://gitlab.com/vyla-entertainment/home-frontend/-/raw/main/assets/images/icons/logo_white.png" alt="Logo" />
-            </div>
-            <div class="vyla-nav-links">
-                <button class="vyla-nav-btn" id="vyla-btn-discord" title="Discord Community">
-                    <svg viewBox="0 0 127.14 96.36"><path d="M107.7,8.07A105.15,105.15,0,0,0,81.47,0a72.06,72.06,0,0,0-3.36,6.83A97.68,97.68,0,0,0,49,6.83,72.37,72.37,0,0,0,45.64,0,105.89,105.89,0,0,0,19.39,8.09C2.79,32.65-1.71,56.6.54,80.21h0A105.73,105.73,0,0,0,32.71,96.36,77.7,77.7,0,0,0,39.6,85.25a68.42,68.42,0,0,1-10.85-5.18c.91-.66,1.8-1.34,2.66-2a75.57,75.57,0,0,0,64.32,0c.87.71,1.76,1.39,2.66,2a68.68,68.68,0,0,1-10.87,5.19,77,77,0,0,0,6.89,11.1A105.25,105.25,0,0,0,126.6,80.22h0C129.24,52.84,122.09,29.11,107.7,8.07ZM42.45,65.69C36.18,65.69,31,60,31,53s5-12.74,11.43-12.74S54,45.91,53.89,53,48.84,65.69,42.45,65.69Zm42.24,0C78.41,65.69,73.25,60,73.25,53s5-12.74,11.44-12.74S96.23,45.91,96.12,53,91.08,65.69,84.69,65.69Z"/></svg>
-                </button>
-            </div>
-        `;
-        document.body.appendChild(nav);
-
-        const logoBtn = nav.querySelector('.vyla-nav-logo-wrap');
-        if (logoBtn) {
-            logoBtn.onclick = (e) => {
-                e.preventDefault();
-                e.stopPropagation();
-                window.location.href = 'http://localhost:4890';
-            };
-        }
-
-        const btnDiscord = nav.querySelector('#vyla-btn-discord');
-        if (btnDiscord) {
-            btnDiscord.onclick = (e) => {
-                e.preventDefault();
-                e.stopPropagation();
-                openExternalUrl('https://discord.gg/5eqRhKeywG');
-            };
+        if (!document.getElementById('tauri-custom-titlebar-style')) {
+            style.id = 'tauri-custom-titlebar-style';
+            (document.head || document.documentElement).appendChild(style);
         }
 
         const tb = document.createElement('div');
@@ -451,31 +418,60 @@ const LINK_HANDLER_SCRIPT: &str = r##"
         const btnClose = tb.querySelector('#tauri-btn-close');
         const dragEl = tb.querySelector('.tauri-drag-region');
 
-        if (btnMin) btnMin.onclick = (e) => { e.preventDefault(); e.stopPropagation(); minimizeWindow(); };
-        if (btnMax) btnMax.onclick = (e) => { e.preventDefault(); e.stopPropagation(); maximizeWindow(); };
-        if (btnClose) btnClose.onclick = (e) => { e.preventDefault(); e.stopPropagation(); closeWindow(); };
+        if (btnMin) {
+            btnMin.addEventListener('click', (e) => {
+                e.preventDefault();
+                e.stopPropagation();
+                e.stopImmediatePropagation();
+                minimizeWindow();
+            }, true);
+        }
+        if (btnMax) {
+            btnMax.addEventListener('click', (e) => {
+                e.preventDefault();
+                e.stopPropagation();
+                e.stopImmediatePropagation();
+                maximizeWindow();
+            }, true);
+        }
+        if (btnClose) {
+            btnClose.addEventListener('click', (e) => {
+                e.preventDefault();
+                e.stopPropagation();
+                e.stopImmediatePropagation();
+                closeWindow();
+            }, true);
+        }
         if (dragEl) {
-            dragEl.onmousedown = (e) => {
-                if (e.buttons === 1) {
+            dragEl.addEventListener('mousedown', (e) => {
+                if (e.button === 0) {
                     e.preventDefault();
                     dragWindow();
                 }
-            };
+            });
         }
     }
 
+    function startNavObserver() {
+        const root = document.documentElement;
+        if (!root) {
+            setTimeout(startNavObserver, 5);
+            return;
+        }
+        const navObserver = new MutationObserver(() => {
+            if (!document.getElementById('tauri-custom-titlebar')) {
+                injectLiquidNavBar();
+            }
+        });
+        navObserver.observe(root, { childList: true, subtree: true });
+    }
+
     if (document.readyState === 'loading') {
         document.addEventListener('DOMContentLoaded', injectLiquidNavBar);
     } else {
         injectLiquidNavBar();
     }
-
-    const navObserver = new MutationObserver(() => {
-        if (!document.getElementById('vyla-floating-nav')) {
-            injectLiquidNavBar();
-        }
-    });
-    navObserver.observe(document.documentElement, { childList: true, subtree: true });
+    startNavObserver();
 "##;
 
 #[tauri::command]
@@ -506,174 +502,80 @@ fn win_drag(window: tauri::Window) -> Result<(), String> {
     window.start_dragging().map_err(|e| e.to_string())
 }
 
-#[tauri::command]
-fn open_new_window(app: tauri::AppHandle, url: String) -> Result<(), String> {
-    debug_log(&format!("[SAME-TAB] Redirecting main window to: {}", url));
-
+fn normalize_url(url: &str) -> Option<tauri::Url> {
     let final_url = if url.starts_with("http") || url.starts_with("tauri://") {
-        url.clone()
+        url.to_string()
     } else if url.starts_with('/') {
         format!("http://127.0.0.1:4890{}", url)
     } else {
         format!("http://127.0.0.1:4890/{}", url)
     };
-
-    if let Some(window) = app.get_webview_window("main") {
-        window
-            .eval(&format!(
-                "window.location.href = '{}';",
-                final_url.replace('\'', "\\'")
-            ))
-            .map_err(|e| e.to_string())?;
-        Ok(())
-    } else {
-        Err("main window not found".to_string())
+    match final_url.parse::<tauri::Url>() {
+        Ok(u) => Some(u),
+        Err(e) => {
+            debug_log(&format!("[NEW-WINDOW] bad url '{}': {}", final_url, e));
+            None
+        }
     }
 }
 
-#[tauri::command]
-async fn kill_orphans() -> Result<(), String> {
-    debug_log("[KILL] User requested orphan process kill");
+fn open_app_window(app: &AppHandle, url: tauri::Url) -> Result<(), String> {
+    js_log(app, &format!("[NEW-WINDOW] Opening: {}", url));
 
-    #[cfg(windows)]
+    let n = WINDOW_COUNTER.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+    let label = format!("win_{}", n);
+    let nw_handle = app.clone();
+
+    let window = WebviewWindowBuilder::new(app, &label, WebviewUrl::External(url))
+        .title("Vyla Home")
+        .inner_size(1100.0, 700.0)
+        .center()
+        .decorations(false)
+        .resizable(true)
+        .transparent(true)
+        .devtools(true)
+        .focused(true)
+        .initialization_script(&format!("window.__VYLA_WINDOW_LABEL = '{}';", label))
+        .initialization_script(LINK_HANDLER_SCRIPT)
+        .on_new_window(move |new_url, _features| {
+            js_log(&nw_handle, &format!("[NEW-WINDOW] handler fired (child): {}", new_url));
+            let h = nw_handle.clone();
+            std::thread::spawn(move || {
+                let _ = open_app_window(&h, new_url);
+            });
+            NewWindowResponse::Deny
+        })
+        .build()
+        .map_err(|e| {
+            js_log(app, &format!("[NEW-WINDOW] build failed: {}", e));
+            e.to_string()
+        })?;
+
+    #[cfg(target_os = "windows")]
     {
-        use std::os::windows::process::CommandExt;
-        const CREATE_NO_WINDOW: u32 = 0x08000000;
-        let _ = std::process::Command::new("taskkill")
-            .args(&["/F", "/T", "/IM", "node.exe"])
-            .creation_flags(CREATE_NO_WINDOW)
-            .output();
+        use window_vibrancy::{apply_acrylic, apply_mica};
+        if apply_mica(&window, Some(true)).is_err() {
+            let _ = apply_acrylic(&window, Some((15, 18, 25, 125)));
+        }
     }
 
-    #[cfg(not(windows))]
+    #[cfg(target_os = "macos")]
     {
-        let _ = std::process::Command::new("pkill")
-            .args(&["-9", "-f", "node"])
-            .output();
+        use window_vibrancy::{apply_vibrancy, NSVisualEffectMaterial};
+        let _ = apply_vibrancy(&window, NSVisualEffectMaterial::HudWindow, None, None);
     }
 
+    let _ = &window;
     Ok(())
 }
 
 #[tauri::command]
-fn get_logo_base64(app: tauri::AppHandle) -> Result<String, String> {
-    use std::io::Read;
-    let mut candidate_paths = Vec::new();
-
-    if let Ok(res_dir) = app.path().resource_dir() {
-        candidate_paths.push(res_dir.join("build").join("icon_white.png"));
-        candidate_paths.push(res_dir.join("_up_").join("build").join("icon_white.png"));
-    }
-
-    if let Ok(mut cur) = std::env::current_dir() {
-        candidate_paths.push(cur.join("build").join("icon_white.png"));
-        if cur.ends_with("src-tauri") {
-            cur.pop();
-            candidate_paths.push(cur.join("build").join("icon_white.png"));
-        }
-    }
-
-    for path in candidate_paths {
-        if path.exists() {
-            if let Ok(mut file) = std::fs::File::open(&path) {
-                let mut buffer = Vec::new();
-                if file.read_to_end(&mut buffer).is_ok() {
-                    use base64::Engine;
-                    return Ok(base64::engine::general_purpose::STANDARD.encode(buffer));
-                }
-            }
-        }
-    }
-
-    Err("icon_white.png not found".to_string())
-}
-
-fn handle_tauri_cmd(w: &tauri::WebviewWindow, msg: &BackendMessage) {
-    let window_label = msg
-        .data
-        .get("window")
-        .and_then(|v| v.as_str())
-        .unwrap_or("main");
-
-    debug_log(&format!("[MAIN-DEBUG] Finding window by label: {}", window_label));
-
-    let cmd_window = match w.app_handle().get_webview_window(window_label) {
-        Some(win) => win,
-        None => {
-            debug_log(&format!("[TAURI-CMD] Window '{}' NOT FOUND!", window_label));
-            return;
-        }
-    };
-
-    let cmd = match msg.data.get("cmd").and_then(|c| c.as_str()) {
-        Some(c) => c,
-        None => return,
-    };
-
-    debug_log(&format!("[TAURI-CMD] Executing action: {}", cmd));
-
-    match cmd {
-        "win_minimize" => {
-            let res = cmd_window.minimize();
-            debug_log(&format!("[TAURI-CMD] Minimize result: {:?}", res));
-        }
-        "win_maximize" => {
-            let is_max = cmd_window.is_maximized().unwrap_or(false);
-            debug_log(&format!("[TAURI-CMD] Currently maximized: {}", is_max));
-            let res = if is_max {
-                cmd_window.unmaximize()
-            } else {
-                cmd_window.maximize()
-            };
-            debug_log(&format!("[TAURI-CMD] Maximize/Unmaximize result: {:?}", res));
-        }
-        "win_close" => {
-            let res = cmd_window.close();
-            debug_log(&format!("[TAURI-CMD] Close result: {:?}", res));
-        }
-        "win_drag" => {
-            let res = cmd_window.start_dragging();
-            debug_log(&format!("[TAURI-CMD] Drag result: {:?}", res));
-        }
-        "open_new_window" => {
-            debug_log("[TAURI-CMD-DEBUG] open_new_window command received");
-            debug_log(&format!(
-                "[TAURI-CMD-DEBUG] Full message data: {}",
-                serde_json::to_string(&msg.data).unwrap_or_default()
-            ));
-
-            let url = match msg.data.get("url").and_then(|u| u.as_str()) {
-                Some(u) => u.to_string(),
-                None => {
-                    debug_log("[TAURI-CMD-DEBUG] ERROR: No URL found in message data");
-                    debug_log(&format!(
-                        "[TAURI-CMD-DEBUG] Available keys: {:?}",
-                        msg.data.as_object().map(|o| o.keys().collect::<Vec<_>>())
-                    ));
-                    return;
-                }
-            };
-
-            debug_log(&format!("[TAURI-CMD-DEBUG] URL extracted: {}", url));
-            debug_log(&format!("[TAURI-CMD-DEBUG] URL length: {}", url.len()));
-            debug_log("[TAURI-CMD-DEBUG] Attempting to dispatch to main thread");
-
-            let app_handle = w.app_handle().clone();
-            let closure_handle = app_handle.clone();
-
-            match app_handle.run_on_main_thread(move || {
-                debug_log("[TAURI-CMD-DEBUG] Now on main thread, calling open_new_window");
-                match open_new_window(closure_handle, url) {
-                    Ok(_) => debug_log("[TAURI-CMD-DEBUG] open_new_window succeeded"),
-                    Err(e) => debug_log(&format!("[TAURI-CMD-DEBUG] open_new_window error: {}", e)),
-                }
-            }) {
-                Ok(_) => debug_log("[TAURI-CMD-DEBUG] Main thread dispatch succeeded"),
-                Err(e) => debug_log(&format!("[TAURI-CMD-DEBUG] Main thread dispatch failed: {}", e)),
-            }
-        }
-        _ => {}
-    }
+fn open_new_window(app: AppHandle, url: String) -> Result<(), String> {
+    let parsed = normalize_url(&url).ok_or_else(|| "invalid url".to_string())?;
+    std::thread::spawn(move || {
+        let _ = open_app_window(&app, parsed);
+    });
+    Ok(())
 }
 
 fn handle_ready(w: &tauri::WebviewWindow, msg: &BackendMessage) {
@@ -709,17 +611,13 @@ fn main() {
     debug_log("=== Vyla Home Executable Started ===");
 
     tauri::Builder::default()
-        .plugin(tauri_plugin_shell::init())
-        .plugin(tauri_plugin_process::init())
         .plugin(tauri_plugin_opener::init())
         .invoke_handler(tauri::generate_handler![
             win_minimize,
             win_maximize,
             win_close,
             win_drag,
-            open_new_window,
-            get_logo_base64,
-            kill_orphans
+            open_new_window
         ])
         .manage(NodeServices(Mutex::new(None)))
         .setup(|app| {
@@ -730,13 +628,13 @@ fn main() {
                 std::path::PathBuf::from(appdata_env)
                     .join("vyla-home")
                     .join("vyla-home-files")
-            } else if let Ok(home) = std::env::var("HOME") {
+            } else if let Ok(_home) = std::env::var("HOME") {
                 #[cfg(target_os = "macos")]
-                let base = std::path::PathBuf::from(&home)
+                let base = std::path::PathBuf::from(&_home)
                     .join("Library")
                     .join("Application Support");
                 #[cfg(target_os = "linux")]
-                let base = std::path::PathBuf::from(&home)
+                let base = std::path::PathBuf::from(&_home)
                     .join(".local")
                     .join("share");
                 #[cfg(not(any(target_os = "macos", target_os = "linux")))]
@@ -748,16 +646,70 @@ fn main() {
 
             let _ = std::fs::create_dir_all(&vyla_files);
 
+            let main_nw_handle = app.handle().clone();
+            let gate: SharedGate = Arc::new(Mutex::new(UiGate {
+                ready: false,
+                queue: Vec::new(),
+            }));
+            let load_gate = gate.clone();
+
             let window = WebviewWindowBuilder::new(app, "main", WebviewUrl::App("index.html".into()))
                 .title("Vyla Home")
                 .inner_size(1280.0, 800.0)
                 .decorations(false)
                 .resizable(true)
+                .transparent(true)
                 .devtools(true)
                 .initialization_script("window.__VYLA_WINDOW_LABEL = 'main';")
+                .on_page_load(move |wv, payload| {
+                    if matches!(payload.event(), tauri::webview::PageLoadEvent::Finished) {
+                        if payload.url().host_str() != Some("127.0.0.1") {
+                            let known = READY_URL.lock().ok().and_then(|g| g.clone());
+                            if let Some(u) = known {
+                                if let Ok(parsed) = u.parse::<tauri::Url>() {
+                                    let _ = wv.navigate(parsed);
+                                    return;
+                                }
+                            }
+                        }
+                        let g = load_gate.clone();
+                        std::thread::spawn(move || {
+                            std::thread::sleep(std::time::Duration::from_millis(400));
+                            if let Ok(mut lock) = g.lock() {
+                                lock.ready = true;
+                                let pending: Vec<BackendMessage> = lock.queue.drain(..).collect();
+                                for m in pending {
+                                    let _ = wv.emit(&m.event, m.data);
+                                }
+                            }
+                        });
+                    }
+                })
                 .initialization_script(LINK_HANDLER_SCRIPT)
+                .on_new_window(move |new_url, _features| {
+                    js_log(&main_nw_handle, &format!("[NEW-WINDOW] handler fired (main): {}", new_url));
+                    let h = main_nw_handle.clone();
+                    std::thread::spawn(move || {
+                        let _ = open_app_window(&h, new_url);
+                    });
+                    NewWindowResponse::Deny
+                })
                 .build()?;
 
+            #[cfg(target_os = "windows")]
+            {
+                use window_vibrancy::{apply_acrylic, apply_mica};
+                if apply_mica(&window, Some(true)).is_err() {
+                    let _ = apply_acrylic(&window, Some((15, 18, 25, 125)));
+                }
+            }
+
+            #[cfg(target_os = "macos")]
+            {
+                use window_vibrancy::{apply_vibrancy, NSVisualEffectMaterial};
+                let _ = apply_vibrancy(&window, NSVisualEffectMaterial::HudWindow, None, None);
+            }
+
             let (main_js, root_dir) = resolve_script_and_root(app);
             debug_log("Searching for node binary...");
 
@@ -768,7 +720,6 @@ fn main() {
                 }
                 None => {
                     debug_log("FATAL: No node binary found in bundle or PATH.");
-                    std::thread::sleep(std::time::Duration::from_millis(600));
                     let _ = window.eval("document.getElementById('status-message').textContent='Error: Node runtime missing. Please reinstall.';");
                     let _ = window.eval("var b=document.getElementById('debug-log-box');b.style.display='block';b.textContent='Node binary not found. bin/node missing from app bundle or not executable.';");
                     return Ok(());
@@ -776,7 +727,6 @@ fn main() {
             };
 
             let vyla_files_str = clean_path(&vyla_files);
-            std::thread::sleep(std::time::Duration::from_millis(400));
 
             let mut cmd = Command::new(&node_bin);
             cmd.arg(&main_js)
@@ -803,6 +753,7 @@ fn main() {
 
                     if let Some(stderr) = child.stderr.take() {
                         let w = window.clone();
+                        let g = gate.clone();
                         std::thread::spawn(move || {
                             use std::io::{BufRead, BufReader};
                             let reader = BufReader::new(stderr);
@@ -812,9 +763,13 @@ fn main() {
                                     || line.contains("Exception")
                                     || line.contains("MODULE_NOT_FOUND")
                                 {
-                                    let _ = w.emit(
-                                        "error",
-                                        serde_json::json!({ "message": format!("Backend failed: {}", line) }),
+                                    dispatch(
+                                        &w,
+                                        &g,
+                                        BackendMessage {
+                                            event: "error".to_string(),
+                                            data: serde_json::json!({ "message": format!("Backend failed: {}", line) }),
+                                        },
                                     );
                                 }
                             }
@@ -823,6 +778,7 @@ fn main() {
 
                     if let Some(stdout) = child.stdout.take() {
                         let w = window.clone();
+                        let g = gate.clone();
                         std::thread::spawn(move || {
                             use std::io::{BufRead, BufReader};
                             let reader = BufReader::new(stdout);
@@ -839,18 +795,16 @@ fn main() {
                                     }
                                 };
 
-                                debug_log(&format!("[MAIN-DEBUG] Received event: {}", msg.event));
-                                debug_log(&format!(
-                                    "[MAIN-DEBUG] Event data: {}",
-                                    serde_json::to_string(&msg.data).unwrap_or_default()
-                                ));
-
                                 match msg.event.as_str() {
-                                    "tauri-cmd" => handle_tauri_cmd(&w, &msg),
-                                    "ready" => handle_ready(&w, &msg),
-                                    _ => {
-                                        let _ = w.emit(&msg.event, msg.data.clone());
+                                    "ready" => {
+                                        if let Some(u) = msg.data.get("url").and_then(|u| u.as_str()) {
+                                            if let Ok(mut g) = READY_URL.lock() {
+                                                *g = Some(u.to_string());
+                                            }
+                                        }
+                                        handle_ready(&w, &msg)
                                     }
+                                    _ => dispatch(&w, &g, msg.clone()),
                                 }
                             }
                         });
@@ -884,9 +838,10 @@ fn main() {
                             kill_child_process(&mut child);
                         }
                     };
+                    window.app_handle().exit(0);
                 }
             }
         })
         .run(tauri::generate_context!())
         .expect("error while running tauri application");
-}
+}

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
     "$schema": "https://schema.tauri.app/config/2",
     "productName": "Vyla Home",
-    "version": "1.1.35",
+    "version": "1.1.52",
     "identifier": "com.vyla.home",
     "build": {
         "frontendDist": "../ui"
@@ -9,7 +9,7 @@
     "app": {
         "withGlobalTauri": true,
         "security": {
-            "csp": "default-src 'self' http://localhost:4890 http://127.0.0.1:4890; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:4890 http://127.0.0.1:4890 https://esm.sh; style-src 'self' 'unsafe-inline' http://localhost:4890 http://127.0.0.1:4890; img-src 'self' data: https: http://localhost:4890 http://127.0.0.1:4890; font-src 'self' data: http://localhost:4890 http://127.0.0.1:4890; connect-src 'self' http://localhost: http://127.0.0.1:"
+            "csp": "default-src 'self' http://localhost:* http://127.0.0.1:*; script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:* http://127.0.0.1:*; style-src 'self' 'unsafe-inline' http://localhost:* http://127.0.0.1:*; img-src 'self' data: blob: https: http://localhost:* http://127.0.0.1:*; font-src 'self' data: http://localhost:* http://127.0.0.1:*; connect-src 'self' ipc: http://ipc.localhost http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:*"
         }
     },
     "bundle": {
@@ -35,8 +35,8 @@
             "WebView2Loader.dll",
             "../bin/**/*",
             "../main.js",
-            "../preload.js",
             "../service-manager.js",
+            "../file-updater.js",
             "../patcher.js",
             "../crypto-utils.js",
             "../credential-manager.js",

update-client.js

@@ -36,7 +36,9 @@ class UpdateClient {
       const urlObj = new URL(url);
       const headers = {
         'User-Agent': 'VylaHome-Client',
-        'Accept': 'application/json'
+        'Accept': 'application/json',
+        'Cache-Control': 'no-cache',
+        'Pragma': 'no-cache'
       };
 
       if (this.token) {
@@ -139,7 +141,7 @@ class UpdateClient {
             file.close(() => {
               if (totalSize && downloadedSize < totalSize) {
                 fs.unlink(destPath, () => { });
-                reject(new Error(`Download truncated: Received ${downloadedSize} of ${totalSize} bytes. Connection dropped prematurely.`));
+                reject(new Error(`Download truncated: Received ${downloadedSize} of ${totalSize} bytes.`));
               } else {
                 resolve();
               }
@@ -235,12 +237,21 @@ class UpdateClient {
   }
 
   async checkForUpdates() {
-    const cacheBuster = `?cb=${Date.now()}`;
-    const releases = await this.fetchJson(RELEASES_API + cacheBuster);
+    const query = `?per_page=20&order_by=released_at&sort=desc&cb=${Date.now()}`;
+    const releases = await this.fetchJson(RELEASES_API + query);
     if (!releases || releases.length === 0) {
       return null;
     }
-    const release = releases[0];
+    const verParts = (v) => String(v || '').replace(/^v/, '').split(/[.\-+]/).map((n) => parseInt(n, 10) || 0);
+    const cmp = (a, b) => {
+      const x = verParts(a);
+      const y = verParts(b);
+      for (let i = 0; i < Math.max(x.length, y.length); i++) {
+        if ((x[i] || 0) !== (y[i] || 0)) return (x[i] || 0) - (y[i] || 0);
+      }
+      return 0;
+    };
+    const release = releases.slice().sort((a, b) => cmp(b.tag_name, a.tag_name))[0];
 
     const payloadAsset = (release.assets && release.assets.links ? release.assets.links : []).find(a => a.name === 'update-payload.zip');
     const manifestAsset = (release.assets && release.assets.links ? release.assets.links : []).find(a => a.name === 'manifest.json');
@@ -268,4 +279,4 @@ class UpdateClient {
   }
 }
 
-module.exports = UpdateClient;
+module.exports = UpdateClient;