LinkedIn (and any site that opens a popup via window.open or
SOAuthorization) was abort()-ing on macOS 26 with a
WKUserContentController _addScriptMessageHandler: NSException because
NewWindowResponse::Allow let WebKit clone the parent's
WKWebViewConfiguration, which already had Tauri's IPC handlers
registered.

Unify all platforms behind open_requested_window so popups get a fresh
Pake WebviewWindow with a new label, and stop reusing
features.opener().target_configuration on macOS. Reposition/resize
hints from the opener are still honored.

Also tighten panic surfaces along the way:
- show_toast logs eval errors instead of unwrap()
- get_data_dir returns Result and propagates IO errors
- check_file_or_append guards against u32 overflow in the suffix loop
- set_global_shortcut logs plugin / register failures and degrades
- set_window/build_window return Result instead of expect()
- pake.json windows[].first() yields a readable error
- top-level Tauri build failure exits cleanly instead of panicking

Split inject/component.js into inject/toast.js and inject/fullscreen.js
so the polyfill can be opted out per-app later, and update
new-window-macos.test.js to lock in the fix and prevent regressions.

Co-authored-by: Cursor <cursoragent@cursor.com>

A grab-bag of follow-ups from the project audit:

feat(icon): generate full multi-resolution Windows ICO (#1190)

ensureMultiResolutionIco re-renders user-supplied ICOs through sharp so
every Windows standard size (16/24/32/48/64/128/256) is present in the
output, and exact-size PNG frames already in the source are preserved.
Avoids the Windows shell having to downsample 256x256 to 16x16 for the
tray, which produced the blurry tray icons reported in #1190.

refactor(builders): extract env helpers from BaseBuilder

Move package-manager detection, build env, install command, Cargo
mirror toggling, and the linuxdeploy strip-error matcher into a new
bin/builders/env.ts module. BaseBuilder drops from 626 to 481 lines
and becomes pure orchestration. Tests migrate from accessing private
methods on BaseBuilder to calling the module-level functions directly.

refactor(cli): top-level error boundary with PakeError

Wrap program.action in try/catch, route user-facing failures through
a PakeError class for short messages, and only print stack traces in
debug mode. Replace the lingering process.exit(1) inside
options/index.ts with a thrown PakeError so behavior stays consistent
with the rest of the pipeline.

test: snapshot CLI options to window config contract

Extract buildWindowConfigOverrides from mergeConfig as a pure
function and snapshot it across darwin/linux/win32. Catches CLI
option drift early instead of waiting for a real build.

ci: split PR fast lane from full Tauri build

quality-and-test now runs vitest + tests/index.js --no-build on every
PR/push (about 5 minutes per OS) and only runs the full real Tauri
build on push to main or manual dispatch. Replaces the broken
hashFiles('~/.cargo/bin/cargo-hack') cache with
taiki-e/install-action so cargo-hack downloads a precompiled binary.

Plus type-gate hardening (rollup noEmitOnError: production) and Node
version doc alignment in both READMEs (>=22 recommended LTS, >=18
also works), matching package.json engines.

Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Register the Window submenu as the macOS windows menu via set_as_windows_menu_for_nsapp(), surfacing native Move & Resize, Fill, Center, and Full Screen Tile options plus system-wide shortcuts.

…ark-mode

feat: support cross-platform dark mode on Windows and Linux

Issue #1249 confused the ~5M package-size claim with runtime memory.
The WebKit render process memory is owned by the wrapped site, not Pake.

Real packages (macOS universal, bundled icons) often exceed 5M; an upper bound of under 10M is more honest while still ~20x smaller than Electron.

feat: honour --targets app on macOS for app-only builds

…uilds

On pure Wayland compositors without XWayland (e.g. Niri), $DISPLAY is
unset and GTK defaults to the X11 backend, aborting with "Failed to
initialize GTK". Force GDK_BACKEND=wayland in that case while still
respecting an explicit user override.

Local clippy (-D warnings) flagged three pre-existing lints unrelated to
behavior: a duplicate target_os cfg already gated in app/mod.rs, an
if-let-Ok over is_ok(), and a single-arm match better written as if let.
Equivalent rewrites so the lint pass is clean locally.

npm-only publish via the npm-publish workflow_dispatch path; no V tag or
GitHub release this round. Ships the macOS --targets app fix (#1248) and
the pure-Wayland GDK_BACKEND startup fix for AppImage (#1251).

…ullscreen

When not built with --fullscreen, exclude FULLSCREEN from the window-state plugin flags so a prior --fullscreen build's persisted state can no longer force fullscreen on a rebuild. Match the tray quit save logic to the plugin init.

Closes #1259

Pake faked page zoom in injected JS: `transform: scale` on Windows and
`html.style.zoom` on macOS/Linux. Both break complex SPAs like ChatGPT.
The page shifts right on Windows (#1264) and fixed or GPU-composited
layers stop repainting on macOS (#1160), and the prior `resize` dispatch
could not force a repaint. Switch to the WebView native zoom via
`WebviewWindow::set_zoom`, which maps to WKWebView pageZoom, WebView2
ZoomFactor, and WebKitGTK zoom level, the same browser zoom that
recalculates layout correctly on every platform.

RPM-based distros (Fedora/RHEL/Oracle/Rocky/Alma/openSUSE) were always built
through the .deb path because the Linux default target was hardcoded to
deb,appimage. Their package manager cannot install a .deb, and on newer distros
the deb bundler can abort outright, taking the would-be-usable AppImage down
with it since the multi-target loop failed fast.

Detect the package family from /etc/os-release and default to rpm,appimage on
RPM systems while keeping deb,appimage on Debian/Ubuntu. When multiple targets
are requested, a single target failure no longer aborts the rest, so a portable
AppImage still ships when the native bundler fails; explicit single targets keep
fail-fast behavior.

Refs #1262

The CI fast-test step runs tests/index.js with PAKE_CREATE_APP=1, which leaks
into the spawned vitest process and forces MacBuilder's format to app, dropping
the DMG name suffix. The DMG-naming assertions then failed only in CI while
passing locally. Stub the env var per-test so the suite is deterministic
regardless of the ambient environment.

npm-only publish via the npm-publish workflow_dispatch path; no V tag or
GitHub release this round. Ships the fullscreen window-state fix (#1259),
native WebView zoom for ChatGPT (#1264, #1160), and per-distro Linux bundle
target selection (#1262).

Merge the star/share and issue/PR bullets so the line no longer wraps on the GitHub repo page, where the About sidebar narrows the column.

#1249 (high memory) and #1263 (Cloudflare verification loop) are recurring
reports rooted in the system WebView, not Pake: WebKitWebProcess memory is
governed by WebKitGTK, and Cloudflare challenges flag the embedded webview.
Document both as known limits so the boundary is clear without re-explaining
each time.

RPM-based distros funnel through the .deb path and the bundler can abort with
SIGABRT during packaging, taking down the whole build. --no-bundle runs the
Tauri build with no packaging step and surfaces the raw executable
(<name>-binary), reusing the keep-binary location logic. Linux-only; ignored
with a warning on other platforms.

Refs #1262