feat(linux): ship Readest on the tauri CEF runtime (#6074)

* feat(linux): build and ship Readest on the tauri CEF runtime Linux now builds against upstream tauri `feat/cef` (git) and the plugins on plugins-workspace `feat/cef`, while macOS/Windows/mobile keep the readest fork untouched: - `pnpm tauri:cef dev|build` (scripts/tauri-cef.mjs) runs @tauri-apps/cli-cef with `--features cef`, cargo `--no-default-features` and the Linux-only `[patch.crates-io]` in src-tauri/.cargo/cef.toml, swapping the committed Cargo.cef.lock in for the run so Cargo.lock stays in the fork state. - The fork crates are no longer workspace members (a member clashes on `links` with the git copy); the tauri-plugins fork carried no changes and is removed, tauri-plugin-fs comes from crates.io at 2.5.1. - App: `cef = ["tauri/cef"]` (the fork gets a no-op stub), explicit runtime type, `cef_entry_point`, `--no-first-run` for CEF, commands generic over the runtime, xdg-portal dialogs on Linux (rfd's GTK thread crashes CEF), rangefile reads and pointer-driven move/resize on the Linux CEF runtime, Chromium reported in the About dialog, deb/rpm depend on libwebkit2gtk while plugins still pull the wry runtime. - Build-generated permission files are untracked; turso registers `batch`. - CI Linux legs use `pnpm tauri:cef`. Submodules: packages/tauri -> feat/cef-feature-stub, tauri-plugin-turso -> fix/register-batch-command (both need pushing). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * feat(linux): let the CEF wrapper run an unpacked tauri CLI for offline builds Flatpak builds have no network, so `TAURI_CEF_CLI` points scripts/tauri-cef.mjs at an unpacked copy of @tauri-apps/cli-cef instead of `pnpm dlx`. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * chore(linux): take the CEF stack from the readest forks - src-tauri/.cargo/cef.toml: tauri and the plugins now come from the readest forks' feat/cef branches (upstream feat/cef plus the DevTools-close fix in tauri-runtime-cef); Cargo.cef.lock re-resolved against them. - tauri-plugin-turso: point at main, which merged the batch command fix. - CI: STRACE_MODE=0 for the Linux legs so the CEF AppImage bundler (quick-sharun) does not launch the app under Xvfb and hang (#4906). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * feat(linux): make the CEF runtime the default tauri build on Linux `pnpm tauri` now goes through scripts/tauri.mjs (the former tauri-cef.mjs): on Linux its dev, build and bundle commands run the feat/cef tauri CLI with the CEF feature, cargo config and Cargo.cef.lock swap, and every other platform or command passes straight through to @tauri-apps/cli. The separate `tauri:cef` script goes away, so the release and nightly workflows, the local Linux build script and the docs use plain `pnpm tauri build` again. The tauri webdriver harness (scripts/test-tauri.sh) still calls the `tauri` binary directly and keeps the wry runtime on Linux, since tauri-driver needs WebKitWebDriver. Cargo.cef.lock picks up the quick-xml 0.41 bump from main. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * chore(nix): refresh cargoHash for the reshaped Cargo.lock Dropping the packages/tauri-plugins submodule and the tauri-plugin-fs path patch changed the vendored cargo dependency set, so the Nix fixed-output hash moves to the value the nix-deps-check job reported. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(linux): harden the CEF wrapper and pointer window drag Review follow-ups on the CEF runtime work: - scripts/tauri.mjs parks the wry Cargo.lock in Cargo.lock.wry, created exclusively, so two CEF commands in one checkout cannot swap lockfiles over each other, and a killed run leaves an obvious file to move back. - The CEF runtime alias, entry point and runtime attributes are gated on Linux as well as the `cef` feature; elsewhere the feature is a no-op. - Pointer-driven window move/resize applies the last pointer delta when the button is released before the pending animation frame, and does not start tracking when the button was already released while the window state was being read. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-19 02:06:57 +00:00 · 2026-09-06 02:09:06 +08:00 · 2026-09-06 02:09:06 +08:00 · 655c72ad5a
commit 655c72ad5a
parent 5bae2e3792
170 changed files with 13010 additions and 6277 deletions
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@ -1,6 +1,6 @@
 # Nightly builds. Mirrors the build matrix and build/signing steps of
 # release.yml — keep cert/NDK/toolchain bumps, secret names, and the
-# truly-portable AppImage + portable-Windows steps in sync between the two.
+# Linux CEF + portable-Windows steps in sync between the two.
 #
 # Differences from release.yml: this workflow (1) stamps a nightly version
 # `<base>-<YYYYMMDDHH>` (Asia/Shanghai), (2) publishes to Cloudflare R2 only (no
@ -218,37 +218,10 @@ jobs:
          pnpm tauri signer sign $arm64_apk

      # ──────────────────────────── DESKTOP ────────────────────────────
-      # Linux uses the truly-portable AppImage tauri CLI fork (mirrors
-      # release.yml). The nightly version is patched BEFORE `tauri build` so the
-      # bundle filenames carry the stamp.
-      #
-      # PINNED to a rev, not the branch tip: on 2026-07-31 the fork rewrote the
-      # sharun bundler to re-download quick-sharun.sh on EVERY build instead of
-      # only when it is missing from the cache. That defeated the cache seed
-      # below, so both Linux legs pulled the moving main-branch script again and
-      # hung under Xvfb until the 45min step timeout (#4906). This rev is the
-      # last one that keeps the cache check, and it built every nightly through
-      # 2026-07-30. Bump it only together with a Linux AppImage build check.
-      - name: Override tauri-cli with custom AppImage format (Linux)
-        if: matrix.config.release == 'linux'
-        run: cargo install tauri-cli --git https://github.com/tauri-apps/tauri --rev 162626969b382d52faebdf6c7264460bd9a47d1f --force
-
-      # The truly-portable AppImage bundler at the rev pinned above downloads
-      # quick-sharun.sh from Anylinux-AppImages@main ONLY when it is not already
-      # in the tauri tools cache. An upstream strace-mode change (2026-06-29)
-      # made bundling launch the app under Xvfb and hang forever, timing out the
-      # Linux legs (#4906). Seed the cache with the last known-good revision so
-      # the bundler never fetches the moving main-branch script.
-      - name: pin quick-sharun.sh for AppImage bundling (Linux)
-        if: matrix.config.release == 'linux'
-        run: |
-          set -euo pipefail
-          cache_dir="${XDG_CACHE_HOME:-$HOME/.cache}/tauri"
-          mkdir -p "$cache_dir"
-          curl -fsSL --retry 3 -o "$cache_dir/quick-sharun.sh" \
-            "https://raw.githubusercontent.com/pkgforge-dev/Anylinux-AppImages/b3a9e985cdedf7efa81d172f182cd13983743147/useful-tools/quick-sharun.sh"
-          chmod +x "$cache_dir/quick-sharun.sh"
-
+      # Linux ships on the CEF runtime: `pnpm tauri` (mirrors release.yml; see
+      # apps/readest-app/scripts/tauri.mjs) runs the feat/cef tauri CLI there.
+      # The nightly version is patched BEFORE `tauri build` so the bundle
+      # filenames carry the stamp.
      - name: build desktop bundles
        if: matrix.config.release != 'android'
        shell: bash
@ -258,7 +231,8 @@ jobs:
        # latest.json for ALL platforms (#4906).
        timeout-minutes: 45
        env:
-          TAURI_BUNDLER_NEW_APPIMAGE_FORMAT: 'true'
+          # See release.yml: keep quick-sharun from running the app under Xvfb.
+          STRACE_MODE: '0'
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@ -272,13 +246,7 @@ jobs:
          version="${{ needs.compute-version.outputs.nightly_version }}"
          node -e "const f='apps/readest-app/package.json';const j=require('./'+f);j.version='${version}';require('fs').writeFileSync(f, JSON.stringify(j,null,2)+'\n')"
          cd apps/readest-app
-          # On Linux use the cargo `tauri` CLI (the truly-portable AppImage fork
-          # installed above); elsewhere the npm @tauri-apps/cli.
-          if [ "${{ matrix.config.release }}" = "linux" ]; then
-            cargo tauri build ${{ matrix.config.args }}
-          else
-            pnpm tauri build ${{ matrix.config.args }}
-          fi
+          pnpm tauri build ${{ matrix.config.args }}

      # Portable Windows build: rebuild with NEXT_PUBLIC_PORTABLE_APP=true and
      # ship the raw exe (mirrors release.yml). Runs after the NSIS build above.
@ -409,7 +377,7 @@ jobs:
              add_entry "$portable_name" "$portable_name" "$portable_key"
              ;;
            linux)
-              # Truly-portable AppImage: bundle/appimage/Readest_<ver>_<amd64|aarch64>.AppImage
+              # CEF (sharun) AppImage: bundle/appimage/Readest_<ver>_<amd64|aarch64>.AppImage
              if [ "$arch" = "x86_64" ]; then
                appimage_name="Readest_${version}_amd64.AppImage"
                key="linux-x86_64-appimage"
@ -417,7 +385,7 @@ jobs:
                appimage_name="Readest_${version}_aarch64.AppImage"
                key="linux-aarch64-appimage"
              fi
-              # The Linux leg builds with `cargo tauri build` WITHOUT `--target`
+              # The Linux leg builds with `pnpm tauri build` WITHOUT `--target`
              # (no matrix args), so cargo emits bundles under target/release/
              # (host-target default) — NOT target/<triple>/release/ like the
              # macOS/Windows legs, which DO pass `--target`. So there is no
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@ -425,8 +425,8 @@ jobs:
        if: steps.changes.outputs.tauri == 'true'
        with:
          # cache-workspace-crates caches the path/workspace crates too: the
-          # vendored tauri fork (packages/tauri, packages/tauri-plugins, wired
-          # via [patch.crates-io]) and the local src-tauri/plugins/*. These are
+          # vendored tauri fork (packages/tauri, wired via [patch.crates-io])
+          # and the local src-tauri/plugins/*. These are
          # workspace members that rust-cache prunes by default, so the whole
          # tauri stack — plus every crates.io plugin that depends on the
          # patched `tauri` — rebuilt on every run. They change only
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -476,37 +476,15 @@ jobs:
          echo "Uploading updated latest.json to GitHub release"
          gh release upload ${{ needs.get-release.outputs.release_tag }} latest.json --clobber

-      # PINNED to a rev, not the branch tip: on 2026-07-31 the fork rewrote the
-      # sharun bundler to re-download quick-sharun.sh on EVERY build instead of
-      # only when it is missing from the cache, which defeats the cache seed
-      # below and hangs the Linux legs under Xvfb (#4906). This rev is the last
-      # one that keeps the cache check. Keep in sync with nightly.yml.
-      - name: Override tauri-cli with custom AppImage format (Linux)
-        if: matrix.config.release == 'linux'
-        run: cargo install tauri-cli --git https://github.com/tauri-apps/tauri --rev 162626969b382d52faebdf6c7264460bd9a47d1f --force
-
-      # The truly-portable AppImage bundler at the rev pinned above downloads
-      # quick-sharun.sh from Anylinux-AppImages@main ONLY when it is not already
-      # in the tauri tools cache. An upstream strace-mode change (2026-06-29)
-      # made bundling launch the app under Xvfb and hang forever (#4906). Seed
-      # the cache with the last known-good revision so the bundler never fetches
-      # the moving main-branch script. Keep in sync with nightly.yml.
-      - name: pin quick-sharun.sh for AppImage bundling (Linux)
-        if: matrix.config.release == 'linux'
-        run: |
-          set -euo pipefail
-          cache_dir="${XDG_CACHE_HOME:-$HOME/.cache}/tauri"
-          mkdir -p "$cache_dir"
-          curl -fsSL --retry 3 -o "$cache_dir/quick-sharun.sh" \
-            "https://raw.githubusercontent.com/pkgforge-dev/Anylinux-AppImages/b3a9e985cdedf7efa81d172f182cd13983743147/useful-tools/quick-sharun.sh"
-          chmod +x "$cache_dir/quick-sharun.sh"
-
      - uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
        id: tauri
        if: matrix.config.release != 'android'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAURI_BUNDLER_NEW_APPIMAGE_FORMAT: 'true'
+          # The CEF AppImage bundler (quick-sharun) otherwise launches the app
+          # under Xvfb to discover dlopen'ed libraries and never gets it to
+          # exit, hanging the Linux legs (#4906); ldd-based discovery only.
+          STRACE_MODE: '0'
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@ -518,10 +496,11 @@ jobs:
          NODE_OPTIONS: '--max-old-space-size=8192'
        with:
          projectPath: apps/readest-app
-          # On Linux, build with the Rust `cargo tauri` CLI installed in the
-          # step above so the new (truly-portable AppImage) bundler is used.
-          # Without this, tauri-action falls back to the npm @tauri-apps/cli.
-          tauriScript: ${{ matrix.config.release == 'linux' && 'cargo tauri' || '' }}
+          # `pnpm tauri` (apps/readest-app/scripts/tauri.mjs) runs the npm
+          # @tauri-apps/cli, except on Linux, which ships on the CEF runtime:
+          # there it runs the tauri CLI from upstream's feat/cef branch, which
+          # bundles CEF into the deb, rpm and (sharun) AppImage.
+          tauriScript: pnpm tauri
          releaseId: ${{ needs.get-release.outputs.release_id }}
          releaseBody: ${{ needs.get-release.outputs.release_note }}
          args: ${{ matrix.config.args || '' }}
--- a/.gitignore
+++ b/.gitignore
@ -59,3 +59,6 @@ fastlane/metadata-play/android/en-US/changelogs

 apps/readest.koplugin/bin/
 apps/readest.koplugin/native/localsend-bin/target/
+
+# scripts/tauri.mjs parks the wry Cargo.lock here during a Linux CEF build
+/Cargo.lock.wry
--- a/.gitmodules
+++ b/.gitmodules
@ -4,9 +4,6 @@
 [submodule "packages/tauri"]
 	path = packages/tauri
 	url = https://github.com/readest/tauri.git
-[submodule "packages/tauri-plugins"]
-	path = packages/tauri-plugins
-	url = https://github.com/readest/tauri-plugins-workspace.git
 [submodule "packages/simplecc-wasm"]
 	path = packages/simplecc-wasm
 	url = https://github.com/readest/simplecc-wasm.git
--- a/Cargo.cef.lock
+++ b/Cargo.cef.lock
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.toml
+++ b/Cargo.toml
@ -1,8 +1,11 @@
 [workspace]
+# The readest forks under packages/ are pulled in through [patch.crates-io]
+# below, not listed as members: the Linux CEF build (see
+# apps/readest-app/src-tauri/.cargo/cef.toml) patches tauri and the plugins to
+# upstream git instead, and a member fork would still sit in the graph and
+# clash on `links` with the git copy.
 members = [
-  "apps/readest-app/src-tauri",
-  "packages/tauri/crates/tauri",
-  "packages/tauri-plugins/plugins/fs"
+  "apps/readest-app/src-tauri"
 ]
 exclude = [
  "packages/qcms"
@ -39,7 +42,6 @@ rust-version = "1.77.2"

 [patch.crates-io]
 tauri = { path = "packages/tauri/crates/tauri" }
-tauri-plugin-fs = { path = "packages/tauri-plugins/plugins/fs" }
 # Xcode 26.2 (Swift 6.2) broke upstream swift-rs 1.0.7's per-swiftc target
 # override; the vendored copy cross-compiles via `--triple`/`--sdk` instead.
 # Upstream is unmaintained (last release 2024). See packages/swift-rs.
--- a/apps/readest-app/AGENTS.md
+++ b/apps/readest-app/AGENTS.md
@ -7,7 +7,7 @@ Readest is a cross-platform ebook reader built as a **Next.js 16 + Tauri v2** hy
 ```bash
 # Development
 pnpm dev-web               # Web-only dev server (no Rust compilation needed)
-pnpm tauri dev             # Desktop dev with Tauri (compiles Rust backend)
+pnpm tauri dev             # Desktop dev with Tauri (compiles Rust backend); on Linux this is the CEF runtime (needs Rust >= 1.95)

 # Building
 pnpm build                 # Build Next.js for Tauri
--- a/apps/readest-app/docs/architecture.md
+++ b/apps/readest-app/docs/architecture.md
@ -535,8 +535,8 @@ android/, macos/,
 windows/            -> per-platform glue
 ```

-Everything else is delegated to **Tauri plugins**, mostly bundled in
-`packages/tauri-plugins/plugins`:
+Everything else is delegated to **Tauri plugins**, mostly the published
+`tauri-plugin-*` crates:

 - standard plugins: `fs`, `dialog`, `http`, `opener`, `os`, `process`, `shell`,
  `cli`, `deep-link`, `haptics`, `log`, `updater`, `websocket`, `oauth`,
--- a/apps/readest-app/package.json
+++ b/apps/readest-app/package.json
@ -44,7 +44,7 @@
    "test:e2e:web:report": "playwright show-report",
    "tauri:dev:test": "dotenv -e .env.tauri -- tauri dev --features webdriver",
    "tauri:build:test": "dotenv -e .env.tauri -- tauri build --debug --features webdriver",
-    "tauri": "tauri",
+    "tauri": "node scripts/tauri.mjs",
    "fmt:check": "cargo fmt -p Readest --check",
    "clippy:check": "cargo clippy -p Readest --no-deps -- -D warnings",
    "test:rust": "cargo test -p Readest --lib",
@ -66,7 +66,7 @@
    "setup-vendors": "pnpm setup-pdfjs && pnpm setup-simplecc && pnpm setup-jieba",
    "build-win-x64": "dotenv -e .env.tauri.local -- tauri build --target i686-pc-windows-msvc --bundles nsis",
    "build-win-arm64": "dotenv -e .env.tauri.local -- tauri build --target aarch64-pc-windows-msvc --bundles nsis",
-    "build-linux-x64": "dotenv -e .env.tauri.local -- tauri build --target x86_64-unknown-linux-gnu --bundles appimage",
+    "build-linux-x64": "dotenv -e .env.tauri.local -- pnpm tauri build --bundles appimage",
    "build-macos-universial": "dotenv -e .env.tauri.local -e .env.apple-nonstore.local -- tauri build -t universal-apple-darwin --bundles dmg --config src-tauri/tauri.macos-nonestore.conf.json",
    "build-macos-universial-appstore": "dotenv -e .env.tauri.local -e .env.apple-appstore.local -- tauri build -t universal-apple-darwin --bundles app --config src-tauri/tauri.appstore.conf.json",
    "build-macos-universial-appstore-dev": "dotenv -e .env.tauri.local -e .env.apple-appstore-dev.local -- tauri build -t universal-apple-darwin --bundles app --config src-tauri/tauri.appstore-dev.conf.json",
--- a/apps/readest-app/scripts/tauri.mjs
+++ b/apps/readest-app/scripts/tauri.mjs
@ -0,0 +1,113 @@
+#!/usr/bin/env node
+// `pnpm tauri <command> [tauri args] [-- cargo args]`.
+//
+// Every platform but Linux goes straight to the npm @tauri-apps/cli, which
+// builds on the readest tauri fork (the wry runtime). On Linux the desktop
+// commands (dev, build, bundle) run on the CEF runtime instead: this uses the
+// tauri CLI published from upstream's `feat/cef` branch and adds what the CEF
+// build needs on top of the normal tauri command line:
+//   - `--features cef` so the CLI bundles the CEF distribution and cargo
+//     compiles the CEF runtime (`cef = ["tauri/cef"]` in src-tauri/Cargo.toml);
+//   - `--no-default-features` (cargo side) to drop the `wry` runtime, see
+//     src-tauri/Cargo.toml;
+//   - `--config src-tauri/.cargo/cef.toml` (cargo side) to take tauri and the
+//     plugins from the `feat/cef` branches instead of the readest fork.
+//
+// Cargo resolves that graph differently from the fork graph every other
+// platform builds, and it can only write one Cargo.lock. So for the duration
+// of the command the repo's Cargo.cef.lock is swapped in as Cargo.lock and the
+// original is put back afterwards; the CEF resolution is saved back to
+// Cargo.cef.lock, which is committed like Cargo.lock. The original is parked
+// in Cargo.lock.wry meanwhile, created exclusively so two CEF commands in one
+// checkout cannot swap over each other; if a run is killed hard (SIGKILL)
+// before the swap back, `mv Cargo.lock.wry Cargo.lock` restores it.
+//
+// Mobile commands (`tauri android ...`, `tauri ios ...`) and the tauri
+// webdriver test harness (scripts/test-tauri.sh, which needs WebKitWebDriver)
+// keep the wry runtime on Linux too.
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const CEF_CLI = '@tauri-apps/cli-cef@3.0.0-alpha.26';
+// Offline builds (Flatpak) cannot `pnpm dlx`; they point this at an unpacked
+// copy of the CLI package's `tauri.js` instead.
+const localCefCli = process.env['TAURI_CEF_CLI'];
+const appDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const repoRoot = path.resolve(appDir, '../..');
+const cargoConfig = path.join(appDir, 'src-tauri/.cargo/cef.toml');
+const lockPath = path.join(repoRoot, 'Cargo.lock');
+const cefLockPath = path.join(repoRoot, 'Cargo.cef.lock');
+const savedLockPath = path.join(repoRoot, 'Cargo.lock.wry');
+
+const [command, ...rest] = process.argv.slice(2);
+const useCef = process.platform === 'linux' && ['dev', 'build', 'bundle'].includes(command);
+
+const run = (file, args, cleanup = () => {}) => {
+  const child = spawn(file, args, { stdio: 'inherit' });
+  child.on('exit', (code, signal) => {
+    cleanup();
+    process.exit(code ?? (signal ? 1 : 0));
+  });
+  child.on('error', (error) => {
+    cleanup();
+    console.error(error);
+    process.exit(1);
+  });
+};
+
+if (!useCef) {
+  const tauriCli = createRequire(import.meta.url).resolve('@tauri-apps/cli/tauri.js');
+  run('node', [tauriCli, ...process.argv.slice(2)]);
+} else {
+  const split = rest.indexOf('--');
+  const tauriArgs = split === -1 ? rest : rest.slice(0, split);
+  const cargoArgs = split === -1 ? [] : rest.slice(split + 1);
+  const args = [
+    command,
+    '--features',
+    'cef',
+    ...tauriArgs,
+    '--',
+    '--no-default-features',
+    '--config',
+    cargoConfig,
+    ...cargoArgs,
+  ];
+
+  try {
+    fs.writeFileSync(savedLockPath, fs.readFileSync(lockPath), { flag: 'wx' });
+  } catch (error) {
+    if (error.code !== 'EEXIST') throw error;
+    console.error(
+      `${savedLockPath} exists: another CEF build is running from this checkout, or an earlier ` +
+        'one was killed before it could restore Cargo.lock. Wait for it to finish, or run ' +
+        '`mv Cargo.lock.wry Cargo.lock`.',
+    );
+    process.exit(1);
+  }
+  if (fs.existsSync(cefLockPath)) {
+    fs.copyFileSync(cefLockPath, lockPath);
+  }
+  let swapped = true;
+  const restoreLock = () => {
+    if (!swapped) return;
+    fs.copyFileSync(lockPath, cefLockPath);
+    fs.renameSync(savedLockPath, lockPath);
+    swapped = false;
+  };
+
+  // Ctrl-C reaches the child through the process group; stay alive until it
+  // has exited so the lock swap is undone.
+  for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
+    process.on(signal, () => {});
+  }
+
+  if (localCefCli) {
+    run('node', [localCefCli, ...args], restoreLock);
+  } else {
+    run('pnpm', ['dlx', CEF_CLI, ...args], restoreLock);
+  }
+}
--- a/apps/readest-app/src-tauri/.cargo/cef.toml
+++ b/apps/readest-app/src-tauri/.cargo/cef.toml
@ -0,0 +1,41 @@
+# Cargo config for the Linux CEF build. Cargo does not load it on its own:
+# `pnpm tauri:cef` (scripts/tauri-cef.mjs) hands it to cargo with `--config`,
+# so every other build keeps resolving tauri from the readest fork pinned in
+# the root Cargo.toml. Linux needs nothing from that fork, so the CEF build
+# takes the whole tauri family and the plugins straight from upstream's
+# `feat/cef` branches; a config-level patch wins over the manifest one.
+#
+# The family is patched together because two versions of tauri-utils or
+# tauri-build in one graph break `generate_context!`. The plugin patches are
+# picked up only while Cargo.lock keeps each plugin at the version published
+# on `feat/cef`: cargo prefers a newer crates.io release over a lower-versioned
+# patch, so bumping a plugin past that branch silently drops back to the
+# crates.io build, and the four scoped plugins (fs, http, opener, shell) then
+# fail to compile against `feat/cef`'s schemars-1 `tauri-plugin`.
+[patch.crates-io]
+tauri = { git = "https://github.com/readest/tauri", branch = "feat/cef" }
+tauri-build = { git = "https://github.com/readest/tauri", branch = "feat/cef" }
+tauri-codegen = { git = "https://github.com/readest/tauri", branch = "feat/cef" }
+tauri-macros = { git = "https://github.com/readest/tauri", branch = "feat/cef" }
+tauri-plugin = { git = "https://github.com/readest/tauri", branch = "feat/cef" }
+tauri-runtime = { git = "https://github.com/readest/tauri", branch = "feat/cef" }
+tauri-utils = { git = "https://github.com/readest/tauri", branch = "feat/cef" }
+
+tauri-plugin-biometric = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-cli = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-clipboard-manager = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-deep-link = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-dialog = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-fs = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-haptics = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-http = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-log = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-opener = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-os = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-persisted-scope = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-process = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-shell = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-single-instance = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-updater = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-websocket = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
+tauri-plugin-window-state = { git = "https://github.com/readest/tauri-plugins-workspace", branch = "feat/cef" }
--- a/apps/readest-app/src-tauri/.gitignore
+++ b/apps/readest-app/src-tauri/.gitignore
@ -2,3 +2,6 @@
 # will have compiled files and executables
 /target/
 /gen/schemas
+# Regenerated by tauri-build on every build; newer tauri-build keeps them out
+# of the source tree altogether.
+/permissions/autogenerated
--- a/apps/readest-app/src-tauri/Cargo.toml
+++ b/apps/readest-app/src-tauri/Cargo.toml
@ -15,6 +15,16 @@ name = "readestlib"
 crate-type = ["staticlib", "cdylib", "lib"]

 [features]
+default = ["wry"]
+# WebKitGTK / WebView2 / WKWebView runtime. The Linux CEF build turns it off
+# (`--no-default-features --features cef`, see scripts/tauri-cef.mjs).
+wry = ["tauri/wry"]
+# Chromium Embedded Framework runtime, Linux only (`pnpm tauri:cef`). The
+# tauri CLI keys CEF bundling off this app feature, and it only becomes the
+# real runtime when `tauri` resolves to upstream's feat/cef through
+# .cargo/cef.toml; the readest fork carries a no-op stub of the same name so
+# the feature can be declared here on every platform.
+cef = ["tauri/cef"]
 # Internal feature to suppress warnings from old objc crate
 cargo-clippy = []
 # Enable WebDriver plugin for E2E testing (use with `tauri build --debug --features webdriver`)
@ -42,11 +52,21 @@ reqwest = { version = "0.12", default-features = false, features = [
  "json",
  "stream",
 ] }
-tauri = { version = "2", features = [ "protocol-asset" ] }
+# `default-features = false` so the Linux CEF build (`pnpm tauri:cef`) can pick
+# the webview runtime: tauri's defaults are spelled out here and `wry` comes
+# back through this crate's own `default` feature, so every other build is
+# unchanged. See .cargo/cef.toml.
+tauri = { version = "2", default-features = false, features = [
+  "protocol-asset",
+  "compression",
+  "common-controls-v6",
+  "dynamic-acl",
+  "x11",
+  "dbus",
+] }
 tauri-build = "2"
 tauri-plugin-log = "2"
 tauri-plugin-fs = "2"
-tauri-plugin-dialog = "2"
 tauri-plugin-os = "2"
 # `unsafe-headers` lets callers pass fetch-spec "forbidden" headers (Origin,
 # Referer, Cookie, ...) instead of having the plugin silently drop them. Needed
@ -165,6 +185,18 @@ objc2 = "0.6"
 objc2-authentication-services = "0.3"
 objc2-foundation = { version = "0.3", features = ["NSError", "NSArray"] }

+# Linux uses the XDG desktop portal for dialogs instead of rfd's gtk3 backend.
+# rfd's gtk3 chooser pumps GTK on a private thread, and that thread iterates
+# the default GLib main context that CEF's browser process also runs its X11
+# event source on, so mouse events get dispatched off Chromium's UI thread
+# and mojo aborts the app (SIGTRAP) as soon as the dialog closes. The portal
+# runs out of process over D-Bus; other platforms keep the native chooser.
+[target.'cfg(target_os = "linux")'.dependencies]
+tauri-plugin-dialog = { version = "2", default-features = false, features = ["xdg-portal"] }
+
+[target.'cfg(not(target_os = "linux"))'.dependencies]
+tauri-plugin-dialog = "2"
+
 [target.'cfg(any(target_os = "macos", windows, target_os = "linux"))'.dependencies]
 tauri-plugin-cli = "2"
 tauri-plugin-single-instance = "2"
--- a/apps/readest-app/src-tauri/capabilities/default.json
+++ b/apps/readest-app/src-tauri/capabilities/default.json
@ -134,6 +134,7 @@
    "core:window:allow-maximize",
    "core:window:allow-unmaximize",
    "core:window:allow-set-size",
+    "core:window:allow-set-position",
    "core:window:allow-set-title",
    "core:window:allow-set-focus",
    "core:window:allow-is-maximized",
--- a/apps/readest-app/src-tauri/permissions/autogenerated/allow_paths_in_scopes.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/allow_paths_in_scopes.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-allow-paths-in-scopes"
-description = "Enables the allow_paths_in_scopes command without any pre-configured scope."
-commands.allow = ["allow_paths_in_scopes"]
-
-[[permission]]
-identifier = "deny-allow-paths-in-scopes"
-description = "Denies the allow_paths_in_scopes command without any pre-configured scope."
-commands.deny = ["allow_paths_in_scopes"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/auth_with_safari.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/auth_with_safari.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-auth-with-safari"
-description = "Enables the auth_with_safari command without any pre-configured scope."
-commands.allow = ["auth_with_safari"]
-
-[[permission]]
-identifier = "deny-auth-with-safari"
-description = "Denies the auth_with_safari command without any pre-configured scope."
-commands.deny = ["auth_with_safari"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/clear_book_presence.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/clear_book_presence.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-clear-book-presence"
-description = "Enables the clear_book_presence command without any pre-configured scope."
-commands.allow = ["clear_book_presence"]
-
-[[permission]]
-identifier = "deny-clear-book-presence"
-description = "Denies the clear_book_presence command without any pre-configured scope."
-commands.deny = ["clear_book_presence"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/clip_url.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/clip_url.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-clip-url"
-description = "Enables the clip_url command without any pre-configured scope."
-commands.allow = ["clip_url"]
-
-[[permission]]
-identifier = "deny-clip-url"
-description = "Denies the clip_url command without any pre-configured scope."
-commands.deny = ["clip_url"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/download_file.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/download_file.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-download-file"
-description = "Enables the download_file command without any pre-configured scope."
-commands.allow = ["download_file"]
-
-[[permission]]
-identifier = "deny-download-file"
-description = "Denies the download_file command without any pre-configured scope."
-commands.deny = ["download_file"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/extract_epub_cover_full.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/extract_epub_cover_full.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-extract-epub-cover-full"
-description = "Enables the extract_epub_cover_full command without any pre-configured scope."
-commands.allow = ["extract_epub_cover_full"]
-
-[[permission]]
-identifier = "deny-extract-epub-cover-full"
-description = "Denies the extract_epub_cover_full command without any pre-configured scope."
-commands.deny = ["extract_epub_cover_full"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/extract_mobi_cover_full.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/extract_mobi_cover_full.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-extract-mobi-cover-full"
-description = "Enables the extract_mobi_cover_full command without any pre-configured scope."
-commands.allow = ["extract_mobi_cover_full"]
-
-[[permission]]
-identifier = "deny-extract-mobi-cover-full"
-description = "Denies the extract_mobi_cover_full command without any pre-configured scope."
-commands.deny = ["extract_mobi_cover_full"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/get_environment_variable.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/get_environment_variable.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-get-environment-variable"
-description = "Enables the get_environment_variable command without any pre-configured scope."
-commands.allow = ["get_environment_variable"]
-
-[[permission]]
-identifier = "deny-get-environment-variable"
-description = "Denies the get_environment_variable command without any pre-configured scope."
-commands.deny = ["get_environment_variable"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/get_executable_dir.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/get_executable_dir.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-get-executable-dir"
-description = "Enables the get_executable_dir command without any pre-configured scope."
-commands.allow = ["get_executable_dir"]
-
-[[permission]]
-identifier = "deny-get-executable-dir"
-description = "Denies the get_executable_dir command without any pre-configured scope."
-commands.deny = ["get_executable_dir"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/install_nightly_update.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/install_nightly_update.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-install-nightly-update"
-description = "Enables the install_nightly_update command without any pre-configured scope."
-commands.allow = ["install_nightly_update"]
-
-[[permission]]
-identifier = "deny-install-nightly-update"
-description = "Denies the install_nightly_update command without any pre-configured scope."
-commands.deny = ["install_nightly_update"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/is_updater_disabled.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/is_updater_disabled.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-is-updater-disabled"
-description = "Enables the is_updater_disabled command without any pre-configured scope."
-commands.allow = ["is_updater_disabled"]
-
-[[permission]]
-identifier = "deny-is-updater-disabled"
-description = "Denies the is_updater_disabled command without any pre-configured scope."
-commands.deny = ["is_updater_disabled"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/localsend_announce.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/localsend_announce.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-localsend-announce"
-description = "Enables the localsend_announce command without any pre-configured scope."
-commands.allow = ["localsend_announce"]
-
-[[permission]]
-identifier = "deny-localsend-announce"
-description = "Denies the localsend_announce command without any pre-configured scope."
-commands.deny = ["localsend_announce"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/localsend_cancel_receive.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/localsend_cancel_receive.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-localsend-cancel-receive"
-description = "Enables the localsend_cancel_receive command without any pre-configured scope."
-commands.allow = ["localsend_cancel_receive"]
-
-[[permission]]
-identifier = "deny-localsend-cancel-receive"
-description = "Denies the localsend_cancel_receive command without any pre-configured scope."
-commands.deny = ["localsend_cancel_receive"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/localsend_cancel_send.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/localsend_cancel_send.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-localsend-cancel-send"
-description = "Enables the localsend_cancel_send command without any pre-configured scope."
-commands.allow = ["localsend_cancel_send"]
-
-[[permission]]
-identifier = "deny-localsend-cancel-send"
-description = "Denies the localsend_cancel_send command without any pre-configured scope."
-commands.deny = ["localsend_cancel_send"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/localsend_get_status.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/localsend_get_status.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-localsend-get-status"
-description = "Enables the localsend_get_status command without any pre-configured scope."
-commands.allow = ["localsend_get_status"]
-
-[[permission]]
-identifier = "deny-localsend-get-status"
-description = "Denies the localsend_get_status command without any pre-configured scope."
-commands.deny = ["localsend_get_status"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/localsend_is_alive.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/localsend_is_alive.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-localsend-is-alive"
-description = "Enables the localsend_is_alive command without any pre-configured scope."
-commands.allow = ["localsend_is_alive"]
-
-[[permission]]
-identifier = "deny-localsend-is-alive"
-description = "Denies the localsend_is_alive command without any pre-configured scope."
-commands.deny = ["localsend_is_alive"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/localsend_list_devices.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/localsend_list_devices.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-localsend-list-devices"
-description = "Enables the localsend_list_devices command without any pre-configured scope."
-commands.allow = ["localsend_list_devices"]
-
-[[permission]]
-identifier = "deny-localsend-list-devices"
-description = "Denies the localsend_list_devices command without any pre-configured scope."
-commands.deny = ["localsend_list_devices"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/localsend_respond.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/localsend_respond.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-localsend-respond"
-description = "Enables the localsend_respond command without any pre-configured scope."
-commands.allow = ["localsend_respond"]
-
-[[permission]]
-identifier = "deny-localsend-respond"
-description = "Denies the localsend_respond command without any pre-configured scope."
-commands.deny = ["localsend_respond"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/localsend_send_files.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/localsend_send_files.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-localsend-send-files"
-description = "Enables the localsend_send_files command without any pre-configured scope."
-commands.allow = ["localsend_send_files"]
-
-[[permission]]
-identifier = "deny-localsend-send-files"
-description = "Denies the localsend_send_files command without any pre-configured scope."
-commands.deny = ["localsend_send_files"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/localsend_set_discoverable.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/localsend_set_discoverable.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-localsend-set-discoverable"
-description = "Enables the localsend_set_discoverable command without any pre-configured scope."
-commands.allow = ["localsend_set_discoverable"]
-
-[[permission]]
-identifier = "deny-localsend-set-discoverable"
-description = "Denies the localsend_set_discoverable command without any pre-configured scope."
-commands.deny = ["localsend_set_discoverable"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/localsend_start.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/localsend_start.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-localsend-start"
-description = "Enables the localsend_start command without any pre-configured scope."
-commands.allow = ["localsend_start"]
-
-[[permission]]
-identifier = "deny-localsend-start"
-description = "Denies the localsend_start command without any pre-configured scope."
-commands.deny = ["localsend_start"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/localsend_stop.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/localsend_stop.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-localsend-stop"
-description = "Enables the localsend_stop command without any pre-configured scope."
-commands.allow = ["localsend_stop"]
-
-[[permission]]
-identifier = "deny-localsend-stop"
-description = "Denies the localsend_stop command without any pre-configured scope."
-commands.deny = ["localsend_stop"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/open_web_browser.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/open_web_browser.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-open-web-browser"
-description = "Enables the open_web_browser command without any pre-configured scope."
-commands.allow = ["open_web_browser"]
-
-[[permission]]
-identifier = "deny-open-web-browser"
-description = "Denies the open_web_browser command without any pre-configured scope."
-commands.deny = ["open_web_browser"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/optimize_cover_thumbnails.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/optimize_cover_thumbnails.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-optimize-cover-thumbnails"
-description = "Enables the optimize_cover_thumbnails command without any pre-configured scope."
-commands.allow = ["optimize_cover_thumbnails"]
-
-[[permission]]
-identifier = "deny-optimize-cover-thumbnails"
-description = "Denies the optimize_cover_thumbnails command without any pre-configured scope."
-commands.deny = ["optimize_cover_thumbnails"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/parse_epub_full.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/parse_epub_full.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-parse-epub-full"
-description = "Enables the parse_epub_full command without any pre-configured scope."
-commands.allow = ["parse_epub_full"]
-
-[[permission]]
-identifier = "deny-parse-epub-full"
-description = "Denies the parse_epub_full command without any pre-configured scope."
-commands.deny = ["parse_epub_full"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/parse_epub_metadata.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/parse_epub_metadata.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-parse-epub-metadata"
-description = "Enables the parse_epub_metadata command without any pre-configured scope."
-commands.allow = ["parse_epub_metadata"]
-
-[[permission]]
-identifier = "deny-parse-epub-metadata"
-description = "Denies the parse_epub_metadata command without any pre-configured scope."
-commands.deny = ["parse_epub_metadata"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/parse_mobi_metadata.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/parse_mobi_metadata.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-parse-mobi-metadata"
-description = "Enables the parse_mobi_metadata command without any pre-configured scope."
-commands.allow = ["parse_mobi_metadata"]
-
-[[permission]]
-identifier = "deny-parse-mobi-metadata"
-description = "Denies the parse_mobi_metadata command without any pre-configured scope."
-commands.deny = ["parse_mobi_metadata"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/parse_pdf_metadata.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/parse_pdf_metadata.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-parse-pdf-metadata"
-description = "Enables the parse_pdf_metadata command without any pre-configured scope."
-commands.allow = ["parse_pdf_metadata"]
-
-[[permission]]
-identifier = "deny-parse-pdf-metadata"
-description = "Denies the parse_pdf_metadata command without any pre-configured scope."
-commands.deny = ["parse_pdf_metadata"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/read_dir.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/read_dir.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-read-dir"
-description = "Enables the read_dir command without any pre-configured scope."
-commands.allow = ["read_dir"]
-
-[[permission]]
-identifier = "deny-read-dir"
-description = "Denies the read_dir command without any pre-configured scope."
-commands.deny = ["read_dir"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/render_pdf_cover.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/render_pdf_cover.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-render-pdf-cover"
-description = "Enables the render_pdf_cover command without any pre-configured scope."
-commands.allow = ["render_pdf_cover"]
-
-[[permission]]
-identifier = "deny-render-pdf-cover"
-description = "Denies the render_pdf_cover command without any pre-configured scope."
-commands.deny = ["render_pdf_cover"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/set_traffic_lights.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/set_traffic_lights.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-set-traffic-lights"
-description = "Enables the set_traffic_lights command without any pre-configured scope."
-commands.allow = ["set_traffic_lights"]
-
-[[permission]]
-identifier = "deny-set-traffic-lights"
-description = "Denies the set_traffic_lights command without any pre-configured scope."
-commands.deny = ["set_traffic_lights"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/set_web_browser_status.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/set_web_browser_status.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-set-web-browser-status"
-description = "Enables the set_web_browser_status command without any pre-configured scope."
-commands.allow = ["set_web_browser_status"]
-
-[[permission]]
-identifier = "deny-set-web-browser-status"
-description = "Denies the set_web_browser_status command without any pre-configured scope."
-commands.deny = ["set_web_browser_status"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/set_webview_info.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/set_webview_info.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-set-webview-info"
-description = "Enables the set_webview_info command without any pre-configured scope."
-commands.allow = ["set_webview_info"]
-
-[[permission]]
-identifier = "deny-set-webview-info"
-description = "Denies the set_webview_info command without any pre-configured scope."
-commands.deny = ["set_webview_info"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/show_lookup_popover.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/show_lookup_popover.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-show-lookup-popover"
-description = "Enables the show_lookup_popover command without any pre-configured scope."
-commands.allow = ["show_lookup_popover"]
-
-[[permission]]
-identifier = "deny-show-lookup-popover"
-description = "Denies the show_lookup_popover command without any pre-configured scope."
-commands.deny = ["show_lookup_popover"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/spawn_fresh_browser.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/spawn_fresh_browser.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-spawn-fresh-browser"
-description = "Enables the spawn_fresh_browser command without any pre-configured scope."
-commands.allow = ["spawn_fresh_browser"]
-
-[[permission]]
-identifier = "deny-spawn-fresh-browser"
-description = "Denies the spawn_fresh_browser command without any pre-configured scope."
-commands.deny = ["spawn_fresh_browser"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/start_apple_sign_in.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/start_apple_sign_in.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-start-apple-sign-in"
-description = "Enables the start_apple_sign_in command without any pre-configured scope."
-commands.allow = ["start_apple_sign_in"]
-
-[[permission]]
-identifier = "deny-start-apple-sign-in"
-description = "Denies the start_apple_sign_in command without any pre-configured scope."
-commands.deny = ["start_apple_sign_in"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/start_server.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/start_server.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-start-server"
-description = "Enables the start_server command without any pre-configured scope."
-commands.allow = ["start_server"]
-
-[[permission]]
-identifier = "deny-start-server"
-description = "Denies the start_server command without any pre-configured scope."
-commands.deny = ["start_server"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/update_book_presence.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/update_book_presence.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-update-book-presence"
-description = "Enables the update_book_presence command without any pre-configured scope."
-commands.allow = ["update_book_presence"]
-
-[[permission]]
-identifier = "deny-update-book-presence"
-description = "Denies the update_book_presence command without any pre-configured scope."
-commands.deny = ["update_book_presence"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/upload_file.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/upload_file.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-upload-file"
-description = "Enables the upload_file command without any pre-configured scope."
-commands.allow = ["upload_file"]
-
-[[permission]]
-identifier = "deny-upload-file"
-description = "Denies the upload_file command without any pre-configured scope."
-commands.deny = ["upload_file"]
--- a/apps/readest-app/src-tauri/permissions/autogenerated/verify_update_signature.toml
+++ b/apps/readest-app/src-tauri/permissions/autogenerated/verify_update_signature.toml
@ -1,11 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-[[permission]]
-identifier = "allow-verify-update-signature"
-description = "Enables the verify_update_signature command without any pre-configured scope."
-commands.allow = ["verify_update_signature"]
-
-[[permission]]
-identifier = "deny-verify-update-signature"
-description = "Denies the verify_update_signature command without any pre-configured scope."
-commands.deny = ["verify_update_signature"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/.gitignore
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/.gitignore
@ -15,3 +15,8 @@ node_modules/

 dist-js
 dist
+
+# Regenerated by tauri-plugin on every build; newer tauri-plugin keeps the
+# command permissions out of the source tree altogether.
+/permissions/autogenerated
+/permissions/schemas
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/build.rs
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/build.rs
@ -41,6 +41,10 @@ const COMMANDS: &[&str] = &[
    "clip_url",
    "open_web_browser",
    "set_web_browser_status",
+    "set_sync_passphrase",
+    "get_sync_passphrase",
+    "clear_sync_passphrase",
+    "is_sync_keychain_available",
    "set_secure_item",
    "get_secure_item",
    "clear_secure_item",
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/auth_with_custom_tab.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/auth_with_custom_tab.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-auth-with-custom-tab"
-description = "Enables the auth_with_custom_tab command without any pre-configured scope."
-commands.allow = ["auth_with_custom_tab"]
-
-[[permission]]
-identifier = "deny-auth-with-custom-tab"
-description = "Denies the auth_with_custom_tab command without any pre-configured scope."
-commands.deny = ["auth_with_custom_tab"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/auth_with_safari.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/auth_with_safari.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-auth-with-safari"
-description = "Enables the auth_with_safari command without any pre-configured scope."
-commands.allow = ["auth_with_safari"]
-
-[[permission]]
-identifier = "deny-auth-with-safari"
-description = "Denies the auth_with_safari command without any pre-configured scope."
-commands.deny = ["auth_with_safari"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/capture_webview_region.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/capture_webview_region.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-capture-webview-region"
-description = "Enables the capture_webview_region command without any pre-configured scope."
-commands.allow = ["capture_webview_region"]
-
-[[permission]]
-identifier = "deny-capture-webview-region"
-description = "Denies the capture_webview_region command without any pre-configured scope."
-commands.deny = ["capture_webview_region"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/check-permissions.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/check-permissions.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-check-permissions"
-description = "Enables the check-permissions command without any pre-configured scope."
-commands.allow = ["check-permissions"]
-
-[[permission]]
-identifier = "deny-check-permissions"
-description = "Denies the check-permissions command without any pre-configured scope."
-commands.deny = ["check-permissions"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/checkPermissions.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/checkPermissions.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-checkPermissions"
-description = "Enables the checkPermissions command without any pre-configured scope."
-commands.allow = ["checkPermissions"]
-
-[[permission]]
-identifier = "deny-checkPermissions"
-description = "Denies the checkPermissions command without any pre-configured scope."
-commands.deny = ["checkPermissions"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/check_permissions.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/check_permissions.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-check-permissions"
-description = "Enables the check_permissions command without any pre-configured scope."
-commands.allow = ["check_permissions"]
-
-[[permission]]
-identifier = "deny-check-permissions"
-description = "Denies the check_permissions command without any pre-configured scope."
-commands.deny = ["check_permissions"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/clear_lookup_dictionary.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/clear_lookup_dictionary.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-clear-lookup-dictionary"
-description = "Enables the clear_lookup_dictionary command without any pre-configured scope."
-commands.allow = ["clear_lookup_dictionary"]
-
-[[permission]]
-identifier = "deny-clear-lookup-dictionary"
-description = "Denies the clear_lookup_dictionary command without any pre-configured scope."
-commands.deny = ["clear_lookup_dictionary"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/clear_secure_item.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/clear_secure_item.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-clear-secure-item"
-description = "Enables the clear_secure_item command without any pre-configured scope."
-commands.allow = ["clear_secure_item"]
-
-[[permission]]
-identifier = "deny-clear-secure-item"
-description = "Denies the clear_secure_item command without any pre-configured scope."
-commands.deny = ["clear_secure_item"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/clear_sync_passphrase.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/clear_sync_passphrase.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-clear-sync-passphrase"
-description = "Enables the clear_sync_passphrase command without any pre-configured scope."
-commands.allow = ["clear_sync_passphrase"]
-
-[[permission]]
-identifier = "deny-clear-sync-passphrase"
-description = "Denies the clear_sync_passphrase command without any pre-configured scope."
-commands.deny = ["clear_sync_passphrase"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/clip_url.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/clip_url.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-clip-url"
-description = "Enables the clip_url command without any pre-configured scope."
-commands.allow = ["clip_url"]
-
-[[permission]]
-identifier = "deny-clip-url"
-description = "Denies the clip_url command without any pre-configured scope."
-commands.deny = ["clip_url"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/copy_uri_to_path.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/copy_uri_to_path.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-copy-uri-to-path"
-description = "Enables the copy_uri_to_path command without any pre-configured scope."
-commands.allow = ["copy_uri_to_path"]
-
-[[permission]]
-identifier = "deny-copy-uri-to-path"
-description = "Denies the copy_uri_to_path command without any pre-configured scope."
-commands.deny = ["copy_uri_to_path"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_external_sdcard_path.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_external_sdcard_path.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-get-external-sdcard-path"
-description = "Enables the get_external_sdcard_path command without any pre-configured scope."
-commands.allow = ["get_external_sdcard_path"]
-
-[[permission]]
-identifier = "deny-get-external-sdcard-path"
-description = "Denies the get_external_sdcard_path command without any pre-configured scope."
-commands.deny = ["get_external_sdcard_path"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_lookup_dictionary.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_lookup_dictionary.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-get-lookup-dictionary"
-description = "Enables the get_lookup_dictionary command without any pre-configured scope."
-commands.allow = ["get_lookup_dictionary"]
-
-[[permission]]
-identifier = "deny-get-lookup-dictionary"
-description = "Denies the get_lookup_dictionary command without any pre-configured scope."
-commands.deny = ["get_lookup_dictionary"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_safe_area_insets.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_safe_area_insets.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-get-safe-area-insets"
-description = "Enables the get_safe_area_insets command without any pre-configured scope."
-commands.allow = ["get_safe_area_insets"]
-
-[[permission]]
-identifier = "deny-get-safe-area-insets"
-description = "Denies the get_safe_area_insets command without any pre-configured scope."
-commands.deny = ["get_safe_area_insets"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_screen_brightness.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_screen_brightness.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-get-screen-brightness"
-description = "Enables the get_screen_brightness command without any pre-configured scope."
-commands.allow = ["get_screen_brightness"]
-
-[[permission]]
-identifier = "deny-get-screen-brightness"
-description = "Denies the get_screen_brightness command without any pre-configured scope."
-commands.deny = ["get_screen_brightness"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_secure_item.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_secure_item.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-get-secure-item"
-description = "Enables the get_secure_item command without any pre-configured scope."
-commands.allow = ["get_secure_item"]
-
-[[permission]]
-identifier = "deny-get-secure-item"
-description = "Denies the get_secure_item command without any pre-configured scope."
-commands.deny = ["get_secure_item"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_status_bar_height.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_status_bar_height.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-get-status-bar-height"
-description = "Enables the get_status_bar_height command without any pre-configured scope."
-commands.allow = ["get_status_bar_height"]
-
-[[permission]]
-identifier = "deny-get-status-bar-height"
-description = "Denies the get_status_bar_height command without any pre-configured scope."
-commands.deny = ["get_status_bar_height"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_storefront_region_code.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_storefront_region_code.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-get-storefront-region-code"
-description = "Enables the get_storefront_region_code command without any pre-configured scope."
-commands.allow = ["get_storefront_region_code"]
-
-[[permission]]
-identifier = "deny-get-storefront-region-code"
-description = "Denies the get_storefront_region_code command without any pre-configured scope."
-commands.deny = ["get_storefront_region_code"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_sync_passphrase.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_sync_passphrase.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-get-sync-passphrase"
-description = "Enables the get_sync_passphrase command without any pre-configured scope."
-commands.allow = ["get_sync_passphrase"]
-
-[[permission]]
-identifier = "deny-get-sync-passphrase"
-description = "Denies the get_sync_passphrase command without any pre-configured scope."
-commands.deny = ["get_sync_passphrase"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_sys_fonts_list.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_sys_fonts_list.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-get-sys-fonts-list"
-description = "Enables the get_sys_fonts_list command without any pre-configured scope."
-commands.allow = ["get_sys_fonts_list"]
-
-[[permission]]
-identifier = "deny-get-sys-fonts-list"
-description = "Denies the get_sys_fonts_list command without any pre-configured scope."
-commands.deny = ["get_sys_fonts_list"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_system_color_scheme.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/get_system_color_scheme.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-get-system-color-scheme"
-description = "Enables the get_system_color_scheme command without any pre-configured scope."
-commands.allow = ["get_system_color_scheme"]
-
-[[permission]]
-identifier = "deny-get-system-color-scheme"
-description = "Denies the get_system_color_scheme command without any pre-configured scope."
-commands.deny = ["get_system_color_scheme"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/has_ambient_light_sensor.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/has_ambient_light_sensor.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-has-ambient-light-sensor"
-description = "Enables the has_ambient_light_sensor command without any pre-configured scope."
-commands.allow = ["has_ambient_light_sensor"]
-
-[[permission]]
-identifier = "deny-has-ambient-light-sensor"
-description = "Denies the has_ambient_light_sensor command without any pre-configured scope."
-commands.deny = ["has_ambient_light_sensor"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/iap_fetch_products.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/iap_fetch_products.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-iap-fetch-products"
-description = "Enables the iap_fetch_products command without any pre-configured scope."
-commands.allow = ["iap_fetch_products"]
-
-[[permission]]
-identifier = "deny-iap-fetch-products"
-description = "Denies the iap_fetch_products command without any pre-configured scope."
-commands.deny = ["iap_fetch_products"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/iap_initialize.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/iap_initialize.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-iap-initialize"
-description = "Enables the iap_initialize command without any pre-configured scope."
-commands.allow = ["iap_initialize"]
-
-[[permission]]
-identifier = "deny-iap-initialize"
-description = "Denies the iap_initialize command without any pre-configured scope."
-commands.deny = ["iap_initialize"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/iap_is_available.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/iap_is_available.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-iap-is-available"
-description = "Enables the iap_is_available command without any pre-configured scope."
-commands.allow = ["iap_is_available"]
-
-[[permission]]
-identifier = "deny-iap-is-available"
-description = "Denies the iap_is_available command without any pre-configured scope."
-commands.deny = ["iap_is_available"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/iap_purchase_product.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/iap_purchase_product.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-iap-purchase-product"
-description = "Enables the iap_purchase_product command without any pre-configured scope."
-commands.allow = ["iap_purchase_product"]
-
-[[permission]]
-identifier = "deny-iap-purchase-product"
-description = "Denies the iap_purchase_product command without any pre-configured scope."
-commands.deny = ["iap_purchase_product"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/iap_restore_purchases.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/iap_restore_purchases.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-iap-restore-purchases"
-description = "Enables the iap_restore_purchases command without any pre-configured scope."
-commands.allow = ["iap_restore_purchases"]
-
-[[permission]]
-identifier = "deny-iap-restore-purchases"
-description = "Denies the iap_restore_purchases command without any pre-configured scope."
-commands.deny = ["iap_restore_purchases"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/icloud_container_status.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/icloud_container_status.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-icloud-container-status"
-description = "Enables the icloud_container_status command without any pre-configured scope."
-commands.allow = ["icloud_container_status"]
-
-[[permission]]
-identifier = "deny-icloud-container-status"
-description = "Denies the icloud_container_status command without any pre-configured scope."
-commands.deny = ["icloud_container_status"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/icloud_ensure_downloaded.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/icloud_ensure_downloaded.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-icloud-ensure-downloaded"
-description = "Enables the icloud_ensure_downloaded command without any pre-configured scope."
-commands.allow = ["icloud_ensure_downloaded"]
-
-[[permission]]
-identifier = "deny-icloud-ensure-downloaded"
-description = "Denies the icloud_ensure_downloaded command without any pre-configured scope."
-commands.deny = ["icloud_ensure_downloaded"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/install_package.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/install_package.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-install-package"
-description = "Enables the install_package command without any pre-configured scope."
-commands.allow = ["install_package"]
-
-[[permission]]
-identifier = "deny-install-package"
-description = "Denies the install_package command without any pre-configured scope."
-commands.deny = ["install_package"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/intercept_keys.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/intercept_keys.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-intercept-keys"
-description = "Enables the intercept_keys command without any pre-configured scope."
-commands.allow = ["intercept_keys"]
-
-[[permission]]
-identifier = "deny-intercept-keys"
-description = "Denies the intercept_keys command without any pre-configured scope."
-commands.deny = ["intercept_keys"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/is_sync_keychain_available.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/is_sync_keychain_available.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-is-sync-keychain-available"
-description = "Enables the is_sync_keychain_available command without any pre-configured scope."
-commands.allow = ["is_sync_keychain_available"]
-
-[[permission]]
-identifier = "deny-is-sync-keychain-available"
-description = "Denies the is_sync_keychain_available command without any pre-configured scope."
-commands.deny = ["is_sync_keychain_available"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/lock_screen_orientation.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/lock_screen_orientation.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-lock-screen-orientation"
-description = "Enables the lock_screen_orientation command without any pre-configured scope."
-commands.allow = ["lock_screen_orientation"]
-
-[[permission]]
-identifier = "deny-lock-screen-orientation"
-description = "Denies the lock_screen_orientation command without any pre-configured scope."
-commands.deny = ["lock_screen_orientation"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/open_external_url.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/open_external_url.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-open-external-url"
-description = "Enables the open_external_url command without any pre-configured scope."
-commands.allow = ["open_external_url"]
-
-[[permission]]
-identifier = "deny-open-external-url"
-description = "Denies the open_external_url command without any pre-configured scope."
-commands.deny = ["open_external_url"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/open_web_browser.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/open_web_browser.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-open-web-browser"
-description = "Enables the open_web_browser command without any pre-configured scope."
-commands.allow = ["open_web_browser"]
-
-[[permission]]
-identifier = "deny-open-web-browser"
-description = "Denies the open_web_browser command without any pre-configured scope."
-commands.deny = ["open_web_browser"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/read_share_clip_html.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/read_share_clip_html.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-read-share-clip-html"
-description = "Enables the read_share_clip_html command without any pre-configured scope."
-commands.allow = ["read_share_clip_html"]
-
-[[permission]]
-identifier = "deny-read-share-clip-html"
-description = "Denies the read_share_clip_html command without any pre-configured scope."
-commands.deny = ["read_share_clip_html"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/refresh_eink_screen.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/refresh_eink_screen.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-refresh-eink-screen"
-description = "Enables the refresh_eink_screen command without any pre-configured scope."
-commands.allow = ["refresh_eink_screen"]
-
-[[permission]]
-identifier = "deny-refresh-eink-screen"
-description = "Denies the refresh_eink_screen command without any pre-configured scope."
-commands.deny = ["refresh_eink_screen"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/register_listener.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/register_listener.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-register-listener"
-description = "Enables the register_listener command without any pre-configured scope."
-commands.allow = ["register_listener"]
-
-[[permission]]
-identifier = "deny-register-listener"
-description = "Denies the register_listener command without any pre-configured scope."
-commands.deny = ["register_listener"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/remove_listener.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/remove_listener.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-remove-listener"
-description = "Enables the remove_listener command without any pre-configured scope."
-commands.allow = ["remove_listener"]
-
-[[permission]]
-identifier = "deny-remove-listener"
-description = "Denies the remove_listener command without any pre-configured scope."
-commands.deny = ["remove_listener"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/render_pdf_cover.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/render_pdf_cover.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-render-pdf-cover"
-description = "Enables the render_pdf_cover command without any pre-configured scope."
-commands.allow = ["render_pdf_cover"]
-
-[[permission]]
-identifier = "deny-render-pdf-cover"
-description = "Denies the render_pdf_cover command without any pre-configured scope."
-commands.deny = ["render_pdf_cover"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/request-permissions.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/request-permissions.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-request-permissions"
-description = "Enables the request-permissions command without any pre-configured scope."
-commands.allow = ["request-permissions"]
-
-[[permission]]
-identifier = "deny-request-permissions"
-description = "Denies the request-permissions command without any pre-configured scope."
-commands.deny = ["request-permissions"]
--- a/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/requestPermissions.toml
+++ b/apps/readest-app/src-tauri/plugins/tauri-plugin-native-bridge/permissions/autogenerated/commands/requestPermissions.toml
@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-requestPermissions"
-description = "Enables the requestPermissions command without any pre-configured scope."
-commands.allow = ["requestPermissions"]
-
-[[permission]]
-identifier = "deny-requestPermissions"
-description = "Denies the requestPermissions command without any pre-configured scope."
-commands.deny = ["requestPermissions"]
--- a/Show more
+++ b/Show more