fix(tauri): correct malformed fixture CSP (root cause) + harden macOS DirectEval against WebKit code-4 (#540)

[goosewobbler]

Addresses the macOS-26.4 embedded-DirectEval flake (#540) — browser.tauri.execute in standalone/deeplink/package modes. Root-caused from the WebKit unified log + local reproduction.

1. Root cause — malformed fixture CSP (the real fix)

Both Tauri fixtures (fixtures/e2e-apps/tauri and fixtures/package-tests/tauri-app) used connect-src: ["ipc:*", "plugin:*", "tauri:*"]. The stray * makes them malformed CSP scheme-sources that don't match the IPC custom-protocol URL (macOS/Linux fetch ipc://localhost/<cmd>; Windows/Android http://ipc.localhost). WebKit blocked that fetch, so Tauri sticky-fell-back to the postMessage IPC interface — whose response is delivered by eval-ing into the webview and only completes while the run loop is pumping. On the idle headless macos-26.4 runner it isn't, so core.invoke stalled and DirectEval timed out. Locally a real display keeps the loop pumping, which is why it never reproduced — the custom-protocol failure was present locally too (66×/run).

Fix: ipc: / plugin: / tauri: (+ http://ipc.localhost). Verified as a controlled A/B on CI: with the e2e fixture's CSP fixed, every DirectEval macOS leg went green and IPC-custom-protocol failures dropped to 0 on the runner, while the package-test leg — CSP still malformed — failed with the same Script execution timed out stall; fixing its CSP greened it too.

2. Harden the DirectEval result path against WebKit code-4 (defense-in-depth)

Independently, macOS 26.4's WebKit intermittently reclaims callAsyncJavaScript's completion handler (Completion handler for function call is no longer reachable, WKError code 4). This delivers the DirectEval result out-of-band instead, mirroring the Windows AsyncScriptState native-handler path: EvalResultRegistry (eval_channel.rs, keyed oneshot) + a wdioEvalResult WKScriptMessageHandler (macos.rs); execute_direct_eval runs the script via callAsyncJavaScript (to pump) but takes the result from the message channel, so a reclaim is harmless. macOS-only.

Residual — tracked separately

A residual intermittent stall remains on the off-screen headless 26.4 runner: with nothing driving the run loop, WebKit doesn't promptly schedule work (page-load / eval), so a DirectEval leg can still occasionally time out. This is environmental (no display → idle run loop), re-runnable, and unrelated to the two fixes here. A follow-up PR attempts a run-loop-pump mitigation; the WebKit-log diagnostics are retained on this branch for that work.

Refs #540

🤖 Generated with Claude Code

[github-actions]

Standing release PR: #456 · 15 packages queued · open 34d 12h 8m · ✅ ready to merge

Release Preview — 17 packages

Note: Labels on this PR are advisory in standing-pr mode. Bumps come from conventional commits in the standing PR; override by editing labels on the standing PR itself. Add release:immediate to bypass the standing PR and release this PR directly.

These changes will be added to the release PR (#456) when merged:

Changelog

@wdio/dioxus-bridge 1.0.0-next.3 → 1.0.0-next.4

Changed

• Update version to 1.0.0-next.4

@wdio/dioxus-service 1.0.0-next.3 → 1.0.0-next.4

Changed

• Update version to 1.0.0-next.4

wdio-dioxus-driver 1.0.0-next.3 → 1.0.0-next.4

Changed

• Update version to 1.0.0-next.4

wdio-dioxus-embedded-driver 1.0.0-next.3 → 1.0.0-next.4

Changed

• Update version to 1.0.0-next.4

@wdio/tauri-plugin 1.2.0 → 1.2.1

Changed

• Update version to 1.2.1

@wdio/tauri-service 1.2.0 → 1.2.1

Changed

• Update version to 1.2.1

tauri-plugin-wdio-webdriver 1.2.0 → 1.2.1

Changed

• add WebContent crash-vs-suspend discriminator + activation mitigation (tauri) (macOS Tauri E2E broken by macos-26 image (26.4): CrabNebula driver (#541) + embedded standalone cold-webview #540)

Fixed

• deliver macOS DirectEval results out-of-band via a message channel (tauri)
• return the DirectEval promise directly (drop await) to avoid WKError 4 (tauri)
• route DirectEval through callAsyncJavaScript (the working session path) (tauri)
• back off DirectEval result-polling to end the macOS 26.4 hang (tauri)
• disable WebView occlusion detection to stop the macOS 26.4 hang (tauri)

@wdio/flutter-service 1.0.0-next.1 → 1.0.0-next.2

Changed

• Update version to 1.0.0-next.2

wdio_flutter N/A → 0.1.1

Changed

• Update version to 0.1.1

@wdio/electrobun-service 0.1.0 → 0.1.1

Changed

• Update version to 0.1.1

@wdio/electron-service 10.1.0 → 10.1.1

Changed

• Update version to 10.1.1

@wdio/native-cdp-bridge 1.0.0 → 1.0.1

Changed

• Update version to 1.0.1

@wdio/native-core 1.0.0 → 1.0.1

Changed

• Update version to 1.0.1

@wdio/native-mobile-core 1.0.0 → 1.0.1

Changed

• Update version to 1.0.1

@wdio/native-spy 1.1.0 → 1.1.1

Changed

• Update version to 1.1.1

@wdio/native-types 2.4.0 → 2.4.1

Changed

• Update version to 2.4.1

@wdio/native-utils 2.5.0 → 2.5.1

Changed

• Update version to 2.5.1

@wdio/react-native-service 1.0.0-next.0 → 1.0.0-next.1

Changed

• Update version to 1.0.0-next.1

After merge — predicted release

No version escalation — this PR's changes will be included in the queued release without affecting the projected versions.

Package	Standing PR	This PR	After merge
@wdio/dioxus-bridge	1.0.0-next.4	1.0.0-next.4	1.0.0-next.4
@wdio/dioxus-service	1.0.0-next.4	1.0.0-next.4	1.0.0-next.4
@wdio/electrobun-service	0.2.0	0.1.1	0.2.0
@wdio/electron-service	10.2.0	10.1.1	10.2.0
@wdio/native-cdp-bridge	1.1.0	1.0.1	1.1.0
@wdio/native-core	1.1.0	1.0.1	1.1.0
@wdio/native-spy	1.2.0	1.1.1	1.2.0
@wdio/native-types	2.5.0	2.4.1	2.5.0
@wdio/native-utils	2.6.0	2.5.1	2.6.0
@wdio/tauri-plugin	1.3.0	1.2.1	1.3.0
@wdio/tauri-service	1.3.0	1.2.1	1.3.0
tauri-plugin-wdio-webdriver	1.3.0	1.2.1	1.3.0
wdio_flutter	0.2.0	0.1.1	0.2.0
wdio-dioxus-driver	1.0.0-next.4	1.0.0-next.4	1.0.0-next.4
wdio-dioxus-embedded-driver	1.0.0-next.4	1.0.0-next.4	1.0.0-next.4

---

Updated automatically by ReleaseKit

[greptile-apps]

Greptile Summary

This PR corrects Tauri fixture CSP sources and adds an out-of-band macOS DirectEval result channel.

• Replaces malformed custom-protocol CSP entries in both Tauri fixtures.
• Registers a macOS WebKit script-message handler backed by a keyed oneshot registry.
• Routes DirectEval results through the native handler instead of relying on WebKit’s completion callback.
• Expands macOS CI diagnostics for WebKit logs and crash reports.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains within the follow-up review scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
packages/tauri-plugin-webdriver/src/platform/macos.rs	Adds the macOS WebKit message handler and changes DirectEval to await out-of-band results.
packages/tauri-plugin-webdriver/src/eval_channel.rs	Introduces the synchronized, keyed oneshot registry used to correlate DirectEval responses.
packages/tauri-plugin-webdriver/src/lib.rs	Registers the shared macOS evaluation-result registry during plugin setup.
packages/tauri-plugin-webdriver/Cargo.toml	Enables the objc2 WebKit features required for configuration and script-message handling.
fixtures/e2e-apps/tauri/src-tauri/tauri.conf.json	Corrects custom-protocol CSP scheme sources and permits the IPC localhost endpoint.
fixtures/package-tests/tauri-app/src-tauri/tauri.conf.json	Applies the same corrected IPC CSP configuration to the package-test fixture.
.github/workflows/_ci-e2e-tauri-all-providers.reusable.yml	Replaces process sampling with WebKit log streaming and broader crash-report collection.

Sequence Diagram

sequenceDiagram
  participant Client as DirectEval client
  participant Executor as macOS executor
  participant WebKit as WKWebView
  participant Handler as wdioEvalResult handler
  participant Registry as EvalResultRegistry
  Client->>Executor: POST /wdio/eval
  Executor->>Registry: register(id)
  Executor->>WebKit: callAsyncJavaScript(wrapper)
  WebKit->>Handler: "postMessage({id, result})"
  Handler->>Registry: complete(id, result)
  Registry-->>Executor: resolve oneshot
  Executor-->>Client: evaluation response

Loading

_{Reviews (11): Last reviewed commit: "fix(tauri-fixture): correct malformed CS..." | Re-trigger Greptile}