feat(ui,webview): compact tab bar, hide inactive tabs, harden CEF link handling#868
Merged
Merged
Conversation
…e skill Comment out unused nav entries and built-in skill rather than deleting so re-enabling is a pure uncomment once the features are active.
Show icon-only by default; label expands in on hover, focus, or active state with a 300ms max-width/opacity/margin transition.
… animation Bring Home and Intelligence tabs back (Intelligence labeled 'Memory'). Ease label reveal with 500ms ease-out-quint for a smoother glide.
- Changed the X/Twitter link to direct users to follow the account. - Added a new section to encourage following the creator, @senamakel.
…nce external link handling - Added guidelines to prevent JavaScript injection in embedded provider webviews, ensuring security and compliance with design principles. - Implemented a mechanism to unwrap provider-side "link safety" redirects for better user experience when opening external links. - Updated the Tauri configuration to disable default JS injection from the `tauri-plugin-opener`. - Enhanced logging for external navigation and new window requests to include unwrapped URLs. - Adjusted window dimensions in the Tauri configuration for improved UI layout.
…sai#867 Approach didn't land cleanly — on_page_load never fires for CDP-driven child webview navigation and CEF's set_visible races with async browser creation. Reverting the on_page_load emit, the off-screen spawn, and the reused-path synthetic emit so main stays clean. Link-opening fixes (unwrap_provider_redirect, /usr/bin/open, opener plugin opt-out) stay. Resolution tracked in tinyhumansai#867.
Contributor
📝 WalkthroughWalkthroughUpdates enforce restrictions on webview JavaScript injection via policy documentation and Tauri plugin configuration; improve LinkedIn URL handling with native browser launching; refactor tab bar UI with animations and spacing adjustments; refine Skills page typing and remove a built-in entry; update window size and README marketing elements. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@app/src-tauri/src/webview_accounts/mod.rs`:
- Around line 225-244: In open_in_system_browser, the macOS branch logs that it
will "fall back to opener plugin" on Err but doesn't actually call the fallback;
update the Err arm of the
std::process::Command::new("/usr/bin/open").arg(url).spawn() match to invoke
tauri_plugin_opener::open_url(url, None::<&str>) and log its result (success or
error) so failures to spawn /usr/bin/open truly fall back to the plugin; keep
existing log context and include the original spawn error when reporting the
fallback outcome.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 780f0708-416a-4af6-ba4f-4827074d27a8
📒 Files selected for processing (7)
CLAUDE.mdREADME.mdapp/src-tauri/src/lib.rsapp/src-tauri/src/webview_accounts/mod.rsapp/src-tauri/tauri.conf.jsonapp/src/components/BottomTabBar.tsxapp/src/pages/Skills.tsx
Comment on lines
225
to
244
| fn open_in_system_browser(url: &str) { | ||
| match tauri_plugin_opener::open_url(url, None::<&str>) { | ||
| Ok(()) => log::info!("[webview-accounts] opened externally: {}", url), | ||
| Err(e) => log::warn!("[webview-accounts] open_url({}) failed: {}", url, e), | ||
| #[cfg(target_os = "macos")] | ||
| { | ||
| match std::process::Command::new("/usr/bin/open").arg(url).spawn() { | ||
| Ok(_) => log::info!("[webview-accounts] opened externally (macos open): {}", url), | ||
| Err(e) => log::warn!( | ||
| "[webview-accounts] /usr/bin/open {} failed: {} — falling back to opener plugin", | ||
| url, | ||
| e | ||
| ), | ||
| } | ||
| } | ||
| #[cfg(not(target_os = "macos"))] | ||
| { | ||
| match tauri_plugin_opener::open_url(url, None::<&str>) { | ||
| Ok(()) => log::info!("[webview-accounts] opened externally: {}", url), | ||
| Err(e) => log::warn!("[webview-accounts] open_url({}) failed: {}", url, e), | ||
| } | ||
| } | ||
| } |
Contributor
There was a problem hiding this comment.
macOS fallback logs intent but doesn't execute.
The warning message says "falling back to opener plugin" but the function returns without actually calling tauri_plugin_opener::open_url. If /usr/bin/open fails (e.g., sandboxing edge case), the URL silently drops.
🐛 Proposed fix to actually fall back
fn open_in_system_browser(url: &str) {
#[cfg(target_os = "macos")]
{
match std::process::Command::new("/usr/bin/open").arg(url).spawn() {
Ok(_) => log::info!("[webview-accounts] opened externally (macos open): {}", url),
Err(e) => {
log::warn!(
"[webview-accounts] /usr/bin/open {} failed: {} — falling back to opener plugin",
url,
e
);
+ // Actually fall back to the opener plugin
+ if let Err(e2) = tauri_plugin_opener::open_url(url, None::<&str>) {
+ log::warn!("[webview-accounts] opener plugin fallback also failed: {}", e2);
+ }
}
}
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| fn open_in_system_browser(url: &str) { | |
| match tauri_plugin_opener::open_url(url, None::<&str>) { | |
| Ok(()) => log::info!("[webview-accounts] opened externally: {}", url), | |
| Err(e) => log::warn!("[webview-accounts] open_url({}) failed: {}", url, e), | |
| #[cfg(target_os = "macos")] | |
| { | |
| match std::process::Command::new("/usr/bin/open").arg(url).spawn() { | |
| Ok(_) => log::info!("[webview-accounts] opened externally (macos open): {}", url), | |
| Err(e) => log::warn!( | |
| "[webview-accounts] /usr/bin/open {} failed: {} — falling back to opener plugin", | |
| url, | |
| e | |
| ), | |
| } | |
| } | |
| #[cfg(not(target_os = "macos"))] | |
| { | |
| match tauri_plugin_opener::open_url(url, None::<&str>) { | |
| Ok(()) => log::info!("[webview-accounts] opened externally: {}", url), | |
| Err(e) => log::warn!("[webview-accounts] open_url({}) failed: {}", url, e), | |
| } | |
| } | |
| } | |
| fn open_in_system_browser(url: &str) { | |
| #[cfg(target_os = "macos")] | |
| { | |
| match std::process::Command::new("/usr/bin/open").arg(url).spawn() { | |
| Ok(_) => log::info!("[webview-accounts] opened externally (macos open): {}", url), | |
| Err(e) => { | |
| log::warn!( | |
| "[webview-accounts] /usr/bin/open {} failed: {} — falling back to opener plugin", | |
| url, | |
| e | |
| ); | |
| // Actually fall back to the opener plugin | |
| if let Err(e2) = tauri_plugin_opener::open_url(url, None::<&str>) { | |
| log::warn!("[webview-accounts] opener plugin fallback also failed: {}", e2); | |
| } | |
| } | |
| } | |
| } | |
| #[cfg(not(target_os = "macos"))] | |
| { | |
| match tauri_plugin_opener::open_url(url, None::<&str>) { | |
| Ok(()) => log::info!("[webview-accounts] opened externally: {}", url), | |
| Err(e) => log::warn!("[webview-accounts] open_url({}) failed: {}", url, e), | |
| } | |
| } | |
| } |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@app/src-tauri/src/webview_accounts/mod.rs` around lines 225 - 244, In
open_in_system_browser, the macOS branch logs that it will "fall back to opener
plugin" on Err but doesn't actually call the fallback; update the Err arm of the
std::process::Command::new("/usr/bin/open").arg(url).spawn() match to invoke
tauri_plugin_opener::open_url(url, None::<&str>) and log its result (success or
error) so failures to spawn /usr/bin/open truly fall back to the plugin; keep
existing log context and include the original spawn error when reporting the
fallback outcome.
This was referenced Apr 24, 2026
7 tasks
AusAgentSmith
pushed a commit
to AusAgentSmith/openhuman
that referenced
this pull request
May 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tauri-plugin-opener's default JS injection (init-iife.js), adds a CLAUDE.md rule forbidding new JS injection into `acct_*` webviews, and unwraps LinkedIn's `/safety/go/?url=...` redirect in Rust so the system browser lands on the real destination (was breaking because the safety page requires LinkedIn session which lives only inside the embedded webview).Known follow-up
Test plan
Summary by CodeRabbit
New Features
UI/UX Improvements
Bug Fixes
Documentation