fix: recover from web content process crashes like Safari

.github/workflows/build-and-test.yml

@@ -1,66 +1,110 @@
-name: Lint and Formatting
+# Lint, format check, build and unit tests on every push and pull request.
+# Also runnable on demand (used by Upstream Sync, whose PRs cannot trigger
+# workflows by themselves).
+name: Build and Test
 
 on:
   push:
     branches: [main, develop]
   pull_request:
     branches: [main, develop]
+  workflow_dispatch:
+
+concurrency:
+  group: build-and-test-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  # Same versions as the ones used locally, so lint results match.
+  SWIFTLINT_VERSION: "0.65.1"
+  SWIFTFORMAT_VERSION: "0.64.1"
 
 jobs:
   build-and-test:
     runs-on: macos-latest
-
+    timeout-minutes: 45
+
     steps:
-    - name: Check architecture
-      run: uname -m
-
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Setup Xcode
-      uses: maxim-lobanov/setup-xcode@v1
-      with:
-        xcode-version: latest-stable
-
-    - name: Show Xcode version
-      run: xcodebuild -version
-
-    - name: Show Swift version
-      run: swift --version
-
-    - name: Install Xcodegen
-      run: brew install xcodegen
-
-    - name: Generate Xcode project
-      run: xcodegen
-
-    - name: Install SwiftLint
-      run: brew install swiftlint
-
-    - name: Run SwiftLint
-      run: swiftlint lint
-
-    - name: Install SwiftFormat
-      run: brew install swiftformat
-
-    - name: Check code formatting
-      run: swiftformat --lint .
-
-    - name: Install Xcbeautify
-      run: brew install xcbeautify
-
-    - name: Clean build folder
-      run: xcodebuild clean -scheme ora -project Ora.xcodeproj
-
-    - name: Cache SPM dependencies
-      uses: actions/cache@v3
-      with:
-        path: |
-          ~/Library/Caches/org.swift.swiftpm/
-          ~/.swiftpm/
-        key: ${{ runner.os }}-spm-${{ hashFiles('**/Package.swift') }}
-        restore-keys: |
-          ${{ runner.os }}-spm-
-
-    - name: Resolve dependencies
-      run: xcodebuild -resolvePackageDependencies
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup Xcode
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: latest-stable
+
+      - name: Show toolchain
+        run: |
+          uname -m
+          xcodebuild -version
+          swift --version
+
+      - name: Install pinned SwiftLint and SwiftFormat
+        run: |
+          bin="$RUNNER_TEMP/tools-bin"
+          mkdir -p "$bin"
+          # Download a release archive and install the named binary from it,
+          # wherever it sits inside the archive.
+          install_tool() {
+            local name="$1" url="$2" dir="$RUNNER_TEMP/$1"
+            curl -fsSL -o "$dir.zip" "$url"
+            unzip -o -q "$dir.zip" -d "$dir"
+            install -m 755 "$(find "$dir" -type f -name "$name" | head -n 1)" "$bin/$name"
+          }
+          install_tool swiftlint \
+            "https://github.com/realm/SwiftLint/releases/download/${SWIFTLINT_VERSION}/portable_swiftlint.zip"
+          install_tool swiftformat \
+            "https://github.com/nicklockwood/SwiftFormat/releases/download/${SWIFTFORMAT_VERSION}/swiftformat.zip"
+          echo "$bin" >> "$GITHUB_PATH"
+
+      - name: Install XcodeGen and xcbeautify
+        run: brew install xcodegen xcbeautify
+
+      - name: Lint
+        run: |
+          swiftlint version
+          swiftlint lint --quiet
+
+      - name: Check formatting
+        run: |
+          swiftformat --version
+          swiftformat --lint .
+
+      - name: Generate Xcode project
+        run: xcodegen
+
+      - name: Cache Swift packages
+        uses: actions/cache@v4
+        with:
+          path: .spm
+          key: ${{ runner.os }}-spm-${{ hashFiles('project.yml') }}
+          restore-keys: |
+            ${{ runner.os }}-spm-
+
+      # The CI has no signing identity: sign ad hoc ("-") instead, which is
+      # enough to build, run the host app and load the test bundle.
+      - name: Build and run unit tests
+        run: |
+          set -o pipefail
+          xcodebuild test \
+            -project Ora.xcodeproj \
+            -scheme ora \
+            -destination "platform=macOS,arch=arm64" \
+            -clonedSourcePackagesDirPath .spm \
+            -resultBundlePath "$RUNNER_TEMP/TestResults.xcresult" \
+            CODE_SIGN_IDENTITY="-" \
+            CODE_SIGN_STYLE=Manual \
+            DEVELOPMENT_TEAM="" \
+            PROVISIONING_PROFILE_SPECIFIER="" \
+            | xcbeautify --renderer github-actions
+
+      - name: Upload test results
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: TestResults
+          path: ${{ runner.temp }}/TestResults.xcresult
+          retention-days: 7

.github/workflows/upstream-sync.yml

@@ -0,0 +1,74 @@
+# Vérifie chaque jour s'il y a du nouveau sur the-ora/browser et ouvre une PR
+# de synchronisation dans ce fork (branche `upstream-sync` -> `main`).
+name: Upstream Sync
+
+on:
+  schedule:
+    - cron: "17 5 * * *" # tous les jours vers 7h (heure de Paris)
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: write
+
+concurrency:
+  group: upstream-sync
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    env:
+      UPSTREAM_REPO: the-ora/browser
+      UPSTREAM_BRANCH: main
+      SYNC_BRANCH: upstream-sync
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Fetch upstream
+        run: |
+          git remote add upstream "https://github.com/${UPSTREAM_REPO}.git"
+          git fetch upstream "${UPSTREAM_BRANCH}" --tags
+
+      - name: Check for new upstream commits
+        id: check
+        run: |
+          count=$(git rev-list --count "HEAD..upstream/${UPSTREAM_BRANCH}")
+          echo "count=${count}" >> "$GITHUB_OUTPUT"
+          echo "Nouveaux commits upstream : ${count}"
+
+      - name: Push sync branch
+        if: steps.check.outputs.count != '0'
+        run: |
+          git push --force origin "upstream/${UPSTREAM_BRANCH}:refs/heads/${SYNC_BRANCH}"
+
+      - name: Open or update pull request
+        if: steps.check.outputs.count != '0'
+        run: |
+          log=$(git log --oneline --no-merges "HEAD..upstream/${UPSTREAM_BRANCH}" | head -50)
+          body=$(printf '%s\n\n%s\n\n```\n%s\n```\n' \
+            "Synchronisation automatique depuis [${UPSTREAM_REPO}](https://github.com/${UPSTREAM_REPO})." \
+            "${{ steps.check.outputs.count }} nouveau(x) commit(s) upstream :" \
+            "$log")
+          existing=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$SYNC_BRANCH" --state open --json number --jq '.[0].number')
+          if [ -n "$existing" ]; then
+            gh pr edit "$existing" --repo "$GITHUB_REPOSITORY" --body "$body"
+            echo "PR #$existing mise à jour"
+          else
+            gh pr create --repo "$GITHUB_REPOSITORY" \
+              --base main --head "$SYNC_BRANCH" \
+              --title "Sync upstream (${UPSTREAM_REPO})" \
+              --body "$body"
+          fi
+
+      # Pull requests opened with GITHUB_TOKEN do not trigger other workflows,
+      # but workflow_dispatch does: run the CI on the sync branch explicitly so
+      # the pull request gets its checks.
+      - name: Run CI on the sync branch
+        if: steps.check.outputs.count != '0'
+        run: gh workflow run build-and-test.yml --repo "$GITHUB_REPOSITORY" --ref "$SYNC_BRANCH"

.swiftformat

@@ -20,6 +20,14 @@
 --disable sortedImports
 --disable consecutiveSpaces
 --disable redundantReturn
+# Règles apparues dans les versions récentes de SwiftFormat : désactivées pour
+# garder le formatage d'origine (et éviter les conflits avec the-ora/browser)
+--disable wrapIfStatementBodies
+--disable nestedIf
+--disable repeatedGuard
+--disable redundantSwiftUIGroup
+--disable wrapIfExpressionBodies
+--disable redundantEmptyView
 --exclude Pods
 --exclude Carthage
 --exclude .build

ora/App/OraApp.swift

@@ -21,29 +21,9 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         return .terminateLater
     }
 
-    func application(_ application: NSApplication, open urls: [URL]) {
-        handleIncomingURLs(urls)
-    }
-
-    func getWindow() -> NSWindow? {
-        if let key = NSApp.keyWindow { return key }
-        if let visible = NSApp.windows.first(where: { $0.isVisible }) { return visible }
-        if let any = NSApp.windows.first {
-            any.makeKeyAndOrderFront(nil)
-            return any
-        }
-        return WindowFactory.makeMainWindow(rootView: OraRoot())
-    }
-
-    func handleIncomingURLs(_ urls: [URL]) {
-        let window = getWindow()!
-        for url in urls {
-            let userInfo: [AnyHashable: Any] = ["url": url]
-            DispatchQueue.main.async {
-                NotificationCenter.default.post(name: .openURL, object: window, userInfo: userInfo)
-            }
-        }
-    }
+    // Links opened from other apps are routed by SwiftUI to a browser window
+    // (see `handlesExternalEvents` on the scenes and in `OraRoot`), so the app
+    // delegate deliberately does not implement `application(_:open:)`.
 }
 
 func deleteSwiftDataStore(_ loc: String) {
@@ -82,7 +62,9 @@ struct OraApp: App {
         .defaultSize(width: 1440, height: 900)
         .windowStyle(.hiddenTitleBar)
         .windowResizability(.contentMinSize)
-        .handlesExternalEvents(matching: [])
+        // Links opened from other apps (Ora as default browser) go to a regular
+        // window; SwiftUI creates one if none is open, e.g. on a cold launch.
+        .handlesExternalEvents(matching: ["*"])
 
         WindowGroup("Private", id: "private") {
             OraRoot(isPrivate: true)
@@ -114,6 +96,7 @@ struct OraApp: App {
         .windowToolbarStyle(UnifiedCompactWindowToolbarStyle())
         .windowResizability(.contentSize)
         .defaultSize(width: 980, height: 640)
+        .handlesExternalEvents(matching: [])
         .commands { OraCommands() }
     }
 }

ora/App/OraCommands.swift

@@ -127,6 +127,14 @@ struct OraCommands: Commands {
                 NotificationCenter.default.post(name: .goForward, object: NSApp.keyWindow)
             }
             .keyboardShortcut(KeyboardShortcuts.Navigation.forward.keyboardShortcut)
+
+            #if DEBUG
+                Divider()
+
+                Button("Copy Page Crash Command (All Tabs in Space)") {
+                    NotificationCenter.default.post(name: .simulatePageCrash, object: NSApp.keyWindow)
+                }
+            #endif
         }
 
         CommandMenu("Tabs") {

ora/App/OraRoot.swift

@@ -107,6 +107,23 @@ struct OraRoot: View {
             .modelContext(downloadContext)
             .withTheme()
             .enableInjection()
+            // External links: reuse this window instead of opening a new one
+            // per link. `onOpenURL` only runs once the view is ready, so links
+            // that launch Ora are not lost. Private windows never take them.
+            .handlesExternalEvents(
+                preferring: privacyMode.isPrivate ? [] : ["*"],
+                allowing: privacyMode.isPrivate ? [] : ["*"]
+            )
+            .onOpenURL { url in
+                guard !privacyMode.isPrivate else { return }
+                tabManager.openTab(
+                    url: url,
+                    historyManager: historyManager,
+                    downloadManager: downloadManager,
+                    focusAfterOpening: true,
+                    isPrivate: false
+                )
+            }
             .onAppear {
                 downloadManager.toastManager = toastManager
                 Task {
@@ -148,6 +165,17 @@ struct OraRoot: View {
                     return false
                 }
 
+                // Full screen: macOS only offers Globe+F in the View menu, which
+                // keyboards without a Globe key cannot type. Honour Ora's own,
+                // customizable shortcut (⌃⌘F by default) as well.
+                keyModifierListener.registerKeyDownHandler { event in
+                    guard KeyChord(fromEvent: event) == KeyboardShortcuts.Window.fullscreen.currentChord,
+                          let targetWindow = event.window ?? NSApp.keyWindow
+                    else { return false }
+                    targetWindow.toggleFullScreen(nil)
+                    return true
+                }
+
                 // Cmd+Q quit confirmation
                 NotificationCenter.default.addObserver(forName: .quitRequested, object: nil, queue: .main) { note in
                     guard note.object as? NSWindow === window ?? NSApp.keyWindow else { return }
@@ -213,6 +241,30 @@ struct OraRoot: View {
                         tabManager.activeTab?.reload()
                     }
                 }
+                #if DEBUG
+                    NotificationCenter.default.addObserver(
+                        forName: .simulatePageCrash,
+                        object: nil,
+                        queue: .main
+                    ) { note in
+                        Task { @MainActor in
+                            guard note.object as? NSWindow === window ?? NSApp.keyWindow else { return }
+                            // The sandbox forbids Ora to kill a web content process
+                            // itself: copy the command that crashes them, to run in
+                            // Terminal (SIGKILL ends a process exactly like a crash).
+                            let tabs = tabManager.activeContainer?.tabs ?? []
+                            let pids = Set(tabs.compactMap { $0.browserPage?.webContentProcessIdentifier })
+                            guard !pids.isEmpty else {
+                                print("[Simulate crash] No web content process found")
+                                return
+                            }
+                            let command = "kill -9 " + pids.sorted().map(String.init).joined(separator: " ")
+                            NSPasteboard.general.clearContents()
+                            NSPasteboard.general.setString(command, forType: .string)
+                            print("[Simulate crash] Copied to the clipboard, run it in Terminal: \(command)")
+                        }
+                    }
+                #endif
                 NotificationCenter.default.addObserver(forName: .goBack, object: nil, queue: .main) { note in
                     Task { @MainActor in
                         guard note.object as? NSWindow === window ?? NSApp.keyWindow else { return }