fix: WebviewUrl::App hash fragment bug — tool windows loading empty page

ROOT CAUSE FOUND: WebviewUrl::App takes a PathBuf, not a URL.
Passing "index.html#/tool/ping?sessionId=abc" treated the ENTIRE
string including # and ? as a file path. Tauri looked for a file
literally named "index.html#/tool/ping?sessionId=abc" which doesn't
exist. The webview loaded an empty/404 page and WKWebView killed
the content process, closing the window instantly.

Fix:
- Rust: split URL at '#' — pass only "index.html" to WebviewUrl::App,
  then set the hash fragment via window.eval() after build()
- Vue: App.vue now listens for 'hashchange' event in addition to
  checking hash on mount, so the eval-injected hash triggers the
  correct tool/detached mode

This was NEVER a CSP issue, focus issue, crossorigin issue, or
async chunk loading issue. It was always a bad file path.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src-tauri/src/commands/mod.rs

@@ -14,3 +14,4 @@ pub mod updater;
 pub mod tools_commands_r2;
 pub mod workspace_commands;
 pub mod docker_commands;
+pub mod window_commands;

src-tauri/src/commands/window_commands.rs

@@ -0,0 +1,40 @@
+use tauri::AppHandle;
+use tauri::WebviewWindowBuilder;
+
+/// Open a child window from the Rust side using WebviewWindowBuilder.
+///
+/// The `url` parameter supports hash fragments (e.g. "index.html#/tool/ping?sessionId=abc").
+/// WebviewUrl::App takes a PathBuf and cannot handle hash/query — so we load plain
+/// index.html and set the hash via JS after the window is created.
+#[tauri::command]
+pub fn open_child_window(
+    app_handle: AppHandle,
+    label: String,
+    title: String,
+    url: String,
+    width: f64,
+    height: f64,
+) -> Result<(), String> {
+    // Split "index.html#/tool/ping?sessionId=abc" into path and fragment
+    let (path, hash) = match url.split_once('#') {
+        Some((p, h)) => (p.to_string(), Some(format!("#{}", h))),
+        None => (url.clone(), None),
+    };
+
+    let webview_url = tauri::WebviewUrl::App(path.into());
+    let window = WebviewWindowBuilder::new(&app_handle, &label, webview_url)
+        .title(&title)
+        .inner_size(width, height)
+        .resizable(true)
+        .center()
+        .build()
+        .map_err(|e| format!("Failed to create window '{}': {}", label, e))?;
+
+    // Set the hash fragment after the window loads — this triggers App.vue's
+    // onMounted hash detection to render the correct tool/detached component.
+    if let Some(hash) = hash {
+        let _ = window.eval(&format!("window.location.hash = '{}';", hash));
+    }
+
+    Ok(())
+}

src-tauri/src/lib.rs

@@ -234,6 +234,7 @@ pub fn run() {
             commands::updater::check_for_updates,
             commands::workspace_commands::save_workspace, commands::workspace_commands::load_workspace,
             commands::docker_commands::docker_list_containers, commands::docker_commands::docker_list_images, commands::docker_commands::docker_list_volumes, commands::docker_commands::docker_action,
+            commands::window_commands::open_child_window,
         ])
         .run(tauri::generate_context!())
         .expect("error while running tauri application");

src/App.vue

@@ -16,7 +16,6 @@ const DetachedSession = defineAsyncComponent({
 const app = useAppStore();
 const appError = ref<string | null>(null);
 
-// Tool window mode — detected from URL hash: #/tool/network-scanner?sessionId=abc
 const isToolMode = ref(false);
 const isDetachedMode = ref(false);
 const toolName = ref("");
@@ -28,32 +27,39 @@ onErrorCaptured((err) => {
   return false;
 });
 
-onMounted(async () => {
-  const hash = window.location.hash;
+/** Parse hash and set mode flags. Called on mount and on hashchange. */
+function applyHash(hash: string): void {
   if (hash.startsWith("#/tool/")) {
     isToolMode.value = true;
-    const rest = hash.substring(7); // after "#/tool/"
+    const rest = hash.substring(7);
     const [name, query] = rest.split("?");
     toolName.value = name;
     toolSessionId.value = new URLSearchParams(query || "").get("sessionId") || "";
   } else if (hash.startsWith("#/detached-session")) {
     isDetachedMode.value = true;
-  } else {
+  }
+}
+
+onMounted(async () => {
+  // Check hash at load time (present if JS-side WebviewWindow set it in the URL)
+  applyHash(window.location.hash);
+
+  // Also listen for hash changes (Rust-side window sets hash via eval after load)
+  window.addEventListener("hashchange", () => applyHash(window.location.hash));
+
+  // Only init vault for the main app window (no hash)
+  if (!isToolMode.value && !isDetachedMode.value) {
     await app.checkVaultState();
   }
 });
 </script>
 
 <template>
-  <!-- Error display for debugging -->
   <div v-if="appError" class="fixed inset-0 z-50 flex items-center justify-center bg-[#0d1117] text-red-400 p-8 text-sm font-mono whitespace-pre-wrap">
     {{ appError }}
   </div>
-  <!-- Detached session window mode -->
   <DetachedSession v-else-if="isDetachedMode" />
-  <!-- Tool popup window mode -->
   <ToolWindow v-else-if="isToolMode" :tool="toolName" :session-id="toolSessionId" />
-  <!-- Normal app mode -->
   <div v-else class="app-root">
     <UnlockLayout v-if="!app.isUnlocked" />
     <MainLayout v-else />

src/components/rdp/RdpView.vue

@@ -204,44 +204,45 @@ onBeforeUnmount(() => {
   if (resizeTimeout) { clearTimeout(resizeTimeout); resizeTimeout = null; }
 });
 
-// Focus canvas, re-check dimensions, and force full frame on tab switch
+// Focus canvas, re-check dimensions, and force full frame on tab switch.
+// Uses 300ms delay to let the flex layout fully settle (copilot panel toggle, etc.)
 watch(
   () => props.isActive,
   (active) => {
     if (!active || !canvasRef.value) return;
 
-    // Wait for layout to settle after tab becomes visible
-    requestAnimationFrame(() => {
-      requestAnimationFrame(() => {
-        const wrapper = canvasWrapper.value;
-        const canvas = canvasRef.value;
-        if (!wrapper || !canvas) return;
+    // Immediate focus so keyboard works right away
+    if (keyboardGrabbed.value) canvasRef.value.focus();
 
-        const { width: cw, height: ch } = wrapper.getBoundingClientRect();
-        const newW = Math.round(cw) & ~1;
-        const newH = Math.round(ch);
+    // Immediate force refresh to show SOMETHING while we check dimensions
+    invoke("rdp_force_refresh", { sessionId: props.sessionId }).catch(() => {});
 
-        // If container size differs from canvas resolution, resize the RDP session
-        if (newW >= 200 && newH >= 200 && (newW !== canvas.width || newH !== canvas.height)) {
-          invoke("rdp_resize", {
-            sessionId: props.sessionId,
-            width: newW,
-            height: newH,
-          }).then(() => {
+    // Delayed dimension check — layout needs time to settle
+    setTimeout(() => {
+      const wrapper = canvasWrapper.value;
+      const canvas = canvasRef.value;
+      if (!wrapper || !canvas) return;
+
+      const { width: cw, height: ch } = wrapper.getBoundingClientRect();
+      const newW = Math.round(cw) & ~1;
+      const newH = Math.round(ch);
+
+      if (newW >= 200 && newH >= 200 && (newW !== canvas.width || newH !== canvas.height)) {
+        invoke("rdp_resize", {
+          sessionId: props.sessionId,
+          width: newW,
+          height: newH,
+        }).then(() => {
+          if (canvas) {
             canvas.width = newW;
             canvas.height = newH;
-            setTimeout(() => {
-              invoke("rdp_force_refresh", { sessionId: props.sessionId }).catch(() => {});
-            }, 200);
-          }).catch(() => {});
-        } else {
-          // Same size — just refresh the frame
-          invoke("rdp_force_refresh", { sessionId: props.sessionId }).catch(() => {});
-        }
-
-        if (keyboardGrabbed.value) canvas.focus();
-      });
-    });
+          }
+          setTimeout(() => {
+            invoke("rdp_force_refresh", { sessionId: props.sessionId }).catch(() => {});
+          }, 500);
+        }).catch(() => {});
+      }
+    }, 300);
   },
 );
 </script>

src/components/session/TabBar.vue

@@ -133,20 +133,14 @@ async function detachTab(): Promise<void> {
   session.active = false;
 
   // Open a new Tauri window for this session
-  const { WebviewWindow } = await import("@tauri-apps/api/webviewWindow");
-  const label = `detached-${session.id.substring(0, 8)}-${Date.now()}`;
-  const wv = new WebviewWindow(label, {
-    title: `${session.name} — Wraith`,
-    width: 900,
-    height: 600,
-    resizable: true,
-    center: true,
-    visible: false,
-    focus: true,
-    url: `index.html#/detached-session?sessionId=${session.id}&name=${encodeURIComponent(session.name)}&protocol=${session.protocol}`,
-  });
-  wv.once("tauri://created", () => { wv.show(); });
-  wv.once("tauri://error", (e) => { console.error("Detach window error:", e); });
+  try {
+    await invoke("open_child_window", {
+      label: `detached-${session.id.substring(0, 8)}-${Date.now()}`,
+      title: `${session.name} — Wraith`,
+      url: `index.html#/detached-session?sessionId=${session.id}&name=${encodeURIComponent(session.name)}&protocol=${session.protocol}`,
+      width: 900, height: 600,
+    });
+  } catch (err) { console.error("Detach window error:", err); }
 }
 
 function closeMenuTab(): void {

src/layouts/MainLayout.vue

@@ -367,20 +367,14 @@ function closeHelpMenuDeferred(): void {
 
 async function handleHelpAction(page: string): Promise<void> {
   showHelpMenu.value = false;
-  const { WebviewWindow } = await import("@tauri-apps/api/webviewWindow");
-  const label = `help-${page}-${Date.now()}`;
-  const wv = new WebviewWindow(label, {
-    title: `Wraith — Help`,
-    width: 750,
-    height: 600,
-    resizable: true,
-    center: true,
-    visible: false,
-    focus: true,
-    url: `index.html#/tool/help?page=${page}`,
-  });
-  wv.once("tauri://created", () => { wv.show(); });
-  wv.once("tauri://error", (e) => { console.error("Help window error:", e); alert("Window error: " + JSON.stringify(e.payload)); });
+  try {
+    await invoke("open_child_window", {
+      label: `help-${page}-${Date.now()}`,
+      title: "Wraith — Help",
+      url: `index.html#/tool/help?page=${page}`,
+      width: 750, height: 600,
+    });
+  } catch (err) { console.error("Help window error:", err); alert("Window error: " + String(err)); }
 }
 
 async function handleToolAction(tool: string): Promise<void> {
@@ -394,8 +388,6 @@ async function handleToolAction(tool: string): Promise<void> {
     return;
   }
 
-  const { WebviewWindow } = await import("@tauri-apps/api/webviewWindow");
-
   const toolConfig: Record<string, { title: string; width: number; height: number }> = {
     "network-scanner": { title: "Network Scanner", width: 800, height: 600 },
     "port-scanner": { title: "Port Scanner", width: 700, height: 500 },
@@ -416,20 +408,14 @@ async function handleToolAction(tool: string): Promise<void> {
 
   const sessionId = activeSessionId.value || "";
 
-  // Open tool in a new Tauri window — create hidden, show after webview confirms ready
-  const label = `tool-${tool}-${Date.now()}`;
-  const wv = new WebviewWindow(label, {
-    title: `Wraith — ${config.title}`,
-    width: config.width,
-    height: config.height,
-    resizable: true,
-    center: true,
-    visible: false,
-    focus: true,
-    url: `index.html#/tool/${tool}?sessionId=${sessionId}`,
-  });
-  wv.once("tauri://created", () => { wv.show(); });
-  wv.once("tauri://error", (e) => { console.error("Tool window error:", e); alert("Window error: " + JSON.stringify(e.payload)); });
+  try {
+    await invoke("open_child_window", {
+      label: `tool-${tool}-${Date.now()}`,
+      title: `Wraith — ${config.title}`,
+      url: `index.html#/tool/${tool}?sessionId=${sessionId}`,
+      width: config.width, height: config.height,
+    });
+  } catch (err) { console.error("Tool window error:", err); alert("Tool window error: " + String(err)); }
 }
 
 async function handleFileMenuAction(action: string): Promise<void> {
@@ -449,23 +435,14 @@ function handleThemeSelect(theme: ThemeDefinition): void {
 async function handleOpenFile(entry: FileEntry): Promise<void> {
   if (!activeSessionId.value) return;
   try {
-    const { WebviewWindow } = await import("@tauri-apps/api/webviewWindow");
     const fileName = entry.path.split("/").pop() || entry.path;
-    const label = `editor-${Date.now()}`;
     const sessionId = activeSessionId.value;
-
-    const wv = new WebviewWindow(label, {
+    await invoke("open_child_window", {
+      label: `editor-${Date.now()}`,
       title: `${fileName} — Wraith Editor`,
-      width: 800,
-      height: 600,
-      resizable: true,
-      center: true,
-      visible: false,
-      focus: true,
       url: `index.html#/tool/editor?sessionId=${sessionId}&path=${encodeURIComponent(entry.path)}`,
+      width: 800, height: 600,
     });
-    wv.once("tauri://created", () => { wv.show(); });
-    wv.once("tauri://error", (e) => { console.error("Editor window error:", e); alert("Window error: " + JSON.stringify(e.payload)); });
   } catch (err) { console.error("Failed to open editor:", err); }
 }