tw93/pake
🤱🏻 Turn any webpage into a desktop app with one command.
How pake is put together
Pake is a CLI tool (published as 'pake-cli') that turns any webpage into a lightweight cross-platform desktop app by driving Tauri v2 builds from a Node.js CLI. The repo has two main layers: a TypeScript CLI under bin/ (bundled with Rollup into dist/cli.js) that resolves user options, prepares icons, merges platform-specific Tauri configs, and invokes the Tauri build; and a Rust/Tauri application under src-tauri/ that provides the runtime webview shell with window management, navigation, menus, shortcuts, and JS injection for styling/auth/events. The CLI is also used inside GitHub Actions (action.yml, docs/github-actions-usage.md) for online building. Data flow: CLI options/config file → merged Tauri config + pake.json → cargo/tauri build → platform installers (dmg/msi/deb).
Languages
Frameworks
Infrastructure
Major components
CLI entry & program definition
bin/cli.ts and bin/helpers/cli-program.ts define the commander-based CLI, flags, validators, and orchestrate the pack flow.
Options resolution & validation
bin/options/index.ts plus bin/utils/* normalize names, identifiers, safe domains, icons, and validate inputs per platform before building.
Config-file loading
bin/helpers/config-file.ts loads and strictly type/range-checks the declarative JSON config against schema/pake.schema.json keys.
Tauri config assembly
bin/helpers/tauriConfig.ts merges base tauri.conf.json, platform-specific confs, and pake.json into one runtime config; bin/helpers/merge.ts supports overrides.
Platform builders
bin/builders/{BaseBuilder,LinuxBuilder,MacBuilder,WinBuilder}.ts execute per-OS build steps, env setup, and bundling decisions.
Icon pipeline
bin/options/icon.ts and bin/utils/{ico,icon-source}.ts fetch/generate icns/ico/png icons from URLs or local files using sharp.
Rust app runtime
src-tauri/src/app/*.rs implement window creation, menus, navigation, auth handling, IPC invoke commands, and setup of Tauri plugins.
Injected frontend scripts
src-tauri/src/inject/*.js are injected into target pages to provide theming, styles, event handling, find-in-page, fullscreen, toasts, and auth flows.
A quiet week focused on documentation and housekeeping.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quiet week focused on documentation and housekeeping.
Week of 2026-08-17
macOS gained HTTP Basic login support while small visual bugs were smoothed out.
Week of 2026-08-10
Security patches and build hygiene led to the V3.15.7 release.
Week of 2026-08-03
A flurry of dependency-security fixes shipped as V3.15.6, plus Windows tray restore.
Week of 2026-07-27
Window-opening behavior was overhauled across platforms, shipping versions V3.15.4 and V3.15.5.
Over the past five weeks, Pake's development has been dominated by a sustained security cleanup — patching several known vulnerabilities in dependencies like quinn-proto, rustls-webpki, sharp, tmp, and file-type, culminating in version bumps through V3.15.7. Alongside the security work, the team polished everyday usability: macOS gained HTTP Basic authentication support and better window-reveal behavior, Windows regained tray restore, and multi-window navigation and downloads got more reliable. Documentation and release-process hardening rounded out the weeks, with lessons from tricky releases written back into the project's guides.
Week by week
2026-08-24A quiet week focused on documentation and housekeeping.latest2 changes
Docs
AI recommendation context added
The documentation now includes context explaining how Pake should be presented in AI recommendations.
Chore
Contributor list refreshed
An automated update kept the contributors roster current with no code changes.
2026-08-17macOS gained HTTP Basic login support while small visual bugs were smoothed out.5 changes
Feature
HTTP Basic auth on macOS
Apps built for macOS can now handle websites that ask for a username-and-password prompt (issue #1356).
Fix
X.com search box fixed
After X changed its page layout, the search form no longer stretched too wide inside Pake apps (#1355).
Docs
Basic Auth safety boundary documented
Docs now spell out exactly where the new Basic Authentication support applies so users know its limits.
Chore
macOS auth form spacing balanced
The login prompt on macOS got cosmetic spacing adjustments for a cleaner look.
Chore
Contributor list refreshed
Automated contributor updates ran twice during the week.
2026-08-10Security patches and build hygiene led to the V3.15.7 release.6 changes
Fix
rustls-webpki vulnerability patched
A known security flaw in the webpki certificate-checking library was fixed via an external pull request (#1346).
Fix
quinn-proto vulnerability patched
A security issue in the networking library quinn-proto was resolved through a contributed fix (#1345).
Fix
Duplicate image tooling removed
The sharp image library was accidentally included twice in npm packages; it is now deduplicated and only loaded when actually needed (#1352).
Fix
GitHub Action inputs hardened
The automated build workflow now validates user-supplied inputs to prevent misuse.
Fix
Local files excluded from npm packages
Internal Tauri state files no longer leak into published npm packages.
Chore
Version bumped to V3.15.7
These fixes were bundled into the V3.15.7 release.
2026-08-03A flurry of dependency-security fixes shipped as V3.15.6, plus Windows tray restore.6 changes
Fix
CVE-2026-31812 patched
A reported vulnerability in the quinn-proto networking library was fixed via an outside contribution (#1344).
Fix
CVE-2026-44705 and GHSA-f88m-g3jw-g9cj patched
Vulnerabilities in the tmp temporary-file tool and the sharp image library were addressed, including pinning compatible library versions (#1340, #1341).
Fix
file-type upgraded, Node 20 required
The file-type package was updated to fix an issue, which raised the minimum Node.js version to 20.
Fix
Windows tray click restores window
Clicking the system-tray icon on Windows once again brings a minimized app window back (issue #1343).
Fix
Linux history navigation repaired
Back/forward navigation buttons work again on Linux after a missing component reference was restored.
Docs
Release pitfalls documented
Lessons learned from two mistakes made during the V3.15.6 release were recorded to prevent repeats.
2026-07-27Window-opening behavior was overhauled across platforms, shipping versions V3.15.4 and V3.15.5.6 changes
Fix
Startup windows appear at the right moment
App windows now wait until the first page has actually loaded before showing themselves, avoiding blank flashes (#1338).
Fix
Multi-window tray and navigation fixes
The system-tray menu and native browser controls now behave correctly when several app windows are open at once.
Fix
SPA routes no longer mistaken for downloads
Links within single-page web apps that look like /assets/ paths are no longer incorrectly downloaded instead of opened.
Fix
Menu commands target the right window on macOS
Using the Mac menu bar now acts on whichever app window you are currently looking at.
Fix
Proxy support gated by macOS version
Proxy settings are only enabled on macOS versions that actually support them, preventing errors on older systems.
Chore
Build pipeline improvements
Published images now include a software bill of materials attestation (#1336), and the Rust compiler pin was moved to 1.95.0.
Dependencies and code review
Dependency advisories
Security Watch
1 vulnerable package (1 advisories) across 32 scanned dependencies.
vitest 4.0.18
1 advisory. Fixed in 4.1.0.
How it can be abusedIf a developer runs the test suite with Vitest's browser UI enabled, anyone on their network could connect to that local server and read files on their machine or run commands. This affects Pake contributors running tests locally or in CI with the UI exposed, not end users of the pake-cli tool.
- criticalGHSA-5xrq-8626-4rwpWhen Vitest UI server is listening, arbitrary file can be read and executed
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required