Add annual Pro pricing

Packages/macOS/CmuxBrowser/Sources/CmuxBrowser/AppSession/BrowserAppTheme.swift

@@ -0,0 +1,103 @@
+public import Foundation
+
+/// Serializable app-web theme values shared by pricing and Pro welcome browser surfaces.
+public struct BrowserAppTheme: Equatable, Sendable {
+    public let appearance: String
+    public let background: String
+    public let foreground: String
+    public let accent: String
+    public let accentOnBackground: String
+    public let accentOnForeground: String
+
+    /// Creates a complete theme after the app has resolved readable accent variants.
+    public init(
+        appearance: String,
+        background: String,
+        foreground: String,
+        accent: String,
+        accentOnBackground: String,
+        accentOnForeground: String
+    ) {
+        self.appearance = appearance
+        self.background = background
+        self.foreground = foreground
+        self.accent = accent
+        self.accentOnBackground = accentOnBackground
+        self.accentOnForeground = accentOnForeground
+    }
+
+    /// Query items used to seed a server-rendered app-web page with the native theme.
+    public var queryItems: [URLQueryItem] {
+        [
+            URLQueryItem(name: "appearance", value: appearance),
+            URLQueryItem(name: "background", value: background),
+            URLQueryItem(name: "foreground", value: foreground),
+            URLQueryItem(name: "accent", value: accent),
+            URLQueryItem(name: "accent_on_background", value: accentOnBackground),
+            URLQueryItem(name: "accent_on_foreground", value: accentOnForeground),
+        ]
+    }
+
+    /// JavaScript that refreshes an already-rendered supported page without navigation.
+    public func applyingJavaScript() -> String? {
+        let payload = JavaScriptPayload(
+            appearance: appearance,
+            background: background,
+            foreground: foreground,
+            accent: accent,
+            accentOnBackground: accentOnBackground,
+            accentOnForeground: accentOnForeground
+        )
+        guard let data = try? JSONEncoder().encode(payload),
+              let json = String(data: data, encoding: .utf8) else {
+            return nil
+        }
+        return """
+        (() => {
+          const root = document.querySelector('[data-cmux-app-theme]');
+          if (!root) return false;
+          const theme = \(json);
+          root.style.setProperty('--ghostty-background', theme.background);
+          root.style.setProperty('--ghostty-foreground', theme.foreground);
+          root.style.setProperty('--cmux-product-blue', theme.accent);
+          root.style.setProperty('--cmux-product-blue-on-background', theme.accentOnBackground);
+          root.style.setProperty('--cmux-product-blue-on-foreground', theme.accentOnForeground);
+          root.style.backgroundColor = theme.background;
+          root.style.colorScheme = theme.appearance;
+          root.dataset.cmuxAppThemeAppearance = theme.appearance;
+          if (root.hasAttribute('data-app-pricing-appearance')) {
+            root.setAttribute('data-app-pricing-appearance', theme.appearance);
+          }
+          if (root.hasAttribute('data-app-pro-welcome-appearance')) {
+            root.setAttribute('data-app-pro-welcome-appearance', theme.appearance);
+          }
+          for (const element of [document.documentElement, document.body]) {
+            element?.style.setProperty('background', theme.background, 'important');
+          }
+          document.querySelector('meta[name="theme-color"]')
+            ?.setAttribute('content', theme.background);
+          return true;
+        })()
+        """
+    }
+
+    /// Checks the app-web URL contract without constructing theme colors.
+    public static func supportsAppSurface(url: URL?, trustedOrigin: URL) -> Bool {
+        guard let url,
+              let scheme = url.scheme?.lowercased(),
+              scheme == "http" || scheme == "https",
+              BrowserAppWebOrigin(trustedOrigin).containsAppSurface(url) else {
+            return false
+        }
+        return true
+    }
+
+    private struct JavaScriptPayload: Encodable {
+        let appearance: String
+        let background: String
+        let foreground: String
+        let accent: String
+        let accentOnBackground: String
+        let accentOnForeground: String
+    }
+}

Packages/macOS/CmuxBrowser/Sources/CmuxBrowser/AppSession/BrowserAppWebOrigin.swift

@@ -8,19 +8,62 @@ struct BrowserAppWebOrigin {
     }
 
     func contains(_ candidate: URL) -> Bool {
-        guard candidate.scheme?.lowercased() == url.scheme?.lowercased(),
-              candidate.host?.lowercased() == url.host?.lowercased() else {
+        guard Self.isSecureOrLoopbackOrigin(url),
+              Self.isSecureOrLoopbackOrigin(candidate),
+              let scheme = url.scheme?.lowercased(),
+              let host = url.host?.lowercased(),
+              candidate.scheme?.lowercased() == scheme,
+              candidate.host?.lowercased() == host else {
             return false
         }
-        return effectivePort(candidate) == effectivePort(url)
+        return Self.effectivePort(candidate) == Self.effectivePort(url)
+    }
+
+    func containsAppSurface(_ candidate: URL) -> Bool {
+        guard contains(candidate) else { return false }
+        let normalizedPath = candidate.path.count > 1
+            && candidate.path.hasSuffix("/")
+            ? String(candidate.path.dropLast())
+            : candidate.path
+        return normalizedPath == "/app-pricing"
+            || normalizedPath == "/app-pro-welcome"
+    }
+
+    /// Recognizes local development hosts without accepting dotted-host lookalikes.
+    static func isLoopbackHost(_ candidate: String) -> Bool {
+        let host = candidate.lowercased()
+        if host == "localhost" || host == "::1" {
+            return true
+        }
+        if host != ".localhost", host.hasSuffix(".localhost") {
+            return true
+        }
+        let octets = host.split(separator: ".", omittingEmptySubsequences: false)
+        return octets.count == 4
+            && octets.allSatisfy { UInt8($0) != nil }
+            && octets[0] == "127"
     }
-}
 
-private func effectivePort(_ url: URL) -> Int? {
-    if let port = url.port { return port }
-    switch url.scheme?.lowercased() {
-    case "http": return 80
-    case "https": return 443
-    default: return nil
+    private static func isSecureOrLoopbackOrigin(_ url: URL) -> Bool {
+        guard url.user == nil,
+              url.password == nil,
+              let host = url.host?.lowercased(),
+              !host.isEmpty else {
+            return false
+        }
+        if url.scheme?.lowercased() == "https" {
+            return true
+        }
+        guard url.scheme?.lowercased() == "http" else { return false }
+        return isLoopbackHost(host)
+    }
+
+    private static func effectivePort(_ url: URL) -> Int? {
+        if let port = url.port { return port }
+        switch url.scheme?.lowercased() {
+        case "http": return 80
+        case "https": return 443
+        default: return nil
+        }
     }
 }

Packages/macOS/CmuxBrowser/Sources/CmuxBrowser/AppSession/BrowserExternalNavigationPolicy.swift

@@ -0,0 +1,33 @@
+public import Foundation
+
+/// Decides whether a trusted app-web surface explicitly requests the system browser.
+public struct BrowserExternalNavigationPolicy: Equatable, Sendable {
+    public let trustedOrigin: URL
+
+    /// Creates a policy pinned to the exact app-web origin.
+    public init(trustedOrigin: URL) {
+        self.trustedOrigin = trustedOrigin
+    }
+
+    /// Returns true only when a trusted app-web source activates a same-origin
+    /// web URL with an explicit intent marker.
+    public func shouldOpenInSystemBrowser(
+        _ url: URL,
+        sourceURL: URL?
+    ) -> Bool {
+        guard let sourceURL,
+              BrowserAppWebOrigin(trustedOrigin).contains(sourceURL),
+              isSafeWebDestination(url),
+              let components = URLComponents(url: url, resolvingAgainstBaseURL: false),
+              components.queryItems?.contains(where: {
+                  $0.name == "cmux_external_browser" && $0.value == "1"
+              }) == true else {
+            return false
+        }
+        return true
+    }
+
+    private func isSafeWebDestination(_ url: URL) -> Bool {
+        BrowserAppWebOrigin(trustedOrigin).contains(url)
+    }
+}

Packages/macOS/CmuxBrowser/Sources/CmuxBrowser/Omnibar/BrowserURLResolver.swift

@@ -42,10 +42,7 @@ public struct BrowserURLResolver: Sendable {
 
         let lower = trimmed.lowercased()
         let bareHost = bareHostCandidate(lower)
-        if bareHost == "localhost" ||
-            isIPv4Loopback(bareHost) ||
-            bareHost == "::1" ||
-            (bareHost != ".localhost" && bareHost.hasSuffix(".localhost")) {
+        if BrowserAppWebOrigin.isLoopbackHost(bareHost) {
             return URL(string: "http://\(trimmed)")
         }
 
@@ -174,13 +171,6 @@ public struct BrowserURLResolver: Sendable {
         return String(lowercasedInput[..<end])
     }
 
-    /// Recognizes IPv4 loopback addresses without accepting dotted-host lookalikes.
-    private func isIPv4Loopback(_ host: String) -> Bool {
-        let octets = host.split(separator: ".", omittingEmptySubsequences: false)
-        guard octets.count == 4, octets.allSatisfy({ UInt8($0) != nil }) else { return false }
-        return octets[0] == "127"
-    }
-
     private func isDottedHostWithPort(_ input: String, schemeCandidate: String) -> Bool {
         guard schemeCandidate.contains(".") else { return false }
         guard input.count > schemeCandidate.count else { return false }