fix: eliminate panics, harden security, and improve UX

- Remove all .unwrap()/.expect() from production code paths, replacing
  with proper error handling via Result types and graceful fallbacks
- Fix desktop entry injection by sanitizing Name/Exec/WMClass fields
- Fix path traversal via app_id by stripping /, \, and .. sequences
- Add with_navigation_handler to webview blocking non-http/https URLs
- Add with_new_window_req_handler to block unsafe new window requests
- Validate URL scheme (http/https only) before loading in webview
- Harden icon-installer.sh: fix TOCTOU race, quote variables, add trap
- Add inline validation for title/URL fields in editor
- Add numeric-only filter with clamping for window size input
- Add toast notifications for save/delete via widget::toaster
- Add Ctrl+N keyboard shortcut for creating new web app
- Restructure app menu with Create new + divider + Settings + About
- Add RON file size limit (64KB), WalkDir depth limit (8), icon cap (200)
- Bound downloader output buffer to 32KB
- Make SVG extension check case-insensitive
- Add empty icon search state message
- Add CLAUDE.md with project documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: olafkfreund

CLAUDE.md

@@ -0,0 +1,97 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+**Quick Web Apps** (`dev.heppen.webapps`) is a web app manager for the COSMIC desktop environment. Users create, manage, and launch web applications that run in isolated WebKitGTK webview windows. Built with Rust using `libcosmic` (iced-based GUI framework) and `wry`/`tao` for the webview runtime.
+
+## Build Commands
+
+The project uses `just` as the task runner:
+
+```bash
+just                    # Build release (default)
+just build-debug        # Debug build
+just build-release      # Release build
+just check              # Clippy with -W clippy::pedantic
+just run                # Run with RUST_BACKTRACE=full
+just dev                # cargo fmt + run
+just clean              # cargo clean
+sudo just install       # Install binaries, desktop entry, icons to /app/
+```
+
+Flatpak build (primary distribution method):
+```bash
+flatpak run --command=flathub-build org.flatpak.Builder --install dev.heppen.webapps.json
+```
+
+There is no test suite. There is no flake.nix — use the Containerfile in `.devcontainer/` or system-installed deps.
+
+### System Dependencies
+
+Building requires: `pkg-config`, `libssl-dev`, `libxkbcommon-dev`, `libwebkit2gtk-4.1-dev`, `just`
+
+## Architecture
+
+### Two Binaries
+
+The crate produces two binaries (see `Cargo.toml [[bin]]` sections):
+
+1. **`dev-heppen-webapps`** (`src/bin/dev-heppen-webapps/main.rs`) — The main GUI application where users create/edit/delete web apps
+2. **`dev-heppen-webapps-webview`** (`src/bin/webview.rs`) — Lightweight webview process spawned per web app. Reads config from the database, creates a GTK+WebKitGTK window, and runs an event loop
+
+Each web app runs as a separate `dev-heppen-webapps-webview <app_id>` process.
+
+### Library Layer (`src/`)
+
+- **`lib.rs`** — Core types (`Icon`, `IconType`, `Category`, `WindowSize`, `WebviewArgs`), XDG path helpers (`database_path()`, `profiles_path()`, `icons_location()`), icon search/validation, URL validation
+- **`browser.rs`** — `Browser` struct: app configuration (URL, title, profile path, window size, decorations, private mode, mobile simulation). Serialized to/from RON
+- **`launcher.rs`** — `WebAppLauncher` struct: wraps `Browser` + name/icon/category. Uses `ashpd` (XDG Desktop Portal) `DynamicLauncher` to create/delete `.desktop` entries. Stores webapp data as `.ron` files in the database directory
+- **`localize.rs`** — i18n via `i18n-embed` with Fluent. Uses `fl!()` macro. Translation files: `i18n/{lang}/webapps.ftl`
+
+### GUI Application (`src/bin/dev-heppen-webapps/`)
+
+- **`pages/mod.rs`** — `QuickWebApps`: the `cosmic::Application` implementation. Manages nav bar (installed apps list), dialogs (icon picker, delete confirmation, icon downloader), theme system, and config subscription
+- **`pages/editor.rs`** — `AppEditor`: form for creating/editing a web app (title, URL, icon, category, window size, toggles for persistent profile/decorations/private mode/mobile simulation)
+- **`pages/iconpicker.rs`** — `IconPicker`: modal dialog for searching system icon packs (Papirus) or picking custom files
+- **`config.rs`** — `AppConfig` with CosmicConfig integration (persists theme choice)
+- **`themes.rs`** — Light/Dark built-in themes + custom RON theme import
+
+### Key Data Flow
+
+**Creating a web app:**
+1. User fills `AppEditor` form → generates unique `app_id` (title + random 4-digit suffix)
+2. `WebAppLauncher::create()` calls XDG DynamicLauncher portal to install a `.desktop` entry
+3. Launcher config saved as RON to `$XDG_DATA_HOME/dev.heppen.webapps/database/{app_id}.ron`
+
+**Launching a web app:**
+1. Desktop entry runs `dev.heppen.webapps.webview {app_id}`
+2. Webview binary loads `Browser::from_appid()` from the RON database
+3. Creates GTK window with WebKitGTK webview using stored settings
+
+### Data Storage (all XDG-compliant)
+
+| Path | Content |
+|------|---------|
+| `$XDG_DATA_HOME/dev.heppen.webapps/database/*.ron` | Webapp configs (RON format) |
+| `$XDG_DATA_HOME/dev.heppen.webapps/profiles/{app_id}/` | Per-app WebKitGTK browser data |
+| `$XDG_DATA_HOME/dev.heppen.webapps/icons/` | Cached icons |
+| `$XDG_DATA_HOME/dev.heppen.webapps/themes/` | Custom theme RON files |
+| `$XDG_CONFIG_HOME/cosmic/{version}/dev.heppen.webapps.ron` | App config (via CosmicConfig) |
+
+## i18n
+
+14 languages supported. English source: `i18n/en/webapps.ftl`. Add translations by creating `i18n/{lang_code}/webapps.ftl`. Strings are accessed via `fl!("key")` or `fl!("key", arg = value)`.
+
+## App ID
+
+The app ID `dev.heppen.webapps` is used throughout: Flatpak manifest, desktop entry, config paths, binary naming. It is defined as `APPID` in the justfile and `APP_ID` constant in `src/lib.rs`.
+
+## Key Dependencies
+
+- **libcosmic** (git dep from pop-os/libcosmic) — COSMIC app framework, provides `cosmic::Application` trait, widgets, nav bar, config system, theme engine
+- **wry** + **tao** + **gtk** — WebKitGTK webview creation and window management (webview binary only)
+- **ashpd** — XDG Desktop Portal client for DynamicLauncher (creating/removing `.desktop` entries)
+- **ron** — Rusty Object Notation for config serialization
+- **i18n-embed** + **i18n-embed-fl** — Compile-time embedded Fluent translations

Cargo.lock

@@ -74,6 +74,7 @@ icon-name-to-find=Icon name to find
 my-icons=My icons
 download=Download
 search=Search
+no-icons-found=No icons found. Try a different search term or upload a custom icon.
 
 # icons_installator.rs
 icons-installer-header=Please wait. Downloading icons...
@@ -89,3 +90,7 @@ warning=You don't meet requirements
     .app-url=  - You must provide valid URL starting with http:// or https://
     .app-icon=  - You must select an Icon for your launcher
     .app-browser=  - Please select a browser. Make sure at least one is installed system-wide or via Flatpak
+
+# toast notifications
+toast-app-saved=Web app saved successfully
+toast-app-deleted=Web app deleted

i18n/en/webapps.ftl

@@ -8,12 +8,21 @@ gh_repo="papirus-icon-theme"
 gh_desc="Papirus icon theme"
 
 : "${XDG_DATA_HOME:=$HOME/.local/share}"
-: "${EXTRA_THEMES=Papirus Papirus-Dark Papirus-Light}"
 : "${TAG:=master}"
 
-temp_file="$(mktemp -u)"
+EXTRA_THEMES="Papirus Papirus-Dark Papirus-Light"
+
+temp_file="$(mktemp)"
 temp_dir="$(mktemp -d)"
 
+cleanup() {
+    echo "Clearing cache ..."
+    rm -rf "$temp_file" "$temp_dir"
+    echo "Done!"
+}
+
+trap cleanup EXIT HUP INT TERM
+
 download() {
     echo "Getting the latest version from GitHub ..."
     wget -O "$temp_file" \
@@ -22,31 +31,21 @@ download() {
     tar -xzf "$temp_file" -C "$temp_dir"
 }
 
-
 install() {
-    # shellcheck disable=2068
-    set -- $@  # split args by space
+    dest="$1"
+    shift
 
     for theme in "$@"; do
         test -d "$temp_dir/$gh_repo-$TAG/$theme" || continue
         echo "Installing '$theme' ..."
-        cp -R "$temp_dir/$gh_repo-$TAG/$theme" $1
+        cp -R "$temp_dir/$gh_repo-$TAG/$theme" "$dest"
     done
 }
 
-cleanup() {
-    echo "Clearing cache ..."
-    rm -rf "$temp_file" "$temp_dir"
-    echo "Done!"
-}
-
-
 download
 
 install_path="$XDG_DATA_HOME/$APP_ID/icons"
 
-error_message=$(mkdir -p $install_path 2>&1)
+mkdir -p "$install_path"
 
-install $install_path $EXTRA_THEMES
-
-trap cleanup EXIT HUP INT TERM
+install "$install_path" $EXTRA_THEMES

resources/scripts/icon-installer.sh

@@ -188,12 +188,17 @@ impl AppEditor {
                 self.app_window_decorations = decorations;
             }
             Message::WindowWidth(width) => {
-                self.app_window_width = width;
-                self.app_window_size.0 = self.app_window_width.parse().unwrap_or_default();
+                // Only accept numeric input
+                let filtered: String = width.chars().filter(|c| c.is_ascii_digit() || *c == '.').collect();
+                self.app_window_width = filtered;
+                let parsed: f64 = self.app_window_width.parse().unwrap_or(webapps::DEFAULT_WINDOW_WIDTH);
+                self.app_window_size.0 = parsed.clamp(200.0, 8192.0);
             }
             Message::WindowHeight(height) => {
-                self.app_window_height = height;
-                self.app_window_size.1 = self.app_window_height.parse().unwrap_or_default();
+                let filtered: String = height.chars().filter(|c| c.is_ascii_digit() || *c == '.').collect();
+                self.app_window_height = filtered;
+                let parsed: f64 = self.app_window_height.parse().unwrap_or(webapps::DEFAULT_WINDOW_HEIGHT);
+                self.app_window_size.1 = parsed.clamp(200.0, 8192.0);
             }
         }
         Task::none()
@@ -274,7 +279,23 @@ impl AppEditor {
                     .class(style::Container::Card),
                 )
                 .push(widget::text_input(fl!("title"), &self.app_title).on_input(Message::Title))
+                .push_maybe(
+                    if !self.app_title.is_empty() && self.app_title.len() < 3 {
+                        Some(widget::text::caption(fl!("warning.app-name"))
+                            .class(style::Text::Accent))
+                    } else {
+                        None
+                    }
+                )
                 .push(widget::text_input(fl!("url"), &self.app_url).on_input(Message::Url))
+                .push_maybe(
+                    if !self.app_url.is_empty() && !webapps::url_valid(&self.app_url) {
+                        Some(widget::text::caption(fl!("warning.app-url"))
+                            .class(style::Text::Accent))
+                    } else {
+                        None
+                    }
+                )
                 .push(
                     widget::settings::section()
                         .add(widget::settings::item(

src/bin/dev-heppen-webapps/pages/editor.rs

@@ -23,6 +23,7 @@ pub enum Message {
 pub struct IconPicker {
     pub icon_searching: String,
     pub icons: Vec<webapps::Icon>,
+    pub has_searched: bool,
 }
 
 impl IconPicker {
@@ -36,7 +37,7 @@ impl IconPicker {
             Message::DownloadIconsPack => return task::message(pages::Message::DownloaderStarted),
             Message::OpenIconPickerDialog => {
                 return task::future(async move {
-                    let result = SelectedFiles::open_file()
+                    let response = match SelectedFiles::open_file()
                         .title("Open multiple images")
                         .accept_label("Open")
                         .modal(true)
@@ -45,10 +46,15 @@ impl IconPicker {
                         .filter(FileFilter::new("SVG Images").glob("*.svg"))
                         .send()
                         .await
-                        .unwrap()
-                        .response();
+                    {
+                        Ok(r) => r.response(),
+                        Err(e) => {
+                            tracing::error!("Failed to open file chooser: {e}");
+                            return pages::Message::None;
+                        }
+                    };
 
-                    if let Ok(result) = result {
+                    if let Ok(result) = response {
                         let files = result
                             .uris()
                             .iter()
@@ -63,6 +69,7 @@ impl IconPicker {
             }
             Message::IconSearch => {
                 self.icons.clear();
+                self.has_searched = true;
 
                 let name = self.icon_searching.clone().to_lowercase();
 
@@ -100,7 +107,7 @@ impl IconPicker {
             .on_submit(|_| Message::IconSearch);
         let button = widget::button::standard(fl!("open")).on_press(Message::OpenIconPickerDialog);
 
-        widget::column()
+        let mut col = widget::column()
             .spacing(30)
             .push(
                 widget::container(
@@ -118,15 +125,24 @@ impl IconPicker {
                         }),
                 )
                 .padding(8),
-            )
-            .push_maybe(if !icons.is_empty() {
-                Some(
-                    widget::container(widget::scrollable(widget::flex_row(icons)))
-                        .height(Length::FillPortion(1)),
+            );
+
+        if !icons.is_empty() {
+            col = col.push(
+                widget::container(widget::scrollable(widget::flex_row(icons)))
+                    .height(Length::FillPortion(1)),
+            );
+        } else if self.has_searched {
+            col = col.push(
+                widget::container(
+                    widget::text::body(fl!("no-icons-found"))
                 )
-            } else {
-                None
-            })
-            .into()
+                .padding(20)
+                .width(Length::Fill)
+                .align_x(cosmic::iced::Alignment::Center),
+            );
+        }
+
+        col.into()
     }
 }