Codex/upstream pr audit 20260827 - #13

Reimplement upstream PR pichillilorenzo#2876 without hand-editing generated files. Add persistent storage kind 13 and a Windows-only fallback for future native permission values.

Port upstream PR pichillilorenzo#2768 and add regression coverage for all three internal WebView host HWNDs.

Reimplement upstream PR pichillilorenzo#2874 without exposing public Pictures or Movies directories. Add capture-directory failure handling and regression coverage.

Take only the proven syntax fix from upstream PR pichillilorenzo#2871. Avoid its unverified content-world, popup, and message-handler routing changes.

…ormance to 10.15+

Xcode 26 rejects the @available(macOS 10.15, *) witness on a type that
conforms to ASWebAuthenticationPresentationContextProviding (available
from 10.14) unconditionally:

  error: protocol 'ASWebAuthenticationPresentationContextProviding'
  requires 'presentationAnchor(for:)' to be available in macOS 10.14
  and newer

Move the conformance into a @available(macOS 10.15, *) extension so the
witness is available everywhere the conformance is, matching the
availability of ASWebAuthenticationSession itself. Verified with
swiftc -typecheck at -target x86_64-apple-macos10.14/10.15 on Xcode 26.4.

- add disableVerticalScroll and disableHorizontalScroll flags to InAppWebViewSettings to track user preferences
- implement SetScrollDelta logic in in_app_webview.cc to drop wheel/trackpad deltas for disabled axes
- serialize and deserialize new scroll settings through FlValue to keep them in sync with Flutter

`PRINT_JS_SOURCE()` ends with `window.print = function() {...}` without a
trailing semicolon. Since these plugin sources are concatenated in front of
user-provided source in
`WKUserContentController.generateCodeForScriptEvaluation` (joined with `\n`
only), and a line break does not trigger ASI when the next token can continue
the expression, any evaluated source that starts with `(` gets parsed as a
call on the assigned function:

    window.print = function() {...}(function () { ... })();

This immediately invokes the print handler (showing the native print UI) and
then throws `TypeError: ... is not a function`, so `evaluateJavascript`
resolves to `null` instead of the script's value.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Adapt upstream PR pichillilorenzo#2860 to restore only after keyboardDidHide. A generation guard prevents a stale hide notification from overwriting a rapid keyboard re-show.

Adapt upstream PR pichillilorenzo#2776 by bypassing content-world bootstrap for popup WebViews on iOS 14-17. Keep callAsyncJavaScript unchanged because its native content-world overload remains unsafe.

Reimplement upstream PR pichillilorenzo#2767 for the current Sources layout and protect the getter, initial setter, and runtime setter on affected macOS 11.x WebKit runtimes.

- Replace `new Long(String)` with `Long.parseLong(String)` in MyCookieManager.
- Replace `new Handler()` with `new Handler(Looper.getMainLooper())` in InAppWebView.
- Route previously-ungated `CookieManager.removeSessionCookie()` calls through a new `clearSessionCookies()` helper that uses `removeSessionCookies(null)` on API 21+ and falls back to the deprecated call only on pre-LOLLIPOP.
- Annotate methods that retain pre-LOLLIPOP `CookieSyncManager` / `CookieManager.removeAllCookie` / `removeSessionCookie` fallbacks with `@SuppressWarnings("deprecation")` to silence javac warnings without changing behavior on minSdk 19/20.

Refs pichillilorenzo#2641

…x Play Store warning

…e WebView background

…gement

- Introduced `PreferredColorScheme` enum with values LIGHT, DARK, and AUTO.
- Added `preferredColorScheme` property to `InAppWebViewSettings` for Windows platform.
- Implemented logic to set and retrieve the preferred color scheme using WebView2's ICoreWebView2Profile API.
- Updated CHANGELOG and documentation to reflect the new feature.

…tomPlatformView

…ng `disposeChannel()` in debug mode

A malicious file picker (a third-party app handling the implicit file
chooser intent) can return a file:// URI pointing into the host app's
own private data directory. The host can read that file (the picker
itself cannot), so its contents are handed to the web page. This
follows the Android platform guidance in WebChromeClient.FileChooserParams
to check the returned URIs in parseResult before invoking
filePathCallback.

- Only file:// URIs are rejected; legitimate content:// picks and the
  app's own FileProvider camera captures are unaffected.
- Primary anchor is the app's dataDir, with /data/ as defense-in-depth.
- getCanonicalPath() collapses ../ traversal.
- Covers single-file (parseResult), multi-file (ClipData), and legacy
  single-URI paths.

Refs CVE-2020-6563