Turn on Tauri's isolation pattern (app.security.pattern = isolation with an isolation/ entry that the CLI bundles), keep the CSP with no remote sources, and make capabilities/default.json the only capability, granting core:default and nothing else. Add a small test (a script in CI is fine) that fails if any capability entry lacks a description.
Acceptance
cargo tauri dev runs with isolation active (the IPC payloads are encrypted in the devtools network tab). A capability file with an undescribed permission fails CI.
Depends on
Nothing; first child of the epic.
Parent: #1
## Scope
Turn on Tauri's isolation pattern (`app.security.pattern = isolation` with an `isolation/` entry that the CLI bundles), keep the CSP with no remote sources, and make `capabilities/default.json` the only capability, granting `core:default` and nothing else. Add a small test (a script in CI is fine) that fails if any capability entry lacks a `description`.
## Acceptance
`cargo tauri dev` runs with isolation active (the IPC payloads are encrypted in the devtools network tab). A capability file with an undescribed permission fails CI.
## Depends on
Nothing; first child of the epic.
grenade
added the child label 2026-09-15 12:38:51 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Parent: #1
Scope
Turn on Tauri's isolation pattern (
app.security.pattern = isolationwith anisolation/entry that the CLI bundles), keep the CSP with no remote sources, and makecapabilities/default.jsonthe only capability, grantingcore:defaultand nothing else. Add a small test (a script in CI is fine) that fails if any capability entry lacks adescription.Acceptance
cargo tauri devruns with isolation active (the IPC payloads are encrypted in the devtools network tab). A capability file with an undescribed permission fails CI.Depends on
Nothing; first child of the epic.