The IPC isolation pattern is on from the first command: every message from
the main window passes through the sandboxed isolation application and is
encrypted before Rust sees it, so a script injected into the webview can read
what the UI shows but cannot forge a command. The hook passes everything
through today; the point of shipping it now is that every later command is
born inside the boundary. Both `tauri` and `tauri-build` need the `isolation`
feature, and the build script refuses to proceed if either lacks it.
Capabilities are TOML rather than JSON so each permission can carry the
reason it exists on the line above it. `tests/capabilities.rs` makes that
comment mandatory, requires a real description on every capability, and
refuses to grant anything to a window other than `main`. A capability is the
one place a plugin's reach into the system is widened, and it should not be
possible to widen it quietly.
Closes#11
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW
grenadeandClaude Fable 5.1
c9b623c438