Capacitor 7 Native Bridge Background Thread & WebView Sandbox Standard

--- description: Capacitor 7 Native Bridge Background Thread & WebView Sandbox Standard - Enforces asynchronous background thread execution for native bridge invocations and implements strict WebView origin sandboxing in Capacitor 7. Eliminates main UI thread starvation during bridge roundtrips and prevents arbitrary JavaScript execution from unauthorized origins. globs: capacitor.config.ts, src/**/*.{ts,tsx}, ios/App/**/*.swift, android/app/**/*.kt alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/capacitor-7-native-bridge-thread-sandbox-standard" --- # Capacitor 7 Native Bridge Background Thread & WebView Sandbox Standard > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Executing Synchronous Native Bridge Calls on the Main UI Queue with Permissive WebView Navigation ## System Constraints You are a Principal Mobile Architect enforcing the Capacitor 7 Native Bridge Background Thread and WebView Sandbox Standard. You must reject any native plugin or bridge client implementation that blocks the UI thread, leaks background operations into the main dispatch queue, or enables open WebView navigation without strict origin validation. ## Strict Guidelines - Engineers MUST ALWAYS isolate native plugin logic into background dispatch queues (e.g., DispatchQueue.global() in Swift or Dispatchers.IO in Kotlin) before returning results to the Capacitor bridge. - Engineers MUST NOT invoke intensive I/O, crypto, or file processing directly within the main UI thread of either the native layer or the WebView runtime. - Code SHOULD configure `capacitor.config.ts` with explicit `server.allowNavigation` domains and enforce `androidScheme: 'https'` to prevent arbitrary protocol hijacking and insecure mixed-content execution. - Services MUST wrap bridge callbacks inside structured promises and apply timeouts with abort signals to prevent unresolved native tasks from hanging the JavaScript event loop. - Components NEVER execute raw `evaluateJavaScript` calls with unsanitized cross-origin data; all inter-context messaging must use typed, serialized Capacitor plugin methods. ## Bad vs Good Implementations ### Configuring Sandbox Rules and Asynchronous Background Bridge Invocation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Configuring wildcard allowNavigation allows external malicious domains to access Capacitor's native bridge context. Additionally, calling long-running native plugins without timeout safeguards or origin validation risks indefinite UI freezes if the native implementation defaults to the main thread. ```typescript import { CapacitorConfig } from '@capacitor/cli'; import { registerPlugin } from '@capacitor/core'; // ANTI-PATTERN: Wildcard navigation and unconstrained bridge invocation const config: CapacitorConfig = { appId: 'com.example.app', appName: 'VulnerableApp', webDir: 'dist', server: { // Allows untrusted third-party hosts to hijack bridge APIs allowNavigation: ['*'], cleartext: true, }, }; interface CustomBridgePlugin { processHeavyPayload(options: { data: string }): Promise<{ result: string }>; } const CustomBridge = registerPlugin<CustomBridgePlugin>('CustomBridge'); export async function runPluginTask(rawData: string) { // Synchronous call pattern without error handling, cancellation, or frame yield const res = await CustomBridge.processHeavyPayload({ data: rawData }); return res.result; } export default config; ``` #### Production Standard (Correct) > **Standard**: Explicitly binds the WebView to an HTTPS/capacitor scheme and strictly white-lists navigation domains. Bridge calls are wrapped with deterministic timeouts and AbortSignal handling to prevent orphaned native tasks from locking the JavaScript runtime. ```typescript import { CapacitorConfig } from '@capacitor/cli'; import { registerPlugin } from '@capacitor/core'; // SECURE: Enforce strict origin sandboxing and HTTPS native bridge transport const config: CapacitorConfig = { appId: 'com.example.app', appName: 'HardenedApp', webDir: 'dist', server: { androidScheme: 'https', iosScheme: 'capacitor', hostname: 'localhost', // Restrict navigation explicitly to trusted origins allowNavigation: ['auth.trusted-domain.com'], cleartext: false, }, plugins: { CapacitorCookies: { enabled: true }, }, }; interface CustomBridgePlugin { processHeavyPayload(options: { data: string }): Promise<{ result: string }>; } const CustomBridge = registerPlugin<CustomBridgePlugin>('CustomBridge'); export async function runPluginTask(rawData: string, signal?: AbortSignal): Promise<string> { const timeoutMs = 8000; const timeoutPromise = new Promise<never>((_, reject) => { const timer = setTimeout(() => { reject(new Error(`Bridge timeout: processHeavyPayload exceeded ${timeoutMs}ms`)); }, timeoutMs); signal?.addEventListener('abort', () => { clearTimeout(timer); reject(new DOMException('Bridge call aborted by client', 'AbortError')); }); }); // Non-blocking bridge execution guarded against thread stalls const response = await Promise.race([ CustomBridge.processHeavyPayload({ data: rawData }), timeoutPromise, ]); return response.result; } export default config; ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Capacitor 7 Native Bridge Background Thread & WebView Sandbox Standard

Capacitor 7 Native Bridge Background Thread & WebView Sandbox Standard defines an industrial-grade behavioral standard for mobile engineering. Enforces asynchronous background thread execution for native bridge invocations and implements strict WebView origin sandboxing in Capacitor 7. Eliminates main UI thread starvation during bridge roundtrips and prevents arbitrary JavaScript execution from unauthorized origins. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Executing Synchronous Native Bridge Calls on the Main UI Queue with Permissive WebView Navigation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Executing Synchronous Native Bridge Calls on the Main UI Queue with Permissive WebView Navigation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate native plugin logic into background dispatch queues (e.g., DispatchQueue.global() in Swift or Dispatchers.IO in Kotlin) before returning results to the Capacitor bridge.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.