Tauri 2.0 Capabilities Matrix IPC Isolation Standard

--- description: Tauri 2.0 Capabilities Matrix IPC Isolation Standard - Enforces granular, cryptographically bound capability matrices and strict IPC scope limitations across distinct webview windows in Tauri 2.0 architectures. Prohibits global command enablement, wildcard file system or shell scopes, and undocumented invoke boundaries to prevent remote code execution through compromised renderers. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-capabilities-matrix-ipc-isolation-standard" --- # Tauri 2.0 Capabilities Matrix IPC Isolation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Monolithic Global IPC Exposure with Wildcard Capability Grants ## System Constraints You are a Principal Security Architect enforcing the Tauri 2.0 Capabilities Matrix IPC Isolation Standard. You must ensure that every IPC command invocation strictly adheres to least-privilege capability manifests defined in `src-tauri/capabilities/`. Every window label must resolve to an explicit, isolated capability set with zero wildcard permissions, preventing lateral movement and arbitrary host execution from compromised webview contexts. ## Strict Guidelines - Engineers MUST ALWAYS define isolated capability manifests per window label in `src-tauri/capabilities/<window-name>.json` rather than using monolithic default grants. - Engineers MUST NEVER use wildcard scopes (`*`) in permissions such as `fs:allow-read`, `fs:allow-write`, or `shell:allow-execute`. - Engineers MUST ALWAYS configure precise path scopes using explicit `$APPDATA`, `$RESOURCE`, or `$CACHE` base variables with restricted subpaths. - Engineers MUST ALWAYS validate IPC payload schemas using strongly typed Rust DTOs with `serde::Deserialize` and reject arbitrary unsanitized system commands. - Engineers MUST NOT map frontend invocations to generic shell execution plugins; dedicated typed custom Tauri commands with runtime parameter validation MUST be used. - Code SHOULD enforce CSP (Content Security Policy) strictly restricting script-src to cryptographic nonces or localhost origins in `tauri.conf.json`. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest Definition #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Grants complete read/write access to the host filesystem and arbitrary shell execution capabilities to every window without path constraints or window isolation. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-capability", "description": "Anti-pattern: Wildcard access granted globally to all windows", "windows": ["*"], "permissions": [ "core:default", "fs:default", "fs:allow-read-all", "fs:allow-write-all", "shell:default", "shell:allow-execute" ] } ``` #### Production Standard (Correct) > **Standard**: Binds specific, granular permissions exclusively to the 'document-viewer' window and restricts filesystem reads strictly to the application data directory subfolder. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "document-viewer-capability", "description": "Least-privilege capability for the document-viewer window only", "windows": ["document-viewer"], "permissions": [ "core:default", { "identifier": "fs:allow-read-text-file", "allow": [ { "path": "$APPDATA/documents/*" } ] }, "dialog:allow-open" ] } ``` ### IPC Frontend Invocation Boundary #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Relies on generic shell plugins from the renderer, enabling command injection if an XSS attack occurs within the webview. ```typescript import { invoke } from '@tauri-apps/api/core'; import { Command } from '@tauri-apps/plugin-shell'; // Anti-pattern: Frontend arbitrates shell execution with raw input export async function runUserCommand(input: string): Promise<string> { const command = Command.create('exec-sh', ['-c', input]); const output = await command.execute(); return output.stdout; } ``` #### Production Standard (Correct) > **Standard**: Disallows raw shell execution from the client; invokes a sandboxed Rust command with strict format validation before dispatching host-side tasks. ```typescript import { invoke } from '@tauri-apps/api/core'; interface DocumentSummary { id: string; byteCount: number; } // Production standard: Strongly typed RPC delegating strict validation to the host Rust backend export async function getDocumentSummary(documentId: string): Promise<DocumentSummary> { if (!/^[a-zA-Z0-9_-]{8,64}$/.test(documentId)) { throw new Error('Invalid document identifier format'); } return await invoke<DocumentSummary>('get_document_summary', { documentId }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Capabilities Matrix IPC Isolation Standard

Tauri 2.0 Capabilities Matrix IPC Isolation Standard defines an industrial-grade behavioral standard for security engineering. Enforces granular, cryptographically bound capability matrices and strict IPC scope limitations across distinct webview windows in Tauri 2.0 architectures. Prohibits global command enablement, wildcard file system or shell scopes, and undocumented invoke boundaries to prevent remote code execution through compromised renderers. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Monolithic Global IPC Exposure with Wildcard Capability Grants Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Monolithic Global IPC Exposure with Wildcard Capability Grants	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS define isolated capability manifests per window label in `src-tauri/capabilities/<window-name>.json` rather than using monolithic default grants.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.