Tauri 2.0 Mobile IPC Scoped Plugin Capability & Native Boundary Standard

--- description: Tauri 2.0 Mobile IPC Scoped Plugin Capability & Native Boundary Standard - Mandates declarative capability manifests in src-tauri/capabilities/*.json with fine-grained scoping instead of wildcard permissions across iOS and Android builds. Enforces bidirectional Zod runtime schema validation on the WebView IPC bridge before invoking native Rust commands, combined with strict Serde bounds checking and path sandboxing in native command implementations. globs: src-tauri/capabilities/**/*.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-scoped-plugin-capability-boundary" --- # Tauri 2.0 Mobile IPC Scoped Plugin Capability & Native Boundary Standard > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Executing untyped invoke calls with wildcard capability grants and unbounded native mobile filesystem access ## System Constraints You are a Principal Security Architect enforcing the Tauri 2.0 IPC Scoped Plugin Capability Boundary Standard. Mandate that every IPC call across the mobile WebView bridge uses strongly typed payload contracts with client-side Zod validation, platform-specific capability declarations, and scoped Rust command permissions. Reject any wildcard capability file or unbounded path access. ## Strict Guidelines - Engineers MUST ALWAYS declare isolated mobile capability manifests in src-tauri/capabilities/ with explicit platforms (["android", "ios"]) and exact permission lists instead of default core wildcards. - Engineers MUST ALWAYS validate IPC arguments with Zod or ArkType on the frontend before dispatching via @tauri-apps/api/core invoke to prevent malicious or malformed JSON-RPC frames. - Engineers MUST NOT grant global permissions (such as fs:default, shell:default, or http:default) across mobile deployment targets; all mobile permissions MUST specify granular scopes (e.g., app-specific cache or document paths). - Services MUST implement native Rust commands using serde::Deserialize structs with strict type annotations, rejecting std::collections::HashMap<String, serde_json::Value> or raw JSON-RPC string payloads. - Components NEVER invoke Tauri commands directly in UI components; all bridge interactions MUST be wrapped in a strongly typed API boundary module that guarantees invariant validation and error propagation. ## Bad vs Good Implementations ### Unvalidated IPC and Wildcard Capability vs. Scoped Capability & Validated Bridge #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Directly invokes a native command without payload schema validation, accepting arbitrary user input that can result in path traversal on mobile devices. Relies on implicit global capabilities without sandboxing. ```typescript import { invoke } from '@tauri-apps/api/core'; // ANTI-PATTERN: Direct untyped invocation passing unvalidated inputs to arbitrary native operations export async function saveMobileUserData(payload: any) { return await invoke('save_user_file', { path: payload.targetPath, data: payload.rawContent }); } ``` #### Production Standard (Correct) > **Standard**: Enforces strict input validation with a restrictive regex preventing path traversal before crossing the IPC bridge. Targets an explicitly scoped plugin command designed for mobile runtime sandboxing. ```typescript import { invoke } from '@tauri-apps/api/core'; import { z } from 'zod'; const SafeFilePayloadSchema = z.object({ filename: z.string().regex(/^[a-zA-Z0-9_-]+\.json$/, 'Invalid filename format'), data: z.record(z.unknown()) }); type SafeFilePayload = z.infer<typeof SafeFilePayloadSchema>; export async function saveMobileUserData(rawPayload: unknown): Promise<{ success: boolean; path: string }> { const validated = SafeFilePayloadSchema.parse(rawPayload); return await invoke<{ success: boolean; path: string }>('plugin:mobile-storage|save_scoped_data', { payload: validated }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Mobile IPC Scoped Plugin Capability & Native Boundary Standard

Tauri 2.0 Mobile IPC Scoped Plugin Capability & Native Boundary Standard defines an industrial-grade behavioral standard for mobile engineering. Mandates declarative capability manifests in src-tauri/capabilities/*.json with fine-grained scoping instead of wildcard permissions across iOS and Android builds. Enforces bidirectional Zod runtime schema validation on the WebView IPC bridge before invoking native Rust commands, combined with strict Serde bounds checking and path sandboxing in native command implementations. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Executing untyped invoke calls with wildcard capability grants and unbounded native mobile filesystem access Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Executing untyped invoke calls with wildcard capability grants and unbounded native mobile filesystem access	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS declare isolated mobile capability manifests in src-tauri/capabilities/ with explicit platforms (["android", "ios"]) and exact permission lists instead of default core wildcards.

Engineers MUST ALWAYS declare isolated mobile capability manifests in src-tauri/capabilities/ with explicit platforms (["android", "ios"]) and exact permission lists instead of default core wildcards.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.