Tauri 2.0 Capability-Based IPC Sandboxing and Origin Isolation Standard

--- description: Tauri 2.0 Capability-Based IPC Sandboxing and Origin Isolation Standard - Enforces Tauri 2.0 capability-driven permission manifests, explicit webview origin boundaries, and least-privilege IPC command access across mobile and desktop runtimes. Eliminates arbitrary native code execution and lateral privilege escalation by isolating webview contexts and strictly forbidding wildcard plugin permissions. Mandates cryptographic origin validation, granular capability scoping, and deterministic payload schema validation between the frontend and native Rust handlers. globs: src-tauri/capabilities/**/*.json, src-tauri/capabilities/**/*.toml, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri2-capability-ipc-sandboxing-origin-isolation-standard" --- # Tauri 2.0 Capability-Based IPC Sandboxing and Origin Isolation Standard > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Exposing Wildcard Plugin Capabilities and Permitting Remote or Untrusted Webviews to Invoke Native System APIs ## System Constraints You are a Principal Software Architect enforcing the Tauri 2.0 Capability-Based IPC Sandboxing & Origin Isolation Standard. You must reject any configuration that uses broad or wildcard capabilities, disables origin validation, passes unvalidated dynamic strings to native invoke bindings, or exposes critical system plugins without scoped filesystem and network boundaries. ## Strict Guidelines - Engineers MUST ALWAYS isolate permissions into modular capability files under `src-tauri/capabilities/` and scope each capability to explicit window and webview labels. - Engineers MUST NOT grant blanket permissions such as `fs:default`, `shell:allow-all`, or `http:default` without restricting target directories, allowed URLs, or execution arguments. - Engineers MUST NEVER expose native IPC commands or capabilities to remote URLs (`remote: { urls: [...] }`) unless the origin is strictly HTTPS-pinned and verified via a secure Content Security Policy (CSP). - Frontend code MUST ALWAYS invoke native commands through strongly typed wrapper functions using `@tauri-apps/api/core` with compile-time validated parameter schemas; dynamic command dispatch (`invoke(userInput)`) is strictly prohibited. - Rust command implementations MUST validate and sanitize all deserialized IPC arguments against boundary conditions and filesystem traversal attacks before executing OS-level primitives. - Mobile builds (iOS and Android) MUST define distinct capability files targeting platform-specific window identifiers and disabling unused desktop capabilities like shell execution. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest: Wildcard vs Granular Scoped Permissions #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using wildcard windows ['*'] and unbounded default capabilities allows any webview context, including external links or XSS-vulnerable windows, to execute arbitrary shell commands, access the entire filesystem, and issue network requests. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "default-capability", "description": "Insecure blanket capability granting full access to all windows", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:default", "http:default" ] } ``` #### Production Standard (Correct) > **Standard**: Restricts capability execution exclusively to the authenticated 'main' window, limits filesystem access strictly to the application's cache directory via path scoping, and limits outbound HTTP requests to an explicitly approved API origin. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-secure-storage-capability", "description": "Scoped capability for secure mobile cache and isolated file reads", "windows": ["main"], "permissions": [ "core:default", { "identifier": "fs:allow-read-text-file", "allow": [ { "path": "$APPDATA/cache/**" } ] }, { "identifier": "http:default", "allow": [ { "url": "https://api.production.internal/**" } ] } ] } ``` ### Frontend IPC Invocation: Unchecked Dynamic Invocation vs Type-Safe Guarded Invocation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Dynamic command routing enables untrusted callers or compromised dependencies to execute arbitrary native Tauri commands by passing malicious command strings and unvalidated parameters. ```typescript import { invoke } from '@tauri-apps/api/core'; // ANTI-PATTERN: Dynamically evaluating command name and payload from unverified input export async function executeNativeAction(commandName: string, payload: Record<string, unknown>): Promise<unknown> { return await invoke(commandName, payload); } ``` #### Production Standard (Correct) > **Standard**: Enforces an explicit static command identifier, validates inputs with strict structural checks to prevent traversal attacks, and ensures compile-time type safety for both request parameters and response values. ```typescript import { invoke } from '@tauri-apps/api/core'; interface SecureWritePayload { readonly filename: string; readonly content: string; } interface WriteResult { readonly bytesWritten: number; } const FILENAME_REGEX = /^[a-zA-Z0-9_-]+\.json$/; export async function writeEncryptedCache( payload: SecureWritePayload ): Promise<WriteResult> { if (!FILENAME_REGEX.test(payload.filename)) { throw new Error('Invalid filename format: path traversal detected or disallowed extension'); } return await invoke<WriteResult>('write_encrypted_cache', { payload: { filename: payload.filename, content: payload.content } }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Capability-Based IPC Sandboxing and Origin Isolation Standard

Tauri 2.0 Capability-Based IPC Sandboxing and Origin Isolation Standard defines an industrial-grade behavioral standard for mobile engineering. Enforces Tauri 2.0 capability-driven permission manifests, explicit webview origin boundaries, and least-privilege IPC command access across mobile and desktop runtimes. Eliminates arbitrary native code execution and lateral privilege escalation by isolating webview contexts and strictly forbidding wildcard plugin permissions. Mandates cryptographic origin validation, granular capability scoping, and deterministic payload schema validation between the frontend and native Rust handlers. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Exposing Wildcard Plugin Capabilities and Permitting Remote or Untrusted Webviews to Invoke Native System APIs Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Exposing Wildcard Plugin Capabilities and Permitting Remote or Untrusted Webviews to Invoke Native System APIs	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate permissions into modular capability files under `src-tauri/capabilities/` and scope each capability to explicit window and webview labels.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.