Tauri 2.0 Fine-Grained IPC Capability Sandboxing Standard

--- description: Tauri 2.0 Fine-Grained IPC Capability Sandboxing Standard - Enforces fine-grained capability sets, window-level access control, and strictly typed command boundaries across mobile and desktop webviews in Tauri 2.0. Prohibits global wildcard permissions, unconstrained filesystem scopes, and raw untyped IPC invocations that expose host system APIs to remote code execution or privilege escalation. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri2-ipc-capability-sandboxing-standard" --- # Tauri 2.0 Fine-Grained IPC Capability Sandboxing Standard > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Assigning global default permissions and wildcards across mobile/desktop webviews without discrete scoped capability manifests ## System Constraints You are a Principal Engineer enforcing the Tauri 2.0 Fine-Grained IPC Capability Sandboxing Standard. Mandate explicit, least-privilege capability manifests in `src-tauri/capabilities/` and enforce strict structural schema validation on all IPC command boundaries across mobile (iOS/Android) and desktop runtimes. ## Strict Guidelines - Engineers MUST ALWAYS isolate permissions into modular capability files under `src-tauri/capabilities/` targeted exclusively to specific window or webview labels. - Engineers MUST NOT grant wildcard permissions (such as `fs:default`, `shell:all`, or unconstrained read/write scopes) in any capability configuration. - Code SHOULD validate IPC payloads symmetrically using compile-time Rust `serde::Deserialize` types on the backend and strict runtime validation (such as Zod) on the webview frontend. - Services MUST restrict filesystem capabilities to explicit path scopes using runtime variables (e.g., `$APPDATA`, `$APPCACHE`) rather than raw filesystem roots or relative directories. - Components NEVER invoke unverified host APIs directly via internal `window.__TAURI_INTERNALS__` or bypass capability permission manifests. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Targets all windows with '*' and grants expansive default permissions (`fs:default`, `shell:allow-open`) with zero path scoping, allowing compromised webviews to access arbitrary host files and execute commands. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "default-capability", "description": "Insecure wildcard permissions for all windows", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:allow-open" ] } ``` #### Production Standard (Correct) > **Standard**: Explicitly binds permissions to named window targets (`main`, `mobile-webview`) and restricts filesystem access strictly to the `$APPDATA/documents/*` scope. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-document-sync", "description": "Scoped document storage access for mobile views", "windows": ["main", "mobile-webview"], "permissions": [ "core:path:default", "core:event:allow-listen", { "identifier": "fs:allow-read-text-file", "allow": [{ "path": "$APPDATA/documents/*" }] }, { "identifier": "fs:allow-write-text-file", "allow": [{ "path": "$APPDATA/documents/*" }] } ] } ``` ### Strictly Typed Frontend IPC Invoke Contract #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Uses 'any' types and does not validate inputs before passing them across the IPC bridge, risking serialization panics or malicious payload injection. ```typescript import { invoke } from '@tauri-apps/api/core'; export async function saveDocument(filename: any, content: any): Promise<any> { // Anti-pattern: Untyped payload and unconstrained invocation return await invoke('save_document', { filename, content }); } ``` #### Production Standard (Correct) > **Standard**: Enforces runtime validation and regex constraints using Zod before serialization, guaranteeing that payloads match the backend Rust contract. ```typescript import { invoke } from '@tauri-apps/api/core'; import { z } from 'zod'; const DocumentPayloadSchema = z.object({ filename: z.string().regex(/^[a-zA-Z0-9_-]+\.json$/), content: z.string().max(1024 * 1024) }); type DocumentPayload = z.infer<typeof DocumentPayloadSchema>; export async function saveDocument(payload: DocumentPayload): Promise<{ success: boolean }> { const validated = DocumentPayloadSchema.parse(payload); return await invoke<{ success: boolean }>('save_document', { payload: validated }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Fine-Grained IPC Capability Sandboxing Standard

Tauri 2.0 Fine-Grained IPC Capability Sandboxing Standard defines an industrial-grade behavioral standard for mobile engineering. Enforces fine-grained capability sets, window-level access control, and strictly typed command boundaries across mobile and desktop webviews in Tauri 2.0. Prohibits global wildcard permissions, unconstrained filesystem scopes, and raw untyped IPC invocations that expose host system APIs to remote code execution or privilege escalation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Assigning global default permissions and wildcards across mobile/desktop webviews without discrete scoped capability manifests Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Assigning global default permissions and wildcards across mobile/desktop webviews without discrete scoped capability manifests	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate permissions into modular capability files under `src-tauri/capabilities/` targeted exclusively to specific window or webview labels.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.