Restrict Tauri command boundaries by tsouth89 · Pull Request #26 · tsouth89/ceiling

tsouth89 · 2026-07-16T00:54:24Z

Summary

enable the Tauri application-command ACL and split capabilities for main/settings, floatbar, and flyout windows
limit auxiliary windows to usage reads and narrow surface controls; explicitly exclude credential, quit, proof, path, and updater-apply commands
canonicalize open_path targets and allow only Ceiling config roots or backend-discovered credential/tool paths
skip updater work in auxiliary webviews and remove redundant broad settings mutation from the floatbar

Validation

cargo test --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml (364 passed)
cargo clippy --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml --all-targets -- -D warnings
pnpm test (219 passed)
pnpm build
ACL inventory check: 91 registered commands, 91 main-window allow entries

Linear: SOU-153

Stacked on #25, which is stacked on #24.

Summary by CodeRabbit

Security
- Tightened file opening to approved credential/config and app locations via canonical allowlisting.
- Improved Windows path handling to prevent access via system directories or extended-length prefixes.
New Features
- Added dedicated capability configurations and permission command groups for FloatBar and Flyout.
- Updated main capability scope/permissions to align with the new command sets.
Bug Fixes
- Reduced unnecessary background work and listeners in auxiliary windows (FloatBar/Flyout).
- Updated FloatBar actions to use dedicated controls for click-through and hide.
Internal Improvements
- Enhanced Windows-focused permission/path validation tests and error messaging.

cloudflare-workers-and-pages · 2026-07-16T00:54:29Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	ceiling	`29a158f`	Commit Preview URL Branch Preview URL	Jul 16 2026, 02:16 AM

coderabbitai · 2026-07-16T00:54:31Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 72d6fc1a-2772-4532-b64c-cfb501cc579e

📥 Commits

Reviewing files that changed from the base of the PR and between 8f26e25bc2aebcfbe875e623f7bcc9ab32f2edfb and 29a158f.

📒 Files selected for processing (10)

apps/desktop-tauri/src-tauri/build.rs
apps/desktop-tauri/src-tauri/capabilities/floatbar.json
apps/desktop-tauri/src-tauri/capabilities/flyout.json
apps/desktop-tauri/src-tauri/capabilities/main.json
apps/desktop-tauri/src-tauri/permissions/commands.toml
apps/desktop-tauri/src-tauri/src/commands/credential_detection.rs
apps/desktop-tauri/src-tauri/src/commands/system.rs
apps/desktop-tauri/src-tauri/src/commands/tests.rs
apps/desktop-tauri/src/App.tsx
apps/desktop-tauri/src/floatbar/FloatBar.tsx

💤 Files with no reviewable changes (1)

apps/desktop-tauri/src/floatbar/FloatBar.tsx

🚧 Files skipped from review as they are similar to previous changes (9)

apps/desktop-tauri/src-tauri/capabilities/floatbar.json
apps/desktop-tauri/src-tauri/capabilities/flyout.json
apps/desktop-tauri/src-tauri/build.rs
apps/desktop-tauri/src-tauri/src/commands/credential_detection.rs
apps/desktop-tauri/src/App.tsx
apps/desktop-tauri/src-tauri/capabilities/main.json
apps/desktop-tauri/src-tauri/src/commands/system.rs
apps/desktop-tauri/src-tauri/permissions/commands.toml
apps/desktop-tauri/src-tauri/src/commands/tests.rs

📝 Walkthrough

Walkthrough

Tauri capabilities now use separate command scopes for main, floatbar, and flyout windows. Path opening is canonicalized and allowlisted. Auxiliary windows skip selected background effects, and floatbar actions use dedicated commands.

Changes

Tauri hardening

Layer / File(s)	Summary
Window capability and command scopes `apps/desktop-tauri/src-tauri/build.rs`, `apps/desktop-tauri/src-tauri/permissions/commands.toml`, `apps/desktop-tauri/src-tauri/capabilities/*.json`, `apps/desktop-tauri/src-tauri/src/commands/tests.rs`	Tauri build manifest handling and per-window command allowlists were added, with tests confirming sensitive commands are excluded from auxiliary windows.
Credential path allowlisting `apps/desktop-tauri/src-tauri/src/commands/credential_detection.rs`, `apps/desktop-tauri/src-tauri/src/commands/system.rs`, `apps/desktop-tauri/src-tauri/src/commands/tests.rs`	Credential-related paths are collected, canonicalized paths are checked against allowed roots or exact paths, and Windows path rejection is tested.
Auxiliary window runtime behavior `apps/desktop-tauri/src/App.tsx`, `apps/desktop-tauri/src/floatbar/FloatBar.tsx`	Floatbar and flyout windows skip update and shortcut background work, while floatbar controls call dedicated click-through and hide commands.

Estimated code review effort: 3 (Moderate) | ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main change: tightening Tauri command access and capability boundaries.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/tauri-ipc-boundaries

_{Comment @coderabbitai help to get the list of available commands.}

tsouth89 · 2026-07-16T01:09:33Z

@coderabbitai review

coderabbitai · 2026-07-16T01:09:39Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/desktop-tauri/src-tauri/src/commands/system.rs`:
- Around line 89-113: Keep the canonical path for allowlist validation in the
existing path-opening command, but normalize the computed target before spawning
the opener so Windows extended-length prefixes such as \\?\ are removed while
valid UNC paths remain usable. Apply this conversion to the target produced by
the file/directory branching, without changing the existing allowed-path checks
or selection behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d4bc1a94-a770-4d2b-85d4-46727e0a4dc7

📥 Commits

Reviewing files that changed from the base of the PR and between 5c6879cd4c3e1a89941a824a9475abf3c092073c and 7dce4d14cfdd2ff9d094bb6c71dbc0e2e0488cd1.

📒 Files selected for processing (10)

apps/desktop-tauri/src-tauri/build.rs
apps/desktop-tauri/src-tauri/capabilities/floatbar.json
apps/desktop-tauri/src-tauri/capabilities/flyout.json
apps/desktop-tauri/src-tauri/capabilities/main.json
apps/desktop-tauri/src-tauri/permissions/commands.toml
apps/desktop-tauri/src-tauri/src/commands/credential_detection.rs
apps/desktop-tauri/src-tauri/src/commands/system.rs
apps/desktop-tauri/src-tauri/src/commands/tests.rs
apps/desktop-tauri/src/App.tsx
apps/desktop-tauri/src/floatbar/FloatBar.tsx

💤 Files with no reviewable changes (1)

apps/desktop-tauri/src/floatbar/FloatBar.tsx

tsouth89 · 2026-07-16T01:36:06Z

@coderabbitai review

coderabbitai · 2026-07-16T01:36:11Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Promote the 0.43.3 line from beta to stable now that the Jul 2026 security hardening (SOU-148) has fully merged to main. ## Version - Bump 0.43.3-beta.2 -> 0.43.3 across rust/Cargo.toml, desktop Cargo.toml, tauri.conf.json, package.json, Cargo.lock, and version.env (BUILD_NUMBER 89 -> 90). - Add the 0.43.3 CHANGELOG entry. ## What is in this release since beta.2 Four merged security PRs (all reviewed by CodeRabbit + Sol, CI green on main): - #24 Harden Windows local access controls (SOU-149, SOU-150) - #25 Harden credential storage hygiene (SOU-151, SOU-159) - #26 Restrict Tauri command boundaries (SOU-153) - #27 serde_with security patch (SOU-193, GHSA-7gcf-g7xr-8hxj) ## Release After merge, tag v0.43.3 on main to trigger the signed Windows build, which drafts the GitHub release.  ## Summary by CodeRabbit * **Security** * Strengthened protection for secrets and stored credentials with user-scoped encryption and access controls. * Removed plaintext cookie caches and ensured temporary cookie data is cleaned up on exit. * Restricted status communication, window commands, and folder access to authorized application contexts. * **Release** * Promoted the application to version 0.43.3. * Updated the build number to 90.  Co-authored-by: tsouth89 <tsouth89@users.noreply.github.com>

tsouth89 marked this pull request as ready for review July 16, 2026 00:55

coderabbitai Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread apps/desktop-tauri/src-tauri/src/commands/system.rs

tsouth89 force-pushed the codex/credential-hygiene branch from aeffaa3 to 215f191 Compare July 16, 2026 02:10

Base automatically changed from codex/credential-hygiene to main July 16, 2026 02:15

tsouth89 added 2 commits July 15, 2026 22:16

Restrict Tauri command boundaries

882c4b2

Normalize Windows shell paths

29a158f

tsouth89 force-pushed the codex/tauri-ipc-boundaries branch from 8f26e25 to 29a158f Compare July 16, 2026 02:16

tsouth89 merged commit b4867b0 into main Jul 16, 2026
6 checks passed

tsouth89 deleted the codex/tauri-ipc-boundaries branch July 16, 2026 02:21

tsouth89 mentioned this pull request Jul 16, 2026

Prepare Ceiling 0.43.3 release #28

Merged

This was referenced Aug 12, 2026

Surface the taskbar widget's hidden state in Settings #264

Merged

Add active and active-plus-critical floatbar modes #296

Merged

Navigation Menu

Restrict Tauri command boundaries - #26

Restrict Tauri command boundaries#26
tsouth89 merged 2 commits into
mainfrom
codex/tauri-ipc-boundaries

tsouth89 commented Jul 16, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 16, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

tsouth89 commented Jul 16, 2026

Uh oh!

coderabbitai Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

tsouth89 commented Jul 16, 2026

Uh oh!

coderabbitai Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

tsouth89 commented Jul 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Summary by CodeRabbit

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

coderabbitai Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

tsouth89 commented Jul 16, 2026

Uh oh!

coderabbitai Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tsouth89 commented Jul 16, 2026

Uh oh!

coderabbitai Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

tsouth89 commented Jul 16, 2026 •

edited by coderabbitai Bot

Loading

cloudflare-workers-and-pages Bot commented Jul 16, 2026 •

edited

Loading

coderabbitai Bot commented Jul 16, 2026 •

edited

Loading

coderabbitai Bot commented Jul 16, 2026 •

edited

Loading

coderabbitai Bot commented Jul 16, 2026 •

edited

Loading