SemianiakaVY/openpencil
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity
openpencil/desktop/AGENTS.md
Danila Poyarkov bd7acd6e34
fix(desktop): pin every command line the app may start (#922) 
* fix(desktop): pin every command line the app may start

On Windows the app starts npm-installed CLIs through cmd /c, and the shell scope let cmd take any arguments, so any code running in the webview could run any command. Each program now has a scope entry with its exact arguments, and Windows shims go through their own cmd-<name> entries with fixed /c <name> arguments. The agents and the MCP server no longer accept arbitrary arguments either. A test checks that every command the app starts has a matching entry on both platforms.

* test(desktop): expect Windows shims through their own scope entries

* test(desktop): check the executable of each shell scope entry

* test(desktop): allow no shell scope entry beyond the programs the app starts

An extra entry with a permissive validator passed the per-program checks.
2026-10-06 11:19:05 +00:00

1.8 KiB
Raw Blame History

Desktop (Tauri v2)

Check desktop/Cargo.toml, desktop/capabilities/**, and desktop/tauri.conf.json before adding desktop capabilities. Release versions are also set in desktop/tauri.conf.json and desktop/Cargo.toml (tools/AGENTS.md, Releases).

  • File system and shell permissions must be configured explicitly; a vague "Internal error" save failure usually means a missing permission.
  • Dev tools: add or use a menu item to toggle them; do not rely on keyboard shortcuts.
  • desktop/src/credentials.rs stores secrets in the native system credential store; failures must surface, never fall back to browser or plaintext storage (src/AGENTS.md, Settings).
  • ACP and harness process changes require checking desktop/capabilities/**.
  • A shell:allow-spawn entry pins the whole command line: no "args": true, and a Windows .cmd shim runs through its own cmd-<name> entry with fixed /c <name> … arguments, which resolvePlatformCommand selects (tests/engine/tauri/command.test.ts).
  • desktop/generated/menu.json is produced by bun run generate:tauri-menu from src/app/shell/menu/schema.ts; do not edit or import it directly.
  • Run bun run generate:icons --target desktop before direct Cargo checks; native icons are generated, not committed.
  • build_fig_file performs .fig export on desktop; the browser path uses fflate (packages/fig/AGENTS.md).
  • The embedded WebDriver plugin compiles only with the native-test Cargo feature and must never be enabled in development or production binaries. Native tests use bun run test:native (tests/AGENTS.md).
  • openpencil:// links are parsed in desktop/src/deep_link.rs: open queues files through take_pending_open, join queues validated room IDs through take_pending_rooms; second launches forward their link arguments through the single-instance handler (deep_link unit tests).