CyberCoveLLC/Triple-C
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 47 Wiki Activity

docs(acl): threat model and conventions say app commands are ACL-gated

Browse Source 
Task 2 already closed the risk (build.rs declares a Tauri AppManifest and
gates every app command per window); this task brings the docs in line so
the threat model of record no longer claims app commands are ungated or
that any local window can call any app command.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
shadowdao
2026-09-22 22:38:32 -07:00
co-authored by Claude Opus 5.5
parent 1401369ffa
commit bc4980e014
6 changed files with 29 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/superpowers/specs/2026-09-22-terminal-file-viewer-design.md
+4 -2
View File
@@ -277,8 +277,10 @@ AppManifest spec, `2026-09-22-app-manifest-lockdown-design.md`).
for **the caller's own label**. No viewer command accepts a path or a label as an argument.
- Rendering: CodeMirror renders text as DOM text nodes; nothing uses `innerHTML` /
`dangerouslySetInnerHTML` on file content. CSP unchanged.
- Accepted residual risk (closed by the AppManifest follow-up): a compromised viewer window can
still invoke other app commands, because `build.rs` does not restrict app commands per window.
- Closed by the AppManifest follow-up (`2026-09-22-app-manifest-lockdown-design.md`, implemented):
`build.rs` now declares a Tauri `AppManifest` from `generate_handler!`, so a compromised viewer
window can invoke only the five `allow-viewer-*` app commands granted in
`capabilities/file-viewer.json`, not any other app command.
- Update CLAUDE.md (frontend/backend structure, Key Conventions note about the viewer window and
label-gated commands).