Task 2 already closed the risk (build.rs declares a Tauri AppManifest and
gates every app command per window); this task brings the docs in line so
the threat model of record no longer claims app commands are ungated or
that any local window can call any app command.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- write.rs: a save's new base is sha256 of the bytes written; the script's
post-mv hash comes back as disk_hash, and a mismatch (another writer landed
after us) shows "Changed on disk" instead of being adopted (ledger M2).
- write.rs: conflict:/gone:/read-only strings are constants with a pure
saved_file() mapping and tests; app/src/viewer/ipcMessages.ts is the one TS
copy and a cargo test checks it against the Rust originals.
- write.rs: the comment now says the in-place `cat >` fallback follows a
planted symlink, and why that is accepted (runs as claude).
- poll.rs: a file deleted between `test -f` and `sha256sum` reads as gone.
- viewerState/EditorPane: poll_failed carries its message; only the
"Start the project before" refusal reads as Container not running, anything
else gets its own banner and leaves Save enabled.
- EditorPane: a failed first read shows Retry and is retried by the poll.
- spec §1: refused OSC 8 targets keep the refusal card (Task 9 ruling).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- CLAUDE.md: document the viewer.html fallback trap (missing/broken Vite entry
silently serves index.html into the viewer window) and point at the Rust test
that pins it.
- Give the manual verification checklist a durable, tracked home: append it as
a markdown task list to the terminal-file-viewer design spec, including the
file-path hover key-hint wording check and the CRLF/BOM round-trip save check.
- default.json: state the app-command residual risk and the pending AppManifest
lockdown directly in the capability file's own description, not only in
CLAUDE.md, since this file is the reviewed threat model of record.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Review the approved design against tauri 2.11.0, xterm 5.5.0, Vite 6.4.1
and the tree: record the verified multi-window, capability, CSP and exec
facts, choose the save mechanism (stage in /tmp, swap in as the container
user), make polling a sha256sum exec, store realpath-resolved targets, and
pin the exact viewer capability set. Add the task-by-task plan with its
parallel groups and the verification commands that work here.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
shadowdaoandClaude Opus 5.5