CLAUDE.md

@@ -176,8 +176,14 @@ docker exec stdout → tokio task → emit("terminal-output-{sessionId}") → li
   polling by `sha256sum`, saves staged in `/tmp` and swapped in by a `sh` script as the container
   user (spec §5 says why the archive API never writes to the target directory). Commands take
   `window: tauri::Window`, gate on the label and act on the caller's own registry entry — no
-  viewer command accepts a path. The residual risk that any local window can call any app command
-  is deliberate and documented; the AppManifest lockdown spec closes it.
+  viewer command accepts a path. Which window may *call* each command is the ACL's job: the
+  `file-viewer-*` capability grants exactly the five `viewer_*` commands (see `build.rs`).
+- **`build.rs` + `src/command_census.rs`** — the build declares a Tauri `AppManifest` from the
+  `generate_handler!` list and refuses to build unless every command has exactly one bare
+  `allow-*` grant in the capability file its name says it belongs to. The parser and rules are
+  in `command_census.rs`, compiled into both the build script and the test build, so they are
+  unit-tested; `the_generated_app_manifest_matches_the_handler_list` reads back what tauri
+  embedded. Design: `docs/superpowers/specs/2026-09-22-app-manifest-lockdown-design.md`.
 - **`auth_bridge/`** — Host-side loopback bridge so browser logins run *inside* a container can
   complete against the host browser. Discovers listeners by parsing `/proc/net/tcp{,6}` (the image
   has no `ss`/`netstat`/`lsof`), binds host `127.0.0.1` **only**, and tunnels in over the Docker
@@ -595,9 +601,16 @@ Anthropic and Bedrock deliberately keep Claude Code's own defaults.
 
 - Frontend types in `lib/types.ts` must stay in sync with Rust structs in `models/`
 - Tauri commands are registered in `lib.rs` via `.invoke_handler(tauri::generate_handler![...])`
-- `capabilities/default.json` grants permissions for **plugin** commands only (`core:`, `dialog:`,
-  `store:`, `opener:`). Application commands registered through `generate_handler!` do **not**
-  need an entry there — adding one is not required and none exists for any app command.
+- **A new command needs three things:** `#[tauri::command]`, a `generate_handler!` entry in
+  `lib.rs`, and a bare `allow-<name-with-dashes>` entry in the one capability file for the
+  window that calls it — `viewer_*` commands in `capabilities/file-viewer.json`, everything else
+  in `capabilities/default.json`. `build.rs` declares a Tauri `AppManifest` from the handler list
+  (without one, tauri 2.11 does not apply the ACL to app commands at all) and fails `cargo
+  check`/`tauri build` on a missing, misspelled, duplicated or misfiled grant, a `deny-*`, or a
+  hand-written file under `permissions/`. `src/test/capabilities.test.ts` fails if code that runs
+  in a window imports a `tauri-commands.ts` wrapper that window is not granted. Only `_` becomes
+  `-` in the identifier; `permissions/autogenerated/` is generated and ignored, and
+  `gen/schemas/*.json` is regenerated by every build and committed.
 - The `projects.json` file uses atomic writes (write to `.tmp`, then `rename()`). Corrupted files are backed up to `.bak`.
 - **Adding project state that changes the container?** `container_needs_recreation()` is entirely
   **label-based** — it does not diff the container's env. If a new setting affects the container's

app/src-tauri/capabilities/file-viewer.json

@@ -1,6 +1,6 @@
 {
   "identifier": "file-viewer",
-  "description": "The terminal file viewer windows (`file-viewer-<n>`, opened by `open_file_viewer` on the app's own `viewer.html`). Same rules as `default.json`: app commands need no entry here and are gated by label inside `commands/file_viewer_commands.rs`; this file is the plugin-command surface a compromised viewer webview could reach, and it is the smallest one that lets the window work. `core:event:allow-listen`/`allow-unlisten` are for `file-viewer-goto` (Rust → this window; the viewer subscribes through `getCurrentWindow().listen`, because a bare `listen()` in *any* window receives an `emit_to`). `core:window:allow-destroy` is not optional: `getCurrentWindow().onCloseRequested` in @tauri-apps/api 2.11 makes Rust `prevent_close()` whenever a JS listener exists and then calls `destroy()` itself, so without this grant the window's X button does nothing once the unsaved-changes guard is installed. `allow-close` is deliberately absent — nothing calls it, and `destroy` is the only exit. No `set-title`/`set-focus`/`unminimize`: those are done from Rust when a second click targets an already-open file. `core:webview:allow-internal-toggle-devtools` is the same dev-only convenience `default.json` carries.",
+  "description": "The terminal file viewer windows (`file-viewer-<n>`, opened by `open_file_viewer` on the app's own `viewer.html`). Same rules as `default.json`. The five bare `allow-viewer-*` grants are the only app commands a viewer window can invoke: `build.rs` declares the AppManifest that makes tauri enforce that, and refuses any other bare grant in this file. The label gate inside `commands/file_viewer_commands.rs` is still what stops window A acting on window B's registry entry, because the ACL only decides which window may call. The rest of this file is the plugin-command surface a compromised viewer webview could reach, and it is the smallest one that lets the window work. `core:event:allow-listen`/`allow-unlisten` are for `file-viewer-goto` (Rust → this window; the viewer subscribes through `getCurrentWindow().listen`, because a bare `listen()` in *any* window receives an `emit_to`). `core:window:allow-destroy` is not optional: `getCurrentWindow().onCloseRequested` in @tauri-apps/api 2.11 makes Rust `prevent_close()` whenever a JS listener exists and then calls `destroy()` itself, so without this grant the window's X button does nothing once the unsaved-changes guard is installed. `allow-close` is deliberately absent — nothing calls it, and `destroy` is the only exit. No `set-title`/`set-focus`/`unminimize`: those are done from Rust when a second click targets an already-open file. `core:webview:allow-internal-toggle-devtools` is the same dev-only convenience `default.json` carries.",
   "windows": ["file-viewer-*"],
   "permissions": [
     "core:event:allow-listen",

app/src-tauri/src/file_viewer/mod.rs

@@ -3,6 +3,10 @@
 //! Every window is a `file-viewer-<n>` label registered in [`registry::ViewerRegistry`];
 //! the commands in `commands/file_viewer_commands.rs` gate on the label and act only on
 //! the caller's own entry, which is why nothing here takes a path from a window.
+//!
+//! `file-viewer-*` is also the `windows` glob of `capabilities/file-viewer.json`, which grants
+//! exactly the five `viewer_*` commands and nothing else. Labels are minted only here; a window
+//! created anywhere else with a matching label would inherit those grants.
 
 pub mod poll;
 pub mod registry;

docs/superpowers/specs/2026-09-22-terminal-file-viewer-design.md

@@ -277,8 +277,10 @@ AppManifest spec, `2026-09-22-app-manifest-lockdown-design.md`).
     for **the caller's own label**. No viewer command accepts a path or a label as an argument.
 - Rendering: CodeMirror renders text as DOM text nodes; nothing uses `innerHTML` /
   `dangerouslySetInnerHTML` on file content. CSP unchanged.
-- Accepted residual risk (closed by the AppManifest follow-up): a compromised viewer window can
-  still invoke other app commands, because `build.rs` does not restrict app commands per window.
+- Closed by the AppManifest follow-up (`2026-09-22-app-manifest-lockdown-design.md`, implemented):
+  `build.rs` now declares a Tauri `AppManifest` from `generate_handler!`, so a compromised viewer
+  window can invoke only the five `allow-viewer-*` app commands granted in
+  `capabilities/file-viewer.json`, not any other app command.
 - Update CLAUDE.md (frontend/backend structure, Key Conventions note about the viewer window and
   label-gated commands).