mirror of
https://github.com/hanzoai/desktop.git
synced 2026-10-30 14:58:42 +00:00
zeekay
672590c8bb
Tauri v2 lets every window call every command in invoke_handler unless the app declares them as permissions, and the main capability also named the spotlight window, so spotlight held all of main's: shell open, updater install, process restart, notifications, reads of ~/.claude, ~/.codex and ~/.hanzo, and all 85 commands. build.rs now reads generate_handler! in src/main.rs and registers each command as an app permission (allow-<command>). main grants all of them, and the build refuses a main capability that misses one or any grant no handler serves. Spotlight, coordinator and node-manager grant the commands and plugin calls their own bundles make, read from the build's module graph: spotlight keeps 21 commands, a save dialog, http fetch, open-path, relaunch and its events. The main capability no longer names spotlight. Measured in the running app over WebDriver: from spotlight and coordinator, mining_get_state and register_server_in_claude are refused; from main they reach the command. Claude-Session: https://claude.ai/code/session_01M8RoubcPN71KgJuZ8LdBUL
46 lines
1.2 KiB
JSON
46 lines
1.2 KiB
JSON
{
|
|
"identifier": "hanzo-node-manager",
|
|
"description": "permissions that were migrated from v1",
|
|
"local": true,
|
|
"windows": [
|
|
"hanzo-node-manager"
|
|
],
|
|
"permissions": [
|
|
"core:default",
|
|
"core:window:allow-start-dragging",
|
|
"log:default",
|
|
"dialog:allow-save",
|
|
"fs:allow-download-write",
|
|
"dialog:allow-open",
|
|
{
|
|
"identifier": "opener:allow-open-path",
|
|
"allow": [
|
|
{
|
|
"path": "$HOME/Downloads/*"
|
|
}
|
|
]
|
|
},
|
|
"allow-download-logs",
|
|
"allow-hanzo-node-get-default-model",
|
|
"allow-hanzo-node-get-options",
|
|
"allow-hanzo-node-is-running",
|
|
"allow-hanzo-node-kill",
|
|
"allow-hanzo-node-open-storage-location-with-path",
|
|
"allow-hanzo-node-remove-storage",
|
|
"allow-hanzo-node-set-default-options",
|
|
"allow-hanzo-node-set-options",
|
|
"allow-hanzo-node-spawn",
|
|
"allow-model-tools-bitdelta-apply",
|
|
"allow-model-tools-bitdelta-encode",
|
|
"allow-model-tools-grpo-run",
|
|
"allow-model-tools-soup-available",
|
|
"allow-model-tools-soup-average",
|
|
"allow-model-tools-soup-delta",
|
|
"allow-retrieve-logs",
|
|
"allow-secure-storage-delete",
|
|
"allow-secure-storage-get",
|
|
"allow-secure-storage-set",
|
|
"allow-show-hanzo-node-manager-window"
|
|
]
|
|
}
|