Merge pull request #209 from oratis/codex/minimize-desktop-capabilities

security: minimize desktop renderer capabilities

Author: oratis

apps/desktop/package.json

@@ -27,7 +27,6 @@
     "@deepcode/shared-ui": "workspace:*",
     "@tauri-apps/api": "^2.0.0",
     "@tauri-apps/plugin-dialog": "^2.0.0",
-    "@tauri-apps/plugin-fs": "^2.0.0",
     "@tauri-apps/plugin-opener": "^2.0.0",
     "@tauri-apps/plugin-process": "^2.3.1",
     "@tauri-apps/plugin-shell": "^2.0.0",

apps/desktop/src-tauri/Cargo.lock

@@ -16,7 +16,6 @@ tauri-build = { version = "2", features = [] }
 [dependencies]
 tauri = { version = "2", features = [] }
 tauri-plugin-dialog = "2"
-tauri-plugin-fs = "2"
 tauri-plugin-opener = "2"
 tauri-plugin-shell = "2"
 tauri-plugin-updater = "2"

apps/desktop/src-tauri/Cargo.toml

@@ -10,11 +10,9 @@
     "core:window:allow-minimize",
     "core:window:allow-maximize",
     "core:window:allow-close",
-    "dialog:default",
-    "fs:default",
-    "opener:default",
+    "dialog:allow-open",
+    "opener:allow-default-urls",
     "updater:default",
-    "process:default",
     "process:allow-restart"
   ]
 }

apps/desktop/src-tauri/capabilities/default.json

@@ -34,7 +34,6 @@ pub fn run() {
     tauri::Builder::default()
         .plugin(tauri_plugin_opener::init())
         .plugin(tauri_plugin_dialog::init())
-        .plugin(tauri_plugin_fs::init())
         .plugin(tauri_plugin_shell::init())
         .plugin(tauri_plugin_updater::Builder::new().build())
         .plugin(tauri_plugin_process::init())

apps/desktop/src-tauri/src/lib.rs

@@ -25,7 +25,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self' tauri:; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: asset: tauri: http://asset.localhost https://asset.localhost; font-src 'self' data:; connect-src 'self' tauri: ipc: ws://localhost:5173 https://api.deepseek.com"
+      "csp": "default-src 'self' tauri:; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: asset: tauri: http://asset.localhost https://asset.localhost; font-src 'self' data:; connect-src 'self' tauri: ipc: ws://localhost:5173"
     }
   },
   "bundle": {

apps/desktop/src-tauri/tauri.conf.json

@@ -350,6 +350,8 @@ model tool call
 - 已删除无生产引用的 core renderer IPC、desktop native mutation/tool facade 与 `chat` 路由别名；
   Tauri 仅保留 credential presence、文件/快照只读投影和 sidecar supervision。legacy session importer
   继续只读，旧文件不迁移、不覆盖；用户文档已改为 app-server 架构。
+- Tauri capability 已收紧为 open dialog、默认 URL、updater 与 restart 的精确 allow 集；未使用的 FS
+  plugin、generic process exit、file reveal 和 renderer → provider CSP 路径已移除，release gate 防止回归。
 - `pnpm release:check` 已对真实 VS Code/app-server/VSIX 产物执行包体预算、v1 capability、
   create/read、配置诊断、workspace diff、重启 read/resume 与薄客户端边界扫描；Ubuntu/macOS CI
   与 tag validate 共用该门禁，tag 还必须通过 desktop Playwright journey。迁移、隔离 home 回滚演练、

docs/CODEX_ALIGNMENT_PLAN.md

@@ -28,6 +28,9 @@ The gate fails unless all of the following hold:
    and resume the same canonical thread.
 5. Desktop, VS Code, and LSP production sources do not import the provider, credentials, agent loop,
    or `RuntimeHost`, and do not contain renderer credential escape hatches.
+6. The Tauri renderer has no filesystem default capability, process-exit capability, file-reveal
+   capability, or provider API CSP access; required dialog, URL-open, and restart features use
+   narrow allow permissions.
 
 The current budgets deliberately leave cross-platform CI headroom over the measured baseline. A
 budget increase requires a PR description with before/after measurements and an explanation of the

docs/design/release-gates-v1.md

@@ -1,6 +1,6 @@
 # DeepCode Security Model
 
-> Last updated: 2026-08-01 (shared app-server trust and config provenance)
+> Last updated: 2026-08-01 (shared app-server trust, provenance, and thin-client capabilities)
 
 This document is the **single source of truth** for what DeepCode protects
 against, what it doesn't, and how each layer composes. If you're reviewing a
@@ -17,13 +17,23 @@ decreasing order of operator severity:
 | 1   | Model exfiltrates DeepSeek API key (or other env secrets) via tool call  | High             | M3.5 sandbox + M5.1 env strip                                           |
 | 2   | Model writes arbitrary files outside the project (`/usr/bin`, `/etc`)    | High             | M3.5 sandbox + permissions                                              |
 | 3   | Plugin (third-party code) does either #1 or #2                           | High             | M5.1 subprocess + (M5.1-ext) OS sandbox                                 |
-| 4   | Hook script (third-party shell snippet) does either #1 or #2             | Medium           | M3.5 sandbox wraps Bash; hooks bypass when invoked via /bin/sh directly |
+| 4   | Hook script (third-party shell snippet) does either #1 or #2             | Medium           | Exact-definition review + source trust; hook commands remain host code  |
 | 5   | Hostile `settings.json` field (e.g. allowRead path) injects sandbox rule | Medium           | escapeSbpl()                                                            |
 | 6   | Untrusted project's AGENTS.md drives the agent into harmful action       | Low              | Trust store (`/trust`)                                                  |
 | 7   | DNS exfiltration of secrets from sandboxed Bash                          | Partly mitigated | M3.5-ext DNS allowlist (netns.ts) — names only; raw-IP dials still pass |
 
 ## Defence layers
 
+### Runtime placement — thin clients
+
+The Tauri WebView, VS Code extension, and LSP process are protocol clients, not trusted runtimes.
+Provider credentials, model calls, tools, permissions, hooks, MCP, and plugins stay in the CLI host
+or app-server. The Tauri capability set is least-privilege: file/folder selection, default
+HTTP(S)/mailto/tel URL opening, updater operations, and application restart. It has no Tauri
+filesystem plugin, shell permission, generic process-exit permission, file-reveal permission, or CSP
+route to the provider API. Read-only file preview and session history use explicit Rust commands
+that reject the backend credential path; all workspace mutations use the versioned protocol.
+
 ### Layer 0 — Trust store
 
 First time DeepCode opens a folder, you're asked **"Do you trust this
@@ -124,15 +134,16 @@ not an oversight. (M5.2 will add per-clause analysis.)
 
 Plugins run in their own `node` subprocess with:
 
-- **No host fs/net access** in plugin code — all capabilities (`fs_read`,
-  `fs_write`, `bash`, `fetch`) flow via JSON-RPC over stdio back to the host,
-  which applies its own mode/permission/sandbox stack.
+- **Gated host capabilities** — declared `fs_read`, `fs_write`, `bash`, and `fetch` requests flow via
+  JSON-RPC over stdio back to the host, which applies mode, permission, hook, approval, and sandbox
+  policy. This controls the supported plugin API; it is not yet an OS boundary against a malicious
+  plugin using Node APIs directly.
 - **Token-protected RPC** — host generates an unguessable token per plugin
   spawn; every RPC from the plugin must include it.
 - **Env scrub** — `DEEPSEEK_API_KEY` and `DEEPSEEK_AUTH_TOKEN` are stripped
   from the child env. Plugins cannot read DeepSeek credentials.
-- **Hash pin** — plugin code is SHA-256 hashed at install time; mismatch on
-  load fails open (drift detection).
+- **Whole-install hash pin** — every installed plugin file contributes to the SHA-256 trust hash;
+  missing trust or any drift disables the plugin and reports a diagnostic.
 
 **Acknowledged gaps**:
 
@@ -166,25 +177,25 @@ etc.) as **untrusted**. We:
 
 ## Attack-vector test suite
 
-`packages/core/src/sandbox/attacks.test.ts` contains 17 tests:
+`packages/core/src/sandbox/attacks.test.ts` and the platform integration suites cover:
 
-- **6 unit-level** "hostile input → safe output" tests:
+- **Unit-level** "hostile input → safe output" cases:
   - SBPL paren/quote escaping
   - SBPL backslash escaping
   - deny-after-allow ordering
   - no implicit network when allowedDomains is empty
   - no implicit file-write to /usr, /System, /Library
-- **3 bwrap-arg safety** tests:
+- **bwrap-argument safety** cases:
   - no --share-net even with a non-empty allowedDomains (connectivity comes from
     slirp4netns externally, never by sharing the host netns)
   - only cwd is bare --bind
   - always --unshare-{pid,ipc,uts}
-- **4 excluded-command spoofing** tests:
+- **Excluded-command spoofing** cases:
   - prefix-only match (`gitleaks`) does NOT bypass
   - exact match bypasses
   - leading-token match bypasses
   - pipeline-after-excluded bypasses (documented behavior; M5.2 hardens)
-- **2 sandbox-exec e2e** (macOS, runIf the binary exists):
+- **sandbox-exec e2e** (macOS, runIf the binary exists):
   - block write to `/usr/local/bin/*`
   - profile is syntactically valid (smoke)
 - **bwrap e2e** (Linux CI, runIf `bwrap` exists — `bwrap-integration.test.ts`):