fix(acl): grant IPC commands explicitly and guard ACL consistency

codex-trace relied on Tauri implicitly permitting its own app commands, so
none of them appeared in the ACL. Mirror claude-code-trace's hardening:
define an explicit [default] permission set granting each generate_handler!
command, reference it from capabilities/default.json, and add a regression
test that cross-checks the handler against the ACL in both directions (so a
command wired up but ungranted fails CI instead of at runtime with
'Command <name> not allowed by ACL').

Author: delexw

src-tauri/capabilities/default.json

@@ -10,6 +10,7 @@
     "fs:allow-read-dir",
     "fs:allow-stat",
     "core:event:default",
-    "opener:default"
+    "opener:default",
+    "default"
   ]
 }

src-tauri/permissions/default.toml

@@ -0,0 +1,58 @@
+[default]
+description = "Default permissions for all codex-trace commands"
+permissions = [
+  "allow-load-session",
+  "allow-watch-session",
+  "allow-unwatch-session",
+  "allow-list-sessions",
+  "allow-watch-picker",
+  "allow-unwatch-picker",
+  "allow-get-settings",
+  "allow-set-sessions-dir",
+  "allow-switch-to-browser",
+]
+
+[[permission]]
+identifier = "allow-load-session"
+description = "Allow loading a session file"
+commands.allow = ["load_session"]
+
+[[permission]]
+identifier = "allow-watch-session"
+description = "Allow watching a session file for changes"
+commands.allow = ["watch_session"]
+
+[[permission]]
+identifier = "allow-unwatch-session"
+description = "Allow stopping session file watching"
+commands.allow = ["unwatch_session"]
+
+[[permission]]
+identifier = "allow-list-sessions"
+description = "Allow listing sessions in the sessions directory"
+commands.allow = ["list_sessions"]
+
+[[permission]]
+identifier = "allow-watch-picker"
+description = "Allow watching the picker for changes"
+commands.allow = ["watch_picker"]
+
+[[permission]]
+identifier = "allow-unwatch-picker"
+description = "Allow stopping picker watching"
+commands.allow = ["unwatch_picker"]
+
+[[permission]]
+identifier = "allow-get-settings"
+description = "Allow reading app settings"
+commands.allow = ["get_settings"]
+
+[[permission]]
+identifier = "allow-set-sessions-dir"
+description = "Allow setting the sessions directory"
+commands.allow = ["set_sessions_dir"]
+
+[[permission]]
+identifier = "allow-switch-to-browser"
+description = "Allow switching to browser mode"
+commands.allow = ["switch_to_browser"]

src-tauri/tests/acl_consistency.rs

@@ -0,0 +1,127 @@
+//! Regression guard for the Tauri ACL.
+//!
+//! Every IPC command registered in `tauri::generate_handler![ ... ]` must also be
+//! granted by the `[default]` permission set in `permissions/default.toml`, and
+//! the capability in `capabilities/default.json` must reference that set.
+//! Otherwise the desktop build rejects the call at runtime with
+//! `Command <name> not allowed by ACL` — the failure mode that hit claude-code-trace
+//! when a feature added the handler but forgot the matching `commands.allow`
+//! entry. The check runs in both directions so a stale ACL grant is caught too.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+const LIB_RS: &str = include_str!("../src/lib.rs");
+const DEFAULT_TOML: &str = include_str!("../permissions/default.toml");
+const CAPABILITY_JSON: &str = include_str!("../capabilities/default.json");
+
+/// Contents of every double-quoted string in `s`.
+fn quoted_strings(s: &str) -> BTreeSet<String> {
+    s.split('"')
+        .enumerate()
+        .filter(|(i, _)| i % 2 == 1)
+        .map(|(_, part)| part.to_string())
+        .collect()
+}
+
+/// Command names registered in `tauri::generate_handler![ ... ]` (last path segment).
+fn handler_commands() -> BTreeSet<String> {
+    let start = LIB_RS
+        .find("generate_handler![")
+        .expect("generate_handler! macro present in lib.rs");
+    let rest = &LIB_RS[start..];
+    let open = rest.find('[').expect("opening [ for generate_handler!");
+    let close = rest.find(']').expect("closing ] for generate_handler!");
+    rest[open + 1..close]
+        .split(',')
+        .map(str::trim)
+        .filter(|t| !t.is_empty())
+        .map(|t| t.rsplit("::").next().unwrap().trim().to_string())
+        .collect()
+}
+
+/// Identifiers referenced by the `[default]` permission set.
+fn default_permission_set() -> BTreeSet<String> {
+    let key = "permissions = [";
+    let start = DEFAULT_TOML
+        .find(key)
+        .expect("[default] permissions array present");
+    let after = &DEFAULT_TOML[start + key.len()..];
+    let end = after.find(']').expect("closing ] for default permissions");
+    quoted_strings(&after[..end])
+}
+
+/// Map of each `[[permission]]` identifier to the commands it allows.
+fn permission_blocks() -> BTreeMap<String, BTreeSet<String>> {
+    let mut map = BTreeMap::new();
+    for chunk in DEFAULT_TOML.split("[[permission]]").skip(1) {
+        let Some(id_line) = chunk
+            .lines()
+            .find(|l| l.trim_start().starts_with("identifier"))
+        else {
+            continue;
+        };
+        let Some(id) = quoted_strings(id_line).into_iter().next() else {
+            continue;
+        };
+        let key = "commands.allow = [";
+        let cmds = match chunk.find(key) {
+            Some(s) => {
+                let after = &chunk[s + key.len()..];
+                let end = after.find(']').unwrap_or(after.len());
+                quoted_strings(&after[..end])
+            }
+            None => BTreeSet::new(),
+        };
+        map.insert(id, cmds);
+    }
+    map
+}
+
+/// Commands granted by the `[default]` permission set.
+fn acl_granted_commands() -> BTreeSet<String> {
+    let referenced = default_permission_set();
+    let blocks = permission_blocks();
+    referenced
+        .iter()
+        .filter_map(|id| blocks.get(id))
+        .flat_map(|cmds| cmds.iter().cloned())
+        .collect()
+}
+
+#[test]
+fn handler_and_acl_grant_the_same_commands() {
+    let handler = handler_commands();
+    let granted = acl_granted_commands();
+
+    let missing_from_acl: Vec<_> = handler.difference(&granted).collect();
+    assert!(
+        missing_from_acl.is_empty(),
+        "commands registered in generate_handler! but missing an ACL `commands.allow` entry \
+         (these fail at runtime with `Command <name> not allowed by ACL`): {missing_from_acl:?}"
+    );
+
+    let extra_in_acl: Vec<_> = granted.difference(&handler).collect();
+    assert!(
+        extra_in_acl.is_empty(),
+        "ACL grants commands that are not registered in generate_handler!: {extra_in_acl:?}"
+    );
+}
+
+#[test]
+fn capability_references_the_default_permission_set() {
+    // The granular commands.allow entries only take effect if the capability
+    // actually pulls in the local `default` permission set.
+    assert!(
+        quoted_strings(CAPABILITY_JSON).contains("default"),
+        "capabilities/default.json must reference the \"default\" permission set so the \
+         app command grants in permissions/default.toml are applied"
+    );
+}
+
+#[test]
+fn core_session_commands_are_acl_granted() {
+    let granted = acl_granted_commands();
+    for cmd in ["load_session", "list_sessions", "get_settings"] {
+        assert!(granted.contains(cmd), "{cmd} must be ACL-granted");
+    }
+}