Security: scope host-side IPC capabilities

[marcello-tk]

Parent umbrella: #108\n\nGoal: reduce the authority exposed by host-side IPC commands and keep privileged actions narrowly scoped.\n\nFocus areas:\n- Review existing #[tauri::command] surfaces for overbroad authority\n- Split commands by capability when a single endpoint currently does too much\n- Keep sensitive actions host-only, with explicit user approval paths for mutation\n- Document the trust boundary for each command in docs/apis.md\n\nSuccess looks like: a smaller, clearer host API surface with fewer implicit privileges.

[judell]

V2.15 (hook-first permission menus) adds new host IPC to scope here.

Two new loopback routes, POSTed by the permission-menu hooks (Claude app/__shell/permission-menu-hook.py, Codex app/shell/codex-permission-menu-hook.py):

• /__menu/permission — src-tauri/src/lib.rs:24622
• /__menu/permission/clear — src-tauri/src/lib.rs:24630

Trust boundary to capture in docs/apis.md:

• Observe-only. They build and display the agent-pane permission menu from the hook payload; they do not approve, deny, or mutate anything. The actual grant still happens in the terminal (the user's keystroke), and repo edits stay gated by the worklist authorization records.
• Display-only authority, but still a new IPC surface — give each route a trust-boundary line per this issue's "document the trust boundary for each command" goal.
• The route also claims the agent-pane menu slot via MENU_HOOK_OWNER_MS coordination (the xterm grid defers while the hook owns it). That ownership window is host-side display state, not an authorization — worth stating so it isn't mistaken for one.

[judell]

Progress from C1 + C2 (target-pane isolation + /__file containment). Not closing — the core is resolved but route-hardening and the docs/apis.md deliverable remain.

Resolved

• C1 (c8c320c, 99591ce): the target-app pane is now served at a distinct bramapp://localhost origin via handle_target_scheme. Cross-origin, untrusted target content can no longer reach window.__TAURI__, the PTY-driving helpers, or the loopback /__* routes — getTauriInvoke() returns null. This removes the largest source of over-broad IPC authority: any embedded page could previously invoke every #[tauri::command] and every host route. Validated: window.__TAURI__ is undefined in the target pane; dynamic routes return 403 (target-scheme op=refuse).
• C2 (9ce3911): /__file (flagged by this issue) now canonicalizes and restricts reads to an allowlist of roots.

Still open under this issue

• open_url routes file:// to open_path (arbitrary local-file open) — needs scheme validation.
• Loopback server has no per-session token and sends Access-Control-Allow-Origin: *; a bearer token + tightened CORS would close co-resident-process / CSRF reach.
• Document the trust boundary per command/route in docs/apis.md (this issue's stated deliverable).

Full triage in docs/security.md.