46 lines
4.7 KiB
Markdown
46 lines
4.7 KiB
Markdown
# Native alpha
|
|
|
|
The native backend uses Tauri v2, bundled SQLite through rusqlite, and the OS WebView. The local workspace and live X page are separate stable WebviewWindows (`main` and `x-session`). SQLite lives in Tauri's app data directory, `dev.xworkspace.desktop/workspace.sqlite3`. It is local plaintext storage; there is no encryption or cloud sync claim.
|
|
|
|
## Implemented
|
|
|
|
- Transactional local drafts, CAS revision checks, immutable account identity per draft, reversible archive/restore, full revision snapshots, consistent JSON export.
|
|
- WAL + `synchronous=FULL`, foreign keys and schema-version refusal. Disk commit precedes returned ACK.
|
|
- Exact native caller-label/origin checks **plus** explicit Tauri AppManifest command ACL. Custom app commands are not left at their permissive default.
|
|
- Remote X can invoke only `capture_draft`; no reads, arbitrary file paths, shell, HTTP, status changes, deletion, theme changes or window creation commands are granted.
|
|
- Server-owned session/composer mapping. Remote cannot supply a draft/account ID. Navigation rotates mapping; existing snapshots remain intact. A local edit/archive forks subsequent live captures into a fresh draft rather than overwriting the edited draft.
|
|
- Capture retries with identical sequence/payload are idempotent. Reused sequence with changed payload and stale sequences reject. Empty text remains a recoverable snapshot.
|
|
- Bounded capture: 65,536 UTF-8 bytes per text, 200 active composers per native page session, 240 committed writes/minute, 64 MiB estimated retained capture payload or 50,000 capture revisions across the database. Quota rejection preserves existing records; there is no destructive automatic cleanup.
|
|
- Local theme command accepts only strict six-digit hex tokens, finite radius 0–24 and known density; it generates fixed CSS for X. No arbitrary CSS or executable plugin code crosses native IPC.
|
|
- X navigation limited to HTTPS `x.com` and specific legacy `twitter.com` login routes. New windows and remote downloads are blocked. External links and third-party SSO popups are intentionally unsupported in this alpha.
|
|
|
|
## Verification
|
|
|
|
From the repository root:
|
|
|
|
```sh
|
|
cargo test --manifest-path src-tauri/Cargo.toml --no-default-features
|
|
bun run desktop:dev
|
|
bun run desktop:build
|
|
```
|
|
|
|
The first command exercises the actual Rust database, session, validation, quota and permission policy without requiring a desktop/WebKit toolchain. It is **not** a native WebView smoke test. `desktop` is the default Cargo feature; `--no-default-features` deliberately excludes the GUI runtime and Tauri build step.
|
|
|
|
macOS requires Xcode command line tools. Windows requires the MSVC Rust target, Visual Studio C++ build tools and WebView2. Bundling and signing are not configured as release-ready (`bundle.active=false`). The root CI describes native build gates.
|
|
|
|
## Known integration gates
|
|
|
|
- Run a real macOS and Windows build, open X, exercise login/logout and account switching, reload/close/reopen, forced app termination, and inspector checks before trusting capture as the only copy of important text.
|
|
- Injected code shares X's page world. It is untrusted. Tauri ACL + the native narrow command boundary are the protection; hiding `window.__TAURI__` would not be one.
|
|
- Remote capture capability is disabled on Linux/Android because Tauri documents iframe IPC origin ambiguity there. The user's target platforms are macOS and Windows.
|
|
- All captured drafts are `unassigned-x`; authenticated account detection has not been verified. No page-supplied identity is trusted. A queued invocation around document navigation can create an extra unassigned snapshot; it cannot select or overwrite a prior session's local draft.
|
|
- Observer relationship events stay page-local. `observations` is an empty, exportable database table until identity and ingestion design are implemented. No invented follow dates/unfollow events.
|
|
- X CSS selectors and DOM capture selectors are experimental. X's CSS/CSP/DOM or WebView behavior may require adjustment after real platform testing.
|
|
- No DM capture, publication, uploads, account API, background notifications, MCP server, or general JavaScript plugin execution.
|
|
- SQLite FULL is a strong durability setting, not a guarantee against storage-device or OS failure. Capture before native ACK can still be lost; the observer must display Pending/Error accurately.
|
|
|
|
References checked during implementation:
|
|
|
|
- https://v2.tauri.app/security/capabilities/ — AppManifest custom-command restriction and Linux iframe caveat.
|
|
- https://docs.rs/tauri/latest/tauri/webview/struct.WebviewWindowBuilder.html — initialization, navigation, download and new-window hooks; Windows async-window creation requirement.
|
|
- https://v2.tauri.app/security/runtime-authority/ — ACL origin/capability checks.
|