host: run_app — the window, shell, tab webviews and generic commands for every app

The `app` feature (App / run_app, AppConfig, SiteHooks): registers the Tauri plugins every app
uses (single-instance, deep-link and updater opt-in, window-state, opener, process, notification,
dialog), makes app data, loads profiles and the language, builds the window (restore, lost-geometry
reset, helper-close routing, native resize follow) and the transparent shell, and serves tabs_sync,
tab_navigate, tab_action, open_external_url, shell_focus, shell_raise, window_system_menu,
profiles_get/set, i18n_get/set (shell-only) and tab_shortcut, tab_link_drag (tab-only). The tab
builder is generic; the app fills in SiteHooks. `commands` lists them (manifest() for build.rs),
`testkit` checks capability files and caller guards, i18n::page_script is origin-guarded.
check:tauri now checks the app feature.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/waybetter-host/src/commands.rs

@@ -0,0 +1,73 @@
+//! The Tauri commands [`crate::app::run_app`] registers for every app, and who may call them.
+//!
+//! An app's `build.rs` lists its own commands plus these in the app-command manifest
+//! ([`manifest`]), and its capability files grant [`SHELL`] to the local `shell` webview only and
+//! [`TAB`] to tab webviews only; [`crate::testkit`] checks both. Every command re-checks its caller
+//! natively (`host::shell_only` / `host::tab_only`) before anything else.
+
+/// Shell-only: the local `shell` webview (debug builds also accept the dev server).
+pub const SHELL: &[&str] = &[
+    "tabs_sync",
+    "tab_navigate",
+    "tab_action",
+    "open_external_url",
+    "shell_focus",
+    "shell_raise",
+    "window_system_menu",
+    "profiles_get",
+    "profiles_set",
+    "i18n_get",
+    "i18n_set",
+];
+
+/// Tab-only: any tab webview, speaking only about itself.
+pub const TAB: &[&str] = &["tab_shortcut", "tab_link_drag"];
+
+/// Whether `command` is one of the host's (dispatched to the host, never to the app's handler).
+pub fn is_host(command: &str) -> bool {
+    SHELL.contains(&command) || TAB.contains(&command)
+}
+
+/// The capability permission tauri-build generates for `command` (`tabs_sync` → `allow-tabs-sync`).
+pub fn permission(command: &str) -> String {
+    format!("allow-{}", command.replace('_', "-"))
+}
+
+/// The app-command manifest for `build.rs`: the app's own commands followed by the host's (each
+/// once). Leaked on purpose: tauri-build wants `&'static` and a build script runs once.
+///
+/// ```ignore
+/// tauri_build::AppManifest::new().commands(waybetter_host::commands::manifest(&["draft_list"]))
+/// ```
+pub fn manifest(app: &[&'static str]) -> &'static [&'static str] {
+    let mut all: Vec<&'static str> = Vec::with_capacity(app.len() + SHELL.len() + TAB.len());
+    for command in app.iter().chain(SHELL).chain(TAB) {
+        if !all.contains(command) {
+            all.push(command);
+        }
+    }
+    Box::leak(all.into_boxed_slice())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn manifest_adds_the_host_commands_once() {
+        let all = manifest(&["draft_list", "tabs_sync"]);
+        assert_eq!(all[0], "draft_list");
+        assert_eq!(all.iter().filter(|c| **c == "tabs_sync").count(), 1);
+        for command in SHELL.iter().chain(TAB) {
+            assert!(all.contains(command), "{command}");
+            assert!(is_host(command));
+        }
+        assert!(!is_host("draft_list"));
+        assert_eq!(permission("tab_link_drag"), "allow-tab-link-drag");
+    }
+
+    #[test]
+    fn shell_and_tab_commands_do_not_overlap() {
+        assert!(!SHELL.iter().any(|command| TAB.contains(command)));
+    }
+}