#118 Narrow core:default for the remote origin to the commands the page uses

[Anonymous]

Originally created by: kristofferR

capabilities/default.json applies the full core:default to the remote facebook.com windows, exposing e.g. plugin:menu|set_as_app_menu, tray manipulation, and plugin:webview|print to that origin. The injected code needs only the event bridge plus the explicitly-granted window/notification/opener commands. Replace core:default with the minimal explicit subset. Needs a runtime inventory pass with a debug build first (the settings bridge and panel must keep working), which is why it wasn't folded into the first capability-tightening round. Ref [#50].

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed

[Anonymous]

Originally posted by: kristofferR

Fixed in [#140]. core:default is no longer applied to the remote facebook.com origin — it's replaced with the minimal explicit subset the page actually needs (e.g. core:event:allow-emit plus the explicitly-granted window/notification/opener commands), so tray/menu/webview|print are no longer exposed to that origin.