#136 Open facebook.com content links in the browser; fix AltGr shortcuts; harden notification privacy

[Anonymous]

Originally created by: kristofferR

First fixes from the July 2026 whole-app audit (epic [#135]).

What

• facebook.com content links open in the default browser (Ref [#105]). classifyHref is now path-aware on facebook.com: only Messenger (/messages, /t/) and login/auth paths (/login, /checkpoint, /two_step_verification, /two_factor, /recover, /reg, /r.php) stay in-app; posts, profiles, groups, reels, etc. go to the default browser. The Rust is_internal deliberately stays permissive — subframe navigations flow through on_navigation, and cancelling them breaks embedded frames (Ref [#78]).
• Download anchors never navigate the app to their blob: URL — clicks on a[download] are left to the native download pipeline, closing the race with the download-anchors sweep.
• AltGr no longer triggers shortcuts (Ref [#106]). Alt-modified keys are excluded from the accelerator check, so typing [ ] { } on European Windows layouts inserts the character instead of switching conversations.
• Remote-origin capabilities narrowed (Ref [#107]). notification:default → the two permission-query commands the page actually calls (banners are delivered Rust-side via carrier:notify); the opener grant now carries an explicit URL scope (http/https/mailto:/tel: + the macOS privacy-pane deep link). The scoped opener grant is correct under both readings of the empty-scope semantics — it either restricts an allow-all or unbreaks a deny-all.
• Mute / Hide Preview enforced on the Rust delivery path (Ref [#108]). show_message_notification suppresses delivery when muted (before touching dedup state) and applies the page's exact "Messenger" / "New message" redaction — avatar dropped — when Hide Preview is on.

Validation

• bun run check: Biome + tsc clean, 68 tests (17 new link-classification assertions), bundles regenerated in sync.
• cargo fmt + cargo clippy --all-targets -- -D warnings + cargo test --lib (67 tests); the capability change passed tauri-build's ACL validation.
• crq preflight --type uncommitted: no findings in these files (3 findings in unrelated untracked landing-drafts/ mockups, out of scope here).
• Remaining runtime check: click-test in a debug build that external links still open and FB content links hit the browser (needs swapping the running app, noted on [#105]).

Summary by CodeRabbit

• Bug Fixes
• Download links no longer trigger in-app navigation.
• Keyboard shortcuts no longer activate unexpectedly while typing Alt-based characters on certain keyboard layouts.
• Facebook links outside supported Messenger paths now open in the browser.
• Notifications now consistently respect muted notifications and hidden-preview settings, including notification text and avatars.
• Security & Permissions
• Notification and external-link permissions are more narrowly scoped to supported actions and URL types.

[Anonymous]

Originally posted by: kristofferR

@coderabbitai review

[Anonymous]

Originally posted by: coderabbitai[bot]

✅ Action performed

Review finished. > Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Anonymous]

Originally posted by: coderabbitai[bot]

📝 Walkthrough

## Walkthrough The PR updates Facebook link routing, bypasses interception for downloads, filters Alt-modified shortcuts, narrows Tauri capability permissions, and enforces mute and hidden-preview settings when constructing native notifications. ### Changes **Link routing and download handling** |Layer / File(s)|Summary| |---|---| |**Facebook URL allowlist and classification**
`inject/src/messenger/lib/links.ts`, `inject/src/messenger/lib/links.test.ts`, `src-tauri/inject/messenger.js`|Facebook URLs remain internal only for allowlisted Messenger and authentication paths; other Facebook URLs are classified as external, with expanded tests.| |**Download-link interception bypass**
`inject/src/messenger/features/link-handling.ts`, `src-tauri/inject/messenger.js`|Links with a `download` attribute bypass normal navigation interception.| **Shortcut accelerator filtering** |Layer / File(s)|Summary| |---|---| |**Alt-modified accelerator filtering**
`inject/src/messenger/features/shortcuts.ts`, `src-tauri/inject/messenger.js`|Cmd/Ctrl accelerators are ignored when the Alt key is also pressed.| **Native capability and notification privacy controls** |Layer / File(s)|Summary| |---|---| |**Capability permission scopes**
`src-tauri/capabilities/default.json`|Notification permissions are split into explicit operations, and opener access is restricted to approved URL patterns and schemes.| |**Notification mute and preview enforcement**
`src-tauri/src/notifications.rs`|Muted notifications are suppressed; hidden previews use generic text and omit avatars, while visible previews retain the original content.| **Estimated code review effort:** 3 (Moderate) | ~20 minutes **Possibly related issues** - [kristofferR/Carrier#135](https://github.com/kristofferR/Carrier/issues/135) — Covers the same audit fixes for Facebook routing, AltGr shortcuts, capability scoping, and notification privacy. - [kristofferR/Carrier#106](https://github.com/kristofferR/Carrier/issues/106) — Addresses the same AltGr accelerator handling. - [kristofferR/Carrier#108](https://github.com/kristofferR/Carrier/issues/108) — Addresses the same mute and hidden-preview notification enforcement. **Possibly related PRs** - [[kristofferR/Carrier#21](https://github.com/kristofferR/Carrier/issues/21)](https://github.com/kristofferR/Carrier/pull/21) — Implements the same notification mute and preview privacy behavior. - [[kristofferR/Carrier#42](https://github.com/kristofferR/Carrier/issues/42)](https://github.com/kristofferR/Carrier/pull/42) — Modifies the same injected Messenger shortcut handling. - [[kristofferR/Carrier#43](https://github.com/kristofferR/Carrier/issues/43)](https://github.com/kristofferR/Carrier/pull/43) — Modifies related injected Messenger download-link processing.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

| Check name | Status | Explanation | | :------------------------: | :------- | :------------------------------------------------------------------------------------------------------------------------------------------- | | Description Check | ✅ Passed | Check skipped - CodeRabbit’s high-level summary is enabled. | | Title check | ✅ Passed | The title clearly summarizes the main user-facing changes: Facebook link handling, AltGr shortcut fixes, and notification privacy hardening. | | Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. | | Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. | | Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |

✨ Finishing Touches

📝 Generate docstrings

- [ ] Create stacked PR - [ ] Commit on current branch

🧪 Generate unit tests (beta)

- [ ] Create PR with unit tests - [ ] Commit unit tests in branch `audit-round-1`

---

_{Comment @coderabbitai help to get the list of available commands.}

[Anonymous]

Originally posted by: kristofferR

@coderabbitai review

[Anonymous]

Originally posted by: coderabbitai[bot]

✅ Action performed

Review finished. > Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Anonymous]

Originally posted by: kristofferR

@coderabbitai review

[Anonymous]

Originally posted by: coderabbitai[bot]

✅ Action performed

Review finished. > Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Anonymous]

Originally posted by: kristofferR

@codex review

[Anonymous]

Originally posted by: chatgpt-codex-connector[bot]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: a3fd869844

ℹ️ About Codex in GitHub

[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you - Open a pull request for review - Mark a draft as ready - Comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed