#354 Move file-touching page events to typed, per-origin commands

[Anonymous]

Originally created by: kristofferR

Status (2026-11-08)

• Step 1 done in [#377]: the remote capability now covers only facebook.com and messenger.com. fbcdn.net and fbsbx.com get no IPC, and a test enforces that.
• Step 3 done in [#377]: AGENTS.md describes the real IPC model.
• Remaining: step 2, moving the file-touching events (prepare-download, share-download, copy-image, choose-download) to typed commands granted per origin.

Problem

capabilities/default.json (github.com) grants core:event:allow-emit to facebook.com, messenger.com, fbcdn.net and fbsbx.com. Any script running on those origins, not only Chatpane's injection, can emit any chatpane:* event the Rust side listens to with listen_any (chatpane:notify, chatpane:prepare-download, chatpane:share-download, chatpane:copy-image, chatpane:context-menu, scheduled send, and more in lib.rs (github.com)). fbsbx.com is Facebook's user-content host.

CLAUDE.md also says the remote page "cannot call Chatpane's own commands". That is not true: Tauri allows it when a command is declared in tauri_build::AppManifest::commands and granted per origin. fMess does this (build.rs:24-51, capabilities/messenger-web.json (github.com)).

Design

1. Immediate: find out whether fbcdn.net and fbsbx.com windows ever need to emit. If not, give them a capability without core:event:allow-emit.
2. Incremental: move page-to-backend calls from free-form events to typed commands granted per origin, one at a time, starting with the ones that touch files (prepare-download, share-download, copy-image, choose-download). This gives per-command allow-lists and serde-validated arguments instead of hand-parsed event payloads.
3. Update the IPC section of CLAUDE.md to describe the real model.

Ref [#107], [#118].

Testing

• Every migrated feature still works on all three platforms.
• From DevTools on an fbsbx.com frame, emitting a chatpane:* event is rejected.

Part of [#349].