chore(hardening): tighten security and footprint defaults

src-tauri/src/commands/live.rs

@@ -17,6 +17,7 @@ use crate::commands::audio::resolve_recording_path;
 use crate::commands::build_initial_prompt;
 use crate::commands::models::{default_model_id_for_engine, ensure_model_loaded};
 use crate::commands::power::PowerAssertion;
+use crate::commands::security::ensure_main_window;
 use crate::AppState;
 use kon_ai_formatting::{post_process_segments, FormatMode, PostProcessOptions};
 use kon_audio::{
@@ -481,6 +482,7 @@ struct SpeechGateDecision {
 
 #[tauri::command]
 pub async fn start_live_transcription_session(
+    window: tauri::WebviewWindow,
     app: tauri::AppHandle,
     state: tauri::State<'_, AppState>,
     live_state: tauri::State<'_, LiveTranscriptionState>,
@@ -488,6 +490,7 @@ pub async fn start_live_transcription_session(
     result_channel: Channel<LiveResultMessage>,
     status_channel: Channel<LiveStatusMessage>,
 ) -> Result<StartLiveTranscriptionResponse, String> {
+    ensure_main_window(&window)?;
     let _lifecycle = live_state.lifecycle.lock().await;
     {
         let running = live_state.running.lock().unwrap();
@@ -586,10 +589,12 @@ pub async fn start_live_transcription_session(
 
 #[tauri::command]
 pub async fn stop_live_transcription_session(
+    window: tauri::WebviewWindow,
     app: tauri::AppHandle,
     live_state: tauri::State<'_, LiveTranscriptionState>,
     session_id: u64,
 ) -> Result<StopLiveTranscriptionResponse, String> {
+    ensure_main_window(&window)?;
     let _lifecycle = live_state.lifecycle.lock().await;
     let running = live_state.running.lock().unwrap().take();
     let Some(running) = running else {