chore(hardening): tighten security and footprint defaults

src-tauri/src/lib.rs

@@ -129,7 +129,6 @@ pub fn run() {
         .plugin(tauri_plugin_opener::init())
         .plugin(tauri_plugin_dialog::init())
         .plugin(tauri_plugin_global_shortcut::Builder::new().build())
-        .plugin(tauri_plugin_updater::Builder::new().build())
         // Phase 5 rituals: autostart. The plugin registers JS-facing
         // commands (isEnabled / enable / disable) that the Settings
         // toggle and first-run prompt invoke directly — no bespoke
@@ -177,8 +176,11 @@ pub fn run() {
                 {
                     main_window
                         .with_webview(|webview| {
+                            use webkit2gtk::glib::prelude::Cast;
                             use webkit2gtk::{
-                                PermissionRequest, PermissionRequestExt, SettingsExt, WebViewExt,
+                                PermissionRequest, PermissionRequestExt, SettingsExt,
+                                UserMediaPermissionRequest, UserMediaPermissionRequestExt,
+                                WebViewExt,
                             };
 
                             let wv: webkit2gtk::WebView = webview.inner().clone();
@@ -189,11 +191,25 @@ pub fn run() {
                                 settings.set_enable_media_capabilities(true);
                             }
 
-                            // Auto-grant all permission requests (audio/video capture)
+                            // Auto-grant microphone capture only. Other WebKitGTK
+                            // permission requests are denied so future surfaces do
+                            // not inherit camera/geolocation/pointer-lock access.
                             WebViewExt::connect_permission_request(
                                 &wv,
                                 |_wv, request: &PermissionRequest| {
-                                    request.allow();
+                                    if let Ok(media) =
+                                        request.clone().downcast::<UserMediaPermissionRequest>()
+                                    {
+                                        if media.is_for_audio_device()
+                                            && !media.is_for_video_device()
+                                        {
+                                            request.allow();
+                                        } else {
+                                            request.deny();
+                                        }
+                                    } else {
+                                        request.deny();
+                                    }
                                     true
                                 },
                             );
@@ -236,11 +252,6 @@ pub fn run() {
                 llm_engine: Arc::new(LlmEngine::new()),
             });
 
-            {
-                let whisper = app.state::<AppState>().whisper_engine.clone();
-                crate::commands::models::prewarm_default_model(whisper);
-            }
-
             // Runtime-warning banner: push CPU-feature + Vulkan-loader
             // fallbacks to the frontend so Settings can render a one-line
             // hint. No-ops on a fully-supported box.
@@ -260,6 +271,7 @@ pub fn run() {
             commands::models::check_model,
             commands::models::list_models,
             commands::models::load_model,
+            commands::models::prewarm_default_model_cmd,
             commands::models::check_engine,
             commands::models::get_runtime_capabilities,
             // Local LLM management