From f7af7b07bb9bc5179106605972542e3273a579b3 Mon Sep 17 00:00:00 2001 From: Jake Date: Wed, 13 May 2026 18:02:23 +0100 Subject: [PATCH] =?UTF-8?q?agent:=20code-atomiser-fix=20=E2=80=94=20main-w?= =?UTF-8?q?indow=20guard=20on=20extract=5Fcontent=5Ftags=5Fcmd=20(Trust-4)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `extract_content_tags_cmd` was the only LLM command in `commands/llm.rs` that did not call `ensure_main_window`. Every sibling (`load_llm_model`, `unload_llm_model`, `delete_llm_model`, `test_llm_model`, `cleanup_transcript_text_cmd`, `download_llm_model`) gates on it. Without the guard a secondary-window webview could trigger a multi- second llama.cpp inference run, blocking the LLM engine for the main window and leaking model-inferred tags out of the History page's trust boundary. This change: - adds a `window: tauri::WebviewWindow` parameter (Tauri injects it automatically — `HistoryPage.svelte`'s `invoke("extract_content_tags_cmd", …)` call site is unchanged and `npm run check` is clean); - calls `ensure_main_window(&window)?` before the engine check so the rejection is fast and the cap mirrors the rest of the surface. Behaviour is otherwise identical: same engine path, same spawn_blocking, same App-Nap power assertion. The shared `ensure_main_window_label` test in `commands::security` already covers the secondary-window rejection behaviour; no command-level scaffolding for handler-style tests exists in this codebase, so introducing one for a single new line was out of scope. Co-Authored-By: Claude Opus 4.7 (1M context) --- src-tauri/src/commands/llm.rs | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src-tauri/src/commands/llm.rs b/src-tauri/src/commands/llm.rs index 970d43e..5c820e2 100644 --- a/src-tauri/src/commands/llm.rs +++ b/src-tauri/src/commands/llm.rs @@ -412,11 +412,19 @@ pub async fn cleanup_transcript_text_cmd( /// synchronous llama-cpp inference) is wrapped in spawn_blocking so it /// does not stall the Tauri runtime, with the same App-Nap power /// assertion the other LLM commands use. +/// +/// Trust-4 (conf 85, code-atomiser-fix 2026-05-12): added the +/// `ensure_main_window` guard that every other command in this file +/// already enforces. The `window: tauri::WebviewWindow` parameter is +/// injected by Tauri automatically — frontend invoke call sites +/// (HistoryPage) do not need updating. #[tauri::command] pub async fn extract_content_tags_cmd( + window: tauri::WebviewWindow, state: State<'_, AppState>, transcript: String, ) -> Result { + ensure_main_window(&window)?; if !state.llm_engine.is_loaded() { return Err("LLM not loaded. Download an AI model in Settings.".to_string()); }