Update permissions for core process and services (#2112)

Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>

app/src-tauri/permissions/allow-core-process.toml

@@ -1,24 +1,28 @@
 [[permission]]
 identifier = "allow-core-process"
-description = "Core RPC URL, sidecar restart, dictation hotkey, webview-account, and gmail-CDP commands"
+description = "Privileged desktop permissions for core process control, service management, dictation, account webview, window/UI, screen share, notifications, Gmail CDP, log access, Meet, and CEF/profile maintenance"
 
 [permission.commands]
+
 allow = [
+
+    # =========================
+    # CORE PROCESS
+    # =========================
     "core_rpc_url",
     "core_rpc_token",
-    "restart_core_process",
     # `start_core_process` is invoked by BootCheckGate after the user picks
     # Local mode, before redux-persist hydrates the rest of the app (#1316).
     # Without this allow entry the invoke is rejected with "Command not
     # found" and the boot gate stalls.
     "start_core_process",
+    "restart_core_process",
     # `restart_app` triggers `app.restart()` so CEF re-initializes against
     # the active user's `users/<id>/cef` profile after an identity flip
     # (#900). Without this allow entry, the invoke is silently denied by
     # Tauri capabilities and webviews keep the prior user's third-party
     # cookies.
     "restart_app",
-    "schedule_cef_profile_purge",
     # `get_active_user_id` reads `~/.openhuman/active_user.toml` so the
     # frontend can prime `userScopedStorage` from the Rust source of truth
     # BEFORE redux-persist hydrates — the prior `localStorage`-only seed
@@ -26,25 +30,49 @@ allow = [
     # restart-driven flips, causing a false re-flip and restart loop on
     # every login. (#900)
     "get_active_user_id",
+
+    # =========================
+    # SERVICE MANAGEMENT
+    # =========================
     "service_install_direct",
     "service_start_direct",
     "service_stop_direct",
     "service_status_direct",
     "service_uninstall_direct",
+
+    # =========================
+    # DICTATION
+    # =========================
     "register_dictation_hotkey",
     "unregister_dictation_hotkey",
+
+    # =========================
+    # ACCOUNT WEBVIEW
+    # =========================
     "webview_account_open",
     "webview_account_close",
-    "webview_account_purge",
+    "webview_account_show",
+    "webview_account_hide",
     "webview_account_bounds",
     "webview_account_reveal",
-    "webview_account_hide",
-    "webview_account_show",
+    "webview_account_purge",
     "webview_recipe_event",
+
+    # =========================
+    # WINDOW / UI
+    # =========================
     "activate_main_window",
+
+    # =========================
+    # SCREEN SHARE
+    # =========================
     "screen_share_begin_session",
     "screen_share_thumbnail",
     "screen_share_finalize_session",
+
+    # =========================
+    # NOTIFICATIONS
+    # =========================
     # Native notification surface (see src/native_notifications/). The
     # frontend bridge in app/src/lib/nativeNotifications/tauriBridge.ts
     # calls these directly instead of routing through the bundled
@@ -55,6 +83,10 @@ allow = [
     "notification_permission_state",
     "notification_permission_request",
     "show_native_notification",
+
+    # =========================
+    # GMAIL CDP
+    # =========================
     # Gmail-CDP surface (see app/src-tauri/src/gmail/). Drives the
     # logged-in Gmail webview through DOMSnapshot + Input events. Used
     # by onboarding's LinkedIn-enrichment pipeline today and by future
@@ -67,6 +99,10 @@ allow = [
     "gmail_trash",
     "gmail_add_label",
     "gmail_find_linkedin_profile_url",
+
+    # =========================
+    # LOGS
+    # =========================
     # Surface the embedded core's daily-rotated log directory
     # (`<data_dir>/logs/`) so the Settings → Developer Options panel can
     # show users the path and reveal it in the platform file manager when
@@ -74,11 +110,21 @@ allow = [
     # backing commands.
     "logs_folder_path",
     "reveal_logs_folder",
+
+    # =========================
+    # GOOGLE MEET
+    # =========================
     # Meet call: open / close a dedicated CEF webview window pointed at a
     # https://meet.google.com/<code> URL with an isolated per-call data
     # directory. Surfaced from Intelligence > Calls. Without these allow
     # entries the invoke is rejected with "Command not found".
     "meet_call_open_window",
     "meet_call_close_window",
+
+    # =========================
+    # CEF / PROFILE
+    # =========================
+    "schedule_cef_profile_purge",
 ]
+
 deny = []