[[permission]]
identifier = "allow-core-process"
description = "Core RPC URL, sidecar restart, dictation hotkey, webview-account, and gmail-CDP commands"

[permission.commands]
allow = [
    "core_rpc_url",
    "core_rpc_token",
    "restart_core_process",
    # `start_core_process` is invoked by BootCheckGate after the user picks
    # Local mode, before redux-persist hydrates the rest of the app (#1316).
    # Without this allow entry the invoke is rejected with "Command not
    # found" and the boot gate stalls.
    "start_core_process",
    # `restart_app` triggers `app.restart()` so CEF re-initializes against
    # the active user's `users/<id>/cef` profile after an identity flip
    # (#900). Without this allow entry, the invoke is silently denied by
    # Tauri capabilities and webviews keep the prior user's third-party
    # cookies.
    "restart_app",
    "schedule_cef_profile_purge",
    # `get_active_user_id` reads `~/.openhuman/active_user.toml` so the
    # frontend can prime `userScopedStorage` from the Rust source of truth
    # BEFORE redux-persist hydrates — the prior `localStorage`-only seed
    # was bound to the per-user CEF profile dir and went stale across
    # restart-driven flips, causing a false re-flip and restart loop on
    # every login. (#900)
    "get_active_user_id",
    "service_install_direct",
    "service_start_direct",
    "service_stop_direct",
    "service_status_direct",
    "service_uninstall_direct",
    "register_dictation_hotkey",
    "unregister_dictation_hotkey",
    "webview_account_open",
    "webview_account_close",
    "webview_account_purge",
    "webview_account_bounds",
    "webview_account_reveal",
    "webview_account_hide",
    "webview_account_show",
    "webview_recipe_event",
    "activate_main_window",
    "screen_share_begin_session",
    "screen_share_thumbnail",
    "screen_share_finalize_session",
    # Native notification surface (see src/native_notifications/). The
    # frontend bridge in app/src/lib/nativeNotifications/tauriBridge.ts
    # calls these directly instead of routing through the bundled
    # tauri-plugin-notification (whose desktop permission_state is
    # hardcoded to Granted, see #1152). Without these allow entries the
    # invokes return "Command not found" and the UI falsely reports the
    # OS as denied.
    "notification_permission_state",
    "notification_permission_request",
    "show_native_notification",
    # Gmail-CDP surface (see app/src-tauri/src/gmail/). Drives the
    # logged-in Gmail webview through DOMSnapshot + Input events. Used
    # by onboarding's LinkedIn-enrichment pipeline today and by future
    # agent tools.
    "gmail_list_labels",
    "gmail_list_messages",
    "gmail_search",
    "gmail_get_message",
    "gmail_send",
    "gmail_trash",
    "gmail_add_label",
    "gmail_find_linkedin_profile_url",
    # Surface the embedded core's daily-rotated log directory
    # (`<data_dir>/logs/`) so the Settings → Developer Options panel can
    # show users the path and reveal it in the platform file manager when
    # collecting support bundles. Read-only; no writes occur in the
    # backing commands.
    "logs_folder_path",
    "reveal_logs_folder",
    # Meet call: open / close a dedicated CEF webview window pointed at a
    # https://meet.google.com/<code> URL with an isolated per-call data
    # directory. Surfaced from Intelligence > Calls. Without these allow
    # entries the invoke is rejected with "Command not found".
    "meet_call_open_window",
    "meet_call_close_window",
]
deny = []