fix(desktop): restrict loopback origins to debug builds (MEET-11)

[eliotlim]

Problem

Release builds trusted http(s)://localhost|127.0.0.1 on ANY port as app origins; with the mic entitlement and wry 0.55.1's media-capture auto-grant, a co-resident local process could capture audio under OpenBook's TCC grant. Sasha finding from the MEET-8 review. Board: MEET-11.

Solution

is_app_origin → testable is_app_origin_for_build(url, is_debug); loopback arm returns is_debug. Release trusts only tauri://localhost + tauri.localhost; loopback navigations degrade to OpenExternal. Release provably needs no loopback navigation (managed sidecar = Tauri IPC over Unix sockets; TCP host-side Windows only; loopback fetches dev-gated). Rust-only, +52/−10.

Before / After

Behavior	Before	After
Release: navigate to http://127.0.0.1:NNNN	trusted in-webview (mic reachable)	opens in OS browser
Debug: dev loopback (:1420/:4319)	trusted	unchanged (tested matrix)

No visual change.

Test procedure

cargo test --locked (29 incl. both-policy matrix), app tests (9), pnpm verify green.

Operational notes

Defense-in-depth; next signed release picks it up — fold into the signed-build mic check.

---

Reviews: security (Sasha — her pre-endorsed finding, verified CLEAR at 9e3f680).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
app.book.pub	Skipped		Oct 6, 2026 2:31pm UTC