openless

1,582 Commits 1 Branch 0 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
sim	34cab16fce	docs: 以源码为准重写 1-app 文档系统（19 篇）保留目录骨架与文件名，内容全部以当前源码为依据重写：范围与版本锚点（2.0.0-Beta.1 / crate 0.1.0 / com.openless.app）、架构分层与 Core 模块地图、桌面验收清单（功能域→源码入口→证据）、Linux 交接 8 篇（沿用 L01-L12 登记体系，锚点落到 settings.rs/audio.rs/ports.rs 等）、后端接口契约、Android 计划、运营指南 5 篇（以 provider descriptor 与实际 CSP/.gitmodules 为锚）。原过程中的计划叙述、截图与历史收口记录不再保留。	2026-09-07 13:48:29 +08:00
H-Chris233	717e694370	Constrain WebView loading with a minimal CSP The desktop WebView no longer runs with an unexplained disabled CSP. The policy keeps scripts self-hosted, permits Tauri IPC and local Vite development connections, keeps provider/update/model networking on the Rust side, and documents the only unsafe allowance for React inline styles used by the existing pixel-aligned UI. Constraint: Issue #226 requires csp:null to be replaced or explicitly bounded Constraint: Provider validation, updater checks, and model downloads are Rust-side paths, not frontend fetch allowlist entries Rejected: Keep csp:null with documentation only \| weaker defense-in-depth and leaves the WebView effectively unconstrained Confidence: high Scope-risk: narrow Directive: Do not add external provider domains to WebView connect-src unless a frontend fetch path is introduced Tested: npm run build Tested: npm run tauri -- info Tested: cargo check --manifest-path src-tauri/Cargo.toml	2026-05-08 12:00:09 +08:00

Author

SHA1

Message

Date

sim

34cab16fce

docs: 以源码为准重写 1-app 文档系统（19 篇）

保留目录骨架与文件名，内容全部以当前源码为依据重写：范围与版本锚点
（2.0.0-Beta.1 / crate 0.1.0 / com.openless.app）、架构分层与 Core 模块地图、
桌面验收清单（功能域→源码入口→证据）、Linux 交接 8 篇（沿用 L01-L12 登记体系，
锚点落到 settings.rs/audio.rs/ports.rs 等）、后端接口契约、Android 计划、
运营指南 5 篇（以 provider descriptor 与实际 CSP/.gitmodules 为锚）。
原过程中的计划叙述、截图与历史收口记录不再保留。

2026-09-07 13:48:29 +08:00

H-Chris233

717e694370

Constrain WebView loading with a minimal CSP

The desktop WebView no longer runs with an unexplained disabled CSP. The policy keeps scripts self-hosted, permits Tauri IPC and local Vite development connections, keeps provider/update/model networking on the Rust side, and documents the only unsafe allowance for React inline styles used by the existing pixel-aligned UI.

Constraint: Issue #226 requires csp:null to be replaced or explicitly bounded

Constraint: Provider validation, updater checks, and model downloads are Rust-side paths, not frontend fetch allowlist entries

Rejected: Keep csp:null with documentation only | weaker defense-in-depth and leaves the WebView effectively unconstrained

Confidence: high

Scope-risk: narrow

Directive: Do not add external provider domains to WebView connect-src unless a frontend fetch path is introduced

Tested: npm run build

Tested: npm run tauri -- info

Tested: cargo check --manifest-path src-tauri/Cargo.toml

2026-05-08 12:00:09 +08:00