BigDataDZ
080304987c
Part of the #3522 docs-verification campaign (Sandbox and privacy group). All four documents were checked claim-by-claim against the code; the group is in good shape and needed only targeted corrections: - workspace-privacy-context: the cited example file runtime-host-search-ipc-main.ts was removed by #5531 — replaced with the live queryRuntimePolicy consumer runtime-host-settings-ipc-main.ts; last_verified refreshed (content changed via #5742). - permission-onboarding-plan: the permissions-actions.ts line reference pointed at a pre-ASF-header line number (now a type-union member); it now cites the deep-link/openExternal block (lines 61-90). - windows-sandbox-rfc (EN+ZH): the §6.5 status date corrected to the #3722 merge date (2026-08-25); the "typed unavailable reasons are deferred" wording now distinguishes the readiness-probe-level collapse from the transform layer, which already emits unsupported_platform / backend_not_available / invalid_request; last_verified refreshed. Refs #3522 Generated-by: ZCode
3.4 KiB
doc_id, title, language, source_language, implementation_status, document_status, translation_status, last_verified, owners
| doc_id | title | language | source_language | implementation_status | document_status | translation_status | last_verified | owners | |
|---|---|---|---|---|---|---|---|---|---|
| workspace-privacy-context | Workspace privacy context | en | en | current | current | source-only | 2026-10-10 |
|
Workspace privacy context
WorkspacePrivacyContext is the shared contract for privacy-sensitive operations. Its current shape is deliberately small:
export interface WorkspacePrivacyContext {
incognitoActive: boolean;
}
Authority
The Runtime Host owns the effective workspace privacy state as runtime policy. Renderers may request a change and display the current value, but a renderer-provided value is never proof of the effective state.
The current authority path is:
apps/desktop/src/renderer/settings/general-settings-page.tsxrequests settings changes.- The effective state is the Runtime Host runtime policy:
packages/core/src/runtime-policy.tsdeclares the readonlyprivacy.incognitoActivefield and defaults it tofalse; patches are validated by the policy codec'sprivacy patchrecord rule. - Desktop surfaces resolve the effective state from the policy via
queryRuntimePolicy()(for exampleapps/desktop/src/main/runtime-host-settings-ipc-main.ts), and core-boundary consumers validate the projected context throughvalidateWorkspacePrivacyContext()(packages/core/src/incognito.ts) before reading any field.
Runtime Host omits notification attention from Session catalog changes while its privacy policy is active or cannot be read. Desktop does not use the local settings store to decide Host privacy.
validateWorkspacePrivacyContext() rejects malformed input; it never converts missing or invalid data to false. Boundaries that cannot resolve a valid authoritative context must fail closed.
Consumer rule
incognitoActive: false only means that incognito mode did not block the operation. It is not general permission to read, write, search, capture, or transmit data. Every consumer must still apply its own settings, permission, and retention rules.
When incognitoActive is true, each privacy-sensitive consumer defines a fail-closed result at its existing main-process boundary. The Runtime Host composition, the desktop main-process consumers, and their focused tests own the current inventory. Do not duplicate that inventory here, add another incognito flag, copy the state into a parallel store, or let a renderer self-attest.
Contract changes
Adding fields, changing scope, or changing default semantics is a cross-cutting contract change. Update the core type and validator, main-process authority path, every consumer, tests, and this document together.