Tauri Native Api Integration Skill

Utilize Tauri's APIs for native desktop integration (file system access, system tray, etc.).
Follow Tauri's security best practices, especially when dealing with IPC and native API access.
Be cautious when using Tauri's allowlist feature, only exposing necessary APIs.

Iron Laws

NEVER expose all Tauri commands without an allowlist — use explicit permission-based access
ALWAYS validate all IPC inputs on the Rust side — never trust the frontend
NEVER perform synchronous I/O in Tauri command handlers — always use async
ALWAYS use tauri-specta to generate TypeScript types from Rust structs for type safety
NEVER transfer large data synchronously over IPC — use streaming or chunking

Anti-Pattern	Why It Fails	Correct Approach
No command allowlist	All Rust functions exposed to frontend; attack surface maximized	Allowlist only specific commands needed by the frontend
Trusting frontend input	Malicious payloads can exploit Rust code	Validate and sanitize all IPC inputs on the Rust side
Synchronous I/O in commands	Blocks the Tauri event loop; UI freezes	Use async Rust for all I/O operations in command handlers
Missing TypeScript types	Runtime type mismatches between Rust and frontend	Use tauri-specta to generate TypeScript types from Rust structs
Large synchronous data transfers	IPC bottleneck causes UI stuttering	Stream or chunk large data; avoid transferring full datasets over IPC

Before starting:

cat .claude/context/memory/learnings.md

After completing: Record any new patterns or exceptions discovered.

ASSUME INTERRUPTION: Your context may reset. If it's not in memory, it didn't happen.