Part of #26
The invite link's Copy did nothing in the built app and every suite was green: Playwright's WebKit lets navigator.clipboard.writeText through from a localhost page, and the real WKWebView refuses it (wry never sets javaScriptCanAccessClipboard), so the editor's own path said "The link is copied." in the specs and the clipboard stayed empty in the app. Fixed for the clipboard in 0e458dd and 10e9e72 by a seam to the backend. Anything a page asks the browser for rather than the backend is untested by construction here, and the same shape will come back: window.open, permission prompts, a native image drag (a Playwright drag never starts WebKit's, so a spec for "dragged by its picture" stayed green with draggable removed), screen capture.
Done when CLAUDE.md, beside "nothing drives the real app", carries the rule and the list: a web API the page needs goes through frontend/src/backend/tauri.js and the fake, never straight to the browser, with the APIs known to differ between Playwright's WebKit and WKWebView named, the clipboard first; and docs/ has the one way found so far to see the real window from a shell (a small logging server set as the index, read by the User-Agent of who asked, and a --config that widens one CSP directive and leaves the tree alone), so the next person does not find it again.
Done in 9ba7c6d. CLAUDE.md carries the rule beside "nothing drives the real app": a web API the UI needs is a method of
frontend/src/backend/tauri.jsand the fake, never a call to the browser, with the APIs known to differ named, the clipboard first.docs/the-real-window.mdhas the probe: the app built with a page of one's own as its index and a--configwidening onlyconnect-srcto a small logging server that prints each request's User-Agent (the app's window has noVersion/Safaritoken). Run verbatim against the real app:window.openisnullthere and aWindowin Playwright's WebKit;writeTextwith no gesture is refused in both, so the clipboard differs only after a press, which has to be made by hand in the app. PointingdevUrlat the probe is listed as not working: the page is then athttp://127.0.0.1with no CSP applied.The native drag is listed from the sighting in this ticket, not probed; permission prompts and screen capture are named as not yet probed.