Module devtools 

DevTools policy: every Right app has no access to DevTools; ViewRight alone may inspect the HTML content it opens.

The owner’s fixed design, verbatim: every Right app has absolutely NO access to DevTools, blocked at each and every level that is possible, for the app, its shell and its own UI. The single exception is ViewRight: it opens HTML documents, and DevTools must be available INSIDE that opened HTML content only (the content frame), never for ViewRight’s own UI or shell.

Two values exist, DevToolsPolicy::Denied (the default) and DevToolsPolicy::ContentOnly (a named allowance an app must request explicitly). Under both, every webview the shell sees is made non-inspectable unless the app registered it as a content webview (ContentWebview) and the policy is ContentOnly.

Layers (see README “DevTools policy” for what each can and cannot block):

1. guard_process_start: refuses a remote-debugging launch argument, removes the WebView2 environment overrides, and refuses a machine policy that injects debugging browser arguments (Windows).
2. Native per-webview settings (apply_native): isInspectable / developerExtrasEnabled (macOS), AreDevToolsEnabled, accelerator keys and the context-menu Inspect item (Windows).
3. The injected hardening script (keyboard shortcuts), in crate::harden.
4. verify_not_remote_debuggable: a post-creation tripwire for a live remote-debugging port.

Development builds are the one deliberate hole: with the off-by-default dev-inspect cargo feature compiled in, every webview is inspectable and the guards above stand down (see DEV_INSPECT_COMPILED). Such a build carries DEV_INSPECT_MARKER, and right-release refuses to seal or upload a release or update build that contains it.

Everything that decides (argument and environment scanning, registry output, content registration, capability checks) is a plain function so it is testable without a GUI.

Structs

ContentWebview

A webview that renders opened content and may be inspected under DevToolsPolicy::ContentOnly.

DevToolsGate

Which webviews are inspectable. Built once at startup and kept in Tauri state.

GuardReport

The result of guard_process_start.

KeyModifiers

The modifier keys held while a key went down.

KeyRules

Which groups of browser keys one webview does not act on. Each group is switched by one rule: devtools by the DevTools decision (a denied webview), the others by the hardening options of the same name. A key in no active group is left to the browser.

RegValue

One string value of a registry key.

Enums

DevToolsError

A refusal. Every variant is fatal at startup; there is no inspectable fallback.

DevToolsPolicy

Who may use DevTools. Exactly two values.

PolicyKeyOpen

What opening a policy key means for the guard, from the status RegOpenKeyExW returned.

WebviewDecision

What the shell does to one webview.

Constants

CONTENT_ONLY_MARKER

Bytes a binary carries when it was built with the content-devtools feature. right-release accepts Tauri’s devtools code in a binary only if this marker is present and the app is on the allow-list (packages/release/devtools-policy.json). Keep identical to CONTENT_ONLY_MARKER in packages/release/devtools-policy.mjs.

DEBUG_PORT_FILE

The file name Chromium writes into the user data folder when remote debugging is on.

DEV_INSPECT_COMPILED

True when this build was compiled with the dev-inspect feature: developer inspection is active.

DEV_INSPECT_MARKER

Bytes that appear in every binary built with the dev-inspect feature, and in no other. right-release scans Mach-O, PE and ELF files for exactly this string and refuses to seal or upload a release or update tier build that has it. Keep identical to DEV_INSPECT_MARKER in packages/release/qa-control-scan.mjs. Code outside the dev-inspect feature must never reference this constant at run time (it would put the string into every binary that links the shell).

OWNER_DECISION

The owner’s decision, stated verbatim. Do not edit or soften.

Traits

DevToolsSwitch

The native DevTools setting of one webview, as enforce_switch needs it.

Functions

apply_native

Apply the DevTools decision to one live webview. Runs for every webview, whatever other hardening modules the app opted out of.

argv_violations

Launch arguments that carry a debugging switch.

build_gate

Validate the policy and the content registrations and build the gate. devtools_compiled is cfg!(feature = "content-devtools") in the shell; it is a parameter so tests can cover both.

build_gate_with

build_gate plus the dev-inspect switch (DEV_INSPECT_COMPILED in the shell). With dev_inspect the registrations are still validated as before (a misconfiguration surfaces in development, not only in the release build), Tauri’s devtools count as compiled (the feature enables them), and the gate allows every webview.

capability_granting_ipc

The identifier of the first capability in doc that applies to the webview and grants permissions. A capability applies when one of its webviews patterns matches the webview label or one of its windows patterns matches the label of the window that hosts the webview. webview_label may be a content prefix pattern (html-content-*); overlap is judged conservatively.

decode_reg_text

The text of a registry value from its type and raw bytes (UTF-16LE), or None for a type that holds no text (a number or binary data cannot carry a browser argument). The strings of a REG_MULTI_SZ are joined with spaces; the terminating NULs are dropped.

enforce_switch

Set the native DevTools switch for decision. A denied webview is accepted only when the switch was set to off and reads back off; a missing settings object, a failed call or a value that is still on is DevToolsError::NativePolicyNotApplied. A webview that may be inspected is never refused here: failing to turn inspection on is not a security failure.

env_vars_to_scrub

Names (as spelled in names) of the environment variables to remove from the process. Matching ignores ASCII case: Windows environment names are case-insensitive.

expand_env_refs

text with every %NAME% that env knows replaced by its value. An unknown name and a lone % stay as they are.

forbidden_switches_in

The debugging switches found in args (a command line or an AdditionalBrowserArguments string): remote debugging port, pipe, address and allowed origins, auto-open DevTools, the Edge remote-debugging flag, and --js-flags that enable the V8 inspector.

glob_match

* matches any run, ? one character: the glob subset Tauri capability patterns use.

guard_process_start

Process-start guard. Call it first in main (before Tauri builds anything) to fail before any webview exists; the shell plugin also runs it when it is constructed and refuses to set up when it failed. Idempotent: the first result is returned on every call.

is_blocked_accelerator

Whether a webview with rules must not act on this key (a Windows virtual-key code). Find, print and every key outside the active groups always pass.

is_live_debug_port_file

A port file older than the process (by more than 2 s) is a leftover of an earlier run.

live_debug_port_file

A live remote-debugging port file under any of dirs (or under <dir>/EBWebView).

open_content_devtools

Open the inspector of a registered content webview. The only path from this crate to an open inspector; every other webview is refused.

patterns_may_overlap

Could any label match both patterns? Conservative: patterns are compared by their literal head (the text before the first wildcard), and heads that are prefixes of one another overlap.

policy_user_data_dirs

The user data folders the WebView2 UserDataFolder policy names for this program, with environment references expanded. The browser writes its port file there, not in the folder the application chose, so the tripwire has to look there too.

policy_value_applies

Whether a WebView2 policy value named name applies to the program whose executable file is exe_name: the name is * (every application) or this program’s executable file name, compared without regard to case. Every other name belongs to another program. When this program’s own file name is unknown, every value is taken to apply.

policy_violations

Errors for every value of a policy key that injects a debugging switch. A value named for a different application is still refused: an administrator-set debugging policy is never normal.

register_user_data_dir

Tell the tripwire about a user data folder the application gives a webview itself (Tauri’s data_directory). Call it before the webview is created. The folders a policy or the WebView2 user-data environment variable names are added by guard_process_start.

runtime_folder_env_name

The name of the environment variable that makes WebView2 start a browser from another folder.

runtime_folder_env_violation

The refusal for that variable’s value in the process environment at start, if it is set to anything. A launcher controls the environment as it controls policy, so it is refused the same way.

runtime_folder_violations

Errors for every value of the WebView2 BrowserExecutableFolder policy that applies to this program. Such a value makes WebView2 start whatever browser is in that folder, with every argument and behaviour that browser was built with, so nothing this crate sets can be relied on.

verify_after_first_navigation

The tripwire once more, the first time a page has finished loading; later calls return Ok without looking. The browser process can write its port file after the webview is ready, which is when verify_not_remote_debuggable first runs.

verify_not_remote_debuggable

Post-creation tripwire (Windows): the browser process writes the port file while it starts, so a fresh file next to this process’s user data means a debugging port is open. A no-op elsewhere.