3.3 KiB
Native browser tabs
The privileged Electron process owns each tab's UUID, WebContentsView, navigation history and security state. The trusted shell renders snapshots and invokes fixed operations; it never allocates tab identities or reloads a URL merely to select a tab. All site views remain sandboxed, without Node or a bridge to management IPC.
managed:tab-create, managed:tab-activate, managed:tab-close and managed:tab-group return authoritative browser state. Navigation accepts {url, tabId} so an address submission is bound to its selected native tab. Group edits repeat centrally managed library permissions in the privileged process. Every state snapshot carries a monotonic tabsRevision; the shell rejects delayed responses older than the state already displayed.
A new tab starts as a guarded blank view. Its native clipboard primitive guard is installed before website navigation. The last tab closes its actual contents and is replaced with a new guarded start page. Switching tabs preserves document state and history. The shared managed browsing session keeps the existing company cookie/session behavior; separate tabs are not separate identity containers.
Network enforcement belongs to the managed session and identifies the originating native contents. Background requests therefore pass the same DLP and policy gates. Clipboard operations, vault fill and other foreground actions need the current tab context; the trusted shell does not expose arbitrary JavaScript or CDP to pages or agents.
Verified evidence
Run node scripts/native-tabs-smoke.mjs for the isolated Windows/Electron proof using the actual production main process. It verifies:
- Two distinct native contents through real chrome New Tab, address submission and tab selection.
- Preserved input values and scroll position, with a receiver counter proving that selection does not reload the original page.
- Independent back histories. Controlled link activation uses Electron's user-gesture flag, matching Chromium's rule that unactivated programmatic history entries may be skipped by Back.
- Secret POST blocking and denied page clipboard writes in both foreground and background contents.
- No Node or privileged bridge in either remote website.
- Destruction of closed contents and a guarded replacement when the last tab closes.
- Central device revocation followed by denied public POST attempts from both surviving views. The controlled receiver records no blocked POST.
The proof writes artifacts/native-tabs-proof.json, artifacts/native-tabs-receiver-proof.json and a screenshot. Private CDP guards are detached only after all assertions, when the test exits; the fixture does not weaken production enforcement. It never writes to the OS clipboard.
node scripts/ui-showcase.cjs separately verifies the real chrome renderer with a clearly synthetic native-state fixture: eight light/dark/compact/settings/sidebar/vault captures, live policy locks and hidden settings, and delayed navigation while creating a new tab. This showcase is visual evidence, not evidence of native website enforcement.
Persistent session restoration, separate identity containers, tab drag/reordering and performance suspension of inactive tabs remain separate future work. File/data-pipe upload limitations and other documented DLP coverage boundaries still apply to every tab.