From 7621aa77fce339cee9dbb2b79797431a8c77434b Mon Sep 17 00:00:00 2001
From: Keep-Silence <keep137950@163.com>
Date: Fri, 18 Sep 2026 09:28:23 +0800
Subject: [PATCH] fix(security): allow notifications permission from the
 harness window

The allowlist only covered clipboard-sanitized-write, so notification
permission requests from the harness page could not be granted. The
loopback main-frame checks are unchanged, so the trust boundary is the
same.
---
 src/main/security-policy.ts |  2 +-
 test/runtime.test.ts        | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/src/main/security-policy.ts b/src/main/security-policy.ts
index 96186834a..3f4e99ec0 100644
--- a/src/main/security-policy.ts
+++ b/src/main/security-policy.ts
@@ -26,7 +26,7 @@ export function canGrantWindowPermission(
   isMainFrame: boolean
 ): boolean {
   return (
-    permission === 'clipboard-sanitized-write' &&
+    (permission === 'clipboard-sanitized-write' || permission === 'notifications') &&
     isMainFrame &&
     requestingUrl !== undefined &&
     isHarnessUrl(requestingUrl)
diff --git a/test/runtime.test.ts b/test/runtime.test.ts
index 623d7ff72..e1a7dc4e1 100644
--- a/test/runtime.test.ts
+++ b/test/runtime.test.ts
@@ -605,6 +605,28 @@ describe('navigation trust boundary', () => {
       canGrantWindowPermission('clipboard-sanitized-write', 'file:///tmp/app.html', true)
     ).toBe(false)
   })
+
+  it('only grants notifications from the trusted main frame', () => {
+    expect(
+      canGrantWindowPermission('notifications', 'http://127.0.0.1:43127/session', true)
+    ).toBe(true)
+    expect(
+      canGrantWindowPermission('notifications', 'http://localhost:43127/session', true)
+    ).toBe(true)
+    expect(
+      canGrantWindowPermission('notifications', 'http://127.0.0.1:43127/session', false)
+    ).toBe(false)
+    expect(
+      canGrantWindowPermission('notifications', 'https://example.com/session', true)
+    ).toBe(false)
+    expect(
+      canGrantWindowPermission('notifications', 'https://127.0.0.1:43127/session', true)
+    ).toBe(false)
+    expect(canGrantWindowPermission('notifications', 'file:///tmp/app.html', true)).toBe(
+      false
+    )
+    expect(canGrantWindowPermission('notifications', undefined, true)).toBe(false)
+  })
 })
 
 describe('Harness window activation', () => {