feat(desktop): authorize client capabilities in managed sessions

apps/desktop/renderer-architecture.json

@@ -710,8 +710,8 @@
           "@maka/core/ui-locale": 1,
           "@maka/ui": 1
         },
-        "importSpecifiers": 23,
-        "nonTriviaTokens": 3041
+        "importSpecifiers": 21,
+        "nonTriviaTokens": 2974
       },
       "src/renderer/app-shell-session-settings-actions.ts": {
         "importDeclarations": 9,
@@ -1061,7 +1061,7 @@
           "react": 1
         },
         "importSpecifiers": 187,
-        "nonTriviaTokens": 15882
+        "nonTriviaTokens": 15855
       },
       "src/renderer/use-app-shell-composer-quotes.ts": {
         "importDeclarations": 3,

apps/desktop/src/main/__tests__/browser-origin-lease.test.ts

@@ -0,0 +1,41 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { BrowserOriginLeaseTracker } from '../browser/browser-origin-lease.js';
+
+test('a navigate lease allows the old page but only arms for its approved target', () => {
+  let url = 'https://old.example/';
+  const tracker = new BrowserOriginLeaseTracker(() => url);
+  const lease = tracker.open('https://approved.example/path', 'navigate');
+  assert.equal(lease.snapshot().violatedUrl, undefined);
+  assert.throws(
+    () => lease.startNavigation('https://other.example/path'),
+    /outside the approved Origin/u,
+  );
+
+  lease.startNavigation('https://approved.example/next');
+  url = 'https://approved.example/next';
+  tracker.recordNavigation(url);
+  assert.deepEqual(lease.snapshot(), {
+    epoch: 1,
+    url: 'https://approved.example/next',
+  });
+});

apps/desktop/src/main/__tests__/browser-session.test.ts

@@ -92,6 +92,13 @@ type HostSpy = {
 function installHost(overrides: Partial<BrowserViewHost> = {}): HostSpy {
   const spy: HostSpy = { resolved: [], released: [], disposed: [], host: null as never };
   const host: BrowserViewHost = {
+    currentUrl: () => "https://example.com/",
+    openOriginLease: () => ({
+      approvedOrigin: 'https://example.com',
+      startNavigation: () => {},
+      snapshot: () => ({ epoch: 0, url: 'https://example.com/' }),
+      release: () => {},
+    }),
     canDrive: () => true,
     resolveEndpoint: async (id) => {
       spy.resolved.push(id);