[JJJ]

Summary

• add an opt-in macOS launcher for running Pasted against a caller-supplied local WebKit build
• propagate framework selection to the app and its XPC services, then fail closed unless vmmap confirms the requested WebKit loaded
• create a disposable, seeded demonstration database and start clipboard capture paused so recording cannot expose private history or the current clipboard
• keep release builds, ordinary launches, and the real Pasted library untouched
• document the development-only workflow and add a portable source-contract test

Validation

• npm run test:frontend
• npm run test:native
• node scripts/test-local-webkit-preview.js
• prior end-to-end launch against /private/tmp/WebKitBuild-live-resize/Release
• prior vmmap confirmation of the requested local framework
• prior lsof confirmation that the preview opened only the temporary demonstration database
• prior interrupt cleanup confirmation for the preview database, Pasted, and Vite

The local WebKit build used for the earlier end-to-end validation is no longer present, so this reconciliation did not repeat that manual run.

Supersedes #306 after renaming the branch to use the repository-neutral eng/ prefix.

[Copilot]

🔵 Needs a closer look

The debug-only preview database override is not validated/fail-closed, so a mis-set env var could still open/modify a real library, undermining the stated privacy-safety guarantees.

Pull request overview

Adds a development-only macOS launcher flow to run Pasted against a caller-supplied local WebKit build while isolating data and pausing capture for safer recordings, plus portable contract checks and documentation.

Changes:

• Adds a debug-only database override via PASTED_PREVIEW_DATABASE_PATH and starts the clipboard monitor paused when that override is active.
• Introduces a macOS-only launcher script that builds the debug app/CLI, seeds a temporary demo database, launches with local WebKit loader paths, and verifies the loaded WebKit via vmmap.
• Wires the launcher into package.json, adds a portable source-contract test, and documents the workflow.

File summaries

File	Description
src-tauri/src/clipboard_monitor.rs	Adds an initially_paused parameter to start capture paused for preview runs.
src-tauri/src/app_runtime.rs	Supports debug-only preview DB selection and passes “start paused” into the clipboard monitor.
scripts/run-with-local-webkit.sh	New macOS launcher for local WebKit builds with vmmap verification and temp demo DB seeding/cleanup.
scripts/test-local-webkit-preview.js	Adds a portable contract test ensuring the launcher’s key safety/verification steps remain present.
package.json	Adds dev:local-webkit and includes the new contract test in test:platform.
docs/LOCAL_WEBKIT_PREVIEW.md	Documents the local WebKit preview workflow and its safety properties.

Review details

Suppressed comments (1)

src-tauri/src/app_runtime.rs:12

• PASTED_PREVIEW_DATABASE_PATH is treated as a trusted PathBuf in debug builds. If it is set incorrectly (relative path, or pointing at the user's real library), the app will silently open/modify that database, which undermines the PR's "privacy-safe" and "fail closed" goals. Consider validating the env var and failing closed unless it points at the script-managed pasted-local-webkit.* temp directory.

pub(crate) fn exit_requested() -> bool {
    EXIT_REQUESTED.load(Ordering::SeqCst)
}

• Files reviewed: 8/8 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[JJJ]

Addressed the preview-database safety concern in 6ae3f66.

The debug override now fails closed unless the supplied path:

• is absolute and ends in pasted.db;
• resolves directly beneath the canonical system temporary directory in a pasted-local-webkit.* directory;
• already exists as a regular, non-symlink file; and
• does not resolve outside that temporary directory.

An invalid override now aborts application setup instead of falling back to the ordinary Pasted library. I verified both paths locally: the script-managed preview still launches against the requested WebKit, while an unmanaged path exits before opening a database. npm run test:frontend, the GUI cargo check, formatting, and diff checks pass.