# Behavior traces — tauri-apps/tauri

> Canonical page: https://codevetter.com/unpack/tauri/behavior-traces

# Behavior traces — tauri-apps/tauri

Scanned commit 745b9a48aeb6e7f48d70adf3d043e6203de5bac6 (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Three flows were traced end-to-end. (1) App startup: user main → Builder → build(Context) → runtime event loop → Ready → setup hook → windows/webviews created. (2) IPC invoke: JS invoke() → injected ipc.js → postMessage or ipc:// POST → parse → invoke_key check → ACL resolve → plugin or app handler → eval/Channel response. (3) CLI dev: cargo-tauri → Commands::Dev → config load → beforeDevCommand spawn → dev-server wait → cargo run under a file watcher that rebuilds on change.
- Startup trace: `main()` calls `api_lib::run()` → `run_app(tauri::Builder::default(), ...)` chains `.plugin(tauri_plugin_log...)`, `.plugin(tauri_plugin_sample::init())`, `.setup(...)` → `.run(tauri::generate_context!())`. — [examples/api/src-tauri/src/main.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/examples/api/src-tauri/src/main.rs) [examples/api/src-tauri/src/lib.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/examples/api/src-tauri/src/lib.rs)
- Startup trace (cont.): `App::run` sets the event-loop main_thread_id and calls `runtime.run(make_run_event_loop_callback)`; on `RuntimeRunEvent::Ready` the stored `setup(&mut app)` hook runs (panic on error), then `on_event_loop_event` translates the runtime event into a public `RunEvent` delivered to the user callback. — [crates/tauri/src/app.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/src/app.rs)
- Startup trace (cont.): during build, `Builder` fields are seeded — `invoke_key` from `crate::generate_invoke_key()`, `invoke_initialization_script` rendered from the `scripts/ipc-protocol.js` template with process_ipc_message_fn, os_name and FETCH_CHANNEL_DATA_COMMAND. — [crates/tauri/src/app.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/src/app.rs) [crates/tauri/scripts/ipc-protocol.js](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/scripts/ipc-protocol.js)
- Context generation trace: build.rs `tauri_build::build()` → codegen `context_codegen(ContextData)` reads acl-manifests.json/capabilities.json from OUT_DIR, calls `Resolved::resolve(&acl, capabilities, target)`, embeds assets/icons, and the app includes the result via `tauri::generate_context!` or `tauri_build_context!` (OUT_DIR/tauri-build-context.rs). — [crates/tauri-codegen/src/context.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri-codegen/src/context.rs) [crates/tauri-build/src/lib.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri-build/src/lib.rs) [crates/tauri/src/lib.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/src/lib.rs)
- Invoke trace (JS side): `invoke(cmd, args)` → `window.__TAURI_INTERNALS__.invoke` (injected by scripts/ipc.js + ipc-protocol.js) → `process_ipc_message_fn` serializes args to JSON or octet-stream → postMessage or `ipc://` fetch with Tauri-* headers. — [packages/api/src/core.ts](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/packages/api/src/core.ts) [crates/tauri/scripts/ipc.js](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/scripts/ipc.js) [crates/tauri/scripts/process-ipc-message-fn.js](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/scripts/process-ipc-message-fn.js)
- Invoke trace (Rust side): `message_handler` → `handle_ipc_message` → deserialize `Message` → `webview.on_message(request, responder)` → verify `invoke_key` → build `InvokeResolver`/`InvokeMessage` → `runtime_authority.resolve_access` → if `plugin:` command, `run_plugin_invoke_handler`; else the app `invoke_handler` → responder callback → `format_callback` → `webview.eval` or `Channel::send`. — [crates/tauri/src/ipc/protocol.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/src/ipc/protocol.rs) [crates/tauri/src/webview/mod.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/src/webview/mod.rs) [crates/tauri/src/ipc/mod.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/src/ipc/mod.rs)
- ACL denial trace: when the command is a plugin command, the app has an ACL manifest, or the origin is remote, and `invoke.acl` is none, the resolver rejects — debug builds use `resolve_access_message` for a detailed reason, release builds send "Command <cmd> not allowed by ACL". — [crates/tauri/src/webview/mod.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/src/webview/mod.rs) [crates/tauri/src/ipc/authority.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/src/ipc/authority.rs)
- Asset request trace: `asset://localhost/<encoded>` → `get_response` → percent-decode path → `SafePathBuf::new` validation (403 on failure) → `scope.is_allowed` (403) → `tokio::fs::File::open` → mime sniff of first 8KiB → full body, HEAD, or range response. — [crates/tauri/src/protocol/asset.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/src/protocol/asset.rs)
- Dev flow trace: `main` → `tauri_cli::run` → `Commands::Dev` → `dev::command` → `command_internal` resolves Target + `get_config` → `AppInterface::new` → `dev::setup` spawns beforeDevCommand as a SharedChild, optionally starts the builtin dev server, and polls the devUrl TCP socket (90 attempts × 2s) → `interface.dev` → rust.rs `run_dev`/`run_dev_watcher`. — [crates/tauri-cli/src/main.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri-cli/src/main.rs) [crates/tauri-cli/src/lib.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri-cli/src/lib.rs) [crates/tauri-cli/src/dev.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri-cli/src/dev.rs) [crates/tauri-cli/src/interface/rust.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri-cli/src/interface/rust.rs)
- Dev teardown trace: `on_app_exit` decides whether to exit or keep watching; `kill_before_dev_process` writes kill-children.sh to the temp dir on Unix (or runs a PowerShell Kill-Tree on Windows) then kills the beforeDevCommand child. — [crates/tauri-cli/src/dev.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri-cli/src/dev.rs)
- Build/bundle trace: `Commands::Build` → `build::command` → `get_config` + AppInterface → cargo release build via the interface → `get_bundler_settings` → `tauri_bundler::bundle_project` → updater-enabled bundles post-processed for signatures. — [crates/tauri-cli/src/build.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri-cli/src/build.rs) [crates/tauri-cli/src/bundle.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri-cli/src/bundle.rs)
- Exit/restart trace: `AppHandle::restart`/`request_restart` set `manager.restart_on_exit`; on `RuntimeRunEvent::Exit` the callback runs user handler → `cleanup_before_exit()` → `crate::process::restart(&self.env())` when the flag is set; ExitRequested can be vetoed via `ExitRequestApi::prevent_exit` unless code == RESTART_EXIT_CODE (i32::MAX). — [crates/tauri/src/app.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/src/app.rs) [crates/tauri/src/process.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/src/process.rs)
- Plugin lifecycle trace: `Builder::plugin` stores into `PluginStore`; during setup each plugin's `initialize(app, config)` runs; hooks `window_created`, `webview_created`, `on_navigation`, `on_page_load`, `on_event` fire at their lifecycle points, and `cleanup_before_exit` hooks run before process exit. — [crates/tauri/src/plugin.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/src/plugin.rs) [crates/tauri/src/app.rs](https://github.com/tauri-apps/tauri/blob/745b9a48aeb6e7f48d70adf3d043e6203de5bac6/crates/tauri/src/app.rs)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)