VitraDesktop apps in Go with a web frontend

The page is untrusted. It gets exactly the authority you grant, for the window it runs in, at the origin it runs at. Nothing more.

Get started

Security model

GitHub

Explicit commands

Only Go functions you register are callable. Inputs are decoded strictly into your types, and a TypeScript client is generated from them.

Narrow grants

A grant names windows, origins, and permissions. Path-scoped permissions take allow and deny patterns. A new window has no authority at all.

Identity from the host

The native bridge stamps every call with the window it came from and that window's origin. A per-window sender token keeps frames from forging calls.

Every refusal is audited

Denials carry a deterministic code and reason. Forged bridge messages and blocked navigations are recorded too.

Native on three platforms

WebKitGTK on Linux, WKWebView on macOS, WebView2 on Windows. The kernel is standard library only.

Ship it

Packages for deb, rpm, snap, flatpak, AppImage, MSI, NSIS, .app and .dmg, plus ed25519-signed updates with expiry.

See it work

The notes demo: a note is edited and saved, then nine attacks from the page are each refused and shown in the live audit log

example/notes is a Markdown notes app whose window may read one folder and write Markdown files in it. Its Try to break it panel attacks the app from the page, and the audit log shows each attempt refused, with the rule that refused it.

bash

git clone https://github.com/klarlabs-studio/vitra && cd vitra
make notes