Confirmations never block: the dialog plugin turns window.confirm into a Promise #168

Tested against main (894ea12) with tauri-plugin-dialog 2.8.0.

Every confirmation in the app is skipped in the real build

tauri-plugin-dialog installs an init script on every desktop platform (src/init-iife.js, injected from init() unless the target is Android):

window.alert = function (i) { invoke("plugin:dialog|message", { message: i.toString() }) }
window.confirm = async function (i) { return await invoke("plugin:dialog|confirm", { message: i.toString() }) }

confirm() therefore returns a Promise, and a Promise is always truthy. The frontend uses it synchronously:

if (confirm(`Delete host "${host.label}"?`)) { await hosts.deleteHost(host.id); }
if (!confirm(`Remove known host "${entry.host}"?`)) return;

so the destructive branch runs at once. On top of that capabilities/default.json grants no dialog:allow-confirm or dialog:allow-message, so the ACL refuses the dialog and it never appears at all. alert() messages are lost the same way.

Affected calls:

Reproduction

The unit tests (happy-dom) and the browser harness (Chromium) both have the browser's synchronous confirm, which is why nothing caught this. Loading the plugin's exact init-iife.js into the harness after the Tauri fixture, with plugin:dialog|* refused the way the ACL refuses it:

• one click on Delete host → IPC log ["plugin:dialog|confirm", "delete_host"], console error confirm not allowed. Permissions associated with this command: dialog:allow-confirm
• control run without the init script → the browser shows Delete host "Orion Staging"?, Cancel → no IPC

To confirm on a packaged build: click the trash icon on any host. It disappears with no prompt.

Fix

Replace window.confirm/alert with an in-app confirmation dialog (no IPC, no permission, same look on every platform), and make the test setup and the e2e fixture reproduce the plugin's async confirm so this cannot come back unnoticed.