TaskStudioby DeccanLogic
Log in Start Free Trial
Microsoft Store

TaskStudio for Windows: use of the unvirtualizedResources capability

Last updated 14 October 2026

Product: TaskStudio (Microsoft Store ID 9PKQW6TT6J0B)
Publisher: DeccanLogic Private Limited
Support: info@deccanlogic.com | https://taskstudio.in

1. Why TaskStudio needs this capability

TaskStudio automates repetitive browser tasks for business users. Its core feature, teach mode, records a task while the user performs it in their own, already signed-in Google Chrome, through our published Chrome extension (Chrome Web Store ID adfaonfgkohagojmdnngneffncnbohej). The recording is then replayed by the desktop app.

The extension has to send the recorded steps to the desktop app. Chrome's only supported channel from an extension to a desktop application is Native Messaging. On Windows, Chrome discovers a native messaging host only through the registry key:

HKCU\Software\Google\Chrome\NativeMessagingHosts\<host-name>

whose default value is the path to a host manifest (JSON) file on disk. Chrome runs outside our MSIX package. With write virtualization on, both the key and the manifest file are redirected into the package's private hive and folder, so Chrome never sees them and teach mode cannot work for Store customers. This is the only reason we request the capability.

2. Alternatives we explored, and why they are not sufficient

AlternativeWhy we did not use it
App-controlled browser (Chrome DevTools Protocol)We ship this mode as well. But bot-detection services (e.g. Cloudflare) block remote-debugged browsers, and users must sign in again to every site in a separate profile. It cannot replace recording in the user's own browser.
Localhost HTTP or WebSocket serverOpens a port that any local process or web page can reach. Native Messaging opens no port, and Chrome restricts it to the extension IDs we list, so it is the more secure design.
Registration under HKLMRequires administrator rights and affects every user on the machine, which is broader than we need.
Registration at install timeMSIX has no install-time script, so the app must write the registration at runtime.
Disabling registry and file-system virtualization for the whole packageFar broader than we need. We use flexible virtualization instead (section 3).

3. Exact scope (least privilege)

We do not turn virtualization off for the package. The manifest uses flexible virtualization and excludes exactly one registry key and one folder. Every other write by the app stays virtualized, as with any MSIX app. Because flexible virtualization is a Windows 11 feature, the Store package requires Windows 11 (MinVersion 10.0.22000.0); we do not fall back to disabling virtualization on Windows 10.

<virtualization:RegistryWriteVirtualization>
  <virtualization:ExcludedKeys>
    <virtualization:ExcludedKey>HKEY_CURRENT_USER\Software\Google\Chrome\NativeMessagingHosts\com.deccanlogic.teachmode_host</virtualization:ExcludedKey>
  </virtualization:ExcludedKeys>
</virtualization:RegistryWriteVirtualization>
<virtualization:FileSystemWriteVirtualization>
  <virtualization:ExcludedDirectories>
    <virtualization:ExcludedDirectory>$(KnownFolder:RoamingAppData)\browser-harness-ui</virtualization:ExcludedDirectory>
  </virtualization:ExcludedDirectories>
</virtualization:FileSystemWriteVirtualization>

Registry (one key, current user only):
HKCU\Software\Google\Chrome\NativeMessagingHosts\com.deccanlogic.teachmode_host, whose default value is the path of the host manifest below.

Files (one folder): %APPDATA%\browser-harness-ui\

  • com.deccanlogic.teachmode_host.json: the host manifest Chrome reads
  • teachmode_host.bat: launcher that starts TaskStudio through its declared app execution alias taskstudio.exe
  • native-host\host.js: relay between Chrome and the app
  • The app's own data (settings and task database)

Not used: no other registry keys, no HKLM, no system folders, no other applications' data, no administrator rights.

4. Safeguards

  • Only our extension can connect. The manifest's allowed_origins lists only our own extension IDs (the published one and our internal development build). Chrome refuses connections from any other extension or web page.
  • The host only relays. host.js passes messages between Chrome and the TaskStudio app over a local named pipe. It makes no network connections and cannot run arbitrary commands.
  • The launcher starts only TaskStudio, through its declared app execution alias.
  • Per-user and idempotent. The registration is written under HKCU for the current user only and rewritten on each launch.
  • User control. Users can remove the registration at any time in TaskStudio under Settings > Chrome settings > Remove Host.
  • Recording limits. Recording runs only on sites the user allows. Password, OTP and payment-card fields are never recorded.

5. How reviewers can verify this

  1. Install TaskStudio from the Store and launch it.
  2. Open regedit and go to HKCU\Software\Google\Chrome\NativeMessagingHosts\com.deccanlogic.teachmode_host. Its default value points to %APPDATA%\browser-harness-ui\com.deccanlogic.teachmode_host.json.
  3. Open that JSON file. allowed_origins contains only our extension IDs, starting with the published one, chrome-extension://adfaonfgkohagojmdnngneffncnbohej/.
  4. In TaskStudio, open Settings > Chrome settings > Remove Host. The key and manifest are removed.

6. Statement of assurance

DeccanLogic Private Limited confirms that the unvirtualizedResources capability is used only to register the TaskStudio Chrome native messaging host for the current user. The app writes outside its virtualized storage only to HKCU\Software\Google\Chrome\NativeMessagingHosts\com.deccanlogic.teachmode_host and %APPDATA%\browser-harness-ui\. The capability will not be used for any other location or purpose. We will update this statement, and our Store submission, before any change to that scope.