5 commits

Author	SHA1	Message	Date
CRT	60a72e6947	Desktop: tray mini card on left click (store status at a glance next to the tray icon; Refresh runs the main window's Refresh all)	2026-10-23 11:15:35 +08:00
CRT	c95f2af8ff	desktop: Fix with AI on scan findings that need a code change (aiFix: true, AI_FIX_RULES). The host (src-tauri/src/ai_fix.rs) runs the owner's local Claude Code headless in the app folder with Read / Edit / Write / Grep / Glob only (Bash, web tools, sub-agents disallowed) and a prompt it builds from the finding's fields; it refuses while the folder has uncommitted files, streams progress, times out after 10 min with a heartbeat, kills the process group on Cancel or exit, and records the run's changed files so Undo restores exactly those; the window shows the diff with Keep / Undo and rescans. Without claude the button copies the prompt (Copy for AI). Only the claude binary, git and kill / taskkill are started there (tests/security.rs); tests/ai_fix.rs covers the prompt, dirty-tree refusal, undo scope, timeout and cancel	2026-10-15 06:26:29 +08:00
CRT	c68ef8acd0	Desktop D5 app: --self-test (sidecar handshake, no window) for release smoke tests; Settings > Updates checks and installs signed updates after a native dialog; storebound://open?path= adds or selects an app folder after asking	2026-10-11 05:16:59 +08:00
CRT	95b7cf7ced	Desktop host: offline read cache (SQLite), job ids for progress and cancel, parallel live portfolio, project init, verified ffmpeg / Chrome for Testing downloads into app data	2026-10-11 03:34:46 +08:00
CRT	61a1e832a0	Desktop app shell (apps/desktop): Tauri 2 + React 19 around the storebound sidecar ... - Rust host: spawns storebound serve --stdio with fixed args, hands over a per-session secret, mints confirm tokens only after a native dialog showing the summary and the dry run - every app command re-checks window label and page origin; one capability (main window, app commands + event listen only, no plugin API in the webview); strict CSP; tests/security.rs pins it - store keys picked in native dialogs, kept in the OS keychain, passed per call in memory only - plugins: shell (Rust only), single-instance, deep-link storebound://, window-state, opener, dialog, notification, updater (placeholder endpoint and key until signing), process - app-centric UI: Portfolio, App (Releases, Catalog, Listings, Health, Reviews, TestFlight), App folders, Accounts, Dependencies, Settings; light / dark with the storebound.dev tokens, reduced motion, home folder shown as ~ - macOS menu: Cmd+Q quits, Edit menu, Window menu keeps the main window; Linux DMABUF fix - Bun workspace (npm files unchanged), ci runs desktop typecheck, build, cargo test and clippy; scrub covers home paths; docs/desktop.md (protocol, safety, dependency sources and licenses)	2026-10-11 01:57:33 +08:00