CoreTrace Desktop 6.0: the Tauri application

.gitattributes

@@ -5,3 +5,14 @@
 *.sh text eol=lf
 Dockerfile text eol=lf
 entrypoint.sh text eol=lf
+
+# Source files are LF in the repository, whatever the committer's platform.
+# A CRLF blob passes Prettier on one runner and fails on another.
+*.ts text eol=lf
+*.tsx text eol=lf
+*.css text eol=lf
+*.json text eol=lf
+*.md text eol=lf
+*.yml text eol=lf
+*.rs text eol=lf
+*.toml text eol=lf

.github/workflows/release.yml

@@ -1,121 +1,131 @@
-name: Build Electron App
-
-# Pushes to master and develop only run the test suite. Artifacts are published
-# from version tags alone (v5.1.0, v5.2.0-beta.1, ...), so merging a PR never
-# republishes a release, and the tag is the single trigger for a build.
+name: CoreTrace Desktop
+# Every push and pull request is checked and built on the three desktops.
+# A tag v<version> additionally builds the installers on each and publishes
+# them as a GitHub Release, whose notes are docs/releases/v<version>.md. A
+# version with a pre-release suffix (6.0.0-beta.1) is published as a
+# pre-release; a plain one becomes the latest release.
 on:
   push:
-    branches:
-      - master
-      - develop
-    tags:
-      - "v*"
+    branches: [master, develop, feat/tauri-react-desktop]
+    tags: ["v*"]
   pull_request:
-    branches:
-      - master
-
+    branches: [master]
+  workflow_dispatch:
 permissions:
   contents: read
-
 jobs:
-  test:
-    runs-on: ubuntu-24.04
+  check:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-2022, ubuntu-24.04, macos-latest]
+    runs-on: ${{ matrix.os }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
-          node-version: 22.15.0
-          cache: "npm"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build renderer bundle
-        run: npm run build:renderer
-
-      - name: Run tests
-        run: npm test
+          node-version: "22.19.0"
+          cache: npm
+      - uses: dtolnay/rust-toolchain@1.95.0
+        with:
+          components: rustfmt, clippy
+      - name: Linux desktop dependencies
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libdbus-1-dev
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri -> target
+      - run: npm ci
+      - name: Verify release versions
+        run: node scripts/check-desktop-version.cjs
+      - name: Verify bundle icons
+        run: node scripts/check-bundle-icons.cjs
+      - run: npm run check
+      - run: npm run format:check
+      - name: Show what Prettier would change
+        # --check only names files; when it fails, the diff says why.
+        if: failure()
+        shell: bash
+        run: |
+          npx prettier --write desktop vite.config.ts vitest.config.ts >/dev/null
+          git --no-pager diff --stat
+          git --no-pager diff | head -120 | cat -A | head -120
+      - run: npm test
+      - run: cargo fmt --manifest-path src-tauri/Cargo.toml --check
+      - run: cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
+      - run: cargo test --manifest-path src-tauri/Cargo.toml --locked
+      - name: Build desktop
+        run: npm run tauri -- build --no-bundle
+      - uses: actions/upload-artifact@v4
+        with:
+          name: coretrace-desktop-${{ runner.os }}-${{ runner.arch }}
+          path: |
+            src-tauri/target/release/coretrace-desktop.exe
+            src-tauri/target/release/coretrace-desktop
+          if-no-files-found: error
 
   release:
+    # Only a tag publishes, and only after every desktop passed its checks.
     if: startsWith(github.ref, 'refs/tags/v')
-    needs: test
-    # Only this job publishes, so only this job gets a write-capable token.
+    needs: check
     permissions:
       contents: write
-    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        # windows-2022 pinned: windows-latest (now windows-2025, build 26100)
-        # breaks node-gyp VS detection during the node-pty native rebuild.
-        #
-        # macOS ships two jobs rather than one universal build: node-pty and
-        # node-llama-cpp are native modules, so each architecture is compiled on
-        # a runner of that architecture. macos-latest is Apple Silicon;
-        # macos-15-intel is the x64 runner that replaced the retired macos-13
-        # (a macos-13 job sits queued forever instead of failing).
-        # The builds are unsigned — see the note below.
-        os: [windows-2022, ubuntu-24.04, macos-latest, macos-15-intel]
-
+        include:
+          - os: windows-2022
+            args: --bundles nsis
+          - os: macos-latest
+            args: --target universal-apple-darwin --bundles dmg
+          - os: ubuntu-24.04
+            args: --bundles deb,appimage
+    runs-on: ${{ matrix.os }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
-          node-version: 22.15.0
-          cache: "npm"
-
-      # The tag is what users see; package.json is what electron-builder writes
-      # into the artifacts and the update manifests. If they disagree, the
-      # updater serves a version nobody can find, so stop before publishing.
-      - name: Verify the tag matches package.json
+          node-version: "22.19.0"
+          cache: npm
+      - uses: dtolnay/rust-toolchain@1.95.0
+        with:
+          # A universal macOS binary is built from both architectures.
+          targets: ${{ runner.os == 'macOS' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+      - name: Linux desktop dependencies
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libdbus-1-dev
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri -> target
+      - run: npm ci
+      - name: Verify release versions
+        run: node scripts/check-desktop-version.cjs
+      - name: Verify bundle icons
+        run: node scripts/check-bundle-icons.cjs
+      - name: Release notes
+        id: notes
         shell: bash
         run: |
-          set -euo pipefail
-          tag="${GITHUB_REF_NAME#v}"
-          pkg="$(node -p "require('./package.json').version")"
-          if [ "$tag" != "$pkg" ]; then
-            echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $pkg."
+          file="docs/releases/${GITHUB_REF_NAME}.md"
+          if [ ! -f "$file" ]; then
+            echo "No release notes at $file; write them before tagging." >&2
             exit 1
           fi
-          echo "Releasing $pkg from tag $GITHUB_REF_NAME."
-
-      # Only `-beta.N` prereleases are recognised: electron-builder names the
-      # update manifest after the prerelease identifier, and `beta` is the one
-      # the in-app channel selector reads (see updaterHandlers.js).
-      - name: Determine release channel
-        id: channel
-        shell: bash
-        run: |
-          set -euo pipefail
-          version="${GITHUB_REF_NAME#v}"
-          if [[ "$version" == *-* ]]; then
-            if [[ ! "$version" =~ -beta\.[0-9]+$ ]]; then
-              echo "::error::Prerelease versions must end in -beta.N (got $version)."
-              exit 1
-            fi
-            echo "prerelease=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "prerelease=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Install dependencies
-        run: npm ci
-
-      # macOS artifacts are deliberately unsigned and un-notarized: that needs a
-      # paid Apple Developer account, and we would rather ship a build testers
-      # can run today. Gatekeeper blocks the first launch, so users open the app
-      # once with right-click > Open, or run `xattr -cr /Applications/CtraceGUI.app`.
-      # To sign later, restore an Apple certificate here and set `identity`,
-      # `hardenedRuntime` and `notarize` in the `mac` block of package.json.
-      - name: Publish
+          {
+            echo "body<<NOTES_EOF"
+            cat "$file"
+            echo
+            echo "NOTES_EOF"
+          } >> "$GITHUB_OUTPUT"
+      - name: Build installers and publish
+        uses: tauri-apps/tauri-action@v0
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CSC_IDENTITY_AUTO_DISCOVERY: false
-          EP_PRE_RELEASE: ${{ steps.channel.outputs.prerelease }}
-        run: npm run dist:publish
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tagName: ${{ github.ref_name }}
+          releaseName: CoreTrace Desktop ${{ github.ref_name }}
+          releaseBody: ${{ steps.notes.outputs.body }}
+          releaseDraft: false
+          prerelease: ${{ contains(github.ref_name, '-') }}
+          includeUpdaterJson: false
+          args: ${{ matrix.args }}

.gitignore

@@ -1,10 +1,17 @@
-dist
-.env
-node_modules
-.codex
-.claude
-.claw
-.claw-cache
-.claw-logs
-ctrace-report.txt
-bundle.js
+dist
+.env
+node_modules
+.codex
+.claw
+.claw-cache
+.claw-logs
+ctrace-report.txt
+bundle.js
+src-tauri/target/
+src-tauri/gen/
+coverage/
+*.tsbuildinfo
+# The native spikes: exploratory Rust/Floem work that has never been committed here, and 12 GB of
+# rebuildable build output beside it. Ignored whole, so `git add -A` cannot sweep the tree into a
+# commit about something else. Committing the spikes is a decision to take deliberately.
+native/