feat(desktop): package Web Shell as a release-ready desktop app

.github/scripts/create-desktop-update-manifest.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+const options = parseArguments(process.argv.slice(2));
+const assets = fs.readdirSync(options.assets).sort();
+const platforms = {};
+const platformArtifacts = [
+  [
+    'darwin-aarch64',
+    selectArtifact(assets, /-aarch64-apple-darwin\.app\.tar\.gz$/i, 'darwin-aarch64'),
+  ],
+  [
+    'darwin-x86_64',
+    selectArtifact(assets, /-x86_64-apple-darwin\.app\.tar\.gz$/i, 'darwin-x86_64'),
+  ],
+  ['windows-x86_64', selectArtifact(assets, /-setup\.exe$/i, 'windows-x86_64')],
+  ['linux-x86_64', selectArtifact(assets, /\.AppImage$/i, 'linux-x86_64')],
+];
+
+for (const [platform, artifact] of platformArtifacts) {
+  const signatureFile = `${artifact}.sig`;
+  if (!assets.includes(signatureFile)) {
+    throw new Error(`Missing updater signature for ${artifact}`);
+  }
+  platforms[platform] = {
+    signature: fs.readFileSync(path.join(options.assets, signatureFile), 'utf8').trim(),
+    url: `https://github.com/${options.repository}/releases/download/${options.tag}/${encodeURIComponent(artifact)}`,
+  };
+}
+
+const manifest = {
+  version: options.version,
+  pub_date: new Date().toISOString(),
+  platforms,
+};
+fs.writeFileSync(options.output, `${JSON.stringify(manifest, null, 2)}\n`);
+
+function selectArtifact(assets, pattern, platform) {
+  const matches = assets.filter((asset) => pattern.test(asset));
+  if (matches.length !== 1) {
+    throw new Error(
+      `Expected one updater artifact for ${platform}, found ${matches.length}: ${matches.join(', ')}`,
+    );
+  }
+  return matches[0];
+}
+
+function parseArguments(args) {
+  const values = {};
+  for (let index = 0; index < args.length; index += 2) {
+    const name = args[index]?.replace(/^--/, '');
+    const value = args[index + 1];
+    if (!name || value === undefined) throw new Error('Invalid arguments.');
+    values[name] = value;
+  }
+  for (const required of ['assets', 'repository', 'tag', 'version', 'output']) {
+    if (!values[required]) throw new Error(`Missing --${required}`);
+  }
+  return values;
+}

.github/workflows/ci.yml

@@ -828,3 +828,79 @@ jobs:
       - name: 'Run CLI Integration Tests'
         run: |-
           npm run test:integration:cli:sandbox:none
+
+  #
+  # Desktop Shell: compile + test the Tauri crate in PR CI.
+  #
+  # The desktop-release workflow (workflow_dispatch only) is otherwise the sole
+  # place this crate is built, so a compile error can land on a PR and stay
+  # invisible until release time. This job compiles the crate and runs its
+  # release-config tests on every PR that touches the shell. It does not need
+  # the bundled runtime, so it is cheap. `cargo test` builds the crate and thus
+  # catches compile failures (e.g. a moved-value error); fmt/clippy are not run
+  # here because the release pipeline does not gate on them either.
+  desktop_shell:
+    name: 'Desktop Shell (ubuntu-22.04)'
+    needs: 'classify_pr'
+    if: "${{ !cancelled() && github.event_name != 'push' && needs.classify_pr.outputs.skip_ci != 'true' }}"
+    runs-on: 'ubuntu-22.04'
+    timeout-minutes: 45
+    permissions:
+      contents: 'read'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
+        with:
+          ref: "${{ github.event.inputs.branch_ref || (github.event_name == 'pull_request' && format('refs/pull/{0}/head', github.event.pull_request.number)) || (github.event_name == 'merge_group' && github.event.merge_group.head_sha) || github.ref }}"
+          fetch-depth: 1
+
+      # Fail open: any uncertainty (non-PR event, fetch failure) runs the job.
+      - name: 'Detect desktop-shell changes'
+        id: 'filter'
+        env:
+          EVENT_NAME: '${{ github.event_name }}'
+          BASE_REF: '${{ github.base_ref }}'
+        run: |-
+          changed=true
+          if [[ "${EVENT_NAME}" == "pull_request" && -n "${BASE_REF}" ]]; then
+            if git fetch --depth=1 origin "${BASE_REF}" >/dev/null 2>&1; then
+              if git diff --name-only FETCH_HEAD HEAD | grep -Eq '^(packages/desktop-shell/|\.github/scripts/create-desktop-update-manifest\.mjs|\.github/workflows/ci\.yml)'; then
+                changed=true
+              else
+                changed=false
+              fi
+            fi
+          fi
+          echo "changed=${changed}" >> "${GITHUB_OUTPUT}"
+          echo "desktop-shell changed: ${changed}"
+
+      # cargo test links the Tauri/wry webview, so the WebKit/GTK dev headers
+      # must be present (mirrors the Linux build job in desktop-release.yml).
+      - name: 'Install Linux dependencies'
+        if: "${{ steps.filter.outputs.changed == 'true' }}"
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libatk-bridge2.0-0 at-spi2-core dbus-x11 patchelf libfuse2 xdg-utils
+
+      - uses: 'actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e' # v6.4.0
+        if: "${{ steps.filter.outputs.changed == 'true' }}"
+        with:
+          node-version: '22.x'
+
+      - uses: 'dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4' # stable
+        if: "${{ steps.filter.outputs.changed == 'true' }}"
+
+      - uses: 'Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae' # v2
+        if: "${{ steps.filter.outputs.changed == 'true' }}"
+        with:
+          workspaces: 'packages/desktop-shell/src-tauri -> target'
+
+      - name: 'Compile and test the desktop crate'
+        if: "${{ steps.filter.outputs.changed == 'true' }}"
+        working-directory: 'packages/desktop-shell'
+        run: 'cargo test --manifest-path src-tauri/Cargo.toml'
+
+      - name: 'Run desktop release tests'
+        if: "${{ steps.filter.outputs.changed == 'true' }}"
+        working-directory: 'packages/desktop-shell'
+        run: 'node scripts/test-release.js'