feat: task bar

Author: matthiasmatt

Cargo.lock

@@ -16,6 +16,7 @@ chrono = { version = "0.4", features = ["serde"] }
 clap = { version = "4.5", features = ["derive"] }
 rand = "0.8"
 regex = "1"
+opener = "0.8"
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
@@ -24,3 +25,7 @@ tokio = { version = "1", features = ["fs", "io-util", "macros", "net", "process"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 which = "6"
+
+[target.'cfg(target_os = "macos")'.dependencies]
+tao = "0.35"
+tray-icon = "0.22"

Cargo.toml

@@ -8,8 +8,14 @@ them, and keep unreviewed critical findings visible until someone triages them.
 
 ![Vulnerability Daemon hero](./docs/assets/vulnerability-daemon-hero.png)
 
+![Dashboard with toolbar icon](./docs/assets/dashboard-screenshot.png)
+
 ![Dashboard with review drawer](./docs/assets/dashboard-drawer-screenshot.png)
 
+The app icon is served as the favicon, the install manifest icon, the header
+brand mark, and the top-right review queue button:
+[vulnerability-daemon-icon.svg](./docs/assets/vulnerability-daemon-icon.svg).
+
 ## What It Does
 
 - Runs recurring security audits over local folders.
@@ -24,6 +30,17 @@ them, and keep unreviewed critical findings visible until someone triages them.
 
 The core promise: never let a new critical finding disappear into a terminal log.
 
+## Product Shape
+
+The normal user flow is app-like:
+
+1. Start `vuln-daemon`.
+2. It lives in the menu bar on macOS.
+3. Reviews run on the schedule in your config.
+4. Critical findings stay visible in the dashboard until reviewed.
+
+The CLI commands remain available for automation, CI experiments, and debugging.
+
 ## Install
 
 From source:
@@ -34,44 +51,70 @@ cargo install --path .
 
 During development, use `cargo run --` in place of `vuln-daemon`.
 
+This is still a source install. Packaged `.app`, Homebrew, and signed release
+binaries are planned so users do not need Rust installed.
+
 ## Quick Start
 
-Create a config interactively:
+Start the app:
 
 ```bash
-vuln-daemon init
+vuln-daemon
 ```
 
-Or write the example config directly:
+or:
 
 ```bash
-vuln-daemon init-config ./vuln-daemon.config.json
+vuln-daemon start
+```
+
+On first run it asks for one local repo/folder to watch, writes the app config,
+starts the local daemon, and opens the dashboard. On macOS it also stays in the
+menu bar with actions for opening the dashboard, starting a review now, opening
+the config, and quitting.
+
+Default app config locations:
+
+- macOS: `~/Library/Application Support/Vulnerability Daemon/config.json`
+- Linux: `~/.config/vulnerability-daemon/config.json`
+- Windows: `%APPDATA%\Vulnerability Daemon\config.json`
+
+Use a specific config when you want to keep project-local state:
+
+```bash
+vuln-daemon start --config ./vuln-daemon.config.json
 ```
 
-Edit the `targets` entries so each `path` points at a local repo or folder.
+## Power User CLI
 
-Run one dry run without invoking an agent:
+Create a config without starting the app:
 
 ```bash
-vuln-daemon run-once --config ./vuln-daemon.config.json --dry-run
+vuln-daemon init
 ```
 
-Run one real audit:
+Write the example config directly:
+
+```bash
+vuln-daemon init-config ./vuln-daemon.config.json
+```
+
+Run one review immediately:
 
 ```bash
 vuln-daemon run-once --config ./vuln-daemon.config.json
 ```
 
-Start the local daemon and dashboard:
+Run the daemon without menu-bar integration:
 
 ```bash
-vuln-daemon serve --config ./vuln-daemon.config.json
+vuln-daemon start --config ./vuln-daemon.config.json --no-tray
 ```
 
-Then open:
+Or run the raw HTTP server:
 
-```text
-http://127.0.0.1:8831
+```bash
+vuln-daemon serve --config ./vuln-daemon.config.json
 ```
 
 Export SARIF after runs:
@@ -118,7 +161,7 @@ For a compiled binary:
 
 ```bash
 cargo build --release
-./target/release/vuln-daemon serve --config ./vuln-daemon.config.json
+./target/release/vuln-daemon start --config ./vuln-daemon.config.json
 ```
 
 ## API
@@ -194,15 +237,16 @@ out/vulnerability-daemon/
 }
 ```
 
-## Daemon Install
+## Headless Daemon Install
 
 Examples are included for:
 
 - [systemd](./examples/systemd/vulnerability-daemon.service)
 - [launchd](./examples/launchd/com.vulnerability-daemon.plist)
 
-Both examples assume you have installed the compiled binary somewhere stable and
-created a config file. The dashboard should remain bound to `127.0.0.1`.
+Both examples run the HTTP/scheduler daemon without menu-bar UI. They assume you
+have installed the compiled binary somewhere stable and created a config file.
+The dashboard should remain bound to `127.0.0.1`.
 
 ## Security Notes