Update files

Author: hotlong

.github/workflows/desktop.yml

@@ -0,0 +1,119 @@
+name: desktop
+
+on:
+  push:
+    tags:
+      - 'desktop-v*'
+  workflow_dispatch:
+    inputs:
+      release:
+        description: 'Create a draft GitHub release with the artifacts'
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: ${{ matrix.label }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: macOS (arm64)
+            os: macos-14
+            target: aarch64-apple-darwin
+            bundle-dir: macos
+          - label: macOS (x64)
+            os: macos-13
+            target: x86_64-apple-darwin
+            bundle-dir: macos
+          - label: Windows (x64)
+            os: windows-2022
+            target: x86_64-pc-windows-msvc
+            bundle-dir: nsis
+          - label: Linux (x64)
+            os: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+            bundle-dir: deb
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Linux build deps
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev libssl-dev libayatana-appindicator3-dev \
+            librsvg2-dev patchelf libgtk-3-dev libsoup-3.0-dev
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.28.2
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: apps/objectos-desktop/src-tauri
+
+      - name: Install workspace deps
+        run: pnpm install --frozen-lockfile
+
+      - name: Stage Node runtime
+        run: pnpm --filter @objectos/desktop stage
+
+      - name: Build Tauri bundle
+        env:
+          # macOS signing (provide via repo secrets to enable notarization).
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          # Tauri updater key (optional).
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: pnpm --filter @objectos/desktop tauri build --target ${{ matrix.target }}
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: objectos-desktop-${{ matrix.target }}
+          path: |
+            apps/objectos-desktop/src-tauri/target/${{ matrix.target }}/release/bundle/**/*.dmg
+            apps/objectos-desktop/src-tauri/target/${{ matrix.target }}/release/bundle/**/*.app
+            apps/objectos-desktop/src-tauri/target/${{ matrix.target }}/release/bundle/**/*.exe
+            apps/objectos-desktop/src-tauri/target/${{ matrix.target }}/release/bundle/**/*.msi
+            apps/objectos-desktop/src-tauri/target/${{ matrix.target }}/release/bundle/**/*.deb
+            apps/objectos-desktop/src-tauri/target/${{ matrix.target }}/release/bundle/**/*.AppImage
+            apps/objectos-desktop/src-tauri/target/${{ matrix.target }}/release/bundle/**/*.sig
+          if-no-files-found: warn
+
+  release:
+    name: Draft release
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/desktop-v') || inputs.release
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+      - name: Create draft release
+        uses: softprops/action-gh-release@v2
+        with:
+          draft: true
+          generate_release_notes: true
+          name: ObjectOS Desktop ${{ github.ref_name }}
+          files: artifacts/**/*

.gitignore

@@ -18,5 +18,6 @@ docker/artifacts/*
 !docker/artifacts/.gitkeep
 .cache/
 apps/objectos-desktop/runtime/
+apps/objectos-desktop/src-tauri/runtime/
 apps/objectos-desktop/src-tauri/target/
 apps/objectos-desktop/src-tauri/gen/

apps/objectos-desktop/README.md

@@ -11,41 +11,60 @@ experience for end users on macOS, Windows and Linux.
 ┌──────────────────────────────────────────┐
 │  Tauri shell (Rust)                      │
 │   ├── splash WebView (src/index.html)    │
+│   ├── system tray (open / restart / data │
+│   │   folder / quit)                     │
 │   ├── waits for sidecar port             │
 │   └── navigates to http://localhost:N    │
 │                                          │
 │  Sidecar: bundled Node runs              │
 │   apps/objectos/desktop.mjs              │
 │      → objectstack serve --port N        │
+│      → SQLite + uploads under            │
+│        $OBJECTOS_HOME                    │
 └──────────────────────────────────────────┘
 ```
 
 The Node tree is staged under `runtime/` by
 `scripts/stage-runtime.mjs` (called automatically by `dev` / `build`)
-and bundled by Tauri as resources.
+and bundled by Tauri as resources. The staging step also slims the
+tree (~50 MB of source maps, markdown, and test fixtures removed).
+
+## Per-user data
+
+| OS      | Path                                         |
+|---------|----------------------------------------------|
+| macOS / Linux / Windows | `~/.objectstack`                   |
+
+(Override with `OBJECTOS_HOME=/some/path`.)
+
+The sidecar receives `OBJECTOS_HOME`, `OS_DATABASE_URL`,
+`OS_STORAGE_ROOT`, and `OS_CACHE_DIR` pointed inside that folder, so a
+clean uninstall is just deleting that directory.
 
 ## Prerequisites
 
 - Node ≥ 20 + pnpm 10
 - Rust (stable) — `curl https://sh.rustup.rs -sSf | sh`
 - macOS: Xcode Command Line Tools
 - Windows: WebView2 (preinstalled on Win10+) + MSVC build tools
-- Linux: `libwebkit2gtk-4.1-dev`, `build-essential`, `libssl-dev`
+- Linux: `libwebkit2gtk-4.1-dev`, `build-essential`, `libssl-dev`,
+  `libayatana-appindicator3-dev`, `librsvg2-dev`
 
 ## Develop
 
 ```bash
-pnpm install                                # repo root
-pnpm --filter @objectos/desktop dev         # stages runtime + tauri dev
+pnpm install
+pnpm desktop:dev          # = pnpm --filter @objectos/desktop dev
 ```
 
-The first run builds Rust dependencies (~2–4 min). Subsequent runs are
-fast.
+First run builds Rust dependencies (~2–4 min). Subsequent runs are
+fast. The window opens on a splash page; once the sidecar is ready it
+navigates to the live Studio URL.
 
 ## Build distributables
 
 ```bash
-pnpm --filter @objectos/desktop build
+pnpm desktop:build
 ```
 
 Output lands in `src-tauri/target/release/bundle/`:
@@ -56,15 +75,66 @@ Output lands in `src-tauri/target/release/bundle/`:
 | Windows  | `nsis/ObjectOS_<v>_x64-setup.exe`       |
 | Linux    | `deb/objectos_<v>_amd64.deb`, AppImage  |
 
-Code signing / notarization is configured per platform in
-`src-tauri/tauri.conf.json` (see Tauri docs).
+## CI
+
+`.github/workflows/desktop.yml` builds all four platforms in parallel
+(macOS arm64, macOS x64, Windows x64, Linux x64). Trigger:
+
+- Push a tag matching `desktop-v*` → full build + draft GitHub release
+- Manual `workflow_dispatch` → artifacts only
+
+The workflow is wired for code signing — provide the secrets below to
+enable. Without secrets the builds still succeed (unsigned binaries,
+end users will see OS warnings on first launch).
+
+## Code signing
+
+### macOS (Developer ID + notarization)
+
+Required repo secrets:
+
+| Secret                       | Value                                              |
+|------------------------------|----------------------------------------------------|
+| `APPLE_CERTIFICATE`          | base64 of your `.p12` Developer ID Application cert |
+| `APPLE_CERTIFICATE_PASSWORD` | the export password                                |
+| `APPLE_SIGNING_IDENTITY`     | `Developer ID Application: Company (TEAMID)`       |
+| `APPLE_ID`                   | Apple ID email used for notarization               |
+| `APPLE_PASSWORD`             | App‑specific password (appleid.apple.com → security) |
+| `APPLE_TEAM_ID`              | 10‑char team ID from Apple Developer portal        |
+
+Tauri picks these up automatically and runs `codesign` + `notarytool`
+during `tauri build`.
+
+### Windows (Authenticode)
+
+| Secret                          | Value                |
+|---------------------------------|----------------------|
+| `WINDOWS_CERTIFICATE`           | base64 of your `.pfx`|
+| `WINDOWS_CERTIFICATE_PASSWORD`  | export password      |
+
+Then in `tauri.conf.json` set `bundle.windows.certificateThumbprint`
+to the SHA‑1 thumbprint (or extend the workflow to import the .pfx
+and sign post‑build with `signtool`).
+
+### Tauri updater key (optional)
+
+To enable in‑app auto‑update:
+
+```bash
+pnpm tauri signer generate -w ~/.tauri/objectos.key
+```
+
+Set `TAURI_SIGNING_PRIVATE_KEY` (file contents) and
+`TAURI_SIGNING_PRIVATE_KEY_PASSWORD` in CI, paste the public key into
+`tauri.conf.json → plugins.updater.pubkey`, and flip
+`plugins.updater.active` to `true`.
 
 ## Comparison with the portable zip
 
 | | Portable zip | Tauri |
 |---|---|---|
 | Brand | none (terminal) | dock icon, menu, tray |
-| Size | ~110 MB | ~120 MB (Node sidecar dominates; shell adds ~10 MB) |
+| Size | ~110 MB zip | ~140 MB installer (signed) |
 | Auto‑update | no | yes (Tauri updater) |
 | Code signing | manual | first‑class |
 | Dev effort | tiny | moderate (Rust toolchain) |

apps/objectos-desktop/scripts/stage-runtime.mjs

@@ -15,7 +15,7 @@
  *       node_modules/
  */
 import { execSync } from 'node:child_process';
-import { existsSync, mkdirSync, copyFileSync, rmSync, chmodSync } from 'node:fs';
+import { existsSync, mkdirSync, copyFileSync, rmSync, chmodSync, readdirSync, statSync, unlinkSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { platform, arch } from 'node:os';
@@ -24,7 +24,7 @@ const HERE = dirname(fileURLToPath(import.meta.url));
 const PKG = resolve(HERE, '..');
 const REPO = resolve(PKG, '../..');
 const APP = resolve(REPO, 'apps/objectos');
-const RUNTIME = resolve(PKG, 'runtime');
+const RUNTIME = resolve(PKG, 'src-tauri/runtime');
 const NODE_VERSION = process.env.NODE_VERSION ?? '20.18.1';
 
 const osName = ({ darwin: 'darwin', linux: 'linux', win32: 'win' })[platform()];
@@ -39,6 +39,74 @@ const sh = (cmd, opts = {}) => {
   execSync(cmd, { stdio: 'inherit', ...opts });
 };
 
+/**
+ * Strip files that are useless at runtime. Conservative — only deletes
+ * patterns that are universally safe in npm packages:
+ *   * .map (source maps)
+ *   * .md / .markdown (docs)
+ *   * directories named __tests__, .github, .nyc_output, coverage
+ *   * cross-platform native prebuilds (we ship one platform per installer)
+ *
+ * NOTE: we deliberately do *not* touch directories called `doc`,
+ * `docs`, `example`, `examples`, `test`, or `tests` — some packages
+ * (e.g. `yaml`) ship real runtime code under those names.
+ */
+function slim(root) {
+  if (!existsSync(root)) return;
+  const dropFileExt = /\.(map|md|markdown)$/i;
+  const dropDirName = /^(__tests__|\.github|\.nyc_output|coverage)$/i;
+  const platformTag = `${platform() === 'win32' ? 'win32' : platform()}-${arch()}`;
+
+  let removed = 0;
+  let bytes = 0;
+  const walk = (dir) => {
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      const p = join(dir, e.name);
+      if (e.isDirectory()) {
+        if (dropDirName.test(e.name)) {
+          const sz = sizeOf(p);
+          rmSync(p, { recursive: true, force: true });
+          removed++; bytes += sz;
+          continue;
+        }
+        // Drop other-platform prebuilds (e.g. @libsql/linux-x64 on darwin)
+        if (dir.endsWith('prebuilds') && !e.name.startsWith(platformTag)) {
+          const sz = sizeOf(p);
+          rmSync(p, { recursive: true, force: true });
+          removed++; bytes += sz;
+          continue;
+        }
+        walk(p);
+      } else if (e.isFile()) {
+        if (dropFileExt.test(e.name)) {
+          try {
+            const sz = statSync(p).size;
+            unlinkSync(p);
+            removed++; bytes += sz;
+          } catch {}
+        }
+      }
+    }
+  };
+
+  function sizeOf(p) {
+    try {
+      let s = 0;
+      for (const e of readdirSync(p, { withFileTypes: true })) {
+        const c = join(p, e.name);
+        if (e.isDirectory()) s += sizeOf(c);
+        else { try { s += statSync(c).size; } catch {} }
+      }
+      return s;
+    } catch { return 0; }
+  }
+
+  walk(root);
+  console.log(`✓ slimmed ${removed} entries (~${(bytes / 1024 / 1024).toFixed(1)} MB)`);
+}
+
 if (!existsSync(join(APP, 'dist/objectstack.json'))) {
   sh('pnpm --filter @objectos/app build', { cwd: REPO });
 }
@@ -54,6 +122,10 @@ sh(
   { cwd: join(RUNTIME, 'app') }
 );
 
+// 3b. slim node_modules: drop source maps, docs, tests, .d.ts — these
+// are useless at runtime and bloat the installer by ~30%.
+slim(join(RUNTIME, 'app', 'node_modules'));
+
 const cache = resolve(REPO, '.cache/node');
 mkdirSync(cache, { recursive: true });
 const ext = osName === 'win' ? 'zip' : osName === 'linux' ? 'tar.xz' : 'tar.gz';