14 KiB
14 KiB
phase, plan, type, wave, depends_on, files_modified, autonomous, requirements, user_setup, must_haves
| phase | plan | type | wave | depends_on | files_modified | autonomous | requirements | user_setup | must_haves | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 06-desktop-client-ci-cd | 01 | execute | 1 |
|
false |
|
|
Purpose: A user can run the desktop app and reach the live Tessera web app — the thinnest end-to-end desktop experience. All native polish (tray, window state, autostart, notifications, icon, production bundles) is layered on in Plan 06-02.
Output: A runnable apps/desktop Tauri project (pnpm --filter=@tessera/desktop tauri dev)
that connects to a user-configured server URL and remembers it.
<execution_context> @$HOME/.claude/gsd-core/workflows/execute-plan.md @$HOME/.claude/gsd-core/templates/summary.md </execution_context>
@.planning/PROJECT.md @.planning/ROADMAP.md @.planning/STATE.md @.planning/phases/06-desktop-client-ci-cd/06-CONTEXT.md @.planning/phases/06-desktop-client-ci-cd/06-RESEARCH.md @pnpm-workspace.yaml @apps/web/src/app/globals.css<artifacts_this_phase_produces> This plan introduces the following symbols/files (consumed by Plan 06-02):
apps/desktop/— Tauri project root, pnpm package@tessera/desktopapps/desktop/src-tauri/src/lib.rs::run()— Rust entry function (extended in 06-02)apps/desktop/src-tauri/tauri.conf.json— central Tauri config (window, bundle, plugins)apps/desktop/src-tauri/capabilities/default.json— permission grants (extended in 06-02)apps/desktop/src/setup.html— first-run server URL page- tauri-plugin-store
config.jsonkeyserver_url— persisted server URL contract </artifacts_this_phase_produces>
Execute these commands (the executor presents them; the human runs/authorizes sudo):
- apt install: `sudo apt install libwebkit2gtk-4.1-dev build-essential curl wget file libxdo-dev libssl-dev libayatana-appindicator3-dev librsvg2-dev`
- Rust: `curl --proto '=https' --tlsv1.2 https://sh.rustup.rs -sSf | sh -s -- -y` then `source "$HOME/.cargo/env"`
Create `src-tauri/Cargo.toml` with package name `tessera-desktop`, edition 2021, a `[lib]` entry named
`tessera_desktop_lib` (crate-type cdylib + staticlib + rlib), build-dependency `tauri-build = "2"`, and
dependencies: `tauri = { version = "2", features = ["tray-icon"] }`, `tauri-plugin-store = "2"`,
`serde = { version = "1", features = ["derive"] }`, `serde_json = "1"`. Only the store plugin is wired in
this plan; notification/autostart/window-state are added in 06-02.
Create `src-tauri/build.rs` calling `tauri_build::build()`.
Create `src-tauri/tauri.conf.json`: `productName` "Tessera", `version` "0.0.1", `identifier`
"de.ctl.tessera.desktop". Under `build`, set `frontendDist` to `../src` (the local setup page directory) and
`devUrl` to `http://localhost:1420`. Under `app.windows`, one window: label "main", title "Tessera",
width 1280, height 800, center true, decorations true, resizable true. Set `app.withGlobalTauri` true.
Add `app.security.csp` allowing connection to the configured server (use `default-src 'self'; connect-src *`
for the URL-configurable wrapper per D-02). Under `bundle`, set `active` true, `targets` `["appimage", "nsis"]`,
`icon` `["icons/icon.png", "icons/icon.ico"]` (icons added in 06-02 — note this in a SUMMARY follow-up if build
is attempted before icons exist).
Create `src-tauri/src/main.rs` as the generated entry: `#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]`
then `fn main() { tessera_desktop_lib::run() }`.
Create `src-tauri/src/lib.rs` exposing `pub fn run()`. Register the store plugin via
`tauri_plugin_store::Builder::new().build()`. In a `.setup(|app| { ... })` callback, open the store
`config.json`, read key `server_url`; if present, get the `main` webview window and call `window.navigate(url)`
to load the configured server; if absent, leave the WebView on the bundled setup page. Use
`tauri::generate_context!()` in `.run(...)`.
Create `src-tauri/capabilities/default.json` with identifier "default", windows `["main"]`, permissions
`["core:default", "store:default"]` (additional permissions added in 06-02).
<threat_model>
Trust Boundaries
| Boundary | Description |
|---|---|
| user input → WebView navigation | Server URL typed by user controls where the WebView connects (untrusted text crosses into navigation) |
| local config store → app startup | Persisted server_url is read on launch and drives navigation |
STRIDE Threat Register
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|---|---|---|---|---|
| T-06-01 | Tampering | setup.html server URL input | mitigate | Validate with new URL() constructor; reject malformed; warn on non-https non-localhost (V5 input validation) |
| T-06-02 | Spoofing | WebView navigation target | accept | Internal-only tool; URL is user-chosen by design (D-02). CSP connect-src * required for configurable server. Locking to a single domain conflicts with the configurable-URL requirement; revisit at external-sales stage |
| T-06-03 | Information Disclosure | config.json stored URL | accept | URL is non-secret connection info stored via plugin-store (atomic, app-scoped path), not plaintext app config |
| T-06-SC | Tampering | npm/cargo installs | mitigate | All Tauri packages [Approved] in RESEARCH.md Package Legitimacy Audit; no [ASSUMED]/[SUS] blocking packages in this plan |
| </threat_model> |
<success_criteria>
- Tauri toolchain installed and verifiable (rustc, webkit2gtk-4.1 pkg-config)
apps/desktopexists as@tessera/desktopandcargo checkpasses- First-run setup page persists the server URL and connects the WebView to it (DESK-02)
- No frontend assets bundled —
frontendDistis the local setup page only (DESK-01 wrapper pattern) </success_criteria>