feat(desktop): desktop app

.github/workflows/ci.yml

@@ -69,6 +69,48 @@ jobs:
             echo "ℹ️ Not a release commit"
           fi
 
+  # Detect shell-code changes on dev/staging pushes. Web-only changes never
+  # need a desktop build (installed shells load the web app live); changes to
+  # the Electron app or the bridge packages trigger a per-env prerelease build
+  # (dev → alpha channel, staging → beta) that the env's update feed
+  # (/api/desktop/update) starts offering automatically.
+  detect-desktop-changes:
+    name: Detect Desktop Changes
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 5
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/staging')
+    outputs:
+      changed: ${{ steps.diff.outputs.changed }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 50
+
+      - name: Diff desktop paths
+        id: diff
+        env:
+          BEFORE: ${{ github.event.before }}
+        run: |
+          # Force pushes (dev resets) can reference a BEFORE we don't have;
+          # fall back to the previous commit, and to no build when even that
+          # is unavailable.
+          if [ -z "$BEFORE" ] || ! git cat-file -e "$BEFORE" 2>/dev/null; then
+            BEFORE="$(git rev-parse HEAD^ 2>/dev/null || echo '')"
+          fi
+          if [ -z "$BEFORE" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "ℹ️ No comparable base commit; skipping desktop prerelease"
+            exit 0
+          fi
+          if git diff --name-only "$BEFORE" HEAD | grep -qE '^(apps/desktop/|packages/desktop-bridge/|packages/browser-protocol/)'; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "✅ Desktop shell code changed"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "ℹ️ No desktop shell changes"
+          fi
+
   # Run database migrations before images are promoted: the ECR latest/staging
   # tag push triggers CodePipeline, so migrating first guarantees the schema is
   # in place before the new app version deploys (replaces the removed ECS
@@ -590,3 +632,172 @@ jobs:
         env:
           GH_PAT: ${{ secrets.GITHUB_TOKEN }}
         run: bun run scripts/create-single-release.ts ${{ needs.detect-version.outputs.version }}
+
+  # Desktop release: builds, signs, notarizes, and attaches the macOS app to
+  # the GitHub release created above. Gated on the Apple signing secrets so a
+  # release pipeline run skips cleanly (instead of failing) until the Apple
+  # Developer account is provisioned — the moment the six secrets exist, the
+  # next vX.Y.Z release ships desktop artifacts with no further changes.
+  # Job-level `if:` cannot read the secrets context, hence the probe job.
+  check-desktop-signing:
+    name: Check Desktop Signing Secrets
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 2
+    needs: [detect-version, detect-desktop-changes]
+    # !cancelled(): detect-desktop-changes is skipped on main (and
+    # detect-version tags only on main); either path may need the probe.
+    if: ${{ !cancelled() && (needs.detect-version.outputs.is_release == 'true' || needs.detect-desktop-changes.outputs.changed == 'true') }}
+    outputs:
+      configured: ${{ steps.check.outputs.configured }}
+    steps:
+      - name: Probe Apple signing secrets
+        id: check
+        env:
+          CONFIGURED: ${{ secrets.CSC_LINK != '' && secrets.CSC_KEY_PASSWORD != '' && secrets.APPLE_API_KEY_P8 != '' && secrets.APPLE_API_KEY_ID != '' && secrets.APPLE_API_ISSUER != '' && secrets.APPLE_TEAM_ID != '' }}
+        run: |
+          echo "configured=${CONFIGURED}" >> "$GITHUB_OUTPUT"
+          if [ "$CONFIGURED" != "true" ]; then
+            echo "::warning::Desktop release skipped: Apple signing secrets are not configured (CSC_LINK, CSC_KEY_PASSWORD, APPLE_API_KEY_P8, APPLE_API_KEY_ID, APPLE_API_ISSUER, APPLE_TEAM_ID)."
+          fi
+
+  desktop-release:
+    name: Desktop Release
+    needs: [create-release, check-desktop-signing, detect-version]
+    if: needs.check-desktop-signing.outputs.configured == 'true'
+    permissions:
+      contents: write
+    uses: ./.github/workflows/desktop-release.yml
+    with:
+      version: ${{ needs.detect-version.outputs.version }}
+      publish: true
+    secrets: inherit
+
+  # Per-env desktop prereleases: a dev/staging push that touches shell code
+  # publishes a channel-tagged GitHub prerelease (vX.Y.Z-alpha.N from dev,
+  # vX.Y.Z-beta.N from staging). Each environment's /api/desktop/update feed
+  # offers only its channel, so dev-pointed shells pick up alpha builds,
+  # staging-pointed shells beta builds, and prod-pointed shells stable
+  # releases — independently. Unlike stable releases, prereleases build even
+  # before the Apple signing secrets exist — unsigned, so the update pipeline
+  # is testable end to end; installed shells detect the missing Developer ID
+  # and offer a manual download instead of a Squirrel install.
+  create-desktop-prerelease:
+    name: Create Desktop Prerelease
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 5
+    needs: [detect-desktop-changes, check-desktop-signing]
+    # Requires the signing probe to have actually succeeded (not just "not
+    # cancelled") so a probe failure can't produce a release with no build.
+    if: ${{ !cancelled() && needs.detect-desktop-changes.outputs.changed == 'true' && needs.check-desktop-signing.result == 'success' }}
+    permissions:
+      contents: write
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Compute prerelease version and create draft release
+        id: version
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          SIGNED: ${{ needs.check-desktop-signing.outputs.configured }}
+        run: |
+          if [ "$GITHUB_REF" = "refs/heads/dev" ]; then CHANNEL=alpha; APP_NAME="Sim Dev"; else CHANNEL=beta; APP_NAME="Sim Staging"; fi
+          # Prerelease core = next patch after the latest stable release, so
+          # channel builds always outrank the stable they are built on top of
+          # and are always superseded by the next stable. The run-attempt
+          # suffix keeps re-runs of the same workflow from colliding on the
+          # tag while preserving semver ordering.
+          LATEST="$(gh release list --exclude-pre-releases --limit 1 --json tagName --jq '.[0].tagName' || true)"
+          LATEST="${LATEST:-v0.0.0}"
+          IFS='.' read -r MAJOR MINOR PATCH <<< "${LATEST#v}"
+          TAG="v${MAJOR}.${MINOR}.$((PATCH + 1))-${CHANNEL}.${GITHUB_RUN_NUMBER}.${GITHUB_RUN_ATTEMPT}"
+          NOTES="Automated ${CHANNEL}-channel desktop build from ${GITHUB_REF_NAME} @ ${GITHUB_SHA::7}."
+          if [ "$SIGNED" != "true" ]; then
+            NOTES="$NOTES
+
+          ⚠️ Unsigned test build (Apple signing secrets not configured). Gatekeeper will quarantine a downloaded copy: right-click → Open, or clear the flag with \`xattr -dr com.apple.quarantine \"/Applications/${APP_NAME}.app\"\`."
+          fi
+          # Draft until the build uploads its artifacts: drafts are invisible
+          # to the update feed, so a failed or in-flight build can never take
+          # the channel down with an assetless release. Publishing later also
+          # defers tag creation, so failed builds strand no tags.
+          gh release create "$TAG" \
+            --draft \
+            --prerelease \
+            --target "$GITHUB_SHA" \
+            --title "$TAG" \
+            --notes "$NOTES"
+          echo "version=$TAG" >> "$GITHUB_OUTPUT"
+          echo "✅ Created draft prerelease $TAG"
+
+  desktop-prerelease:
+    name: Desktop Prerelease Build
+    needs: [create-desktop-prerelease, check-desktop-signing]
+    permissions:
+      contents: write
+    uses: ./.github/workflows/desktop-release.yml
+    with:
+      version: ${{ needs.create-desktop-prerelease.outputs.version }}
+      publish: true
+      sign: ${{ needs.check-desktop-signing.outputs.configured == 'true' }}
+    secrets: inherit
+
+  # The draft only becomes visible to the update feed once its artifacts are
+  # attached — this is what makes a dev/staging push atomic from the shell's
+  # point of view.
+  publish-desktop-prerelease:
+    name: Publish Desktop Prerelease
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 5
+    needs: [create-desktop-prerelease, desktop-prerelease]
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+      TAG: ${{ needs.create-desktop-prerelease.outputs.version }}
+    steps:
+      - name: Publish the draft release
+        run: gh release edit "$TAG" --draft=false
+
+  # Keep the release list tidy: per channel, retain the newest 5 prereleases
+  # and delete the rest (with their tags, so dev force-resets don't strand
+  # commits behind stale tags). Leftover drafts (failed or superseded builds)
+  # are always garbage by this point — the current run's release is published.
+  prune-desktop-prereleases:
+    name: Prune Desktop Prereleases
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 5
+    needs: [publish-desktop-prerelease]
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+    steps:
+      - name: Delete stale prereleases
+        run: |
+          if [ "$GITHUB_REF" = "refs/heads/dev" ]; then CHANNEL=alpha; else CHANNEL=beta; fi
+          gh release list --limit 100 --json tagName,isPrerelease,isDraft,createdAt \
+            --jq "[.[] | select(.isPrerelease and (.isDraft | not) and (.tagName | test(\"-${CHANNEL}\\\\.\")))] | sort_by(.createdAt) | reverse | .[5:] | .[].tagName" |
+          while read -r TAG; do
+            [ -n "$TAG" ] || continue
+            echo "Deleting stale prerelease $TAG"
+            gh release delete "$TAG" --cleanup-tag --yes
+          done
+
+      - name: Delete leftover draft prereleases
+        run: |
+          if [ "$GITHUB_REF" = "refs/heads/dev" ]; then CHANNEL=alpha; else CHANNEL=beta; fi
+          # Drafts have no tag ref, so delete by release id via the API
+          # (gh release delete resolves by tag, which is ambiguous for drafts).
+          gh api "repos/${GH_REPO}/releases?per_page=100" \
+            --jq ".[] | select(.draft and (.tag_name | test(\"-${CHANNEL}\\\\.\"))) | .id" |
+          while read -r ID; do
+            [ -n "$ID" ] || continue
+            echo "Deleting leftover draft release $ID"
+            gh api -X DELETE "repos/${GH_REPO}/releases/${ID}"
+          done

.github/workflows/desktop-e2e.yml

@@ -0,0 +1,85 @@
+name: Desktop E2E
+
+# Smoke coverage of the real Electron shell, plus an advisory canary leg
+# against electron@latest so Chromium-cadence breakage surfaces before an
+# upgrade is attempted (U18/U22).
+#
+# Manual-only for now: the desktop app is tested locally, so the
+# pull_request trigger is disabled until desktop CI is turned back on.
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: desktop-e2e-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  e2e:
+    name: E2E (${{ matrix.electron }})
+    runs-on: macos-14
+    strategy:
+      fail-fast: false
+      matrix:
+        electron: [pinned, latest]
+    continue-on-error: ${{ matrix.electron == 'latest' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.13
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Switch to electron@latest (canary)
+        if: matrix.electron == 'latest'
+        working-directory: apps/desktop
+        run: bun add -d electron@latest
+
+      - name: Bundle main and preload
+        working-directory: apps/desktop
+        run: bun run build
+
+      - name: Run Playwright _electron smoke suite
+        working-directory: apps/desktop
+        run: bunx playwright test
+
+      - name: Upload test results
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: desktop-e2e-results-${{ matrix.electron }}
+          path: apps/desktop/test-results
+          retention-days: 7
+
+  package-smoke:
+    name: Unsigned package smoke
+    runs-on: macos-14
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.13
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Bundle and package unsigned
+        working-directory: apps/desktop
+        env:
+          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+        run: |
+          bun run build
+          bunx electron-builder --mac dir --publish never