feat(native): add Studio desktop app with a local Rust runtime

.github/workflows/test.yml

@@ -179,12 +179,18 @@ jobs:
           test -f apps/api/dist/server/migrate.js
           test -f apps/api/dist/server/cli.js
 
+      # `build:web` rather than `build` so VITE_TAURI_APP=0 is stated, not
+      # inherited from the variable happening to be unset — the desktop-free
+      # assertion below is only meaningful against a known browser build.
       - name: Build web app
-        run: bun run --cwd=apps/web build
+        run: bun run --cwd=apps/web build:web
 
       - name: Verify web output
         run: test -f apps/web/dist/index.html
 
+      - name: Assert no Tauri desktop code in the browser bundle
+        run: bun run check:web-bundle
+
   # Playwright component tests for the sections-editor field widgets
   # (apps/web/ct). Self-contained — real chromium, no server/DB — so it lives
   # here rather than e2e.yml, gated to web changes only.

.gitignore

@@ -100,6 +100,8 @@ packages/e2e/playwright-report/
 # so we can un-ignore specific subdirs below — git won't traverse into an
 # ignored directory.
 /docs/*
+# Committed engineering plans (desktop migration etc.)
+!/docs/plans/
 # Superpowers workspace artifacts (brainstorming + writing-plans output)
 # are kept local to the working tree, not committed.
 

AGENTS.md

@@ -25,8 +25,24 @@ bun run --cwd=apps/api dev:server
 
 # Run documentation site locally
 bun run docs:dev
+
+# Native desktop app (Tauri) dev loop — HMR via Vite on port 4420
+bun run --cwd=apps/native dev
 ```
 
+**One-time macOS setup for `apps/native` devs**: run
+`bun run --cwd=apps/native dev:signing:setup` once. It creates or reuses the
+local self-signed `decocms-dev` code-signing identity; no Apple Developer
+account is required. It also builds, signs, and installs one fixed
+`decocms-keychain-helper` under the user's Application Support directory.
+Debug app rebuilds talk to that unchanged helper over JSON stdin/stdout, so
+Keychain sees one stable executable; tokens never use argv, logs, or a
+filesystem fallback. The native dev runner still signs the app itself and
+fails closed if signing drifts, but the fixed helper—not the app's self-signed
+designated requirement—is what makes debug Keychain access stable. Debug
+sessions stay in the Keychain-only `com.decocms.studio.dev` namespace; release
+sessions stay in `com.decocms.studio`.
+
 ### Testing & Quality
 ```bash
 # Run all tests (Bun test runner)

README.md

@@ -183,6 +183,7 @@ Every tool call gets input/output validation, access control, audit logging, and
 | --- | --- |
 | [`apps/api`](./apps/api/README.md) | Hono API, authentication, tools, storage, migrations, and the `deco` CLI |
 | [`apps/docs`](./apps/docs/README.md) | Astro documentation site |
+| [`apps/native`](./apps/native/README.md) | Tauri desktop app and local Rust runtime |
 | [`apps/web`](./apps/web/README.md) | Vite and React 19 administration interface |
 
 ### Packages

apps/api/package.json

@@ -113,7 +113,7 @@
     "typescript": "^7.0.2",
     "typescript5": "npm:typescript@^5.9.3",
     "vite": "^7.2.1",
-    "zod": "^4.0.0"
+    "zod": "4.3.6"
   },
   "homepage": "https://github.com/decocms/studio",
   "keywords": [

apps/api/src/api/routes/desktop-session-bridge.ts

@@ -2,7 +2,7 @@
  * Desktop system-browser session bridge.
  *
  * `POST /api/auth/desktop/session-from-oauth` — the one Studio-side change
- * `apps/desktop/docs/real-ui-auth-recon.md` concluded was unavoidable to fix
+ * the native authentication contract concluded was unavoidable to fix
  * the Google/GitHub/SAML system-browser desktop login path: an MCP OAuth
  * access token (the `oauthAccessToken` row both desktop login paths
  * ultimately hold) satisfies org-scoped `/api/:org/*` routes but is REJECTED
@@ -20,7 +20,7 @@
  * `Set-Cookie` header — this caller is a native app process, not a browser
  * that would capture one) so it can forward that value itself, byte for
  * byte, as `Cookie: better-auth.session_token=<value>` — see
- * `apps/desktop/crates/upstream/src/login.rs`'s
+ * `apps/native/crates/upstream/src/login.rs`'s
  * `mint_session_from_access_token`, the Rust-side caller.
  *
  * ## Auth guard

apps/native/.cargo/config.toml

@@ -0,0 +1,11 @@
+# macOS dev-build signing hook. Cargo routes each locally-executed binary
+# through the runner, but the script signs only `decocms-desktop`; test binaries
+# pass through unchanged. The app uses the local self-signed `decocms-dev`
+# identity with an explicit certificate-hash + bundle-identifier requirement so
+# Keychain ACLs remain stable across rebuilds. Signing fails closed instead of
+# launching an ad-hoc binary.
+[target.aarch64-apple-darwin]
+runner = "scripts/dev-runner.sh"
+
+[target.x86_64-apple-darwin]
+runner = "scripts/dev-runner.sh"

apps/native/.gitignore

@@ -0,0 +1,4 @@
+/target/
+**/target/
+/.dev-signing-identity
+/src-tauri/binaries/