2026-10-12 17:42:25 -04:00
21 changed files with 5909 additions and 1 deletions
@@ -1,4 +1,4 @@
-.PHONY: deploy redeploy build up down restart logs migrate migrate-new migrate-history frontend test test-cov reindex reindex-obsidian
+.PHONY: deploy redeploy build up down restart logs migrate migrate-new migrate-history frontend desktop desktop-dev test test-cov reindex reindex-obsidian

 # Blue-green: detect the running color (default blue when nothing is running)
 ACTIVE_COLOR := $(shell docker compose ps --status running --services 2>/dev/null | grep -oE 'raggr-(blue|green)' | head -1 | cut -d- -f2)
@@ -70,3 +70,14 @@ test-cov:
 # Frontend
 frontend:
 	cd raggr-frontend && yarn install && yarn build
+
+# Desktop app (Tauri). Point it at the server with SIMBA_URL, e.g.
+#   make desktop-dev SIMBA_URL=https://simba.example.com
+# SIMBA_URL is read at runtime and baked in at build time as the default.
+desktop-dev:
+	cd desktop && npm install && SIMBA_URL=$(SIMBA_URL) npx tauri dev
+
+desktop:
+	cd desktop && npm install && SIMBA_URL=$(SIMBA_URL) npx tauri build --bundles app
+	rm -rf /Applications/Simba.app
+	cp -R desktop/src-tauri/target/release/bundle/macos/Simba.app /Applications/
@@ -0,0 +1,3 @@
+node_modules/
+src-tauri/target/
+src-tauri/gen/
@@ -0,0 +1,232 @@
+{
+  "name": "simba-desktop",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "simba-desktop",
+      "version": "0.1.0",
+      "devDependencies": {
+        "@tauri-apps/cli": "^2.12.2"
+      }
+    },
+    "node_modules/@tauri-apps/cli": {
+      "version": "2.12.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli/-/cli-2.12.2.tgz",
+      "integrity": "sha512-PMSppzAnlT+BvZtRKuidxjRSm2r5t8kDpJ/czmmQUa0AtDNTwrjLE8vApK3phCWGg7isfnYL46Dl1jB4ArI0hA==",
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "bin": {
+        "tauri": "tauri.js"
+      },
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/tauri"
+      },
+      "optionalDependencies": {
+        "@tauri-apps/cli-darwin-arm64": "2.12.2",
+        "@tauri-apps/cli-darwin-x64": "2.12.2",
+        "@tauri-apps/cli-linux-arm-gnueabihf": "2.12.2",
+        "@tauri-apps/cli-linux-arm64-gnu": "2.12.2",
+        "@tauri-apps/cli-linux-arm64-musl": "2.12.2",
+        "@tauri-apps/cli-linux-riscv64-gnu": "2.12.2",
+        "@tauri-apps/cli-linux-x64-gnu": "2.12.2",
+        "@tauri-apps/cli-linux-x64-musl": "2.12.2",
+        "@tauri-apps/cli-win32-arm64-msvc": "2.12.2",
+        "@tauri-apps/cli-win32-ia32-msvc": "2.12.2",
+        "@tauri-apps/cli-win32-x64-msvc": "2.12.2"
+      }
+    },
+    "node_modules/@tauri-apps/cli-darwin-arm64": {
+      "version": "2.12.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-arm64/-/cli-darwin-arm64-2.12.2.tgz",
+      "integrity": "sha512-Lk3zaBTfzNvA7670Al5PNgo2M/95uaDPe1yp+ILJeDOmol87XiYuK5E5+FUbK5e6U6OORx9qpZdOo2U+5tETtQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-darwin-x64": {
+      "version": "2.12.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-darwin-x64/-/cli-darwin-x64-2.12.2.tgz",
+      "integrity": "sha512-2CyYjJ833JB3sKRz4B0W/Tv4oOVC16ws1bxdSCWj1XvrmanWwvZi99e5tNIoCHwHhcOm0jh+sh0PCGQyls6Z+w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-linux-arm-gnueabihf": {
+      "version": "2.12.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm-gnueabihf/-/cli-linux-arm-gnueabihf-2.12.2.tgz",
+      "integrity": "sha512-uvt2xbone4JftKarelssi86Kqnl7JiG1Smh5+Ae+nZmtM+JUhTGmqkcqfUPXRW8Ygwog92POZvd4oGDN9j8eXQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-linux-arm64-gnu": {
+      "version": "2.12.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-gnu/-/cli-linux-arm64-gnu-2.12.2.tgz",
+      "integrity": "sha512-DZlDJ24u3tlocKOYqzR+b2M+Qr+5WFcoMBZ7EfdhHN5j3ZXwBBpms4G4gyNvPCrak5vMzmdZ65ecBXPJcC+5sA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-linux-arm64-musl": {
+      "version": "2.12.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.12.2.tgz",
+      "integrity": "sha512-pb+RTZUYH/p0gR4j4ecCCq+FNfz3W3eKuUQvVEBn7MQZx6DzfLO7FaYzt2NyDKWpdNN3lP10mdzOvw3R5P5aAQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-linux-riscv64-gnu": {
+      "version": "2.12.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-riscv64-gnu/-/cli-linux-riscv64-gnu-2.12.2.tgz",
+      "integrity": "sha512-nidEvDUJyHYNbIv9MUk6KiEix8IXfRh4Wj2G2SA5g8nFmgbBCwazUNWYiG/LhNeNbfZpBMLerRBUtoQ5K0GidA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-linux-x64-gnu": {
+      "version": "2.12.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-gnu/-/cli-linux-x64-gnu-2.12.2.tgz",
+      "integrity": "sha512-gkXyYn3w+Xfc8nz/DleEbkm1M7bBuU2cejqUXNmI98cA2P5kp+oPmS4ALTorb1FaNWjpsKoYZBWsbS9BXxYFkQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-linux-x64-musl": {
+      "version": "2.12.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-linux-x64-musl/-/cli-linux-x64-musl-2.12.2.tgz",
+      "integrity": "sha512-MrjgoZ09s8Hsn99XvxSNvK8NQTZxi7XiyK3FxxytzfHgz2jb3qUT69CZtsokRkN/zdi9rCgrMtq+w9XNICjcfQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-win32-arm64-msvc": {
+      "version": "2.12.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-arm64-msvc/-/cli-win32-arm64-msvc-2.12.2.tgz",
+      "integrity": "sha512-BR+CYM7iF3lkfyTtVkwMQU/s9hwegLpj3UqDjaxKCPmixQCa1csBBPy3C75V+FhLtOjIXNna4Gt6Vm9oxbV+qA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-win32-ia32-msvc": {
+      "version": "2.12.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-ia32-msvc/-/cli-win32-ia32-msvc-2.12.2.tgz",
+      "integrity": "sha512-zODJo9l3TbNBM+GrO/yPqGeELNMK5cjIc+QHh1WQc3l8tD+jDZGTQyYuAxViCsM6Uh5uWJ//RnCZG9LXrvsXww==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@tauri-apps/cli-win32-x64-msvc": {
+      "version": "2.12.2",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/cli-win32-x64-msvc/-/cli-win32-x64-msvc-2.12.2.tgz",
+      "integrity": "sha512-cQXI2ZaZmwBDt0XATCqASVanYizxkEE3ceQVlVHXaQ51HzsQUWA04c9Nz7LrrY2lgAu3jFMyat+8Yz3Z2R2qBA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 OR MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    }
+  }
+}
@@ -0,0 +1,13 @@
+{
+  "name": "simba-desktop",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "tauri": "tauri",
+    "dev": "tauri dev",
+    "build": "tauri build --bundles app"
+  },
+  "devDependencies": {
+    "@tauri-apps/cli": "^2.12.2"
+  }
+}
@@ -0,0 +1,17 @@
+[package]
+name = "simba-desktop"
+version = "0.1.0"
+edition = "2021"
+
+[lib]
+name = "simba_desktop_lib"
+crate-type = ["staticlib", "cdylib", "rlib"]
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+
+[dependencies]
+tauri = { version = "2", features = ["tray-icon", "image-png"] }
+tauri-plugin-global-shortcut = "2"
+tauri-plugin-single-instance = "2"
+url = "2"
@@ -0,0 +1,3 @@
+fn main() {
+    tauri_build::build()
+}
@@ -0,0 +1,7 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "default",
+  "description": "Bundled pages only (offline/connect screen). The remote SimbaRAG origin gets no IPC.",
+  "windows": ["main"],
+  "permissions": ["core:default"]
+}
@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.90.0"
+profile = "minimal"
@@ -0,0 +1,171 @@
+//! Simba desktop shell.
+//!
+//! A thin native wrapper around the deployed SimbaRAG web app: the main window
+//! starts on a bundled connect page (`ui/index.html`) that checks the server is
+//! reachable and then navigates to it. The Rust side owns everything the web
+//! app can't do: the menu-bar icon, the global hotkey, and keeping the app
+//! alive when the window is closed.
+
+use tauri::{
+    menu::{Menu, MenuItem, PredefinedMenuItem},
+    tray::{MouseButton, MouseButtonState, TrayIconBuilder, TrayIconEvent},
+    AppHandle, Manager, RunEvent, WebviewUrl, WebviewWindow, WebviewWindowBuilder, WindowEvent,
+};
+use tauri_plugin_global_shortcut::{Code, GlobalShortcutExt, Modifiers, Shortcut, ShortcutState};
+
+const MAIN: &str = "main";
+const DEFAULT_SERVER_URL: &str = "http://localhost:8080";
+
+/// Server URL: `SIMBA_URL` at runtime, else at build time, else localhost.
+fn server_url() -> String {
+    std::env::var("SIMBA_URL")
+        .ok()
+        .or_else(|| option_env!("SIMBA_URL").map(str::to_owned))
+        .unwrap_or_else(|| DEFAULT_SERVER_URL.to_owned())
+        .trim_end_matches('/')
+        .to_owned()
+}
+
+/// Bundled connect page, told which server to probe and open.
+fn connect_url() -> WebviewUrl {
+    let mut url = url::Url::parse("tauri://localhost/index.html").expect("static url");
+    url.query_pairs_mut().append_pair("server", &server_url());
+    WebviewUrl::App(format!("index.html?{}", url.query().unwrap_or_default()).into())
+}
+
+fn main_window(app: &AppHandle) -> Option<WebviewWindow> {
+    app.get_webview_window(MAIN)
+}
+
+fn show(app: &AppHandle) {
+    if let Some(window) = main_window(app) {
+        let _ = window.unminimize();
+        let _ = window.show();
+        let _ = window.set_focus();
+    }
+}
+
+fn toggle(app: &AppHandle) {
+    let Some(window) = main_window(app) else { return };
+    let focused = window.is_visible().unwrap_or(false) && window.is_focused().unwrap_or(false);
+    if focused {
+        let _ = window.hide();
+    } else {
+        show(app);
+    }
+}
+
+/// Re-run the connect page (server probe + redirect), e.g. after an outage.
+fn reconnect(app: &AppHandle) {
+    if let Some(window) = main_window(app) {
+        let WebviewUrl::App(path) = connect_url() else { return };
+        if let Ok(url) = url::Url::parse(&format!("tauri://localhost/{}", path.display())) {
+            let _ = window.navigate(url);
+        }
+        show(app);
+    }
+}
+
+fn new_chat(app: &AppHandle) {
+    if let Some(window) = main_window(app) {
+        if let Ok(url) = url::Url::parse(&format!("{}/", server_url())) {
+            let _ = window.navigate(url);
+        }
+        show(app);
+    }
+}
+
+fn build_tray(app: &AppHandle) -> tauri::Result<()> {
+    let show_item = MenuItem::with_id(app, "show", "Show Simba", true, Some("Alt+Space"))?;
+    let new_chat_item = MenuItem::with_id(app, "new_chat", "New Chat", true, None::<&str>)?;
+    let reconnect_item = MenuItem::with_id(app, "reconnect", "Reconnect", true, None::<&str>)?;
+    let quit_item = MenuItem::with_id(app, "quit", "Quit Simba", true, Some("Cmd+Q"))?;
+    let menu = Menu::with_items(
+        app,
+        &[
+            &show_item,
+            &new_chat_item,
+            &PredefinedMenuItem::separator(app)?,
+            &reconnect_item,
+            &PredefinedMenuItem::separator(app)?,
+            &quit_item,
+        ],
+    )?;
+
+    let mut tray = TrayIconBuilder::with_id("simba")
+        .tooltip("Simba")
+        .menu(&menu)
+        .show_menu_on_left_click(false)
+        .on_menu_event(|app, event| match event.id.as_ref() {
+            "show" => show(app),
+            "new_chat" => new_chat(app),
+            "reconnect" => reconnect(app),
+            "quit" => app.exit(0),
+            _ => {}
+        })
+        .on_tray_icon_event(|tray, event| {
+            if let TrayIconEvent::Click {
+                button: MouseButton::Left,
+                button_state: MouseButtonState::Up,
+                ..
+            } = event
+            {
+                toggle(tray.app_handle());
+            }
+        });
+    if let Some(icon) = app.default_window_icon() {
+        tray = tray.icon(icon.clone());
+    }
+    tray.build(app)?;
+    Ok(())
+}
+
+fn register_hotkey(app: &AppHandle) -> tauri::Result<()> {
+    let hotkey = Shortcut::new(Some(Modifiers::ALT), Code::Space);
+    app.plugin(
+        tauri_plugin_global_shortcut::Builder::new()
+            .with_handler(move |app, shortcut, event| {
+                if shortcut == &hotkey && event.state() == ShortcutState::Pressed {
+                    toggle(app);
+                }
+            })
+            .build(),
+    )?;
+    // Another app may already own ⌥Space; the tray still works without it.
+    if let Err(e) = app.global_shortcut().register(hotkey) {
+        eprintln!("simba: could not register Alt+Space: {e}");
+    }
+    Ok(())
+}
+
+pub fn run() {
+    tauri::Builder::default()
+        .plugin(tauri_plugin_single_instance::init(|app, _args, _cwd| show(app)))
+        .setup(|app| {
+            WebviewWindowBuilder::new(app, MAIN, connect_url())
+                .title("Simba")
+                .inner_size(1200.0, 820.0)
+                .min_inner_size(420.0, 520.0)
+                .build()?;
+            build_tray(app.handle())?;
+            register_hotkey(app.handle())?;
+            Ok(())
+        })
+        .on_window_event(|window, event| {
+            // Closing the window hides it; Simba lives on in the menu bar.
+            if let WindowEvent::CloseRequested { api, .. } = event {
+                if window.label() == MAIN {
+                    api.prevent_close();
+                    let _ = window.hide();
+                }
+            }
+        })
+        .build(tauri::generate_context!())
+        .expect("error while building Simba")
+        .run(|app, event| {
+            // Clicking the Dock icon brings the hidden window back.
+            if let RunEvent::Reopen { .. } = event {
+                show(app);
+            }
+        });
+}
@@ -0,0 +1,6 @@
+// Prevents an extra console window on Windows in release builds.
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+fn main() {
+    simba_desktop_lib::run()
+}
@@ -0,0 +1,26 @@
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "productName": "Simba",
+  "version": "0.1.0",
+  "identifier": "co.torrtle.simba",
+  "build": {
+    "frontendDist": "../ui"
+  },
+  "app": {
+    "windows": [],
+    "security": {
+      "csp": null
+    }
+  },
+  "bundle": {
+    "active": true,
+    "targets": ["app"],
+    "icon": [
+      "icons/32x32.png",
+      "icons/128x128.png",
+      "icons/128x128@2x.png",
+      "icons/icon.icns",
+      "icons/icon.png"
+    ]
+  }
+}
@@ -0,0 +1,88 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Simba</title>
+  <style>
+    :root {
+      --cream: #FAF8F2;
+      --leaf: #2A4D38;
+      --muted: #7a7266;
+      --card: #ffffff;
+      --border: #e6e0d4;
+    }
+    @media (prefers-color-scheme: dark) {
+      :root { --cream: #1b1d1a; --leaf: #8fc4a1; --muted: #a39d92; --card: #24271f; --border: #34382f; }
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0; min-height: 100vh; display: grid; place-items: center;
+      background: var(--cream); color: var(--leaf);
+      font: 15px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+      -webkit-user-select: none; user-select: none;
+    }
+    main { text-align: center; padding: 16px; max-width: 360px; }
+    .cat { font-size: 48px; display: inline-block; animation: bob 1.2s ease-in-out infinite; }
+    .offline .cat { animation: none; filter: grayscale(1); }
+    @keyframes bob { 50% { transform: translateY(-6px); } }
+    h1 { font-size: 17px; margin: 12px 0 4px; }
+    p { margin: 0; color: var(--muted); font-size: 13px; }
+    code { font-size: 12px; background: var(--card); border: 1px solid var(--border); border-radius: 6px; padding: 1px 6px; }
+    button {
+      margin-top: 16px; padding: 6px 16px; border-radius: 999px; cursor: pointer;
+      border: 1px solid var(--border); background: var(--card); color: var(--leaf); font: inherit;
+    }
+    .online-only { display: block; }
+    .offline-only { display: none; }
+    .offline .online-only { display: none; }
+    .offline .offline-only { display: block; }
+  </style>
+</head>
+<body>
+  <main id="root">
+    <div class="cat">🐈</div>
+    <div class="online-only">
+      <h1>waking up simba…</h1>
+      <p>connecting to <code id="server-a"></code></p>
+    </div>
+    <div class="offline-only">
+      <h1>Can't reach Simba</h1>
+      <p><code id="server-b"></code> isn't responding. Retrying every few seconds.</p>
+      <button id="retry" type="button">Try now</button>
+    </div>
+  </main>
+  <script>
+    // The Rust shell passes the server in ?server=. Probe it, then hand the
+    // whole window over to the real web app.
+    const server = (new URLSearchParams(location.search).get("server") || "http://localhost:8080").replace(/\/+$/, "");
+    const root = document.getElementById("root");
+    document.getElementById("server-a").textContent = server;
+    document.getElementById("server-b").textContent = server;
+
+    let timer = null;
+
+    async function probe() {
+      clearTimeout(timer);
+      const ctrl = new AbortController();
+      const abort = setTimeout(() => ctrl.abort(), 5000);
+      try {
+        // no-cors: we only care that the server answered, not what it said.
+        await fetch(`${server}/api/health`, { mode: "no-cors", cache: "no-store", signal: ctrl.signal });
+        location.replace(`${server}/`);
+      } catch {
+        root.classList.add("offline");
+        timer = setTimeout(probe, 5000);
+      } finally {
+        clearTimeout(abort);
+      }
+    }
+
+    document.getElementById("retry").addEventListener("click", () => {
+      root.classList.remove("offline");
+      probe();
+    });
+    probe();
+  </script>
+</body>
+</html>
@@ -0,0 +1,354 @@
+# Desktop Client (exploration)
+
+Status: **proposal**, no app code yet. Branch `explore/desktop-client`.
+
+Goal: a persistent, native-feeling macOS app where Simba works *alongside* the
+user rather than a chat box in a browser tab. "Cowork-like" means:
+
+- visible tool activity and progress while the agent works
+- side panels for artifacts: budget reports, recipes, notes, documents
+- drag files into the agent
+- desktop notifications (scheduled messages, cron jobs, finished runs)
+- a menu-bar icon and a global-hotkey quick-ask window
+
+## Decisions (2026-10-12)
+
+| Question | Decision | Consequence |
+|---|---|---|
+| Reachable off-LAN? | Yes, publicly via Caddy | Loading the remote origin works anywhere; `offline.html` only covers "no network / server down" |
+| Who uses it? | Just the admin (Ryan) | Every desktop-only endpoint is `@admin_required`; no multi-user notification fan-out, no distribution story |
+| Act on the Mac (local tools)? | **Yes** | Adds a *local tool bridge* (below). Tauri is still the pick: the bridge lives in the Rust core and can spawn local MCP servers as child processes |
+| Artifact storage | Own `artifacts` table | Artifacts can be listed, reopened, edited and written back |
+| Stop sending the refresh token on every request? | Yes, for web too | Becomes phase 0 (see "Auth fix") |
+| Apple Developer account? | No; a local dev build is fine | No notarization or updater. `make desktop` builds an ad-hoc-signed `.app` locally |
+
+## What exists today
+
+| Area | Current state | Desktop implication |
+|---|---|---|
+| Frontend | React 19 + Rsbuild + Tailwind, `BrowserRouter`, all API calls use relative `/api/...` | Reusable as-is if the shell loads it from the server origin; a bundled copy needs an API base URL and CORS |
+| PWA | `manifest.json` + `sw.js` (static cache, network-only `/api`) | "Install app" already works in Chrome / Safari "Add to Dock" |
+| Streaming | `POST /api/conversation/stream-query` → SSE over `fetch` with events `thinking`, `thinking_delta`, `tool_start {tool}`, `tool_end {tool}`, `content`, `response`, `error` | Too thin for Cowork: tool events have no run id, no args, no output, no structured payload |
+| Run lifecycle | The agent runs *inside* the HTTP response generator. A client disconnect cancels it (`CancelledError`, partial answer persisted) | You can't close the window and let Simba keep working |
+| Tool output | Tools return strings; output is persisted as `speaker="tool"` text (capped at 4000 chars) and the UI only shows the first line. `simba_search` already uses `response_format="content_and_artifact"` | Natural hook for structured artifacts |
+| Tool labels | `TOOL_MESSAGES` map in `useChat.ts` is hand-maintained and stale (no Mealie, SimbaKit, Homebox, BookStack, Beli…) | Labels should come from the server |
+| Uploads | `POST /api/conversation/upload-image`: images only, 10 MB, stored in S3, attached as an image block | Need generic file upload (PDF, text, markdown, CSV) |
+| Auth | Backend is the confidential OIDC client. `/oidc/login` returns an Authelia URL; Authelia redirects to `OIDC_REDIRECT_URI` (the web root); the SPA posts `code`+`state` to `/oidc/callback` and stores JWTs in `localStorage` | In-webview login works unchanged if the shell loads the real origin. A system-browser login needs a handoff (see below) |
+| Auth quirks | `_oidc_sessions` is an in-process dict (a login that spans a blue/green flip fails with "Invalid or expired state"); `redirect_after_login` is stored but never used; every API call sends the **30-day refresh token** as the bearer (`@jwt_refresh_token_required` everywhere) | Desktop must keep that token in the Keychain, not plain storage |
+| Notifications | Scheduled messages and cron jobs deliver to iMessage / email only (admin-only APIs) | No in-app notification channel exists |
+| CORS | None configured | Only matters for a bundled frontend |
+
+## Shell options
+
+### A. PWA ("Install app" / "Add to Dock")
+
+- **Reuse:** 100%. Already shipped.
+- **Size:** 0.
+- **macOS integration:** own window and Dock icon; Web Push and the Badging API
+  work for installed PWAs. **No** menu-bar icon, **no** global hotkey, no
+  quick-ask panel, no Keychain, file access only through the picker/drop.
+- **OIDC:** unchanged.
+- **Verdict:** a free baseline and the fallback. It can't deliver the
+  menu-bar or hotkey parts, which are most of what makes it feel like a
+  desktop app.
+
+### B. Tauri v2 (recommended)
+
+- **Reuse:** high. Either load the deployed frontend from the server origin
+  (no fork), or bundle `raggr-frontend/dist` (needs an API base URL plus CORS).
+- **Size:** ~5–15 MB `.app`, low idle memory (system WKWebView). Rust and
+  cargo are already installed on this machine.
+- **macOS integration:** first-party plugins for tray/menu-bar (core
+  `TrayIcon`), `global-shortcut`, `notification`, `deep-link`,
+  `single-instance`, `window-state`, `autostart`, `updater`, `positioner`
+  (anchor the quick-ask panel under the tray icon), keychain storage, and
+  window file drag-drop events with real paths. `ActivationPolicy::Accessory`
+  gives a menu-bar-only mode.
+- **Costs:** Safari/WebKit engine (the PWA already targets Safari, so low
+  risk). Service workers don't run in WKWebView here (the `sw.js` register
+  call already fails soft). Native code is Rust, but the native layer stays
+  small: tray, hotkey, notifications, keychain, deep link.
+- **Security:** remote content can reach Tauri IPC only through an explicit
+  `remote.urls` capability. Grant the remote origin only notification and
+  window commands; register shortcut and tray from Rust, not JS.
+
+### C. Electron
+
+- **Reuse:** same as Tauri.
+- **Size:** ~100 MB+ download, ~200 MB+ on disk, 150–300 MB RAM idle.
+- **macOS integration:** everything Tauri has, more mature (`menubar`
+  package, `globalShortcut`, `Notification`, `safeStorage`), plus Node in the
+  main process. That would matter if the client ran local tools or MCP
+  servers on the user's machine (see open questions).
+- **Verdict:** the better choice only if we want heavy client-side tool
+  execution in JS/Node. For a thin client to a self-hosted agent, the size
+  and memory cost buys nothing. Local tools are wanted, but the bridge design
+  below runs local MCP servers as child processes (Node is already installed),
+  so Electron's in-process Node isn't needed.
+
+### Decision matrix
+
+| | PWA | Tauri v2 | Electron |
+|---|---|---|---|
+| Reuse raggr-frontend | ✅ as-is | ✅ remote or bundled | ✅ remote or bundled |
+| Bundle / RAM | none | ~10 MB / low | ~100 MB+ / high |
+| Menu bar + quick-ask | ❌ | ✅ | ✅ |
+| Global hotkey | ❌ | ✅ | ✅ |
+| Notifications | Web Push (VAPID) | ✅ native | ✅ native |
+| File drag-drop w/ paths | browser `File` only | ✅ | ✅ |
+| Secure token storage | ❌ localStorage | ✅ Keychain | ✅ safeStorage |
+| Auto-update | free (server) | `updater` plugin, or free with a remote UI | `electron-updater` |
+| Local tool execution | ❌ | Rust | Node (easiest) |
+
+## Recommended architecture
+
+**A Tauri v2 shell that loads the deployed SimbaRAG origin, plus a tiny bundled
+"offline/connect" page. Cowork features are built in `raggr-frontend` behind
+feature detection, so the web app gets them too.**
+
+```
+┌──────────────────────── Simba.app (Tauri v2) ─────────────────────────┐
+│ Rust core (small)                                                      │
+│  • tray icon + menu (Ask…, New chat, recent convos, Quit)              │
+│  • global shortcut ⌥Space → quick-ask panel (positioner, always-on-top)│
+│  • notifications (plugin-notification)                                 │
+│  • keychain token store, deep-link `simba://`, single-instance         │
+│  • window-state, autostart                                             │
+│                                                                        │
+│  Main window  ──loads──▶  https://<simba-host>/        (full UI)       │
+│  Quick panel  ──loads──▶  https://<simba-host>/quick   (compact route) │
+│  Fallback     ──bundled─▶ offline.html (server unreachable / retry)    │
+└───────────────────────────────┬────────────────────────────────────────┘
+                                │ HTTPS: REST + SSE (same origin, no CORS)
+┌───────────────────────────────▼────────────────────────────────────────┐
+│ Caddy → raggr-blue / raggr-green (Quart)                               │
+│  /api/conversation/*  (+ structured tool/artifact events)              │
+│  /api/runs/*          (detached agent runs, resumable SSE)  [phase 3]  │
+│  /api/files           (generic upload)                                 │
+│  /api/notifications/stream (per-user SSE feed)                         │
+└────────────────────────────────────────────────────────────────────────┘
+```
+
+Why load the remote origin rather than bundle:
+
+- **One codebase, one deploy.** `make redeploy` updates web, PWA and desktop
+  together. No version skew between the desktop UI and the SSE protocol, and
+  no desktop release for UI changes.
+- **No CORS, no API-base refactor, and the current OIDC flow works unchanged**
+  inside the webview (redirect back to the web root on the same origin).
+- The agent needs the server anyway, so offline-first buys little. The bundled
+  `offline.html` covers "server down / not on VPN".
+
+The frontend detects the shell with `window.__TAURI_INTERNALS__` (or a
+`?shell=desktop` query param) and turns on the native bits: notifications,
+drag-drop paths, and the "open in quick panel" route. Everything else renders
+the same in a browser.
+
+### Cowork UI (in raggr-frontend, shared by web and desktop)
+
+- **Three panes:** conversations | chat | **artifact panel** (collapsible, a
+  tab per artifact). On mobile/web the artifact panel becomes a sheet.
+- **Activity timeline** in place of single-line `ToolBubble` pills: one row per
+  tool call with a server-provided label, args summary, a spinner, duration,
+  and an expandable result. Clicking a row with an artifact opens it in the
+  panel.
+- **Artifact renderers:** `budget` (YNAB summary/category table + chart),
+  `transactions` (table), `recipe` (Mealie: ingredients/steps, "add to meal
+  plan"), `note` (Obsidian markdown, "open in Obsidian" via
+  `obsidian://` deep link), `document` (Paperless hit: title, snippet, link to
+  Paperless), `photo` (Immich), `device` (SimbaKit status/weight chart).
+- **Drop zone** over the whole window: images go to the existing vision path;
+  PDFs and text go to the new upload endpoint (below).
+- **Quick-ask route** (`/quick`): input + streamed answer only; "Open in Simba"
+  hands the conversation to the main window.
+
+### Local tool bridge (Simba acts on the Mac)
+
+The backend can't reach the Mac (it's behind NAT), so the desktop app dials
+out and the backend calls tools back over that connection.
+
+```
+Mac                                              Server
+┌─ Simba.app Rust core ────────────┐   wss    ┌─ Quart ────────────────────────┐
+│ bridge client ───────────────────┼─────────▶│ /api/desktop/bridge (websocket)│
+│   │ JSON-RPC (MCP messages)      │          │   │                            │
+│   ▼                              │          │   ▼                            │
+│ local MCP servers (child procs)  │          │ MCP ClientSession over the ws  │
+│  • filesystem (scoped folders)   │          │  → langchain-mcp-adapters tools│
+│  • later: screenshot, clipboard, │          │  → mcp_tools.select_tools(     │
+│    open app/URL, Shortcuts       │          │      prefix="mac", admin-only) │
+│ confirm dialog for write tools   │          │  → injected per run only while │
+└──────────────────────────────────┘          │    the bridge is connected     │
+                                              └────────────────────────────────┘
+```
+
+- **The protocol is MCP**, so the backend reuses the existing pattern in
+  `utils/mcp_tools.py` (allowlist, `prefix_` rename, admin re-check). Only the
+  transport is new: an MCP `ClientSession` over the websocket's read/write
+  streams instead of stdio.
+- **The bridge runs in Rust, not in the webview.** The webview loads remote
+  content, so giving page JS file access would turn any XSS into local file
+  access. The Rust core owns the socket, the child processes, and the
+  allowlist of exposed folders (picked in a native settings window).
+- **Writes need consent:** tools tagged as writes (save file, move, run a
+  Shortcut) show a native confirm dialog before running. Reads inside the
+  scoped folders are allowed without asking.
+- **Availability:** the agent is compiled once at startup, so `mac_*` tools are
+  added per run, e.g. via `get_agent_for(user)` returning a variant with
+  bridge tools when a bridge session is connected. If the bridge drops
+  mid-call, the tool returns "Mac is offline" rather than hanging.
+- **Auth:** the websocket authenticates with the same JWT, so this depends on
+  the auth fix landing first. A blue/green flip drops the socket and the app
+  reconnects to the new color.
+- **Open spike question:** do the `mcp` Python SDK and `langchain-mcp-adapters`
+  accept a custom transport cleanly? Fallback: a small hand-rolled JSON-RPC
+  tool-call protocol with tools defined server-side.
+
+## Auth fix (web + desktop)
+
+Today the frontend sends the **refresh** token as the bearer on every call,
+and 20 routes use `@jwt_refresh_token_required` (conversation ×9, beli ×6,
+users ×2 incl. `/refresh`, rag ×1, app ×1, plus `admin_required` in
+`blueprints/users/decorators.py`).
+
+Change:
+
+1. Backend: every route except `/api/user/refresh` uses `@jwt_required`
+   (access token, 1h). The same goes for the inner decorator of
+   `admin_required`.
+2. Frontend: collapse `fetchWithRefreshToken` and `fetchWithAuth` into one
+   function that sends the access token and, on 401, refreshes once and
+   retries. `validateToken` keeps using the refresh token.
+3. Desktop: the refresh token lives in the Keychain. The webview keeps only
+   the access token (memory or `localStorage`).
+
+This is blue/green-safe in both directions. An *old* frontend talking to the
+new backend sends the refresh token, gets a 401, calls `/refresh`, and retries
+with an access token, so it works. A *new* frontend talking to the old backend
+sends an access token where a refresh token is required, gets a 401, and the
+retry with a fresh access token also fails. That window lasts only as long as
+the deploy flip. To avoid it, deploy the backend change first: for one release,
+accept either token type on the protected routes (a small custom decorator),
+then flip the frontend.
+
+SSE streams are authenticated once at request start, so a stream running past
+the 1h access-token expiry is fine.
+
+Also in scope: move `_oidc_sessions` into Postgres (or signed, stateless
+`state`) so a login spanning a deploy doesn't fail, and either honour or
+delete the unused `redirect_after_login`.
+
+## Backend changes
+
+Ordered by how much the client depends on them. All are additive, so
+blue/green stays safe: the old frontend ignores the new fields.
+
+1. **Richer SSE events** (`blueprints/conversation/__init__.py`):
+   - `tool_start {run_id, tool, label, input}`: `input` comes from
+     `event["data"]["input"]`, trimmed/redacted; `label` comes from a
+     server-side map that replaces `TOOL_MESSAGES`.
+   - `tool_end {run_id, tool, ms, summary, artifact?}`: `run_id` lets parallel
+     tool calls pair up correctly.
+   - optional `event: id` lines so a client can resume (needed for phase 3).
+2. **Structured artifacts.** Move high-value tools to
+   `response_format="content_and_artifact"` (as `simba_search` already does): the
+   LLM still sees compact text, and the UI gets
+   `{kind, title, data}`. Persist them in an **`artifacts` table**:
+   `id, user_id, conversation_id, message_id (nullable FK to the tool row),
+   kind, title, data JSON, source_ref (e.g. Mealie slug, Obsidian path,
+   Paperless id), version, created_at, updated_at`. Generate the migration with
+   `make migrate-new` (never hand-written); a new table is backward-compatible.
+   Endpoints: `GET /api/artifacts?conversation_id=` and
+   `GET/PATCH /api/artifacts/<id>`. `PATCH` writes back to the source
+   integration where one exists (edit a recipe → Mealie, edit a note →
+   Obsidian) and bumps `version`. `GET /api/conversation/<id>` includes artifact
+   ids on tool messages.
+3. **Generic file upload** `POST /api/conversation/upload` (supersedes
+   `upload-image`, which stays for compatibility): accept images, PDF, md/txt,
+   CSV. Store in S3 under `conversations/<id>/`, extract text (reuse
+   `utils/cleaner.py` for PDFs), and attach it as a document block capped to the
+   context budget (32k slots). Possible extra: a "file it in Paperless" action
+   that pushes the PDF into Paperless so it gets indexed. Revisit
+   `MAX_CONTENT_LENGTH` (10 MB).
+4. **Notifications feed.** A `notifications` table (user, kind, title, body,
+   link, created_at, read_at) written by the scheduler (`process_due_messages`),
+   cron runs, and completed detached runs. Add
+   `GET /api/notifications/stream` (per-user SSE with `Last-Event-ID` replay
+   from the table, so a blue/green flip only causes a reconnect) and
+   `POST /api/notifications/<id>/read`. Also consider a `desktop` value on
+   `MessageChannel` so a scheduled message can target the app instead of
+   iMessage.
+5. **Detached agent runs** (phase 3): `POST /api/runs` starts the agent in a
+   background task and returns `run_id`; `GET /api/runs/<id>/events` streams
+   with replay. This decouples work from the window. Constraint: an in-process
+   run dies on a blue/green stop. Either persist events (Postgres) and mark
+   runs `interrupted` on startup, or have `deploy.sh` drain active runs before
+   stopping the old color.
+6. **Native auth handoff** (phase 3, optional): sign in through the system
+   browser (password manager, passkeys, existing Authelia session) without
+   changing Authelia config:
+   1. The app generates a PKCE verifier and opens
+      `https://<simba-host>/api/user/oidc/login?client=desktop&challenge=…` in
+      the default browser.
+   2. The normal web OIDC round-trip runs against the existing redirect URI.
+   3. The backend sees `client=desktop` on the stored session and, instead of
+      returning JWTs to the page, issues a one-time 60-second handoff code and
+      redirects to `simba://auth?code=…`.
+   4. The app exchanges `code + verifier` at `POST /api/user/desktop/token` for
+      JWTs and stores them in the Keychain.
+
+   This also requires moving `_oidc_sessions` into Postgres or signed state so
+   it survives blue/green. The alternative, registering a loopback or
+   custom-scheme redirect URI in Authelia, depends on Authelia's redirect
+   matching rules (exact match, ports?). That needs checking, and the client
+   secret would have to stay on the server anyway.
+7. **Local tool bridge:** `/api/desktop/bridge` websocket, an MCP-over-websocket
+   client, and per-run injection of `mac_*` tools (see above). Admin-only.
+8. **CORS:** only needed if we ever bundle the frontend (`quart-cors`
+   allowing `tauri://localhost` / `http://tauri.localhost`). Not needed
+   with the recommendation.
+
+## Phased plan
+
+| Phase | Scope | Backend | Exit criteria |
+|---|---|---|---|
+| **0a. Auth fix** (own PR) | access token on every call, single fetch helper, OIDC state in Postgres | auth fix (+ migration if state goes in a table) | Web works through a blue/green flip; the refresh token is only ever sent to `/refresh` |
+| **0b. Spike** (½ day) | `desktop/` Tauri v2 app: one window loading `<simba-host>`, tray icon with Show/Quit, ⌥Space toggles the window, `offline.html` fallback | none | Log in through Authelia inside the webview, stream an answer, survive a `make redeploy` |
+| **1. Native shell** | quick-ask panel (`/quick` route), notifications, window-state, single-instance, autostart, refresh token in the Keychain | none | Hotkey → ask → answer without touching the main window |
+| **2. Cowork UI** | activity timeline, artifact panel + renderers (budget, recipe, note, document first), whole-window drop zone | items 1–3 (`artifacts` table) | Ask "how's the grocery budget" → YNAB artifact opens in the side panel; drop a PDF → summarised |
+| **3. Local tools** | Rust bridge client, filesystem MCP scoped to chosen folders, write-confirm dialog, folder picker | item 7 | "Summarise the PDFs in ~/Downloads/taxes" works; a write prompts first; quitting the app removes the tools |
+| **4. Background agent** | detached runs, notifications feed, desktop channel for scheduled messages, system-browser auth handoff | items 4–6 | Close the window mid-run → notification when done → reopen shows the full timeline |
+
+**0b status:** scaffolded in `desktop/`. It has a bundled connect page that
+probes `/api/health` and hands off to `$SIMBA_URL`, a menu-bar icon
+(Show / New Chat / Reconnect / Quit), ⌥Space to toggle, close-to-hide,
+single-instance, and Dock-click reopen. The remote origin gets no IPC.
+`desktop/src-tauri/rust-toolchain.toml` pins Rust 1.90, the minimum
+Tauri 2.12 accepts, so the global toolchain is untouched. Run it with
+`make desktop-dev SIMBA_URL=…` or `make desktop`.
+Verified 2026-10-12: Authelia login inside the webview works, and the
+conversation list loads.
+
+Phases 1–3 are independent once 0a/0b land. Phase 2 also improves the web
+UI. There's no distribution phase: `make desktop` runs `tauri build` and
+copies the ad-hoc-signed `.app` to `/Applications`. A locally built app isn't
+quarantined, so Gatekeeper won't complain. Because the UI loads from the
+server, rebuilds are only needed when the Rust shell changes.
+
+## Open questions
+
+1. **Keychain and ad-hoc signing:** the ad-hoc signature changes on every
+   rebuild, so macOS may ask again for Keychain access after each
+   `make desktop`. Acceptable, or use a self-signed local code-signing
+   certificate to keep the identity stable?
+2. **Local tool scope for v1:** filesystem (read + confirmed writes) only, or
+   also screenshot, clipboard, "open URL/app", and running Shortcuts?
+3. **MCP over websocket:** does `langchain-mcp-adapters` take a custom session
+   or transport cleanly? Settle this in a short spike before phase 3;
+   otherwise fall back to a hand-rolled tool-call protocol.
+4. **Engine risk:** does anything in the UI rely on Chromium-only behaviour?
+   The spike should check markdown rendering, streaming `fetch`, and the
+   image picker in WKWebView.
+5. **Artifact write-back conflicts:** if a recipe or note changed in
+   Mealie/Obsidian after the artifact was captured, should we refuse, show a
+   diff, or let the last write win?
@@ -23,3 +23,4 @@ nav:
  - Home: index.md
  - Architecture:
      - Authentication: authentication.md
+      - Desktop Client (proposal): desktop-client.md