Add Windows voice dictation support and authentication fixes

.changeset/windows-desktop-auth-login.md

@@ -0,0 +1,11 @@
+---
+"@agent-native/core": patch
+---
+
+Fix Windows desktop (Tauri) email/password sign-in. The login endpoint now
+returns the session token to the Windows WebView2 origin
+(`http://tauri.localhost` / `https://tauri.localhost`), which was missing from
+the desktop token allowlist, so sign-in no longer silently bounces back to the
+form. Also stop reporting wrong-password failures as "Enter a valid email
+address" — credential errors now surface as "Invalid email or password" while
+genuine malformed-email input still gets the friendly format message.

.gitignore

@@ -5,6 +5,8 @@ dist
 docs/superpowers
 .DS_Store
 
+.idea/
+
 /*.png
 tmp/
 

packages/core/src/server/auth.ts

@@ -842,6 +842,11 @@ function publicAuthError(
 }
 
 function isAuthEmailValidationMessage(message: string): boolean {
+  // Credential failures (e.g. Better Auth's "Invalid email or password") mention
+  // "email" + "invalid" but are NOT email-format errors — don't rewrite them to
+  // the "enter a valid email" message, or every wrong-password attempt looks like
+  // a malformed-email error.
+  if (/password|credential/i.test(message)) return false;
   return (
     /\bemail\b/i.test(message) &&
     /(invalid|input|required|format)/i.test(message)
@@ -1129,6 +1134,8 @@ const _desktopExchanges = new Map<string, DesktopExchangeEntry>();
 const DESKTOP_EXCHANGE_ERROR_PREFIX = "__error__::";
 const DESKTOP_AUTH_TOKEN_BODY_ORIGINS = new Set([
   "tauri://localhost",
+  "http://tauri.localhost",
+  "https://tauri.localhost",
   "http://localhost:1420",
 ]);
 

templates/clips/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clips-desktop",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "private": true,
   "description": "Clips menu-bar tray app (Tauri 2). Quick-record + recent recordings from the OS tray.",
   "type": "module",