Fix/desktop oauth connect opener

desktop/app/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "orcabot-desktop"
-version = "0.8.0"
+version = "0.9.1"
 edition = "2021"
 description = "Orcabot Desktop shell"
 license = "UNLICENSED"
@@ -43,6 +43,7 @@ ratatui = "0.29"
 tungstenite = { version = "0.21", default-features = false, features = ["handshake"] }
 # VT/ANSI parser to render PTY output (agents draw full-screen TUIs).
 vt100 = "0.15"
+tauri-plugin-opener = "2.5.4"
 
 [dev-dependencies]
 # Used by the vm/image.rs unit tests (was referenced but never declared).

desktop/app/src-tauri/build.rs

@@ -1,3 +1,35 @@
 fn main() {
-  tauri_build::build()
+  // The packaged frontend is a REMOTE-origin webview (http://localhost:8788), and
+  // Tauri v2's ACL rejects custom app commands from remote origins unless they're
+  // explicitly granted in a capability. Declaring the commands here generates the
+  // `allow-<command>` permissions that capabilities/default.json references, so the
+  // frontend can invoke sign-in / workspace / cloud commands (not just the opener
+  // plugin). Keep this list in sync with the `generate_handler!` list in main.rs.
+  tauri_build::try_build(
+    tauri_build::Attributes::new().app_manifest(
+      tauri_build::AppManifest::new().commands(&[
+        "get_workspace_path",
+        "import_folder",
+        "switch_to_cli",
+        "quit_app",
+        "get_surface_token",
+        "open_url",
+        "reveal_workspace",
+        "get_ports",
+        "get_app_version",
+        "read_startup_log",
+        "verify_orcabot_account",
+        "set_cloud_credential",
+        "sign_in_google_loopback",
+        "cancel_google_sign_in",
+        "rollback_sign_in",
+        "get_cloud_account",
+        "clear_cloud_credential",
+        "list_cloud_dashboards",
+        "get_cloud_dashboard",
+        "download_cloud_workspace",
+      ]),
+    ),
+  )
+  .expect("failed to run tauri build script");
 }

desktop/app/src-tauri/capabilities/default.json

@@ -8,6 +8,32 @@
   "permissions": [
     "core:default",
     "dialog:default",
-    "dialog:allow-open"
+    "dialog:allow-open",
+    {
+      "identifier": "opener:allow-open-url",
+      "allow": [
+        { "url": "http://*" },
+        { "url": "https://*" }
+      ]
+    },
+    "allow-get-workspace-path",
+    "allow-import-folder",
+    "allow-switch-to-cli",
+    "allow-quit-app",
+    "allow-get-surface-token",
+    "allow-reveal-workspace",
+    "allow-get-ports",
+    "allow-get-app-version",
+    "allow-read-startup-log",
+    "allow-verify-orcabot-account",
+    "allow-set-cloud-credential",
+    "allow-sign-in-google-loopback",
+    "allow-cancel-google-sign-in",
+    "allow-rollback-sign-in",
+    "allow-get-cloud-account",
+    "allow-clear-cloud-credential",
+    "allow-list-cloud-dashboards",
+    "allow-get-cloud-dashboard",
+    "allow-download-cloud-workspace"
   ]
 }

desktop/app/src-tauri/gen/schemas/capabilities.json

@@ -1 +1 @@
-{"default":{"identifier":"default","description":"Default capabilities for the main window","remote":{"urls":["http://localhost:*"]},"local":true,"windows":["main"],"permissions":["core:default","dialog:default","dialog:allow-open"]}}
+{"default":{"identifier":"default","description":"Default capabilities for the main window","remote":{"urls":["http://localhost:*"]},"local":true,"windows":["main"],"permissions":["core:default","dialog:default","dialog:allow-open",{"identifier":"opener:allow-open-url","allow":[{"url":"http://*"},{"url":"https://*"}]},"allow-get-workspace-path","allow-import-folder","allow-switch-to-cli","allow-quit-app","allow-get-surface-token","allow-open-url","allow-reveal-workspace","allow-get-ports","allow-get-app-version","allow-read-startup-log","allow-verify-orcabot-account","allow-set-cloud-credential","allow-sign-in-google-loopback","allow-cancel-google-sign-in","allow-rollback-sign-in","allow-get-cloud-account","allow-clear-cloud-credential","allow-list-cloud-dashboards","allow-get-cloud-dashboard","allow-download-cloud-workspace"]}}

desktop/app/src-tauri/permissions/autogenerated/cancel_google_sign_in.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-cancel-google-sign-in"
+description = "Enables the cancel_google_sign_in command without any pre-configured scope."
+commands.allow = ["cancel_google_sign_in"]
+
+[[permission]]
+identifier = "deny-cancel-google-sign-in"
+description = "Denies the cancel_google_sign_in command without any pre-configured scope."
+commands.deny = ["cancel_google_sign_in"]

desktop/app/src-tauri/permissions/autogenerated/clear_cloud_credential.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-clear-cloud-credential"
+description = "Enables the clear_cloud_credential command without any pre-configured scope."
+commands.allow = ["clear_cloud_credential"]
+
+[[permission]]
+identifier = "deny-clear-cloud-credential"
+description = "Denies the clear_cloud_credential command without any pre-configured scope."
+commands.deny = ["clear_cloud_credential"]

desktop/app/src-tauri/permissions/autogenerated/download_cloud_workspace.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-download-cloud-workspace"
+description = "Enables the download_cloud_workspace command without any pre-configured scope."
+commands.allow = ["download_cloud_workspace"]
+
+[[permission]]
+identifier = "deny-download-cloud-workspace"
+description = "Denies the download_cloud_workspace command without any pre-configured scope."
+commands.deny = ["download_cloud_workspace"]

desktop/app/src-tauri/permissions/autogenerated/get_app_version.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-get-app-version"
+description = "Enables the get_app_version command without any pre-configured scope."
+commands.allow = ["get_app_version"]
+
+[[permission]]
+identifier = "deny-get-app-version"
+description = "Denies the get_app_version command without any pre-configured scope."
+commands.deny = ["get_app_version"]

desktop/app/src-tauri/permissions/autogenerated/get_cloud_account.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-get-cloud-account"
+description = "Enables the get_cloud_account command without any pre-configured scope."
+commands.allow = ["get_cloud_account"]
+
+[[permission]]
+identifier = "deny-get-cloud-account"
+description = "Denies the get_cloud_account command without any pre-configured scope."
+commands.deny = ["get_cloud_account"]

desktop/app/src-tauri/permissions/autogenerated/get_cloud_dashboard.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-get-cloud-dashboard"
+description = "Enables the get_cloud_dashboard command without any pre-configured scope."
+commands.allow = ["get_cloud_dashboard"]
+
+[[permission]]
+identifier = "deny-get-cloud-dashboard"
+description = "Denies the get_cloud_dashboard command without any pre-configured scope."
+commands.deny = ["get_cloud_dashboard"]

desktop/app/src-tauri/permissions/autogenerated/get_ports.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-get-ports"
+description = "Enables the get_ports command without any pre-configured scope."
+commands.allow = ["get_ports"]
+
+[[permission]]
+identifier = "deny-get-ports"
+description = "Denies the get_ports command without any pre-configured scope."
+commands.deny = ["get_ports"]

desktop/app/src-tauri/permissions/autogenerated/get_surface_token.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-get-surface-token"
+description = "Enables the get_surface_token command without any pre-configured scope."
+commands.allow = ["get_surface_token"]
+
+[[permission]]
+identifier = "deny-get-surface-token"
+description = "Denies the get_surface_token command without any pre-configured scope."
+commands.deny = ["get_surface_token"]

desktop/app/src-tauri/permissions/autogenerated/get_workspace_path.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-get-workspace-path"
+description = "Enables the get_workspace_path command without any pre-configured scope."
+commands.allow = ["get_workspace_path"]
+
+[[permission]]
+identifier = "deny-get-workspace-path"
+description = "Denies the get_workspace_path command without any pre-configured scope."
+commands.deny = ["get_workspace_path"]

desktop/app/src-tauri/permissions/autogenerated/import_folder.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-import-folder"
+description = "Enables the import_folder command without any pre-configured scope."
+commands.allow = ["import_folder"]
+
+[[permission]]
+identifier = "deny-import-folder"
+description = "Denies the import_folder command without any pre-configured scope."
+commands.deny = ["import_folder"]

desktop/app/src-tauri/permissions/autogenerated/list_cloud_dashboards.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-list-cloud-dashboards"
+description = "Enables the list_cloud_dashboards command without any pre-configured scope."
+commands.allow = ["list_cloud_dashboards"]
+
+[[permission]]
+identifier = "deny-list-cloud-dashboards"
+description = "Denies the list_cloud_dashboards command without any pre-configured scope."
+commands.deny = ["list_cloud_dashboards"]

desktop/app/src-tauri/permissions/autogenerated/open_url.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-open-url"
+description = "Enables the open_url command without any pre-configured scope."
+commands.allow = ["open_url"]
+
+[[permission]]
+identifier = "deny-open-url"
+description = "Denies the open_url command without any pre-configured scope."
+commands.deny = ["open_url"]

desktop/app/src-tauri/permissions/autogenerated/quit_app.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-quit-app"
+description = "Enables the quit_app command without any pre-configured scope."
+commands.allow = ["quit_app"]
+
+[[permission]]
+identifier = "deny-quit-app"
+description = "Denies the quit_app command without any pre-configured scope."
+commands.deny = ["quit_app"]

desktop/app/src-tauri/permissions/autogenerated/read_startup_log.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-read-startup-log"
+description = "Enables the read_startup_log command without any pre-configured scope."
+commands.allow = ["read_startup_log"]
+
+[[permission]]
+identifier = "deny-read-startup-log"
+description = "Denies the read_startup_log command without any pre-configured scope."
+commands.deny = ["read_startup_log"]

desktop/app/src-tauri/permissions/autogenerated/reveal_workspace.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-reveal-workspace"
+description = "Enables the reveal_workspace command without any pre-configured scope."
+commands.allow = ["reveal_workspace"]
+
+[[permission]]
+identifier = "deny-reveal-workspace"
+description = "Denies the reveal_workspace command without any pre-configured scope."
+commands.deny = ["reveal_workspace"]

desktop/app/src-tauri/permissions/autogenerated/rollback_sign_in.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-rollback-sign-in"
+description = "Enables the rollback_sign_in command without any pre-configured scope."
+commands.allow = ["rollback_sign_in"]
+
+[[permission]]
+identifier = "deny-rollback-sign-in"
+description = "Denies the rollback_sign_in command without any pre-configured scope."
+commands.deny = ["rollback_sign_in"]

desktop/app/src-tauri/permissions/autogenerated/set_cloud_credential.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-set-cloud-credential"
+description = "Enables the set_cloud_credential command without any pre-configured scope."
+commands.allow = ["set_cloud_credential"]
+
+[[permission]]
+identifier = "deny-set-cloud-credential"
+description = "Denies the set_cloud_credential command without any pre-configured scope."
+commands.deny = ["set_cloud_credential"]

desktop/app/src-tauri/permissions/autogenerated/sign_in_google_loopback.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-sign-in-google-loopback"
+description = "Enables the sign_in_google_loopback command without any pre-configured scope."
+commands.allow = ["sign_in_google_loopback"]
+
+[[permission]]
+identifier = "deny-sign-in-google-loopback"
+description = "Denies the sign_in_google_loopback command without any pre-configured scope."
+commands.deny = ["sign_in_google_loopback"]

desktop/app/src-tauri/permissions/autogenerated/switch_to_cli.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-switch-to-cli"
+description = "Enables the switch_to_cli command without any pre-configured scope."
+commands.allow = ["switch_to_cli"]
+
+[[permission]]
+identifier = "deny-switch-to-cli"
+description = "Denies the switch_to_cli command without any pre-configured scope."
+commands.deny = ["switch_to_cli"]

desktop/app/src-tauri/permissions/autogenerated/verify_orcabot_account.toml

@@ -0,0 +1,11 @@
+# Automatically generated - DO NOT EDIT!
+
+[[permission]]
+identifier = "allow-verify-orcabot-account"
+description = "Enables the verify_orcabot_account command without any pre-configured scope."
+commands.allow = ["verify_orcabot_account"]
+
+[[permission]]
+identifier = "deny-verify-orcabot-account"
+description = "Denies the verify_orcabot_account command without any pre-configured scope."
+commands.deny = ["verify_orcabot_account"]

desktop/app/src-tauri/src/main.rs

@@ -1223,6 +1223,10 @@ fn main() {
   let app = tauri::Builder::default()
     .plugin(tauri_plugin_dialog::init())
     .plugin(tauri_plugin_updater::Builder::new().build())
+    // Opens external URLs (OAuth connect flows) from the remote-origin frontend.
+    // Its `opener:allow-open-url` permission works for the localhost webview,
+    // unlike the custom `open_url` command which the ACL rejects from remote.
+    .plugin(tauri_plugin_opener::init())
     .invoke_handler(tauri::generate_handler![
       commands::get_workspace_path,
       commands::import_folder,
@@ -1256,6 +1260,15 @@ fn main() {
       // Start core services (d1-shim, workerd) — blocks until healthy (~5-10s)
       services.start(app);
 
+      // NOTE: we deliberately do NOT clear the webview's browsing data here. An
+      // earlier attempt used clear_all_browsing_data() to bust a *suspected* stale
+      // frontend cache, but it also wiped cookies/localStorage — including the
+      // desktop-mode marker DESKTOP_MODE fell back to — which flipped the app into
+      // web mode (Box shown, connect buttons no-op'd, Calendar "access revoked").
+      // The real fix was robust Tauri detection in the frontend (env.ts uses
+      // __TAURI_INTERNALS__), so no cache-clear is needed. If genuine chunk
+      // staleness ever appears, use a cache-ONLY clear, never clear_all_browsing_data.
+
       // Register workspace state for Tauri commands
       let data_dir = app.path().app_data_dir().ok();
       if let Some(ref dd) = data_dir {

desktop/app/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Orcabot",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "identifier": "com.orcabot.desktop",
   "build": {
     "beforeDevCommand": "sh -c \"cd ../../frontend && NEXT_PUBLIC_API_URL=http://localhost:8787 NEXT_PUBLIC_SITE_URL=http://localhost:8788 NEXT_PUBLIC_DEV_MODE_ENABLED=true NEXT_PUBLIC_DESKTOP_MODE=true npx wrangler dev -c wrangler.toml --port 8788\"",