Electron shell: host the browser panel as a real view, not a video stream

[duolahypercho]

Why

The BROWSER tab works, but it never stopped feeling remote — because it is.

Tauri hands us the OS webview (WKWebView on macOS, WebView2 on Windows), which cannot host a second browser. So the panel is a CDP screencast: Chrome paints, core re-encodes to JPEG, the client draws it to a canvas and maps clicks back through the letterbox. Every complaint about it traced to that pipeline existing rather than to a tunable inside it:

Symptom	What it actually was
Blurry	Encode + rescale. Raising cast width/quality fixed it twice; it came back both times.
"I can't click, I can't type"	Coordinate mapping through a stale viewport — a bug class that only exists because coordinates need mapping.
Tab toggle looked like a refresh	The view being torn down and rebuilt.
Not smooth	Frame pacing on a re-encoded stream.

Electron bundles Chromium, so the panel can be a WebContentsView the window composites directly. Real pixels, real input, real scrolling, no encode step.

What this does not do

It adds the Electron shell alongside Tauri. src-tauri/ and pnpm desktop:build are untouched and still the shipping path. Retiring either is a later decision, and the streaming pipeline stays until then because the Tauri build is its only consumer.

What's here

• electron/main.ts — spawns or attaches to core, opens the window on the port core serves, and hands the panel's CDP target id to browser_attach, so the agent's browser_* tools drive the same view the user sees. One browser with two drivers, not one each.
• electron/browserPanel.ts — creates the view on a persistent partition, hides rather than destroys it (a destroyed view loses the page — that was the "refresh on tab toggle"), and captures downloads to ~/.cali/downloads.
• electron/preload.ts — a narrow window.cali over contextBridge under sandbox: true. No generic invoke; one named method per operation. Bundled with esbuild because a sandboxed preload cannot require a sibling module and the failure is silent (window.cali === undefined at render time, no error anywhere).
• BrowserTab.tsx — detects the bridge and, under Electron, skips the cast entirely. It becomes a geometry reporter that tells the shell where to put the view, and hides the view while a popover or dialog is open so native pixels never paint over the editor's own overlays.

How the UI was checked

scripts/compare-shells.mjs drives both shells over CDP and diffs the editor region — the concern here was a shell swap quietly wrecking the look, so it's measured rather than asserted.

The two agree inside the antialiasing floor, measured at 2,666–3,023 px; the threshold sits at 6,000. Tokens, the no-focus-ring rule, and the drag regions all render identically.

node scripts/compare-shells.mjs   # from client/

Verification

• npx tsc -b --noEmit — clean
• tsc -p tsconfig.electron.json --noEmit — clean
• pnpm test — 904 passed / 74 files, green on two consecutive runs (one earlier run had a single timing flake in an unrelated retry test, which did not reproduce)
• pnpm desktop:electron:build — packages unsigned to release-electron/

Scope

Two commits: the client shell, then the core half that makes it mean anything.

The core commit is scoped to the browser subsystem — rpc.rs and tools.rs take
only their browser hunks, so another session's in-flight computer.rs,
guardian.rs and spawn_ledger.rs work stays out. The one casualty: the
spawn_ledger registration they added to browser.rs is omitted, because that
module is not on main yet. It should be restored when their branch lands.

Not done

• Signing and notarisation — entitlements are written, the identity is not.
• No LLM turn has yet been observed choosing these tools against the native panel.

Plan and status: docs/plans/electron-shell.md.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DAV2UBU1PQ8mJFVWMhKyHx

[duolahypercho]

The red E2E check is pre-existing on main, not from this branch.

e2e/workflow.spec.ts:312 › routes concurrent editor calls to the owning page and session times out at 60s on run 31866375731 — that is ad8467e, the exact commit this branch is based on, with no changes of mine on it. Same test, same timeout, and the last three main runs are red the same way.

This branch touches no attachment-routing code; the client diff is 174 lines across BrowserTab, desktop.ts, workspace.ts and index.css. Rust core, Client and GitGuardian all pass here.

Worth fixing, but it belongs in its own change rather than being folded into this one.

[duolahypercho]

Follow-up: the core half is now in, because without it the branch was still running a second browser.

Caught in review: the client commit alone made the panel native, but core knew nothing about it. Browsers::ensure launches a Chrome on first use, so the agent's browser_* tools drove an invisible browser while the user looked at a different one — worse than the screencast it replaced, since at least the screencast was the same page. The shell was already POSTing browser_attach; core had no such method, and the handshake failed into a console.error nobody sees.

c157213 adds it. Ownership is now explicit — child and profile are Option, None meaning attached — and close returns early rather than sending Browser.close, which would quit the application hosting the view.

Proven rather than asserted: browser::tests::live_attach_drives_a_browser_it_did_not_launch runs against a real Chrome the test owns, and reads the resulting url back over its own devtools connection so it cannot pass on core merely believing it navigated. I mutation-checked the safety assertion — removing the ownership guard from close fails it with shutdown killed a browser core did not launch, so it has teeth.

cargo fmt --check, clippy --all-targets -D warnings, and the suite (887 + 2, 6 ignored) are green.

[duolahypercho]

Tauri is gone; Electron is the only shell (0ef10c6).

Keeping both meant every fix had to be made twice, into a shell that structurally could not have the browser panel. Removed: client/src-tauri/, @tauri-apps/*, the tauri script, and compare-shells.mjs (it needed two shells to compare). 80 files, +206/−5611.

Three things the removal carried rather than dropped:

• Folder picker — chooseNativeWorkspace used @tauri-apps/plugin-dialog; it goes through the shell's chooseFolder now, with defaultPath threaded through the bridge so the one caller that passes a starting folder still gets it.
• Icons — moved to build-electron/ (electron-builder's buildResources), same artwork and the same com.calicode.desktop identifier, so this replaces the installed app rather than sitting beside it.
• scripts/desktop.sh — rewritten, not deleted. Still owns build|dev|install, still uses a stable local signing identity (an ad-hoc signature is keyed to the binary hash, so macOS drops the app's TCC grants every rebuild). Signing moved to electron-builder's own, because an Electron bundle must be signed inside-out and codesign --deep does it in the wrong order.

Traffic lights. trafficLightPosition had been copied from tauri.conf.json, and the shells don't measure it the same way — y: 23 sat the lights ~10pt below the sidebar's controls row, on their own line. Measured against a real window, Electron places the group ~6.75pt above the buttons' visual centre, so y: 13 centres them at 20pt. Lights, sidebar toggle, history arrows and tab strip now share one centre to within 0.5pt.

Name. Packaged bundle reports CFBundleName/CFBundleDisplayName = CaliCode with the brand icon. app.setName does not rename the menu bar unpackaged — that comes from the running bundle's plist — so pnpm desktop:electron still says "Electron". Documented rather than chased.

One test changed, said out loud: SettingsPage.test.tsx faked the shell with __TAURI_INTERNALS__. That global no longer exists, so it installs the Electron bridge instead — same assertion, same titlebar, through the detection that is left.

Verified by driving both builds and measuring pixels rather than asserting: unpackaged and packaged agree on alignment, the packaged app carries icon and name, and core drives the panel with no Chrome of its own (proven by pointing the panel at a distinct url over CDP and watching browser_status report it back).

Client and Rust core pass. E2E is still the pre-existing workflow.spec.ts:312 timeout that fails on main at this branch's base.