Add Electron desktop shell while preserving browser access

[germanescobar]

Summary

Explore and implement an Electron packaging path for Coding Orchestrator without forking the existing browser-first app.

The current architecture already separates the React/Vite client from the Express API server, so Electron should act as an additional desktop shell around the same UI rather than a separate product surface.

Goals

• Keep the existing browser workflow working unchanged.
• Add an Electron main process that can load the same client UI.
• Support local development with Electron loading the Vite dev server.
• Support production packaging with Electron loading the built client and connecting to a local backend.
• Avoid duplicating frontend code or creating Electron-only UI paths unless absolutely necessary.

Proposed approach

• Add Electron dependencies and scripts, for example dev:electron and a production packaging command.
• In development, start the existing Express server and Vite client, then have Electron load http://localhost:4500.
• In production, either:
  • bundle/start the Express server locally and load its URL, or
  • serve dist/client from the backend and load that local app URL.
• Keep API and WebSocket paths shared between browser and Electron modes.

Security considerations

Because the backend can access local project paths, spawn agent CLIs, run terminal sessions, and manage API keys, production browser accessibility should be deliberate:

• Bind privileged backend services to localhost by default.
• Avoid permissive CORS in production.
• Consider a local auth token or similar protection if the service may be reachable beyond the local machine.
• Keep Node integration disabled in the renderer unless a specific, reviewed bridge is required.

Acceptance criteria

• The app can still be run in a normal browser using the existing dev workflow.
• The app can also be launched as an Electron desktop app.
• Browser and Electron modes use the same React UI and backend API contracts.
• Production packaging strategy is documented.
• Security posture for local backend access is documented and implemented where needed.