Osprey v0.2.1 — the bundled backend actually works

Fixes the blockers in v0.2.0 — that build could not talk to its own bundled backend.

Two defects, either of which alone broke it:

• the webview's Content-Security-Policy still only allowed connections to
  localhost:8000, while the bundled backend listens on a random loopback port, so
  every request and the live-hotlist WebSocket were blocked
• the bundled backend runs as env=prod, where CORS is deny-by-default, and nothing
  named the Tauri webview as an allowed origin

Also in this build: only missing keys in secrets.json are regenerated (a partial file
previously discarded your encryption_key and orphaned saved connector tokens); a
corrupt secrets file no longer crashes every launch; the backend process is now
terminated on exit rather than leaked; and the sign-in screen shows real progress while
the backend starts instead of looking broken.

Install

• Windows — Osprey_0.2.1_x64-setup.exe or the .msi
• Linux — .deb, .rpm, .AppImage
• macOS — not published (needs Apple signing certificates)

Launch it and it starts its own backend — no Python, no Docker. First start takes a
few seconds; the sign-in screen says so. SmartScreen will warn (no Authenticode
certificate): More info → Run anyway.

Data lives in %APPDATA%\Osprey (Windows) · ~/.local/share/Osprey (Linux). Keep
secrets.json — its keys decrypt your connector tokens.

Still not in the bundled build

No background worker, so connected sources aren't polled on a schedule — use Refresh,
or run the Docker stack. OAuth connectors also need provider app credentials on the
backend.

Osprey v0.2.0 — self-contained desktop build

The desktop app now contains the backend. Install it and it runs — no Python, no Docker, nothing else to start.

Install

• Windows — Osprey_x64-setup.exe (installer) or ..._x64_en-US.msi
• Linux — .deb, .rpm, or .AppImage
• macOS — not published; the build needs Apple signing certificates. Build from source.

On first launch the app starts its own backend on a private loopback port and shows
"Running your own private copy — nothing leaves this machine." Create an account and go.

Expect this on Windows

SmartScreen will warn that the publisher is unrecognised — More info → Run anyway.
The installers are signed with the app's updater key, not an Authenticode certificate.
PyInstaller binaries also occasionally trip antivirus heuristics.

Where your data lives

%APPDATA%\Osprey (Windows) · ~/Library/Application Support/Osprey (macOS) ·
~/.local/share/Osprey (Linux) — SQLite plus a secrets.json generated on first run.
Deleting that folder resets the app. Keep it: the keys in it decrypt your connector tokens.

What works in the bundled build

Sign-in, projects, forward-an-email / drop-a-CSV ingestion, clustering, explainable
scoring, the hotlist with filters and item detail, Excel + PDF export, AI sift with your
own key, and on-demand Python scripts.

Not in this build: the background worker, so connected sources are not polled on a
schedule — use Refresh, or run the Docker stack for continuous monitoring. OAuth
connectors also need provider app credentials configured on the backend.

Try it without connecting anything

cd backend && python -m osprey.seed loads a realistic project and writes a real
hotlist to demo/hotlist.xlsx and .pdf.

---

Artifacts in this release are named 0.1.0 — the bundle version comes from
tauri.conf.json, which lagged the tag. Fixed on main for the next release.