v0.0.2 - Desktop Shell

v0.0.2 - Desktop Shell

Hardened Electron shell that supervises a bundled DeepSeek Harness child and hosts its web UI.

Included

• DSH child-process supervisor (@closerai/supervisor): random loopback port, stdout URL parsing, TCP health checks, crash-restart with exponential backoff and a reset-on-stable window, graceful shutdown.
• Hardened Electron shell (apps/desktop): single-instance lock, closerai:// deep links, strict CSP, navigation locked to the DSH origin, external links opened in the system browser, all permission requests denied, minimal frozen sandboxed preload.
• DeepSeek Harness bundled and pinned (@deepseek-ai/dsh@0.1.0-rc.6), Electron pinned (43.4.0), launched via ELECTRON_RUN_AS_NODE=1 electron --expose-internals <dsh-bin> web.
• --smoke-test mode that launches the real app, boots bundled DSH, loads the UI in the hardened window, asserts the React app mounted, and exits 0.

Test evidence

• pnpm check (Prettier + ESLint + build + tsc --noEmit + Vitest): passed.
• Vitest: 40 tests passed (mock provider 17, supervisor 11, desktop security/deep-link 12).
• Electron smoke test on Windows: DSH UI loaded (title="DeepSeek Harness", React root mounted) with exit code 0.
• GitHub Actions CI: success on Linux, macOS, and Windows.

Known limitations

• No tray, notifications, auto-update, or diagnostics export yet (v0.0.7).
• CSP allows 'unsafe-inline' 'unsafe-eval' for scripts because DSH's SPA requires them (see docs/DECISIONS.md D-009); revisit in v0.0.8.
• The Electron smoke test currently runs on Windows; macOS/Linux runtime verification lands with the packaging milestone.
• No installers; the app runs from source with pnpm --filter @closerai/desktop start.