[jserv]

CodeTrial now ships as a desktop app for macOS, Windows and Linux. The app is a Tauri 2 shell in desktop/ that runs the same codetrial web binary as a child process and shows it in one window on a fixed 127.0.0.1:3101, so no browser has to be opened by hand. Running the server as a child rather than linking it in keeps src/main.rs close to unchanged: the server gains three launcher options instead (--allowed-hosts, --data-dir, CODETRIAL_EXIT_WITH_STDIN), each an ordinary CLI option a non-desktop install can use too. The LiveKit and Google keys are asked for once, and come from whichever of three places has them. Exported LIVEKIT_URL, LIVEKIT_API_KEY and LIVEKIT_API_SECRET (and optionally GOOGLE_API_KEY or GOOGLE_API_KEYS) are written to the app's own config, checked as Setup checks them, and Setup is skipped. Otherwise the Setup page asks, and offers two shortcuts. When the app was started near a CLI config (config/codetrial.env.local or codetrial.env.local in the start folder or above, so a run from a checkout's desktop/ finds its config/), the server's new --import-config names that file on the page with the scheme and host of its LiveKit URL, and "Use these keys" has the server read it and save its Setup keys, checked as typed ones are. The file is never used unasked, because one found near the start folder could be any project's, and no key, no other part of its URL and no line it could not parse reaches the page, because any account on the machine can reach the port while Setup serves. And the "Import from a config file" button fills the form from a file the user picks, read in the page and checked on save like typed keys. Every later launch reads the saved config. docs/desktop.md has the design, the file locations and the qualification list.

The page gets no native access at all; navigation, camera and microphone permission, downloads and the close check are all decided from outside the page. Where WebKitGTK is built without WebRTC (Ubuntu 24.04, Debian 12 and Arch as packaged), the app opens the interview in the default browser and keeps the server running. The app's own starting page uses the visual system the interview pages now share: the lobby's palette on a light system and the warm dark one otherwise, the violet accent, and the same radii and type steps.

Rebased onto main at 65cee24. Verified with scripts/test.sh at the tip: 1947 Rust tests pass, and the gate fails only on skill-refs, for an untracked local skill folder on this host, and on two camera-preview browser tests from #448 that time out on this host on main as well and pass in CI. The desktop lane skipped here for want of WebKitGTK; in a Debian 12 container with WebKitGTK 4.1, desktop fmt, clippy with -D warnings and the desktop unit tests pass, and scripts/desktop-smoke.sh passes against a release build under xvfb (Setup answers, a foreign Host is refused, and SIGKILL of the app takes the server with it). Every commit builds and passes clippy on its own. The desktop gate runs in the rust lane on every run, since under CI a skipped gate fails the run, and the CI dependency audit reads desktop/Cargo.lock beside the root lockfile. The screenshots come from that container at the app's 1280x860 window, light and dark from the system scheme. The Setup screenshot shows the import button; the page is the server's, so the CLI gets it too. Checked end to end in that container: the app started from a checkout's desktop/ served Setup offering ../config/codetrial.env.local with its LiveKit host, wrote nothing, and sent no key to the page.

Left out: GitHub sign-in and recording inside the window, signed installers, and automatic updates. An interview has not yet been run on real hardware in WKWebView, WebView2 or a WebRTC-enabled WebKitGTK; the checklist in docs/desktop.md is what a release needs before it is called more than a preview.

Closes #289

---

Summary by cubic

CodeTrial now ships as a desktop app for macOS, Windows, and Linux. It starts the existing server in a child process and shows it in one window, so users don't need to launch a terminal or open a browser themselves.

Server and security

• Adds --data-dir (a launch's config, database, and session key all live in one folder; without a SESSION_SECRET there the server generates its own key and reads no configuration from the environment, except the LiveKit and Google keys it writes to the config on a cold start, skipping Setup), --allowed-hosts (serves only the Host names listed; empty answers any, so a proxy deployment is unaffected), and CODETRIAL_EXIT_WITH_STDIN (the server exits when its launcher's pipe closes, freeing its fixed port even if the app crashes).
• A cold start also imports keys from a CLI config via --import-config, or from the Setup page: its new import button reads a chosen file in the browser and fills the form, and a launched app offers the nearest CLI config—the page names the file and its LiveKit URL, read only when you tell it to.
• The app limits navigation and permissions; on WebKitGTK builds without WebRTC, interviews open in the default browser while the server stays running.
• Bounds CLI test runs so a server that hangs fails the test instead of timing out.

Build and releases

• Adds cross-platform installer builds and smoke tests; desktop prerelease tags publish separately from the CLI's rolling release.
• CI builds and tests the desktop crate when its files or the server launch contract change.

^{Written for commit 543f260. Summary will update on new commits.}

[jserv]

Rebase latest main branch and resolve conflicts