Migrate from Tauri to Electron by richiemcilroy · Pull Request #2119 · CapSoftware/Cap

richiemcilroy · 2026-08-12T23:47:20Z

I wanted to see what a migration from Tauri to Electron would look like for Cap. We regularly receive bug reports caused by differences between the browser versions available across OS releases. Electron ships a stable Chromium runtime, giving Cap consistent browser behavior across supported versions.

This keeps the existing Rust backend and UI, replacing the Tauri runtime and bridge with Electron equivalents. Packaging and release workflows have been updated to match.

Validation: Rust checks, clippy and 141 tests; desktop typecheck and Biome; production renderer and Electron builds; unsigned macOS packaging.

Greptile Summary

The PR replaces the Tauri desktop runtime and packaging pipeline with Electron while retaining the Rust backend and existing renderer.

Adds an Electron main process, preload bridge, native-operation layer, and Rust transport.
Reworks desktop builds, signing, updater manifests, and immutable GitHub release promotion.
Updates frontend integrations and shared runtime abstractions for the new bridge.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains in the follow-up review scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/desktop-release.yml	Replaces direct per-platform release uploads with SHA-scoped staging, complete asset assembly, validation, and final promotion.
scripts/prepare-electron-release-assets.mjs	Validates platform artifacts and combines macOS x64 and arm64 updater entries into one manifest.
apps/desktop/electron/main.cjs	Initializes Electron application services, windows, backend transport, and IPC dispatch.
apps/desktop/electron/native.cjs	Implements the native-operation compatibility layer used by the Electron renderer and Rust backend.
apps/desktop/electron/backend.cjs	Starts the Rust backend and implements its framed localhost transport.
crates/desktop-runtime/src/transport.rs	Adds the Rust side of the Electron backend protocol and command transport.

_{Reviews (18): Last reviewed commit: "fix: format merged SEO metadata" | Re-trigger Greptile}

cursor · 2026-08-12T23:47:47Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

socket-security · 2026-08-12T23:48:44Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: npm `shell-quote` quote() does not escape newlines in object .op values CVE: GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values (CRITICAL) Affected versions: >= 1.1.0 < 1.8.4 Patched version: 1.8.4 From: pnpm-lock.yaml → `npm/concurrently@9.2.1` → `npm/shell-quote@1.8.3` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/shell-quote@1.8.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `electron-winstaller` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/electron-builder@26.15.3` → `npm/electron-winstaller@5.4.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/electron-winstaller@5.4.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `tiny-async-pool` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/electron-builder@26.15.3` → `npm/tiny-async-pool@1.3.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tiny-async-pool@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

richiemcilroy · 2026-08-12T23:50:25Z

hey @greptile-apps please review the PR

richiemcilroy · 2026-08-13T00:09:43Z