Migrate from Tauri to Electron by richiemcilroy · Pull Request #2119 · CapSoftware/Cap

richiemcilroy · 2026-08-12T23:47:20Z

I wanted to see what a migration from Tauri to Electron would look like for Cap. We regularly receive bug reports caused by differences between the browser versions available across OS releases. Electron ships a stable Chromium runtime, giving Cap consistent browser behavior across supported versions.

This keeps the existing Rust backend and UI, replacing the Tauri runtime and bridge with Electron equivalents. Packaging and release workflows have been updated to match.

Validation: Rust checks, clippy and 141 tests; desktop typecheck and Biome; production renderer and Electron builds; unsigned macOS packaging.

Greptile Summary

The updated release workflow resolves the previously reported release-tag, asset-upload, updater-manifest, and failed-staging lifecycle issues by building against SHA-specific staging drafts and promoting only a complete asset set.

Serializes releases by channel and version and refuses to move an existing final tag.
Uses SHA-scoped staging releases that can be safely retried without blocking corrected builds.
Assembles all platform artifacts before promoting or publishing the final release.
Defers creation of the final release tag until successful promotion.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains from the previously reported release-workflow issues.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/desktop-release.yml	Reworks releases around immutable SHA-specific staging drafts, complete asset assembly, guarded promotion, and delayed final-tag creation.
scripts/prepare-electron-release-assets.mjs	Consolidates platform updater metadata and release artifacts before the staging release is promoted.
apps/desktop/electron/main.cjs	Introduces Electron application startup, custom protocols, IPC dispatch, navigation restrictions, and backend lifecycle management.
apps/desktop/electron/native.cjs	Implements the native Electron compatibility layer used by the migrated renderer and Rust backend.
apps/desktop/electron/windows.cjs	Centralizes Electron window creation, routing, state persistence, and lifecycle behavior.

_{Reviews (11): Last reviewed commit: "fix: scope release staging to commits" | Re-trigger Greptile}

cursor · 2026-08-12T23:47:47Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

socket-security · 2026-08-12T23:48:42Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/electron-builder@26.15.3
	npm/electron-updater@6.8.9
	npm/wait-on@9.0.1
	npm/concurrently@9.2.1
	npm/electron@43.4.0

View full report

socket-security · 2026-08-12T23:48:44Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: npm `shell-quote` quote() does not escape newlines in object .op values CVE: GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values (CRITICAL) Affected versions: >= 1.1.0 < 1.8.4 Patched version: 1.8.4 From: pnpm-lock.yaml → `npm/concurrently@9.2.1` → `npm/shell-quote@1.8.3` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/shell-quote@1.8.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `electron-winstaller` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/electron-builder@26.15.3` → `npm/electron-winstaller@5.4.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/electron-winstaller@5.4.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `tiny-async-pool` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/electron-builder@26.15.3` → `npm/tiny-async-pool@1.3.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tiny-async-pool@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

richiemcilroy · 2026-08-12T23:50:25Z

hey @greptile-apps please review the PR

richiemcilroy · 2026-08-13T00:09:43Z