fix: verify desktop build with cargo

.gitignore

@@ -1,6 +1,7 @@
 node_modules/
 dist/
 target/
+**/src-tauri/gen/
 .env
 data/
 coverage/

AGENTS.md

@@ -1,69 +1,69 @@
 # AGENTS.md
 
-## Project
+## 项目
 
-This repository contains the SenlinAI project workbench MVP.
+本仓库包含 SenlinAI 项目工作台 MVP。
 
-The product is a private-deployment, project-centered workbench for individual knowledge workers, team leads, and trusted internal users. It organizes project tasks, inbox items, Markdown notes, files, AI sessions, project-local tags, and lightweight task distribution.
+该产品是一个以项目为中心、面向私有化部署的工作台，服务于个人知识工作者、团队负责人和可信的内部用户。它用于组织项目任务、inbox 条目、Markdown 笔记、文件、AI 会话、项目内标签，以及轻量级任务分发。
 
-## Repository Layout
+## 仓库结构
 
-- `backend`: Go Gin + Gorm + PostgreSQL API.
-- `apps/web`: Responsive Svelte + TypeScript web client.
-- `apps/desktop`: Tauri desktop shell for the web client.
-- `infra`: Local development infrastructure such as Docker Compose.
-- `docs/superpowers/specs`: Product and technical specs.
-- `docs/superpowers/plans`: Implementation plans.
+- `backend`: Go Gin + Gorm + PostgreSQL API。
+- `apps/web`: 响应式 Svelte + TypeScript Web 客户端。
+- `apps/desktop`: Web 客户端的 Tauri 桌面壳。
+- `infra`: 本地开发基础设施，例如 Docker Compose。
+- `docs/superpowers/specs`: 产品和技术规格文档。
+- `docs/superpowers/plans`: 实施计划。
 
-## Backend Rules
+## 后端规则
 
-- Use Go, Gin, Gorm, and PostgreSQL.
-- Keep backend modules focused under `backend/internal`.
-- Use module path `senlinai-agent/backend`.
-- Keep all server-local file path construction inside the file service.
-- Do not let HTTP handlers construct storage paths directly.
-- Keep project tags scoped to a project; do not introduce global tags in MVP.
-- Keep task sharing conservative: assignees see the task and only explicitly shared linked objects.
-- AI must not create official objects without user confirmation.
-- AI calls must record provider, key type, action, status, and errors.
-- Auth session tokens must be signed, expiring bearer tokens; do not accept forgeable `user:<id>` strings.
-- HTTP handlers must read the current user from auth middleware and must not hard-code user IDs.
-- Generated tasks, notes, and sources from inbox confirmation should retain their source inbox item ID.
-- Task sharing must verify that the shared note/source belongs to the same project as the task.
-- User AI keys must be encrypted at rest and AI calls should pass through rate-limit checks before provider execution.
+- 使用 Go、Gin、Gorm 和 PostgreSQL。
+- 后端模块集中放在 `backend/internal` 下，并保持职责聚焦。
+- 使用模块路径 `senlinai-agent/backend`。
+- 所有服务端本地文件路径构造必须集中在文件服务中。
+- 不允许 HTTP handler 直接构造存储路径。
+- 项目标签必须限定在项目内；MVP 阶段不要引入全局标签体系。
+- 任务分享保持保守：被指派人只能看到任务，以及被显式分享的关联对象。
+- AI 未经用户确认，不得创建正式对象。
+- AI 调用必须记录 provider、key 类型、action、status 和 error。
+- 认证 session token 必须是已签名、会过期的 bearer token；不要接受可伪造的 `user:<id>` 字符串。
+- HTTP handler 必须从认证 middleware 读取当前用户，不得硬编码用户 ID。
+- 从 inbox 确认生成的任务、笔记和资料，应保留来源 inbox item ID。
+- 任务分享必须校验被分享的 note/source 与任务属于同一个项目。
+- 用户 AI key 必须加密存储；AI 调用在执行 provider 请求前应经过限流检查。
 
-## Frontend Rules
+## 前端规则
 
-- Use Svelte only for the frontend. Do not add React dependencies or React components.
-- Build the web app desktop-first, while keeping mobile browser layouts usable.
-- Keep feature code under `apps/web/src/features`.
-- The login screen must let the user enter the server IP address or domain name.
-- Use browser-style tabs for page-level workspace state.
-- Save editor and AI input drafts separately from tab state.
-- Use Markdown for MVP note editing.
+- 前端只使用 Svelte。不要添加 React 依赖或 React 组件。
+- Web 应用优先面向桌面端构建，同时保持移动浏览器可用。
+- 功能代码放在 `apps/web/src/features` 下。
+- 登录界面必须允许用户输入服务器 IP 地址或域名。
+- 页面级工作台状态使用浏览器式标签页。
+- 编辑器草稿和 AI 输入草稿要与标签页状态分开保存。
+- MVP 阶段使用 Markdown 进行笔记编辑。
 
-## Tauri Rules
+## Tauri 规则
 
-- Tauri wraps the web client.
-- MVP desktop features are login persistence, file drag-and-drop upload, notifications, and global shortcut quick capture.
-- Do not add offline editing, local-first sync, background clipboard monitoring, or file-system indexing in MVP.
+- Tauri 用于包装 Web 客户端。
+- MVP 桌面端功能包括登录持久化、文件拖拽上传、通知，以及全局快捷键快速收集。
+- MVP 阶段不要添加离线编辑、本地优先同步、后台剪贴板监控或文件系统索引。
 
-## MVP Scope Guardrails
+## MVP 范围边界
 
-Do not add these unless a later approved spec says so:
+除非后续批准的规格文档明确要求，否则不要添加以下功能：
 
-- Real-time instant messaging.
-- Project-level member roles.
-- Anonymous public task sharing.
-- Autonomous Agent execution.
-- Semantic or vector search.
-- Native mobile apps.
-- Browser extension, email, IM, or third-party capture integrations.
+- 真正的实时即时通讯。
+- 项目级成员角色体系。
+- 匿名公开任务分享。
+- 自主 Agent 执行。
+- 语义搜索或向量搜索。
+- 原生移动 App。
+- 浏览器扩展、邮件、IM 或第三方收集集成。
 
-## Verification
+## 验证
 
-- Backend changes should run `go test ./...` from `backend`.
-- PostgreSQL integration checks should read a live test database URL from `DATABASE_URL`; do not commit real credentials.
-- Web changes should run tests and build from `apps/web`.
-- Tauri changes should build the web app first, then run the Tauri verification command from `apps/desktop`.
-- Each implementation task should end with a focused commit.
+- 后端变更应在 `backend` 目录运行 `go test ./...`。
+- PostgreSQL 集成检查应从 `DATABASE_URL` 读取实时测试数据库 URL；不要提交真实凭据。
+- Web 变更应在 `apps/web` 目录运行测试和构建。
+- Tauri 变更应先构建 Web 应用，然后在 `apps/desktop` 目录运行 Tauri 验证命令。
+- 每个实施任务结束时都应创建一个聚焦的提交。

apps/desktop/package.json

@@ -6,7 +6,8 @@
   "scripts": {
     "tauri": "tauri",
     "dev": "tauri dev",
-    "build": "tauri build"
+    "build": "tauri build --no-bundle",
+    "bundle": "tauri build --ci --no-sign"
   },
   "devDependencies": {
     "@tauri-apps/cli": "^2.9.3"

apps/desktop/src-tauri/tauri.conf.json

@@ -18,11 +18,12 @@
       }
     ],
     "security": {
-      "csp": null
+      "csp": "default-src 'self'; img-src 'self' asset: https: data:; style-src 'self' 'unsafe-inline'; connect-src http://* https://*"
     }
   },
   "bundle": {
     "active": true,
-    "targets": "all"
+    "targets": "all",
+    "icon": ["icons/icon.ico"]
   }
 }

docs/mvp-verification.md

@@ -51,12 +51,20 @@ Set-Location ../desktop
 npm run build
 ```
 
-Expected: Tauri desktop bundle builds when Rust/Cargo is installed and the stable Rust toolchain is complete.
+Expected: the Tauri desktop executable builds when Rust/Cargo is installed and the stable Rust toolchain is complete.
+
+Installer packaging is a separate step:
+
+```powershell
+Set-Location apps/desktop
+npm run bundle
+```
 
 Current machine status:
-- `rustup` was installed through winget.
-- The latest desktop build attempt fails before project compilation because `cargo` is not available on PATH: `program not found`.
-- Desktop verification remains blocked until Rust/Cargo is installed and visible to the shell. Then run `npm run build` from `apps/desktop`.
+- Cargo and rustc are installed under `%USERPROFILE%\.cargo\bin`.
+- If the current shell does not see Cargo yet, prepend `%USERPROFILE%\.cargo\bin` to `PATH` or open a new terminal.
+- `npx tauri build --no-bundle --verbose` passes and produces `apps/desktop/src-tauri/target/release/senlinai_workbench.exe`.
+- Full installer bundling through `npm run bundle` currently times out in the Tauri CLI bundling stage on this machine before producing `target/release/bundle` artifacts.
 
 ## Latest Audit Verification
 
@@ -67,7 +75,8 @@ Last audited: 2026-07-18.
 - `apps/web`: `npm test -- --run` passed.
 - `apps/web`: `npm run build` passed.
 - `apps/web`: `npx playwright test` passed.
-- `apps/desktop`: `npm run build` blocked by missing Cargo/Rust toolchain on the current machine.
+- `apps/desktop`: `npx tauri build --no-bundle --verbose` passed and produced the desktop executable.
+- `apps/desktop`: installer packaging is still blocked by Tauri CLI bundling timeout on the current machine.
 
 Audit fixes included:
 

docs/superpowers/plans/2026-07-18-project-workbench-mvp.md

@@ -666,7 +666,7 @@ Last updated: 2026-07-18.
 - [x] Router/main wiring audit: `/api` route registrar 已接入，`cmd/api` 启动时连接 PostgreSQL、执行 AutoMigrate，并注册项目与 Inbox handlers。
 - [x] Search coverage audit: 搜索 service 已覆盖 project、task、note、source、inbox 和 AI session。
 - [x] Credential hygiene audit: 当前文档不再保存真实 PostgreSQL 测试库连接串，集成验证统一通过 `DATABASE_URL` 注入。
-- [ ] Desktop binary verification: blocked by local Rust toolchain state. `rustup` is installed, but `stable-x86_64-pc-windows-msvc` reports `Missing manifest in toolchain`. Run `rustup toolchain install stable-x86_64-pc-windows-msvc --profile minimal --force` until it completes, then run `npm run build` from `apps/desktop`.
+- [x] Desktop binary verification: Cargo/Rust is available, and `npm run build` from `apps/desktop` passes with `tauri build --no-bundle`, producing `target/release/senlinai_workbench.exe`.
 
 Verification evidence from the latest run:
 
@@ -689,4 +689,5 @@ Verification evidence from the latest run:
 - [x] AI user keys are encrypted at rest and gateway rate-limit checks are covered by tests.
 - [x] Svelte web client calls the backend `/api` prefix, passes type checking, and has Playwright coverage for inbox suggestion confirmation.
 - [x] Current Markdown docs no longer include the live PostgreSQL test credential; integration tests must receive it through `DATABASE_URL`.
-- [ ] Desktop binary build remains blocked on this machine because Cargo/Rust is not available to the shell. Install a complete Rust stable toolchain, then rerun `npm run build` from `apps/desktop`.
+- [x] Desktop executable build passes with Cargo/Rust available: `npx tauri build --no-bundle --verbose` produces `apps/desktop/src-tauri/target/release/senlinai_workbench.exe`.
+- [ ] Desktop installer bundling remains blocked on this machine because Tauri CLI packaging times out before producing `target/release/bundle` artifacts. Use `npm run bundle` to retry installer generation.