app.communicationos-desktop

@lssm-tech/app.communicationos-desktop

Message search uses the authenticated canonical space projection and shares the same typed API boundary as web and mobile. It is not limited to the active room.

Thin Tauri 2 and React/Vite shell for CommunicationOS. It consumes the shared application kit, declares Stronghold/OS keychain credentials and Tauri SQLite projections, and supports device, managed-cloud, or self-hosted connectors.

Stronghold stores both the native AuthOS session and provider credentials. The shell exchanges that session for a short-lived CommunicationOS grant and renders only live spaces and room counts returned for the server-derived scope. The signed-out and expired-session surfaces include direct email/password and TOTP recovery. CompanyOS validates the Stronghold bearer and performs the server-only hCircle host assertion; the webview never receives the shared secret or proposes tenant/workspace/space authority. Transient send failures enter the Tauri SQLite outbox, retain their original idempotency keys, and replay on reconnect or a five-second recovery interval. The shell keeps the queued count visible until the server confirms delivery. Queued payloads use the v2 AES-256-GCM envelope with a random key held only in Stronghold and AAD bound to tenant, workspace, space, principal, room, and idempotency key. Every list, count, delivery, retry, quarantine, and discard statement repeats that full owner scope. SQLite secure-delete is enabled and v1 or legacy plaintext rows are purged instead of replayed. Corrupt v2 ciphertext is retained as payload-opaque quarantine evidence until the user discards and recomposes it. The active authorized room is refreshed from realtime invalidations, online recovery, and a 15-second safety poll through one per-session queue. Outbox replay completes before the next timeline read, so confirmed messages do not disappear between recovery frames and overlapping triggers cannot race. Durable monotonic sequence numbers preserve enqueue order even when multiple messages share the same timestamp. Replay treats an API 401 as terminal session expiry: it never increments the retry schedule, propagates to the session boundary, removes credentials, and closes live work before the signed-out recovery surface commits. Every conversation refresh and send-result commit is fenced to the current native session, route, and room; a late response from a previous deep link cannot replace the active conversation. A send-side 401 invalidates live work before Stronghold session removal completes and renders explicit sign-in recovery instead of an attachment error. The composer validates and hashes up to five supported files locally, uploads them through the scoped API, replays opaque attachment IDs after transient send failures, and downloads without exposing storage locations.

Room and thread details retain separate canonical hashes. Thread routes resolve to a room only through server-returned channel bindings and keep an explicit thread-context marker above the shared attachment-aware composer. The client never accepts a tenant, workspace, space, or room membership as authority.

The desktop navigation mounts shared Forms management at /communications/forms and resolves every API call from the in-memory scoped grant rather than persisting access tokens in the webview.

Run bun dev, bun test, bun run build, or bun tauri dev from this package. The Vite 8 production profile keeps the default 500 kB warning budget and isolates React into a stable vendor chunk instead of hiding oversized bundles. bun --bun run tauri build --debug --no-bundle is the bounded native-window compilation gate when the host has the Rust/Tauri toolchain. Forcing Bun keeps the Tauri CLI on the host's native architecture; signed distributable acceptance remains platform- and certificate-specific.