# @lssm-tech/app.personalos-desktop Premium Tauri 2 desktop shell for PersonalOS. ## Source and release context - Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498` - Repository: `lssm-tech/contractspec` - Declared package version: `0.2.1` - Package path: `packages/apps/personalos-desktop` - Manifest path: `packages/apps/personalos-desktop/package.json` - Manifest Git blob: `e00250d07daa2db0119eb8146ab2fb6a955365a5` - Manifest origin: pinned GitHub manifest fetch - Manual: [@lssm-tech/app.personalos-desktop](https://lssm.co/docs/packages/app.personalos-desktop/) - Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/) This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review. Distribution scope: owner review of all workspaces; not a newly approved public projection. - [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/personalos-desktop) - [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/personalos-desktop/package.json) - [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/personalos-desktop/README.md) - [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/app.personalos-desktop.txt) ## Package metadata ```json { "layer": "apps", "physicalArea": null, "primaryArea": "personal-and-learning", "classification": { "privateDeclared": true, "catalogFamily": null, "catalogKind": null, "catalogStatus": null, "adoptionMode": null, "stability": null }, "descriptionOrigin": "package.json", "manifestComplete": true, "publicationPolicyApplied": false } ``` Manifest private flag: true — workspace only. Primary area: [Personal workflows, learning and progress](https://lssm.co/docs/areas/personal-and-learning/) ## Package guide ```json { "status": "available", "sourcePath": "packages/apps/personalos-desktop/README.md", "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/personalos-desktop/README.md", "blobSha": "6e9dc225ddb7baf66c6f4697ea4747b3352d4c57", "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498", "origin": "README recovered byte-for-byte from pinned aggregate guide", "integrity": "exact Git blob match", "executionStatus": "not executed" } ``` The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations. # PersonalOS Desktop Tauri 2 shell for PersonalOS on macOS, Windows, and Linux. It composes the canonical Personal Calm design pack, golden journey, privacy center, and offline authority policy with typed goal, productivity, household, and health read models. Household invitation, activation, delegation, and revocation use the same browser-safe runtime constructor as web and mobile; desktop supplies exact native identity, revision, human evidence, timestamp, and opaque IDs. ## Safety boundaries - Only low-risk commands with an explicit undo command may queue offline. - Consent, sharing, health connection, delegation, rights, deletion, and authority changes require online revalidation. - Credentials are stored through the operating-system keychain. They are never placed in SQLite or browser storage. - Local projections are AES-256-GCM encrypted in Rust with subject, projection, and revision-bound additional authenticated data. The encryption key is held by the operating-system keychain. - Tauri grants only event listen/unlisten and current deep-link reads. There is no shell, process, filesystem, clipboard, arbitrary HTTP, SQL, menu, tray, image, or window-command permission. The CSP permits inline style attributes because the shared design-system theme runtime applies audited CSS variables through React. Scripts remain `self`-only with no `unsafe-inline` or `unsafe-eval`, and production network access is limited to Tauri IPC. ## Runtime composition The app exports `DesktopPersonalOsApp`, `DesktopPersonalOsApiClient`, and `bootstrapNativeDesktopHost` so the native AuthOS product host can bind an exact subject and provision an OS-keychain credential reference. Credential acquisition is `native_authos_only`: the webview port can check or remove a reference but cannot receive or store a raw bearer. The canonical client validates server experience/workspace projections, sends full domain commands with their exact idempotency key, and never exposes the bearer token to the webview. Tauri permits only the projection, workspace, domain-command, and exact health-authorization API paths over a compile-time HTTPS origin; localhost HTTP is debug-only. The clickable Personal Calm journey starts on the next incomplete golden step, uses an accessible design-system action and provider picker, and submits canonical shared-schema commands for household creation, mission and goals, Today planning, habits, check-ins, missed-day recovery, weekly review, coach proposal/activation/inspection/undo/reset, limited household support, and export/deletion. Remote wellbeing connections use the server authorization broker and expose only its validated HTTPS authorization URL; missing and unknown providers are rejected before that broker is contacted. Coach commands derive coach and adaptation revisions from the authenticated workspace instead of trusting hidden or caller-provided values. Per-action drafts survive denial and revision conflicts for recovery. The goals view renders minimized outcome baselines, targets, latest confidence, and correction/removal counts. Its record, correct, and remove actions submit the exact shared metric commands online; corrections reuse the current observation identity and retain prior values in encrypted server state. The privacy view renders the same minimized consent dashboard with localized purpose and downstream-consumer labels, expiry, and lifecycle status. Evidence, receipt identifiers, and subject metadata remain outside the desktop cache. Its action panel can grant the fixed one-year PersonalOS planning scope and revoke only a currently active consent. Both actions remain high-risk, human-required, online-only commands and are never written to the desktop offline queue. The wellbeing view consumes the shared minimized category summaries: localized category and status, observation/quarantine counts, and an optional latest source-observation timestamp. Raw measurements, provider payloads, credentials, and clinical conclusions never enter the desktop workspace model. The same view renders the optional bounded wellbeing-goal window with localized safe metric, lifecycle, direction, dates, observation count, and uncertain outcome. It states that observations do not establish cause or medical advice; raw targets, values, evidence, and provider fields never enter the local model. Goal-scoped support is distinct from household membership: the subject selects an active `propose_support` delegation, current goal, consent, and purpose before the shell constructs the canonical scope digest. Grant, revoke, block, and categorical report commands are high-risk, human-required, online-only actions; the desktop never queues them or widens their proposal-only fields and actions. The desktop consumes the server-issued PersonalOS presentation projection rather than resolving local roles or preferences. Display-only areas remain usable when legacy projections omit presentation metadata, but every governed mutation then fails closed. When a projection is present, denied areas and referenced components suppress their data, hidden actions disappear, blocked actions are disabled, and approval-required actions remain explicit requests to server authority. Preference and explanation rendering is presentation-only; its local reset preview is reversible and cannot alter action authority. Low-risk reconnect work is stored as a complete canonical domain command in an AES-GCM sealed v2 outbox. Replay decrypts and revalidates its subject, registry classification, payload digest, expected server revision, and idempotency key, then submits to `/v1/domain-commands` for fresh server authority. A 202 response is the only acknowledgement. Denial, confirmation, scope, and revision failures remain durably blocked for recovery; authentication/network/service failures remain pending without data loss. The native host shares one encrypted queue between command submission and workspace reads. A browser `online` event invokes the reconnect port, which replays and revalidates that queue before refreshing the canonical projection; initial load never dispatches queued effects, and concurrent reconnect notifications coalesce into one replay/refresh operation. The standalone entry loads native-only AuthOS session metadata and verifies its keychain credential reference before composing the canonical workspace and journey ports. Missing, expired, or invalid native identity fails closed; the app never invents a demo identity or silently falls back to local authority. The React host owns one shared Personalization identity boundary and refreshes native AuthOS session metadata when the window regains focus. Exact account, actor, opaque tenant, consent, or sign-out changes discard retiring buffers before the new projection is accepted; loading, reconnect, and retryable errors preserve the current scope. Collection cannot attach without granted consent. The updater seam is also fail-closed. `DesktopUpdatePort` reports `not_configured` until release engineering injects a signed update feed and its public verification key. A local Vite or Cargo build is not signed-installer, store-review, real-device, accessibility-certification, or update-feed evidence. ## Commands ```bash bun run --cwd packages/apps/personalos-desktop lint:check bun run --cwd packages/apps/personalos-desktop clean bun run --cwd packages/apps/personalos-desktop typecheck bun run --cwd packages/apps/personalos-desktop test bun run --cwd packages/apps/personalos-desktop build bun run --cwd packages/apps/personalos-desktop pack:check cargo fmt --manifest-path packages/apps/personalos-desktop/src-tauri/Cargo.toml -- --check cargo check --manifest-path packages/apps/personalos-desktop/src-tauri/Cargo.toml cargo test --manifest-path packages/apps/personalos-desktop/src-tauri/Cargo.toml ``` ## Declared capabilities This manifest does not declare a capability catalogue. Assess the package using its guide, import map and source. ## Catalogue metadata ```json { "visualTesting": { "status": "platform-qualified", "platform": "desktop", "owner": "@contractspec-core", "qualificationCommands": [ "bun run typecheck", "bun run test" ], "evidenceManifest": "./storybook-platform-qualification.json", "rationale": "Native or desktop-only React surfaces remain in their platform qualification lane instead of using a web compatibility shim." } } ``` ## Canonical imports Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference. ```json [] ``` ## Declared export entry points Scope: manifest-declared export entrypoints and catalog-declared imports. Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted. Installation status: not verified. - `@lssm-tech/app.personalos-desktop` — subpath `.` - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/personalos-desktop/src/index.ts); verified source file. - `@lssm-tech/app.personalos-desktop/i18n` — subpath `./i18n` - `unconditional`: `./src/i18n/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/personalos-desktop/src/i18n/index.ts); verified source file. - `@lssm-tech/app.personalos-desktop/navigation` — subpath `./navigation` - `unconditional`: `./src/navigation/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/personalos-desktop/src/navigation/index.ts); verified source file. - `@lssm-tech/app.personalos-desktop/platform` — subpath `./platform` - `unconditional`: `./src/platform/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/personalos-desktop/src/platform/index.ts); verified source file. ## Package publication metadata These are source-manifest declarations, not a registry installation check. ```json { "types": null, "files": [ "dist", "src", "!src/**/*.test.ts", "!src/**/*.test.tsx", "!src/platform/test-command.ts", "src-tauri", "!src-tauri/src/projection_store_tests.rs", "!src-tauri/target", "README.md", "index.html", "postcss.config.mjs", "tsconfig.json", "vite.config.ts" ], "publishExports": null } ``` ## Dependencies Metadata status: complete pinned manifest. ### Runtime dependencies - `@fontsource/ibm-plex-mono`: `5.3.0` - `@fontsource/ibm-plex-sans`: `5.3.0` - `@fontsource/newsreader`: `5.3.0` - [@lssm-tech/lib.contracts-spec](https://lssm.co/docs/packages/lib.contracts-spec/): `workspace:^` - [@lssm-tech/lib.design-catalog](https://lssm.co/docs/packages/lib.design-catalog/): `workspace:^` - [@lssm-tech/lib.design-system](https://lssm.co/docs/packages/lib.design-system/): `workspace:^` - [@lssm-tech/lib.personal-health-spec](https://lssm.co/docs/packages/lib.personal-health-spec/): `workspace:^` - [@lssm-tech/lib.personal-os-runtime](https://lssm.co/docs/packages/lib.personal-os-runtime/): `workspace:^` - [@lssm-tech/lib.personal-os-spec](https://lssm.co/docs/packages/lib.personal-os-spec/): `workspace:^` - [@lssm-tech/module.personal-experience](https://lssm.co/docs/packages/module.personal-experience/): `workspace:^` - [@lssm-tech/module.personal-goals](https://lssm.co/docs/packages/module.personal-goals/): `workspace:^` - [@lssm-tech/module.personal-health](https://lssm.co/docs/packages/module.personal-health/): `workspace:^` - [@lssm-tech/module.personal-household](https://lssm.co/docs/packages/module.personal-household/): `workspace:^` - [@lssm-tech/module.personal-productivity](https://lssm.co/docs/packages/module.personal-productivity/): `workspace:^` - `@tauri-apps/api`: `^2.11.1` - `@tauri-apps/plugin-deep-link`: `2.4.10` - `react`: `catalog:` - `react-dom`: `catalog:` ### Peer dependencies No declarations in the inspected manifest. ### Optional dependencies No declarations in the inspected manifest. ### Development dependencies - [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*` - `@tailwindcss/postcss`: `4.3.3` - `@tauri-apps/cli`: `^2.11.4` - `@types/bun`: `catalog:types` - `@types/react`: `catalog:types` - `@types/react-dom`: `catalog:types` - `@vitejs/plugin-react`: `^6.1.1` - `tailwindcss`: `catalog:build` - `typescript`: `catalog:` - `vite`: `^8.2.2` ### Peer dependency metadata ```json {} ``` ### Bundled dependencies ```json null ``` ## Package scripts Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest. ```json { "dev": "vite", "clean": "rimraf dist tsconfig.tsbuildinfo", "build": "tsgo --noEmit && bun --bun x vite build", "tauri": "tauri", "typecheck": "tsgo --noEmit", "test": "bun test", "lint:check": "node ../../../scripts/biome.cjs check .", "lint:fix": "node ../../../scripts/biome.cjs check --write .", "pack:check": "bun run scripts/check-pack-inventory.ts" } ``` ## Declared documentation links No additional documentation links are declared in the inspected catalogue. ## Existing agent-guide projection ```json { "path": "packages/apps/web-landing/public/llms-packages/app.personalos-desktop.txt", "route": "/llms/app.personalos-desktop", "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/app.personalos-desktop.txt", "blobSha": "6e9dc225ddb7baf66c6f4697ea4747b3352d4c57", "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498", "bodyEqualsReadme": true, "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt", "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf" } ```