Add Tauri desktop application support

[jimli570]

feat: Add Tauri desktop application support

Integrate Tauri 2.0 to enable native desktop builds for Windows,
macOS, and Linux while maintaining web deployment compatibility.

• Add Tauri dependencies and Rust backend configuration
• Configure conditional Vite base path for dual deployment
• Add tauri-dev, tauri-build, tauri-init npm scripts
• Update justfile with Tauri commands and nvm/cargo PATH setup
• Create comprehensive Tauri setup documentation
• Configure build to exclude AppImage for reliable builds
• Update README with desktop app instructions and troubleshooting

Build outputs: .deb/.rpm (Linux), .msi (Windows), .dmg/.app (macOS)
Bundle identifier: com.touchtask

[florianbuetow]

Comprehensive PR Review: #1 "Add Tauri Desktop Application Support"

Repository: florianbuetow/touchtask
Author: jimli570
Changes: 38 files, +8,442 / -1,027 lines

---

Executive Summary

This PR adds Tauri 2.0 desktop application support to TouchTask. While technically interesting, the review identified critical security issues, significant maintenance concerns, and a lack of clear value proposition for the project.

Recommendation: Decline

---

Strategic Concerns (Maintainer Perspective)

🔴 Missing Value Proposition

The PR doesn't articulate why a desktop app is beneficial. The PR description lists what was added, but not why:

Question	PR's Answer
What problem does this solve?	Not stated
What can users do now that they couldn't before?	Nothing new
Why Tauri over just using a browser?	Not explained

The reality:

• TouchTask already works in any browser
• All data is stored in localStorage (same in desktop and web)
• No native features are used (no system notifications, file system integration, offline-first storage, etc.)
• The Rust backend is pure boilerplate with zero custom functionality

🔴 Significant Maintenance Burden

This PR introduces substantial ongoing costs:

Added Dependency	Maintenance Implication
Rust toolchain	Must keep Rust updated, handle breaking changes
Tauri 2.x	Track Tauri releases, security patches, breaking changes
Platform-specific builds	Test on Windows, macOS, Linux for every release
441-line setup guide	Keep documentation synchronized with code
Cross-platform icons	Update 13+ icon files for any branding change

Breaking changes already bundled in this PR:

• React 18 → 19 (major)
• Vite 6 → 7 (major)
• ESLint 8 → 9 (major, requires new flat config format)

These upgrades should be separate PRs with their own testing.

🔴 Build Artifacts Committed

The PR modifies files in dist/:

• dist/assets/index-9gatSvON.js
• dist/assets/index-Bc3HTUhe.css
• dist/index.html

Build artifacts should never be in version control. This indicates the PR author may have misunderstood the build/deploy workflow.

---

Critical Security Issues

1. Content Security Policy Disabled

File: frontend/src-tauri/tauri.conf.json
Severity: CRITICAL

"security": {
  "csp": null
}

CSP is completely disabled, removing a fundamental XSS protection layer. For a desktop app with native system access, this is dangerous.

2. No Logging in Production Builds

File: frontend/src-tauri/src/lib.rs
Severity: CRITICAL

if cfg!(debug_assertions) {
  // Logging only enabled in debug builds
}

Production users will have zero diagnostic information when issues occur.

3. Unhelpful Panic on Startup Failure

File: frontend/src-tauri/src/lib.rs
Severity: CRITICAL

.run(tauri::generate_context!())
.expect("error while running tauri application");

All startup failures produce the same generic panic with no actionable information.

---

Important Technical Issues

4. Platform-Specific Build Script

File: frontend/package.json

"tauri:build": "tauri build --bundles deb,rpm"

This only builds Linux packages. Windows (.msi) and macOS (.dmg, .app) users get nothing. Documentation claims otherwise.

5. Silent Environment Detection

File: frontend/vite.config.js

base: process.env.TAURI_ENV_PLATFORM ? '/' : '/touchtask/',

If TAURI_ENV_PLATFORM is unset or misspelled, the build silently uses the wrong base path and all assets 404.

6. Version Number Chaos

File	Version
package.json	0.0.0
tauri.conf.json	0.1.0
CHANGELOG.md	1.0.0

7. Cargo.toml Metadata Incomplete

authors = ["you"]
license = ""
repository = ""

Placeholder values shouldn't be in a PR ready for merge.

---

Documentation Issues

8. Inconsistent Window Size Documentation

• Documentation shows 1200x800
• Actual config uses 800x600

9. Hardcoded Paths in Examples

cd ~/touchtask  # Assumes specific install location

10. Redundant CI Environment Variable Documentation

The same workaround is documented 4+ times across files.

---

Issue Summary Table

#	Severity	Issue	Location
1	CRITICAL	CSP disabled	tauri.conf.json
2	CRITICAL	No production logging	lib.rs
3	CRITICAL	Unhelpful startup panic	lib.rs
4	HIGH	Linux-only build script	package.json
5	HIGH	Silent env var fallback	vite.config.js
6	MEDIUM	Version inconsistencies	Multiple files
7	MEDIUM	Incomplete Cargo metadata	Cargo.toml
8	LOW	Doc/code mismatch (window size)	TAURI_SETUP.md
9	LOW	Hardcoded paths	README.md
10	LOW	Redundant documentation	Multiple

---

No Functional Improvements

A desktop app could justify maintenance cost if it provided native benefits. This PR implements none:

Native Feature	User Benefit	Currently Implemented?
System notifications	Timer alerts when browser minimized	❌ No
Global hotkeys	Quick-add tasks from anywhere	❌ No
Menu bar/tray icon	Always-visible timer	❌ No
Native file backup	Auto-save to disk, not just localStorage	❌ No
Offline-first storage	SQLite instead of localStorage	❌ No
Auto-start on login	Start with computer	❌ No

The current PR provides zero functional improvements over the web app.

---

Positive Observations

Despite the issues, the PR shows effort:

• ✅ Comprehensive 441-line setup documentation
• ✅ Platform-specific dependency instructions (Ubuntu 22.04 vs 24.04)
• ✅ Justfile integration with nvm/cargo PATH handling
• ✅ Proper Tauri 2.0 project structure
• ✅ Conditional Vite base path for dual deployment

---

Decision: Declining This PR

This is a cool technical demo of what is possible to wrap the web app inside an application, but because there are no functional improvement in the desktop version that would make users prefer it over a browser bookmark. The maintenance burden is not justified.