# Rho Desktop TODO

Status: first desktop slice is implemented and merged. This TODO replaces the
old single-CLI migration TODO; keep `desktop.md` as the build/signing reference.

## Objective

Make the Tauri desktop app a usable Rho client for the real two-GitHub-account
workflow:

1. Create or reuse local Rho profiles and private keys for each GitHub account.
2. Open one or more desktop windows, each bound to a different Rho/GitHub
   profile.
3. Manage Rho Git repos, membership, protected messages, requests, approvals,
   runs, results, and PR choreography through the UI.
4. Keep the desktop app using the same CLI/API semantics as `rho` so the UI is a
   thin, inspectable shell over the proven command flow.

## Current Evidence

- [x] Tauri v2 desktop app exists under `desktop/`.
- [x] Product name is `Rho`.
- [x] App identifier is `com.madhavajay.rho-desktop`.
- [x] Desktop Rust crate is `rho-desktop`.
- [x] JavaScript package is `rho-desktop`.
- [x] Desktop app imports the repo Rust crate through `rho_core`.
- [x] Desktop app calls `rho` CLI commands for existing workflows instead of
      inventing a separate protocol.
- [x] `dev-desktop.sh` launches the Tauri desktop app.
- [x] `test-desktop.sh` smoke-tests the desktop app.
- [x] `build.sh` builds unsigned desktop packages.
- [x] `build-signed.sh` supports signed/notarized macOS builds.
- [x] `scripts/create-desktop-dmg.sh` exists as a fallback DMG builder.
- [x] `check-gatekeeper.sh` validates signed macOS app/DMG artifacts.
- [x] `install-dmg.sh` installs a local DMG into `/Applications`.
- [x] `.github/workflows/desktop-builds.yml` builds unsigned desktop packages
      for Linux, macOS arm64, macOS x64, and Windows x64.
- [x] `.github/workflows/desktop-signed-macos.yml` exists for signed macOS
      desktop builds.
- [x] `.env.example` documents Tauri updater signing variables.
- [x] Local `.env` has `TAURI_SIGNING_PRIVATE_KEY` and
      `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`.
- [x] Desktop CI currently passes on PR checks.

## Non-Goals For The Next Slice

- Do not add a daemon or WebSocket bridge yet.
- Do not build a separate desktop-only Rho protocol.
- Do not hide CLI failures behind silent UI state.
- Do not make release updater artifacts mandatory until the signed build flow is
  ready to ship.

## Completed Product Slices

### 1. Basic Shell

- [x] Desktop app starts with React/Vite/Tauri.
- [x] App shows CLI readiness checks.
- [x] App checks `rho`, `git`, `gh`, `gh auth`, selected Rho profile, GitHub
      account match, and Rho home.
- [x] App can open additional profile windows.
- [x] App has no Rust WebSocket bridge requirement.

### 2. Profile And Onboarding Foundation

- [x] Detect local profiles from `~/.rho/identities/github/*.yaml`.
- [x] Detect GitHub accounts from `gh auth status --json`.
- [x] Match detected GitHub accounts to existing local Rho profiles.
- [x] Detect whether local signing and encryption private keys exist.
- [x] Create missing Rho profiles with `rho id init`.
- [x] Verify GitHub profile proof with `rho id verify-github`.
- [x] Show profile details with `rho id show`.
- [x] Switch active GitHub account with `rho gh switch`.
- [x] Bind commit author metadata into the local Rho identity manifest.
- [x] Allow profile-specific windows for multi-account testing.

### 3. Project Registry And Repo Overview

- [x] Track projects per Rho profile under the Rho home desktop registry.
- [x] Add a local repo by path.
- [x] Clone a GitHub repo URL.
- [x] Warn when a repo is not a Rho repo.
- [x] Show owner, current role, branch, remote, dirty state, ahead/behind, and
      status summary.
- [x] Open the project folder in the OS file manager.
- [x] Select a repo and inspect files, members, participants, policy files,
      tools, messages, pending actions, and git status entries.

### 4. Basic Repo Actions

- [x] Set up a Rho repo from a folder, creating `.git` if needed.
- [x] Optionally add an `origin` remote during setup.
- [x] Run `rho repo init`, `rho repo add-user`, `rho repo protect-path`, and
      `rho repo doctor` from setup.
- [x] Run repo status, doctor, doctor flow, import users, join, admit, add user,
      and request review actions from the UI.
- [x] Commit repo changes through `rho commit --require-identity-match`.
- [x] Run basic git fetch, pull, push, push upstream, switch branch, and create
      branch actions.

### 5. Message First Slice

- [x] Show project messages discovered in the repo.
- [x] Compose a signed project message.
- [x] Persist message metadata under the recipient inbox path.

## Remaining Work

### 1. Turn Onboarding Into A Real First-Run Flow

- [ ] Show onboarding as a guided first-run/skippable workflow instead of a
      permanent inline panel.
- [ ] Present detected GitHub accounts as profile choices, e.g. "Create profile
      for `madhavajay` or `madhavajay-test`".
- [ ] Explain when an existing `~/.rho` profile and private keys are being
      reused.
- [ ] Add explicit import/detect/repair UI for existing private keys in
      `~/.rho/keys/github/<handle>/`.
- [ ] Add a clear proof-setup step that shows the GitHub profile proof URL and
      waits for verification.
- [ ] Add a final readiness screen that verifies `rho`, `git`, `gh`, auth,
      profile keys, proof, and commit binding.

### 2. Native File And Folder Picking

- [ ] Add Tauri dialog plugin support for folder selection.
- [ ] Replace manual path text fields for local repo path, clone destination,
      and setup folder with native pickers.
- [ ] Add remove/forget project action for stale registry entries.
- [ ] Consider an auto-discover flow for existing local git repos.

### 3. GitHub PR Workflow

- [ ] List relevant GitHub PRs for the selected repo and active profile.
- [ ] Create/open PRs for join, request, and result branches with `gh`.
- [ ] Show PR state, branch, author, changed files, and mergeability.
- [ ] Allow merge of approved PRs from the UI.
- [ ] Guard merge actions with `rho repo check-pr`, `rho repo doctor`, and
      `rho repo doctor --flow` where appropriate.
- [ ] Keep GitHub permissions separate from Rho authorization; Rho approval must
      come from signed in-repo artifacts.

### 4. First-Class Join/Add User UI

- [ ] Show join requests as dedicated pending actions.
- [ ] Display the requester's GitHub handle, identity bundle, proof URL, key
      fingerprints, and changed files.
- [ ] Verify the GitHub proof before admitting a user.
- [ ] Add buttons for admit, add user, open profile on GitHub, open PR, and
      merge PR.
- [ ] Make owner/collaborator roles obvious in each profile window.

### 5. Request, Approval, Run, Result UI

- [ ] Add a request detail screen for request metadata, script diff, dataset,
      requester, owner, and expected protected paths.
- [ ] Add an approve-request flow backed by `rho run approve-request`.
- [ ] Add a run-approved-action flow backed by `rho run controlled-action`.
- [ ] Add result release flow backed by `rho result release`.
- [ ] Add result verification flow for the recipient profile.
- [ ] Show the full flow state from `rho repo doctor --flow` as UI state, not
      only raw command output.
- [ ] Require signed approval grants and run receipts through the full desktop
      flow.

### 6. Messages As Project Chat

- [ ] Group messages by project, inbox, sender, and thread.
- [ ] Show a compact chat-style view for each project/thread.
- [ ] Encrypt messages to the recipient path, not just sign plaintext
      `message.yaml`.
- [ ] Commit message changes to a feature branch.
- [ ] Push the branch and optionally open a PR.
- [ ] Show signature and encryption status per message.

### 7. Repo File Browser

- [ ] Add an in-app file tree for selected repos.
- [ ] Show file contents for safe text files.
- [ ] Highlight protected/encrypted files and signed artifacts.
- [ ] Add quick actions to open a file/folder in Finder/Explorer.
- [ ] Defer in-app editing until the request/message flow is stable.

### 8. Setup New Rho Repo Polish

- [ ] Support creating a GitHub repository through `gh repo create`.
- [ ] Better infer repo id and origin remote from GitHub URL or selected account.
- [ ] Ask basic `rho.yaml` setup questions explicitly.
- [ ] Push the initialized `main` branch after setup when requested.
- [ ] Run and display `rho repo doctor --governance` after setup.

### 9. Multi-Profile Window Isolation

- [ ] Make the active profile/window identity visually prominent at all times.
- [ ] Ensure every command in a profile window receives that profile's
      `RHO_HOME` and `RHO_IDENTITY`.
- [ ] Ensure `gh` switching is explicit before network operations.
- [ ] Add a small two-window smoke test for `madhavajay` and
      `madhavajay-test` style flows.

### 10. Build, Signing, And Update Polish

- [ ] Decide when to enable Tauri updater artifacts
      (`createUpdaterArtifacts: true`).
- [ ] Wire signed macOS workflow secrets in GitHub:
      `APPLE_ID`, `APPLE_PASSWORD`, `APPLE_TEAM_ID`,
      `SIGNING_CERTIFICATE_P12_DATA`, `SIGNING_CERTIFICATE_PASSWORD`,
      `KEYCHAIN_PASSWORD`, and optional `APPLE_SIGNING_IDENTITY`.
- [ ] Confirm `TAURI_SIGNING_PRIVATE_KEY` and
      `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` are present as GitHub secrets.
- [ ] Run a signed/notarized macOS build and Gatekeeper check.
- [ ] Decide whether release distribution needs separate x64/arm64 DMGs or a
      universal macOS app.
- [ ] Tighten Tauri CSP before shipping remote-content features.

## Acceptance Gates For The Next Desktop Slice

- [ ] `npm --prefix desktop run build`
- [ ] `cargo check --manifest-path desktop/src-tauri/Cargo.toml --locked`
- [ ] `./test-desktop.sh`
- [ ] `cargo fmt --all -- --check`
- [ ] `cargo clippy --all-targets --all-features --locked -- -D warnings`
- [ ] `cargo test --all-targets --all-features --locked`
- [ ] `./test.sh`
- [ ] CI passes for `CI`, `Desktop Builds`, and `rho-pr-policy`.

## Reference Docs

- `desktop.md` keeps the imported build/signing notes.
- `docs/tutorials/live-github-two-identity-rehearsal.md` describes the real
  two-account GitHub flow.
- `docs/tutorials/live-git-pi-sandbox-encrypted.md` describes the longer
  request/run/result flow.
- `improvements.md` tracks CLI/backend workflow gaps that the desktop UI should
  surface rather than hide.
