Krzysztof kuhy Rudnicki aeb9376391 app: add the desktop wrapper that serves the web build and fronts GitHub ... A browser cannot touch the filesystem, so the desktop app needs a second half. This local process serves the built web assets, owns an on-disk copy of every document and photo blob the app stores, and performs the GitHub I/O the page cannot. Both GitHub responsibilities are load-bearing, not convenience: - the device-flow endpoints (github.com/login/device/*) send no CORS headers, so a page cannot call them at all; - proxying api.github.com server-side is what keeps the token out of the browser -- the page is told `{"status":"ok"}`, never the token itself. The wrapper falls back to the PC gate's existing `~/.config/diet_guard/sync_token`, so this machine needs no second setup. Details learned the hard way in the two apps migrated before this one, kept here deliberately: loopback-only binding (the endpoints overwrite files in $HOME with no auth), `application/wasm` for .wasm or CanvasKit renders nothing at all, a fixed port and Chrome profile because IndexedDB is keyed by origin, and treating a browser exit inside ~5s as a handoff to an existing window rather than a reason to stop serving. Mirror names are rejected unless they are plain filenames -- a `..` segment would turn a mirror write into an arbitrary-file overwrite. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-07-20 16:31:47 +02:00
..
wrapper_server_test.dart	app: add the desktop wrapper that serves the web build and fronts GitHub	2026-07-20 16:31:47 +02:00