feat(desktop): real-use Desktop product path (D1-D6 complete on Windows)

[AllureCurtain]

Summary

Delivers the D package of docs/plans/2026-08-18-tui-desktop-real-use-final-implementation.md: the Windows Desktop product path, from install to a real Agent task equivalent to the TUI's.

Desktop stays a thin Tauri host over the shared rove-api, Runtime, ProductStore, Tool Registry, provider catalog, canonical events, and durable run state. No Agent loop, no Desktop-private event protocol, no unilateral change to the Core Agent loop, Provider wire protocol, or Tool Registry permissions.

D1-D6 are complete on Windows. The final section 10.1 A gate is still outstanding and must run on merged main.

What's in the code

• Windows provider_credential_prompt: accepts only non-secret profile metadata, opens the native credential UI with CREDUI_FLAGS_DO_NOT_PERSIST, hands the raw credential straight to the shared onboarding service. The secret never reaches WebView state, ordinary config, logs, or traces.
• Settings create/test/use flow driving the shared ProviderOnboardingService, so a Start-menu launch can configure and enable a provider with no terminal and no TOML.
• Native directory picker creating a correct Product Workspace.
• Bearer-authenticated SSE inside the WebView, reconnecting only the focused job, with no duplicate submission on an ambiguous job-start response.
• Negative tests pinning secret-free projection: secure_onboarding_projects_catalog_identity_without_serializing_the_secret, probe_and_use_metadata_are_bounded_and_secret_free.

D6 installed-state gate: 9/9 pass

Run 2026-08-26 against the real SiliconFlow provider — openai, https://api.siliconflow.cn/v1, deepseek-ai/DeepSeek-V3.2 — with the key read only from the Windows keyring. No Fake provider was used anywhere in this gate, and no temporary PowerShell environment variable was involved. Desktop was launched from the Start-menu shortcut every time.

item	result
install succeeds, launch needs no dev tooling	pass
uninstall + reinstall round trip	pass, 10/10
provider credentials resolve after Start-menu launch	pass
two read-only turns on the real model, same as TUI	pass
Chat/Inspector show real tool calls and their evidence	pass
a modification turn: approval, change, test, diff	pass
SSE disconnect/reconnect without duplicate submission	pass, 5/5
restart restores workspace, sessions, terminal state	pass, 10/10
reinstall + relaunch restores state	pass, 6/6

Details worth pulling out:

• Tool calls are genuinely native. 41 tool calls across 8 distinct tools, every one carrying a provider-side tool_use_id — not JSON embedded in assistant text. 6 approval events.
• SSE replay is exact. Streamed 40 events, dropped the socket, reopened with after=40, resumed at exactly seq 41 and drained to 1148. No duplicate seqs, exactly one run_completed, no gaps, one run id per job.
• Restart used a hard kill, including WebView2 children, which is a stronger test than a graceful window close. Workspace identity, the full session set with statuses, diff, artifact count and sha256 digests all came back. /jobs/{id}/state returns 404 — the job registry is ephemeral by design, so terminal state is recovered from the durable report (status: success, termination_reason: final).
• Uninstall preserves user data. %APPDATA%\Rove held 146 files / 11204219 bytes at installed, uninstalled, and reinstalled states alike.
• Both NSIS packages are perMachine. Install and uninstall must run as an elevated child; driving uninstall.exe from an unelevated session fails with WinError 740. The earlier claim that installation was impossible in a non-administrator session is now corrected in the docs.

Evidence package at C:\rove-evidence\d6-desktop\ — manifest.json indexes every artifact with a sha256 digest, alongside report.json, tool-events.jsonl, transcript.md, session-diff.json, uninstall-round-trip.{json,md}, provider-safe-identity.json, git-status.txt, checks.json. Generated, and deliberately not committed. Every file passed a leak scan (sk-, SILICONFLOW_API_KEY=, Bearer ey, api_key":") before being written.

Deterministic checks

cargo fmt --all --check                                  exit 0
cargo clippy --workspace --all-targets -- -D warnings    exit 0
cargo test --workspace                                   1567 passed / 0 failed
cargo test -p rove-api                                   137 passed
cargo test -p rove-desktop --all-targets                 13 lib + 3 integration passed
pnpm test        (apps/web)                              37 files / 255 tests passed
pnpm typecheck   (apps/web)                               exit 0
pnpm build:desktop                                        exit 0
pnpm dlx @tauri-apps/cli@2 build --bundles "msi,nsis" --ci  MSI + NSIS produced

CARGO_TARGET_DIR was redirected to C:\rove-build\desktop-real-use-final because the D: volume was short on space, so bundles landed there rather than in the in-repo target/release/bundle/. The docs previously stated the in-repo path unconditionally; that is now corrected.

Product defects found, not fixed

Confirmed by observation while running the gate, each recorded in the manifest. Left unfixed on purpose — section 6 forbids this branch from unilaterally changing Core Agent loop, Provider wire protocol, or Tool Registry permission behaviour, and none of these are Desktop-owned:

1. needs_attention is a terminal deadlock. A run ending without a final answer strands the session; there is no recovery endpoint. error accepts new turns, needs_attention does not.
2. Project config is never loaded on the API/Desktop path. project_config_loaded is hardcoded false even when the project_configuration trust capability has been granted.
3. max_model_turns_per_step = 4 is unreachable from Desktop. Hardcoded as DEFAULT_MAX_MODEL_TURNS_PER_STEP in runtime/src/planning/execution.rs.
4. The product UI cannot select an agent profile. POST /jobs honours an agent field, but CreateProductMessageRequest sets deny_unknown_fields, so the Desktop and Web product path cannot send one. Identical on main; this branch adds no agent-selection frontend code.

Test plan

• Deterministic workspace gate (fmt, clippy, cargo test, web tests, typecheck, build)
• D6 installed-state gate on real SiliconFlow, 9/9
• Uninstall/reinstall round trip with user-data retention
• SSE disconnect/reconnect replay contiguity
• Restart recovery from durable state
• pnpm test:e2e (Playwright) — not run here, part of the final A1 gate on main
• Desktop screenshots for the D6 journey — not captured, recorded as a gap rather than filled with a synthetic image
• Section 10.1 A gate — must run on final main after both branches merge; this Windows-only, single-machine evidence does not substitute for it, nor for the A3 installed-state TUI gate

Scope notes

Windows-only. No release claim is made for unverified platforms. No existing tests were deleted; new tests are limited to the §8.2 golden path plus the security regressions above.