v1.2.8

v1.2.8

Released: 2026-05-16

What’s changed

Desktop frontend no longer served on localhost

Tauri desktop now serves bundled frontend assets (src-tauri/frontend-dist/app) and no longer starts an Astro localhost frontend sidecar. Loader flow is now:

1. Tauri boots backend sidecar.
2. Tauri emits backend-ready payload (API URL + per-launch desktop token).
3. Loader stores payload in session storage and navigates to bundled /app/.

Desktop backend localhost hardened

Desktop launches now inject a per-launch token into backend env. Backend middleware enforces this token when desktop mode is active, so direct browser calls to localhost backend endpoints are rejected without the app-managed header.

Sidecar lifecycle hardened

Desktop runtime now maintains a backend PID file and performs stale-process cleanup on startup, with idempotent shutdown behavior when quitting the app.

Desktop static build wiring completed

tauri-build.sh and tauri-dev.sh now build desktop frontend with STRATA_DESKTOP_STATIC=1, then sync the bundle into src-tauri/frontend-dist/app before running Tauri.

Validation summary

• Backend unit coverage: ✅ (cd backend && npm run test:cov)
• Backend e2e: ✅ (cd backend && npm run test:e2e)
• Frontend unit coverage: ✅ (cd front && npx vitest run --coverage)
• Frontend e2e: ✅ (cd front && npm run test:e2e)
• Docs build: ✅ (cd docs && npm run build)
• Desktop build gate: ✅ (./scripts/tauri-build.sh)

Commits

• 12f573d — fix(desktop): harden no-localhost runtime
• 044d5d9 — chore: release v1.2.8