Migrate from Tauri to Electron by richiemcilroy · Pull Request #2119 · CapSoftware/Cap · GitHub

I wanted to see what a migration from Tauri to Electron would look like for Cap. We regularly receive bug reports caused by differences between the browser versions available across OS releases. Electron ships a stable Chromium runtime, giving Cap consistent browser behavior across supported versions.

This keeps the existing Rust backend and UI, replacing the Tauri runtime and bridge with Electron equivalents. Packaging and release workflows have been updated to match.

Validation: Rust checks, clippy and 141 tests; desktop typecheck and Biome; production renderer and Electron builds; unsigned macOS packaging.

Greptile Summary

The PR replaces the Tauri desktop runtime and packaging pipeline with Electron while retaining the Rust backend and existing renderer.

Adds an Electron main process, preload bridge, native-operation layer, and Rust transport.
Reworks desktop builds, signing, updater manifests, and immutable GitHub release promotion.
Updates frontend integrations and shared runtime abstractions for the new bridge.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains in the follow-up review scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/desktop-release.yml	Replaces direct per-platform release uploads with SHA-scoped staging, complete asset assembly, validation, and final promotion.
scripts/prepare-electron-release-assets.mjs	Validates platform artifacts and combines macOS x64 and arm64 updater entries into one manifest.
apps/desktop/electron/main.cjs	Initializes Electron application services, windows, backend transport, and IPC dispatch.
apps/desktop/electron/native.cjs	Implements the native-operation compatibility layer used by the Electron renderer and Rust backend.
apps/desktop/electron/backend.cjs	Starts the Rust backend and implements its framed localhost transport.
crates/desktop-runtime/src/transport.rs	Adds the Rust side of the Electron backend protocol and command transport.

Reviews (18): Last reviewed commit: "fix: format merged SEO metadata" | Re-trigger Greptile

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: npm shell-quote quote() does not escape newlines in object .op values CVE: GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values (CRITICAL) Affected versions: >= 1.1.0 < 1.8.4 Patched version: 1.8.4 From: pnpm-lock.yaml → npm/concurrently@9.2.1 → npm/shell-quote@1.8.3 ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/shell-quote@1.8.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm electron-winstaller is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/electron-builder@26.15.3 → npm/electron-winstaller@5.4.0 ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/electron-winstaller@5.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm tiny-async-pool is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/electron-builder@26.15.3 → npm/tiny-async-pool@1.3.0 ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tiny-async-pool@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

hey @greptile-apps please review the PR

hey @greptileai, please re-review the PR

Superagent found 1 security concern(s).

hey @greptileai, please re-review the PR

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/electron-builder@26.15.3
	npm/electron-updater@6.8.9
	npm/wait-on@9.0.1
	npm/concurrently@9.2.1
	npm/electron@43.4.0

View full report

hey @greptileai, please re-review the PR

richiemcilroy added 5 commits August 13, 2026 00:36

feat(desktop): replace Tauri with a Rust IPC runtime

4f77475

feat(desktop): add the Electron shell and renderer bridge

fa925ef

ci(desktop): build and publish Electron releases

3a57117

docs: add Electron and Tauri benchmark

1dec47e

chore(desktop): format Electron migration files

777479b

richiemcilroy marked this pull request as ready for review August 12, 2026 23:47

vercel Bot deployed to Preview August 12, 2026 23:47 View deployment

github-advanced-security Bot found potential problems Aug 12, 2026

View reviewed changes

Comment thread apps/desktop/src/electron/path.ts Fixed

greptile-apps Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread .github/workflows/desktop-release.yml Outdated

github-advanced-security Bot found potential problems Aug 13, 2026

View reviewed changes

Comment thread apps/desktop/src-backend/src/lib.rs Fixed

fix: protect published release tags

ba952c8

vercel Bot deployed to Preview August 13, 2026 00:10 View deployment

superagent-security Bot reviewed Aug 13, 2026

View reviewed changes

Comment thread .github/workflows/desktop-release.yml Outdated

greptile-apps Bot reviewed Aug 13, 2026

View reviewed changes

Comment thread .github/workflows/desktop-release.yml Outdated

richiemcilroy added 4 commits August 13, 2026 01:33

fix: make release tags immutable

c75998b

fix: preserve basename suffix semantics

491c2ac

fix: avoid logging user identifiers

e090512

style: format Loom storage access

eb048ee

vercel Bot deployed to Preview August 13, 2026 00:35 View deployment

fix: harden Loom URL handling

4d1a993

vercel Bot deployed to Preview August 13, 2026 00:57 View deployment

ci: harden desktop validation

4233b70

vercel Bot deployed to Preview August 13, 2026 02:04 View deployment

vercel Bot deployed to Preview August 13, 2026 03:38 View deployment

richiemcilroy added 3 commits August 13, 2026 14:02

perf: retain decoded frames on the GPU

e739e32

perf: reduce Electron editor resource usage

c9aa93e

docs: update Electron performance benchmark

eb98994

vercel Bot deployed to Preview August 13, 2026 13:04 View deployment

greptile-apps Bot reviewed Aug 13, 2026

View reviewed changes

Comment thread .github/workflows/desktop-release.yml

docs: refresh final Electron benchmark

ca5c360

vercel Bot deployed to Preview August 13, 2026 13:43 View deployment

fix: revalidate release before promotion

4aa2d3a

vercel Bot deployed to Preview August 13, 2026 13:50 View deployment

fix: require immutable desktop releases

26be4fa

vercel Bot deployed to Preview August 13, 2026 13:59 View deployment

fix: validate release policy without admin token

8b56f79

vercel Bot deployed to Preview August 13, 2026 14:12 View deployment

richiemcilroy added 2 commits August 14, 2026 12:58

perf: reduce editor layout measurements

6604aa6

perf: defer updates while main window is hidden

9655675

vercel Bot deployed to Preview August 14, 2026 12:00 View deployment

richiemcilroy added 2 commits August 14, 2026 13:48

Merge remote-tracking branch 'origin/main' into feature/electron-desktop

7ef4a0f

fix: format merged SEO metadata

0966358

vercel Bot deployed to Preview August 14, 2026 12:50 View deployment

greptile-apps Bot reviewed Aug 14, 2026

View reviewed changes

Comment thread .github/workflows/desktop-release.yml

richiemcilroy mentioned this pull request Aug 18, 2026

Cap Desktop -> GPUI #2133

Merged

3 tasks

Migrate from Tauri to Electron by richiemcilroy · Pull Request #2119 · CapSoftware/Cap · GitHub

Uh oh!

Migrate from Tauri to Electron - #2119

Migrate from Tauri to Electron#2119richiemcilroy wants to merge 32 commits intomainCapSoftware/Cap:mainfrom feature/electron-desktopCapSoftware/Cap:feature/electron-desktopCopy head branch name to clipboard

Conversation

richiemcilroy commented Aug 12, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

cursor Bot commented Aug 12, 2026

Uh oh!

socket-security Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

richiemcilroy commented Aug 12, 2026

Uh oh!

Uh oh!

Uh oh!

richiemcilroy commented Aug 13, 2026

Uh oh!

superagent-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

richiemcilroy commented Aug 13, 2026

Uh oh!

richiemcilroy commented Aug 13, 2026

Uh oh!

richiemcilroy commented Aug 13, 2026

Uh oh!

richiemcilroy commented Aug 13, 2026

Uh oh!

Uh oh!

richiemcilroy commented Aug 13, 2026

Uh oh!

richiemcilroy commented Aug 13, 2026

Uh oh!

socket-security Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

richiemcilroy commented Aug 13, 2026

Uh oh!

richiemcilroy commented Aug 13, 2026

Uh oh!

richiemcilroy commented Aug 14, 2026

Uh oh!

Uh oh!

richiemcilroy commented Aug 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Migrate from Tauri to Electron#2119
richiemcilroy wants to merge 32 commits into
mainfrom
feature/electron-desktop

richiemcilroy commented Aug 12, 2026 •
edited by greptile-apps Bot
Loading

socket-security Bot commented Aug 12, 2026 •
edited
Loading

socket-security Bot commented Aug 13, 2026 •
edited
Loading