Skip to content

Convert CapScreen to an on-device desktop app with cloud sign-in - #1

Merged
devxsubh merged 4 commits into
mainfrom
desktop-app
Oct 25, 2026
Merged

Convert CapScreen to an on-device desktop app with cloud sign-in#1
devxsubh merged 4 commits into
mainfrom
desktop-app

Conversation

@devxsubh

@devxsubh devxsubh commented Oct 25, 2026

Copy link
Copy Markdown
Owner

Summary

CapScreen becomes an Electron desktop app. Cap tables, documents and screenings stay on the user's computer; the only cloud piece is account sign-in.

Desktop shell (desktop/)

  • Electron supervises three loopback services: Watchman (self-built, no libpostal), the Express backend and the Next.js UI, behind a capscreen://app protocol and a per-launch API token.
  • Offline sanctions data: list snapshot with automatic fallback and return to live lists.
  • Claude-Code-style sign-in: browser hand-off (RFC 8252 loopback + PKCE), session sealed in the OS keychain, 14-day offline grace.
  • Tray, notifications, crash restart, clean shutdown, installers via electron-builder.

Backend

  • SQLite storage under mongoose (node:sqlite); models and queries unchanged.
  • Pluggable LLMs (Anthropic, native Ollama, OpenAI-compatible) and the AI Control Center API (BYO keys, encrypted).
  • Encrypted backup/restore, hash-chained audit export, watched folders, background re-screening, sanctions list versions stored on results.
  • Cloud auth service for Vercel (src/authService, api/index.ts), live at https://capscreen-auth.vercel.app.
  • Fixes: PDF ingestion (pdf-parse v2 API), refresh cookie path, persisted watchmanListInfo.

Frontend

  • AI Control Center, Data & Backup, signed-in identity, offline banners, watched folders, PDF export.
  • New CapScreen brand (logo, favicon, app and tray icons).

Verification

  • Backend, desktop and frontend typecheck; frontend lint has 0 errors.
  • End to end in the packaged macOS app: local-model screening chat, real OFAC match with OFAC 50% rule propagation, backup → restore, audit tamper detection, watched-folder ingest, crash restart, clean shutdown.
  • Sign-in: 17-check protocol suite (code replay, wrong PKCE verifier, non-loopback redirect, forged callback, rotation, revocation), real portal driven in Chromium, gate → restore → offline → sign-out in the app.
  • Offline lists: Watchman's network blocked → boot in ~12 s from the snapshot, identical screening results.

Known gaps

  • The Atlas cluster in .env.production no longer exists, so live sign-in returns 500 until MONGODB_URI on Vercel points at a working cluster.
  • Installers are unsigned; Windows/Linux builds must be made on those OSes.
  • The SQLite database is not encrypted at rest (API keys are).

🤖 Generated with Claude Code

devxsubh and others added 4 commits October 25, 2026 22:20
@devxsubh @claude
Convert CapScreen to an on-device desktop app with cloud sign-in
6d2a28d 
Desktop (Electron) app where cap tables, documents and screenings never
leave the user's machine. The only cloud piece is account sign-in.

Desktop shell (desktop/)
- Electron main supervises three loopback sidecars: Watchman (self-built
  pure-Go binary, no libpostal), the Express backend and the Next.js UI.
- capscreen://app protocol proxies UI + API; per-launch token gates the API.
- Tray, native notifications, crash restart, clean shutdown, single instance.
- Offline sanctions data: list snapshot cache, automatic fallback when an
  online start fails, automatic return to live lists.
- Claude-Code-style sign-in: browser hand-off over RFC 8252 loopback + PKCE,
  session sealed in the OS keychain, 14-day offline grace.
- electron-builder packaging (dmg/nsis/AppImage).

Backend
- SQLite storage via a MongoDB-driver-compatible store under mongoose
  (node:sqlite); all models and queries unchanged.
- Pluggable LLM providers: Anthropic, native Ollama, OpenAI-compatible.
- AI Control Center API: BYO keys (AES-256-GCM, keychain-sealed master key),
  model roles, local-only policy, Ollama model management.
- Local files instead of R2, in-memory cache instead of Upstash.
- Encrypted backup/restore, hash-chained audit export, watched folders,
  background re-screening, sanctions list versions stored on results.
- Cloud auth service (src/authService) for Vercel: existing account system
  plus desktop token exchange and a hosted sign-in portal.
- Fix: PDF ingestion (pdf-parse v2 API), refresh cookie path, persisted
  watchmanListInfo, misleading Watchman log.

Frontend
- AI Control Center and Data & Backup pages, desktop bridge, watched folder
  and PDF export controls, signed-in identity, offline banners.
- New CapScreen brand (logo, favicon, app and tray icons).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@devxsubh @claude
Load SQLite store lazily so the Vercel auth service never imports nod…
58a2500 
…e:sqlite

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@devxsubh @claude
Vercel config for the auth service: function-only output, upload excl…
0b2d894 
…usions

- .vercelignore keeps storage/ (JWT private key), env files and local data
  out of uploads (the Vercel CLI does not read .gitignore)
- vercel.json: no framework auto-detection, empty static output, all
  routes to api/index.ts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@devxsubh @claude
Ignore Vercel CLI link and env files in backend
33a6998 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@devxsubh
devxsubh merged commit 032061c into main Oct 25, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@devxsubh