feat: desktop-substrate — Electron preload + transport substrate for sense:// (15 commits)

.changeset/config.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [
+    [
+      "commoners",
+      "@commoners/solidarity",
+      "@commoners/testing",
+      "@commoners/bluetooth",
+      "@commoners/serial",
+      "@commoners/windows",
+      "@commoners/local-services",
+      "@commoners/splash-screen",
+      "@commoners/autoupdate"
+    ]
+  ],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.claude/commands/debug-service.md

@@ -0,0 +1,11 @@
+Debug a failing service. The service name/type is: $ARGUMENTS
+
+Investigation steps:
+1. Find the service definition in the demo config or relevant config file
+2. Check the service source code for obvious issues
+3. Check service build output paths (dev: `.commoners/.tmp/services/`, build: `.commoners/services/`)
+4. Look for port conflicts (especially port 2345)
+5. Check if the service requires special environment (conda for Python, cargo for Rust, g++ for C++)
+6. Review recent changes to service-related code in `packages/core/`
+
+Report: root cause analysis, suggested fix, and any related known issues from test history.

.claude/commands/release-check.md

@@ -0,0 +1,10 @@
+Run the full pre-release checklist for the commoners monorepo. Execute each step sequentially and report results:
+
+1. **Type check**: `pnpm typecheck`
+2. **Lint check**: `pnpm lint:check`
+3. **Build all packages**: `pnpm build`
+4. **Run tests**: `pnpm test`
+5. **Build docs**: `pnpm docs:build`
+6. **Build demo**: `pnpm demo:build`
+
+After all steps, provide a summary table showing pass/fail for each step and any issues that need attention before release.

.claude/commands/review.md

@@ -0,0 +1,11 @@
+Review the current uncommitted changes (or the last commit if clean) against project conventions.
+
+Check for:
+1. **Security**: No hardcoded secrets, no command injection, no XSS vectors
+2. **Architecture**: No imports across the `assets/electron/` → `utils/` boundary; WASM services don't go through full `resolveService` path
+3. **Testing**: Changes to core logic should have corresponding test coverage
+4. **Style**: Follows Prettier config (2 spaces, single quotes, no semicolons, 100 char width)
+5. **Extensions system**: Uses `config.extensions` as canonical record, not legacy `plugins`/`services` directly
+6. **Electron**: Preload has no top-level await; IPC uses `invoke`/`handle` pattern
+
+Report findings grouped by severity: blocking, warning, suggestion.

.claude/commands/test-suite.md

@@ -0,0 +1,13 @@
+Run the specified test suite (or all tests if none specified). Ensure proper environment and sequencing.
+
+Available suites: start, config, security, desktop, services, wasm, build, env, protocol, mobile-workflow
+
+Important constraints:
+- Do NOT run test suites concurrently (port conflicts, especially port 2345)
+- Desktop test order: desktop-build → desktop → desktop-zlaunch
+- Python service tests require `conda activate commoners-demo`
+- Echo test may need 90s timeout under resource contention
+
+Run: `pnpm test:$ARGUMENTS` (or `pnpm test` if no suite specified)
+
+After the run, summarize: pass/fail counts, any flaky failures, and whether re-running in isolation would help.

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.md]
+trim_trailing_whitespace = false

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"
+      production-dependencies:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/ci.yml

@@ -0,0 +1,247 @@
+name: CI
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+    branches: [main, dev]
+
+jobs:
+  build:
+    name: Build on ${{ matrix.os }} (Node ${{ matrix.node }})
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node: ['20', '22']
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js ${{ matrix.node }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - name: Setup pnpm cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build packages
+        run: pnpm build
+
+      - name: Check bundle size
+        if: matrix.os == 'ubuntu-latest' && matrix.node == '22'
+        run: |
+          echo "## Bundle Sizes" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Package | Size |" >> $GITHUB_STEP_SUMMARY
+          echo "|---------|------|" >> $GITHUB_STEP_SUMMARY
+          echo "| CLI | $(du -h packages/cli/dist/index.cjs | cut -f1) |" >> $GITHUB_STEP_SUMMARY
+          echo "| Core | $(du -sh packages/core/dist | cut -f1) |" >> $GITHUB_STEP_SUMMARY
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    continue-on-error: true
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - name: Setup pnpm cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build packages
+        run: pnpm build
+
+      - name: Run linter
+        run: pnpm lint:check
+
+  typecheck:
+    name: Typecheck
+    runs-on: ubuntu-latest
+    continue-on-error: true
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - name: Setup pnpm cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build packages
+        run: pnpm build
+
+      - name: Run type check
+        run: pnpm typecheck
+
+  test-fast:
+    name: Fast tests on ${{ matrix.os }} (Node ${{ matrix.node }})
+    needs: build
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node: ['20', '22']
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js ${{ matrix.node }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - name: Setup pnpm cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build packages
+        run: pnpm build
+
+      - name: Config tests
+        run: pnpm test:config
+        env:
+          CI: true
+
+      - name: Environment tests
+        run: pnpm test:env
+        env:
+          CI: true
+
+      - name: Fast unit tests
+        run: pnpm test:fast-unit
+        env:
+          CI: true
+
+  test-services:
+    name: Service tests on ${{ matrix.os }} (Node ${{ matrix.node }})
+    needs: build
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node: ['20', '22']
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js ${{ matrix.node }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - name: Setup pnpm cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build packages
+        run: pnpm build
+
+      - name: Service compilation tests
+        run: pnpm test:services
+        continue-on-error: true
+        env:
+          CI: true