desktop: route worker api calls through rust, add devtools build flag

[dallen4]

Summary

API key fetching in the desktop app was failing in production, and there was no way to open the inspector in a packaged build to find out why. Both are fixed here.

1. Worker calls leave from Rust instead of the webview. The worker's CORS allowlist takes the deadrop.io hosts, the Vercel previews, and vscode-webview://. The Tauri webview origin is tauri://localhost packaged and http://localhost:1420 under tauri dev, so neither build was ever getting through and prod was never going to fix what dev was showing. src/lib/native-fetch.ts (renamed from native-clerk-fetch-patch.ts) already routed Clerk FAPI calls through @tauri-apps/plugin-http for an unrelated Origin conflict, so worker calls now take that same path. Rust side requests are not webview originated, so CORS does not apply to them.

I went this way instead of adding a desktop origin to the worker allowlist. Origin is self asserted, so allowlisting tauri://localhost, let alone http://localhost:1420, hands that bypass to anything willing to set the header against a public API. Nothing changes server side.

No call sites changed, so this also covers cloud vault provisioning and token issuance in vault-cloud.ts, plus the drop and grab session calls in the contexts. All of those were hitting the same wall.

2. Opt in devtools for packaged builds. pnpm tauri build --features devtools compiles the inspector in and opens it on launch. Plain release builds still ship without it, which is why right click and the hotkey do nothing today. I left it opt in rather than always on, since the whole pitch is that plaintext never leaves the device.

Before merging

Confirm VITE_DEADROP_API_URL matches the capability scope. http:default in src-tauri/capabilities/default.json now allows https://deadrop.nieky.dev/* and http://localhost:8787/*. I read the prod host off worker/wrangler.toml because the .env files were outside what I could read. If the desktop build env points somewhere else, plugin-http rejects the call before it leaves and you trade a CORS error for a scope error.

Testing

• pnpm desktop:dev, sign in, open a cloud vault you own, confirm the API Keys section lists keys instead of erroring
• Issue a key from that section
• Create a cloud vault and issue a sync token, both of which go through vault-cloud.ts
• Run a drop and a grab from the desktop app, since those calls moved onto the same path
• pnpm tauri build --features devtools, confirm the inspector opens in the packaged app
• Plain pnpm desktop:build, confirm no inspector

Verified locally: cargo check with and without the feature, pnpm -F desktop build, and the pre-push suite at 352 passing.

Also here: deadrop-setup skill refresh

The skill had drifted from the CLI. Corrections:

• apiKeys create no longer prints to stdout by default. The hard rule said it does, and used that as the reason an agent must not run it. As of 1.11.0 it renders on an alternate screen, refuses a non-interactive stream outright, and needs --print to pipe. Rule kept, reasoning fixed.
• --copy is now the recommended way to issue a key. It puts both values on the clipboard and prints only the key name.
• DEADROP_VAULT_KEY comes back with the key now. The skill was still sending users into .deadroprc to copy it out by hand, which is the file it also tells them not to open.
• CI needs a cloud vault. apiKeys create only offers vaults marked cloud, but the skill's init step makes a local one and the CI section never said so. Anyone following it end to end hit a dead stop.
• Global vs project is now an explicit choice at step 2, with deadrop init --global (1.11.0). Project is recommended for encapsulation, global for ease of use, and project is the default when the user has no preference since it is the reversible direction.
• New "Desktop app" section: deadrop desktop install, the shared global config, the API Keys and Add secret UIs, and vault sharing. The desktop app is also now the answer to a gap the skill flagged as unsolved, since "Add secret" is a safe way for a user to enter a brand new value.
• Numbered steps were not contiguous (Common follow-ups sat between 5 and CI). Reordered.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
deadrop	Ready	Preview	Sep 5, 2026 10:32pm UTC