fix(desktop): preserve Electron to Tauri upgrades

.github/scripts/create-electron-bridge-manifest.mjs

@@ -6,15 +6,24 @@ import path from 'node:path';
 
 const options = parseArguments(process.argv.slice(2));
 const assets = fs.readdirSync(options.assets).sort();
-const names = [
-  'Qwen-Code-Desktop-arm64.zip',
-  'Qwen-Code-Desktop-x64.zip',
-  'Qwen-Code-Desktop-arm64.dmg',
-  'Qwen-Code-Desktop-x64.dmg',
-];
-const artifacts = names.map((name) => readArtifact(assets, name));
+const patterns = {
+  macos: [
+    /[-_]arm64\.zip$/i,
+    /[-_]x64\.zip$/i,
+    /[-_]arm64\.dmg$/i,
+    /[-_]x64\.dmg$/i,
+  ],
+  windows: [/-setup\.exe$/i],
+  linux: [/\.AppImage$/i],
+};
+const selectedPatterns = patterns[options.platform];
+if (!selectedPatterns) {
+  throw new Error(`Invalid --platform: ${options.platform}`);
+}
+const artifacts = selectedPatterns.map((pattern) =>
+  readArtifact(selectArtifact(assets, pattern)),
+);
 const primary = artifacts[0];
-
 const lines = [
   `version: ${options.version}`,
   'files:',
@@ -29,10 +38,17 @@ const lines = [
 ];
 fs.writeFileSync(options.output, `${lines.join('\n')}\n`);
 
-function readArtifact(assets, name) {
-  if (!assets.includes(name)) {
-    throw new Error(`Missing Electron bridge artifact: ${name}`);
+function selectArtifact(assets, pattern) {
+  const matches = assets.filter((asset) => pattern.test(asset));
+  if (matches.length !== 1) {
+    throw new Error(
+      `Expected one Electron bridge artifact matching ${pattern}, found ${matches.length}: ${matches.join(', ')}`,
+    );
   }
+  return matches[0];
+}
+
+function readArtifact(name) {
   const file = path.join(options.assets, name);
   return {
     name,
@@ -52,7 +68,7 @@ function parseArguments(args) {
     if (!name || value === undefined) throw new Error('Invalid arguments.');
     values[name] = value;
   }
-  for (const required of ['assets', 'version', 'output']) {
+  for (const required of ['assets', 'platform', 'version', 'output']) {
     if (!values[required]) throw new Error(`Missing --${required}`);
   }
   if (

.github/workflows/desktop-build.yml

@@ -12,6 +12,9 @@ on:
       tag:
         required: true
         type: 'string'
+      electron_bridge:
+        required: true
+        type: 'boolean'
       publish:
         required: true
         type: 'boolean'
@@ -34,9 +37,11 @@ jobs:
           - name: 'macOS Apple Silicon'
             os: 'macos-15'
             target: 'aarch64-apple-darwin'
+            legacy_arch: 'arm64'
           - name: 'macOS Intel'
             os: 'macos-15-intel'
             target: 'x86_64-apple-darwin'
+            legacy_arch: 'x64'
           - name: 'Windows x64'
             os: 'windows-2025'
             target: 'x86_64-pc-windows-msvc'
@@ -234,6 +239,23 @@ jobs:
           $signature = Get-AuthenticodeSignature $installer.FullName
           if ($signature.Status -ne 'Valid') { throw "Invalid Authenticode signature: $($signature.Status)" }
 
+      - name: 'Create Electron bridge archive'
+        if: "runner.os == 'macOS' && inputs.electron_bridge"
+        shell: 'bash'
+        env:
+          LEGACY_ARCH: '${{ matrix.legacy_arch }}'
+          RELEASE_VERSION: '${{ inputs.version }}'
+        run: |
+          set -euo pipefail
+          app="$(find packages/desktop-shell/src-tauri/target/${{ matrix.target }}/release/bundle/macos -maxdepth 1 -name 'OpenWork.app' -print -quit)"
+          if [[ -z "$app" ]]; then
+            echo '::error::The OpenWork macOS app bundle was not produced.'
+            exit 1
+          fi
+          destination="packages/desktop-shell/src-tauri/target/${{ matrix.target }}/release/bundle/electron-bridge"
+          mkdir -p "$destination"
+          ditto -c -k --sequesterRsrc --keepParent "$app" "$destination/OpenWork_${RELEASE_VERSION}_${LEGACY_ARCH}.zip"
+
       - name: 'Smoke packaged application (macOS)'
         if: "runner.os == 'macOS'"
         shell: 'bash'
@@ -259,6 +281,9 @@ jobs:
 
       - name: 'Collect verified artifacts'
         shell: 'bash'
+        env:
+          LEGACY_ARCH: '${{ matrix.legacy_arch }}'
+          RELEASE_VERSION: '${{ inputs.version }}'
         run: |
           set -euo pipefail
           destination="$RUNNER_TEMP/openwork-desktop-artifacts"
@@ -270,7 +295,8 @@ jobs:
               case "$name" in
                 *.app.tar.gz.sig) name="${name%.app.tar.gz.sig}-${{ matrix.target }}.app.tar.gz.sig" ;;
                 *.app.tar.gz) name="${name%.app.tar.gz}-${{ matrix.target }}.app.tar.gz" ;;
-                *.dmg) name="OpenWork-${{ matrix.target }}.dmg" ;;
+                *.dmg) name="OpenWork_${RELEASE_VERSION}_${LEGACY_ARCH}.dmg" ;;
+                OpenWork_*.zip) ;;
                 *) continue ;;
               esac
             elif [[ "$RUNNER_OS" == 'Windows' ]]; then
@@ -279,7 +305,7 @@ jobs:
               case "$name" in *.AppImage|*.AppImage.sig|*.deb|*.deb.sig) ;; *) continue ;; esac
             fi
             cp "$artifact" "$destination/${name// /-}"
-          done < <(find "$bundle_root" -mindepth 2 -maxdepth 2 -type f \( -name '*.dmg' -o -name '*.AppImage' -o -name '*.deb' -o -name '*.exe' -o -name '*.app.tar.gz' -o -name '*.sig' \) -print0)
+          done < <(find "$bundle_root" -mindepth 2 -maxdepth 2 -type f \( -name '*.dmg' -o -name '*.AppImage' -o -name '*.deb' -o -name '*.exe' -o -name '*.zip' -o -name '*.app.tar.gz' -o -name '*.sig' \) -print0)
           if [[ -z "$(find "$destination" -type f -print -quit)" ]]; then
             echo '::error::No desktop artifacts were produced.'
             exit 1
@@ -316,23 +342,33 @@ jobs:
       - name: 'Generate updater manifest and checksums'
         shell: 'bash'
         env:
+          ELECTRON_BRIDGE: '${{ inputs.electron_bridge }}'
           RELEASE_TAG: '${{ inputs.tag }}'
           RELEASE_VERSION: '${{ inputs.version }}'
         run: |
           set -euo pipefail
           node .github/scripts/create-desktop-update-manifest.mjs --assets release-assets --repository "$GITHUB_REPOSITORY" --tag "$RELEASE_TAG" --version "$RELEASE_VERSION" --output release-assets/latest.json
+          if [[ "$ELECTRON_BRIDGE" == 'true' ]]; then
+            for manifest in macos:latest-mac.yml windows:latest.yml linux:latest-linux.yml; do
+              platform="${manifest%%:*}"
+              output="${manifest#*:}"
+              node .github/scripts/create-electron-bridge-manifest.mjs --assets release-assets --platform "$platform" --version "$RELEASE_VERSION" --output "release-assets/$output"
+            done
+          fi
           (cd release-assets && sha256sum -- * > SHA256SUMS.txt)
 
       - name: 'Create GitHub release'
         env:
           GH_TOKEN: '${{ github.token }}'
+          ELECTRON_BRIDGE: '${{ inputs.electron_bridge }}'
           RELEASE_DRAFT: '${{ inputs.draft }}'
           RELEASE_NAME: '${{ inputs.release_name }}'
           RELEASE_PRERELEASE: '${{ inputs.prerelease }}'
           RELEASE_TAG: '${{ inputs.tag }}'
         run: |
           set -euo pipefail
-          args=("$RELEASE_TAG" release-assets/* --target "$GITHUB_SHA" --title "$RELEASE_NAME" --generate-notes --latest=false)
+          args=("$RELEASE_TAG" release-assets/* --target "$GITHUB_SHA" --title "$RELEASE_NAME" --generate-notes)
+          if [[ "$RELEASE_DRAFT" == 'false' && "$RELEASE_PRERELEASE" == 'false' && "$ELECTRON_BRIDGE" == 'true' ]]; then args+=(--latest); else args+=(--latest=false); fi
           if [[ "$RELEASE_DRAFT" == 'true' ]]; then args+=(--draft); fi
           if [[ "$RELEASE_PRERELEASE" == 'true' ]]; then args+=(--prerelease); fi
           gh release create "${args[@]}"

.github/workflows/desktop-release.yml

@@ -13,6 +13,11 @@ on:
         description: 'Release title. Defaults to openwork-v<version>.'
         required: false
         type: 'string'
+      electron_bridge:
+        description: 'Publish Electron-compatible update manifests and payloads for macOS, Windows, and Linux.'
+        required: true
+        default: true
+        type: 'boolean'
       dry_run:
         description: 'Build installers without publishing a release.'
         required: true
@@ -50,6 +55,7 @@ jobs:
         name: 'Validate version and source'
         shell: 'bash'
         env:
+          ELECTRON_BRIDGE: '${{ inputs.electron_bridge }}'
           INPUT_VERSION: '${{ inputs.version }}'
           INPUT_RELEASE_NAME: '${{ inputs.release_name }}'
           IS_DRAFT: '${{ inputs.draft }}'
@@ -75,6 +81,14 @@ jobs:
             echo "::error::Published stable releases require an X.Y.Z version: $INPUT_VERSION"
             exit 1
           fi
+          if [[ "$ELECTRON_BRIDGE" == "true" ]]; then
+            core="${version%%[-+]*}"
+            IFS='.' read -r major minor _ <<< "$core"
+            if [[ "$major" -eq 0 && "$minor" -lt 2 ]]; then
+              echo "::error::The Electron bridge starts at OpenWork 0.2.0: $INPUT_VERSION"
+              exit 1
+            fi
+          fi
           if [[ "$INPUT_RELEASE_NAME" == *$'\n'* || "$INPUT_RELEASE_NAME" == *$'\r'* || ${#INPUT_RELEASE_NAME} -gt 200 ]]; then
             echo "::error::Release names must be a single line up to 200 characters."
             exit 1
@@ -97,6 +111,7 @@ jobs:
       version: '${{ needs.metadata.outputs.version }}'
       release_name: '${{ needs.metadata.outputs.release_name }}'
       tag: '${{ needs.metadata.outputs.tag }}'
+      electron_bridge: '${{ inputs.electron_bridge }}'
       publish: false
       draft: '${{ inputs.draft }}'
       prerelease: '${{ inputs.prerelease }}'
@@ -112,6 +127,7 @@ jobs:
       version: '${{ needs.metadata.outputs.version }}'
       release_name: '${{ needs.metadata.outputs.release_name }}'
       tag: '${{ needs.metadata.outputs.tag }}'
+      electron_bridge: '${{ inputs.electron_bridge }}'
       publish: true
       draft: '${{ inputs.draft }}'
       prerelease: '${{ inputs.prerelease }}'

docs/design/desktop-electron-to-tauri-update-bridge.md

@@ -2,65 +2,21 @@
 
 ## Context
 
-The last published desktop release, `desktop-v0.0.5`, is an Electron app named `Qwen Code Desktop` with bundle identifier `com.alibaba.qwen-code`. Its macOS updater reads `latest-mac.yml` from the fixed `desktop-latest` release and installs a ZIP archive.
-
-The new desktop shell is a Tauri app. It currently uses a different product name and bundle identifier and publishes `desktop-latest.json`, so the existing Electron app cannot discover or replace it.
-
-## Goals
-
-- Let signed macOS Electron `0.0.5` installations update directly to the first stable Tauri release.
-- Preserve the existing macOS application identity so the updater replaces the installed app bundle.
-- Keep Tauri's signed updater feed for all releases after the migration.
-- Make the bridge opt-in and one-time; later releases must not need Electron build tooling.
-
-## Non-goals
-
-- Migrating Electron settings, sessions, or workspace state. The Tauri app may ask for a workspace on first launch.
-- Bridging Windows or Linux Electron installations.
-- Generating Electron differential blockmaps. Electron updater falls back to the checksum-verified full ZIP.
+OpenWork Electron releases use GitHub's latest stable release and read `latest-mac.yml`, `latest.yml`, or `latest-linux.yml`. Tauri reads `latest.json` from the fixed `desktop-latest` release. A stable Tauri release must therefore publish both update formats, and the versioned release must remain GitHub Latest for legacy clients.
 
 ## Compatibility contract
 
-The Tauri bundle uses the legacy macOS identity:
-
-- product name: `Qwen Code Desktop`
-- bundle identifier: `com.alibaba.qwen-code`
-- artifact prefix: `Qwen-Code-Desktop`
-- signing identity: the existing Developer ID Application certificate
-
-The bridge release must be newer than `0.0.5`. It publishes two updater views over the same signed app bundles:
-
-1. `latest-mac.yml` points legacy Electron clients at `Qwen-Code-Desktop-arm64.zip` or `Qwen-Code-Desktop-x64.zip`.
-2. `desktop-latest.json` points Tauri clients at the signed Tauri updater archives.
-
-The ZIP is created from the already signed and notarized `.app`; it is not rebuilt by Electron tooling.
-
-## Release flow
-
-`Desktop Release` gains an `electron_bridge` input, disabled by default.
-
-- All macOS builds continue to produce the Tauri app, DMG, updater archive, and updater signature.
-- When `electron_bridge` is enabled, each macOS build also creates a legacy-compatible ZIP.
-- The publish job generates `latest-mac.yml` from the two ZIPs and two DMGs.
-- A stable bridge release uploads the legacy metadata and payloads to `desktop-latest` together with `desktop-latest.json`.
-- Later stable releases leave `electron_bridge` disabled. Updating `desktop-latest.json` does not remove the bridge files, so Electron installations that return later can still cross to Tauri.
-
-Draft and prerelease runs may build and publish bridge artifacts for inspection, but they never update the stable feed.
-
-## Signing credentials
-
-The repository already stores the Electron-era Apple certificate and App Store Connect API key under `MAC_CSC_*` and `APPLE_NOTARY_*` secret names. The workflow accepts those names as fallbacks for the newer Tauri names, so the Developer ID identity remains unchanged.
+OpenWork 0.2.0 keeps the Electron product name `OpenWork` and application identifier `com.alibaba.openwork`. With `electron_bridge` enabled, a release contains:
 
-Tauri updater artifacts additionally require `TAURI_SIGNING_PRIVATE_KEY`; `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` is only needed for an encrypted private key. The private key must match the public key in the Tauri configuration before the first published Tauri release.
+- `latest-mac.yml` plus versioned ZIP and DMG payloads for Apple Silicon and Intel;
+- `latest.yml` plus the x64 NSIS installer for Windows;
+- `latest-linux.yml` plus the x64 AppImage for Linux;
+- `latest.json` and signed updater archives for Tauri clients.
 
-## Validation
+The macOS ZIPs are created from the signed and notarized Tauri app. Windows removes the matching per-user Electron installation through its registered uninstaller before Tauri writes files, preserving user data and avoiding duplicate uninstall entries. Linux AppImage updates replace the current AppImage directly.
 
-Automated release-helper tests verify:
+## Release usage
 
-- the legacy application identity,
-- exact bridge artifact selection,
-- SHA-512 and size values in `latest-mac.yml`,
-- failure when a required bridge artifact is missing,
-- existing Tauri updater manifest and version synchronization behavior.
+`Desktop Release` defaults `electron_bridge` to true. For a stable release, use `dry_run=false`, `draft=false`, and `prerelease=false`. A stable bridge release is marked GitHub Latest and updates the fixed Tauri feed. Keep the bridge enabled on later stable releases while Electron installations remain supported. Once support is intentionally retired, disable it; later Tauri-only releases use `--latest=false`, so the previous bridge release remains GitHub Latest for dormant Electron clients.
 
-Before the stable release, install the signed `desktop-v0.0.5` arm64 and x64 builds, point them at an isolated bridge feed, and verify both `0.0.5 -> Tauri bridge` and `Tauri bridge -> newer Tauri` updates.
+Before publishing, verify signed 0.1.4 clients on each platform can install the bridge and that the resulting Tauri app can then update to a newer Tauri release. Retire the bridge only after the legacy support window is explicitly closed.

packages/desktop-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwork/desktop-shell",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": true,
   "type": "module",
   "scripts": {