feat(desktop): in-app auto-update via CrabNebula Cloud

.github/workflows/cn-release.yml

@@ -0,0 +1,104 @@
+name: 'CrabNebula Desktop Release'
+
+# Desktop auto-update channel → CrabNebula Cloud. Mobile ships via the stores (publish.yaml).
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'v*.*.*'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  CN_APPLICATION: 'obsidianirc/obsidianirc'
+
+jobs:
+  draft:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: create draft release
+        uses: crabnebula-dev/cloud-release@1a8803698ba41de6b23e42abc5dcc3721308233c # v0
+        with:
+          command: release draft ${{ env.CN_APPLICATION }} --framework tauri
+          api-key: ${{ secrets.CN_API_KEY }}
+
+  build:
+    needs: draft
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: 'macos-latest' # Arm-based macs (M1+)
+            args: '--target aarch64-apple-darwin'
+          - platform: 'macos-latest' # Intel macs
+            args: '--target x86_64-apple-darwin'
+          - platform: 'ubuntu-22.04' # 22.04 for glibc 2.35 compatibility
+            args: ''
+          - platform: 'windows-latest'
+            args: ''
+    runs-on: ${{ matrix.platform }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: install dependencies (ubuntu only)
+        if: matrix.platform == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget libssl-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev patchelf pkg-config
+
+      - name: setup node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: lts/*
+          cache: 'npm'
+
+      - name: install Rust stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+
+      - name: Rust cache
+        uses: swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          workspaces: './src-tauri -> target'
+
+      - name: install frontend dependencies
+        run: npm install
+
+      - name: build Tauri app
+        # --config adds createUpdaterArtifacts so only this build signs update artifacts
+        run: npm run tauri build -- ${{ matrix.args }} --config src-tauri/tauri.updater.conf.json
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+
+      - name: upload assets
+        uses: crabnebula-dev/cloud-release@1a8803698ba41de6b23e42abc5dcc3721308233c # v0
+        with:
+          command: release upload ${{ env.CN_APPLICATION }} --framework tauri
+          api-key: ${{ secrets.CN_API_KEY }}
+          path: ./src-tauri
+
+  publish:
+    needs: build
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: publish release
+        uses: crabnebula-dev/cloud-release@1a8803698ba41de6b23e42abc5dcc3721308233c # v0
+        with:
+          command: release publish ${{ env.CN_APPLICATION }} --framework tauri
+          api-key: ${{ secrets.CN_API_KEY }}

AGENTS.md

@@ -33,6 +33,44 @@ npm run format; npm run fix:unsafe; npm run test; npm run build
 - Details: [BUILD.md — Nix (flake)](BUILD.md#nix-flake)
 ---
 
+## Distribution & Desktop Auto-Update
+
+Releases run from [`.github/workflows/publish.yaml`](.github/workflows/publish.yaml): on a
+`v*.*.*` tag it builds desktop (macOS arm64/x64, Windows, Linux x64/arm64), Android (+ Google
+Play), iOS, and a web zip, all pushed to GitHub Releases via `tauri-apps/tauri-action`.
+Pushes to `main` produce `-pre` pre-releases. Linux AppImages get zsync update info embedded
+(`gh-releases-zsync`) so AppImageUpdate can self-update.
+
+Mobile updates ship through the App Store / Google Play — do **not** add an in-app updater for
+iOS/Android.
+
+Desktop auto-update (macOS/Windows/Linux) is done with the **Tauri updater plugin** backed by
+**CrabNebula Cloud** (CDN + update server with first-class Tauri-updater support; free since
+2026-06-19). Wiring lives in:
+
+- `tauri-plugin-updater` + `tauri-plugin-process` in [src-tauri/Cargo.toml](src-tauri/Cargo.toml),
+  registered inside the `#[cfg(desktop)]` block of [src-tauri/src/lib.rs](src-tauri/src/lib.rs)
+  (same place as `single-instance`) so mobile builds never link them.
+- `bundle.createUpdaterArtifacts: true` and `plugins.updater` (`endpoints` → CrabNebula CDN URL,
+  `pubkey`) in [src-tauri/tauri.conf.json](src-tauri/tauri.conf.json). Endpoint template:
+  `https://cdn.crabnebula.app/update/<org>/<app>/{{target}}-{{arch}}/{{current_version}}`.
+- `updater:default` + `process:allow-restart` in
+  [src-tauri/capabilities/desktop.json](src-tauri/capabilities/desktop.json)
+  (desktop-only capability, not the cross-platform `default.json`).
+- Update signing keypair: `npm exec tauri signer generate`. The **public** key goes in
+  `tauri.conf.json`; the **private** key + password are CI secrets
+  (`TAURI_SIGNING_PRIVATE_KEY`, `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`) — never commit them.
+- CrabNebula release CI uses `crabnebula-dev/cloud-release` with `CN_API_KEY` as a **repository**
+  secret (environment secrets leak as plaintext in logs). Pin every third-party action to a full
+  commit SHA, as `publish.yaml` already does.
+
+Restart-to-update flow lives in the frontend: `check()` → `downloadAndInstall()` → `relaunch()`
+(`@tauri-apps/plugin-updater` + `@tauri-apps/plugin-process`). Gate all of it behind `isTauriDesktop()`
+so the web/Docker build is unaffected, and wrap any user-facing update text in the i18n macros
+(see the i18n section).
+
+---
+
 ## Project Layout
 
 ```

package.json

@@ -49,6 +49,8 @@
     "@tauri-apps/plugin-notification": "^2.2.2",
     "@tauri-apps/plugin-opener": "^2.5.4",
     "@tauri-apps/plugin-os": "^2.2.1",
+    "@tauri-apps/plugin-process": "^2.3.1",
+    "@tauri-apps/plugin-updater": "^2.10.1",
     "@types/uuid": "^10.0.0",
     "buffer": "^6.0.3",
     "clsx": "^2.1.1",