agency-desktop-app-engineer

Enable contextIsolation, disable nodeIntegration, and turn on the sandbox, then expose only a narrow preload bridge via contextBridge. Validate every IPC payload on the privileged side with a schema like zod, and expose narrow verbs such as project:export instead of generic filesystem access.

Choose Electron for pixel-perfect rendering consistency and heavy native-module needs; choose Tauri for small installers (3-15MB vs 80-150MB) and lower idle memory. Tauri relies on the OS webview, so you must test across WebView2, WKWebView, and WebKitGTK versions.

Sign the app bundle with codesign using --options runtime and your entitlements, then submit the DMG with xcrun notarytool and staple the ticket with xcrun stapler. Hardened runtime is required for notarization, and signing infrastructure should be built before the first feature ships.

Publish signed update manifests to a small cohort first, typically 1% for 24 hours, then gate expansion to 10% and 100% on crash-free rate of at least 99.5%. Rollback means republishing the previous manifest so clients downgrade cleanly.

No. Remote content must live in sandboxed views with no IPC access or a deny-by-default allowlist. Loading remote URLs into a privileged window turns the app into a malware distribution vector if the remote content is compromised.

Tauri depends on the system webview, so rendering and API behavior vary across WebView2, WKWebView, and WebKitGTK versions, requiring a broader test matrix. Its plugin ecosystem is younger than Electron's, so each native capability need must be verified before committing.