Repo Examples
Jan Case Study
_repos/janhq-jan is the only concrete local Tauri 2 app example used in this pack.
Observed shape:
| Area | Evidence |
|---|---|
| Frontend | build.frontendDist points to ../web-app/dist; dev URL uses localhost |
| Base config | src-tauri/tauri.conf.json uses Tauri config schema v2 |
| Capabilities | Base config attaches multiple capabilities including default and window-specific capabilities |
| CSP | Allows custom protocol, asset protocol, IPC, loopback, HTTPS, and selected external sources |
| Asset protocol | Enabled with broad **/* allow scope |
| Updater | Configures public key, endpoints, and Windows passive install mode |
| Desktop sidecars | Windows and macOS configs include externalBin entries for bun and uv |
| Windows packaging | Targets NSIS and MSI and uses WebView2 download bootstrapper |
| macOS packaging | Targets app and dmg, includes entitlements, and bundles MLX resources |
| Mobile config | Android/iOS use mobile capability and empty externalBin arrays |
| Rust backend | Registers plugins, commands, managed state, desktop-only updater commands, and shutdown cleanup |
What To Reuse
- Platform override config pattern.
- Separate desktop and mobile command/plugin registration.
- Treat updater plugin config and updater artifact creation as separate decisions.
- Test sidecar and cleanup behavior as release concerns.
- Use real app configs to build review checklists.
What Not To Copy Blindly
- Broad asset protocol allow scope.
- Broad HTTP URL allowances.
- Broad shell spawn/open permissions.
- Production CSP relaxations such as loopback and
unsafe-evalwithout explanation. - Custom AI/plugin authority without matching threat model.
Why This Matters
Real apps accumulate authority. A stack pack should help agents notice that authority and ask whether it is justified, not normalize it as starter boilerplate.