Desktop client (warp-desktop) with Wails v3

apps/desktop is the web client in a native window. It embeds the same
build warp-web does and serves it through the same Go package, so every
screen is shared. Unlike warp-web it proxies nothing: the client calls the
homeserver directly, and the CSP allows the homeserver plus any https:
and wss: origin for the call backend.

- First run asks for the homeserver: a server name or address, with
  .well-known discovery and a /versions check; File > Change homeserver
  asks again. Signed-in sessions keep their own base URL, so a change
  never sends one server's token to another.
- Links to other sites open in the system browser (/_desktop/links.js,
  added to index.html); only http, https and mailto are opened.
- One instance at a time, since sessions and keys live in the webview's
  storage.
- Dev builds open the DevTools Protocol on Windows when
  WARP_DESKTOP_REMOTE_DEBUGGING_PORT is set, for scripted testing.
- Packaging: icon, version info and manifest in the Windows exe, a macOS
  .app with camera and microphone descriptions, Linux packages via nfpm.
  Make targets: desktop, desktop-run, desktop-test, desktop-resources,
  desktop-macos, desktop-linux.

Web client: host and client move out of internal/ so the desktop app can
import them, and host gains AnyCallOrigin. The Dockerfile, .dockerignore
and the vite output path follow the move.

Pinned to Wails v3.0.0-beta.27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/web/Dockerfile

@@ -26,8 +26,9 @@ FROM golang:1.26-alpine AS build
 WORKDIR /src/apps/web
 COPY apps/web/go.mod ./
 COPY apps/web/cmd ./cmd
-COPY apps/web/internal ./internal
-COPY --from=web /src/apps/web/internal/client/build/dist ./internal/client/build/dist
+COPY apps/web/host ./host
+COPY apps/web/client/client.go ./client/
+COPY --from=web /src/apps/web/client/build/dist ./client/build/dist
 
 ARG VERSION=0.0.0-dev
 ENV CGO_ENABLED=0 GOWORK=off

apps/web/README.md

@@ -171,7 +171,7 @@ proxies the same paths warp-web does, so the app code is the same in both.
 
 | Command | What |
 |---|---|
-| `make web-web` | build the frontend into `internal/client/build/dist` |
+| `make web-web` | build the frontend into `client/build/dist` |
 | `make web` | build the frontend, then `bin/warp-web` with it embedded |
 | `make web-test` | typecheck the frontend, vet and test the Go host |
 | `make web-docker` | build the container image |
@@ -188,8 +188,8 @@ page saying the client is missing.
 | `src/views/` | sign-in, sign-up, home, room |
 | `src/components/` | timeline, message body, room info, dialogs |
 | `cmd/warp-web/` | the binary |
-| `internal/host/` | static serving, `/config.json` and the allow-listed proxy |
-| `internal/client/` | the embedded build |
+| `host/` | static serving, `/config.json` and the allow-listed proxy (shared with [the desktop app](../desktop/README.md)) |
+| `client/` | the embedded build (shared with the desktop app) |
 
 The SDK's objects change in place and emit events. The stores turn those
 events into a version counter (bumped at most once a frame), and the views

apps/web/client/build/README.md

@@ -0,0 +1,4 @@
+`pnpm build` in `apps/web` writes the client to `dist/` here, and package
+`client` embeds it into the `warp-web` and `warp-desktop` binaries. This file
+keeps the directory in git so the Go code compiles before the frontend is
+built; such a binary serves a page saying the client has not been built.

apps/web/cmd/warp-web/main.go

@@ -19,8 +19,8 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/dariuszjaniak/warp/apps/web/internal/client"
-	"github.com/dariuszjaniak/warp/apps/web/internal/host"
+	"github.com/dariuszjaniak/warp/apps/web/client"
+	"github.com/dariuszjaniak/warp/apps/web/host"
 )
 
 // Set with -ldflags "-X main.version=...".

apps/web/host/host.go

@@ -46,6 +46,10 @@ type Options struct {
 	// SFU's WebSocket, e.g. https://livekit-jwt.example and
 	// wss://livekit.example. They are added to the CSP's connect-src.
 	CallOrigins []string
+	// AnyCallOrigin lets the page connect to any https: or wss: origin.
+	// The desktop app sets it: it can be pointed at any homeserver, so it
+	// learns the call backend at run time and can't list it in advance.
+	AnyCallOrigin bool
 }
 
 // proxiedPrefixes are the parts of the homeserver a Matrix client uses: the
@@ -103,6 +107,9 @@ func New(opts Options) (http.Handler, error) {
 			connect += " https://" + u.Host
 		}
 	}
+	if opts.AnyCallOrigin {
+		connect += " https: wss:"
+	}
 	body, err := json.Marshal(cfg)
 	if err != nil {
 		return nil, err

apps/web/host/host_test.go

@@ -336,3 +336,16 @@ func TestCallOriginsJoinConnectSrc(t *testing.T) {
 		t.Error("a call origin with a path was accepted")
 	}
 }
+
+func TestAnyCallOrigin(t *testing.T) {
+	public, _ := url.Parse("http://localhost:8008")
+	h, err := New(Options{PublicHomeserver: public, Client: clientFS, AnyCallOrigin: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	rec := do(h, http.MethodGet, "/", nil)
+	want := "connect-src 'self' http://localhost:8008 https: wss:;"
+	if csp := rec.Header().Get("Content-Security-Policy"); !strings.Contains(csp, want) {
+		t.Errorf("CSP %q", csp)
+	}
+}

apps/web/internal/client/build/README.md

@@ -1,4 +0,0 @@
-`pnpm build` in `apps/web` writes the client to `dist/` here, and
-`internal/client` embeds it into the `warp-web` binary. This file keeps the
-directory in git so the Go code compiles before the frontend is built; such a
-binary serves a page saying the client has not been built.

apps/web/vite.config.ts

@@ -14,8 +14,8 @@ export default defineConfig({
     alias: { '@': fileURLToPath(new URL('./src', import.meta.url)) },
   },
   build: {
-    // Embedded into the warp-web binary by internal/client.
-    outDir: 'internal/client/build/dist',
+    // Embedded into the warp-web binary by client/ (and the desktop app).
+    outDir: 'client/build/dist',
     emptyOutDir: true,
     assetsInlineLimit: 0,
     // matrix-js-sdk is most of the bundle; it is one chunk on purpose.