add electron app

[seeden]

add electron
build Electron installers on macOS, Windows, and Linux in CI

---

Note

High Risk
Introduces a new security-critical desktop boundary (custom protocol, CSP, network policy, IPC, signing pipeline) and broad front-end behavior changes for Electron; mistakes could block hubs, wallets, or weaken isolation.

Overview
Adds a desktop package that wraps the existing player React + WASM bundle in a hardened Electron shell, with installers for macOS, Windows, and Linux.

The renderer is served from chiagaming://app (not file://), with sandboxing, CSP, hub/WebSocket/WalletConnect egress allowlists, runtime hub trust via a single IPC channel, and electron-builder fuses plus macOS entitlements. The front end branches on __chiaDistribution to hide the simulator, fix WalletConnect metadata for non-http origins, request hub trust before connecting, and treat orphaned tab leases as stale.

CI adds a matrix workflow that builds WASM (including WASI SDK on macOS), optionally signs (Apple / DigiCert on non-PR builds), notarizes macOS DMGs, and uploads artifacts. build.rs runs Chialisp compilation on a thread with a larger stack when CHIALISP_COMPILE is set.

^{Reviewed by Cursor Bugbot for commit 89ca783. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​electron-builder@​26.15.3
	npm/​esbuild@​0.25.11
	npm/​electron@​43.2.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm argparse under Python-2.0.1 License: Python-2.0.1 - The applicable license policy does not permit this license (5) (package/LICENSE) From: pnpm-lock.yaml → npm/electron-builder@26.15.3 → npm/argparse@2.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/argparse@2.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm tiny-async-pool is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/electron-builder@26.15.3 → npm/tiny-async-pool@1.3.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tiny-async-pool@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm truncate-utf8-bytes under WTFPL License: WTFPL - The applicable license policy does not permit this license (5) (npm metadata) License: WTFPL - The applicable license policy does not permit this license (5) (package/package.json) From: pnpm-lock.yaml → npm/electron-builder@26.15.3 → npm/truncate-utf8-bytes@1.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/truncate-utf8-bytes@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

• npm/electron-winstaller@5.4.0

View full report

[seeden]

@SocketSecurity ignore npm/electron-winstaller@5.4.0

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit fea9fbc. Configure here.}