fix: Tauri .exe production build — all features working

The released .exe was completely broken because features only existed
in Vite middleware but had no Tauri Rust equivalents.

Rust backend:
- Add fetch_external command: HTTP proxy for CivitAI API, workflow JSON
- Add fetch_external_bytes command: binary proxy for ZIP/image downloads
- Register both in main.rs invoke_handler

Frontend routing:
- Add fetchExternal() and fetchExternalBytes() in backend.ts that route
  to Tauri invoke() in production or Vite proxy in dev mode
- Fix workflows.ts: CivitAI search uses fetchExternal() instead of
  /civitai-api/ relative URL
- Fix discover.ts: CivitAI model search uses fetchExternal()
- Fix workflows.ts: fetchWorkflowFromUrl uses fetchExternalBytes()
  instead of /local-api/proxy-download relative URL

Security:
- Update CSP in tauri.conf.json: allow civitai.com, huggingface.co,
  ollama.com for connect-src and img-src

UX:
- Default view changed from Chat to Model Manager — new users need
  models before they can do anything
- Privacy proxy: Tauri mode loads images directly (CSP allows), dev
  mode continues using local proxy

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: PurpleDoubleD

src-tauri/src/commands/proxy.rs

@@ -1,3 +1,47 @@
+/// Generic HTTP proxy — fetch any external URL and return body as string.
+/// Used for CivitAI API calls, workflow JSON downloads, etc.
+#[tauri::command]
+pub async fn fetch_external(url: String) -> Result<String, String> {
+    let client = reqwest::Client::builder()
+        .user_agent("LocallyUncensored/1.5")
+        .timeout(std::time::Duration::from_secs(60))
+        .build()
+        .map_err(|e| e.to_string())?;
+
+    let resp = client.get(&url)
+        .send()
+        .await
+        .map_err(|e| format!("fetch_external: {}", e))?;
+
+    if !resp.status().is_success() {
+        return Err(format!("HTTP {}: {}", resp.status().as_u16(), url));
+    }
+
+    resp.text().await.map_err(|e| e.to_string())
+}
+
+/// Binary HTTP proxy — fetch any external URL and return bytes.
+/// Used for downloading ZIP files, images, model files.
+#[tauri::command]
+pub async fn fetch_external_bytes(url: String) -> Result<Vec<u8>, String> {
+    let client = reqwest::Client::builder()
+        .user_agent("LocallyUncensored/1.5")
+        .timeout(std::time::Duration::from_secs(300))
+        .build()
+        .map_err(|e| e.to_string())?;
+
+    let resp = client.get(&url)
+        .send()
+        .await
+        .map_err(|e| format!("fetch_external_bytes: {}", e))?;
+
+    if !resp.status().is_success() {
+        return Err(format!("HTTP {}: {}", resp.status().as_u16(), url));
+    }
+
+    resp.bytes().await.map(|b| b.to_vec()).map_err(|e| e.to_string())
+}
+
 /// Proxy search requests to ollama.com (needed because frontend can't CORS to ollama.com)
 #[tauri::command]
 pub async fn ollama_search(query: String) -> Result<serde_json::Value, String> {

src-tauri/src/main.rs

@@ -42,6 +42,8 @@ fn main() {
             commands::search::searxng_status,
             // Proxy
             commands::proxy::ollama_search,
+            commands::proxy::fetch_external,
+            commands::proxy::fetch_external_bytes,
         ])
         .setup(|app| {
             let state = app.state::<AppState>();

src-tauri/tauri.conf.json

@@ -21,7 +21,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self'; connect-src 'self' http://localhost:11434 http://127.0.0.1:11434 http://localhost:8188 http://127.0.0.1:8188 ws://localhost:8188 ws://127.0.0.1:8188; img-src 'self' data: blob: http://localhost:8188 http://127.0.0.1:8188; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'"
+      "csp": "default-src 'self'; connect-src 'self' http://localhost:* http://127.0.0.1:* https://civitai.com https://*.civitai.com https://huggingface.co https://*.huggingface.co https://ollama.com ws://localhost:8188 ws://127.0.0.1:8188; img-src 'self' data: blob: http://localhost:8188 http://127.0.0.1:8188 https://*.civitai.com https://*.githubusercontent.com; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'"
     }
   },
   "bundle": {

src/api/backend.ts

@@ -110,3 +110,26 @@ export function comfyuiUrl(path: string): string {
 export function comfyuiWsUrl(): string {
   return "ws://localhost:8188/ws";
 }
+
+/** Fetch an external URL as text — works in both Tauri and dev mode */
+export async function fetchExternal(url: string): Promise<string> {
+  if (isTauri()) {
+    const invoke = await getInvoke();
+    return invoke('fetch_external', { url }) as Promise<string>;
+  }
+  const res = await fetch(`/local-api/proxy-download?url=${encodeURIComponent(url)}`);
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  return res.text();
+}
+
+/** Fetch an external URL as bytes — works in both Tauri and dev mode */
+export async function fetchExternalBytes(url: string): Promise<ArrayBuffer> {
+  if (isTauri()) {
+    const invoke = await getInvoke();
+    const bytes = await invoke('fetch_external_bytes', { url }) as number[];
+    return new Uint8Array(bytes).buffer;
+  }
+  const res = await fetch(`/local-api/proxy-download?url=${encodeURIComponent(url)}`);
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  return res.arrayBuffer();
+}

src/api/discover.ts

@@ -1,4 +1,4 @@
-import { backendCall } from "./backend"
+import { backendCall, fetchExternal } from "./backend"
 
 export interface DiscoverModel {
   name: string
@@ -326,10 +326,8 @@ export async function searchCivitaiModels(
       limit: '20',
       sort: 'Most Downloaded',
     })
-    const resp = await fetch(`/civitai-api/v1/models?${params}`)
-    if (!resp.ok) return []
-
-    const data = await resp.json()
+    const text = await fetchExternal(`https://civitai.com/api/v1/models?${params}`)
+    const data = JSON.parse(text)
     const items: any[] = data.items ?? []
 
     return items.map((item) => {

src/api/workflows.ts

@@ -2,6 +2,7 @@ import JSZip from 'jszip'
 import type { ModelType } from './comfyui'
 import type { GenerateParams, VideoParams } from './comfyui'
 import { findMatchingVAE, findMatchingCLIP } from './comfyui'
+import { fetchExternal, fetchExternalBytes } from './backend'
 import type {
   WorkflowTemplate,
   WorkflowSearchResult,
@@ -397,16 +398,19 @@ export async function fetchWorkflowFromUrl(url: string, apiKey?: string): Promis
     const sep = url.includes('?') ? '&' : '?'
     finalUrl = `${url}${sep}token=${apiKey}`
   }
-  // Route external URLs through the server-side proxy to avoid CORS/redirect issues
-  const fetchUrl = finalUrl.startsWith('/') ? finalUrl : `/local-api/proxy-download?url=${encodeURIComponent(finalUrl)}`
-  const resp = await fetch(fetchUrl)
-  if (!resp.ok) throw new Error(`Failed to fetch workflow: ${resp.status} ${resp.statusText}`)
+  // Route through backend proxy (works in both Tauri and dev mode)
+  let buffer: ArrayBuffer
+  try {
+    buffer = await fetchExternalBytes(finalUrl)
+  } catch (err) {
+    throw new Error(`Failed to fetch workflow: ${err instanceof Error ? err.message : String(err)}`)
+  }
 
-  const contentType = resp.headers.get('content-type') || ''
+  // Detect content type from URL or try parsing
+  const isLikelyZip = url.endsWith('.zip') || finalUrl.includes('/download/')
 
   // Handle ZIP archives (CivitAI downloads workflows as .zip)
-  if (contentType.includes('zip') || contentType.includes('octet-stream') || url.endsWith('.zip')) {
-    const buffer = await resp.arrayBuffer()
+  if (isLikelyZip) {
     try {
       const zip = await JSZip.loadAsync(buffer)
       // Try all files in the ZIP that could contain workflow JSON
@@ -438,10 +442,13 @@ export async function fetchWorkflowFromUrl(url: string, apiKey?: string): Promis
     }
   }
 
-  // Regular JSON
-  const json = await resp.json()
-  const resolved = resolveWorkflowJson(json)
-  if (resolved) return resolved
+  // Try parsing as JSON
+  try {
+    const text = new TextDecoder().decode(buffer)
+    const json = JSON.parse(text)
+    const resolved = resolveWorkflowJson(json)
+    if (resolved) return resolved
+  } catch { /* not JSON */ }
 
   throw new Error('Invalid workflow format. Expected ComfyUI API or web format.')
 }
@@ -596,13 +603,12 @@ export async function searchCivitai(query: string): Promise<WorkflowSearchResult
       limit: '20',
       sort: 'Most Downloaded',
     })
-    const resp = await fetch(`/civitai-api/v1/models?${params}`)
-    if (!resp.ok) {
-      console.warn(`[workflows] CivitAI returned ${resp.status}`)
+    const text = await fetchExternal(`https://civitai.com/api/v1/models?${params}`)
+    const data = JSON.parse(text)
+    if (!data.items) {
+      console.warn('[workflows] CivitAI returned no items')
       return []
     }
-
-    const data = await resp.json()
     const items: CivitAIModel[] = data.items ?? []
 
     return items.map((item) => {

src/lib/privacy.ts

@@ -3,11 +3,15 @@
  * so external servers never see the user's IP or browsing behavior.
  */
 
+import { isTauri } from '../api/backend'
+
 /** Proxy an external image URL through the local server */
 export function proxyImageUrl(url: string | undefined): string | undefined {
   if (!url) return undefined
   // Already local — no proxy needed
   if (url.startsWith('/') || url.startsWith('blob:') || url.startsWith('data:')) return url
-  // Route through local proxy
+  // In Tauri mode: CSP allows these domains directly (images loaded via img tag, no CORS)
+  if (isTauri()) return url
+  // Dev mode: route through local proxy
   return `/local-api/proxy-image?url=${encodeURIComponent(url)}`
 }

src/stores/uiStore.ts

@@ -11,7 +11,7 @@ interface UIState {
 }
 
 export const useUIStore = create<UIState>()((set) => ({
-  currentView: 'chat',
+  currentView: 'models',
   sidebarOpen: true,
 
   setView: (view) => set({ currentView: view }),