ScratchPad — Tauri v2 Desktop App

Local-first, infinite-canvas sticky notes with BYOK AI. This repo is the Tauri v2 conversion of the original single-file app (project-notes.html, kept untouched as reference).

Project layout

index.html              UI markup (from the original file)
src/
  main.js               Entry: bundled fonts + styles + app
  app.js                The application (canvas, boards, AI features, settings)
  platform.js           Tauri bridge w/ browser-dev fallback
  storage.js            Debounced JSON-on-disk persistence
  vault.js              API keys via Windows Credential Manager
  updater.js            Auto-update check (no-op until configured)
  styles/main.css       All styles (from the original file)
src-tauri/
  src/main.rs           Rust: state file, key vault, tray, hotkey
  tauri.conf.json       Window, NSIS installer, updater config
  capabilities/         HTTP scope: OpenAI/Anthropic/Gemini/localhost

Build on the Windows 11 workstation

One-time prerequisites:

1. Rust — winget install Rustlang.Rustup then rustup default stable-msvc
2. Node.js LTS — winget install OpenJS.NodeJS.LTS
3. WebView2 — preinstalled on Windows 11
4. Visual Studio Build Tools with "Desktop development with C++" (required by the MSVC linker): winget install Microsoft.VisualStudio.2022.BuildTools

Then:

npm install
npm run tauri dev      # develop with hot reload
npm run tauri build    # produces the NSIS installer

Installer output: src-tauri/target/release/bundle/nsis/ScratchPad_0.1.0_x64-setup.exe

Note: the Rust side was written but not compiled in this environment (no Windows toolchain here). The first tauri dev run may surface minor API drift in main.rs; the frontend is build-verified.

What changed vs. the single-file app

• Data: notes now live in %APPDATA%\com.scratchpad.app\scratchpad-data.json (atomic, debounced writes) — human-readable, easy to back up. localStorage is only used in browser dev.
• API keys: stored in Windows Credential Manager (one credential: ScratchPad / ai-provider-keys). The WebCrypto/passphrase vault was removed.
• HTTP: all AI calls route through Rust (tauri-plugin-http) — no CORS. LM Studio/Ollama no longer need CORS enabled; allowed hosts are scoped in src-tauri/capabilities/default.json (add entries there if your local server runs on a non-localhost address).
• Fonts: Caveat, Gloria Hallelujah, Inter bundled via Fontsource — fully offline.
• Desktop: system tray (close hides to tray; Quit in tray menu), global hotkey Ctrl+Shift+N for quick capture, single-instance lock.
• The old data in a browser's localStorage can't be reached by the app. To migrate existing notes, open the old project-notes.html where you used it, run localStorage.getItem('stack_notes_v1') in DevTools, and save the JSON to %APPDATA%\com.scratchpad.app\scratchpad-data.json.

Enabling the auto-updater

The updater ships dormant (checks fail silently). To activate:

1. npm run tauri signer generate -- -w %USERPROFILE%\.tauri\scratchpad.key
2. Put the printed public key into plugins.updater.pubkey in tauri.conf.json, and set the real endpoints URL (GitHub Releases latest.json works).
3. Set bundle.createUpdaterArtifacts: true.
4. Build with TAURI_SIGNING_PRIVATE_KEY (and password) in the environment; upload the artifacts + latest.json to your release host.