chore: import upstream snapshot with attribution

surfsense_desktop/scripts/build-electron.mjs

@@ -0,0 +1,160 @@
+import { build } from 'esbuild';
+import fs from 'fs';
+import path from 'path';
+import dotenv from 'dotenv';
+
+const desktopEnv = dotenv.config().parsed || {};
+
+const STANDALONE_ROOT = path.join(
+  '..', 'surfsense_web', '.next', 'standalone', 'surfsense_web'
+);
+
+/**
+ * electron-builder cannot follow symlinks when packaging into ASAR.
+ * Recursively walk the standalone output and replace every symlink
+ * with a real copy (or remove it if the target doesn't exist).
+ */
+function resolveAllSymlinks(dir) {
+  if (!fs.existsSync(dir)) return;
+
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isSymbolicLink()) {
+      const target = fs.readlinkSync(full);
+      const resolved = path.resolve(dir, target);
+      if (fs.existsSync(resolved)) {
+        fs.rmSync(full, { recursive: true, force: true });
+        fs.cpSync(resolved, full, { recursive: true });
+        console.log(`Resolved symlink: ${full}`);
+      } else {
+        fs.rmSync(full, { force: true });
+        console.log(`Removed broken symlink: ${full}`);
+      }
+    } else if (entry.isDirectory()) {
+      resolveAllSymlinks(full);
+    }
+  }
+}
+
+/**
+ * pnpm's .pnpm/ virtual store uses symlinks for sibling dependency resolution.
+ * After resolveAllSymlinks converts everything to real copies, packages can no
+ * longer find their dependencies through the pnpm structure.  We flatten the
+ * tree into a standard npm-like layout: every package from .pnpm/*/node_modules/
+ * gets hoisted to the top-level node_modules/.  This lets Node.js standard
+ * module resolution find all dependencies (e.g. next → styled-jsx).
+ */
+function flattenPnpmStore(nodeModulesDir) {
+  const pnpmDir = path.join(nodeModulesDir, '.pnpm');
+  if (!fs.existsSync(pnpmDir)) return;
+
+  console.log('Flattening pnpm store to top-level node_modules...');
+  let hoisted = 0;
+
+  for (const storePkg of fs.readdirSync(pnpmDir, { withFileTypes: true })) {
+    if (!storePkg.isDirectory() || storePkg.name === 'node_modules') continue;
+
+    const innerNM = path.join(pnpmDir, storePkg.name, 'node_modules');
+    if (!fs.existsSync(innerNM)) continue;
+
+    for (const dep of fs.readdirSync(innerNM, { withFileTypes: true })) {
+      const depName = dep.name;
+      // Handle scoped packages (@org/pkg)
+      if (depName.startsWith('@') && dep.isDirectory()) {
+        const scopeDir = path.join(innerNM, depName);
+        for (const scopedPkg of fs.readdirSync(scopeDir, { withFileTypes: true })) {
+          const fullName = `${depName}/${scopedPkg.name}`;
+          const src = path.join(scopeDir, scopedPkg.name);
+          const dest = path.join(nodeModulesDir, depName, scopedPkg.name);
+          if (!fs.existsSync(dest)) {
+            fs.mkdirSync(path.join(nodeModulesDir, depName), { recursive: true });
+            fs.cpSync(src, dest, { recursive: true });
+            hoisted++;
+          }
+        }
+      } else if (dep.isDirectory() || dep.isFile()) {
+        const dest = path.join(nodeModulesDir, depName);
+        if (!fs.existsSync(dest)) {
+          fs.cpSync(path.join(innerNM, depName), dest, { recursive: true });
+          hoisted++;
+        }
+      }
+    }
+  }
+
+  // Remove the .pnpm directory — no longer needed
+  fs.rmSync(pnpmDir, { recursive: true, force: true });
+  console.log(`Hoisted ${hoisted} packages, removed .pnpm/`);
+}
+
+function resolveStandaloneSymlinks() {
+  console.log('Resolving symlinks in standalone output...');
+  resolveAllSymlinks(STANDALONE_ROOT);
+  flattenPnpmStore(path.join(STANDALONE_ROOT, 'node_modules'));
+}
+
+async function buildElectron() {
+  if (fs.existsSync('dist')) {
+    fs.rmSync('dist', { recursive: true });
+    console.log('Cleaned dist/');
+  }
+  fs.mkdirSync('dist', { recursive: true });
+
+  const shared = {
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    external: ['electron', 'node-mac-permissions', 'bindings', 'file-uri-to-path'],
+    sourcemap: true,
+    minify: false,
+    define: {
+      'process.env.HOSTED_BACKEND_URL': JSON.stringify(
+        process.env.HOSTED_BACKEND_URL || desktopEnv.HOSTED_BACKEND_URL || ''
+      ),
+      'process.env.HOSTED_FRONTEND_URL': JSON.stringify(
+        process.env.HOSTED_FRONTEND_URL || desktopEnv.HOSTED_FRONTEND_URL || 'https://surfsense.com'
+      ),
+      'process.env.GOOGLE_DESKTOP_CLIENT_ID': JSON.stringify(
+        process.env.GOOGLE_DESKTOP_CLIENT_ID || desktopEnv.GOOGLE_DESKTOP_CLIENT_ID || ''
+      ),
+      'process.env.POSTHOG_KEY': JSON.stringify(
+        process.env.POSTHOG_KEY || desktopEnv.POSTHOG_KEY || ''
+      ),
+      'process.env.POSTHOG_HOST': JSON.stringify(
+        process.env.POSTHOG_HOST || desktopEnv.POSTHOG_HOST || 'https://assets.surfsense.com'
+      ),
+    },
+  };
+
+  await build({
+    ...shared,
+    entryPoints: ['src/main.ts'],
+    outfile: 'dist/main.js',
+  });
+
+  await build({
+    ...shared,
+    entryPoints: ['src/preload.ts'],
+    outfile: 'dist/preload.js',
+  });
+
+  await build({
+    ...shared,
+    entryPoints: ['src/modules/screen-capture/screen-region-preload.ts'],
+    outfile: 'dist/modules/screen-capture/screen-region-preload.js',
+  });
+
+  await build({
+    ...shared,
+    entryPoints: ['src/modules/screen-capture/window-picker-preload.ts'],
+    outfile: 'dist/modules/screen-capture/window-picker-preload.js',
+  });
+
+  console.log('Electron build complete');
+  resolveStandaloneSymlinks();
+}
+
+buildElectron().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

surfsense_desktop/scripts/electron-dev.mjs

@@ -0,0 +1,24 @@
+/**
+ * Linux dev: (1) ELECTRON_DISABLE_SANDBOX before start — setuid chrome-sandbox in node_modules.
+ * (2) --ozone-platform=x11 — use X11 via XWayland so global shortcuts / GPU warnings match many
+ *     Linux Electron setups better than native Wayland. Set SURFSENSE_ELECTRON_WAYLAND=1 to skip (2).
+ * Packaged apps are not launched through this script.
+ */
+import { spawnSync } from 'child_process';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+const cli = join(root, 'node_modules', 'electron', 'cli.js');
+
+const env = { ...process.env };
+const args = [cli, '.'];
+if (process.platform === 'linux') {
+  env.ELECTRON_DISABLE_SANDBOX = '1';
+  if (env.SURFSENSE_ELECTRON_WAYLAND !== '1') {
+    args.push('--ozone-platform=x11');
+  }
+}
+
+const r = spawnSync(process.execPath, args, { cwd: root, env, stdio: 'inherit' });
+process.exit(r.status === null ? 1 : r.status ?? 0);

surfsense_desktop/scripts/postinstall-rebuild.mjs

@@ -0,0 +1,25 @@
+/**
+ * node-mac-permissions is macOS-only; electron-rebuild would still compile it on Linux/Windows
+ * (missing `make`, wrong platform). We skip rebuild there.
+ */
+import { existsSync } from 'fs';
+import { spawnSync } from 'child_process';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+if (process.platform !== 'darwin') {
+  console.log('[surfsense-desktop] Skipping electron-rebuild on non-macOS (native permissions module is darwin-only).');
+  process.exit(0);
+}
+
+const bin = join(root, 'node_modules', '.bin', 'electron-rebuild');
+
+if (!existsSync(bin)) {
+  console.warn('[surfsense-desktop] electron-rebuild not found in node_modules/.bin, skipping.');
+  process.exit(0);
+}
+
+const result = spawnSync(bin, [], { cwd: root, stdio: 'inherit' });
+process.exit(result.status === null ? 1 : result.status);