Skip to content

Add studio ui local web surface + converge desktop/local backend (PoC)#3953

Open
youknowriad wants to merge 6 commits into
trunkfrom
claude/distracted-euclid-7036cd
Open

Add studio ui local web surface + converge desktop/local backend (PoC)#3953
youknowriad wants to merge 6 commits into
trunkfrom
claude/distracted-euclid-7036cd

Conversation

@youknowriad

@youknowriad youknowriad commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

How AI was used in this PR

Built almost entirely with Claude Code, pairing with @youknowriad. AI authored the studio ui server, the @studio/common extractions, the connector wiring, the auth flows, and the design doc.

Reviewers should start by reading the design doc to understand how everything fits together. They should pay particular attention to:

  • The desktop wrappers rewired onto shared modules (cli-site-creator, cli-site-editor, wordpress-rest-api, is-installed, the preview/sync IPC handlers). They are typecheck + unit-test verified and tested quickly.
  • Anything touching auth / token handling.

Proposed Changes

Adds a new studio ui surface: the same agentic UI (apps/ui) the desktop shows, served in a browser against the user's real local sites by a small server (apps/local) that is bundled into the CLI and launched with studio ui.

More importantly, it converges the desktop and local backends. Site, session, agent, preview, sync, REST-proxy, app-detection, blueprint, and media logic now live once in @studio/common; the desktop and the local server are thin transports (IPC vs HTTP/SSE) over that same code and the same forked CLI. This stops the two surfaces from drifting and is the main point of the PR.

User-facing (local web):

  • studio ui opens the agentic UI in the browser. Create / delete / duplicate / update sites, export & import, open folder/editor/terminal, preview, sync (pull/push), blueprint-based creation, and WordPress.com login (redirect-based) all work against local sites.
  • Capability-driven UI: features that need a native runtime degrade gracefully in the browser — editable path field instead of a folder picker, browser downloads instead of Save-As, and the preview's Annotate control is hidden where it can't run.
  • No change to the desktop's user-visible behavior is intended; the desktop now runs the shared code paths.

Also adds a design doc, docs/design-docs/studio-apps-and-surfaces.md, mapping the four surfaces (desktop, CLI, local web, hosted), the shared layers, and the convergence.

Testing Instructions

nvm use 24
npm run build:local --workspace=apps/ui   # build the browser UI
npm run cli:build                          # build the CLI (bundles apps/local)
node apps/cli/dist/cli/main.mjs ui         # open studio ui in your browser

youknowriad and others added 2 commits June 25, 2026 12:33
…ed @studio/common backend

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ared UI)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@youknowriad youknowriad marked this pull request as ready for review June 25, 2026 11:49
Comment thread apps/local/src/index.ts Fixed
Comment thread apps/local/src/index.ts Fixed
Comment thread apps/local/src/index.ts Fixed
Comment thread tools/common/lib/wordpress-rest.ts Dismissed
Comment thread tools/common/sites/blueprint-extract.ts Dismissed
…dia/read, contain temp deletes

Addresses the CodeQL alerts on PR #3953 (path injection, SSRF). The local server is loopback-only but reachable cross-origin from the browser, so: CORS is now allowlisted (disallowed origins rejected), the shared REST proxy validates that a request path stays within the site's REST root, the arbitrary-file /media/read endpoint is removed (unused), and temp-dir cleanup + blueprint extraction are path-contained.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Comment thread apps/local/src/index.ts Dismissed
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@wpmobilebot

wpmobilebot commented Jun 25, 2026

Copy link
Copy Markdown
Collaborator

📊 Performance Test Results

Comparing ce8fe3a vs trunk

app-size

Metric trunk ce8fe3a Diff Change
App Size (Mac) 1311.91 MB 1312.16 MB +0.25 MB ⚪ 0.0%

site-editor

Metric trunk ce8fe3a Diff Change
load 1089 ms 1077 ms 12 ms ⚪ 0.0%

site-startup

Metric trunk ce8fe3a Diff Change
siteCreation 6505 ms 6483 ms 22 ms ⚪ 0.0%
siteStartup 6475 ms 6977 ms +502 ms 🔴 7.8%

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)

Both surfaces now record the agent's weekly/monthly unique-user stats against the same app.json store via a shared appBumpStatsProvider in @studio/common, so a user is counted once per period regardless of surface (previously studio ui wrote to the CLI's unrelated cli.json, which double-counted users on both). Only the surface differs, selecting the studio-code-ui-* vs studio-code-cliui-* groups; the provider is no longer injected per host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Removes the "shared between the desktop app and the local server / now lives in @studio/common / re-export keeps imports working" commentary across the extracted modules and their desktop bindings; shared-module headers keep a one-line description and any genuine behavior notes (storage/lockfile, surface→stat-group mapping, the @sentry/core rationale).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants