Merge development into the gospel handoff branch

README.md

@@ -523,6 +523,11 @@ bun run phone          # builds the app and installs it on a phone or emulator
 
 ![Desktop app (Tauri) — proven, not yet in production](documentation/readme-images/deploy5-desktop.png)
 
+**Rudder, the voice-to-text plugin, runs as its own desktop app too**, built with
+`bun run desktop:build rudder-voice` ([HOWTO-build-the-desktop-app](./documentation/HOWTO-build-the-desktop-app.md)).
+
+![Rudder as a desktop app on Linux: offline voice-to-text](documentation/readme-images/deploy5-desktop-rudder.png)
+
 <details>
 <summary><b>More about the desktop app</b></summary>
 

deployment/cloud/README.md

@@ -113,6 +113,7 @@ there. Only then does it swap the new build in.
 | `PRODUCTION_BRANCH` | the branch `/cdn/` is built from (default `main`); the dev server keeps following `BRANCH`. It moves only on a publish |
 | `EMBED_BASE_URL` | the address the published `dx-maps/` folder sits under, so the manifests' copy-paste snippets are absolute: `https://<host>/cdn` (it is served at `/cdn/dx-maps/`), or a research subdomain's `https://research.<host>` (served at `/dx-maps/`). Unset, the snippets stay relative (`./…`) and other sites can't paste them |
 | `CDN_AUTOBUILD_MINUTES` | rebuild `/cdn/` by itself once `PRODUCTION_BRANCH` has held a new commit this long (default `2`; `0` = only the admin button) |
+| `OIDC_AUTO_SIGNIN` | `1` skips the "Sign in with …" button and goes straight to the provider, so the Studio can sign in inside a frame (a dashboard tile) for anyone already signed in to the provider. Default off |
 | `SUBDOMAIN_APPS` | publish plugins as their own PUBLIC sites: `host=bundle/profile`, comma-separated, e.g. `research-gallery.example.org=doxa-maps-spa/doxa-maps-spa`. Served from the `/cdn` build by a separate server on `SUBDOMAIN_PORT` (default `5176`) that answers only those hosts and only with published files; point each host's proxy route at that port. No sign-in is skipped anywhere else |
 | `PUBLIC_API_BASE` | the public API URL written into the build's `runtime-config.js` (e.g. `https://<host>/api-prod`) |
 | `BUILD_MAX_OLD_SPACE_MB` | Node heap cap for a build (default `1536`) |

deployment/cloud/entry.sh

@@ -118,6 +118,10 @@ if [ -z "${OIDC_ISSUER:-}" ] && [ "${ACCESS:-}" != public ]; then
 fi
 
 if [ "${ACCESS:-}" != public ]; then
+  # OIDC_AUTO_SIGNIN=1: no "Sign in with …" button page; an unsigned visitor goes straight to the provider. It lets
+  # the Studio sign in INSIDE a frame (e.g. a dashboard tile): for a user already signed in to the provider the whole
+  # round trip is redirects, so the provider's own no-framing headers never apply.
+  AUTO=(); [ "${OIDC_AUTO_SIGNIN:-0}" = 1 ] && AUTO=(--skip-provider-button)
   # OIDC gate: oauth2-proxy owns the public port; Vite listens on localhost behind it, so the Plugin
   # Studio, every map and the hot-reload websocket are all behind the same sign-in.
   : "${OIDC_CLIENT_ID:?}" "${OIDC_CLIENT_SECRET:?}" "${OIDC_REDIRECT_URL:?}"
@@ -212,6 +216,7 @@ oauth2-proxy \
   "${ALLOW[@]}" \
   --email-domain='*' \
   --provider-display-name="${OIDC_DISPLAY_NAME:-your identity provider}" \
+  "${AUTO[@]}" \
   --upstream="$ROOT" \
   --upstream=http://127.0.0.1:5175/cdn/ \
   --upstream=http://127.0.0.1:5175/api-prod/ \

plugin-designs/rudder-voice/README.md

@@ -57,5 +57,6 @@ so this plugin is not meant for web embeds.
 
 ## Not yet
 
-- Desktop build (`desktop:build`) with the engine as a Tauri sidecar.
+- The desktop app on macOS and Windows. On Linux it builds and runs: `bun run desktop:build rudder-voice`,
+  see [HOWTO-build-the-desktop-app](../../documentation/HOWTO-build-the-desktop-app.md).
 - A saved word-correction table (PocketBase) for technical terms the model mishears.