The Electron build was accidentally bundling the entire tauri/src-tauri/target
Rust build directory into app.asar (1.2GB!), inflating the installer to 304MB.
Added a files exclusion so Electron and Tauri builds stay independent.
- Add tauri/ subfolder: a Tauri-based desktop shell that loads the same
index.html as the Electron app, producing a ~2MB installer (vs ~71MB for
Electron) by using the OS WebView2 instead of bundled Chromium. Includes
sync-frontend.js to keep tauri/dist/ in sync with the canonical index.html
and vendor/ at build time (no UI duplication/drift).
- Vendor lucide, jsPDF, and jspdf-autotable locally under vendor/ instead of
loading from CDNs, so the app works fully offline in both shells.
- Fix server.js path traversal vulnerability (sanitize/contain request paths).
- Fix exportPDF() using stale/edited piece data that could produce
Infinity/NaN in generated PDFs; add a recalculate guard.
- Fix race conditions: overlapping copy/save-defaults button revert timers,
and FileReader callbacks for logo/CSV import that could apply out of order.
- Minor cleanups: explicit array index parsing, hasResult() helper, consistent
event binding for NMFC search results, cached DOM lookups.
- Document the dual-shell architecture and vendoring conventions in CLAUDE.md.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Devon Bontrager