feat(desktop): isolate oxc in a rust service

Implement docs/specs/2026-09-07-rust-oxc-service.md with a pinned Rust OXC executable and bounded JSONL transport. Keep AgentReact admission, ABI extraction and semantic indexing in the existing kernel, inject the compiler through production build and preview routes, and partition caches by compiler factory. Desktop compilation no longer loads OXC NAPI bindings.

Add timeout, cancellation and crash recovery, package the native executable outside ASAR, and require Rust for future extracted capability services. Validated 5 Rust tests, 7 native integration tests, AgentReact and server regressions, documentation links, and the packaged macOS arm64 app. Windows/Linux execution and Apple NSXPC remain unverified or out of scope.

Co-authored-by: Codex (GPT 5.6 Sol) <codex@openai.com>

Author: phodal

.github/workflows/harness-desktop.yml

@@ -25,11 +25,14 @@ jobs:
         with:
           node-version: '24'
           cache: npm
+      - uses: dtolnay/rust-toolchain@1.96.0
       - run: npm ci
       - run: npm run harness-desktop:test
       - run: npm run harness-desktop:pack
         env:
           CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+      - run: npm run test:rust -w @qoder-ai/harness-desktop
+      - run: npm run test:native -w @qoder-ai/harness-desktop
       - if: runner.os != 'Linux'
         run: npm run smoke -w @qoder-ai/harness-desktop -- --packaged
       - if: runner.os == 'Linux'

docs/ARCHITECTURE.md

@@ -13,6 +13,9 @@ the target journey, contract, evidence, governance, and DX-measurement system.
   dispatches to capability-owned commands with argv arrays and must not own
   product logic, schemas, fixtures, or host adapters.
 - Compose through public surfaces; do not import another capability's private helpers, fixtures, or provider modules.
+- Extracted desktop capability services (including OXC and future ACP services)
+  are Rust executables. The existing Studio Node runtime remains a host; keep
+  capability contracts explicit and transports cross-platform.
 - Keep product judgment in canonical owners such as `skills/`, `scripts/`, `hooks/`, `models/`, `schemas/` (a target owner, not yet created), `templates/`, and `references/`; host shells stay thin.
 - Use business-named boundaries, not generic umbrellas such as `scripts/core/`.
 - Runtime behavior needs a contract plus validation evidence: fixtures, tests, smoke commands, or parser-safe output. CLI facades need help, unknown-command, and delegated-output coverage.

docs/specs/2026-09-07-rust-oxc-service.md

@@ -0,0 +1,75 @@
+# Rust OXC Service
+
+## Traceability
+- Spec ID: rust-oxc-service
+- Status: Implemented
+- Request: split OXC into an XPC service; all extracted capability services must be written in Rust.
+- AI involvement: Codex implementation and local validation.
+
+## Intent
+Move desktop OXC native parsing and transformation into a supervised Rust
+executable. Preserve AgentReact profile checks, ABI extraction, semantic index,
+diagnostics and browser CLI compatibility.
+
+## Acceptance Scenarios
+- AC-1: Desktop uses the Rust service for every OXC parse/transform, with no OXC NAPI library loaded in the Studio process. A typed compiler factory passes through production artifact routes; the browser CLI retains its worker adapter.
+- AC-2: A versioned, strict, bounded JSONL stdio protocol carries request ids and parse/transform results. Invalid requests, unknown fields, oversized sources/frames and unsupported protocol versions fail closed. Native code receives source text, not filesystem authority.
+- AC-3: Deadline, crash, malformed output and close settle pending calls. Timeout/cancellation kills the affected process; a later compile starts a fresh process. Queues and buffers are bounded; no automatic replay of the failed request.
+- AC-4: Valid TSX (including non-ASCII text), refused profile examples, ABI/semantic index and source maps match the existing kernel. Profile refusal happens before requesting transformation. Compiler identity and outer artifact caches distinguish transports.
+- AC-5: Cargo locks OXC to 0.147.0; target-native Rust binaries ship outside ASAR. Native tests and the packaged macOS app prove real service calls and process separation. Windows/Linux build and smoke are wired into CI; unrun platforms remain unverified.
+
+## Design and Capability Matrix
+| Capability | Decision |
+| --- | --- |
+| Parse and transform | Rust service using pinned OXC crates |
+| Profile, ABI, semantic index | Existing JS semantic kernel, using a private backend port |
+| AST transfer | Bounded ESTree JSON inside the kernel/backend boundary only; never exposed to business callers or renderer. UTF-8 spans converted to UTF-16 for parity. |
+| Cancellation | Kill dedicated compiler process; synchronous native work cannot consume cancel messages while executing |
+| XPC transport | Cross-platform child process + framed JSONL stdio; native macOS NSXPC is not claimed |
+| Other future capability services | Rust executables; Studio remains the existing Node host runtime |
+
+## Non-goals
+No ACP extraction, semantic-rule rewrite, generic RPC registry, UI changes,
+macOS-only NSXPC bridge, signing, publication or auto-update changes.
+
+## Plan and Tasks
+1. Separate the native backend from semantic compilation without changing the
+   existing default adapter. Keep constants available without importing NAPI.
+2. Add Rust parse/transform service and a supervised Node transport adapter.
+3. Inject compiler factory from desktop through Studio production routes;
+   partition caches by factory and retain current OxcCompilerPort output.
+4. Package the Rust binary as an external resource; add Cargo/native/protocol
+   parity checks and extend desktop smoke with actual Rust proof.
+
+## Test and Review Evidence
+Local macOS arm64 evidence on 2026-09-07:
+
+| Acceptance | Receipt |
+| --- | --- |
+| AC-1 | Packaged-app smoke records separate main, Studio and Rust PIDs; Studio process.report sharedObjects contains no OXC NAPI. Native HTTP test proves both build and preview routes call the injected compiler. |
+| AC-2 | Five Rust tests cover UTF-16 spans, TSX transform/source map, unknown methods/fields/versions, source limits, oversized/truncated frames and parse errors. Cargo.lock pins native dependencies. |
+| AC-3 | Native adapter tests exercise a hung child, exit code zero, malformed JSON, oversized stdout, cancellation, use after close and recovery with a real Rust process. Desktop tracks active compilers and closes them before stopping Studio. |
+| AC-4 | Seven native integration tests include parity with NAPI over valid and refused inputs, Unicode, generated code and parsed source maps; profile refusal makes zero transform calls. Artifact cache regression proves different factories cannot share cached builds. |
+| AC-5 | Full desktop build/stage/pack and packaged macOS arm64 smoke pass. Binary ships outside ASAR. Cargo tests, native integration tests and packaged smoke are wired into the three-platform CI matrix. |
+| Regression | AgentReact/artifact/auth selection: 182 passing tests before adding the cache case. Final artifact/project/server selection: 70 passing tests including that new case. These overlap and are not additive. Six desktop lifecycle tests and eight docs-link tests also pass. |
+
+Commands: `npm run test:rust -w @qoder-ai/harness-desktop`,
+`npm run test:native -w @qoder-ai/harness-desktop`,
+`npm exec -w @qoder-ai/harness-studio -- vitest run test/agent-react test/artifact-compile-runtime.test.ts test/desktop-authorization.test.ts`,
+`npm exec -w @qoder-ai/harness-studio -- vitest run test/artifact-compile-runtime.test.ts test/project-server.test.ts test/server.test.ts`,
+`CSC_IDENTITY_AUTO_DISCOVERY=false npm run harness-desktop:pack`,
+`npm run smoke -w @qoder-ai/harness-desktop -- --packaged`.
+
+Generated native and screenshot/JSON receipts live under the desktop package's
+ignored `dist/`. Windows/Linux jobs have not run here; no signed release or
+native Apple NSXPC acceptance is claimed. Existing Studio npm dependencies retain
+NAPI for browser/CLI compatibility, but the desktop does not load or fall back
+to those modules. AST serialization adds bounded transport overhead; no speedup
+is claimed. Source-map object content matches; JSON property ordering is not a
+semantic equality requirement.
+
+Review Readiness Check: user request and spec confirmed; no Story supplied.
+The Electron baseline is committed as 3920fd1. This Rust slice is reviewed separately from the baseline: native service/lockfile, semantic-backend seam, supervised
+adapter, factory routing/cache isolation, desktop packaging/smoke, architecture
+rule and tests. No ACP implementation or UI change is included. No generated
+runtime artifacts are staged; no publication is performed.

package-lock.json

@@ -1,23 +1,26 @@
 # Harness Studio Desktop
 
-Electron distribution of Harness Studio. Build from the repository root:
+Electron distribution of Harness Studio. Install Rust 1.96.0 with rustup for
+the native OXC service, then build from the repository root:
 
 ```sh
+rustup toolchain install 1.96.0 --profile minimal
 npm ci
 npm run harness-desktop:build
 npm run harness-desktop:dev
 ```
 
 `npm run harness-desktop:pack` builds an unpacked application under
 `packages/harness-desktop/dist/installers`. Run it on the target OS/architecture
-so npm selects the matching oxc native packages. `npm run dist -w
+so Cargo produces the matching Rust executable. `npm run dist -w
 @qoder-ai/harness-desktop` creates the configured ZIP (macOS), NSIS (Windows),
 or AppImage (Linux). These are development packaging targets; signing,
 notarization and automatic updates are not configured.
 
 The main process owns the native window, menus, single instance and directory
 chooser. A utility process owns a Node worker hosting the Studio HTTP server, providers,
-ACP and compiler workers. Renderer fetch and SSE stay unchanged. A per-launch
+ACP and the semantic kernel. OXC parsing and transformation run in a dedicated Rust
+process supervised by the Studio host. Renderer fetch and SSE stay unchanged. A per-launch
 HTTP credential is attached by an isolated Electron session; the renderer has
 no Node integration or preload API. External links need native confirmation.
 
@@ -26,20 +29,33 @@ request/result. Startup and shutdown are bounded, directory requests are
 correlated, and service failure terminates the desktop app. The browser CLI
 continues to use its existing directory chooser and server behavior.
 
-“XPC” describes the intended cross-process service boundary here. The current
-transport is Electron utilityProcess on all three platforms, not native macOS
-NSXPC. Extracting ACP and oxc into dedicated services is a later step; keep
-request/result/cancellation contracts with those capability owners.
+All extracted capability services, including OXC and future ACP services, are
+written in Rust. OXC uses a versioned, bounded JSONL stdio protocol. The current
+cross-platform process boundary does not claim native macOS NSXPC support.
+
+A compiler belongs to one artifact build. Parse/transform requests carry source
+text and portable module names; Rust never opens those names as files. Profile,
+ABI and semantic-index rules stay in the JS kernel; AST transfer is private to
+its native backend. Deadlines, malformed replies, crashes and cancellation kill
+the affected Rust process. A later request can start a fresh process. There is
+no desktop fallback to NAPI. Compiler-factory identity partitions artifact caches.
+
+The Rust binary is packaged as `Resources/native/harness-oxc-service` (with
+`.exe` on Windows), outside ASAR. The browser CLI still uses its existing NAPI
+worker, so the shared Studio package retains those dependencies.
 
 Validation:
 
 ```sh
 npm run harness-desktop:test
+npm run test:rust -w @qoder-ai/harness-desktop
+npm run test:native -w @qoder-ai/harness-desktop
 npm run smoke -w @qoder-ai/harness-desktop
 ```
 
 The smoke command launches a real Electron window with Playwright, verifies
-renderer isolation, local HTTP protection and native parsing, saves a screenshot,
+renderer isolation, local HTTP protection, Rust parsing/transformation and absence of OXC NAPI
+in the Studio process, saves a screenshot,
 and checks service shutdown. It requires a graphical session (Xvfb on Linux).
 Staging resolves production dependencies through npm; a signed, reproducible
 release pipeline and native Windows/Linux receipts remain separate work.

packages/harness-desktop/README.md

@@ -10,17 +10,19 @@
     "node": ">=22.20.0 <25.0.0"
   },
   "scripts": {
-    "build": "npm run build -w @qoder-ai/harness && npm run build -w @qoder-ai/harness-studio",
+    "build": "npm run build -w @qoder-ai/harness && npm run build -w @qoder-ai/harness-studio && npm run build:rust",
     "start": "electron .",
     "test": "node --test test/*.test.mjs",
     "smoke": "node scripts/smoke.mjs",
     "stage": "node scripts/stage.mjs",
     "pack": "npm run build && npm run stage && electron-builder --dir",
-    "dist": "npm run build && npm run stage && electron-builder"
+    "dist": "npm run build && npm run stage && electron-builder",
+    "build:rust": "node scripts/rust.mjs",
+    "test:rust": "node scripts/rust.mjs --test",
+    "test:native": "npm exec -w @qoder-ai/harness-studio -- vitest run --config vitest.native.config.ts"
   },
   "dependencies": {
-    "@qoder-ai/harness-studio": "0.1.1",
-    "oxc-parser": "0.147.0"
+    "@qoder-ai/harness-studio": "0.1.1"
   },
   "devDependencies": {
     "electron": "44.2.0",
@@ -61,6 +63,15 @@
       ],
       "category": "Development",
       "executableName": "harness-studio"
-    }
+    },
+    "extraResources": [
+      {
+        "from": "dist/native",
+        "to": "native",
+        "filter": [
+          "harness-oxc-service*"
+        ]
+      }
+    ]
   }
 }