fix(runtime)!: remove the legacy app websocket

[zippy]

Summary

Stacked on #17. Review only the top commit. Rebase onto main once that PR merges. Supersedes #19.

The legacy path attached an app interface with AllowedOrigins::Any and injected a reusable, non-expiring token into the page, so any local page could connect with it. #19 restricted the interface to the window's origin, but that origin has to be predicted from the app config, and the prediction fails on Windows and Android when use_https_scheme is on. No consumer uses the path (kando, emergence and the example app all use Tauri IPC), so this removes it instead.

Removed:

• WindowOptions::use_app_websocket and the injectHolochainClientEnv / __HC_LAUNCHER_ENV__ injection. main_window_builder always wires the window over IPC.
• Runtime::ensure_app_websocket, Runtime::setup_app, AppAuth and the private helpers that issued the token and attached the interface. setup_app's tests now cover install_app_if_missing, which does the same thing without the websocket.

Breaking for consumers: drop use_app_websocket from WindowOptions, and call install_app_if_missing where you called setup_app.

dist-js is rebuilt. The build script fails as-is under TypeScript 7 (TS5112 from the dependabot bump; separate fix), so I built it with --ignoreConfig. The bundle also picks up the newer @tauri-apps/api and native class fields. A new test asserts the bundle no longer contains __HC_LAUNCHER_ENV__.

TODO:

• CHANGELOG updated with appropriate info
• npm run ci passes (ran cargo fmt --check, cargo clippy --workspace --all-targets -D warnings and the runtime and plugin test suites locally)

AI Policy discosure: Generated under my direction by LLM

[cocogitto-bot]

✔️ b9353a9 - Conventional commits check succeeded.

[cocogitto-bot]

✔️ b9353a9 - Conventional commits check succeeded.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 0191d536-b665-42a7-8dba-fda5321bf040

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}