Claude API × Tauri 2: Building a Production Desktop AI App With Rust — Streaming, Tool Use, and Signed Distribution

// src-tauri/src/secrets.rs
// Save/load the Claude API key in the OS keychain. Never let it live in a file
// or environment variable; route everything through this module.
 
use keyring::Entry;
use anyhow::{Result, Context};
 
const SERVICE: &str = "net.dolice.claude-desk";
const ACCOUNT: &str = "anthropic_api_key";
 
pub fn save_api_key(key: &str) -> Result<()> {
    let entry = Entry::new(SERVICE, ACCOUNT)
        .context("failed to construct keychain entry")?;
    entry.set_password(key)
        .context("failed to write to keychain")?;
    Ok(())
}
 
pub fn load_api_key() -> Result<Option<String>> {
    let entry = Entry::new(SERVICE, ACCOUNT)
        .context("failed to construct keychain entry")?;
    match entry.get_password() {
        Ok(key) => Ok(Some(key)),
        Err(keyring::Error::NoEntry) => Ok(None),
        Err(e) => Err(anyhow::anyhow!("keychain read failed: {}", e)),
    }
}
 
pub fn delete_api_key() -> Result<()> {
    let entry = Entry::new(SERVICE, ACCOUNT)?;
    match entry.delete_credential() {
        Ok(_) => Ok(()),
        Err(keyring::Error::NoEntry) => Ok(()),
        Err(e) => Err(anyhow::anyhow!("keychain delete failed: {}", e)),
    }
}

// src-tauri/src/lib.rs (excerpt)
mod secrets;
 
#[tauri::command]
async fn save_api_key(key: String) -> Result<(), String> {
    secrets::save_api_key(&key).map_err(|e| e.to_string())
}
 
#[tauri::command]
async fn has_api_key() -> Result<bool, String> {
    Ok(secrets::load_api_key().map_err(|e| e.to_string())?.is_some())
}
 
#[tauri::command]
async fn delete_api_key() -> Result<(), String> {
    secrets::delete_api_key().map_err(|e| e.to_string())
}

// src/SettingsView.tsx (excerpt)
import { invoke } from "@tauri-apps/api/core";
import { useState } from "react";
 
export function SettingsView() {
  const [apiKey, setApiKey] = useState("");
  const [saving, setSaving] = useState(false);
  const [error, setError] = useState<string | null>(null);
 
  const handleSave = async () => {
    setSaving(true);
    setError(null);
    try {
      // Hand the key to Rust exactly once; clear the field as soon as we're done.
      await invoke("save_api_key", { key: apiKey });
      setApiKey("");
      alert("API key saved securely");
    } catch (e) {
      setError(String(e));
    } finally {
      setSaving(false);
    }
  };
 
  return (
    <div>
      <input
        type="password"
        value={apiKey}
        onChange={(e) => setApiKey(e.target.value)}
        placeholder="sk-ant-..."
        autoComplete="off"
      />
      <button onClick={handleSave} disabled={saving || !apiKey}>
        Save
      </button>
      {error && <div role="alert">{error}</div>}
    </div>
  );
}

// src-tauri/src/anthropic.rs
// A minimal Anthropic API client. Centralizing the fetch layer keeps header
// changes, retries, and instrumentation in one obvious place.
 
use serde::{Deserialize, Serialize};
use reqwest::Client;
use anyhow::{Result, Context, bail};
 
const API_BASE: &str = "https://api.anthropic.com/v1";
const API_VERSION: &str = "2023-06-01";
 
#[derive(Serialize, Clone)]
pub struct Message {
    pub role: String,
    pub content: String,
}
 
#[derive(Serialize)]
struct MessagesRequest<'a> {
    model: &'a str,
    max_tokens: u32,
    messages: &'a [Message],
    #[serde(skip_serializing_if = "Option::is_none")]
    system: Option<&'a str>,
    #[serde(skip_serializing_if = "Option::is_none")]
    stream: Option<bool>,
}
 
#[derive(Deserialize)]
pub struct MessagesResponse {
    pub content: Vec<ContentBlock>,
    pub stop_reason: Option<String>,
    pub usage: Usage,
}
 
#[derive(Deserialize)]
pub struct ContentBlock {
    #[serde(rename = "type")]
    pub kind: String,
    pub text: Option<String>,
}
 
#[derive(Deserialize)]
pub struct Usage {
    pub input_tokens: u32,
    pub output_tokens: u32,
}
 
pub async fn send_message(
    api_key: &str,
    model: &str,
    system: Option<&str>,
    messages: &[Message],
    max_tokens: u32,
) -> Result<MessagesResponse> {
    let client = Client::new();
    let body = MessagesRequest {
        model,
        max_tokens,
        messages,
        system,
        stream: None,
    };
 
    let res = client
        .post(format!("{}/messages", API_BASE))
        .header("x-api-key", api_key)
        .header("anthropic-version", API_VERSION)
        .header("content-type", "application/json")
        .json(&body)
        .send()
        .await
        .context("failed to reach Anthropic API")?;
 
    let status = res.status();
    if !status.is_success() {
        let text = res.text().await.unwrap_or_default();
        bail!("Anthropic API error {}: {}", status, text);
    }
 
    res.json::<MessagesResponse>()
        .await
        .context("failed to parse Anthropic API response")
}

// Add to src-tauri/src/anthropic.rs
use futures_util::StreamExt;
use tauri::{AppHandle, Emitter};
 
#[derive(Serialize, Clone)]
pub struct StreamChunk {
    pub session_id: String,
    pub delta: String,
}
 
#[derive(Serialize, Clone)]
pub struct StreamDone {
    pub session_id: String,
    pub stop_reason: Option<String>,
    pub input_tokens: u32,
    pub output_tokens: u32,
}
 
pub async fn stream_message(
    app: AppHandle,
    api_key: &str,
    session_id: String,
    model: &str,
    system: Option<&str>,
    messages: &[Message],
    max_tokens: u32,
) -> Result<()> {
    let client = Client::new();
    let body = MessagesRequest {
        model,
        max_tokens,
        messages,
        system,
        stream: Some(true),
    };
 
    let res = client
        .post(format!("{}/messages", API_BASE))
        .header("x-api-key", api_key)
        .header("anthropic-version", API_VERSION)
        .header("content-type", "application/json")
        .json(&body)
        .send()
        .await?;
 
    if !res.status().is_success() {
        bail!("Anthropic API error {}: {}", res.status(), res.text().await.unwrap_or_default());
    }
 
    let mut stream = res.bytes_stream();
    let mut buf = String::new();
    let mut input_tokens = 0u32;
    let mut output_tokens = 0u32;
    let mut stop_reason: Option<String> = None;
 
    while let Some(chunk) = stream.next().await {
        let bytes = chunk.context("stream read failed")?;
        buf.push_str(&String::from_utf8_lossy(&bytes));
 
        // SSE events terminate at "\n\n"
        while let Some(idx) = buf.find("\n\n") {
            let event = buf[..idx].to_string();
            buf.drain(..idx + 2);
 
            for line in event.lines() {
                if let Some(data) = line.strip_prefix("data: ") {
                    let v: serde_json::Value = match serde_json::from_str(data) {
                        Ok(v) => v,
                        Err(_) => continue,
                    };
                    match v["type"].as_str() {
                        Some("content_block_delta") => {
                            if let Some(text) = v["delta"]["text"].as_str() {
                                app.emit(
                                    "claude://stream",
                                    StreamChunk {
                                        session_id: session_id.clone(),
                                        delta: text.to_string(),
                                    },
                                )?;
                            }
                        }
                        Some("message_start") => {
                            input_tokens = v["message"]["usage"]["input_tokens"]
                                .as_u64()
                                .unwrap_or(0) as u32;
                        }
                        Some("message_delta") => {
                            if let Some(out) = v["usage"]["output_tokens"].as_u64() {
                                output_tokens = out as u32;
                            }
                            if let Some(reason) = v["delta"]["stop_reason"].as_str() {
                                stop_reason = Some(reason.to_string());
                            }
                        }
                        _ => {}
                    }
                }
            }
        }
    }
 
    app.emit(
        "claude://done",
        StreamDone {
            session_id,
            stop_reason,
            input_tokens,
            output_tokens,
        },
    )?;
    Ok(())
}

// src-tauri/src/lib.rs (excerpt)
#[tauri::command]
async fn chat_stream(
    app: tauri::AppHandle,
    session_id: String,
    messages: Vec<anthropic::Message>,
    system: Option<String>,
) -> Result<(), String> {
    let api_key = secrets::load_api_key()
        .map_err(|e| e.to_string())?
        .ok_or("API key is not configured".to_string())?;
 
    anthropic::stream_message(
        app,
        &api_key,
        session_id,
        "claude-sonnet-4-6",
        system.as_deref(),
        &messages,
        4096,
    )
    .await
    .map_err(|e| e.to_string())
}

// src/ChatView.tsx (excerpt)
import { invoke } from "@tauri-apps/api/core";
import { listen, UnlistenFn } from "@tauri-apps/api/event";
import { useEffect, useRef, useState } from "react";
 
type Msg = { role: "user" | "assistant"; content: string };
 
export function ChatView() {
  const [messages, setMessages] = useState<Msg[]>([]);
  const [input, setInput] = useState("");
  const [streaming, setStreaming] = useState(false);
  const sessionIdRef = useRef("");
 
  useEffect(() => {
    let unlistenChunk: UnlistenFn | null = null;
    let unlistenDone: UnlistenFn | null = null;
 
    (async () => {
      unlistenChunk = await listen<{ session_id: string; delta: string }>(
        "claude://stream",
        (event) => {
          if (event.payload.session_id !== sessionIdRef.current) return;
          setMessages((prev) => {
            const next = [...prev];
            const last = next[next.length - 1];
            if (last?.role === "assistant") {
              next[next.length - 1] = {
                ...last,
                content: last.content + event.payload.delta,
              };
            }
            return next;
          });
        }
      );
      unlistenDone = await listen("claude://done", () => setStreaming(false));
    })();
 
    return () => {
      unlistenChunk?.();
      unlistenDone?.();
    };
  }, []);
 
  const send = async () => {
    if (!input.trim() || streaming) return;
    const sid = crypto.randomUUID();
    sessionIdRef.current = sid;
    const next: Msg[] = [
      ...messages,
      { role: "user", content: input },
      { role: "assistant", content: "" },
    ];
    setMessages(next);
    setInput("");
    setStreaming(true);
    try {
      await invoke("chat_stream", {
        sessionId: sid,
        messages: next.slice(0, -1),
        system: "You are a helpful, careful coding assistant.",
      });
    } catch (e) {
      setStreaming(false);
      alert(`Send failed: ${e}`);
    }
  };
 
  // …UI omitted…
}

// src-tauri/src/tools.rs
use serde_json::{json, Value};
use std::fs;
use std::path::Path;
 
pub fn tool_definitions() -> Value {
    json!([
        {
            "name": "read_local_file",
            "description": "Read a UTF-8 text file from a path the user previously authorized. Binary files are not supported.",
            "input_schema": {
                "type": "object",
                "properties": {
                    "path": { "type": "string", "description": "Absolute path to read" }
                },
                "required": ["path"]
            }
        }
    ])
}
 
pub fn execute_tool(name: &str, input: &Value, allowed_dirs: &[String]) -> Result<String, String> {
    match name {
        "read_local_file" => {
            let path = input["path"].as_str().ok_or("path is required")?;
            let abs = Path::new(path);
            // Confirm the path is under an allowed directory (path traversal guard)
            let allowed = allowed_dirs.iter().any(|d| abs.starts_with(Path::new(d)));
            if !allowed {
                return Err(format!("path is not allowed: {}", path));
            }
            let content = fs::read_to_string(abs)
                .map_err(|e| format!("read failed: {}", e))?;
            // Truncate large files
            let truncated = if content.len() > 200_000 {
                format!("{}\n\n[…file truncated; only the first 200KB returned…]", &content[..200_000])
            } else {
                content
            };
            Ok(truncated)
        }
        _ => Err(format!("unknown tool: {}", name)),
    }
}

npm install @tauri-apps/plugin-store
cargo add tauri-plugin-store --manifest-path src-tauri/Cargo.toml

// src-tauri/src/lib.rs (excerpt)
pub fn run() {
    tauri::Builder::default()
        .plugin(tauri_plugin_store::Builder::default().build())
        .plugin(tauri_plugin_shell::init())
        .plugin(tauri_plugin_updater::Builder::new().build())
        .invoke_handler(tauri::generate_handler![
            save_api_key,
            has_api_key,
            delete_api_key,
            chat_stream,
        ])
        .run(tauri::generate_context!())
        .expect("error while running tauri application");
}

// src/store.ts
import { Store } from "@tauri-apps/plugin-store";
 
const store = await Store.load("history.json");
 
export async function saveConversation(id: string, messages: unknown) {
  await store.set(id, { messages, updated_at: Date.now() });
  await store.save();
}
 
export async function loadConversations() {
  const entries = await store.entries();
  return entries.sort((a: any, b: any) => b[1].updated_at - a[1].updated_at);
}

# Pass signing/notarization details via environment variables
export APPLE_SIGNING_IDENTITY="Developer ID Application: Your Name (TEAMID)"
export APPLE_ID="you@example.com"
export APPLE_PASSWORD="app-specific-password"
export APPLE_TEAM_ID="TEAMID"
 
# Production build
npm run tauri build
 
# Output (macOS example)
# src-tauri/target/release/bundle/dmg/claude-desk_0.1.0_aarch64.dmg
# src-tauri/target/release/bundle/macos/claude-desk.app

// src-tauri/src/anthropic.rs (add to bottom)
#[cfg(test)]
mod tests {
    use super::*;
 
    #[test]
    fn parses_content_block_delta_lines() {
        let line = r#"data: {"type":"content_block_delta","delta":{"type":"text_delta","text":"hello"}}"#;
        let raw = line.strip_prefix("data: ").unwrap();
        let v: serde_json::Value = serde_json::from_str(raw).unwrap();
        assert_eq!(v["type"], "content_block_delta");
        assert_eq!(v["delta"]["text"], "hello");
    }
 
    #[test]
    fn ignores_unknown_event_types() {
        let v: serde_json::Value =
            serde_json::from_str(r#"{"type":"ping"}"#).unwrap();
        // The streaming loop should skip these without panicking; this test
        // documents the contract for future readers.
        assert_eq!(v["type"], "ping");
    }
}