Guard remaining unguarded Tauri calls for web deployments

[jefflitt1]

Summary

• Several call sites into @tauri-apps/api still assume a native Tauri runtime and throw when the desktop chat UI is served as a plain web page instead (no window.__TAURI_INTERNALS__): "Cannot read properties of undefined (reading 'transformCallback'/'invoke')". Most of the codebase already guards this correctly with isTauri() before calling listen()/invoke() (e.g. audioWorklet.ts); this closes the boot-reachable gaps found by exercising a web-served build end-to-end.
• useAgentsDataRefresh, useNestNotifications, HuddleContext, HuddleBar, HuddleIndicator, MobilePairingCard: guard listen() registration with isTauri().
• usePreventSleep: guard both effects. The listen() registration throws without Tauri internals, and setPreventSleepActive is fired fire-and-forget (void, no .catch), so an unguarded call there is a genuine unhandled rejection rather than a logged warning.
• deep-link.ts: the pending-deep-link queue is populated by the Rust backend and only exists in the native shell, so both the invoke() drain and the listen()-based registrations are guarded. In listenForDeepLinks the guard precedes deps.onAddCommunityAvailable — that subscription only wakes the native queue, so in a browser it would register a callback that can never do work.
• legacyCommunityStorage.ts: the legacy Sprout WebKit SQLite database read only exists in the native shell — skip it in a web runtime.

Guards stay at the consumer rather than inside shared/api/tauri.ts: that module is an API wrapper, not a policy layer, and its callers already handle failure (useCommunityInit wraps its calls in try/catch and falls back to needsSetup, App.tsx catches is_shared_identity and falls back to false). Guarding inside the wrapper would only suppress those console warnings, which are the signal that a packaged native build is misconfigured. It would also grow a file the repo's own size ratchet already holds at its limit.

Apart from the prevent-sleep unhandled rejection, these failures were already caught and logged as console warnings, so this doesn't change behavior for native Tauri users.

Scope note: this covers the boot-reachable native calls surfaced by a standalone-web smoke test, not an exhaustive audit of every invoke()/listen() in the desktop client.

Independent of #3189, but both were found while exercising the same web-served build, and neither on its own makes the bundle usable as a plain web page.

Test plan

• pnpm build (tsc + vite build) — passes
• pnpm test — 5799/5799 passing
• just file-size-check — passes
• pnpm check (biome + px-text + pubkey-truncation) — clean
• New deep-link.web.test.mjs sets no Tauri globals, so it runs against the real @tauri-apps/api in the browser runtime the guards exist for. Verified by mutation, not just a green run: removing any one of the five guards fails that file (listenForDeepLinks fails two of six cases, the rest one each).
• Manually verified in a browser: served the built bundle as a plain web page outside Tauri. Note this was verified against an earlier revision that also guarded shared/api/tauri.ts; those guards were dropped deliberately (see above), so a browser load still logs the is_shared_identity command failed warning from App.tsx's existing .catch. That warning is intended — it is the signal that the native bridge is absent, and suppressing it was the only thing those guards bought.

Related

Checked open PRs/issues for duplicates before submitting — no duplicate found. #3027 is open in an adjacent but different subsystem (relay-side SPA routing config, vs. this PR's desktop-client Tauri guards) for a similarly-motivated self-hosted deployment; not overlapping, noted for context.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 00e61eafa917d296104006576b7a2ddbfd58bb5a...48baee22c35824a6295d0016f2771a52f70a9743.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 48baee22c35824a6295d0016f2771a52f70a9743 to authorize a new review.
Any previous review applies only to its recorded range.