[khaliqgant]

Summary

The Desktop downloads card (Settings > Workspace) now falls back to a GitHub releases repo when the install has no signed Desktop feed, for example a local Kind stack.

Behaviour

• The signed feed wins. The card loads profiles and manifests as before. It calls GET /cloud/api/v1/desktop/releases only when the feed has no profiles or no releases.
• A 404 from /desktop/releases means no repo is configured, and the card shows today's empty state unchanged. Any other error, a malformed response or release: null also shows the empty state, with no error alert.
• With a GitHub release, the card uses the same UI: the recommended download for the visitor's OS/CPU (and the other format beside it), then all downloads grouped by OS with version, size and SHA-256. Probes stay hidden. The command-line install section is not shown, because its install scripts verify against the signed feed.
• Download buttons go straight to asset.url through the injected navigate, with no signed-URL call. Only https URLs on github.com or objects.githubusercontent.com (no port, no userinfo) are offered. Assets with any other URL are not rendered.
• A muted source line reads "Source: GitHub releases (owner/repo), not the signed Desktop feed. Checksums are from the release's .sha256 files." The repo name links to releasesUrl, but only when that is an https github.com URL. A "Pre-release" badge shows when prerelease is true.

Internally, each release entry now carries a resolve(asset) => url function. For feed releases it is the signed-URL call; for the GitHub release it is the asset's direct URL. contracts.ts adds githubReleasesSchema, and api.ts adds desktopFeedApi.githubReleases(), which returns null on 404.

Tests (src/admin/downloads.test.tsx, route mocked)

• Feed has a release: /desktop/releases is never called and there is no source line.
• No feed + 404: today's empty state, no alert.
• No feed + release: null, or a 502: empty state.
• Feed profiles but no manifests: falls back to GitHub.
• No feed + GitHub release: recommended Linux download plus the .tar.gz alternative, version, Pre-release badge, per-OS list with checksums and macOS floor, probe hidden, source label and link, no CLI section.
• Clicking download navigates to the GitHub URL with no /download-url call.
• An asset whose URL is off GitHub is not rendered, and the recommendation falls back to the remaining build.
• Unit tests for isGithubDownloadUrl.

npm run check is green.

Depends on

The relay-control /desktop/releases route (branch feat/desktop-github-releases). Until that lands, the route returns 404 and this change is inert.

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 5 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4d3c31f1-6680-44e0-935c-ecf5777d0852

Commits

Reviewing files that changed from the base of the PR and between 7259485 and a3b65b8.

Files selected for processing: 5

• src/admin/api.ts
• src/admin/contracts.ts
• src/admin/downloads.module.css
• src/admin/downloads.test.tsx
• src/admin/downloads.tsx

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T22:34:25.087900Z	2efe387	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[devin-ai-integration]

Devin Review found 2 potential issues.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the earlier empty-card issue is fixed, and no new actionable issues remain.

Summary

Adds GitHub releases as a fallback when the signed Desktop feed has no releases.

• Desktop downloads use GitHub releases when the signed feed has none.

_{Reviews (2) · Last reviewed commit: "fix(downloads): treat a GitHub release w..." · Reviewed by Greptile}