This is a comment left during a code review.
Path: apps/linux/src/build.rs
Line: 1-3

Comment:
**`build.rs` placed in wrong directory**

Cargo automatically discovers a build script only when it is named `build.rs` at the **crate root** (i.e., alongside `Cargo.toml`). Because these files live under `src/build.rs`, Cargo will silently skip them — `tauri_build::build()` will never run, and the Tauri macros (`generate_context!`, `generate_handler!`) will fail to find the required generated artifacts at compile time.

The fix is to move both `apps/linux/src/build.rs` → `apps/linux/build.rs` and `apps/windows/src/build.rs` → `apps/windows/build.rs`. Alternatively, add an explicit `build = "src/build.rs"` key to each `Cargo.toml`:

```toml
[package]
name = "openclaw-linux"
build = "src/build.rs"
```

The same problem exists in `apps/windows/src/build.rs`.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: apps/linux/src/gateway.rs
Line: 30-44

Comment:
**`connect()` blocks the caller indefinitely**

The `while let Some(msg) = read.next().await` loop runs on the same task that called `connect()`. Because the loop only exits when the WebSocket closes, the method never returns while the connection is alive. Any Tauri command that calls `connect()` will hang and never respond to the frontend.

The receive loop must be detached into its own Tokio task so `connect()` can return immediately after the handshake:

```rust
pub async fn connect(&mut self, url: String) -> Result<(), Box<dyn std::error::Error>> {
    let (ws_stream, _) = connect_async(&url).await?;
    let (_write, mut read) = ws_stream.split();

    self.connected = true;
    self.gateway_url = Some(url);

    tokio::spawn(async move {
        while let Some(msg) = read.next().await {
            if let Ok(WsMessage::Text(text)) = msg {
                println!("Received: {}", text);
            }
        }
    });

    Ok(())
}
```

The same issue exists in `apps/windows/src/gateway.rs`.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: apps/linux/src/gateway.rs
Line: 1-5

Comment:
**Unused imports will cause compiler warnings/errors**

`mpsc` is imported from `tokio::sync` but never referenced anywhere in this file. `SinkExt` is imported for the unused `write` sink. `write` itself is bound as `mut write` on line 32 but never written to. Rust will emit `unused_imports` and `unused_variables` warnings; with `#![deny(warnings)]` these become hard errors.

```suggestion
use futures_util::StreamExt;
use serde::{Deserialize, Serialize};
use std::sync::Arc;
use tokio::sync::RwLock;
use tokio_tungstenite::{connect_async, tungstenite::Message as WsMessage};
```

Also update line 32 to drop the unused `write` binding:
```rust
let (_, mut read) = ws_stream.split();
```

The same issues are present in `apps/windows/src/gateway.rs`.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: apps/linux/tauri.conf.json
Line: 40-42

Comment:
**CSP disabled — security risk in production**

Setting `"csp": null` completely removes Tauri's built-in Content Security Policy. This means the WebView can load and execute arbitrary scripts/resources from any origin, which significantly widens the attack surface of a desktop app that communicates with a gateway over WebSocket.

Consider using a restrictive policy such as:
```json
"security": {
  "csp": "default-src 'self'; connect-src 'self' ws://localhost wss://; script-src 'self'"
}
```

The same configuration is present in `apps/windows/tauri.conf.json`.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: apps/linux/tauri.conf.json
Line: 7

Comment:
**DevTools enabled unconditionally**

`"devtools": true` at the top-level `build` key enables the WebView inspector in **all** builds, including production releases. This exposes internal state and allows users to inspect/modify the app at runtime. Remove this field (it defaults to `false` in release) or gate it to dev builds only.

```suggestion
    "devtools": false
```

The same applies to `apps/windows/tauri.conf.json`.

How can I resolve this? If you propose a fix, please make it concise.