feat(configurator): add Tauri desktop configurator app

[knotekt]

Summary

• Adds a Tauri-based desktop GUI that lets non-technical users set up lox-mcp without editing config files manually
• Adds CI workflow to build and publish platform binaries on configurator-v* tag
• Streamlines README and moves detailed setup docs to docs/SETUP.md

Changes

configurator/ — Tauri app (React + Rust)

• Java check — detects Java 21+, shows OS-specific Adoptium download link if missing
• JAR manager — downloads latest release JAR to ~/.lox-mcp/lox-mcp.jar with SHA256 verification; HTTP status checked before write
• Config scanner — detects all known MCP config files (Claude Desktop, Cursor, VS Code, OpenCode, Zed, Continue.dev, Windsurf, Antigravity) and reads existing loxone-* entries
• Config editor — add / edit / delete Loxone server entries across any detected config; backup .bak created before each write
• Connection verifier — spins up the JAR in --stdio mode, sends MCP initialize, verifies response
• Security — CSP hardened (default-src 'self'), no null policy

.github/workflows/build-configurator.yml

Builds DMG (macOS arm64 + x86_64), AppImage (Linux), NSIS installer (Windows) on configurator-v* tag; publishes as draft release.

docs/SETUP.md

New secondary doc with credentials, per-client config snippets, transport modes, custom YAML config, build instructions, and project structure — moved from README.

README.md

Trimmed to essentials: what it does, quick start (Configurator vs manual JAR), tools/resources tables, license summary.

[Copilot]

Pull request overview

Adds a new Tauri-based desktop “Configurator” to simplify setting up lox-mcp for non-technical users, alongside updated documentation and a CI workflow to build/publish desktop binaries.

Changes:

• Introduces configurator/: a Tauri (React + Rust) desktop app for Java checks, JAR download/upgrade, MCP client config scanning/editing, and connection verification.
• Adds a GitHub Actions workflow to build and publish Configurator binaries on configurator-v* tags.
• Streamlines README.md and moves detailed setup/reference material into docs/SETUP.md (plus adds a dedicated statistics-tool implementation guide).

Reviewed changes

Copilot reviewed 32 out of 55 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
README.md	Updates project intro/quickstart and links users to the Configurator + docs/SETUP.md.
docs/SETUP.md	Adds detailed setup/reference documentation (clients, transports, config, build).
docs/mcp-statistics-tool-guide.md	Adds an implementation guide for a future statistics-reading MCP tool.
configurator/vite.config.ts	Vite configuration for the Configurator frontend.
configurator/tsconfig.json	TypeScript compiler settings for the Configurator frontend.
configurator/tailwind.config.js	Tailwind configuration for Configurator styling.
configurator/postcss.config.js	PostCSS setup for Tailwind/autoprefixer.
configurator/package.json	Frontend dependencies and scripts for building/running the Configurator UI.
configurator/index.html	Vite entry HTML for the Configurator UI.
configurator/src/vite-env.d.ts	Vite type declarations for the frontend.
configurator/src/main.tsx	React entrypoint wiring App into the DOM.
configurator/src/index.css	Tailwind CSS base/components/utilities import.
configurator/src/App.tsx	Main UI flow: checks, download/install, config list, add/edit forms.
configurator/src/lib/types.ts	Shared frontend types for Java/JAR/config/release state.
configurator/src/components/StatusBar.tsx	Displays Java/JAR status and upgrade actions.
configurator/src/components/ConfigList.tsx	Lists detected MCP client configs and their Loxone server entries.
configurator/src/components/ServerTree.tsx	Renders per-config server entries with edit/delete actions.
configurator/src/components/ServerForm.tsx	Add/edit server form incl. connection verification.
configurator/src/components/JavaSetup.tsx	Java install guidance with Adoptium link per platform.
configurator/src-tauri/tauri.conf.json	Tauri app configuration incl. CSP and bundling settings.
configurator/src-tauri/build.rs	Tauri build script hook.
configurator/src-tauri/Cargo.toml	Rust crate definition and dependencies for the Tauri backend.
configurator/src-tauri/src/main.rs	Registers Tauri commands and initializes required plugins.
configurator/src-tauri/src/platform.rs	OS/arch detection and Adoptium download URL generation.
configurator/src-tauri/src/java_check.rs	Java detection + version parsing for the prereq check.
configurator/src-tauri/src/jar_manager.rs	Fetches latest release metadata, downloads JAR, verifies checksum, stores version.
configurator/src-tauri/src/config_scanner.rs	Scans known MCP client config locations and extracts loxone* entries.
configurator/src-tauri/src/config_editor.rs	Adds/edits/deletes server entries in detected MCP client config formats (with backups).
configurator/src-tauri/src/connection_verifier.rs	Spawns the JAR in --stdio and verifies MCP initialize response.
configurator/src-tauri/capabilities/default.json	Grants default Tauri capability permissions (core + shell open).
configurator/src-tauri/gen/schemas/desktop-schema.json	Generated schema used by Tauri capabilities configuration.
configurator/src-tauri/gen/schemas/capabilities.json	Generated capabilities schema/manifest output.
configurator/src-tauri/gen/schemas/acl-manifests.json	Generated ACL manifests used by Tauri permissions system.
configurator/src-tauri/icons/android/values/ic_launcher_background.xml	Android icon background color resource for generated app assets.
configurator/src-tauri/icons/android/mipmap-anydpi-v26/ic_launcher.xml	Android adaptive launcher icon definition.
.github/workflows/build-configurator.yml	CI build/release workflow for Configurator binaries on configurator-v* tags.
.gitignore	Ignores Configurator build artifacts and Node/Rust outputs.

[jimirocks]

Code Review — feat(configurator): add Tauri desktop configurator app

---

Bug: Silent checksum skip on download failure

configurator/src-tauri/src/jar_manager.rs — Medium

When the checksum file fetch returns a non-2xx status, the download proceeds and the binary is written to disk without any verification or user notification. If the checksum URL was published by the release, a 404 is unexpected and likely indicates a problem. A corrupted download is indistinguishable from a valid one in this path. At minimum, surface a warning to the frontend.

---

Bug: danger_accept_invalid_certs(true) is unconditional

configurator/src-tauri/src/connection_verifier.rs — Low-Medium

TLS certificate validation is disabled for all connection tests, not just self-signed cert scenarios. The credentials being tested (host/user/pass) are transmitted over this connection. This is a realistic MITM risk on shared networks (home WiFi, corporate networks). A better approach: attempt the connection normally first, then offer a "trust anyway" option on cert failure rather than disabling validation silently.

---

Bug: Java version detection misses bare major-version format

configurator/src-tauri/src/java_check.rs — Low

Outputs like java 21 (no minor/patch, no quotes) — produced by some distributions — match neither the primary regex nor the fallback \d+\.\d+\.\d+ pattern. The result would be meets_minimum: false for a valid Java 21 install, incorrectly blocking the user.

---

Behavior: writable check inaccurate when grandparent dirs are missing

configurator/src-tauri/src/config_scanner.rs — Minor / UI only

When the config file doesn't exist, writable returns true only if the immediate parent directory exists. But add_server uses fs::create_dir_all, which would succeed even when intermediate directories are missing. The flag shown in the UI will say false (or show as non-writable) when the write would actually succeed.

---

Behavior: Section-validity check runs after removal in edit_server

configurator/src-tauri/src/config_editor.rs — Minor

When the server name changes and the section is not a valid object, the removal silently no-ops before the error is returned. The file is left unchanged, which is safe, but the ordering is misleading and could mask a partially invalid config.

---

Security note: Passwords included in scan_configs IPC response

configurator/src-tauri/src/config_scanner.rs

DetectedServer includes pass and is serialized into every scan_configs Tauri IPC response. This is probably necessary for the edit flow. Given the hardened CSP (default-src 'self') this is an acceptable tradeoff, but worth being explicit about in a security review since the PR description calls out security hardening.

---

Suggestion: Gitignore src-tauri/gen/

configurator/src-tauri/gen/

The gen/schemas/ files (desktop-schema.json, macOS-schema.json, ~133 KB each) are auto-generated by Tauri at build time and only change on Tauri version bumps. The diffs are large, machine-generated JSON schemas with low review value. Consider adding src-tauri/gen/ to .gitignore and regenerating at build time — this avoids noisy diffs on upgrades and is a common pattern in Tauri projects.

[jimirocks]

All previously raised issues are resolved. One minor edge case remains in ServerForm.tsx:15 — a server named exactly loxone will round-trip to loxone- due to the loxone-? regex stripping the full name to an empty string. Low impact in practice but worth a follow-up fix.