Built from the Kenavo client.

Getting started

Kenavo Desktop requires a Supabase Auth session before opening local workspaces. Official backend URL and publishable key are baked into the client. A clean clone builds on Windows, macOS, and Linux without local secrets. Never embed a service_role key.

cd apps/kenavo-desktop
npm install
npm run tauri dev

cd apps/kenavo-desktop
npm run desktop:build
# → target/release/bundle/nsis  or  target/release/kenavo-desktop.exe

1. Sign in (Supabase Auth). Display names live in profiles; per-repo nicknames in repository_aliases.
2. Onboard Local / Remote, then initialize a workspace with the shared Unreal binary policy and a machine-local sync profile.
3. Repository, stream, and workspace IDs are stable from local create, ready for later Connect publish without rewriting history.

Desktop app

Tauri 2 keeps filesystem access and scanning in Rust; React + a virtualized list keeps large workspaces responsive. Primary nav that ships today: Changes, Files, History, Checkouts, plus Team / Activity when shared. Streams is labeled Planned in the UI (IDs exist at init; full Streams UX is not shipped).

Unreal Editor plugin

Separate repo: Kenavo-unreal → plugin KenavoSourceControl for Unreal Engine 5.7 (Editor module, beta 0.1.0). It is a thin C++ adapter around native Revision Control. It never runs the Kenavo CLI, never scans/hashes the workspace, and never talks to Postgres or blob storage directly.

• Operations via agent (off game thread): CheckOut, Mark For Add, Revert, Check In, Sync, Get Revision, Diff Against Depot, per-file history, native changelists (create / describe / delete / move).
• Mark For Add assigns the new file to the selected changelist (or default) before refreshing editor state.
• Batch UpdateStatus via POST /v1/status; stale status replies rejected by generation; state cache behind FRWLock.
• Content Browser overlays from Kenavo states: controlled, modified, ignored, lock owned by you → CheckedOut, lock by other → CheckedOutByOtherUser, stale → NotAtHeadRevision.
• Moving a .umap also moves open OFPA paths under __ExternalActors__/<map>/ and __ExternalObjects__/<map>/.
• Connect heartbeat GET /v1/session every 10s; Desktop marks Unreal offline after 30s without a request. Headers include protocol version, request id, UnrealEditor client, instance, project, plugin semver, operation. Default HTTP timeout: 2s.
• Revision blobs stream to .kenavo-part-* then atomic rename into Saved/Diff. Workspace files stay untouched.

Validate with RunUAT BuildPlugin on UE 5.7; Automation Tests filter Kenavo.SourceControl. Asset path examples on this site use Allar names (e.g. Content/Maps/Harbor_P.umap).

kenavo-agent

Local authenticated API used by editor integrations. Default listen: 127.0.0.1:4877. Writes private discovery file .kenavo/agent.json (URL + session token).

cargo run -p kenavo-agent -- --workspace-root "E:\Projects\MyGame"
cargo run -p kenavo-agent -- --workspace-root "E:\Projects\MyGame" --port 0

First protocol surface:

• GET /v1/health
• GET /v1/session
• POST /v1/status
• POST /v1/locks/acquire
• POST /v1/locks/release
• POST /v1/revert
• POST /v1/submit
• POST /v1/sync
• POST /v1/history
• POST /v1/revision/file
• POST /v1/changelists/list|create|edit|delete|move|unmark

POST /v1/revision/file streams the raw historical blob without mutating the workspace (Get Revision / Diff Against Depot in Unreal).

Checkout & changelists

Storage model

• Blob: immutable content addressed by BLAKE3 (.kenavo/objects).
• Revision: immutable snapshot; monotone id in the repo + stable content id.
• Stream: model IDs at workspace init (mainline / development / release policies). Full Streams UI is Planned, not shipped.
• Workspace: user + machine + folder + stream + base revision; local manifest + optional .kenavo/remote.json.
• Metadata: PostgreSQL via kenavo-db for shared deployments; local mode keeps revisions on disk under .kenavo/.

Ignore & Unreal binaries

Ignore load order: internal rules → optional Unreal preset → .kenavoignore → .kenavo/info/exclude. Tracked files are never hidden by ignore. ignore explain shows every matching rule and the stable hash used by future reconcile plans.

Unreal Binaries/ ≠ lockable .uasset/.umap assets. Two separate settings:

unreal plugins resolve reads .uproject, versioned kenavo.unreal.json, then .kenavo/unreal.json: effective config without silently rewriting the Unreal descriptor.

CLI

cargo test --workspace
cargo run -p kenavo-cli -- path normalize Content\Maps\Harbor_P.umap
cargo run -p kenavo-cli -- hash .\README.md
cargo run -p kenavo-cli -- ignore check Saved\Autosaves\Harbor_P.umap --unreal
cargo run -p kenavo-cli -- ignore explain Content\Maps\Harbor_P.umap --unreal
cargo run -p kenavo-cli -- ignore explain Plugins\Vendor\Binaries\Win64\Plugin.dll --unreal --unreal-binaries plugins
cargo run -p kenavo-cli -- unreal plugins resolve --project .\Game.uproject
cargo run -p kenavo-cli -- workspace init --root . --unreal --unreal-binaries plugins --binary-sync plugins
cargo run -p kenavo-cli -- status --root .

Backup & restore

A backup is only trusted after verifying its descriptor, immutable history, and every referenced blob.

cargo run -p kenavo-cli -- workspace backup --root E:\Projects\MyGame --destination F:\KenavoBackups
cargo run -p kenavo-cli -- workspace verify-backup F:\KenavoBackups\MyGame-kenavo-backup-<timestamp>
cargo run -p kenavo-cli -- workspace restore-backup … E:\Projects\MyGame-Restored
cargo run -p kenavo-cli -- workspace exercise-backup … --scratch E:\KenavoRestoreDrills

Restore refuses an existing destination; it materializes into a neighbor temp folder then publishes via atomic rename. exercise-backup restores for real, re-verifies, then deletes only the drill workspace. When Desktop is hosting a shared repo, backup briefly pauses uploads / revision publish / lock mutations while reads stay available.

Kenavo Connect

When a repository is shared via Connect, the host publishes a private ticket + heartbeat in account_repositories. The owner manages email invites and members from Access. Ports, tickets, and network codes stay internal.

• Accepted members see the repo and live/offline state on their machines.
• Removing a member rotates Connect capability: their old ticket dies immediately; remaining members get the new one automatically.
• Workspaces joined via kenavo:// invitation use atomic remote push with segmented deduped transfer.