Frontend · HarmonyOS

cj-tauri: A 10MB AI Desktop Client Built on Cangjie + System WebViews Instead of Electron

By 特立独行的猫A · Oct 25, 2026

Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Desktop AI clients don't have to ship 100MB of Chromium. cj-tauri shows a working alternative that stays under 10MB, uses system WebViews, and adds a permission model stricter than Tauri's—events are whitelisted too, and any outbound host not in the manifest requires explicit runtime approval. For teams shipping cross-platform desktop tools on Windows, Linux, or HarmonyOS PC, this is a concrete benchmark for size, security, and multi-platform single-codebase delivery.

Summary

cj-tauri reimplements Tauri's architecture in Huawei's Cangjie language, swapping Rust for a static-compiled backend and keeping the same system-WebView strategy (WebView2, WebKitGTK, or ArkWeb). The result is single-file desktop executables that stay under 11 MB for real applications, with no Chromium bundled. And it treats HarmonyOS PC as a first-class target, so the same business code builds for Windows, Linux, and HarmonyOS PC.

The security model is stricter than Tauri 2's in several places: events also require whitelisting, path scopes are deny-before-allow, outbound network hosts are whitelisted with "not specified = all denied," and runtime allowlisting rejects wildcards. Every claim is backed by re-runnable test cases.

The ai-chat example is a template-level application: it combines direct OpenAI-compatible streaming chat, a local agent (cjh) over WebSocket, and nine web AI services as in-window embedded WebView tabs (not iframes, because third-party cookies and X-Frame-Options break login). It also demonstrates one-click cjh deployment with local SHA256 verification, model pass-through with per-round API keys, dangerous-operation approval cards, and a single-file Windows distribution.

Takeaways

— cj-tauri compiles Cangjie backend code to a static binary with no VM and no GC jitter, keeping the protocol layer to roughly two hundred auditable lines.

— Windows single-file executables range from 4.69 MB to 10.3 MB; ai-chat.exe is 10.3 MB and imports only system DLLs.

— The framework's security model has four entry points—commands, events, path arguments, and URL arguments—each with a default-deny gate; events are whitelisted, which Tauri 2 does not do.

— Runtime allowlisting rejects wildcards and can never override a deny rule; an empty capability list denies everything.

— ai-chat embeds nine web AI services as in-window tabs using native WebViews, capped at 4 concurrent views with LRU eviction, because iframes break login cookies and OAuth redirects.

— cjh, the agent backend, is deployed via a one-click flow that verifies SHA256 checksums locally, checks four runtime DLLs on Windows, and binds to 127.0.0.1 by default to avoid LAN exposure.

— Each turn in Agent mode passes the selected model, base URL, and API key; a self-check assertion (cjh-key-not-logged) ensures the key never appears in logs.

— ai-chat ships as a single exe with the page, highlight.js, and capabilities manifest base64-embedded into the binary.

— The framework's ai-chat example has 73 built-in assertions; 65 pass in a local run, with 4 independent probes covering guide, deploy, panels, and chat flows.

Conclusions

The security model deliberately goes beyond Tauri 2: event ACLs, path deny-before-allow, and runtime allowlisting that rejects wildcards close holes that typical Tauri apps leave open.

The decision to embed external web AI services as native WebViews rather than iframes is an honest acknowledgment of third-party cookie and X-Frame-Options behavior, and it preserves login state without a workaround.

Passing the API key per turn instead of persisting it on the agent side is a practical fix for multi-vendor setup: with multiple providers, a single global key would silently send the wrong credentials to the wrong endpoint.

The 'deny before allow' filesystem scope in ai-chat shows a product-level choice: the file panel is for preview only, so even a user's own home directory is off-limits for SSH keys and credentials.

Treating the web tab as a native control that must be manually rectangle-reported (with 80ms throttling) is an honest trade-off for embedding multiple WebViews in one window, making the layout complexity visible.

Concepts & terms

Cangjie

Huawei's programming language designed for system programming; it compiles to native machine code, has no VM, and is used here to replace Rust as the backend language for a Tauri-like framework.

System WebView

The operating system's built-in browser engine (WebView2 on Windows, WebKitGTK on Linux, ArkWeb on HarmonyOS) instead of bundling a full browser like Electron. This keeps binaries small but ties functionality to what the OS provides.

Capability ACL

A permission manifest that whitelists which commands, events, paths, and network hosts a web frontend may access. Empty lists deny everything; wildcards are rejected at runtime; deny rules cannot be overridden by allow rules.

Source: juejin.cn ↗ Google Translate ↗ Backup ↗