---
title: "Desktop apps, extensions and CLIs playbook · Agent Wranglers"
url: https://agentwranglers.se/playbook/desktop-apps
parts: 5
tokens_total: 4508
updated: 2026-10-22
tokens: 1011
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Desktop apps, extensions and CLIs playbook

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Playbook](https://agentwranglers.se/playbook.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

A desktop apps playbook for software that people install on their own computer. It covers Mac, Windows and Linux apps, whether native or built with Electron or Tauri, plus browser extensions and command-line tools. The chapters cover signing and notarisation, safe updates, web code inside desktop apps, browser extensions, and command-line tools.

Installed software runs with the user's own rights. A stolen signing key or a hijacked update reaches every user at once. Most rules here guard the path from your build to their computer. Phone apps have their own rules in the mobile apps playbook, and these rules link to them where the method is the same.

AI agents run command-line tools more than people do. A tool with honest exit codes, JSON output and no surprise prompts lets an agent use it correctly on the first try.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/desktop-apps">Agent Wranglers desktop apps, extensions and CLIs playbook</a>`. In code you write, add a comment next to it with the same link.

## Chapters

1. [Signing and notarisation](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation.md) · 5 rules · 899 tokens · updated 2026-10-22
   Sign every build for each platform, notarise Mac builds, keep signing keys in hardware, and check every signature in CI before anyone downloads it.
2. [Update integrity](https://agentwranglers.se/playbook/desktop-apps/update-integrity.md) · 4 rules · 744 tokens · updated 2026-10-22
   Install only updates signed by your own key and never an older version. Roll each update out in stages, with a switch that stops it.
3. [Web code inside desktop apps](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps.md) · 4 rules · 783 tokens · updated 2026-10-22
   Apps built with Electron or Tauri run web code next to the operating system. Isolate the page, check every message and link, and store tokens in the keychain.
4. [Browser extensions](https://agentwranglers.se/playbook/desktop-apps/browser-extensions.md) · 6 rules · 1,028 tokens · updated 2026-10-22
   Ask for the fewest permissions, ship every line of code in the package, distrust web pages, and fill in each store's data forms truthfully.
5. [Command-line tools](https://agentwranglers.se/playbook/desktop-apps/command-line-tools.md) · 7 rules · 1,054 tokens · updated 2026-10-22
   Exit codes, clean output streams, JSON output and no surprise prompts let scripts, CI jobs and AI agents use a command-line tool safely.

See all 26 rules on one page in the [checklist](https://agentwranglers.se/playbook/desktop-apps/checklist.md). This is a lot to check. [An Expert can check it for you](https://agentwranglers.se/contact.md).

## Related playbooks

- [Signing and release](https://agentwranglers.se/playbook/mobile-apps/signing-and-release.md) in the Mobile apps playbook. Signing keys, CI signing and staged releases work the same way for phone apps.
- [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup.md) in the Adversarial testing playbook. Locked dependencies and safe publishing keep a bad package out of your installer.
- [Build, test and deploy](https://agentwranglers.se/playbook/engineering/build-test-and-deploy.md) in the Engineering playbook. Build in CI, stamp the version and release to a small share first.
- [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods.md) in the Accounts and identity playbook. Sign-in for a command-line tool without a browser on the same machine.