Scan a Tauri app without running it.

What scan writes

A scan bundle is six files. Meilisearch settings and project metadata are in the bundle so it can be uploaded or reindexed.

artifacts.ndjson

Extracted documents. Every artifact includes id, repo, kind, risk_level, contains_phi, has_related_tests, and related_tests.

edges.ndjson

Relationships between documents.

warnings.ndjson

Warning documents. When the code is ambiguous, the scanner writes one instead of silently skipping it.

summary.json

Scan summary.

project-info.json

Project metadata.

meili-settings.json

Meilisearch settings for upload or reindex.

Relationships it keeps

The scan extracts frontend components, hooks, tests, Tauri commands, plugin metadata, permissions, and capability documents. It also extracts frontend HTTP wrappers, transports, endpoints, and canonical endpoint flows. Redaction, PHI detection, and risk tagging run before documents are written.

• frontend component -> hook
• hook -> invoke call
• component -> API wrapper -> transport -> backend route
• invoke call -> Rust command
• command -> permission
• permission -> effective capability
• artifact -> related tests

Commands

The quick start order from the project README. Global flags are --strict, --verbose, --quiet, --redact-secrets, --detect-phi, and --fail-on-phi. --redact-secrets and --detect-phi are on by default. --fail-on-phi is off by default.

1. Init

   Creates .repo-search/tauri/source-map-tauri.toml, .repo-search/tauri/.gitignore, and ~/.config/meilisearch/connect.json with placeholder values if that file does not already exist.

   source-map-tauri init --root /path/to/tauri-app

   Copy command

2. Doctor

   Reports whether the repo looks like a Tauri app, how many frontend, capability, and permission files were found, and whether Vite sourcemaps appear configurable.

   source-map-tauri doctor --root /path/to/tauri-app --repo my-tauri-app

   Copy command

3. Scan

   Writes the bundle under --out. The walk skips .git, node_modules, target, dist, build, vendor, coverage, logs, tmp, and storage. Pass --include-node-modules, --include-target, --include-dist, or --include-vendor to bring those directories back in.

   source-map-tauri scan --root /path/to/tauri-app --repo my-tauri-app --out /tmp/source-map-tauri

   Copy command

4. Validate

   Checks bundle structure, document ids, and command-to-permission evidence. Validation fails if a document id is not Meilisearch-safe.

   source-map-tauri validate --input /tmp/source-map-tauri

   Copy command

5. Upload

   Sends the bundle to Meilisearch. Connection resolution order: --meili-url / --meili-key, then MEILI_HOST, MEILI_MASTER_KEY, and MEILI_SEARCH_KEY, then ~/.config/meilisearch/connect.json, then the default http://127.0.0.1:7700 host in config. Meilisearch is used for upload, reindex, search, and the Meili health checks in doctor.

   source-map-tauri upload \
     --input /tmp/source-map-tauri/artifacts.ndjson \
     --edges /tmp/source-map-tauri/edges.ndjson \
     --warnings /tmp/source-map-tauri/warnings.ndjson \
     --wait

   Copy command

6. Reindex

   Scans again and uploads in one step.

   source-map-tauri reindex --root /path/to/tauri-app --repo my-tauri-app --wait

   Copy command

7. Search

   Endpoint-shaped queries are normalized and filtered to frontend_http_flow. auth/login resolves to /auth/login. A suffix such as /home/search can resolve to /appointment/home/search when that suffix is stored as a path alias. The query returns one canonical flow document per repo. Extra callsites collapse into caller_count, alternate_components, and source_paths. A /home/search query can return PatientSearchContent -> useSearchPatientMutation -> usePostMutation -> POST /appointment/home/search.

   source-map-tauri search --query "patient upload permission"
   source-map-tauri search --query "auth/login"
   source-map-tauri search --query "/home/search"

   Copy commands

8. Print schema

   Prints JSON schema hints for an artifact, an edge, or a warning.

   source-map-tauri print-schema --kind artifact
   source-map-tauri print-schema --kind edge
   source-map-tauri print-schema --kind warning

   Copy commands

9. Trace

   Verifies the bundle path and preserves the command surface. Deeper sourcemap frame tracing is still being filled in.

   source-map-tauri trace --root /path/to/tauri-app --bundle dist/app.js --line 120 --column 4

   Copy command

Install

Build requirements are a Rust toolchain and a Tauri repository to scan. Meilisearch is required only for upload, reindex, search, or Meili health checks in doctor. Current CI runs on Linux and macOS.

brew tap dickwu/tap
brew install source-map-tauri

cargo install source-map-tauri

git clone git@github.com:dickwu/source-map-tauri.git
cd source-map-tauri
cargo build --release

Still being hardened

The project README names what is still being hardened:

• More real-world Tauri repo shapes outside the current fixtures
• Richer sourcemap frame tracing beyond the placeholder bundle-path response
• Live Meilisearch integration coverage in CI

Questions