TOVIO Desktop: what it does today

TOVIO Desktop is a graphical client for people who would rather not live in a terminal. Unlike the web dashboard, it embeds the engine in process and drives a working copy on disk directly — no server, no sign-in. It is pre-release: worth trying, not yet worth depending on.

What is actually in it

Two dozen views, reachable from the sidebar or a command palette:

• Everyday: Status, History, Changes, Search, Lanes, Tags, Land, Build Check, Conflicts, Diff, Blame
• Governance: Policies, Access, Identity & Keys, Agents, Audit
• Networking: Remotes
• Advanced: Settings, Explain Undo, Explain Sync, Explain Rerere, Explain Plugins, Behavioral, Meta

It writes as well as reads: signed commit and amend, switch/create/delete lane, land, in-app conflict resolution, undo/redo, restore, move, tags, and the change lifecycle (new, describe, promote, abandon, restore).

It is not read-only for governance

This is where the desktop app is more capable than people assume. It can set and remove policies, grant and revoke access (a revoke performs a real forward-secrecy re-seal of HEAD's protected files to the reduced roster), issue and revoke agent capability tokens, lock and unlock files, manage identity and devices, and rotate, export, import, renew, and recover keys. It can even obliterate.

What is genuinely absent

• Forge administration, review, and proposals. Excluded by charter, not deferred — this app carries no Forge code. Use the web dashboard or the CLI.
• The Git bridge — import, export, bridge, credential setup.
• Plugin and secret-scan management. The Explain Plugins view reads the bindings a repository already has, and post-event plugin observations run in a default build; installing, binding, and running plugins is CLI-only.
• Semantic search and diff, and the MCP server.
• Maintenance — fsck and gc.
• History surgery — rebase, cherry-pick, revert.

The networking caveat

Clone, push, pull, sync, fetch, and serving a repository to a peer all live behind an off-by-default build feature, because they link the TLS transport that on Windows requires the MSVC toolchain. A default build gives you named-remote configuration but not the transfers themselves, and the Remotes view hides the transfer controls when the build reports it cannot do them. If your desktop build has no sync buttons, that is why — not a bug.

Same repository, same rules

The desktop app and the CLI share the on-disk format and the keychain slot, so a repository open in both stays consistent: a desktop commit is visible to tovio log immediately, and because every desktop write records an op-log entry, tovio undo in a terminal reverses a desktop-made change.

Permissions are enforced in the engine, so no client can present a more permissive view than your clearance allows.

Platform notes

Windows needs the MSVC toolchain and the WebView2 runtime (preinstalled on current Windows 10 and 11). Linux needs the WebKitGTK development packages. Installers exist as a build target but signed installers are still an open item.

Reporting problems

Use the Bugs & rough edges board and set the Surface field to Desktop. Pre-release feedback on this surface is genuinely useful, because it has had less exposure than the CLI.