Integrate desktop authoring line into core TMCP

.github/workflows/ci.yml

@@ -4,6 +4,7 @@ on:
   pull_request:
     branches:
       - main
+      - feature/desktop
 
 jobs:
   build:
@@ -36,6 +37,9 @@ jobs:
       - name: Build
         run: npm run build
 
+      - name: Build desktop variant
+        run: npm run build:desktop
+
       - name: Build Docker image
         run: npm run build:docker
 

.github/workflows/publish.yml

@@ -20,6 +20,13 @@ jobs:
           npm install -g npm@latest
           npm ci
           npm run build
+          # Build the desktop variant into the same build/ dir. --dirty preserves the
+          # default build/index.js emitted above (a non-dirty desktop build would wipe it).
+          npx tsx src/scripts/build.ts --variant desktop --dirty
+          # Fail the publish if either entry point or the staged desktop data is missing.
+          test -f build/index.js
+          test -f build/index.desktop.js
+          test -d build/desktop/data
           npm publish
   upload-mcpb:
     runs-on: ubuntu-latest

.github/workflows/upload-binaries.yml

@@ -19,27 +19,20 @@ jobs:
           git fetch --tags
           git checkout -b sea-linux ${{ github.event.release.tag_name }}
           npm ci
-          npm run build
-          node --experimental-sea-config sea-config.json
-          cp $(command -v node) tableau-mcp
-          npx -y postject tableau-mcp NODE_SEA_BLOB sea-prep.blob --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2
+          npm run build:sea -- --platform linux-x64
+          cp build/sea/default/linux-x64/tableau-mcp tableau-mcp
+          cp build/sea/desktop/linux-x64/tableau-mcp-desktop tableau-mcp-desktop
           echo "SERVER=${{ secrets.E2E_TEST_SERVER }}" > .env
           echo "AUTH=${{ secrets.E2E_TEST_AUTH }}" >> .env
           echo "SITE_NAME=${{ secrets.E2E_TEST_SITE_NAME }}" >> .env
           echo "JWT_SUB_CLAIM=${{ secrets.E2E_TEST_JWT_SUB_CLAIM }}" >> .env
           echo "CONNECTED_APP_CLIENT_ID=${{ secrets.E2E_TEST_CONNECTED_APP_CLIENT_ID }}" >> .env
           echo "CONNECTED_APP_SECRET_ID=${{ secrets.E2E_TEST_CONNECTED_APP_SECRET_ID }}" >> .env
           echo "CONNECTED_APP_SECRET_VALUE=${{ secrets.E2E_TEST_CONNECTED_APP_SECRET_VALUE }}" >> .env
-          ./tableau-mcp &
-          if [ $? -eq 0 ]; then
-            echo "tableau-mcp started successfully"
-            rm .env
-            pkill -f tableau-mcp
-          else
-            echo "tableau-mcp failed to start"
-            exit 1
-          fi
-          tar -czf tableau-mcp.tar.gz tableau-mcp
+          trap 'rm -f .env' EXIT
+          npx tsx src/scripts/seaSmoke.ts ./tableau-mcp
+          npx tsx src/scripts/seaSmoke.ts ./tableau-mcp-desktop --require-tool bind-template
+          tar -czf tableau-mcp.tar.gz tableau-mcp tableau-mcp-desktop
       - name: Upload archive to release
         run: |
           gh release upload ${{github.event.release.tag_name}} tableau-mcp.tar.gz
@@ -61,11 +54,9 @@ jobs:
           git fetch --tags
           git checkout -b sea-windows ${{ github.event.release.tag_name }}
           npm ci
-          npm run build
-
-          node --experimental-sea-config sea-config.json
-          node -e "require('fs').copyFileSync(process.execPath, 'tableau-mcp.exe')"
-          npx -y postject tableau-mcp.exe NODE_SEA_BLOB sea-prep.blob --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2
+          npm run build:sea -- --platform win-x64
+          Copy-Item -Path .\build\sea\default\win-x64\tableau-mcp.exe -Destination .\tableau-mcp.exe
+          Copy-Item -Path .\build\sea\desktop\win-x64\tableau-mcp-desktop.exe -Destination .\tableau-mcp-desktop.exe
 
           "SERVER=${{ secrets.E2E_TEST_SERVER }}" | Out-File -FilePath ".env" -Encoding UTF8
           "AUTH=${{ secrets.E2E_TEST_AUTH }}" | Out-File -FilePath ".env" -Append -Encoding UTF8
@@ -75,18 +66,19 @@ jobs:
           "CONNECTED_APP_SECRET_ID=${{ secrets.E2E_TEST_CONNECTED_APP_SECRET_ID }}" | Out-File -FilePath ".env" -Append -Encoding UTF8
           "CONNECTED_APP_SECRET_VALUE=${{ secrets.E2E_TEST_CONNECTED_APP_SECRET_VALUE }}" | Out-File -FilePath ".env" -Append -Encoding UTF8
 
-          Start-Process -FilePath .\tableau-mcp.exe -NoNewWindow -ErrorAction SilentlyContinue
-          $processId = Get-Process -Name tableau-mcp -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id
-
-          if ($processId) {
-            Write-Host "tableau-mcp.exe is running"
+          try {
+            npx tsx src/scripts/seaSmoke.ts .\tableau-mcp.exe
+            if ($LASTEXITCODE -ne 0) {
+              throw "tableau-mcp.exe smoke failed"
+            }
+            npx tsx src/scripts/seaSmoke.ts .\tableau-mcp-desktop.exe --require-tool bind-template
+            if ($LASTEXITCODE -ne 0) {
+              throw "tableau-mcp-desktop.exe smoke failed"
+            }
+          } finally {
             Remove-Item -Path .\.env -Force
-            Stop-Process -Id $processId -Force
-          } else {
-            Write-Host "tableau-mcp.exe failed to start"
-            exit 1
           }
-          Compress-Archive -Path tableau-mcp.exe -DestinationPath tableau-mcp.zip
+          Compress-Archive -Path tableau-mcp.exe, tableau-mcp-desktop.exe -DestinationPath tableau-mcp.zip
       - name: Upload zip to release
         run: |
           gh release upload ${{github.event.release.tag_name}} tableau-mcp.zip

.gitignore

@@ -3,7 +3,7 @@
 .env.*
 .vscode/
 build/
-cache/
+/cache/
 node_modules/
 junit/
 coverage/

AGENTS.md

@@ -6,7 +6,7 @@ Repo-level contract for the global agent OS. Defines what "correct" means in `ta
 
 ## Project overview
 
-`@tableau/mcp-server` — an MCP server "helping agents see and understand data." Exposes Tableau capabilities to MCP clients over stdio and HTTP. Ships multiple build variants (default web, **desktop**, combined) from one codebase via `src/scripts/build.ts` + esbuild conditional bundling. An active migration on `feature/authoring` ports Tableau Desktop *authoring* tools from the `agent-to-tableau-desktop` repo into `src/tools/desktop/`.
+`@tableau/mcp-server` — an MCP server "helping agents see and understand data." Exposes Tableau capabilities to MCP clients over stdio and HTTP. Ships multiple build variants (default web, **desktop**, combined) from one codebase via `src/scripts/build.ts` + esbuild conditional bundling. An active migration on `feature/authoring` ports Tableau Desktop *authoring* tools from the `agent-to-tableau-desktop` repo/source implementation into `src/tools/desktop/`.
 
 ## Architecture
 

README.desktop.md

@@ -1 +1,88 @@
 # Tableau Desktop Authoring MCP
+
+The **desktop** build variant of `@tableau/mcp-server`. Where the default variant talks to
+Tableau Cloud/Server over REST, this variant exposes a **local authoring** tool surface that
+drives a running **Tableau Desktop** instance — inspect a workbook, list/inject chart
+templates, and bind fields into worksheets — over MCP (stdio).
+
+This document is a from-source quickstart. The desktop variant is **not** yet built by the
+publish pipeline (see [Known gaps](#known-gaps)); build it from a clone.
+
+## The binder tool surface
+
+Alongside the workbook/worksheet/dashboard/field tools, four tools drive the fast-path
+chart binder:
+
+- **`list-templates`** — list the bundled chart templates with each one's chart-intent
+  family, slot contract, and `fast_path_eligible` status. Works **headless** (no Desktop
+  needed) — it reads the in-package snapshot.
+- **`propose-template`** — Call 1: given a natural-language ask and the live workbook,
+  return candidate templates + a strict `output_schema` for the caller to fill into a
+  binding proposal (slot_id → field), or a deterministic no-LLM match when one is found.
+- **`validate-proposal`** — Call 2 (dry run): run a filled proposal through the binder's
+  deterministic gate (slot coverage, field/kind/role, derivation legality, confidence
+  floor) and report valid/invalid **without** creating or applying a worksheet.
+- **`bind-template`** — the full two-call flow: validate a filled proposal and, when valid,
+  return the injector-ready args plus the apply instruction.
+
+Typical flow: `propose-template` → fill the proposal → `validate-proposal` (dry run) →
+`bind-template` to get the apply instruction.
+
+## Build & run from source
+
+Requires Node.js `>=22.7.5`.
+
+```bash
+npm ci
+npm run build:desktop
+```
+
+The build emits the desktop entry point at **`build/index.desktop.js`** (the default
+variant's `build/index.js` is not produced by this command). It also stages the bundled
+authoring data under `build/desktop/data/` — this staging happens **only** for the desktop
+and combined variants.
+
+Point an MCP client at the entry over stdio:
+
+```json
+{
+  "mcpServers": {
+    "tableau-desktop": {
+      "command": "node",
+      "args": ["/absolute/path/to/tableau-mcp/build/index.desktop.js"]
+    }
+  }
+}
+```
+
+## Requirements
+
+- **`list-templates`** works headless against the bundled snapshot.
+- **`propose-template`**, **`validate-proposal`**, and **`bind-template`** read/drive a
+  **running Tableau Desktop** instance. Discover the instance with **`list-instances`** and
+  pass its session id (the Tableau Desktop PID) as the `session` argument to those tools.
+
+## Template content
+
+- Templates ship as a **bundled snapshot** inside the package, hash-verified against a
+  generated `content-manifest.json` (every resource carries a sha256 + byte count).
+- **17** chart templates are bundled today.
+- **`fast_path_eligible`** marks a template that is portable across the committed schema
+  fixture **and** carries a live render-verification stamp — the templates the binder can
+  one-shot. Ineligible templates report a `fast_path_blockers` entry explaining why (an
+  explicit blocker code, or a derived note such as "no live render verification stamp").
+- **Remote content packs** (fetching a signed, versioned pack instead of the bundled
+  snapshot) are a **documented milestone-2 skeleton only** — the verification/cache/fallback
+  contract exists behind the provider seam, but no transport is wired, so the server always
+  serves the bundled snapshot. Its status honestly reports `satisfies_exec_freshness: false`.
+
+## Known gaps
+
+Stated honestly so nobody is surprised:
+
+- The **search tools** (`search-examples`, `search-commands`, `search-workbook-examples`,
+  `lookup-workbook-schema`) resolve their data **relative to the current working directory**,
+  so they are effectively **dev-only** (run from a repo checkout) and are not reachable from
+  a packaged install.
+- The **publish pipeline does not yet build this variant** — the desktop authoring server is
+  **from-source only** for now.

README.md

@@ -50,6 +50,52 @@ The quickest way to run Tableau MCP locally. Requires [Node.js](https://nodejs.o
 
 For Docker, building from source, and other self-hosted options, see the [Getting Started guide](https://tableau.github.io/tableau-mcp/docs/getting-started).
 
+### Tableau Desktop Authoring Server (from source)
+
+The **desktop** build variant exposes a local authoring tool surface that drives a running Tableau Desktop instance over MCP stdio. It can inspect workbooks, list/inject chart templates, bind fields into worksheets, and work with dashboards.
+
+Build it from a clone with Node.js 22.7.5 or later:
+
+```bash
+npm run build:desktop
+```
+
+Point an MCP client at the desktop entry:
+
+```json
+{
+  "mcpServers": {
+    "tableau-desktop": {
+      "command": "node",
+      "args": ["/absolute/path/to/tableau-mcp/build/index.desktop.js"]
+    }
+  }
+}
+```
+
+Headless reference tools such as `list-templates` read the bundled snapshot. Tools that inspect or mutate a workbook require a running Tableau Desktop instance; use `list-instances` and pass the returned `session` id to those calls.
+
+See [`README.desktop.md`](README.desktop.md) for the full desktop authoring quickstart and known gaps.
+
+## Standalone Binaries (SEA)
+
+The server can be packaged as a [Node.js Single Executable Application](https://tableau.github.io/tableau-mcp/docs/extras/node-sea)
+so it runs without a Node.js install. Build them locally with:
+
+```bash
+npm run build:sea            # default (web) + desktop variants, host platform
+npm run build:sea:desktop    # desktop variant only
+
+# Pick variants/platforms explicitly:
+npm run build:sea -- --variant desktop --platform macos-arm64 macos-x64 win-x64
+```
+
+Output lands in `build/sea/<variant>/<platform>/`. Platforms: `macos-arm64`, `macos-x64`,
+`linux-x64`, `linux-arm64`, `win-x64`. macOS binaries are ad-hoc codesigned when built on a
+macOS host. Each binary is fully self-contained: the desktop variant's knowledge, data,
+templates, and examples are embedded into the executable as SEA assets, so it can be
+distributed and run as a single file with no sibling folders.
+
 ## Deploy to Heroku
 
 [![Deploy to Heroku](https://www.herokucdn.com/deploy/button.svg)](https://www.heroku.com/deploy?template=https://github.com/tableau/tableau-mcp)