shkSecurity Harness Kit

DocsGuides

Desktop App

shk Desktop is a local GUI for project scanning, AI-oriented masking, setup automation, and audit review, with OS notifications when a hook blocks AI activity.

On this page

The shk Desktop app provides a local GUI for project scanning, AI-oriented masking, setup automation, and audit review. It bundles the same engine as the CLI, so findings and policies stay consistent between the two.

While it is open it also raises an OS notification when a hook blocks AI activity in any of your projects, so an agent running in the background is visible without switching to the app.

What the app does

  • Projects — Open a folder or clone a Git repository, then keep it in the sidebar with a per-project findings badge and last-scan time.
  • Scan — Run a full project scan and browse findings by severity, rule, and file.
  • Quick Setup — Apply recommended fixes in one step: create shk.toml, patch .gitignore, install the Git pre-commit hook, install AI tool hooks, encrypt .env files, apply npm hardening, and install agent skills.
  • AI Mask — Paste or open text, Office documents, and text-layer PDFs, mask findings using the selected project's policy, and copy the safe result into your preferred AI app. PDF masking is desktop-only; the CLI shk mask does not accept PDFs.
  • Blocked AI activity — Review metadata-only audit entries from .shk/audit.log for every project in the sidebar.
  • Open in app — Jump to the project in Cursor, VS Code, Antigravity, Claude Desktop, or ChatGPT.
  • Language — The interface is available in English and Japanese.

Keyboard shortcuts: ⌘O open a project, ⌘R run a scan, ⌘M open the mask workspace, ⌘⇧N return to the welcome screen. On Windows and Linux, use Ctrl in place of ⌘.

Installation

The desktop app is distributed separately from the CLI. Releases are published from desktop-vX.Y.Z (or combined shk-vX.Y.Z) tags as shk-desktop_* assets on GitHub Releases. Starting with desktop-v0.6.0, macOS builds are Developer ID signed, notarized, and stapled. Windows installers are currently not Authenticode-signed.

Choose an installer

Platform Asset pattern Notes
Linux x86_64 shk-desktop_*_x86_64-unknown-linux-gnu_*.AppImage or *.deb AppImage needs chmod +x
Linux aarch64 shk-desktop_*_aarch64-unknown-linux-gnu_*.AppImage or *.deb Same as above
macOS Intel shk-desktop_*_x86_64-apple-darwin_*.dmg Signed and notarized; drag shk.app to /Applications
macOS Apple Silicon shk-desktop_*_aarch64-apple-darwin_*.dmg Same as above
Windows x86_64 shk-desktop_*_x86_64-pc-windows-msvc_*setup.exe or *.msi Currently unsigned

Download from the release page for your tag, for example:

https://github.com/Kazuki-tam/security-harness-kit/releases/tag/desktop-v0.7.0
text

Verify checksums when available:

curl -LO https://github.com/Kazuki-tam/security-harness-kit/releases/download/desktop-v0.7.0/shk-desktop.sha256sum
sha256sum -c shk-desktop.sha256sum
bash

macOS

Installers from desktop-v0.6.0 onward are Developer ID signed and notarized; Gatekeeper opens them without workarounds. If you still run an older unsigned early access build, replace it with a signed .dmg install. The in-app updater also migrates existing installs because all releases share the same Tauri updater signing keys.

Windows SmartScreen

Windows installers are currently not Authenticode-signed, so SmartScreen may show Windows protected your PC. Choose More info → Run anyway if you trust the release checksum and attestation.

Blocked-activity notifications

While the app is open it tails .shk/audit.log for every project in the sidebar and raises an OS notification when a hook blocks AI activity. The bell menu in the top bar turns notifications off, or narrows them to one kind of block; both kinds are on by default.

Details worth knowing:

  • Only blocks recorded after a project appears in the sidebar are announced. Existing history never produces a backlog of notifications.
  • Blocks arriving within a few seconds collapse into a single notification.
  • Notification text is limited to the block reason, the risky-action category, and the AI tool. File paths are deliberately left out, because notifications render on the lock screen and are persisted by the OS; use the Blocked AI activity panel to see them.
  • Turning notifications off stops the banners, not the tailing: the audit panel still updates while the app is open.
  • The first block prompts for OS notification permission. On macOS the installed app appears as shk; a tauri dev binary sends through the Terminal identity instead, so allow Terminal notifications when testing.
  • No banner but blocks listed in the panel almost always means macOS is suppressing display: check Focus mode, and the per-app notification style in System Settings → Notifications.

In-app updates

The desktop app checks desktop-latest/latest.json on GitHub for updater metadata. Updater packages are always signed with the project Tauri updater key, independent of OS code signing.