feat: add optional github gist sync for the desktop app

README.md

@@ -18,7 +18,7 @@
 ## Features
 
 - **Lightweight** — Tauri 2 on the system WebView: 10 MB on macOS, ~70 MB RAM idle.
-- **Local-first** — documents are plain `.xmind` files on disk, no account, nothing uploaded.
+- **Local-first** — documents are plain `.xmind` files on disk. Nothing is uploaded unless you turn on optional GitHub sync and explicitly push a map.
 - **Real folders** — organise documents in folders under `~/Documents/Mind`, so the file manager and the app always agree.
 - **Two views of one document** — a classic mind map, or a Mermaid `mindmap` source with live preview.
 - **Full editor** — 14 layouts, 50+ themes, dark mode, rich text, notes, tags, images, formulas and an outline view.
@@ -66,6 +66,40 @@ make bootstrap # toolchain only
 
 AI generation reads `baseUrl`, `model` and `apiKey` from `ai.json` in the app config folder.
 
+## Optional GitHub sync
+
+The desktop app can push the open map to a **secret GitHub Gist**. This is off until you sign in and choose Push. A fresh install, and the browser build, stay local-only: nothing is uploaded in the background, and `~/Documents/Mind` remains the source of truth.
+
+Sync uses GitHub's OAuth **Device Flow** (`gist` and `read:user`). The app embeds or reads a public **Client ID** only. There is no `client_secret` in the client. The access token is stored next to `ai.json` in `github.json` (mode `0600` on Unix). Sign out deletes that token.
+
+Push writes the open map as JSON (the full document) or, if you choose it, Markdown (an outline). The file is text, not a `.xmind` zip. GitHub Gists are about **1 MB**; a larger map is refused with an error instead of being truncated. Pull asks before it replaces a local file. Gists created here are secret: they are not listed on your profile, but anyone with the link can open them.
+
+| System  | Config folder                                         |
+| ------- | ----------------------------------------------------- |
+| macOS   | `~/Library/Application Support/com.huanyuli.mindmap/` |
+| Linux   | `~/.local/share/com.huanyuli.mindmap/`                |
+| Windows | `%APPDATA%\com.huanyuli.mindmap\`                     |
+
+### Configure the OAuth App
+
+These steps are for the maintainer. They are not done by the app.
+
+1. Create an OAuth App at <https://github.com/settings/developers>.
+2. Homepage URL can be this repository. The form requires an authorization callback URL; Device Flow does not use it. `http://127.0.0.1` is enough.
+3. On the app's settings page, enable **Device Flow**.
+4. Copy the **Client ID**. Do not generate a client secret for this flow. If GitHub shows one, do not put it in the app, the repo, or CI.
+5. Provide the Client ID in one of these ways, with no production placeholder checked in:
+   - Runtime or compile time: `MIND_GITHUB_CLIENT_ID=YOUR_CLIENT_ID`. `make dev` and `make desktop` both see it. A value set while compiling the desktop crate is embedded with `option_env!`; a value set when the app starts overrides it.
+   - Or set `clientId` in `github.json` in the config folder above. Leave `accessToken` empty; the sign-in flow fills it in.
+
+```bash
+MIND_GITHUB_CLIENT_ID=YOUR_CLIENT_ID make dev
+```
+
+### Developer Program
+
+To apply for the GitHub Developer Program, use <https://github.com/developer/register> with this integration (Gists API via OAuth Device Flow) and a support email you monitor. A development build is enough to apply. This repository does not publish a support address.
+
 ## Contributing
 
 Issues and pull requests follow [CONTRIBUTING.md](CONTRIBUTING.md): use the issue forms, keep one concern per change, and run the checks listed there. Security problems should go through [SECURITY.md](SECURITY.md) rather than the public tracker.
@@ -74,4 +108,4 @@ Issues and pull requests follow [CONTRIBUTING.md](CONTRIBUTING.md): use the issu
 
 - Built on [SimpleMindMap](https://github.com/wanglin2/mind-map) by [wanglin2](https://github.com/wanglin2) — MIT, notice kept in [LICENSE](./LICENSE).
 - From upstream: the editor, the `simple-mind-map/` engine, the themes and most icons.
-- Added by this fork: the Tauri shell, dark mode, Mermaid authoring, AI generation and a local file library.
+- Added by this fork: the Tauri shell, dark mode, Mermaid authoring, AI generation, a local file library, and optional GitHub Gist sync.

desktop/src-tauri/build.rs

@@ -28,6 +28,15 @@ fn main() {
             "ai_config_status",
             "reveal_ai_config",
             "ai_complete",
+            "github_status",
+            "github_auth_start",
+            "github_auth_poll",
+            "github_auth_cancel",
+            "github_sign_out",
+            "github_open_url",
+            "github_push",
+            "github_pull",
+            "github_list_gists",
             "desktop_version",
             "check_update",
             "install_update",

desktop/src-tauri/capabilities/default.json

@@ -42,6 +42,15 @@
     "allow-ai-config-status",
     "allow-reveal-ai-config",
     "allow-ai-complete",
+    "allow-github-status",
+    "allow-github-auth-start",
+    "allow-github-auth-poll",
+    "allow-github-auth-cancel",
+    "allow-github-sign-out",
+    "allow-github-open-url",
+    "allow-github-push",
+    "allow-github-pull",
+    "allow-github-list-gists",
     "allow-desktop-version",
     "allow-check-update",
     "allow-install-update",