diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index 0d9ae9d..44eb019 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -48,3 +48,64 @@ jobs:
           go test ./...
       - name: Vulnerability scan
         run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
+
+  # Scaffold a real full-stack project, install it, set up the DB and hit the
+  # /health-check endpoint. Catches runtime breakage that `go test` can't (e.g.
+  # a bad DATABASE_URL that only fails when the app actually opens the DB).
+  scaffold-smoke:
+    if: |
+      (github.event.action == 'review_requested' ||
+      (github.event.action == 'labeled' && github.event.label.name == 'ci-testing') ||
+      (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'ci-testing'))) ||
+      (github.event_name == 'push')
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # sqlite needs no Docker service, so both ORMs run on the cheap runner.
+          - orm: drizzle
+            setup_db: pnpm run db:generate && pnpm run db:migrate
+          - orm: prisma
+            # `prisma migrate dev` is interactive; `db push` syncs the schema
+            # non-interactively for the smoke test.
+            setup_db: pnpm run db:generate && pnpm exec prisma db push
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25.x"
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+      - name: Build CLI
+        run: go build -o bungkus-cli .
+      - name: Scaffold ${{ matrix.orm }} + sqlite
+        run: ./bungkus-cli create app --base astro-react --backend hono --orm ${{ matrix.orm }} --db sqlite --layout flat --pm pnpm --git=false
+      - name: Install, set up DB, seed
+        working-directory: app
+        run: |
+          cp .env.example .env
+          pnpm install
+          ${{ matrix.setup_db }}
+          pnpm run db:seed
+      - name: Boot API and verify /health-check
+        working-directory: app
+        run: |
+          pnpm run dev:server > server.log 2>&1 &
+          for i in $(seq 1 30); do
+            body=$(curl -s http://localhost:8000/health-check || true)
+            if echo "$body" | grep -q '"status":"ok"'; then
+              echo "health-check: $body"
+              echo "$body" | grep -q '"db":"connected"' || { echo "FAIL: db not connected"; exit 1; }
+              echo "$body" | grep -q 'Ada Lovelace' || { echo "FAIL: seed rows missing"; exit 1; }
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "FAIL: /health-check never came up"; cat server.log; exit 1
diff --git a/README.md b/README.md
index 03011d5..aeaa072 100644
--- a/README.md
+++ b/README.md
@@ -118,12 +118,21 @@ my-app/
     domain/              # shared contract: zod schemas (with --validation zod) or plain types
 ```
 
-- **`--backend hono`** runs on Node via `tsx`; **`--backend elysia`** runs on Bun. `pnpm dev` runs `apps/web` and `apps/api` together.
-- **`--orm drizzle` / `--orm prisma`** add the config, a `db/` client, and `.env.example` under `apps/api`. `web` and `api` both depend on `packages/domain` via `workspace:*`.
+- **`--backend hono`** runs on Node via `tsx`; **`--backend elysia`** runs on Bun. `pnpm dev` runs `apps/web` (`http://localhost:3000`) and `apps/api` (`http://localhost:8000`) together. Every backend exposes `GET /health-check`; with an ORM selected it also runs a read-only query against the database and returns the rows, so you can confirm the DB wiring end-to-end.
+- **`--orm drizzle` / `--orm prisma`** add the config, a `db/` client, `.env.example`, and `db:generate` / `db:migrate` / `db:seed` scripts under `apps/api`. `db:seed` inserts a couple of dummy rows so a fresh DB (and `/health-check`) returns real data. `web` and `api` both depend on `packages/domain` via `workspace:*`.
 - **`--db postgres` / `--db mysql`** also generate a root `docker-compose.yml` whose credentials match `.env.example`, so `docker compose up -d` gives you a working database. `sqlite` needs nothing extra; `d1` targets Cloudflare Workers (pair with `--deploy cloudflare-workers`).
 
 The post-scaffold summary prints the get-started steps for your exact combo (install, dev, and — when a server database is selected — `docker compose up -d` plus the `db:generate` / `db:migrate` commands).
 
+### AI-agent-ready
+
+Every scaffolded project ships with files that make it work well with Claude Code and other AI agents out of the box:
+
+- **`AGENTS.md`** (and a `CLAUDE.md` pointing to it) — describes your *exact* stack: real commands, both dev URLs, the monorepo map, the ORM/DB workflow, and the `/health-check` probe.
+- **`.claude/settings.json`** — a permission allowlist for routine dev commands (package manager, `docker compose` when a server DB is selected, `wrangler` for Cloudflare, read-only git) so agents don't stall on prompts.
+- **`.claude/commands/`** — project slash-commands: `/verify` (typecheck + build + test, and curl the health-check), `/format-fix`, and `/new-component` (follows the repo's naming + JSDoc conventions).
+- **`.mcp.json`** — with `--test playwright`, a Playwright MCP server so an agent can drive the running app in a browser.
+
 ## Project Structure
 
 ```
diff --git a/clean.sh b/clean.sh
new file mode 100755
index 0000000..bcc875a
--- /dev/null
+++ b/clean.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env sh
+# Remove the scaffolded my-app folder (dev cleanup). Pass a name to remove a
+# different folder: ./clean.sh some-app
+target="${1:-my-app}"
+if [ -e "$target" ]; then
+  rm -rf "$target"
+  echo "Removed $target"
+else
+  echo "Nothing to remove: $target does not exist"
+fi
diff --git a/cmd/add.go b/cmd/add.go
new file mode 100644
index 0000000..e7c1e19
--- /dev/null
+++ b/cmd/add.go
@@ -0,0 +1,159 @@
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/spencer-osbrjp/bungkus-cli/config"
+	"github.com/spencer-osbrjp/bungkus-cli/pkg"
+	"github.com/spf13/cobra"
+)
+
+var addCmd = &cobra.Command{
+	Use:   "add <option> [dir]",
+	Short: "Add a tool to an existing project.",
+	Long: `Add a tool from the bungkus registry to an existing project without
+touching your code.
+
+Renders the option's config templates into the project (existing files are
+NEVER overwritten — they are skipped and reported) and additively merges the
+option's dependencies and scripts into package.json (existing versions and
+scripts are never changed; other package.json fields, key order, and the
+file's own indent style are preserved).
+
+GitHub Actions workflow files (.github/**) are always written to the git
+repository root, even when adding inside a subdirectory such as apps/web.
+
+The package manager is detected from package.json's packageManager field or
+a lockfile (searched upward to the git root), and the base framework from
+package.json dependencies; use --pm / --base to override. Run "bungkus-cli
+add" with no option to list what can be added.`,
+	Args: cobra.MaximumNArgs(2),
+	RunE: runAdd,
+}
+
+func init() {
+	rootCmd.AddCommand(addCmd)
+	addCmd.Flags().String("pm", "", "Package manager override (pnpm, bun, npm, yarn); detected otherwise")
+	addCmd.Flags().String("base", "", "Base framework override; detected from package.json otherwise")
+	addCmd.Flags().String("deploy", "", "Deploy target for CI/CD options (cloudflare-pages, cloudflare-workers)")
+}
+
+func printAddable() {
+	fmt.Println("Addable options:")
+	for _, c := range pkg.AddableOptions() {
+		fmt.Printf("  %-8s %s\n", c.Name+":", strings.Join(c.Options, ", "))
+	}
+	fmt.Println("\ncicd options require --deploy.")
+}
+
+func runAdd(cmd *cobra.Command, args []string) error {
+	if len(args) == 0 {
+		printAddable()
+		return nil
+	}
+	opt := args[0]
+	dir := "."
+	if len(args) == 2 {
+		dir = args[1]
+	}
+
+	raw, err := os.ReadFile(filepath.Join(dir, "package.json"))
+	if err != nil {
+		return fmt.Errorf("no package.json found in %s — 'add' works on an existing project (use 'create' to scaffold a new one)", dir)
+	}
+	cfg, err := pkg.DetectProject(dir, raw)
+	if err != nil {
+		return err
+	}
+	if cmd.Flags().Changed("pm") {
+		v, _ := cmd.Flags().GetString("pm")
+		cfg.PM = pkg.PackageManager(v)
+	}
+	if cmd.Flags().Changed("base") {
+		v, _ := cmd.Flags().GetString("base")
+		cfg.Base = pkg.BaseFramework(v)
+	}
+	if cmd.Flags().Changed("deploy") {
+		v, _ := cmd.Flags().GetString("deploy")
+		cfg.Deployment = pkg.DeployTarget(v)
+	}
+	if cfg.PM == "" {
+		return fmt.Errorf("could not detect the package manager (no or ambiguous lockfile) — pass --pm (pnpm, bun, npm, yarn)")
+	}
+	if !cfg.PM.IsValid() {
+		return fmt.Errorf("invalid package manager: %s (pnpm, bun, npm, yarn)", cfg.PM)
+	}
+	if cfg.Base == "" {
+		return fmt.Errorf("could not detect the base framework from package.json — pass --base (astro, astro-react, astro-vue, nuxt, vite, vite-react, vite-vue)")
+	}
+	if !cfg.Base.IsValid() {
+		return fmt.Errorf("invalid base framework: %s", cfg.Base)
+	}
+	if cfg.Deployment != "none" && !cfg.Deployment.IsValid() {
+		return fmt.Errorf("invalid deploy target: %s (cloudflare-pages, cloudflare-workers)", cfg.Deployment)
+	}
+
+	rep, err := pkg.Add(dir, config.Templates, cfg, opt)
+	if errors.Is(err, pkg.ErrUnknownAddOption) {
+		fmt.Printf("unknown option %q\n\n", opt)
+		printAddable()
+		return errors.New("nothing added")
+	}
+	if err != nil {
+		return err
+	}
+	printAddReport(rep, dir, opt, cfg)
+	return nil
+}
+
+func printAddReport(rep *pkg.AddReport, dir, opt string, cfg pkg.ProjectConfig) {
+	fmt.Printf("Added %s (%s) to %s\n\n", opt, strings.Join(rep.Categories, ", "), dir)
+	for _, f := range rep.CreatedFiles {
+		if strings.HasPrefix(f, "..") {
+			fmt.Printf("  created   %s   (repo root)\n", f)
+		} else {
+			fmt.Printf("  created   %s\n", f)
+		}
+	}
+	for _, f := range rep.SkippedFiles {
+		fmt.Printf("  skipped   %s (already exists — kept yours)\n", f)
+	}
+	if len(rep.DepsAdded)+len(rep.DepsSkipped)+len(rep.ScriptsAdded)+len(rep.ScriptsSkipped) > 0 {
+		fmt.Println("\n  package.json:")
+		for _, d := range rep.DepsAdded {
+			fmt.Printf("    + %s\n", d)
+		}
+		for _, s := range rep.ScriptsAdded {
+			fmt.Printf("    + scripts  %s\n", s)
+		}
+		for _, d := range rep.DepsSkipped {
+			fmt.Printf("    = %s (already present — kept yours)\n", d)
+		}
+		for _, s := range rep.ScriptsSkipped {
+			fmt.Printf("    = scripts  %s (already defined — kept yours)\n", s)
+		}
+	}
+
+	if rep.WorkflowRelocated {
+		fmt.Printf("\n  note: workflow(s) written to %s/.github — review job steps if this is a monorepo.\n", rep.GitRoot)
+	}
+	if rep.NoGitWarning {
+		for _, f := range rep.CreatedFiles {
+			if strings.HasPrefix(filepath.ToSlash(f), ".github/") {
+				fmt.Printf("\n  warning: no git repository found — .github/ written under %s;\n", dir)
+				fmt.Println("  GitHub Actions only reads .github/ at the repo root.")
+				break
+			}
+		}
+	}
+
+	if rep.PkgJSONChanged {
+		fmt.Printf("\nRun `%s` to install the new dependencies.\n", cfg.PM.InstallCmd())
+	} else if len(rep.CreatedFiles) == 0 {
+		fmt.Printf("\nNothing to do — everything %s provides already exists.\n", opt)
+	}
+}
diff --git a/cmd/create.go b/cmd/create.go
index bc5ee77..4dec276 100644
--- a/cmd/create.go
+++ b/cmd/create.go
@@ -182,6 +182,10 @@ to scaffold into the current directory.`,
 			v, _ := cmd.Flags().GetString("audit")
 			cfg.Audit = pkg.AuditTool(v)
 		}
+		if cmd.Flags().Changed("desktop") {
+			v, _ := cmd.Flags().GetString("desktop")
+			cfg.Desktop = pkg.DesktopTarget(v)
+		}
 		if cmd.Flags().Changed("backend") {
 			v, _ := cmd.Flags().GetString("backend")
 			cfg.Backend = pkg.BackendLib(v)
@@ -264,6 +268,9 @@ to scaffold into the current directory.`,
 		if cfg.CICD != "none" && cfg.Deployment == "none" {
 			return fmt.Errorf("--cicd requires a deploy target (--deploy cloudflare-pages or --deploy cloudflare-workers)")
 		}
+		if !cfg.Desktop.IsValid() {
+			return fmt.Errorf("invalid desktop shell: %s (none, tauri)", cfg.Desktop)
+		}
 		if !cfg.Backend.IsValid() {
 			return fmt.Errorf("invalid backend: %s (none, hono, elysia)", cfg.Backend)
 		}
@@ -333,6 +340,7 @@ func init() {
 	createCmd.Flags().String("cms", "none", "CMS (none, microcms)")
 	createCmd.Flags().String("test", "none", "Testing library (none, playwright)")
 	createCmd.Flags().String("audit", "none", "Audit / performance tool (none, lhci)")
+	createCmd.Flags().String("desktop", "none", "Desktop shell (none, tauri)")
 	createCmd.Flags().StringP("template", "t", "", "Predefined template (astro, astro-react, astro-vue, nuxt, vite, vite-react, vite-vue)")
 	createCmd.Flags().String("deploy", "none", "Deployment target (none, cloudflare-pages, cloudflare-workers)")
 	createCmd.Flags().String("cicd", "none", "CI/CD provider (none, github-actions)")
diff --git a/config/registry.json b/config/registry.json
index 23a2de5..825bd08 100644
--- a/config/registry.json
+++ b/config/registry.json
@@ -249,7 +249,9 @@
         },
         "devDependencies": {
           "eslint": "^10.0.0",
-          "@eslint/js": "^10.0.0"
+          "@eslint/js": "^10.0.0",
+          "globals": "^17.4.0",
+          "typescript-eslint": "^8.58.0"
         }
       }
     },
@@ -546,6 +548,25 @@
       }
     }
   ],
+  "desktop": [
+    {
+      "value": "none",
+      "label": "None",
+      "packages": {}
+    },
+    {
+      "value": "tauri",
+      "label": "Tauri 2",
+      "packages": {
+        "scripts": {
+          "tauri": "tauri"
+        },
+        "devDependencies": {
+          "@tauri-apps/cli": "^2.11.4"
+        }
+      }
+    }
+  ],
   "backend": [
     {
       "value": "none",
@@ -564,7 +585,7 @@
           "tsx": "^4.19.2"
         },
         "scripts": {
-          "dev:server": "tsx watch server/index.ts"
+          "dev:server": "tsx watch --env-file-if-exists=.env server/index.ts"
         }
       }
     },
@@ -595,12 +616,14 @@
           "drizzle-orm": "^0.36.4"
         },
         "devDependencies": {
-          "drizzle-kit": "^0.28.1"
+          "drizzle-kit": "^0.28.1",
+          "tsx": "^4.19.2"
         },
         "scripts": {
           "db:generate": "drizzle-kit generate",
           "db:migrate": "drizzle-kit migrate",
-          "db:studio": "drizzle-kit studio"
+          "db:studio": "drizzle-kit studio",
+          "db:seed": "tsx --env-file-if-exists=.env db/seed.ts"
         }
       }
     },
@@ -612,12 +635,14 @@
           "@prisma/client": "^5.22.0"
         },
         "devDependencies": {
-          "prisma": "^5.22.0"
+          "prisma": "^5.22.0",
+          "tsx": "^4.19.2"
         },
         "scripts": {
           "db:generate": "prisma generate",
           "db:migrate": "prisma migrate dev",
-          "db:studio": "prisma studio"
+          "db:studio": "prisma studio",
+          "db:seed": "tsx --env-file-if-exists=.env prisma/seed.ts"
         }
       }
     }
diff --git a/config/templates/agent/mcp/.mcp.json b/config/templates/agent/mcp/.mcp.json
new file mode 100644
index 0000000..259a959
--- /dev/null
+++ b/config/templates/agent/mcp/.mcp.json
@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "playwright": {
+      "command": "npx",
+      "args": ["@playwright/mcp@latest"]
+    }
+  }
+}
diff --git a/config/templates/audit/lhci/.github/workflows/lhci.yml.tmpl b/config/templates/audit/lhci/.github/workflows/lhci.yml.tmpl
index d9520b7..046172e 100644
--- a/config/templates/audit/lhci/.github/workflows/lhci.yml.tmpl
+++ b/config/templates/audit/lhci/.github/workflows/lhci.yml.tmpl
@@ -1,9 +1,26 @@
+{{- $urls := "" }}{{- if not .Base.IsVite }}{{- $urls = " ${{ steps.affected.outputs.urls }}" }}{{- end -}}
 name: Lighthouse CI
+
+# Pull requests only. GitHub runs this against the merge result rather than the branch
+# head, so a post-merge run on the default branch would re-audit a tree that has already
+# passed — a full duplicate audit for every change.
+#
+# Run it by hand on any ref from Actions -> Run workflow, or:
+#   gh workflow run "Lighthouse CI" --ref main
 on:
-  push:
-    branches: [main, dev, staging, test]
   pull_request:
-    branches: [main, dev, staging, test]
+    branches: [main]
+    paths-ignore:
+      - '**/*.md'
+      - 'LICENSE'
+      - '.github/**'
+  workflow_dispatch:
+
+# Only the newest tree is worth measuring. Without this, several pushes in quick
+# succession each run a full audit through to completion.
+concurrency:
+  group: lhci-{{ "${{ github.ref }}" }}
+  cancel-in-progress: true
 
 jobs:
   lighthouseci:
@@ -11,6 +28,36 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+{{- if not .Base.IsVite }}
+      # A PR that only touches static page files can't change any other route's
+      # score, so audit just those routes instead of the full lighthouserc list.
+      # Anything shared (components, layouts, config), dynamic routes ([slug]),
+      # underscore partials, and non-HTML endpoints (rss.xml.ts) fall back to
+      # the full audit — narrowing must never skip a route a change could regress.
+      - name: Limit audit to changed pages
+        id: affected
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_SHA: {{ "${{ github.event.pull_request.base.sha }}" }}
+        run: |
+          pages_dir="{{ if .Base.IsNuxt }}app/pages{{ else }}src/pages{{ end }}"
+          git fetch --no-tags --depth=1 origin "$BASE_SHA"
+          urls=""
+          while IFS= read -r f; do
+            case "$f" in
+              "$pages_dir"/_* | "$pages_dir"/*/_* | "$pages_dir"/*\[* | "$pages_dir"/*.*.*)
+                urls=""; break ;;
+              "$pages_dir"/*)
+                route="${f#"$pages_dir"}"
+                route="${route%.*}"
+                route="${route%/index}"
+                urls="$urls --collect.url=http://localhost:3000${route:-/}"
+                ;;
+              *) urls=""; break ;;
+            esac
+          done < <(git diff --name-only --diff-filter=d "$BASE_SHA" HEAD)
+          echo "urls=$urls" >> "$GITHUB_OUTPUT"
+{{- end }}
 {{- if eq .PM "pnpm" }}
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
@@ -19,14 +66,14 @@ jobs:
           cache: pnpm
       - run: pnpm install
       - run: pnpm run build
-      - run: pnpx lhci autorun
+      - run: pnpx lhci autorun{{ $urls }}
         env:
           LHCI_GITHUB_APP_TOKEN: {{ "${{ secrets.LHCI_GITHUB_APP_TOKEN }}" }}
 {{- else if eq .PM "bun" }}
       - uses: oven-sh/setup-bun@v2
       - run: bun install
       - run: bun run build
-      - run: bunx lhci autorun
+      - run: bunx lhci autorun{{ $urls }}
         env:
           LHCI_GITHUB_APP_TOKEN: {{ "${{ secrets.LHCI_GITHUB_APP_TOKEN }}" }}
 {{- else if eq .PM "yarn" }}
@@ -36,7 +83,7 @@ jobs:
           cache: yarn
       - run: yarn install
       - run: yarn build
-      - run: yarn dlx @lhci/cli@0.15.x autorun
+      - run: yarn dlx @lhci/cli@0.15.x autorun{{ $urls }}
         env:
           LHCI_GITHUB_APP_TOKEN: {{ "${{ secrets.LHCI_GITHUB_APP_TOKEN }}" }}
 {{- else }}
@@ -46,7 +93,7 @@ jobs:
           cache: npm
       - run: npm install
       - run: npm run build
-      - run: npx --package=@lhci/cli@0.15.x lhci autorun
+      - run: npx --package=@lhci/cli@0.15.x lhci autorun{{ $urls }}
         env:
           LHCI_GITHUB_APP_TOKEN: {{ "${{ secrets.LHCI_GITHUB_APP_TOKEN }}" }}
 {{- end }}
diff --git a/config/templates/audit/lhci/lighthouserc.json.tmpl b/config/templates/audit/lhci/lighthouserc.json.tmpl
index fcd6874..f77cf90 100644
--- a/config/templates/audit/lhci/lighthouserc.json.tmpl
+++ b/config/templates/audit/lhci/lighthouserc.json.tmpl
@@ -3,14 +3,15 @@
     "collect": {
       "startServerCommand": "{{ .PM }} run preview --port 3000",
       "url": ["http://localhost:3000"],
-      "numberOfRuns": 3
+      "numberOfRuns": 1
     },
     "upload": {
       "target": "temporary-public-storage"
     },
     "assert": {
       "assertions": {
-        "categories:performance": ["error", { "minScore": 0.5 }]
+        "categories:performance": ["error", { "minScore": 0.5 }],
+        "categories:accessibility": ["warn", { "minScore": 0.9 }]
       }
     }
   }
diff --git a/config/templates/backend/elysia/server/index.ts.tmpl b/config/templates/backend/elysia/server/index.ts.tmpl
index baa0c2d..b23627d 100644
--- a/config/templates/backend/elysia/server/index.ts.tmpl
+++ b/config/templates/backend/elysia/server/index.ts.tmpl
@@ -1,7 +1,32 @@
 import { Elysia } from "elysia";
+{{- $orm := printf "%s" .ORM }}
+{{- $hasDb := and (ne $orm "none") (ne (printf "%s" .Database) "d1") }}
+{{- if $hasDb }}
+import { db } from "../db";
+{{- if eq $orm "drizzle" }}
+import { users } from "../db/schema";
+{{- end }}
+{{- end }}
 
 const app = new Elysia()
   .get("/", () => ({ message: "Hello from {{ .ProjectName }}" }))
-  .listen(Number(process.env.PORT ?? 3001));
+  // Health check — read-only; verifies the DB connection with a lightweight query.
+  .get("/health-check", async () => {
+{{- if $hasDb }}
+    try {
+{{- if eq $orm "drizzle" }}
+      const rows = await db.select().from(users);
+{{- else }}
+      const rows = await db.user.findMany();
+{{- end }}
+      return { status: "ok", db: "connected", users: rows };
+    } catch (err) {
+      return { status: "error", db: "disconnected", error: String(err) };
+    }
+{{- else }}
+    return { status: "ok" };
+{{- end }}
+  })
+  .listen(Number(process.env.PORT ?? 8000));
 
 console.log(`Server running on http://localhost:${app.server?.port}`);
diff --git a/config/templates/backend/hono/server/index.ts.tmpl b/config/templates/backend/hono/server/index.ts.tmpl
index c1033a5..718dfa6 100644
--- a/config/templates/backend/hono/server/index.ts.tmpl
+++ b/config/templates/backend/hono/server/index.ts.tmpl
@@ -1,11 +1,37 @@
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
+{{- $orm := printf "%s" .ORM }}
+{{- $hasDb := and (ne $orm "none") (ne (printf "%s" .Database) "d1") }}
+{{- if $hasDb }}
+import { db } from "../db";
+{{- if eq $orm "drizzle" }}
+import { users } from "../db/schema";
+{{- end }}
+{{- end }}
 
 const app = new Hono();
 
 app.get("/", (c) => c.json({ message: "Hello from {{ .ProjectName }}" }));
 
-const port = Number(process.env.PORT ?? 3001);
+// Health check — read-only; verifies the DB connection with a lightweight query.
+app.get("/health-check", async (c) => {
+{{- if $hasDb }}
+  try {
+{{- if eq $orm "drizzle" }}
+    const rows = await db.select().from(users);
+{{- else }}
+    const rows = await db.user.findMany();
+{{- end }}
+    return c.json({ status: "ok", db: "connected", users: rows });
+  } catch (err) {
+    return c.json({ status: "error", db: "disconnected", error: String(err) }, 503);
+  }
+{{- else }}
+  return c.json({ status: "ok" });
+{{- end }}
+});
+
+const port = Number(process.env.PORT ?? 8000);
 serve({ fetch: app.fetch, port }, (info) => {
   console.log(`Server running on http://localhost:${info.port}`);
 });
diff --git a/config/templates/base/nuxt/nuxt.config.ts.tmpl b/config/templates/base/nuxt/nuxt.config.ts.tmpl
index 1944d5b..c80f215 100644
--- a/config/templates/base/nuxt/nuxt.config.ts.tmpl
+++ b/config/templates/base/nuxt/nuxt.config.ts.tmpl
@@ -5,6 +5,10 @@ import tailwindcss from "@tailwindcss/vite";
 export default defineNuxtConfig({
   compatibilityDate: '{{.Date}}',
   devtools: { enabled: true },
+  {{- if eq .Desktop "tauri"}}
+  // Tauri wraps the static output (SSG); tauri.conf.json builds via `generate`.
+  ssr: false,
+  {{- end}}
   {{- if eq .Deployment "cloudflare-pages"}}
   nitro: {
     preset: 'cloudflare_pages',
diff --git a/config/templates/base/vite/vite.config.ts.tmpl b/config/templates/base/vite/vite.config.ts.tmpl
index d22f147..92cab4f 100644
--- a/config/templates/base/vite/vite.config.ts.tmpl
+++ b/config/templates/base/vite/vite.config.ts.tmpl
@@ -10,6 +10,10 @@ import vue from '@vitejs/plugin-vue'
 {{- end}}
 
 export default defineConfig({
+  {{- if eq .Desktop "tauri"}}
+  clearScreen: false,
+  server: { watch: { ignored: ["**/src-tauri/**"] } },
+  {{- end}}
   plugins: [
   {{- if eq .CSS "tailwindcss"}}
     tailwindcss(),
diff --git a/config/templates/desktop/tauri/src-tauri/.gitignore b/config/templates/desktop/tauri/src-tauri/.gitignore
new file mode 100644
index 0000000..b21bd68
--- /dev/null
+++ b/config/templates/desktop/tauri/src-tauri/.gitignore
@@ -0,0 +1,7 @@
+# Generated by Cargo
+# will have compiled files and executables
+/target/
+
+# Generated by Tauri
+# will have schema files for capabilities auto-completion
+/gen/schemas
diff --git a/config/templates/desktop/tauri/src-tauri/Cargo.toml.tmpl b/config/templates/desktop/tauri/src-tauri/Cargo.toml.tmpl
new file mode 100644
index 0000000..6678f6e
--- /dev/null
+++ b/config/templates/desktop/tauri/src-tauri/Cargo.toml.tmpl
@@ -0,0 +1,23 @@
+[package]
+name = "{{ .CrateName }}"
+version = "0.1.0"
+description = "{{ .ProjectName }} desktop app"
+edition = "2021"
+
+[lib]
+# `_lib` suffix avoids the lib/bin name clash on Windows (cargo#8519)
+name = "app_lib"
+crate-type = ["staticlib", "cdylib", "rlib"]
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+
+[dependencies]
+tauri = { version = "2", features = [] }
+
+[profile.release]
+codegen-units = 1
+lto = true
+opt-level = 3
+panic = "abort"
+strip = true
diff --git a/config/templates/desktop/tauri/src-tauri/build.rs b/config/templates/desktop/tauri/src-tauri/build.rs
new file mode 100644
index 0000000..d860e1e
--- /dev/null
+++ b/config/templates/desktop/tauri/src-tauri/build.rs
@@ -0,0 +1,3 @@
+fn main() {
+    tauri_build::build()
+}
diff --git a/config/templates/desktop/tauri/src-tauri/capabilities/default.json b/config/templates/desktop/tauri/src-tauri/capabilities/default.json
new file mode 100644
index 0000000..b9ec4c1
--- /dev/null
+++ b/config/templates/desktop/tauri/src-tauri/capabilities/default.json
@@ -0,0 +1,9 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "default",
+  "description": "Capability for the main window",
+  "windows": ["main"],
+  "permissions": [
+    "core:default"
+  ]
+}
diff --git a/config/templates/desktop/tauri/src-tauri/icons/128x128.png b/config/templates/desktop/tauri/src-tauri/icons/128x128.png
new file mode 100644
index 0000000..1a60391
Binary files /dev/null and b/config/templates/desktop/tauri/src-tauri/icons/128x128.png differ
diff --git a/config/templates/desktop/tauri/src-tauri/icons/128x128@2x.png b/config/templates/desktop/tauri/src-tauri/icons/128x128@2x.png
new file mode 100644
index 0000000..2757ede
Binary files /dev/null and b/config/templates/desktop/tauri/src-tauri/icons/128x128@2x.png differ
diff --git a/config/templates/desktop/tauri/src-tauri/icons/32x32.png b/config/templates/desktop/tauri/src-tauri/icons/32x32.png
new file mode 100644
index 0000000..2b75ab4
Binary files /dev/null and b/config/templates/desktop/tauri/src-tauri/icons/32x32.png differ
diff --git a/config/templates/desktop/tauri/src-tauri/icons/icon.icns b/config/templates/desktop/tauri/src-tauri/icons/icon.icns
new file mode 100644
index 0000000..60b6957
Binary files /dev/null and b/config/templates/desktop/tauri/src-tauri/icons/icon.icns differ
diff --git a/config/templates/desktop/tauri/src-tauri/icons/icon.ico b/config/templates/desktop/tauri/src-tauri/icons/icon.ico
new file mode 100644
index 0000000..5ac440e
Binary files /dev/null and b/config/templates/desktop/tauri/src-tauri/icons/icon.ico differ
diff --git a/config/templates/desktop/tauri/src-tauri/src/lib.rs b/config/templates/desktop/tauri/src-tauri/src/lib.rs
new file mode 100644
index 0000000..ec54672
--- /dev/null
+++ b/config/templates/desktop/tauri/src-tauri/src/lib.rs
@@ -0,0 +1,7 @@
+// Learn more about Tauri commands at https://tauri.app/develop/calling-rust/
+#[cfg_attr(mobile, tauri::mobile_entry_point)]
+pub fn run() {
+    tauri::Builder::default()
+        .run(tauri::generate_context!())
+        .expect("error while running tauri application");
+}
diff --git a/config/templates/desktop/tauri/src-tauri/src/main.rs b/config/templates/desktop/tauri/src-tauri/src/main.rs
new file mode 100644
index 0000000..31c612f
--- /dev/null
+++ b/config/templates/desktop/tauri/src-tauri/src/main.rs
@@ -0,0 +1,6 @@
+// Prevents additional console window on Windows in release, DO NOT REMOVE!!
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+fn main() {
+    app_lib::run()
+}
diff --git a/config/templates/desktop/tauri/src-tauri/tauri.conf.json.tmpl b/config/templates/desktop/tauri/src-tauri/tauri.conf.json.tmpl
new file mode 100644
index 0000000..2133b13
--- /dev/null
+++ b/config/templates/desktop/tauri/src-tauri/tauri.conf.json.tmpl
@@ -0,0 +1,21 @@
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "productName": "{{ .ProjectName }}",
+  "version": "0.1.0",
+  "identifier": "{{ .BundleIdentifier }}",
+  "build": {
+    "beforeDevCommand": "{{ .PM.RunCmd }}",
+    "devUrl": "http://localhost:3000",
+    "beforeBuildCommand": "{{ .PM }} run {{ if eq (printf "%s" .Base) "nuxt" }}generate{{ else }}build{{ end }}",
+    "frontendDist": "../{{ .Base.OutputDir }}"
+  },
+  "app": {
+    "windows": [{ "title": "{{ .ProjectName }}", "width": 800, "height": 600 }],
+    "security": { "csp": null }
+  },
+  "bundle": {
+    "active": true,
+    "targets": "all",
+    "icon": ["icons/32x32.png", "icons/128x128.png", "icons/128x128@2x.png", "icons/icon.icns", "icons/icon.ico"]
+  }
+}
diff --git a/config/templates/linter/eslint/eslint.config.mjs.tmpl b/config/templates/linter/eslint/eslint.config.mjs.tmpl
index 86fe819..978a5c7 100644
--- a/config/templates/linter/eslint/eslint.config.mjs.tmpl
+++ b/config/templates/linter/eslint/eslint.config.mjs.tmpl
@@ -1,14 +1,16 @@
 import js from '@eslint/js'
 import globals from 'globals'
+{{- if .Base.IsReactInt}}
 import reactHooks from 'eslint-plugin-react-hooks'
 import reactRefresh from 'eslint-plugin-react-refresh'
+{{- end}}
 import tseslint from 'typescript-eslint'
 import { defineConfig, globalIgnores } from 'eslint/config'
 
 export default defineConfig([
   globalIgnores(['dist']),
   {
-    files: ['**/*.{ts,tsx,vue,astro}'],
+    files: ['**/*.{ts,tsx}'],
     extends: [
       js.configs.recommended,
       tseslint.configs.recommended,
@@ -23,4 +25,3 @@ export default defineConfig([
     },
   },
 ])
-
diff --git a/config/templates/orm/drizzle/db/index.ts.tmpl b/config/templates/orm/drizzle/db/index.ts.tmpl
index 67b8098..71f792c 100644
--- a/config/templates/orm/drizzle/db/index.ts.tmpl
+++ b/config/templates/orm/drizzle/db/index.ts.tmpl
@@ -26,6 +26,8 @@ import { drizzle } from "drizzle-orm/better-sqlite3";
 import Database from "better-sqlite3";
 import * as schema from "./schema";
 
-const sqlite = new Database(process.env.DATABASE_URL ?? "sqlite.db");
+// better-sqlite3 wants a filesystem path, not a `file:` URL — strip the scheme
+// so the same DATABASE_URL works for both drizzle-kit and the runtime client.
+const sqlite = new Database((process.env.DATABASE_URL ?? "sqlite.db").replace(/^file:/, ""));
 export const db = drizzle(sqlite, { schema });
 {{- end }}
diff --git a/config/templates/orm/drizzle/db/seed.ts.tmpl b/config/templates/orm/drizzle/db/seed.ts.tmpl
new file mode 100644
index 0000000..f2202a2
--- /dev/null
+++ b/config/templates/orm/drizzle/db/seed.ts.tmpl
@@ -0,0 +1,20 @@
+{{- if eq (printf "%s" .Database) "d1" -}}
+// D1 runs inside the Cloudflare Worker runtime, so there is no module-level
+// client to seed from here. Seed with wrangler instead, e.g.:
+//   wrangler d1 execute <DB> --command "INSERT INTO users (name) VALUES ('Ada Lovelace')"
+console.log("For D1, seed via `wrangler d1 execute` — see db/seed.ts.");
+{{- else -}}
+import { db } from "./index";
+import { users } from "./schema";
+
+/** Seed the database with a couple of deterministic rows for local dev. */
+async function main() {
+  await db.insert(users).values([{ name: "Ada Lovelace" }, { name: "Alan Turing" }]);
+  console.log("Seeded users ✔");
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});
+{{- end }}
diff --git a/config/templates/orm/prisma/prisma/seed.ts.tmpl b/config/templates/orm/prisma/prisma/seed.ts.tmpl
new file mode 100644
index 0000000..8597247
--- /dev/null
+++ b/config/templates/orm/prisma/prisma/seed.ts.tmpl
@@ -0,0 +1,16 @@
+import { db } from "../db";
+
+/** Seed the database with a couple of deterministic rows for local dev. */
+async function main() {
+  await db.user.createMany({
+    data: [{ name: "Ada Lovelace" }, { name: "Alan Turing" }],
+  });
+  console.log("Seeded users ✔");
+}
+
+main()
+  .catch((err) => {
+    console.error(err);
+    process.exit(1);
+  })
+  .finally(() => db.$disconnect());
diff --git a/config/templates/shared/.claude/commands/format-fix.md.tmpl b/config/templates/shared/.claude/commands/format-fix.md.tmpl
new file mode 100644
index 0000000..5008d3d
--- /dev/null
+++ b/config/templates/shared/.claude/commands/format-fix.md.tmpl
@@ -0,0 +1,6 @@
+---
+description: Format and lint the codebase, fixing what can be auto-fixed
+---
+Run `{{ .PM }} format` to format and lint the codebase. Fix any remaining issues
+the formatter/linter can't auto-fix, then re-run until clean. Report what changed
+in one or two lines — don't paste the full diff.
diff --git a/config/templates/shared/.claude/commands/new-component.md.tmpl b/config/templates/shared/.claude/commands/new-component.md.tmpl
new file mode 100644
index 0000000..a248bc2
--- /dev/null
+++ b/config/templates/shared/.claude/commands/new-component.md.tmpl
@@ -0,0 +1,15 @@
+---
+description: Scaffold a new component following this project's conventions
+argument-hint: <name> [what it does]
+---
+Create a new {{ .Base }} component for: $ARGUMENTS
+
+Follow the conventions in `AGENTS.md`:
+
+- **File name**: `kebab-case`, e.g. `primary-button.*` — use the extension this project already uses for components (`.astro`, `.tsx`, or `.vue`); match the existing files.
+- **Location**: pick the right folder under `/components` — `ui/` (primitives), `layout/` (header/footer/nav), `page/` (per-page sections), or `icon/`.
+- **JSDoc**: start every component with the JSDoc block from AGENTS.md (Module, @file, @description, @module).
+- **Types**: TypeScript `strict`; never `any` (use `unknown`); avoid `as` — prefer type guards. Prefer arrow functions and small, composable components.
+- Respect the formatter config; run `{{ .PM }} format` when done.
+
+Show the created file path and a one-line summary.
diff --git a/config/templates/shared/.claude/commands/verify.md.tmpl b/config/templates/shared/.claude/commands/verify.md.tmpl
new file mode 100644
index 0000000..5ed659b
--- /dev/null
+++ b/config/templates/shared/.claude/commands/verify.md.tmpl
@@ -0,0 +1,17 @@
+---
+description: Typecheck, build, and test the project; report any failures
+---
+Verify the project is healthy. Run, in order, and report results concisely:
+
+{{ if .Layout.IsMonorepo -}}
+1. `{{ .PM }} -r build` — typechecks and builds every workspace (apps/web, apps/api, packages/domain)
+2. `{{ .PM }} -r test` — runs tests where a `test` script exists
+{{- else -}}
+1. `{{ .PM }} build` — typechecks and builds the project
+2. `{{ .PM }} test` — runs tests if a `test` script exists
+{{- end }}
+{{ if ne (printf "%s" .Backend) "none" -}}
+3. With the API running (`{{ .PM }} dev`), `curl -s http://localhost:8000/health-check` — confirms the server{{ if ne (printf "%s" .ORM) "none" }} and database connection{{ end }} are up.
+{{- end }}
+
+If anything fails, show the failing output and fix the root cause. Do not report success unless every step passes.
diff --git a/config/templates/shared/.claude/settings.json.tmpl b/config/templates/shared/.claude/settings.json.tmpl
new file mode 100644
index 0000000..afce82a
--- /dev/null
+++ b/config/templates/shared/.claude/settings.json.tmpl
@@ -0,0 +1,27 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash({{ .PM }} install)",
+      "Bash({{ .PM }} run:*)",
+      "Bash({{ .PM }} dev)",
+      "Bash({{ .PM }} build)",
+      "Bash({{ .PM }} preview)",
+      "Bash({{ .PM }} test:*)",
+      "Bash({{ .PM }} format)",
+      "Bash({{ .PM }} lint)",
+{{- if .Layout.IsMonorepo }}
+      "Bash({{ .PM }} --filter:*)",
+      "Bash({{ .PM }} -r:*)",
+{{- end }}
+{{- if or (eq (printf "%s" .Database) "postgres") (eq (printf "%s" .Database) "mysql") }}
+      "Bash(docker compose:*)",
+{{- end }}
+{{- if or (eq (printf "%s" .Deployment) "cloudflare-pages") (eq (printf "%s" .Deployment) "cloudflare-workers") }}
+      "Bash(wrangler:*)",
+{{- end }}
+      "Bash(git status)",
+      "Bash(git diff:*)",
+      "Bash(git log:*)"
+    ]
+  }
+}
diff --git a/config/templates/shared/AGENTS.md.tmpl b/config/templates/shared/AGENTS.md.tmpl
index 3ad8f2e..e60317e 100644
--- a/config/templates/shared/AGENTS.md.tmpl
+++ b/config/templates/shared/AGENTS.md.tmpl
@@ -1,28 +1,86 @@
 # Global AI Agent Guidance
 
 ## Overview
-This project contains the following stack:
+This project was scaffolded with bungkus-cli. Stack:
 
-- Framework: {{ .Base }}
+- Framework: {{ .Base }}{{ if ne (printf "%s" .CMS) "none" }} + {{ .CMS }} (CMS){{ end }}
 - CSS: {{ .CSS }}
+- Formatter / Linter: {{ .Fmt }} / {{ .Linter }}
 - Package Manager: {{ .PM }}
+- Layout: {{ .Layout }}
+{{- if ne (printf "%s" .Validation) "none" }}
+- Validation: {{ .Validation }}
+{{- end }}
+{{- if ne (printf "%s" .Backend) "none" }}
+- Backend: {{ .Backend }} (API on `http://localhost:8000`)
+{{- end }}
+{{- if ne (printf "%s" .ORM) "none" }}
+- ORM / Database: {{ .ORM }} / {{ .Database }}
+{{- end }}
+
+The frontend dev server runs on `http://localhost:3000`.
+
+## Dev environment tips
+- Always use `{{ .PM }}` as the package manager.
+- Update `README.md` and `AGENTS.md` when you add a package or a script.
+- Don't install packages unless necessary — keep the dependency footprint small.
+- Make changes in small chunks; add useful comments for complex logic, not generic ones.
+
+{{ if .Layout.IsMonorepo -}}
+This is a **{{ .PM }} workspace monorepo**:
 
-## Dev environments tips
-- Always prioritise to use `{{ .PM }}` as package manager.
-- Development PORT is set to `:3000` by default
-- Always update README.md and AGENTS.md when new package and new script has been added
-- Do not install packages unless nesccessary, practice less dependency
-- Prioitise fixing/adding code in smaller chunk. 
-- Add useful comments to document complex features / code changes, not generic comments
+```
+apps/web         frontend ({{ .Base }})
+{{ if ne (printf "%s" .Backend) "none" }}apps/api         backend ({{ .Backend }}{{ if ne (printf "%s" .ORM) "none" }} + {{ .ORM }}{{ end }})
+{{ end }}packages/domain  shared types / schemas (imported by web + api via workspace:*)
+```
+
+```bash
+{{ .PM }} install            # install all workspace deps
+{{ .PM }} dev                # run every app together{{ if ne (printf "%s" .Backend) "none" }} (web + api){{ end }}
+{{ .PM }} -r build           # typecheck + build all workspaces
+{{ .PM }} --filter web dev   # run only the frontend
+{{ if ne (printf "%s" .Backend) "none" }}{{ .PM }} --filter api dev   # run only the backend
+{{ end }}{{ if eq (printf "%s" .Desktop) "tauri" }}{{ .PM }} --filter web tauri dev   # run the desktop app (needs Rust)
+{{ end }}{{ .PM }} format             # format and lint
+```
+{{- else -}}
+```bash
+{{ .PM }} install       # install dependencies
+{{ .PM }} dev           # start dev server (http://localhost:3000)
+{{ .PM }} build         # production build (also typechecks)
+{{ .PM }} preview       # preview the production build
+{{ if eq (printf "%s" .Desktop) "tauri" }}{{ .PM }} run tauri dev # run the desktop app (needs Rust)
+{{ end }}{{ .PM }} format        # format and lint code
+```
+{{- end }}
+{{ if ne (printf "%s" .Backend) "none" }}
+## Backend ({{ .Backend }})
+
+- The API runs on `http://localhost:8000` (override with the `PORT` env var).
+- Start it with `{{ if .Layout.IsMonorepo }}{{ .PM }} dev` (runs web + api together) or `{{ .PM }} --filter api dev`{{ else }}{{ .PM }} run dev:server` (or `{{ .PM }} dev` for the frontend){{ end }}.
+- `GET /health-check` returns `{ status: "ok" }`{{ if ne (printf "%s" .ORM) "none" }} plus a read-only list of `users` when the database is reachable — use it to confirm the DB is wired{{ end }}.
+- Keep secrets in the API's `.env`; never expose them to the client bundle.
+{{- end }}
+{{ if ne (printf "%s" .ORM) "none" }}
+## Database ({{ .ORM }} / {{ .Database }})
+
+{{ if .Layout.IsMonorepo }}Run from `apps/api`, or with `{{ .PM }} --filter api <script>`:{{ else }}Database scripts:{{ end }}
 
 ```bash
-{{ .PM }} install       # install dependency
-{{ .PM }} dev           # start dev server
-{{ .PM }} build         # production build
-{{ .PM }} preview       # preview build
-{{ .PM }} format        # format and lint code
+cp {{ if .Layout.IsMonorepo }}apps/api/{{ end }}.env.example {{ if .Layout.IsMonorepo }}apps/api/{{ end }}.env
+{{ if or (eq (printf "%s" .Database) "postgres") (eq (printf "%s" .Database) "mysql") }}docker compose up -d              # start the local {{ .Database }} service
+{{ end }}{{ .PM }} {{ if .Layout.IsMonorepo }}--filter api {{ end }}db:generate   # generate a migration from the schema
+{{ .PM }} {{ if .Layout.IsMonorepo }}--filter api {{ end }}db:migrate    # apply migrations
+{{ .PM }} {{ if .Layout.IsMonorepo }}--filter api {{ end }}db:seed       # insert dummy rows for local dev
 ```
 
+- Schema lives in `{{ if eq (printf "%s" .ORM) "drizzle" }}db/schema.ts{{ else }}prisma/schema.prisma{{ end }}`. After changing it, re-run `db:generate` then `db:migrate`.
+{{- if eq (printf "%s" .ORM) "prisma" }}
+- `db:migrate` (`prisma migrate dev`) prompts for a migration name — **it blocks in a non-interactive shell**. Pass one directly (`{{ .PM }} {{ if .Layout.IsMonorepo }}--filter api {{ end }}db:migrate -- --name <name>`), or sync without a migration file using `{{ if .Layout.IsMonorepo }}{{ .PM }} --filter api exec {{ else }}{{ .PM }} exec {{ end }}prisma db push`.
+{{- end }}
+{{- end }}
+
 ## Workflow
 Use the information below as the standard workflow and criteria check-point:
 
diff --git a/config/templates/shared/README.md.tmpl b/config/templates/shared/README.md.tmpl
index 1f99222..efaf4ce 100644
--- a/config/templates/shared/README.md.tmpl
+++ b/config/templates/shared/README.md.tmpl
@@ -43,3 +43,19 @@ Edit `lighthouserc.json` to tune the assertions, URLs, and collection settings t
 For more information about `lhci`, visit [the Lighthouse CI repository](https://github.com/GoogleChrome/lighthouse-ci/).
 
 {{ end}}
+{{- if eq .Desktop "tauri"}}
+## Desktop (Tauri)
+
+Requires the Rust toolchain (https://rustup.rs) and Tauri's platform
+prerequisites (https://tauri.app/start/prerequisites/).
+
+{{ if .Layout.IsMonorepo -}}
+- `{{ .PM }} --filter web tauri dev` — run the desktop app against the dev server
+- `{{ .PM }} --filter web tauri build` — bundle installers into `apps/web/src-tauri/target/release/bundle`
+{{- else -}}
+- `{{ .PM }} run tauri dev` — run the desktop app against the dev server
+- `{{ .PM }} run tauri build` — bundle installers into `src-tauri/target/release/bundle`
+{{- end }}
+
+Rebrand the app icon with the Tauri CLI: `tauri icon <your-icon.png>` (1024x1024 RGBA source).
+{{- end }}
diff --git a/internal/tui/success.go b/internal/tui/success.go
index e6cca3a..92dfd3b 100644
--- a/internal/tui/success.go
+++ b/internal/tui/success.go
@@ -64,6 +64,14 @@ func PrintSuccess(cfg pkg.ProjectConfig) {
 		runLine,
 	)
 
+	// Local URLs the dev server serves on.
+	urls := "\n\n  " + AccentStyle.Render("Local URLs:") +
+		"\n    " + MutedStyle.Render("web  ") + orange.Render("http://localhost:3000")
+	if cfg.Backend != "none" {
+		urls += "\n    " + MutedStyle.Render("api  ") + orange.Render("http://localhost:8000")
+	}
+	cmds += urls
+
 	// Monorepo layout: explain the pnpm-workspace structure.
 	if cfg.Layout.IsMonorepo() {
 		ws := "\n\n  " + AccentStyle.Render("Workspace (pnpm):") +
diff --git a/internal/tui/wizard.go b/internal/tui/wizard.go
index 4c2004c..4f3850d 100644
--- a/internal/tui/wizard.go
+++ b/internal/tui/wizard.go
@@ -450,6 +450,7 @@ func buildAddOnPanels(reg *pkg.Registry, group string, integration string) (tool
 		{"CMS", reg.CMS},
 		{"Deploy", reg.Deployment},
 		{"CI/CD", reg.CICD},
+		{"Desktop", reg.Desktop},
 	}
 
 	// Backend concerns live on their own tab, kept out of the frontend panels.
@@ -712,6 +713,8 @@ func (m *WizardModel) collectConfig() {
 			m.Cfg.Deployment = pkg.DeployTarget(selected.value)
 		case "CI/CD":
 			m.Cfg.CICD = pkg.CICDProvider(selected.value)
+		case "Desktop":
+			m.Cfg.Desktop = pkg.DesktopTarget(selected.value)
 		}
 	}
 
@@ -805,6 +808,7 @@ func (m WizardModel) summaryPopup() string {
 		row("CMS:        ", string(m.Cfg.CMS)) +
 		row("Deploy:     ", string(m.Cfg.Deployment)) +
 		row("CI/CD:      ", string(m.Cfg.CICD)) +
+		row("Desktop:    ", string(m.Cfg.Desktop)) +
 		row("Backend:    ", string(m.Cfg.Backend)) +
 		row("ORM:        ", string(m.Cfg.ORM)) +
 		row("Database:   ", string(m.Cfg.Database)) +
diff --git a/pkg/add.go b/pkg/add.go
new file mode 100644
index 0000000..3d21d91
--- /dev/null
+++ b/pkg/add.go
@@ -0,0 +1,431 @@
+package pkg
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+)
+
+// ErrUnknownAddOption is returned when the option matches no addable category.
+var ErrUnknownAddOption = errors.New("unknown add option")
+
+// AddReport records what Add did (and refused to do). File paths are relative
+// to the project directory (relocated workflow files may contain "../").
+type AddReport struct {
+	CreatedFiles, SkippedFiles   []string
+	DepsAdded, DepsSkipped       []string
+	ScriptsAdded, ScriptsSkipped []string
+	PkgJSONChanged               bool
+	Categories                   []string
+	GitRoot                      string // where .github/** is written
+	NoGitWarning                 bool   // no .git found walking up from dir
+	WorkflowRelocated            bool   // .github/** landed outside dir
+}
+
+// addCategory wires one registry category into `add`. Options inside each
+// category are 100% registry-driven; only the category list is Go-known,
+// mirroring the per-category branches in Scaffold/BuildPackageJSON. The
+// supported set is the standalone categories (config files + deps, no source
+// edits inside the user's app).
+type addCategory struct {
+	name   string // registry/template dir name
+	lookup func(*Registry, string) *OptionEntry
+	set    func(*ProjectConfig, string)
+}
+
+var addCategories = []addCategory{
+	{"fmt", (*Registry).GetFormatter, func(c *ProjectConfig, v string) { c.Fmt = Formatter(v) }},
+	{"linter", (*Registry).GetLinter, func(c *ProjectConfig, v string) { c.Linter = Linter(v) }},
+	{"test", (*Registry).GetTestingFramework, func(c *ProjectConfig, v string) { c.Test = TestingFramework(v) }},
+	{"audit", (*Registry).GetAudit, func(c *ProjectConfig, v string) { c.Audit = AuditTool(v) }},
+	{"deploy", (*Registry).GetDeployment, func(c *ProjectConfig, v string) { c.Deployment = DeployTarget(v) }},
+	{"cicd", (*Registry).GetCICD, func(c *ProjectConfig, v string) { c.CICD = CICDProvider(v) }},
+}
+
+// AddableCategory is one row of the `add` help listing.
+type AddableCategory struct {
+	Name    string
+	Options []string
+}
+
+// AddableOptions lists what `add` accepts, generated from the live registry so
+// the listing can never go stale.
+func AddableOptions() []AddableCategory {
+	r := GetRegistry()
+	cats := []struct {
+		name    string
+		entries []OptionEntry
+	}{
+		{"fmt", r.Formatters}, {"linter", r.Linters}, {"test", r.Test},
+		{"audit", r.Audit}, {"deploy", r.Deployment}, {"cicd", r.CICD},
+	}
+	out := make([]AddableCategory, 0, len(cats))
+	for _, c := range cats {
+		var opts []string
+		for _, e := range c.entries {
+			if e.Value != "none" {
+				opts = append(opts, e.Value)
+			}
+		}
+		out = append(out, AddableCategory{c.name, opts})
+	}
+	return out
+}
+
+// wranglerTomlMainRE matches a top-level `main = ...` in wrangler.toml.
+var wranglerTomlMainRE = regexp.MustCompile(`(?m)^\s*main\s*=`)
+
+// lockfileNames maps each package manager to its lockfile names. These are npm
+// ecosystem facts, not bungkus choices, so they live here, not in the registry.
+var lockfileNames = map[string][]string{
+	"pnpm": {"pnpm-lock.yaml"},
+	"bun":  {"bun.lock", "bun.lockb"},
+	"npm":  {"package-lock.json"},
+	"yarn": {"yarn.lock"},
+}
+
+// DetectProject inspects dir and rawPkg (the project's package.json bytes) and
+// returns a partial ProjectConfig. Base and PM are left empty when they cannot
+// be determined unambiguously, for the caller to fill from flags or reject.
+// Fmt/Linter are left empty so only the option being added triggers
+// cross-cutting package rules.
+func DetectProject(dir string, rawPkg []byte) (ProjectConfig, error) {
+	cfg := NewProjectConfig()
+	cfg.Base, cfg.PM, cfg.Fmt, cfg.Linter = "", "", "", ""
+
+	var pj struct {
+		Name            string            `json:"name"`
+		PackageManager  string            `json:"packageManager"`
+		Dependencies    map[string]string `json:"dependencies"`
+		DevDependencies map[string]string `json:"devDependencies"`
+	}
+	if err := json.Unmarshal(rawPkg, &pj); err != nil {
+		return cfg, fmt.Errorf("could not parse package.json: %w", err)
+	}
+	if pj.Name != "" {
+		cfg.ProjectName = pj.Name
+	} else if abs, err := filepath.Abs(dir); err == nil {
+		cfg.ProjectName = filepath.Base(abs)
+	}
+
+	names := map[string]bool{}
+	for k := range pj.Dependencies {
+		names[k] = true
+	}
+	for k := range pj.DevDependencies {
+		names[k] = true
+	}
+
+	cfg.PM = detectPM(dir, pj.PackageManager)
+	cfg.Base = BaseFramework(detectBase(names))
+	if names["tailwindcss"] {
+		cfg.CSS = "tailwindcss"
+	} else {
+		cfg.CSS = "vanilla"
+	}
+	cfg.Deployment = detectDeploy(dir)
+	return cfg, nil
+}
+
+// detectDeploy infers the deploy target from an existing wrangler config so
+// `add cloudflare-pages` followed by `add github-actions` needs no flags.
+// Deliberately conservative: each target needs its own positive marker
+// (pages_build_output_dir / main); anything else stays "none" and the caller
+// asks for --deploy rather than guessing a workflow that deploys wrongly.
+func detectDeploy(dir string) DeployTarget {
+	for _, f := range []string{"wrangler.jsonc", "wrangler.toml"} {
+		data, err := os.ReadFile(filepath.Join(dir, f))
+		if err != nil {
+			continue
+		}
+		s := string(data)
+		switch {
+		case strings.Contains(s, "pages_build_output_dir"):
+			return "cloudflare-pages"
+		case strings.Contains(s, `"main"`) || wranglerTomlMainRE.MatchString(s):
+			return "cloudflare-workers"
+		}
+		return "none"
+	}
+	return "none"
+}
+
+// findGitRoot walks up from dir to the nearest ancestor containing .git (a
+// directory, or a file in worktrees). Unless that ancestor is dir itself it
+// must also look like a JS workspace root (package.json or
+// pnpm-workspace.yaml) — otherwise an unrelated outer repo (e.g. a
+// git-managed $HOME) would receive this project's workflow files or lend it
+// a stray lockfile. Returns "" when there is no usable root.
+func findGitRoot(dir string) string {
+	d, err := filepath.Abs(dir)
+	if err != nil {
+		return ""
+	}
+	start := d
+	for {
+		if _, err := os.Stat(filepath.Join(d, ".git")); err == nil {
+			if d == start {
+				return d
+			}
+			for _, marker := range []string{"package.json", "pnpm-workspace.yaml"} {
+				if _, err := os.Stat(filepath.Join(d, marker)); err == nil {
+					return d
+				}
+			}
+			return ""
+		}
+		parent := filepath.Dir(d)
+		if parent == d {
+			return ""
+		}
+		d = parent
+	}
+}
+
+// detectPM resolves the package manager: package.json's packageManager field
+// wins; otherwise look for exactly one PM's lockfile, walking up from dir but
+// never past the project's own git root (see findGitRoot). Without a usable
+// git root only dir itself is checked — walking further would adopt stray
+// lockfiles from unrelated ancestors. Zero or several matching lockfiles
+// yield "" so the caller can require --pm.
+func detectPM(dir, pmField string) PackageManager {
+	if name, _, _ := strings.Cut(pmField, "@"); name != "" && GetRegistry().HasPM(name) {
+		return PackageManager(name)
+	}
+	d, err := filepath.Abs(dir)
+	if err != nil {
+		return ""
+	}
+	root := findGitRoot(dir)
+	for {
+		var found []string
+		for pm, files := range lockfileNames {
+			for _, f := range files {
+				if _, err := os.Stat(filepath.Join(d, f)); err == nil {
+					found = append(found, pm)
+					break
+				}
+			}
+		}
+		if len(found) == 1 {
+			return PackageManager(found[0])
+		}
+		if len(found) > 1 {
+			return "" // ambiguous
+		}
+		if root == "" || d == root {
+			return ""
+		}
+		parent := filepath.Dir(d)
+		if parent == d {
+			return ""
+		}
+		d = parent
+	}
+}
+
+// detectBase matches the dependency-name signature of every registry base: a
+// base is a candidate when all of its packages appear among the project's
+// dependency names. The candidate with the most packages wins (astro-react
+// beats astro); a tie is ambiguous and yields "".
+func detectBase(names map[string]bool) string {
+	best, bestCount, tie := "", 0, false
+	for _, b := range GetRegistry().Bases {
+		count := len(b.Packages.Dependencies) + len(b.Packages.DevDependencies)
+		if count == 0 {
+			continue
+		}
+		ok := true
+		for k := range b.Packages.Dependencies {
+			if !names[k] {
+				ok = false
+				break
+			}
+		}
+		for k := range b.Packages.DevDependencies {
+			if !ok || !names[k] {
+				ok = false
+				break
+			}
+		}
+		if !ok {
+			continue
+		}
+		switch {
+		case count > bestCount:
+			best, bestCount, tie = b.Value, count, false
+		case count == bestCount:
+			tie = true
+		}
+	}
+	if tie {
+		return ""
+	}
+	return best
+}
+
+// Add applies option opt to the existing project at dir. cfg is the detected/
+// overridden project config (Base and PM must be valid). It renders each
+// matched category's templates without ever overwriting an existing file,
+// merges the option's packages into package.json additively, and returns a
+// report of everything it did. The only file ever rewritten is package.json.
+func Add(dir string, templates fs.FS, cfg ProjectConfig, opt string) (*AddReport, error) {
+	reg := GetRegistry()
+	baseEntry := reg.GetBase(string(cfg.Base))
+	if baseEntry == nil {
+		return nil, fmt.Errorf("unknown base framework: %s", cfg.Base)
+	}
+	if opt == "none" {
+		return nil, ErrUnknownAddOption
+	}
+
+	rep := &AddReport{}
+	var entries []*OptionEntry
+	var matched []addCategory
+	for _, cat := range addCategories {
+		if e := cat.lookup(reg, opt); e != nil {
+			entries = append(entries, e)
+			matched = append(matched, cat)
+			rep.Categories = append(rep.Categories, cat.name)
+		}
+	}
+	if len(entries) == 0 {
+		return nil, ErrUnknownAddOption
+	}
+
+	for _, e := range entries {
+		if e.ExcludesGroup(baseEntry.Group) {
+			return nil, fmt.Errorf("%s does not support %s projects", opt, baseEntry.Group)
+		}
+	}
+	cfgBefore := cfg
+	for _, cat := range matched {
+		if cat.name == "cicd" {
+			if cfg.Deployment == "none" {
+				return nil, fmt.Errorf("%s needs a deploy target: pass --deploy (cloudflare-pages, cloudflare-workers) or run 'bungkus-cli add cloudflare-pages' first", opt)
+			}
+			// The rendered workflow runs wrangler; ship the deploy target's
+			// packages (wrangler devDep + deploy script) alongside it.
+			if de := reg.GetDeployment(string(cfg.Deployment)); de != nil {
+				entries = append(entries, de)
+			}
+		}
+		cat.set(&cfg, opt)
+	}
+
+	// GitHub only reads .github/ at the repo root, so workflow templates are
+	// redirected there (copyDir handles the redirect via rep.GitRoot).
+	if rep.GitRoot = findGitRoot(dir); rep.GitRoot == "" {
+		rep.NoGitWarning = true
+		rep.GitRoot, _ = filepath.Abs(dir)
+	}
+
+	// Merge package.json FIRST: a malformed file (e.g. "devDependencies": null)
+	// must abort before any template file lands in the user's tree.
+	pkgPath := filepath.Join(dir, "package.json")
+	raw, err := os.ReadFile(pkgPath)
+	if err != nil {
+		return nil, fmt.Errorf("could not read package.json: %w", err)
+	}
+	merged, err := MergeAddPackages(raw, collectAddPackages(cfgBefore, cfg, entries), rep)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, cat := range matched {
+		tmplDir := "templates/" + cat.name + "/" + opt
+		if cat.name == "cicd" {
+			tmplDir = "templates/cicd/" + opt + "/" + string(cfg.Deployment)
+		}
+		if _, err := fs.Stat(templates, tmplDir); err != nil {
+			continue // deps-only option, no template dir
+		}
+		sub, err := fs.Sub(templates, tmplDir)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read %s templates: %w", cat.name, err)
+		}
+		if err := copyDir(sub, dir, cfg, "", rep); err != nil {
+			return nil, err
+		}
+	}
+	// Playwright ships the agent MCP config too, same as create.
+	if cfg.Test == "playwright" {
+		if sub, err := fs.Sub(templates, "templates/agent/mcp"); err == nil {
+			if err := copyDir(sub, dir, cfg, "", rep); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	// Atomic replace: a crash or full disk mid-write must never truncate the
+	// user's package.json (the one pre-existing file this command rewrites).
+	if rep.PkgJSONChanged {
+		tmp := pkgPath + ".bungkus.tmp"
+		if err := os.WriteFile(tmp, merged, 0o644); err != nil {
+			return nil, err
+		}
+		if err := os.Rename(tmp, pkgPath); err != nil {
+			os.Remove(tmp)
+			return nil, err
+		}
+	}
+
+	absDir, _ := filepath.Abs(dir)
+	rel := func(paths []string, markRelocated bool) []string {
+		out := make([]string, 0, len(paths))
+		for _, p := range paths {
+			if abs, err := filepath.Abs(p); err == nil {
+				p = abs
+			}
+			if r, err := filepath.Rel(absDir, p); err == nil {
+				out = append(out, r)
+				if markRelocated && strings.HasPrefix(r, "..") {
+					rep.WorkflowRelocated = true
+				}
+			} else {
+				out = append(out, p)
+			}
+		}
+		return out
+	}
+	rep.CreatedFiles = rel(rep.CreatedFiles, true)
+	rep.SkippedFiles = rel(rep.SkippedFiles, false)
+	return rep, nil
+}
+
+// collectAddPackages builds the packages an add contributes: each matched
+// entry's own packages plus the cross-cutting-rule DELTA the added option
+// causes (e.g. `add prettier` on a tailwind project also brings
+// prettier-plugin-tailwindcss). Rules that fire regardless of the option —
+// like pnpm+astro -> vite — are create-time concerns and must not ride along
+// on an unrelated add, so rules matched by the before-config are subtracted.
+func collectAddPackages(before, after ProjectConfig, entries []*OptionEntry) Packages {
+	p := packageJSON{Scripts: map[string]string{}, Dependencies: map[string]string{}, DevDependencies: map[string]string{}}
+	for _, e := range entries {
+		mergePackages(&p, e.Packages)
+	}
+
+	empty := func() packageJSON {
+		return packageJSON{Scripts: map[string]string{}, Dependencies: map[string]string{}, DevDependencies: map[string]string{}}
+	}
+	base, withOpt := empty(), empty()
+	applyCrossCuttingRules(&base, before)
+	applyCrossCuttingRules(&withOpt, after)
+	delta := func(dst, all, already map[string]string) {
+		for k, v := range all {
+			if _, ok := already[k]; !ok {
+				dst[k] = v
+			}
+		}
+	}
+	delta(p.Scripts, withOpt.Scripts, base.Scripts)
+	delta(p.Dependencies, withOpt.Dependencies, base.Dependencies)
+	delta(p.DevDependencies, withOpt.DevDependencies, base.DevDependencies)
+
+	return Packages{Scripts: p.Scripts, Dependencies: p.Dependencies, DevDependencies: p.DevDependencies}
+}
diff --git a/pkg/add_test.go b/pkg/add_test.go
new file mode 100644
index 0000000..c51d895
--- /dev/null
+++ b/pkg/add_test.go
@@ -0,0 +1,496 @@
+package pkg
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/spencer-osbrjp/bungkus-cli/config"
+)
+
+func writeFiles(t *testing.T, dir string, files map[string]string) {
+	t.Helper()
+	for name, content := range files {
+		p := filepath.Join(dir, name)
+		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(p, []byte(content), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func TestDetectProject(t *testing.T) {
+	setupRegistry(t)
+
+	astroPkg := `{"name": "site", "dependencies": {"astro": "^5.0.0"}}`
+
+	cases := []struct {
+		name     string
+		pkgJSON  string
+		files    map[string]string // relative to the project dir
+		subdir   string            // detect from this subdir if set
+		wantPM   PackageManager
+		wantBase BaseFramework
+		wantCSS  CSSFramework
+		wantName string
+	}{
+		{
+			name:    "pnpm lockfile, astro base",
+			pkgJSON: astroPkg, files: map[string]string{"pnpm-lock.yaml": ""},
+			wantPM: "pnpm", wantBase: "astro", wantCSS: "vanilla", wantName: "site",
+		},
+		{
+			name:    "bun binary lockfile",
+			pkgJSON: astroPkg, files: map[string]string{"bun.lockb": ""},
+			wantPM: "bun", wantBase: "astro",
+		},
+		{
+			name:    "packageManager field beats lockfile",
+			pkgJSON: `{"name": "site", "packageManager": "yarn@4.1.0", "dependencies": {"astro": "^5.0.0"}}`,
+			files:   map[string]string{"pnpm-lock.yaml": ""},
+			wantPM:  "yarn", wantBase: "astro",
+		},
+		{
+			name:    "no lockfile means no PM",
+			pkgJSON: astroPkg, files: map[string]string{".git/HEAD": ""},
+			wantPM: "", wantBase: "astro",
+		},
+		{
+			name:    "two lockfiles are ambiguous",
+			pkgJSON: astroPkg, files: map[string]string{"pnpm-lock.yaml": "", "package-lock.json": ""},
+			wantPM: "", wantBase: "astro",
+		},
+		{
+			name:    "lockfile found in a parent workspace root",
+			pkgJSON: astroPkg,
+			files:   map[string]string{"../../pnpm-lock.yaml": "", "../../.git/HEAD": "", "../../package.json": "{}"},
+			subdir:  "apps/web",
+			wantPM:  "pnpm", wantBase: "astro",
+		},
+		{
+			// Without a git root the walk must not leave dir: a stray lockfile
+			// in an unrelated ancestor (e.g. an accidental npm i in $HOME) must
+			// not decide the project's package manager.
+			name:    "stray parent lockfile without git is ignored",
+			pkgJSON: astroPkg,
+			files:   map[string]string{"../package-lock.json": ""},
+			subdir:  "proj",
+			wantPM:  "", wantBase: "astro",
+		},
+		{
+			name: "astro-react beats astro",
+			pkgJSON: `{"dependencies": {"astro": "1", "@astrojs/react": "1", "react": "1", "react-dom": "1"},
+			           "devDependencies": {"@types/react": "1", "@types/react-dom": "1"}}`,
+			wantBase: "astro-react",
+		},
+		{
+			name:     "nuxt detected",
+			pkgJSON:  `{"dependencies": {"nuxt": "1", "vue": "1", "vue-router": "1"}, "devDependencies": {"@types/node": "1"}}`,
+			wantBase: "nuxt",
+		},
+		{
+			name:     "unrecognized deps mean no base",
+			pkgJSON:  `{"dependencies": {"express": "^4.0.0"}}`,
+			wantBase: "",
+		},
+		{
+			name:     "tailwind detected",
+			pkgJSON:  `{"dependencies": {"astro": "1", "tailwindcss": "^4.0.0"}}`,
+			wantBase: "astro", wantCSS: "tailwindcss",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			root := t.TempDir()
+			dir := root
+			if tc.subdir != "" {
+				dir = filepath.Join(root, tc.subdir)
+				if err := os.MkdirAll(dir, 0o755); err != nil {
+					t.Fatal(err)
+				}
+			}
+			writeFiles(t, dir, tc.files)
+			// Confine PM detection: without a .git the walk-up would escape the
+			// temp dir into the developer's own filesystem.
+			if _, err := os.Stat(filepath.Join(root, ".git")); err != nil {
+				writeFiles(t, root, map[string]string{".git/HEAD": ""})
+			}
+
+			cfg, err := DetectProject(dir, []byte(tc.pkgJSON))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if cfg.PM != tc.wantPM {
+				t.Errorf("PM = %q, want %q", cfg.PM, tc.wantPM)
+			}
+			if cfg.Base != tc.wantBase {
+				t.Errorf("Base = %q, want %q", cfg.Base, tc.wantBase)
+			}
+			if tc.wantCSS != "" && cfg.CSS != tc.wantCSS {
+				t.Errorf("CSS = %q, want %q", cfg.CSS, tc.wantCSS)
+			}
+			if tc.wantName != "" && cfg.ProjectName != tc.wantName {
+				t.Errorf("ProjectName = %q, want %q", cfg.ProjectName, tc.wantName)
+			}
+		})
+	}
+}
+
+func addCfg(base BaseFramework, css CSSFramework) ProjectConfig {
+	cfg := NewProjectConfig()
+	cfg.Base, cfg.PM, cfg.CSS = base, "pnpm", css
+	cfg.Fmt, cfg.Linter = "", ""
+	return cfg
+}
+
+func TestAdd(t *testing.T) {
+	setupRegistry(t)
+
+	astroPkg := `{
+  "name": "site",
+  "author": "someone",
+  "scripts": {"dev": "astro dev"},
+  "dependencies": {"astro": "^5.0.0"}
+}
+`
+
+	cases := []struct {
+		name       string
+		files      map[string]string
+		cfg        ProjectConfig
+		opt        string
+		deploy     DeployTarget
+		wantErr    string
+		created    []string
+		skipped    []string
+		pkgHas     []string
+		pkgMissing []string
+	}{
+		{
+			name: "add lhci",
+			cfg:  addCfg("astro", "vanilla"), opt: "lhci",
+			created: []string{"lighthouserc.json", ".github/workflows/lhci.yml"},
+			pkgHas:  []string{"@lhci/cli", "\"lhci\": \"lhci autorun\"", "\"author\": \"someone\""},
+		},
+		{
+			name:  "add lhci keeps an existing lighthouserc",
+			files: map[string]string{"lighthouserc.json": `{"sentinel": true}`},
+			cfg:   addCfg("astro", "vanilla"), opt: "lhci",
+			created: []string{".github/workflows/lhci.yml"},
+			skipped: []string{"lighthouserc.json"},
+		},
+		{
+			name: "add biome matches formatter and linter",
+			cfg:  addCfg("astro", "vanilla"), opt: "biome",
+			created: []string{"biome.json"},
+			pkgHas:  []string{"@biomejs/biome", "\"format\"", "\"lint\""},
+		},
+		{
+			name: "add playwright ships the mcp config too",
+			cfg:  addCfg("astro", "vanilla"), opt: "playwright",
+			created: []string{"playwright.config.ts", ".mcp.json"},
+			pkgHas:  []string{"@playwright/test", "test:e2e"},
+		},
+		{
+			name: "add prettier pulls cross-cutting plugins",
+			cfg:  addCfg("astro", "tailwindcss"), opt: "prettier",
+			pkgHas: []string{"prettier-plugin-tailwindcss", "prettier-plugin-astro"},
+		},
+		{
+			name: "add github-actions needs a deploy target",
+			cfg:  addCfg("astro", "vanilla"), opt: "github-actions",
+			wantErr: "needs a deploy target",
+		},
+		{
+			// The rendered workflow runs wrangler, so the deploy target's
+			// packages must ride along or the first CI run fails.
+			name: "add github-actions with deploy",
+			cfg:  addCfg("astro", "vanilla"), opt: "github-actions", deploy: "cloudflare-pages",
+			created: []string{".github/workflows/deploy.yml"},
+			pkgHas:  []string{"wrangler", "\"deploy\""},
+		},
+		{
+			name: "add oxfmt on astro is rejected",
+			cfg:  addCfg("astro", "vanilla"), opt: "oxfmt",
+			wantErr: "does not support astro",
+		},
+		{
+			name: "unknown option",
+			cfg:  addCfg("astro", "vanilla"), opt: "unknown-thing",
+			wantErr: ErrUnknownAddOption.Error(),
+		},
+		{
+			name: "none is rejected",
+			cfg:  addCfg("astro", "vanilla"), opt: "none",
+			wantErr: ErrUnknownAddOption.Error(),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := t.TempDir()
+			writeFiles(t, dir, map[string]string{"package.json": astroPkg})
+			writeFiles(t, dir, tc.files)
+
+			cfg := tc.cfg
+			if tc.deploy != "" {
+				cfg.Deployment = tc.deploy
+			}
+			rep, err := Add(dir, config.Templates, cfg, tc.opt)
+			if tc.wantErr != "" {
+				if err == nil || !strings.Contains(err.Error(), tc.wantErr) {
+					t.Fatalf("err = %v, want containing %q", err, tc.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("Add: %v", err)
+			}
+
+			for _, f := range tc.created {
+				if _, err := os.Stat(filepath.Join(dir, f)); err != nil {
+					t.Errorf("expected %s to be created: %v", f, err)
+				}
+			}
+			// The same render invariants create output gets: no unrendered
+			// template residue, valid JSON — add renders with a config shape
+			// (Fmt="", Linter="") the create path never produces.
+			for _, f := range rep.CreatedFiles {
+				b, err := os.ReadFile(filepath.Join(dir, f))
+				if err != nil {
+					t.Errorf("read created file %s: %v", f, err)
+					continue
+				}
+				for _, m := range goTemplateMarkers {
+					if strings.Contains(string(b), m) {
+						t.Errorf("unrendered template marker %q in %s", m, f)
+					}
+				}
+				if strings.HasSuffix(f, ".json") {
+					if err := json.Unmarshal(b, new(json.RawMessage)); err != nil {
+						t.Errorf("invalid JSON in %s: %v", f, err)
+					}
+				}
+			}
+			for _, f := range tc.skipped {
+				found := false
+				for _, s := range rep.SkippedFiles {
+					if filepath.ToSlash(s) == f {
+						found = true
+					}
+				}
+				if !found {
+					t.Errorf("expected %s in SkippedFiles, got %v", f, rep.SkippedFiles)
+				}
+			}
+
+			raw, err := os.ReadFile(filepath.Join(dir, "package.json"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := json.Unmarshal(raw, new(json.RawMessage)); err != nil {
+				t.Fatalf("package.json is invalid JSON after add: %v\n%s", err, raw)
+			}
+			for _, s := range tc.pkgHas {
+				if !strings.Contains(string(raw), s) {
+					t.Errorf("package.json missing %q:\n%s", s, raw)
+				}
+			}
+			for _, s := range tc.pkgMissing {
+				if strings.Contains(string(raw), s) {
+					t.Errorf("package.json should not contain %q", s)
+				}
+			}
+		})
+	}
+}
+
+func TestAddRelocatesWorkflowsToGitRoot(t *testing.T) {
+	setupRegistry(t)
+	root := t.TempDir()
+	dir := filepath.Join(root, "apps", "web")
+	writeFiles(t, root, map[string]string{".git/HEAD": "", "package.json": `{"name": "workspace"}`})
+	writeFiles(t, dir, map[string]string{"package.json": `{"name": "web", "dependencies": {"astro": "1"}}`})
+
+	rep, err := Add(dir, config.Templates, addCfg("astro", "vanilla"), "lhci")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(filepath.Join(root, ".github", "workflows", "lhci.yml")); err != nil {
+		t.Errorf("workflow not at git root: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(dir, ".github")); err == nil {
+		t.Error("stray .github left inside the app dir")
+	}
+	if _, err := os.Stat(filepath.Join(dir, "lighthouserc.json")); err != nil {
+		t.Errorf("lighthouserc.json should stay in the app dir: %v", err)
+	}
+	if !rep.WorkflowRelocated {
+		t.Error("WorkflowRelocated not set")
+	}
+	if rep.NoGitWarning {
+		t.Error("NoGitWarning set despite a .git at the root")
+	}
+}
+
+func TestAddIgnoresUnrelatedAncestorRepo(t *testing.T) {
+	// A git ancestor that is not a JS workspace (e.g. a git-managed $HOME) must
+	// not receive this project's workflow files.
+	setupRegistry(t)
+	root := t.TempDir()
+	dir := filepath.Join(root, "scratch", "site")
+	writeFiles(t, root, map[string]string{".git/HEAD": ""}) // no package.json at root
+	writeFiles(t, dir, map[string]string{"package.json": `{"name": "site", "dependencies": {"astro": "1"}}`})
+
+	rep, err := Add(dir, config.Templates, addCfg("astro", "vanilla"), "lhci")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(filepath.Join(root, ".github")); err == nil {
+		t.Error("workflow leaked into the unrelated ancestor repo")
+	}
+	if _, err := os.Stat(filepath.Join(dir, ".github", "workflows", "lhci.yml")); err != nil {
+		t.Errorf("workflow should stay in the project dir: %v", err)
+	}
+	if !rep.NoGitWarning {
+		t.Error("NoGitWarning should be set when no usable git root exists")
+	}
+}
+
+func TestAddOnlyOptionPackages(t *testing.T) {
+	// `add lhci` on a pnpm astro project must add ONLY lhci's packages — the
+	// create-time pnpm+astro -> vite rule must not ride along.
+	setupRegistry(t)
+	dir := t.TempDir()
+	writeFiles(t, dir, map[string]string{
+		"package.json": `{"name": "site", "dependencies": {"astro": "1"}}`,
+	})
+	rep, err := Add(dir, config.Templates, addCfg("astro", "vanilla"), "lhci")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rep.DepsAdded) != 1 || !strings.HasPrefix(rep.DepsAdded[0], "@lhci/cli") {
+		t.Errorf("DepsAdded = %v, want exactly [@lhci/cli ...]", rep.DepsAdded)
+	}
+	raw, _ := os.ReadFile(filepath.Join(dir, "package.json"))
+	if strings.Contains(string(raw), `"vite"`) {
+		t.Errorf("unrequested vite dependency injected:\n%s", raw)
+	}
+}
+
+func TestDetectBaseTieIsAmbiguous(t *testing.T) {
+	// A project matching two equally specific base signatures (e.g. migrating
+	// between stacks) must not silently pick one.
+	setupRegistry(t)
+	reg := GetRegistry()
+	a, b := reg.GetBase("astro-react"), reg.GetBase("vite-vue")
+	count := func(e *BaseEntry) int {
+		return len(e.Packages.Dependencies) + len(e.Packages.DevDependencies)
+	}
+	if count(a) != count(b) {
+		t.Skipf("registry signatures no longer tie (%d vs %d) — pick two equal-count bases", count(a), count(b))
+	}
+	names := map[string]bool{}
+	for _, e := range []*BaseEntry{a, b} {
+		for k := range e.Packages.Dependencies {
+			names[k] = true
+		}
+		for k := range e.Packages.DevDependencies {
+			names[k] = true
+		}
+	}
+	if got := detectBase(names); got != "" {
+		t.Errorf("detectBase = %q, want \"\" for a tie", got)
+	}
+}
+
+func TestAddWithoutGitWarns(t *testing.T) {
+	setupRegistry(t)
+	dir := t.TempDir() // no .git anywhere within the temp dir
+	writeFiles(t, dir, map[string]string{"package.json": `{"name": "site", "dependencies": {"astro": "1"}}`})
+	rep, err := Add(dir, config.Templates, addCfg("astro", "vanilla"), "lhci")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The walk-up may or may not find a .git above the temp dir on the host
+	// machine; only assert the invariant that holds either way: files exist
+	// and the report is internally consistent.
+	if rep.NoGitWarning && rep.GitRoot == "" {
+		t.Error("NoGitWarning must come with a dir fallback GitRoot")
+	}
+}
+
+func TestDetectDeploy(t *testing.T) {
+	setupRegistry(t)
+	cases := []struct {
+		name  string
+		files map[string]string
+		want  DeployTarget
+	}{
+		{"no wrangler config", nil, "none"},
+		{"pages", map[string]string{"wrangler.jsonc": `{"pages_build_output_dir": "./dist"}`}, "cloudflare-pages"},
+		{"workers", map[string]string{"wrangler.jsonc": `{"main": "src/index.ts"}`}, "cloudflare-workers"},
+		{"workers toml", map[string]string{"wrangler.toml": `main = "src/index.ts"`}, "cloudflare-workers"},
+		// A wrangler config without a positive marker (e.g. a Pages project
+		// configured in the dashboard) must NOT be guessed as workers.
+		{"ambiguous wrangler config", map[string]string{"wrangler.toml": "name = \"site\"\ncompatibility_date = \"2026-01-01\""}, "none"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := t.TempDir()
+			writeFiles(t, dir, tc.files)
+			if got := detectDeploy(dir); got != tc.want {
+				t.Errorf("detectDeploy = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestAddPreservesExistingFileContent(t *testing.T) {
+	setupRegistry(t)
+	dir := t.TempDir()
+	sentinel := `{"my": "custom lighthouse config"}`
+	writeFiles(t, dir, map[string]string{
+		"package.json":      `{"name": "site", "dependencies": {"astro": "1"}}`,
+		"lighthouserc.json": sentinel,
+	})
+	if _, err := Add(dir, config.Templates, addCfg("astro", "vanilla"), "lhci"); err != nil {
+		t.Fatal(err)
+	}
+	got, _ := os.ReadFile(filepath.Join(dir, "lighthouserc.json"))
+	if string(got) != sentinel {
+		t.Errorf("existing file was modified:\n%s", got)
+	}
+}
+
+func TestAddIsIdempotent(t *testing.T) {
+	setupRegistry(t)
+	dir := t.TempDir()
+	writeFiles(t, dir, map[string]string{
+		"package.json": `{"name": "site", "dependencies": {"astro": "1"}}`,
+	})
+	if _, err := Add(dir, config.Templates, addCfg("astro", "vanilla"), "lhci"); err != nil {
+		t.Fatal(err)
+	}
+	before, _ := os.ReadFile(filepath.Join(dir, "package.json"))
+
+	rep, err := Add(dir, config.Templates, addCfg("astro", "vanilla"), "lhci")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rep.CreatedFiles) != 0 {
+		t.Errorf("second run created files: %v", rep.CreatedFiles)
+	}
+	if rep.PkgJSONChanged {
+		t.Error("second run reported package.json changes")
+	}
+	after, _ := os.ReadFile(filepath.Join(dir, "package.json"))
+	if string(before) != string(after) {
+		t.Errorf("package.json changed on the second run:\nbefore: %s\nafter:  %s", before, after)
+	}
+}
diff --git a/pkg/bump.go b/pkg/bump.go
index f7ead7a..0bb75bd 100644
--- a/pkg/bump.go
+++ b/pkg/bump.go
@@ -134,6 +134,7 @@ func BumpRegistry(content string, resolve func(name string) (string, bool)) (Bum
 	for _, group := range [][]OptionEntry{
 		reg.CSS, reg.Formatters, reg.Linters, reg.Validation, reg.Form,
 		reg.Query, reg.State, reg.CMS, reg.Test, reg.Audit, reg.Deployment, reg.CICD,
+		reg.Desktop,
 	} {
 		for _, e := range group {
 			record(e.Packages)
diff --git a/pkg/bump_test.go b/pkg/bump_test.go
index ab6bcca..9d8719c 100644
--- a/pkg/bump_test.go
+++ b/pkg/bump_test.go
@@ -120,3 +120,32 @@ func contains(s, sub string) bool {
 	}
 	return false
 }
+
+func TestBumpRegistryDesktop(t *testing.T) {
+	// Proves the desktop category is scanned by BumpRegistry (it enumerates
+	// option groups explicitly, so a missing group silently freezes its pins).
+	content := `{
+  "desktop": [
+    {
+      "value": "tauri",
+      "packages": { "devDependencies": { "@tauri-apps/cli": "^2.11.4" } }
+    }
+  ]
+}`
+	resolve := func(name string) (string, bool) {
+		if name == "@tauri-apps/cli" {
+			return "2.12.0", true
+		}
+		return "", false
+	}
+	res, err := BumpRegistry(content, resolve)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(res.Changes) != 1 || res.Changes[0].To != "^2.12.0" {
+		t.Fatalf("changes = %+v; want single @tauri-apps/cli -> ^2.12.0", res.Changes)
+	}
+	if want := `"@tauri-apps/cli": "^2.12.0"`; !contains(res.Content, want) {
+		t.Errorf("content missing %q", want)
+	}
+}
diff --git a/pkg/config.go b/pkg/config.go
index 15122f7..b074d9b 100644
--- a/pkg/config.go
+++ b/pkg/config.go
@@ -4,6 +4,7 @@ import (
 	"errors"
 	"maps"
 	"slices"
+	"strings"
 	"time"
 )
 
@@ -23,6 +24,7 @@ type (
 	TestingFramework string
 	DeployTarget     string
 	AuditTool        string
+	DesktopTarget    string
 	CICDProvider     string
 	BackendLib       string
 	ORMLib           string
@@ -155,11 +157,14 @@ func (b BaseFramework) IsVite() bool {
 }
 
 func (b BaseFramework) GetIntegration() (BaseIntegration, error) {
-	if globalRegistry != nil {
+	if globalRegistry == nil {
 		return BaseIntegration(""), errors.New("unable to read registry")
 	}
 
 	entry := globalRegistry.GetBase(string(b))
+	if entry == nil {
+		return BaseIntegration(""), errors.New("unknown base framework: " + string(b))
+	}
 	return BaseIntegration(entry.Integration), nil
 }
 
@@ -180,7 +185,7 @@ func (b BaseFramework) IsVueInt() bool {
 		return false
 	}
 
-	return integration == "react"
+	return integration == "vue"
 }
 
 func (c CSSFramework) IsValid() bool {
@@ -316,6 +321,60 @@ func (a AuditTool) GetDependencies() AllDependencies {
 	}
 }
 
+func (d DesktopTarget) IsValid() bool {
+	return globalRegistry != nil && globalRegistry.HasDesktop(string(d))
+}
+
+func (d DesktopTarget) GetDependencies() AllDependencies {
+	if globalRegistry == nil {
+		return AllDependencies{}
+	}
+	entry := globalRegistry.GetDesktop(string(d))
+	if entry == nil {
+		return AllDependencies{}
+	}
+	return AllDependencies{
+		Dependencies:    entry.Packages.Dependencies,
+		DevDependencies: entry.Packages.DevDependencies,
+	}
+}
+
+// desktopSlug lowercases name and collapses every run of characters outside
+// [a-z0-9] to a single '-'. The result is valid both as a Cargo crate name
+// and as a bundle-identifier segment ("My App" -> "my-app", "my.app" -> "my-app").
+func desktopSlug(name string) string {
+	var b strings.Builder
+	dash := false
+	for _, r := range strings.ToLower(name) {
+		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') {
+			b.WriteRune(r)
+			dash = false
+		} else if !dash && b.Len() > 0 {
+			b.WriteByte('-')
+			dash = true
+		}
+	}
+	s := strings.TrimSuffix(b.String(), "-")
+	if s == "" {
+		return "app" // e.g. `create .` in a directory with no ascii-alnum chars
+	}
+	return s
+}
+
+// CrateName is ProjectName as a valid Cargo package name.
+func (c ProjectConfig) CrateName() string { return desktopSlug(c.ProjectName) }
+
+// BundleIdentifier is a reverse-DNS placeholder id for tauri.conf.json.
+// Never ends in ".app" (conflicts with the macOS bundle extension) and never
+// equals the forbidden default "com.tauri.dev".
+func (c ProjectConfig) BundleIdentifier() string {
+	id := "com.example." + desktopSlug(c.ProjectName)
+	if strings.HasSuffix(id, ".app") { // only possible when the slug is exactly "app"
+		id += "-desktop"
+	}
+	return id
+}
+
 func (v ValidationLib) IsValid() bool {
 	return globalRegistry != nil && globalRegistry.HasValidation(string(v))
 }
@@ -561,6 +620,7 @@ type ProjectConfig struct {
 	CMS         CMS
 	Deployment  DeployTarget
 	CICD        CICDProvider
+	Desktop     DesktopTarget
 	PM          PackageManager
 	Test        TestingFramework
 	Audit       AuditTool
@@ -619,6 +679,7 @@ func (c ProjectConfig) Stack() []StackEntry {
 	add("State", c.State.GetDependencies())
 	add("CMS", c.CMS.GetDependencies())
 	add("Deployment", c.Deployment.GetDependencies())
+	add("Desktop", c.Desktop.GetDependencies())
 	add("Testing", c.Test.GetDependencies())
 	add("Audit", c.Audit.GetDependencies())
 	add("Backend", c.Backend.GetDependencies())
@@ -644,6 +705,7 @@ func NewProjectConfig() ProjectConfig {
 		Deployment:  "none",
 		CICD:        "none",
 		Audit:       "none",
+		Desktop:     "none",
 		Backend:     "none",
 		ORM:         "none",
 		Database:    "none",
diff --git a/pkg/config_test.go b/pkg/config_test.go
index 266118b..9579ba4 100644
--- a/pkg/config_test.go
+++ b/pkg/config_test.go
@@ -1,6 +1,7 @@
 package pkg
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/spencer-osbrjp/bungkus-cli/config"
@@ -107,3 +108,69 @@ func TestStateLib_IsValidIntegration(t *testing.T) {
 		})
 	}
 }
+
+func TestDesktopTarget_IsValid(t *testing.T) {
+	setupRegistry(t)
+	cases := map[DesktopTarget]bool{"none": true, "tauri": true, "electron": false, "": false}
+	for d, want := range cases {
+		if got := d.IsValid(); got != want {
+			t.Errorf("DesktopTarget(%q).IsValid() = %v, want %v", d, got, want)
+		}
+	}
+}
+
+func TestCrateNameAndBundleIdentifier(t *testing.T) {
+	cases := []struct {
+		name  string
+		crate string
+		id    string
+	}{
+		{"my-app", "my-app", "com.example.my-app"},
+		{"my.app", "my-app", "com.example.my-app"},
+		{"My App", "my-app", "com.example.my-app"},
+		{"my_app", "my-app", "com.example.my-app"},
+		{"app", "app", "com.example.app-desktop"}, // .app suffix guard
+		{"アプリ", "app", "com.example.app-desktop"},
+	}
+	for _, tc := range cases {
+		c := ProjectConfig{ProjectName: tc.name}
+		if got := c.CrateName(); got != tc.crate {
+			t.Errorf("CrateName(%q) = %q, want %q", tc.name, got, tc.crate)
+		}
+		got := c.BundleIdentifier()
+		if got != tc.id {
+			t.Errorf("BundleIdentifier(%q) = %q, want %q", tc.name, got, tc.id)
+		}
+		if strings.HasSuffix(got, ".app") || got == "com.tauri.dev" {
+			t.Errorf("BundleIdentifier(%q) = %q violates tauri identifier rules", tc.name, got)
+		}
+	}
+}
+
+func TestBaseIntegrationHelpers(t *testing.T) {
+	setupRegistry(t)
+	cases := []struct {
+		base  BaseFramework
+		react bool
+		vue   bool
+	}{
+		{"astro", false, false},
+		{"astro-react", true, false},
+		{"astro-vue", false, true},
+		{"vite", false, false},
+		{"vite-react", true, false},
+		{"vite-vue", false, true},
+		// nuxt's registry entry has no integration field; its vue-ness is
+		// remapped separately (see BuildPackageJSON / IsValidIntegration).
+		{"nuxt", false, false},
+		{"bogus", false, false},
+	}
+	for _, tc := range cases {
+		if got := tc.base.IsReactInt(); got != tc.react {
+			t.Errorf("%s.IsReactInt() = %v, want %v", tc.base, got, tc.react)
+		}
+		if got := tc.base.IsVueInt(); got != tc.vue {
+			t.Errorf("%s.IsVueInt() = %v, want %v", tc.base, got, tc.vue)
+		}
+	}
+}
diff --git a/pkg/configimports_test.go b/pkg/configimports_test.go
new file mode 100644
index 0000000..e974bf9
--- /dev/null
+++ b/pkg/configimports_test.go
@@ -0,0 +1,150 @@
+package pkg
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/spencer-osbrjp/bungkus-cli/config"
+)
+
+var importSpecRE = regexp.MustCompile(`(?m)^\s*import\s+(?:[^'"]*?\sfrom\s+)?['"]([^'"]+)['"]`)
+
+// packageName extracts the npm package a specifier resolves to
+// ("eslint/config" -> "eslint", "@eslint/js" -> "@eslint/js").
+func packageName(spec string) string {
+	parts := strings.Split(spec, "/")
+	if strings.HasPrefix(spec, "@") && len(parts) >= 2 {
+		return parts[0] + "/" + parts[1]
+	}
+	return parts[0]
+}
+
+// TestGeneratedConfigImportsAreInstalled guards the issue #118 class of bug:
+// every package imported by a generated top-level config file (eslint.config,
+// vite.config, astro.config, ...) must actually be installed by the generated
+// package.json. A config template importing a tool the registry entry does
+// not ship breaks the project's very first lint/build.
+func TestGeneratedConfigImportsAreInstalled(t *testing.T) {
+	setupRegistry(t)
+
+	combo := func(base BaseFramework, mutate func(*ProjectConfig)) ProjectConfig {
+		c := NewProjectConfig()
+		c.Base = base
+		if mutate != nil {
+			mutate(&c)
+		}
+		return c
+	}
+	eslint := func(c *ProjectConfig) { c.Fmt, c.Linter, c.CSS = "prettier", "eslint", "tailwindcss" }
+
+	combos := map[string]ProjectConfig{
+		"astro_eslint":       combo("astro", eslint), // the issue #118 repro
+		"astro_react_eslint": combo("astro-react", eslint),
+		"astro_vue_eslint":   combo("astro-vue", eslint),
+		"vite_vue_eslint":    combo("vite-vue", eslint),
+		"vite_react_eslint":  combo("vite-react", eslint),
+		"nuxt_eslint":        combo("nuxt", eslint),
+		"vite_ox":            combo("vite", func(c *ProjectConfig) { c.Fmt, c.Linter = "oxfmt", "oxlint" }),
+		"astro_defaults":     combo("astro", nil),
+		"vite_playwright":    combo("vite-react", func(c *ProjectConfig) { c.Test = "playwright" }),
+	}
+
+	for name, cfg := range combos {
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			if err := Scaffold(dir, config.Templates, cfg); err != nil {
+				t.Fatalf("Scaffold: %v", err)
+			}
+
+			raw, err := os.ReadFile(filepath.Join(dir, "package.json"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var pj struct {
+				Dependencies    map[string]string `json:"dependencies"`
+				DevDependencies map[string]string `json:"devDependencies"`
+			}
+			if err := json.Unmarshal(raw, &pj); err != nil {
+				t.Fatal(err)
+			}
+			installed := func(name string) bool {
+				_, d := pj.Dependencies[name]
+				_, dd := pj.DevDependencies[name]
+				return d || dd
+			}
+
+			entries, err := os.ReadDir(dir)
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, e := range entries {
+				n := e.Name()
+				if e.IsDir() || !strings.Contains(n, ".config.") {
+					continue
+				}
+				b, err := os.ReadFile(filepath.Join(dir, n))
+				if err != nil {
+					t.Fatal(err)
+				}
+				for _, m := range importSpecRE.FindAllStringSubmatch(string(b), -1) {
+					spec := m[1]
+					if strings.HasPrefix(spec, ".") || strings.HasPrefix(spec, "/") ||
+						strings.HasPrefix(spec, "node:") || strings.Contains(spec, ":") {
+						continue // relative, absolute, builtin, or virtual module
+					}
+					if pkg := packageName(spec); !installed(pkg) {
+						t.Errorf("%s imports %q but package.json does not install %q", n, spec, pkg)
+					}
+				}
+			}
+		})
+	}
+}
+
+// TestEslintReactPluginsWired asserts the positive direction the import-vs-
+// deps guard can't see: react bases must actually get the react eslint
+// plugins (both the config imports and the installed packages), and
+// non-react bases must not. Before the GetIntegration nil-check fix,
+// IsReactInt always returned false and this wiring silently never fired.
+func TestEslintReactPluginsWired(t *testing.T) {
+	setupRegistry(t)
+	scaffoldEslint := func(base BaseFramework) (conf, pkgJSON string) {
+		c := NewProjectConfig()
+		c.Base, c.Fmt, c.Linter = base, "prettier", "eslint"
+		dir := t.TempDir()
+		if err := Scaffold(dir, config.Templates, c); err != nil {
+			t.Fatalf("Scaffold(%s): %v", base, err)
+		}
+		cb, err := os.ReadFile(filepath.Join(dir, "eslint.config.mjs"))
+		if err != nil {
+			t.Fatalf("read eslint config for %s: %v", base, err)
+		}
+		pb, err := os.ReadFile(filepath.Join(dir, "package.json"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		return string(cb), string(pb)
+	}
+
+	for _, base := range []BaseFramework{"astro-react", "vite-react"} {
+		conf, pkgJSON := scaffoldEslint(base)
+		for _, want := range []string{"eslint-plugin-react-hooks", "eslint-plugin-react-refresh"} {
+			if !strings.Contains(conf, want) {
+				t.Errorf("%s: eslint.config.mjs missing %s", base, want)
+			}
+			if !strings.Contains(pkgJSON, want) {
+				t.Errorf("%s: package.json missing %s", base, want)
+			}
+		}
+	}
+	for _, base := range []BaseFramework{"astro", "astro-vue", "vite-vue", "nuxt"} {
+		conf, pkgJSON := scaffoldEslint(base)
+		if strings.Contains(conf, "eslint-plugin-react") || strings.Contains(pkgJSON, "eslint-plugin-react") {
+			t.Errorf("%s: react eslint plugins leaked into a non-react base", base)
+		}
+	}
+}
diff --git a/pkg/jsonmerge.go b/pkg/jsonmerge.go
new file mode 100644
index 0000000..23ee2ba
--- /dev/null
+++ b/pkg/jsonmerge.go
@@ -0,0 +1,201 @@
+package pkg
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"maps"
+	"regexp"
+	"slices"
+)
+
+// orderedObj preserves top-level key order and the exact raw bytes of every
+// value. Interior bytes of untouched values are preserved verbatim; each
+// emitted level's key/indent framing is re-emitted using the file's own
+// sniffed indent unit and newline style, so an untouched line normally stays
+// byte-identical (exotic per-line indentation is the one case it normalizes).
+type orderedObj struct {
+	keys []string
+	vals map[string]json.RawMessage
+}
+
+func parseOrderedObj(data []byte) (*orderedObj, error) {
+	o := &orderedObj{vals: map[string]json.RawMessage{}}
+	dec := json.NewDecoder(bytes.NewReader(data))
+	tok, err := dec.Token()
+	if err != nil {
+		return nil, err
+	}
+	if d, ok := tok.(json.Delim); !ok || d != '{' {
+		return nil, fmt.Errorf("expected a JSON object")
+	}
+	for dec.More() {
+		keyTok, err := dec.Token()
+		if err != nil {
+			return nil, err
+		}
+		key, ok := keyTok.(string)
+		if !ok {
+			return nil, fmt.Errorf("expected an object key")
+		}
+		var raw json.RawMessage
+		if err := dec.Decode(&raw); err != nil {
+			return nil, err
+		}
+		// A duplicate key means any rewrite would silently drop one of the
+		// user's values (JSON parsers keep the last one) — refuse instead.
+		if _, dup := o.vals[key]; dup {
+			return nil, fmt.Errorf("duplicate key %q — refusing to rewrite", key)
+		}
+		o.keys = append(o.keys, key)
+		o.vals[key] = raw
+	}
+	if _, err := dec.Token(); err != nil { // consume the closing brace
+		return nil, err
+	}
+	return o, nil
+}
+
+// set replaces an existing key's value or appends the key at the end.
+func (o *orderedObj) set(key string, v json.RawMessage) {
+	if _, ok := o.vals[key]; !ok {
+		o.keys = append(o.keys, key)
+	}
+	o.vals[key] = v
+}
+
+// marshal emits the object using the file's own indent unit and newline style
+// (see sniffFormat); value bytes are written verbatim, preserving their
+// interior formatting. prefix is the indentation of the object's own braces.
+func (o *orderedObj) marshal(prefix, unit, nl string) []byte {
+	if len(o.keys) == 0 {
+		return []byte("{}")
+	}
+	var buf bytes.Buffer
+	buf.WriteString("{" + nl)
+	for i, k := range o.keys {
+		kb, _ := json.Marshal(k)
+		buf.WriteString(prefix + unit)
+		buf.Write(kb)
+		buf.WriteString(": ")
+		buf.Write(bytes.TrimSpace(o.vals[k]))
+		if i < len(o.keys)-1 {
+			buf.WriteByte(',')
+		}
+		buf.WriteString(nl)
+	}
+	buf.WriteString(prefix + "}")
+	return buf.Bytes()
+}
+
+var indentRE = regexp.MustCompile(`(?m)^([ \t]+)\S`)
+
+// sniffFormat detects the file's indent unit (first indented line ≈ the
+// top-level unit) and newline style so a rewrite matches what the user wrote.
+func sniffFormat(orig []byte) (unit, nl string) {
+	unit, nl = "  ", "\n"
+	if bytes.Contains(orig, []byte("\r\n")) {
+		nl = "\r\n"
+	}
+	if m := indentRE.FindSubmatch(orig); m != nil {
+		unit = string(m[1])
+	}
+	return
+}
+
+// depSections are every package.json section that can already carry a
+// dependency; a package present in ANY of them is never re-added.
+var depSections = []string{"dependencies", "devDependencies", "peerDependencies", "optionalDependencies"}
+
+// MergeAddPackages additively merges add into raw package.json bytes. It never
+// changes an existing script or dependency version; a dependency already
+// present in any dependency section is skipped entirely (never duplicated or
+// moved between sections). New keys are appended in sorted order after the
+// existing ones; missing sections are created at the end of the file only when
+// they gain a key. When nothing is added the original bytes are returned
+// unchanged and rep.PkgJSONChanged stays false.
+func MergeAddPackages(orig []byte, add Packages, rep *AddReport) ([]byte, error) {
+	top, err := parseOrderedObj(orig)
+	if err != nil {
+		return nil, fmt.Errorf("could not parse package.json: %w", err)
+	}
+
+	sections := map[string]*orderedObj{}
+	getSection := func(name string) (*orderedObj, error) {
+		if o, ok := sections[name]; ok {
+			return o, nil
+		}
+		o := &orderedObj{vals: map[string]json.RawMessage{}}
+		if raw, ok := top.vals[name]; ok {
+			var err error
+			if o, err = parseOrderedObj(raw); err != nil {
+				return nil, fmt.Errorf("package.json %q is not an object: %w", name, err)
+			}
+		}
+		sections[name] = o
+		return o, nil
+	}
+
+	present := map[string]bool{}
+	for _, name := range depSections {
+		o, err := getSection(name)
+		if err != nil {
+			return nil, err
+		}
+		for _, k := range o.keys {
+			present[k] = true
+		}
+	}
+
+	changed := map[string]bool{}
+
+	scripts, err := getSection("scripts")
+	if err != nil {
+		return nil, err
+	}
+	for _, k := range slices.Sorted(maps.Keys(add.Scripts)) {
+		if _, ok := scripts.vals[k]; ok {
+			rep.ScriptsSkipped = append(rep.ScriptsSkipped, k)
+			continue
+		}
+		v, _ := json.Marshal(add.Scripts[k])
+		scripts.set(k, v)
+		rep.ScriptsAdded = append(rep.ScriptsAdded, k+" = "+add.Scripts[k])
+		changed["scripts"] = true
+	}
+
+	addDeps := func(section string, entries map[string]string) error {
+		o, err := getSection(section)
+		if err != nil {
+			return err
+		}
+		for _, k := range slices.Sorted(maps.Keys(entries)) {
+			if present[k] {
+				rep.DepsSkipped = append(rep.DepsSkipped, k)
+				continue
+			}
+			v, _ := json.Marshal(entries[k])
+			o.set(k, v)
+			present[k] = true
+			rep.DepsAdded = append(rep.DepsAdded, k+" "+entries[k])
+			changed[section] = true
+		}
+		return nil
+	}
+	if err := addDeps("dependencies", add.Dependencies); err != nil {
+		return nil, err
+	}
+	if err := addDeps("devDependencies", add.DevDependencies); err != nil {
+		return nil, err
+	}
+
+	if len(changed) == 0 {
+		return orig, nil
+	}
+	rep.PkgJSONChanged = true
+	unit, nl := sniffFormat(orig)
+	for name := range changed {
+		top.set(name, sections[name].marshal(unit, unit, nl))
+	}
+	return append(top.marshal("", unit, nl), []byte(nl)...), nil
+}
diff --git a/pkg/jsonmerge_test.go b/pkg/jsonmerge_test.go
new file mode 100644
index 0000000..b09a974
--- /dev/null
+++ b/pkg/jsonmerge_test.go
@@ -0,0 +1,192 @@
+package pkg
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestMergeAddPackages(t *testing.T) {
+	base := `{
+  "name": "my-app",
+  "author": {
+    "name": "Spencer",
+    "url": "https://example.com"
+  },
+  "license": "MIT",
+  "scripts": {
+    "dev": "astro dev",
+    "format": "prettier --write ."
+  },
+  "dependencies": {
+    "astro": "^5.0.0"
+  },
+  "devDependencies": {
+    "prettier": "^3.0.0"
+  }
+}
+`
+
+	cases := []struct {
+		name        string
+		orig        string
+		add         Packages
+		wantChanged bool
+		contains    []string
+		notContains []string
+		wantErr     bool
+	}{
+		{
+			name: "adds dep and script, preserves unknown fields",
+			orig: base,
+			add: Packages{
+				Scripts:         map[string]string{"lhci": "lhci autorun"},
+				DevDependencies: DevDependencies{"@lhci/cli": "^0.14.0"},
+			},
+			wantChanged: true,
+			contains: []string{
+				"\"lhci\": \"lhci autorun\"",
+				"\"@lhci/cli\": \"^0.14.0\"",
+				// unknown field kept verbatim, interior formatting intact
+				"\"author\": {\n    \"name\": \"Spencer\",\n    \"url\": \"https://example.com\"\n  }",
+				"\"license\": \"MIT\"",
+			},
+		},
+		{
+			name: "never changes an existing script or version",
+			orig: base,
+			add: Packages{
+				Scripts:         map[string]string{"format": "biome format ."},
+				DevDependencies: DevDependencies{"prettier": "^9.9.9"},
+			},
+			wantChanged: false,
+			contains:    []string{"prettier --write .", "\"prettier\": \"^3.0.0\""},
+			notContains: []string{"biome format .", "^9.9.9"},
+		},
+		{
+			name:        "dep in the other section is skipped, not moved or duplicated",
+			orig:        base,
+			add:         Packages{Dependencies: Dependencies{"prettier": "^9.9.9"}},
+			wantChanged: false,
+		},
+		{
+			name:        "dep in peerDependencies is skipped",
+			orig:        `{"peerDependencies": {"react": "^19.0.0"}}`,
+			add:         Packages{Dependencies: Dependencies{"react": "^18.0.0"}},
+			wantChanged: false,
+			notContains: []string{"^18.0.0"},
+		},
+		{
+			name:        "creates a missing section at the end",
+			orig:        `{"name": "x"}`,
+			add:         Packages{Scripts: map[string]string{"lhci": "lhci autorun"}},
+			wantChanged: true,
+			contains:    []string{"\"scripts\": {\n    \"lhci\": \"lhci autorun\"\n  }"},
+		},
+		{
+			name:    "malformed json errors",
+			orig:    `{"name": `,
+			add:     Packages{Scripts: map[string]string{"a": "b"}},
+			wantErr: true,
+		},
+		{
+			// A rewrite would silently drop one of the duplicate values, so the
+			// merge must refuse rather than destroy user-written bytes.
+			name:    "duplicate top-level keys are refused",
+			orig:    `{"license": "MIT", "license": "ISC", "scripts": {}}`,
+			add:     Packages{Scripts: map[string]string{"lhci": "lhci autorun"}},
+			wantErr: true,
+		},
+		{
+			name:    "duplicate section keys are refused",
+			orig:    `{"scripts": {"build": "tsc", "build": "vite build"}}`,
+			add:     Packages{Scripts: map[string]string{"lhci": "lhci autorun"}},
+			wantErr: true,
+		},
+		{
+			name:    "null section is rejected before anything is written",
+			orig:    `{"devDependencies": null}`,
+			add:     Packages{DevDependencies: DevDependencies{"@lhci/cli": "^0.14.0"}},
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			rep := &AddReport{}
+			out, err := MergeAddPackages([]byte(tc.orig), tc.add, rep)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatal("expected an error")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("MergeAddPackages: %v", err)
+			}
+			if rep.PkgJSONChanged != tc.wantChanged {
+				t.Errorf("PkgJSONChanged = %v, want %v", rep.PkgJSONChanged, tc.wantChanged)
+			}
+			if !tc.wantChanged && string(out) != tc.orig {
+				t.Errorf("no-op merge must return the input byte-identical\ngot:  %q\nwant: %q", out, tc.orig)
+			}
+			for _, s := range tc.contains {
+				if !strings.Contains(string(out), s) {
+					t.Errorf("output missing %q\n%s", s, out)
+				}
+			}
+			for _, s := range tc.notContains {
+				if strings.Contains(string(out), s) {
+					t.Errorf("output should not contain %q\n%s", s, out)
+				}
+			}
+		})
+	}
+}
+
+func TestMergeAddPackagesPreservesIndentStyle(t *testing.T) {
+	// A tab-indented package.json must stay tab-indented: untouched lines keep
+	// their exact bytes and new keys use the file's own indent unit.
+	orig := "{\n\t\"name\": \"x\",\n\t\"scripts\": {\n\t\t\"dev\": \"astro dev\"\n\t}\n}\n"
+	rep := &AddReport{}
+	out, err := MergeAddPackages([]byte(orig), Packages{Scripts: map[string]string{"lhci": "lhci autorun"}}, rep)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s := string(out)
+	for _, want := range []string{"\t\"name\": \"x\"", "\t\t\"dev\": \"astro dev\"", "\t\t\"lhci\": \"lhci autorun\""} {
+		if !strings.Contains(s, want) {
+			t.Errorf("output missing %q:\n%s", want, s)
+		}
+	}
+	if strings.Contains(s, "  \"") {
+		t.Errorf("space indentation leaked into a tab-indented file:\n%s", s)
+	}
+
+	// CRLF files keep CRLF framing.
+	crlf := "{\r\n  \"name\": \"x\"\r\n}\r\n"
+	rep = &AddReport{}
+	out, err = MergeAddPackages([]byte(crlf), Packages{Scripts: map[string]string{"a": "b"}}, rep)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(out), "\r\n") || strings.Contains(strings.ReplaceAll(string(out), "\r\n", ""), "\n") {
+		t.Errorf("CRLF framing not preserved:\n%q", out)
+	}
+}
+
+func TestMergeAddPackagesPreservesKeyOrder(t *testing.T) {
+	orig := `{"zebra": 1, "apple": 2, "scripts": {"z": "1", "a": "2"}}`
+	rep := &AddReport{}
+	out, err := MergeAddPackages([]byte(orig), Packages{Scripts: map[string]string{"m": "3"}}, rep)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s := string(out)
+	if !(strings.Index(s, "zebra") < strings.Index(s, "apple") && strings.Index(s, "apple") < strings.Index(s, "scripts")) {
+		t.Errorf("top-level key order not preserved:\n%s", s)
+	}
+	// existing script order kept, new key appended after
+	if !(strings.Index(s, "\"z\"") < strings.Index(s, "\"a\"") && strings.Index(s, "\"a\"") < strings.Index(s, "\"m\"")) {
+		t.Errorf("script key order not preserved:\n%s", s)
+	}
+}
diff --git a/pkg/packagejson.go b/pkg/packagejson.go
index 9e2e1f2..42b2e55 100644
--- a/pkg/packagejson.go
+++ b/pkg/packagejson.go
@@ -127,6 +127,14 @@ func BuildPackageJSON(cfg ProjectConfig) ([]byte, error) {
 		}
 	}
 
+	// Desktop wraps the frontend, so in monorepo mode the tauri script and CLI
+	// belong to apps/web's package.json — merged before the monorepo branch.
+	if cfg.Desktop != "none" {
+		if d := reg.GetDesktop(string(cfg.Desktop)); d != nil {
+			mergePackages(&pkg, d.Packages)
+		}
+	}
+
 	// In a monorepo the backend/orm live in apps/api (see buildAPIPackageJSON),
 	// so the frontend package omits them and instead depends on the shared
 	// domain package. In the flat layout they are colocated here.
@@ -328,12 +336,14 @@ func applyCrossCuttingRules(pkg *packageJSON, cfg ProjectConfig) {
 		pkg.DevDependencies["prettier-plugin-astro"] = "0.14.1"
 	}
 
-	// eslint + vite-react → extra React eslint plugins
-	if cfg.Linter == "eslint" && cfg.Base == "vite-react" {
-		pkg.DevDependencies["globals"] = "^17.4.0"
+	// eslint + a react-integrated base → react eslint plugins. The generated
+	// eslint.config.mjs imports these whenever the base has a react
+	// integration, so the deps must track the same condition (issue #118:
+	// globals/typescript-eslint are imported unconditionally and live in the
+	// registry's eslint entry instead).
+	if cfg.Linter == "eslint" && cfg.Base.IsReactInt() {
 		pkg.DevDependencies["eslint-plugin-react-hooks"] = "^7.0.1"
 		pkg.DevDependencies["eslint-plugin-react-refresh"] = "^0.5.2"
-		pkg.DevDependencies["typescript-eslint"] = "^8.58.0"
 	}
 
 	// veevalidate + zod → @vee-validate/zod adapter
diff --git a/pkg/packagejson_test.go b/pkg/packagejson_test.go
index 4a4f82b..c09bafa 100644
--- a/pkg/packagejson_test.go
+++ b/pkg/packagejson_test.go
@@ -2,6 +2,7 @@ package pkg
 
 import (
 	"encoding/json"
+	"strings"
 	"testing"
 )
 
@@ -40,12 +41,12 @@ func TestBuildPackageJSON(t *testing.T) {
 	}
 
 	tests := []struct {
-		name       string
-		cfg        func() ProjectConfig
-		wantDep    []string // must be in dependencies
-		wantDev    []string // must be in devDependencies
-		forbidDep  []string // must NOT be in dependencies
-		forbidDev  []string // must NOT be in devDependencies
+		name      string
+		cfg       func() ProjectConfig
+		wantDep   []string // must be in dependencies
+		wantDev   []string // must be in devDependencies
+		forbidDep []string // must NOT be in dependencies
+		forbidDev []string // must NOT be in devDependencies
 	}{
 		{
 			name: "astro-react + react-hook-form + zod installs resolver",
@@ -228,3 +229,51 @@ func TestBuildPackageJSON(t *testing.T) {
 		})
 	}
 }
+
+func TestBuildPackageJSONDesktop(t *testing.T) {
+	setupRegistry(t)
+
+	cfg := NewProjectConfig()
+	cfg.Desktop = "tauri"
+	b, err := BuildPackageJSON(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{"@tauri-apps/cli", `"tauri": "tauri"`} {
+		if !strings.Contains(string(b), want) {
+			t.Errorf("package.json missing %q", want)
+		}
+	}
+
+	cfg.Desktop = "none"
+	b, err = BuildPackageJSON(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(b), "@tauri-apps/cli") {
+		t.Error("desktop none must not pull @tauri-apps/cli")
+	}
+
+	// Monorepo: the desktop packages belong to the web app only.
+	mono := NewProjectConfig()
+	mono.Base, mono.Backend, mono.ORM, mono.Database = "astro-react", "hono", "drizzle", "sqlite"
+	mono.PM, mono.Layout, mono.Desktop = "pnpm", LayoutMonorepo, "tauri"
+	web, err := BuildPackageJSON(mono)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(web), "@tauri-apps/cli") {
+		t.Error("monorepo web package.json missing @tauri-apps/cli")
+	}
+	for name, build := range map[string]func(ProjectConfig) ([]byte, error){
+		"api": BuildAPIPackageJSON, "root": BuildRootPackageJSON,
+	} {
+		b, err := build(mono)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if strings.Contains(string(b), "@tauri-apps/cli") {
+			t.Errorf("monorepo %s package.json must not carry @tauri-apps/cli", name)
+		}
+	}
+}
diff --git a/pkg/registry.go b/pkg/registry.go
index a119921..47ccd60 100644
--- a/pkg/registry.go
+++ b/pkg/registry.go
@@ -69,6 +69,7 @@ type Registry struct {
 	CommonPackages  Packages      `json:"commonPackages"`
 	Deployment      []OptionEntry `json:"deployment"`
 	CICD            []OptionEntry `json:"cicd"`
+	Desktop         []OptionEntry `json:"desktop"`
 	Backend         []OptionEntry `json:"backend"`
 	ORM             []OptionEntry `json:"orm"`
 	Database        []OptionEntry `json:"database"`
@@ -287,6 +288,19 @@ func (r *Registry) HasCICD(value string) bool {
 	return r.GetCICD(value) != nil
 }
 
+func (r *Registry) GetDesktop(value string) *OptionEntry {
+	for i := range r.Desktop {
+		if r.Desktop[i].Value == value {
+			return &r.Desktop[i]
+		}
+	}
+	return nil
+}
+
+func (r *Registry) HasDesktop(value string) bool {
+	return r.GetDesktop(value) != nil
+}
+
 func (r *Registry) GetBackend(value string) *OptionEntry {
 	for i := range r.Backend {
 		if r.Backend[i].Value == value {
diff --git a/pkg/render_test.go b/pkg/render_test.go
new file mode 100644
index 0000000..3487a11
--- /dev/null
+++ b/pkg/render_test.go
@@ -0,0 +1,270 @@
+package pkg
+
+import (
+	"encoding/json"
+	"image/color"
+	"image/png"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/spencer-osbrjp/bungkus-cli/config"
+)
+
+// goTemplateMarkers are fragments that only appear in an *unrendered* Go
+// template. They are chosen not to collide with Vue's `{{ count }}`
+// interpolation, which is legitimately present in scaffolded .vue files.
+var goTemplateMarkers = []string{
+	"{{ .", "{{.", "{{-", "-}}",
+	"{{ if", "{{if", "{{ end", "{{end", "{{ range", "{{ else",
+	"{{ printf", "{{ eq", "{{ ne", "{{ or", "{{ and",
+}
+
+// TestScaffoldRenders scaffolds representative combos in-process and asserts
+// two universal invariants on every emitted file — no unrendered template
+// residue, and valid JSON — plus a few targeted content checks. This is the
+// guard that would have caught the sqlite `file:` runtime bug, which passed
+// `go test` but broke at runtime.
+func TestScaffoldRenders(t *testing.T) {
+	setupRegistry(t)
+
+	fullstack := func() ProjectConfig {
+		c := NewProjectConfig()
+		c.Base, c.Backend, c.ORM, c.Database = "astro-react", "hono", "drizzle", "sqlite"
+		c.PM, c.Layout = "pnpm", LayoutMonorepo
+		return c
+	}
+	prismaPostgres := func() ProjectConfig {
+		c := NewProjectConfig()
+		c.Base, c.Backend, c.ORM, c.Database = "nuxt", "elysia", "prisma", "postgres"
+		c.PM, c.Layout = "pnpm", LayoutMonorepo
+		return c
+	}
+	vitePlaywright := func() ProjectConfig {
+		c := NewProjectConfig()
+		c.Base, c.Test, c.CSS = "vite-react", "playwright", "tailwindcss"
+		return c
+	}
+	plainAstro := func() ProjectConfig { return NewProjectConfig() }
+	lhciAstro := func() ProjectConfig {
+		c := NewProjectConfig()
+		c.Audit = "lhci"
+		return c
+	}
+	lhciNuxt := func() ProjectConfig {
+		c := NewProjectConfig()
+		c.Base, c.Audit = "nuxt", "lhci"
+		return c
+	}
+	tauriAstroReact := func() ProjectConfig {
+		c := NewProjectConfig()
+		c.Base, c.Desktop = "astro-react", "tauri"
+		return c
+	}
+	tauriNuxt := func() ProjectConfig {
+		c := NewProjectConfig()
+		c.Base, c.Desktop = "nuxt", "tauri"
+		return c
+	}
+	tauriMonorepo := func() ProjectConfig {
+		c := NewProjectConfig()
+		c.Base, c.Backend, c.ORM, c.Database = "astro-react", "hono", "drizzle", "sqlite"
+		c.PM, c.Layout, c.Desktop = "pnpm", LayoutMonorepo, "tauri"
+		return c
+	}
+
+	cases := []struct {
+		name string
+		cfg  ProjectConfig
+		// present/absent are project-root-relative paths that must / must not exist.
+		present []string
+		absent  []string
+		// contains maps a root-relative path to substrings it must contain.
+		contains map[string][]string
+	}{
+		{
+			name:    "fullstack_drizzle_sqlite",
+			cfg:     fullstack(),
+			present: []string{"apps/api/db/seed.ts", ".claude/settings.json", ".claude/commands/verify.md"},
+			absent:  []string{".mcp.json"},
+			contains: map[string][]string{
+				"apps/api/server/index.ts": {"/health-check"},
+				"apps/api/db/index.ts":     {"replace(/^file:"},
+				"apps/api/package.json":    {"db:seed"},
+				"AGENTS.md":                {"localhost:8000", "db:seed"},
+			},
+		},
+		{
+			name:    "fullstack_prisma_postgres",
+			cfg:     prismaPostgres(),
+			present: []string{"apps/api/prisma/seed.ts", "docker-compose.yml"},
+			contains: map[string][]string{
+				".claude/settings.json":    {"docker compose"},
+				"apps/api/server/index.ts": {"/health-check"},
+			},
+		},
+		{
+			name:    "vite_playwright_mcp",
+			cfg:     vitePlaywright(),
+			present: []string{".mcp.json"},
+			contains: map[string][]string{
+				".mcp.json": {"playwright", "@playwright/mcp"},
+			},
+		},
+		{
+			name:   "plain_astro",
+			cfg:    plainAstro(),
+			absent: []string{".mcp.json", "docker-compose.yml", "apps/api/db/seed.ts", "src-tauri"},
+		},
+		{
+			name:    "lhci_astro",
+			cfg:     lhciAstro(),
+			present: []string{"lighthouserc.json"},
+			contains: map[string][]string{
+				".github/workflows/lhci.yml": {`pages_dir="src/pages"`, "steps.affected.outputs.urls"},
+			},
+		},
+		{
+			name: "lhci_nuxt",
+			cfg:  lhciNuxt(),
+			contains: map[string][]string{
+				".github/workflows/lhci.yml": {`pages_dir="app/pages"`, "steps.affected.outputs.urls"},
+			},
+		},
+		{
+			name: "tauri_astro_react",
+			cfg:  tauriAstroReact(),
+			present: []string{
+				"src-tauri/Cargo.toml", "src-tauri/build.rs", "src-tauri/src/main.rs",
+				"src-tauri/src/lib.rs", "src-tauri/capabilities/default.json",
+				"src-tauri/.gitignore", "src-tauri/icons/icon.ico", "src-tauri/icons/icon.icns",
+				"src-tauri/icons/32x32.png",
+			},
+			contains: map[string][]string{
+				"src-tauri/tauri.conf.json": {
+					"http://localhost:3000", `"frontendDist": "../dist"`,
+					"pnpm run dev", "pnpm run build", "com.example.my-app",
+				},
+				"src-tauri/Cargo.toml": {`name = "my-app"`},
+				"package.json":         {"@tauri-apps/cli", `"tauri": "tauri"`},
+				"README.md":            {"tauri dev"},
+			},
+		},
+		{
+			name: "tauri_nuxt",
+			cfg:  tauriNuxt(),
+			contains: map[string][]string{
+				"src-tauri/tauri.conf.json": {"pnpm run generate"},
+				"nuxt.config.ts":            {"ssr: false"},
+			},
+		},
+		{
+			name: "tauri_monorepo",
+			cfg:  tauriMonorepo(),
+			present: []string{
+				"apps/web/src-tauri/tauri.conf.json",
+			},
+			contains: map[string][]string{
+				"apps/web/package.json": {"@tauri-apps/cli"},
+				"README.md":             {"--filter web tauri dev"},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := t.TempDir()
+			if err := Scaffold(dir, config.Templates, tc.cfg); err != nil {
+				t.Fatalf("Scaffold: %v", err)
+			}
+
+			// Universal invariants across every emitted file.
+			err := filepath.WalkDir(dir, func(path string, d os.DirEntry, err error) error {
+				if err != nil || d.IsDir() {
+					return err
+				}
+				rel, _ := filepath.Rel(dir, path)
+				b, err := os.ReadFile(path)
+				if err != nil {
+					return err
+				}
+				content := string(b)
+				for _, m := range goTemplateMarkers {
+					if strings.Contains(content, m) {
+						t.Errorf("unrendered template marker %q in %s", m, rel)
+					}
+				}
+				// tsconfig*.json and biome.json are JSONC (they carry comments);
+				// the scaffold leaves them unformatted, so don't strict-parse them.
+				base := filepath.Base(path)
+				isJSONC := strings.HasPrefix(base, "tsconfig") || base == "biome.json"
+				if strings.HasSuffix(path, ".json") && !isJSONC {
+					if err := json.Unmarshal(b, new(json.RawMessage)); err != nil {
+						t.Errorf("invalid JSON in %s: %v", rel, err)
+					}
+				}
+				return nil
+			})
+			if err != nil {
+				t.Fatalf("walk: %v", err)
+			}
+
+			for _, p := range tc.present {
+				if _, err := os.Stat(filepath.Join(dir, p)); err != nil {
+					t.Errorf("expected %s to exist: %v", p, err)
+				}
+			}
+			for _, p := range tc.absent {
+				if _, err := os.Stat(filepath.Join(dir, p)); err == nil {
+					t.Errorf("expected %s NOT to exist", p)
+				}
+			}
+			for p, subs := range tc.contains {
+				b, err := os.ReadFile(filepath.Join(dir, p))
+				if err != nil {
+					t.Errorf("read %s: %v", p, err)
+					continue
+				}
+				for _, s := range subs {
+					if !strings.Contains(string(b), s) {
+						t.Errorf("%s: expected to contain %q", p, s)
+					}
+				}
+			}
+		})
+	}
+}
+
+// TestTauriIconsRGBA guards the Tauri icon footgun: PNG icons must be square
+// and RGBA (tauri-build rejects palette-based PNGs at compile time), and the
+// committed binary assets must decode at all.
+func TestTauriIconsRGBA(t *testing.T) {
+	for _, name := range []string{"32x32.png", "128x128.png", "128x128@2x.png"} {
+		f, err := config.Templates.Open("templates/desktop/tauri/src-tauri/icons/" + name)
+		if err != nil {
+			t.Fatalf("open %s: %v", name, err)
+		}
+		img, err := png.Decode(f)
+		f.Close()
+		if err != nil {
+			t.Fatalf("decode %s: %v", name, err)
+		}
+		b := img.Bounds()
+		if b.Dx() != b.Dy() {
+			t.Errorf("%s is not square: %dx%d", name, b.Dx(), b.Dy())
+		}
+		switch img.ColorModel() {
+		case color.RGBAModel, color.NRGBAModel, color.RGBA64Model, color.NRGBA64Model:
+		default:
+			t.Errorf("%s is not an RGBA png (tauri build would reject it)", name)
+		}
+	}
+	for _, name := range []string{"icon.icns", "icon.ico"} {
+		f, err := config.Templates.Open("templates/desktop/tauri/src-tauri/icons/" + name)
+		if err != nil {
+			t.Fatalf("open %s: %v", name, err)
+		}
+		f.Close()
+	}
+}
diff --git a/pkg/scaffold.go b/pkg/scaffold.go
index 14ff75f..0650eb5 100644
--- a/pkg/scaffold.go
+++ b/pkg/scaffold.go
@@ -3,6 +3,7 @@ package pkg
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io/fs"
 	"os"
@@ -57,7 +58,7 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 	if entry.Group == "vite" && entry.EntryPoint != "" {
 		skip = "main.ts"
 	}
-	if err := copyDir(baseFS, webDir, cfg, skip); err != nil {
+	if err := copyDir(baseFS, webDir, cfg, skip, nil); err != nil {
 		return err
 	}
 
@@ -69,7 +70,7 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 		if err != nil {
 			return fmt.Errorf("failed to read %v integration templates: %w", entry.Integration, err)
 		}
-		if err := copyDir(integrationFS, webDir, cfg, ""); err != nil {
+		if err := copyDir(integrationFS, webDir, cfg, "", nil); err != nil {
 			return err
 		}
 	}
@@ -82,7 +83,7 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 	}
 
 	stylesDir := filepath.Join(webDir, entry.StylesDir)
-	if err := copyDir(cssFS, stylesDir, cfg, ""); err != nil {
+	if err := copyDir(cssFS, stylesDir, cfg, "", nil); err != nil {
 		return err
 	}
 
@@ -93,7 +94,7 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 		return fmt.Errorf("failed to read formatter templates: %w", err)
 	}
 
-	if err := copyDir(fmtFS, webDir, cfg, ""); err != nil {
+	if err := copyDir(fmtFS, webDir, cfg, "", nil); err != nil {
 		return err
 	}
 
@@ -104,7 +105,7 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 		if err != nil {
 			return fmt.Errorf("failed to read linter templates: %w", err)
 		}
-		if err := copyDir(linterFS, webDir, cfg, ""); err != nil {
+		if err := copyDir(linterFS, webDir, cfg, "", nil); err != nil {
 			return err
 		}
 	}
@@ -116,7 +117,7 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 		if err != nil {
 			return fmt.Errorf("failed to read package manager templates: %w", err)
 		}
-		if err := copyDir(pmFS, destDir, cfg, ""); err != nil {
+		if err := copyDir(pmFS, destDir, cfg, "", nil); err != nil {
 			return err
 		}
 	}
@@ -128,7 +129,7 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 			if err != nil {
 				return fmt.Errorf("failed to read test templates: %w", err)
 			}
-			if err := copyDir(testFS, webDir, cfg, ""); err != nil {
+			if err := copyDir(testFS, webDir, cfg, "", nil); err != nil {
 				return err
 			}
 		}
@@ -141,7 +142,7 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 			if err != nil {
 				return fmt.Errorf("failed to read audit templates: %w", err)
 			}
-			if err := copyDir(auditFS, webDir, cfg, ""); err != nil {
+			if err := copyDir(auditFS, webDir, cfg, "", nil); err != nil {
 				return err
 			}
 		}
@@ -162,7 +163,7 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 		if err != nil {
 			return fmt.Errorf("failed to read CMS templates: %w", err)
 		}
-		if err := copyDir(cmsFS, webDir, cfg, ""); err != nil {
+		if err := copyDir(cmsFS, webDir, cfg, "", nil); err != nil {
 			return err
 		}
 	}
@@ -174,7 +175,7 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 			if err != nil {
 				return fmt.Errorf("failed to read deployment templates: %w", err)
 			}
-			if err := copyDir(deployFS, webDir, cfg, ""); err != nil {
+			if err := copyDir(deployFS, webDir, cfg, "", nil); err != nil {
 				return err
 			}
 		}
@@ -187,7 +188,20 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 			if err != nil {
 				return fmt.Errorf("failed to read cicd templates: %w", err)
 			}
-			if err := copyDir(cicdFS, webDir, cfg, ""); err != nil {
+			if err := copyDir(cicdFS, webDir, cfg, "", nil); err != nil {
+				return err
+			}
+		}
+	}
+
+	if cfg.Desktop != "none" {
+		desktopDir := "templates/desktop/" + string(cfg.Desktop)
+		if _, err := fs.Stat(templates, desktopDir); err == nil {
+			desktopFS, err := fs.Sub(templates, desktopDir)
+			if err != nil {
+				return fmt.Errorf("failed to read desktop templates: %w", err)
+			}
+			if err := copyDir(desktopFS, webDir, cfg, "", nil); err != nil {
 				return err
 			}
 		}
@@ -200,7 +214,7 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 			if err != nil {
 				return fmt.Errorf("failed to read backend templates: %w", err)
 			}
-			if err := copyDir(backendFS, apiDir, cfg, ""); err != nil {
+			if err := copyDir(backendFS, apiDir, cfg, "", nil); err != nil {
 				return err
 			}
 		}
@@ -213,7 +227,7 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 			if err != nil {
 				return fmt.Errorf("failed to read orm templates: %w", err)
 			}
-			if err := copyDir(ormFS, apiDir, cfg, ""); err != nil {
+			if err := copyDir(ormFS, apiDir, cfg, "", nil); err != nil {
 				return err
 			}
 		}
@@ -229,7 +243,7 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 			if err != nil {
 				return fmt.Errorf("failed to read database templates: %w", err)
 			}
-			if err := copyDir(dbFS, destDir, cfg, ""); err != nil {
+			if err := copyDir(dbFS, destDir, cfg, "", nil); err != nil {
 				return err
 			}
 		}
@@ -240,10 +254,22 @@ func Scaffold(destDir string, templates fs.FS, cfg ProjectConfig) error {
 	if err != nil {
 		return fmt.Errorf("failed to read shared templates: %w", err)
 	}
-	if err := copyDir(sharedFS, destDir, cfg, ""); err != nil {
+	if err := copyDir(sharedFS, destDir, cfg, "", nil); err != nil {
 		return err
 	}
 
+	// Playwright ships a .mcp.json at the project root so an agent can drive the
+	// running app through the Playwright MCP server.
+	if cfg.Test == "playwright" {
+		mcpFS, err := fs.Sub(templates, "templates/agent/mcp")
+		if err != nil {
+			return fmt.Errorf("failed to read mcp templates: %w", err)
+		}
+		if err := copyDir(mcpFS, destDir, cfg, "", nil); err != nil {
+			return err
+		}
+	}
+
 	if cfg.Layout.IsMonorepo() {
 		return scaffoldMonorepo(destDir, apiDir, templates, cfg)
 	}
@@ -268,7 +294,7 @@ func scaffoldMonorepo(destDir, apiDir string, templates fs.FS, cfg ProjectConfig
 	if err != nil {
 		return fmt.Errorf("failed to read monorepo root templates: %w", err)
 	}
-	if err := copyDir(rootFS, destDir, cfg, ""); err != nil {
+	if err := copyDir(rootFS, destDir, cfg, "", nil); err != nil {
 		return err
 	}
 
@@ -288,7 +314,7 @@ func scaffoldMonorepo(destDir, apiDir string, templates fs.FS, cfg ProjectConfig
 	if err != nil {
 		return fmt.Errorf("failed to read domain templates: %w", err)
 	}
-	if err := copyDir(domainFS, domainDir, cfg, ""); err != nil {
+	if err := copyDir(domainFS, domainDir, cfg, "", nil); err != nil {
 		return err
 	}
 
@@ -308,7 +334,7 @@ func scaffoldMonorepo(destDir, apiDir string, templates fs.FS, cfg ProjectConfig
 		if err != nil {
 			return fmt.Errorf("failed to read api templates: %w", err)
 		}
-		if err := copyDir(apiFS, apiDir, cfg, ""); err != nil {
+		if err := copyDir(apiFS, apiDir, cfg, "", nil); err != nil {
 			return err
 		}
 	}
@@ -352,7 +378,10 @@ func PostScaffold(destDir string, cfg ProjectConfig) error {
 	return nil
 }
 
-func copyDir(srcFS fs.FS, destDir string, cfg ProjectConfig, skip string) error {
+// copyDir renders/copies srcFS into destDir. A non-nil rep switches to `add`
+// semantics: existing files are never overwritten, and every write or skip is
+// recorded in the report.
+func copyDir(srcFS fs.FS, destDir string, cfg ProjectConfig, skip string, rep *AddReport) error {
 	return fs.WalkDir(srcFS, ".", func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
 			return err
@@ -377,6 +406,11 @@ func copyDir(srcFS fs.FS, destDir string, cfg ProjectConfig, skip string) error
 		}
 
 		destPath := filepath.Join(destDir, path)
+		// The `add` path writes .github/** at the git root — GitHub only reads
+		// workflows from the repo root's .github/, not a subdirectory's.
+		if rep != nil && rep.GitRoot != "" && strings.HasPrefix(filepath.ToSlash(path)+"/", ".github/") {
+			destPath = filepath.Join(rep.GitRoot, path)
+		}
 
 		if d.IsDir() {
 			return os.MkdirAll(destPath, 0o755)
@@ -385,14 +419,14 @@ func copyDir(srcFS fs.FS, destDir string, cfg ProjectConfig, skip string) error
 		// Render .tmpl files, copy everything else as-is
 		if strings.HasSuffix(path, ".tmpl") {
 			destPath = strings.TrimSuffix(destPath, ".tmpl")
-			return renderTemplate(srcFS, path, destPath, cfg)
+			return renderTemplate(srcFS, path, destPath, cfg, rep)
 		}
 
-		return copyFile(srcFS, path, destPath)
+		return copyFile(srcFS, path, destPath, rep)
 	})
 }
 
-func renderTemplate(srcFS fs.FS, srcPath string, destPath string, cfg ProjectConfig) error {
+func renderTemplate(srcFS fs.FS, srcPath string, destPath string, cfg ProjectConfig, rep *AddReport) error {
 	data, err := fs.ReadFile(srcFS, srcPath)
 	if err != nil {
 		return fmt.Errorf("failed to read %s: %w", srcPath, err)
@@ -429,10 +463,10 @@ func renderTemplate(srcFS fs.FS, srcPath string, destPath string, cfg ProjectCon
 		perm = 0o755
 	}
 
-	return os.WriteFile(destPath, output, perm)
+	return writeScaffoldFile(destPath, output, perm, rep)
 }
 
-func copyFile(srcFS fs.FS, srcPath string, destPath string) error {
+func copyFile(srcFS fs.FS, srcPath string, destPath string, rep *AddReport) error {
 	data, err := fs.ReadFile(srcFS, srcPath)
 	if err != nil {
 		return fmt.Errorf("failed to read %s: %w", srcPath, err)
@@ -442,5 +476,30 @@ func copyFile(srcFS fs.FS, srcPath string, destPath string) error {
 		return fmt.Errorf("failed to create directory for %s: %w", destPath, err)
 	}
 
-	return os.WriteFile(destPath, data, 0o644)
+	return writeScaffoldFile(destPath, data, 0o644, rep)
+}
+
+// writeScaffoldFile writes one scaffolded file. With a non-nil report (the
+// `add` path) an existing file is never touched — it is recorded as skipped.
+func writeScaffoldFile(destPath string, data []byte, perm os.FileMode, rep *AddReport) error {
+	if rep == nil {
+		return os.WriteFile(destPath, data, perm)
+	}
+	f, err := os.OpenFile(destPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, perm)
+	if errors.Is(err, fs.ErrExist) {
+		rep.SkippedFiles = append(rep.SkippedFiles, destPath)
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if _, err := f.Write(data); err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Close(); err != nil {
+		return err
+	}
+	rep.CreatedFiles = append(rep.CreatedFiles, destPath)
+	return nil
 }