ruby_everywhere 0.6.0 → 0.7.0

data/lib/everywhere/builders/ios.rb

@@ -15,30 +15,61 @@ module Everywhere
     # Xcode template, stamp it (xcconfig + everywhere.json + AppIcon; never
     # the pbxproj), and hand it to xcodebuild.
     #
-    # MVP scope is the Simulator (ad-hoc signed, no certs). Device signing,
-    # archive/.ipa export and store distribution hang off this same seam
-    # later — see platform/docs/build-engine.md §5.
+    # Two products come out of the same stamped project: the Simulator .app
+    # (ad-hoc signed, no certs) and, with device: true, a signed .ipa via
+    # xcodebuild archive + -exportArchive — see platform/docs/build-engine.md §5.
     class Ios
       # Fixed by the template contract: the target/product is always "App"
       # (App.app), so build paths never depend on per-app values.
       SCHEME = "App"
 
-      def initialize(config:, root:, target:, template_dir: nil)
+      # Device signing arrives through the environment, never everywhere.yml:
+      # the platform runner pulls the certificate and profile just-in-time and
+      # nothing lands in the app repo.
+      REQUIRED_SIGNING_ENV = {
+        "EVERY_IOS_TEAM_ID" => "the 10-character Apple Developer team id",
+        "EVERY_IOS_PROVISIONING_PROFILE" => "the provisioning profile NAME (not a path or UUID)"
+      }.freeze
+
+      EXPORT_METHODS = %w[app-store-connect app-store ad-hoc development release-testing enterprise].freeze
+      DEFAULT_EXPORT_METHOD = "app-store-connect"
+
+      # Distribution channels whose artifact has to reach App Store Connect: the
+      # upload happens here, on the build host, because only this machine has the
+      # archive and Xcode.
+      STORE_CHANNELS = %w[testflight app_store].freeze
+
+      # The App Store Connect API key, under the names the platform runner
+      # already exports for notarytool, plus explicit aliases for local runs.
+      ASC_ENV = {
+        key_path: %w[NOTARY_KEY EVERY_ASC_KEY],
+        key_id: %w[NOTARY_KEY_ID EVERY_ASC_KEY_ID],
+        issuer_id: %w[NOTARY_ISSUER EVERY_ASC_ISSUER_ID]
+      }.freeze
+
+      def initialize(config:, root:, target:, template_dir: nil, channel: "direct")
         @config = config
         @root = root
         @target = target
         @template_dir = template_dir
+        @channel = channel.to_s
       end
 
       # Build the Simulator .app and copy it into dist_dir. `dev` builds Debug
       # and relaxes the remote-mode requirement (the dev URL arrives at launch
       # via SIMCTL_CHILD_EVERYWHERE_DEV_URL, not baked into the bundle).
-      # Returns the path of the built .app.
-      def build!(dist_dir:, dev: false)
-        preflight!(dev: dev)
+      # `device` archives and exports a signed dist/<Name>.ipa instead.
+      # Returns the path of the built product.
+      def build!(dist_dir:, dev: false, device: false)
+        preflight!(dev: dev, device: device)
         template = @template_dir ? File.expand_path(@template_dir) : Paths.ios_dir!
         work = stage(template)
         stamp!(work)
+        if device
+          archive!(work, dist_dir)
+          return export!(work, dist_dir)
+        end
+
         configuration = dev ? "Debug" : "Release"
         xcodebuild!(work, configuration, dist_dir)
         collect(configuration, dist_dir)
@@ -49,18 +80,70 @@ module Everywhere
       def name = @config.name(target: @target)
       def bundle_id = @config.bundle_id(target: @target)
 
-      def preflight!(dev:)
+      def preflight!(dev:, device:)
         unless dev || @config.remote?
           UI.die!("iOS apps are remote mode only for now — set remote.url in config/everywhere.yml " \
                   "(the shell wraps your deployed app; nothing is packaged locally)")
         end
         UI.die!("iOS builds need macOS with Xcode installed") unless RUBY_PLATFORM.include?("darwin")
+        return device_preflight! if device
         return if Shellout.run?("xcrun", "--sdk", "iphonesimulator", "--show-sdk-path", quiet: true)
 
         UI.die!("no iOS Simulator SDK — install full Xcode (not just the Command Line Tools) " \
                 "and run: xcode-select --switch /Applications/Xcode.app")
       end
 
+      # Signing is checked before anything is staged: xcodebuild only notices a
+      # missing team or profile minutes in, at the codesign step, and says so in
+      # its own vocabulary.
+      def device_preflight!
+        unless Shellout.run?("xcrun", "--sdk", "iphoneos", "--show-sdk-path", quiet: true)
+          UI.die!("no iOS device SDK — install full Xcode (not just the Command Line Tools) " \
+                  "and run: xcode-select --switch /Applications/Xcode.app")
+        end
+
+        missing = REQUIRED_SIGNING_ENV.reject { |name, _| signing_env(name) }
+        unless missing.empty?
+          UI.die!("device builds need signing credentials in the environment:\n" \
+                  "#{missing.map { |name, hint| "  #{name} — #{hint}" }.join("\n")}")
+        end
+        unless EXPORT_METHODS.include?(export_method)
+          UI.die!("EVERY_IOS_EXPORT_METHOD=#{export_method} isn't an Xcode export method — " \
+                  "use one of: #{EXPORT_METHODS.join(", ")}")
+        end
+        asc_preflight! if store_channel?
+      end
+
+      # A store channel that can't reach App Store Connect has to fail now: the
+      # archive it would otherwise produce takes minutes and is unusable.
+      def asc_preflight!
+        missing = ASC_ENV.reject { |field, _names| asc_env(field) }
+                         .map { |_field, names| names.first }
+        unless missing.empty?
+          UI.die!("--channel #{@channel} uploads to App Store Connect, which needs an API key " \
+                  "in the environment — missing: #{missing.join(", ")}")
+        end
+        return if export_method == DEFAULT_EXPORT_METHOD
+
+        UI.die!("--channel #{@channel} uploads to App Store Connect, which only accepts " \
+                "#{DEFAULT_EXPORT_METHOD} builds — unset EVERY_IOS_EXPORT_METHOD=#{export_method}")
+      end
+
+      def signing_env(name)
+        value = ENV[name].to_s.strip
+        value.empty? ? nil : value
+      end
+
+      def asc_env(field) = ASC_ENV.fetch(field).filter_map { |name| signing_env(name) }.first
+
+      def store_channel? = STORE_CHANNELS.include?(@channel)
+      def upload_to_asc? = store_channel? && ASC_ENV.each_key.all? { |field| asc_env(field) }
+
+      def team_id = signing_env("EVERY_IOS_TEAM_ID")
+      def provisioning_profile = signing_env("EVERY_IOS_PROVISIONING_PROFILE")
+      def signing_identity = signing_env("APPLE_SIGNING_IDENTITY")
+      def export_method = signing_env("EVERY_IOS_EXPORT_METHOD") || DEFAULT_EXPORT_METHOD
+
       # Copy the template into the app's persistent work dir. Persistent (not
       # a tmpdir) so the project path is stable — Xcode's incremental state
       # stays valid and users can open the stamped project directly.
@@ -360,7 +443,7 @@ module Everywhere
           MARKETING_VERSION = #{@config.version(target: @target)}
           CURRENT_PROJECT_VERSION = 1
           INFOPLIST_KEY_CFBundleDisplayName = #{name}
-          DEVELOPMENT_TEAM =
+          DEVELOPMENT_TEAM =#{" #{team_id}" if team_id}
           #{entitlements}
         XCCONFIG
       end
@@ -415,6 +498,158 @@ module Everywhere
                              log: log, filter: LogFilter.for(:xcodebuild))
       end
 
+      # Archive for a real device. The signing settings are passed as
+      # command-line build settings because those override the project file —
+      # the template ships CODE_SIGN_STYLE = Automatic and the stamp-only
+      # contract forbids editing its pbxproj. CODE_SIGN_IDENTITY is left to
+      # xcodebuild ("Apple Distribution") unless the runner names one.
+      def archive!(work, dist_dir)
+        UI.step("archiving iOS app #{UI.dim("(xcodebuild archive, team #{team_id})")}")
+        FileUtils.mkdir_p(dist_dir)
+        FileUtils.rm_rf(archive_path(work))
+        Shellout.run_logged!({},
+                             ["xcodebuild", "archive",
+                              "-project", File.join(work, "App.xcodeproj"),
+                              "-scheme", SCHEME,
+                              "-configuration", "Release",
+                              "-destination", "generic/platform=iOS",
+                              "-archivePath", archive_path(work),
+                              "-derivedDataPath", Paths.ios_derived_data_dir,
+                              "-clonedSourcePackagesDirPath", Paths.ios_packages_dir,
+                              "CODE_SIGN_STYLE=Manual",
+                              "DEVELOPMENT_TEAM=#{team_id}",
+                              "PROVISIONING_PROFILE_SPECIFIER=#{provisioning_profile}",
+                              *("CODE_SIGN_IDENTITY=#{signing_identity}" if signing_identity)],
+                             log: File.join(dist_dir, "ios-archive.log"), filter: LogFilter.for(:xcodebuild))
+      end
+
+      # Two passes over the same archive: the local .ipa (the artifact everything
+      # downstream expects) and, for a store channel, the upload to App Store
+      # Connect. Xcode won't do both from one -exportArchive — `destination` is
+      # either export or upload — and the .ipa must exist either way.
+      def export!(work, dist_dir)
+        FileUtils.mkdir_p(dist_dir)
+        # A receipt left by a previous run would otherwise read as proof that
+        # THIS build reached App Store Connect.
+        FileUtils.rm_f(upload_receipt_path(dist_dir))
+        ipa = export_local!(work, dist_dir)
+        upload_to_asc!(work, dist_dir) if upload_to_asc?
+        ipa
+      end
+
+      def export_local!(work, dist_dir)
+        export = File.join(work, "build", "export")
+        FileUtils.rm_rf(export)
+        UI.step("exporting .ipa #{UI.dim("(#{export_method}, profile #{provisioning_profile})")}")
+        Shellout.run_logged!({},
+                             ["xcodebuild", "-exportArchive",
+                              "-archivePath", archive_path(work),
+                              "-exportOptionsPlist", write_export_options(work),
+                              "-exportPath", export],
+                             log: File.join(dist_dir, "ios-export.log"), filter: LogFilter.for(:xcodebuild))
+        collect_ipa(export, dist_dir)
+      end
+
+      # -allowProvisioningUpdates is what lets the auth-key trio stand in for a
+      # signed-in Xcode account; `destination: upload` in the plist is what makes
+      # this an upload rather than a second export.
+      def upload_to_asc!(work, dist_dir)
+        upload = File.join(work, "build", "upload")
+        FileUtils.rm_rf(upload)
+        UI.step("uploading to App Store Connect #{UI.dim("(#{@channel}, key #{asc_env(:key_id)})")}")
+        Shellout.run_logged!({},
+                             ["xcodebuild", "-exportArchive",
+                              "-archivePath", archive_path(work),
+                              "-exportOptionsPlist", write_export_options(work, destination: "upload"),
+                              "-exportPath", upload,
+                              "-allowProvisioningUpdates",
+                              "-authenticationKeyPath", asc_env(:key_path),
+                              "-authenticationKeyID", asc_env(:key_id),
+                              "-authenticationKeyIssuerID", asc_env(:issuer_id)],
+                             log: File.join(dist_dir, "ios-upload.log"), filter: LogFilter.for(:xcodebuild))
+        write_upload_receipt(work, dist_dir)
+      end
+
+      def upload_receipt_path(dist_dir) = File.join(dist_dir, "ios-upload.json")
+
+      # The contract `every release` folds into the receipt's signing bag. Written
+      # only after the upload pass returned — run_logged! dies on failure — so the
+      # file existing IS the proof that App Store Connect accepted the build.
+      def write_upload_receipt(work, dist_dir)
+        require "json"
+        require "time"
+        File.write(upload_receipt_path(dist_dir), "#{JSON.pretty_generate(
+          "uploaded" => true,
+          "destination" => "app-store-connect",
+          "method" => export_method,
+          "channel" => @channel,
+          "build_number" => archive_build_number(work),
+          "uploaded_at" => Time.now.utc.iso8601
+        )}\n")
+      end
+
+      # What ASC will show as the build: the archive's own CFBundleVersion, which
+      # the upload pass is pinned to by manageAppVersionAndBuildNumber = false.
+      def archive_build_number(work)
+        out, status = Shellout.capture("plutil", "-extract", "ApplicationProperties.CFBundleVersion",
+                                       "raw", "-o", "-", File.join(archive_path(work), "Info.plist"))
+        status&.success? ? out.strip : nil
+      end
+
+      def archive_path(work) = File.join(work, "build", "App.xcarchive")
+
+      # `destination` picks the pass: "export" writes an .ipa, "upload" hands the
+      # archive to App Store Connect. manageAppVersionAndBuildNumber is
+      # LOAD-BEARING on the upload pass — left at its default Xcode silently bumps
+      # CFBundleVersion, and the uploaded build stops matching the stored .ipa.
+      # testFlightInternalTestingOnly is deliberately never emitted: it would
+      # permanently bar the build from external TestFlight and the App Store.
+      def write_export_options(work, destination: "export")
+        upload = destination == "upload"
+        path = File.join(work, "build", upload ? "ExportOptions-upload.plist" : "ExportOptions.plist")
+        managed = "\t<key>manageAppVersionAndBuildNumber</key>\n\t<false/>\n" if upload
+        FileUtils.mkdir_p(File.dirname(path))
+        File.write(path, <<~PLIST)
+          <?xml version="1.0" encoding="UTF-8"?>
+          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+          <plist version="1.0">
+          <dict>
+          \t<key>method</key>
+          \t<string>#{export_method}</string>
+          \t<key>teamID</key>
+          \t<string>#{team_id}</string>
+          \t<key>signingStyle</key>
+          \t<string>manual</string>
+          \t<key>provisioningProfiles</key>
+          \t<dict>
+          \t\t<key>#{bundle_id}</key>
+          \t\t<string>#{xml_escape(provisioning_profile)}</string>
+          \t</dict>
+          \t<key>destination</key>
+          \t<string>#{destination}</string>
+          #{managed}\t<key>uploadSymbols</key>
+          \t<true/>
+          </dict>
+          </plist>
+        PLIST
+        path
+      end
+
+      # Profile names are free-form and come from outside the CLI, so this is
+      # the one interpolated plist value that can't be trusted as XML.
+      def xml_escape(value) = value.to_s.gsub("&", "&amp;").gsub("<", "&lt;").gsub(">", "&gt;")
+
+      def collect_ipa(export, dist_dir)
+        built = File.join(export, "App.ipa")
+        built = Dir.glob(File.join(export, "*.ipa")).min unless File.file?(built)
+        UI.die!("xcodebuild reported success but no .ipa in #{UI.short_path(export)}") unless built && File.file?(built)
+
+        dest = File.join(dist_dir, "#{name}.ipa")
+        FileUtils.rm_f(dest)
+        FileUtils.cp(built, dest)
+        dest
+      end
+
       # Copy the product out of DerivedData. The ".simulator.app" suffix keeps
       # it visibly distinct from the desktop dist/<Name>.app (and out of
       # release.rb's dist/*.app glob).

data/lib/everywhere/cli.rb

@@ -6,6 +6,7 @@ require_relative "framework"
 require_relative "commands/build"
 require_relative "commands/clean"
 require_relative "commands/dev"
+require_relative "commands/preview"
 require_relative "commands/logs"
 require_relative "commands/icon"
 require_relative "commands/doctor"
@@ -38,6 +39,7 @@ module Everywhere
     register "doctor",  Commands::Doctor
     register "install", Commands::Install
     register "dev",     Commands::Dev
+    register "preview", Commands::Preview
     register "logs",    Commands::Logs
     register "build",   Commands::Build
     register "clean",   Commands::Clean

data/lib/everywhere/commands/build.rb

@@ -18,16 +18,16 @@ module Everywhere
   module Commands
     # Press the app into a single-file binary and make it runnable on this Mac.
     #
-    # Encodes the Xcode 26 / macOS 26 workarounds discovered in the Phase 0 spike:
-    #   1. CXX compiler shim (fmt consteval + folly __compressed_pair fixes)
-    #   2. BUNDLE_FORCE_RUBY_PLATFORM so native gems compile from source
+    # Encodes the macOS 26 workarounds discovered in the Phase 0 spike:
+    #   1. BUNDLE_FORCE_RUBY_PLATFORM so native gems compile from source
     #      (tebako's strip corrupts precompiled gems' signatures -> SIGKILL)
-    #   3. Homebrew bison on PATH + LG_VADDR for tebako itself
-    #   4. Post-press ad-hoc re-sign (macOS 26 rejects the pressed signature)
+    #   2. Homebrew bison on PATH + LG_VADDR for tebako itself
+    #   3. Post-press ad-hoc re-sign (macOS 26 rejects the pressed signature)
     class Build < Dry::CLI::Command
-      SHIM = File.expand_path("~/.tebako-shims/clang++")
-
-      DEFAULT_TARGET = "macos-arm64"
+      # Derived from the host, not fixed: on an Intel Mac the pressed binary is
+      # x86_64, and a hardcoded arm64 would put that lie in the bundle metadata,
+      # the release receipt and every platform override keyed off the target.
+      DEFAULT_TARGET = RUBY_PLATFORM.match?(/arm64|aarch64/) ? "macos-arm64" : "macos-x86_64"
       IOS_TARGET = "ios-arm64"
       # The APK/AAB is universal, so the arch half is nominal — it exists only
       # so every target reads as os-arch.
@@ -37,6 +37,8 @@ module Everywhere
       # mobile platform is one entry rather than a third copy of resolve_target.
       SHORTHAND_TARGETS = { ios: IOS_TARGET, android: ANDROID_TARGET }.freeze
 
+      ANDROID_FORMATS = %w[apk aab].freeze
+
       desc "Package the app natively — desktop (tebako press + shell + .app), iOS (--ios) or Android (--android)"
 
       option :root,       default: ".",              desc: "App root directory"
@@ -46,12 +48,17 @@ module Everywhere
       option :app_name,   default: nil,              desc: "Bundle name (default: capitalized app dir)"
       option :target,     default: nil,              desc: "Build target (os-arch) — selects any platforms: overrides, default: \"#{DEFAULT_TARGET}\""
       option :shell_dir,  default: nil,              desc: "Path to the shell's src-tauri directory"
+      option :template_dir, default: nil,             desc: "Path to the mobile shell template (iOS/Android)"
+      option :format,     default: nil,               desc: "Android artifact format (#{ANDROID_FORMATS.join(" | ")}), default: apk"
+      option :channel,    default: "direct",          desc: "Distribution channel (direct | testflight | app_store | ...)"
       option :ios,        type: :boolean, default: false, desc: "Build the iOS shell (shorthand for --target #{IOS_TARGET})"
       option :android,    type: :boolean, default: false, desc: "Build the Android shell (shorthand for --target #{ANDROID_TARGET})"
+      option :device,     type: :boolean, default: false, desc: "iOS: archive and export a device .ipa instead of a simulator .app"
       option :skip_press, type: :boolean, default: false, desc: "Reuse the existing pressed binary, only rebuild the .app"
 
       def call(root: ".", output: nil, ruby: "4.0.6", entry: "native_boot.rb",
-               app_name: nil, target: nil, shell_dir: nil, ios: false, android: false, skip_press: false, **)
+               app_name: nil, target: nil, shell_dir: nil, template_dir: nil, format: nil,
+               channel: "direct", ios: false, android: false, device: false, skip_press: false, **)
         target = resolve_target(target, ios: ios, android: android)
         root_path = File.expand_path(root)
         config = Everywhere::Config.load(root_path)
@@ -61,11 +68,20 @@ module Everywhere
         # shells, each built by its own builder. Anything else has no builder yet.
         case Everywhere::Config.os_of(target)
         when "ios", "android"
-          app = mobile_builder(target).new(config: config, root: root_path, target: target)
-                                      .build!(dist_dir: File.expand_path("dist", root_path))
+          # --output names a file for the pressed desktop binary, but a mobile
+          # build's product is whatever the platform toolchain emits — so here it
+          # names the directory those products land in.
+          dist_dir = output ? File.expand_path(output) : File.expand_path("dist", root_path)
+          app = mobile_builder(target).new(config: config, root: root_path, target: target,
+                                           template_dir: template_dir, **channel_option(target, channel))
+                                      .build!(dist_dir: dist_dir, **mobile_options(target, device: device, format: format))
           UI.success("built #{rel(app, root_path)}")
           return
-        when "macos" # the rest of this method
+        when "macos" # ...which is the rest of this method
+          # Every step of it ends in codesign and an .app bundle, so a Linux
+          # host can only fail — the question is whether it fails here or
+          # thirty minutes in, at the first codesign.
+          UI.die!("desktop builds are macOS-only for now") unless RUBY_PLATFORM.include?("darwin")
         else
           UI.die!("no builder for target #{target} — macos-*, ios-* and android-* are supported")
         end
@@ -88,7 +104,7 @@ module Everywhere
         # required locally, nothing to press — just shell + config in a bundle.
         if config.remote?
           UI.step("#{UI.bold("remote")} mode → #{UI.cyan(config.remote_url)} #{UI.dim("(no local server packaged)")}")
-          app_dir = bundle_app(nil, app_name, shell_dir, config, target: target, dist_dir: File.expand_path("dist", root_path))
+          bundle_app(nil, app_name, shell_dir, config, target: target, dist_dir: File.expand_path("dist", root_path))
           return
         end
 
@@ -114,7 +130,7 @@ module Everywhere
           press!(framework, entry, ruby, output_path)
         end
 
-        bundle_app(output_path, app_name, shell_dir, config, target: target) if RUBY_PLATFORM.include?("darwin")
+        bundle_app(output_path, app_name, shell_dir, config, target: target)
 
         UI.success("built #{rel(output_path, root_path)} (#{(File.size(output_path) / 1024.0 / 1024.0).round}MB)")
       end
@@ -128,6 +144,34 @@ module Everywhere
         Everywhere::Config.os_of(target) == "android" ? Builders::Android : Builders::Ios
       end
 
+      # Only iOS distributes from the build host — the store upload rides along
+      # with the archive that's already on this machine. Android's Play upload
+      # happens platform-side, so its builder has no channel to know about.
+      def channel_option(target, channel)
+        Everywhere::Config.os_of(target) == "android" ? {} : { channel: channel }
+      end
+
+      # Each mobile builder takes the one flag that only makes sense for it, so
+      # `--format aab` on an iOS build is a mistake we name rather than drop.
+      def mobile_options(target, device:, format:)
+        if Everywhere::Config.os_of(target) == "android"
+          UI.die!("--device is an iOS flag — Android always builds an installable artifact") if device
+          { format: android_format(format) }
+        else
+          UI.die!("--format is an Android flag (#{ANDROID_FORMATS.join("/")}) — iOS builds a .app or .ipa") if format
+          { device: device }
+        end
+      end
+
+      def android_format(format)
+        return :apk if format.nil?
+
+        unless ANDROID_FORMATS.include?(format.to_s)
+          UI.die!("--format must be one of #{ANDROID_FORMATS.join(", ")} (got #{format})")
+        end
+        format.to_s.to_sym
+      end
+
       # --ios/--android are shorthand for their target, and disagreeing with an
       # explicit --target is a mistake worth naming rather than silently
       # resolving one way: both spellings were deliberate, so we can't know
@@ -173,6 +217,7 @@ module Everywhere
       end
 
       def press!(framework, entry, ruby, output_path)
+        bison_prefix! # fail here, not forty minutes deep in tebako's log
         ensure_gems!(framework) if framework.precompile?
 
         UI.step("precompiling assets")
@@ -184,21 +229,24 @@ module Everywhere
         # into the new binary. dist/ is ours — clear it.
         FileUtils.rm_rf(out_dir) if out_dir.start_with?(framework.root + File::SEPARATOR)
         FileUtils.mkdir_p(out_dir)
-        # Press into a staging dir OUTSIDE the app root for the same reason
-        # (tebako prints a big warning about exactly this).
-        staging = File.join(Dir.mktmpdir("everywhere-press"), File.basename(output_path))
         log = "#{output_path}.build.log"
 
         UI.step("rbe-tebako press #{UI.dim("(Ruby #{ruby} — grab a coffee on first run)")}")
         UI.detail("full build log: #{UI.short_path(log)}")
-        Shellout.run_logged!(press_env, ["rbe-tebako", "press",
-             "--root=#{framework.root}", "--entry-point=#{entry}",
-             "--Ruby=#{ruby}", "--output=#{staging}"], log: log, filter: LogFilter.for(:tebako))
-
-        # Tebako's final strip step only warns (and still exits 0) if it can't
-        # write the output, so verify the artifact instead of trusting exit codes.
-        UI.die!("tebako reported success but no binary was created") unless File.exist?(staging)
-        FileUtils.mv(staging, output_path)
+        # Press into a staging dir OUTSIDE the app root for the same reason
+        # (tebako prints a big warning about exactly this). Block form: the
+        # staging copy is a 100MB+ binary, and a failed press never reaches the mv.
+        Dir.mktmpdir("everywhere-press") do |staging_dir|
+          staging = File.join(staging_dir, File.basename(output_path))
+          Shellout.run_logged!(press_env, ["rbe-tebako", "press",
+               "--root=#{framework.root}", "--entry-point=#{entry}",
+               "--Ruby=#{ruby}", "--output=#{staging}"], log: log, filter: LogFilter.for(:tebako))
+
+          # Tebako's final strip step only warns (and still exits 0) if it can't
+          # write the output, so verify the artifact instead of trusting exit codes.
+          UI.die!("tebako reported success but no binary was created") unless File.exist?(staging)
+          FileUtils.mv(staging, output_path)
+        end
 
         UI.step("re-signing for macOS")
         Shellout.run!({}, "codesign", "--remove-signature", output_path)
@@ -215,11 +263,16 @@ module Everywhere
       # Assemble dist/<App Name>.app: the release shell binary + the pressed
       # Rails binary (as "app-server") + Info.plist + icon. An .app bundle is
       # just a directory layout, so we build it by hand — no tauri-cli needed.
-      def bundle_app(server_binary, app_name, shell_dir, config, target: "macos-arm64", dist_dir: nil)
-        # An app with native.desktop gets a stamped per-app shell; everyone else
-        # compiles the gem's copy against the shared target dir, exactly as
-        # before. Builders::Desktop decides which, and the rest of this method
-        # doesn't need to know.
+      def bundle_app(server_binary, app_name, shell_dir, config, target: DEFAULT_TARGET, dist_dir: nil)
+        Shellout.ensure_tool!("cargo", "the desktop shell is built with Rust — install it from https://rustup.rs")
+
+        # cargo always runs in a STAGED copy of the shell under
+        # ~/.rubyeverywhere, never in the gem (or in whatever --shell-dir
+        # points at): the icon swap below and cargo's own Cargo.lock would
+        # otherwise write into the installed gem — Errno::EACCES on a
+        # system-wide install, and one app's branding in the next app's build.
+        # An app with native.desktop additionally gets its Rust stamped in and a
+        # private target dir; the rest of this method doesn't need to know which.
         prepared = Builders::Desktop.new(config: config, root: config.root, template_dir: shell_dir).prepare!
         shell_dir = prepared.dir
         dist_dir ||= File.dirname(server_binary)
@@ -249,21 +302,15 @@ module Everywhere
 
         # Tauri bakes icons/icon.png into the shell binary and sets it as the
         # Dock icon at runtime (stomping the bundle's icns after launch), so the
-        # shell must be COMPILED with the app's icon. Swap in the shaped master
-        # for the build, restore the placeholder after; touch build.rs so
-        # tauri-build re-embeds.
-        #
-        # The restore only matters on the fast path, where shell_dir is the
-        # INSTALLED GEM and every app shares it — leaving one app's icon there
-        # would brand the next app's build. A stamped work dir belongs to this
-        # app alone, so its icon can stay: restoring would only force another
-        # re-embed on the next build.
+        # shell must be COMPILED with the app's icon. Swap the shaped master into
+        # the staged copy and touch build.rs so tauri-build re-embeds. Nothing to
+        # restore: staging re-seeds the copy from the template on every build, so
+        # the placeholder comes back by itself when app.icon goes away.
         shell_icon = File.join(shell_dir, "icons", "icon.png")
-        placeholder_backup = "#{shell_icon}.placeholder"
         if icon_source
-          FileUtils.cp(shell_icon, placeholder_backup) unless File.exist?(placeholder_backup)
           # The shaped master is already RGBA; fall back to raw RGBA conversion
-          # if shaping failed, and to the placeholder if even that fails.
+          # if shaping failed. ensure_rgba refuses before writing, so a failure
+          # leaves the staged placeholder untouched.
           dock_ok = if macos_icon == icon_source
                       Everywhere::PNG.ensure_rgba(icon_source, shell_icon)
                     else
@@ -272,21 +319,13 @@ module Everywhere
                     end
           unless dock_ok
             UI.warn "couldn't convert #{File.basename(icon_source)} to RGBA (unusual PNG flavor) — Dock icon will use the placeholder after launch"
-            FileUtils.cp(placeholder_backup, shell_icon)
           end
           FileUtils.touch(File.join(shell_dir, "build.rs"))
         end
 
         UI.step("building shell #{UI.dim(prepared.stamped? ? "(cargo release, per-app)" : "(cargo release)")}")
         target_dir = prepared.target_dir
-        begin
-          Shellout.run!({ "CARGO_TARGET_DIR" => target_dir }, "cargo", "build", "--release", chdir: shell_dir)
-        ensure
-          if !prepared.stamped? && icon_source && File.exist?(placeholder_backup)
-            FileUtils.mv(placeholder_backup, shell_icon)
-            FileUtils.touch(File.join(shell_dir, "build.rs"))
-          end
-        end
+        Shellout.run!({ "CARGO_TARGET_DIR" => target_dir }, "cargo", "build", "--release", chdir: shell_dir)
         shell_bin = Dir[File.join(target_dir, "release/*")]
                     .find { |f| File.file?(f) && File.executable?(f) && !f.end_with?(".d") }
         UI.die!("couldn't find release shell binary in #{target_dir}/release") unless shell_bin
@@ -312,7 +351,7 @@ module Everywhere
             UI.warn "splash #{splash} not found — using the default splash"
           end
         end
-        icns = make_icns(macos_icon || File.join(shell_dir, "icons", "icon.png"), resources)
+        icns = make_icns(macos_icon || shell_icon, resources)
         File.write(File.join(app_dir, "Contents", "Info.plist"),
                    info_plist(app_name, exe_name, icns, config.bundle_id(target: target), config.version(target: target)))
 
@@ -404,14 +443,30 @@ module Everywhere
       end
 
       def press_env
-        env = {
+        {
           "BUNDLE_FORCE_RUBY_PLATFORM" => "true",
-          "LG_VADDR" => "39"
+          "LG_VADDR" => "39",
+          "PATH" => "#{bison_prefix!}/bin:#{ENV.fetch("PATH")}"
         }
-        env["CXX"] = SHIM if File.exist?(SHIM)
-        bison = `brew --prefix bison 2>/dev/null`.strip
-        env["PATH"] = "#{bison}/bin:#{ENV.fetch("PATH")}" unless bison.empty?
-        env
+      end
+
+      # tebako builds Ruby from source and macOS still ships bison 2.3 (2006),
+      # which fails deep inside that build with no hint of the cause. Homebrew's
+      # is the only one that works, so a missing one is a hard stop rather than
+      # a silently dropped PATH entry.
+      def bison_prefix!
+        @bison_prefix ||= brew_bison_prefix ||
+                          UI.die!("tebako needs Homebrew bison — brew install bison")
+      end
+
+      def brew_bison_prefix
+        return nil unless Shellout.tool?("brew")
+
+        prefix, status = Shellout.capture("brew", "--prefix", "bison")
+        prefix = prefix.to_s.strip
+        # `brew --prefix <formula>` answers with the opt path whether or not the
+        # formula is installed, so the bin dir has to be checked too.
+        prefix if status&.success? && !prefix.empty? && File.directory?(File.join(prefix, "bin"))
       end
 
     end

data/lib/everywhere/commands/clean.rb

@@ -6,9 +6,9 @@ require "fileutils"
 module Everywhere
   module Commands
     # Wipes the shared build caches under ~/.rubyeverywhere (or
-    # $RUBYEVERYWHERE_HOME): the cargo shell cache, the iOS DerivedData / SPM /
-    # stamped-project dirs, and the Android Gradle home / icon font / stamped
-    # projects. Safe to run any time: everything here is derived output, so the
+    # $RUBYEVERYWHERE_HOME): the cargo shell cache, the staged desktop shells
+    # and their dev staging dirs, the iOS DerivedData / SPM / stamped-project
+    # dirs, and the Android Gradle home / icon font / stamped projects. Safe to run any time: everything here is derived output, so the
     # next `every dev`/`every build` rebuilds it — cold, and for Android that
     # includes re-downloading Gradle and the Material icon font.
     class Clean < Dry::CLI::Command
@@ -16,6 +16,11 @@ module Everywhere
 
       def call(**)
         caches = [Everywhere::Paths.cargo_target_dir,
+                  File.join(Everywhere::Paths.cache_dir, "desktop"),
+                  File.join(Everywhere::Paths.cache_dir, "desktop-target"),
+                  File.join(Everywhere::Paths.cache_dir, "desktop-app"),
+                  File.join(Everywhere::Paths.cache_dir, "desktop-icon"),
+                  File.join(Everywhere::Paths.cache_dir, "desktop-assets"),
                   Everywhere::Paths.ios_derived_data_dir,
                   Everywhere::Paths.ios_packages_dir,
                   File.join(Everywhere::Paths.cache_dir, "ios"),