ruby_everywhere 0.6.0 → 0.8.0

data/lib/everywhere/child_supervision.rb

@@ -0,0 +1,172 @@
+# frozen_string_literal: true
+
+require "socket"
+require_relative "clock"
+require_relative "child_processes"
+require_relative "relay"
+require_relative "shellout"
+require_relative "ui"
+
+module Everywhere
+  # The long-lived children a session keeps on a leash, one per key: `every
+  # dev`'s dev server, desktop shell and log stream; `every preview`'s server
+  # and tunnel.
+  #
+  # It sits above ChildProcesses — which knows how to signal one pid's process
+  # group but nothing about names — and beside Shellout, which knows how to
+  # spawn one child but never remembers it. What lives here is the
+  # session-scoped {key => pid} registry, and the teardown that must not let a
+  # child outlive the CLI that opened it.
+  #
+  # A mixin rather than a collaborator object: the registry has exactly one
+  # owner (the command), and these read as the command's own vocabulary —
+  # stop_child(:web), child_pid(:desktop).
+  module ChildSupervision
+    private
+
+    # Children are spawned from pool threads as well as the main one.
+    def init_children!
+      @pids = {}
+      @relays = {}
+      @children = Mutex.new
+    end
+
+    # Spawn a long-lived child on a pty and relay its output, one tagged line
+    # at a time. A pty rather than a pipe so foreman, cargo and friends still
+    # believe they're on a terminal and keep their colors; PTY.spawn also
+    # setsids, so a Ctrl-C at our terminal can't reach them and teardown
+    # decides when they die.
+    def supervise(key, env, cmd, chdir:, filter: nil, log: nil, on_line: nil)
+      io, pid = spawn_child(env, cmd, chdir: chdir)
+      thread = relay_thread(key, io, pid, filter: filter, log: log, on_line: on_line) if io
+      Process.detach(pid)
+      @children.synchronize do
+        @pids[key] = pid
+        @relays[key] = thread if thread
+      end
+      pid
+    end
+
+    # How this command puts a child into the world: [io, pid], where io is the
+    # side we read its output from — or nil for a child that was handed our own
+    # fds and prints for itself, which gets no relay. Overridden per command,
+    # because only the pty path is shared: what to do when there is no pty is
+    # exactly where dev and preview differ.
+    def spawn_child(env, cmd, chdir:)
+      Shellout.spawn_pty(env, cmd, chdir: chdir)
+    end
+
+    def relay_thread(key, io, pid, filter:, log:, on_line:)
+      Thread.new do
+        Thread.current.name = "relay-#{key}"
+        Thread.current.report_on_exception = false
+        begin
+          Relay.new(io, source: key, log: log, filter: filter, on_line: on_line).run
+        rescue StandardError => e
+          # Losing a relay costs us that child's output, nothing more. It must
+          # not surface later out of the join in teardown.
+          Kernel.warn("#{key} output relay stopped: #{e.class}: #{e.message}")
+        end
+        on_child_exit(key, pid)
+      end
+    end
+
+    # The child's output ended, which for a supervised child means it died.
+    # Nothing to do by default — the pid is still in the registry either way,
+    # and teardown reaps it.
+    def on_child_exit(key, pid); end
+
+    # TERM the child's whole process group, escalate to KILL, and wait for the
+    # relay to drain so its last lines aren't lost. The pid is dropped from the
+    # registry FIRST, so the relay knows this death was asked for.
+    def stop_child(key, grace: 5)
+      pid, thread = @children.synchronize { [@pids.delete(key), @relays.delete(key)] }
+      return unless pid
+
+      reap([pid], grace: grace)
+      thread&.join(1)
+    end
+
+    # TERM each process group, wait for them together rather than serially,
+    # then KILL the stragglers.
+    def reap(pids, grace: 5)
+      live = pids.compact.select { |pid| ChildProcesses.alive?(pid) }
+      return if live.empty?
+
+      live.each { |pid| ChildProcesses.signal(pid, "TERM") }
+      deadline = Clock.monotonic + grace
+      sleep(0.1) while live.any? { |pid| ChildProcesses.alive?(pid) } && Clock.monotonic < deadline
+      live.select { |pid| ChildProcesses.alive?(pid) }.each { |pid| ChildProcesses.signal(pid, "KILL") }
+    end
+
+    def child_pid(key) = @children.synchronize { @pids[key] }
+
+    # Teardown must never raise — it runs from an ensure, where an exception
+    # would mask whatever actually ended the session — and one failed step
+    # must not skip the rest, or a child survives the CLI that spawned it.
+    # That ensure can also run before init_children! ever did, which is why the
+    # registry is read through a nil guard.
+    #
+    # `before` is whatever the host has to shut down ahead of its children —
+    # for `every dev`, the dock's hold on the terminal and the build pool.
+    def teardown_children(grace: 2, before: [])
+      @stopping = true
+      pids, relays = @children ? @children.synchronize { [@pids.values, @relays.values] } : [[], []]
+      (before + [
+        # TERM everything, then give it a moment and KILL whatever is left.
+        # The CLI exits the instant this returns, so anything still alive is
+        # orphaned — and a windowed shell is exactly the kind of child that
+        # doesn't drop dead on the first signal.
+        -> { reap(pids, grace: grace) },
+        -> { relays.each { |thread| thread.join(1) } }
+      ]).each do |step|
+        step.call
+      rescue StandardError => e
+        Kernel.warn("teardown: #{e.class}: #{e.message}")
+      end
+    end
+
+    # Checked once, up front: Integer() would otherwise raise from inside
+    # port_open? — an ArgumentError backtrace after the dock has already
+    # taken over the terminal.
+    def validate_port!(port)
+      number = begin
+        Integer(port.to_s, 10)
+      rescue ArgumentError, TypeError
+        UI.die!("--port must be a number (got #{port.inspect})")
+      end
+      UI.die!("--port must be between 1 and 65535 (got #{number})") unless (1..65_535).cover?(number)
+      number.to_s
+    end
+
+    # Any connect error means "nothing listening yet" for our purposes —
+    # ECONNREFUSED is the common one, but a firewall or an exhausted fd table
+    # answers differently and must not abort the session.
+    def port_open?(port)
+      TCPSocket.new("127.0.0.1", Integer(port)).close
+      true
+    rescue SystemCallError
+      false
+    end
+
+    # Watches the child as well as the port: a dev server that dies on
+    # startup (no `bundle install`, a bin/dev whose foreman isn't installed)
+    # never opens the port, and waiting out the full timeout for it buries
+    # the error it already printed under a minute of silence.
+    #
+    # The hints are appended to the message as-is, for a caller that can say
+    # something more specific about why its server never came up.
+    def wait_for_port(port, pid: nil, timeout: 60, dead_hint: nil, slow_hint: nil)
+      deadline = Clock.monotonic + timeout
+      until port_open?(port)
+        if pid && !ChildProcesses.alive?(pid)
+          UI.die!("the dev server exited before it finished booting — scroll up for its output#{dead_hint}")
+        end
+        if Clock.monotonic > deadline
+          UI.die!("dev server never came up on port #{port} after #{timeout}s#{slow_hint}")
+        end
+        sleep 0.25
+      end
+    end
+  end
+end

data/lib/everywhere/cli.rb

@@ -6,6 +6,7 @@ require_relative "framework"
 require_relative "commands/build"
 require_relative "commands/clean"
 require_relative "commands/dev"
+require_relative "commands/preview"
 require_relative "commands/logs"
 require_relative "commands/icon"
 require_relative "commands/doctor"
@@ -38,6 +39,7 @@ module Everywhere
     register "doctor",  Commands::Doctor
     register "install", Commands::Install
     register "dev",     Commands::Dev
+    register "preview", Commands::Preview
     register "logs",    Commands::Logs
     register "build",   Commands::Build
     register "clean",   Commands::Clean

data/lib/everywhere/clock.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Everywhere
+  # The one clock every deadline in the CLI measures against. Monotonic, so a
+  # timeout can't be lengthened or skipped by an NTP step or a DST change
+  # mid-build.
+  module Clock
+    module_function
+
+    def monotonic = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+  end
+end

data/lib/everywhere/commands/build.rb

@@ -5,10 +5,12 @@ require "fileutils"
 require "tmpdir"
 require "shellwords"
 require_relative "../shellout"
+require_relative "../host"
 require_relative "../log_filter"
 require_relative "../png"
 require_relative "../icon"
 require_relative "../paths"
+require_relative "../plist"
 require_relative "../desktop_assets"
 require_relative "../builders/ios"
 require_relative "../builders/android"
@@ -18,16 +20,16 @@ module Everywhere
   module Commands
     # Press the app into a single-file binary and make it runnable on this Mac.
     #
-    # Encodes the Xcode 26 / macOS 26 workarounds discovered in the Phase 0 spike:
-    #   1. CXX compiler shim (fmt consteval + folly __compressed_pair fixes)
-    #   2. BUNDLE_FORCE_RUBY_PLATFORM so native gems compile from source
+    # Encodes the macOS 26 workarounds discovered in the Phase 0 spike:
+    #   1. BUNDLE_FORCE_RUBY_PLATFORM so native gems compile from source
     #      (tebako's strip corrupts precompiled gems' signatures -> SIGKILL)
-    #   3. Homebrew bison on PATH + LG_VADDR for tebako itself
-    #   4. Post-press ad-hoc re-sign (macOS 26 rejects the pressed signature)
+    #   2. Homebrew bison on PATH + LG_VADDR for tebako itself
+    #   3. Post-press ad-hoc re-sign (macOS 26 rejects the pressed signature)
     class Build < Dry::CLI::Command
-      SHIM = File.expand_path("~/.tebako-shims/clang++")
-
-      DEFAULT_TARGET = "macos-arm64"
+      # Derived from the host, not fixed: on an Intel Mac the pressed binary is
+      # x86_64, and a hardcoded arm64 would put that lie in the bundle metadata,
+      # the release receipt and every platform override keyed off the target.
+      DEFAULT_TARGET = RUBY_PLATFORM.match?(/arm64|aarch64/) ? "macos-arm64" : "macos-x86_64"
       IOS_TARGET = "ios-arm64"
       # The APK/AAB is universal, so the arch half is nominal — it exists only
       # so every target reads as os-arch.
@@ -37,6 +39,8 @@ module Everywhere
       # mobile platform is one entry rather than a third copy of resolve_target.
       SHORTHAND_TARGETS = { ios: IOS_TARGET, android: ANDROID_TARGET }.freeze
 
+      ANDROID_FORMATS = %w[apk aab].freeze
+
       desc "Package the app natively — desktop (tebako press + shell + .app), iOS (--ios) or Android (--android)"
 
       option :root,       default: ".",              desc: "App root directory"
@@ -46,26 +50,51 @@ module Everywhere
       option :app_name,   default: nil,              desc: "Bundle name (default: capitalized app dir)"
       option :target,     default: nil,              desc: "Build target (os-arch) — selects any platforms: overrides, default: \"#{DEFAULT_TARGET}\""
       option :shell_dir,  default: nil,              desc: "Path to the shell's src-tauri directory"
+      option :template_dir, default: nil,             desc: "Path to the mobile shell template (iOS/Android)"
+      option :format,     default: nil,               desc: "Android artifact format (#{ANDROID_FORMATS.join(" | ")}), default: apk"
+      option :channel,    default: "direct",          desc: "Distribution channel (direct | testflight | app_store | ...)"
       option :ios,        type: :boolean, default: false, desc: "Build the iOS shell (shorthand for --target #{IOS_TARGET})"
       option :android,    type: :boolean, default: false, desc: "Build the Android shell (shorthand for --target #{ANDROID_TARGET})"
+      option :device,     type: :boolean, default: false, desc: "iOS: archive and export a device .ipa instead of a simulator .app"
       option :skip_press, type: :boolean, default: false, desc: "Reuse the existing pressed binary, only rebuild the .app"
 
       def call(root: ".", output: nil, ruby: "4.0.6", entry: "native_boot.rb",
-               app_name: nil, target: nil, shell_dir: nil, ios: false, android: false, skip_press: false, **)
+               app_name: nil, target: nil, shell_dir: nil, template_dir: nil, format: nil,
+               channel: "direct", ios: false, android: false, device: false, skip_press: false, **)
         target = resolve_target(target, ios: ios, android: android)
         root_path = File.expand_path(root)
         config = Everywhere::Config.load(root_path)
 
+        # Before any builder runs: the bundle id names the work dirs they wipe
+        # and recreate, so a malformed one is a wrong path, not a wrong label.
+        identity_errors = config.identity_errors
+        UI.die!("app: in config/everywhere.yml:\n#{identity_errors.join("\n")}") unless identity_errors.empty?
+
+        # Baked into the shell here, so this is the last moment an unusable
+        # feed URL can still be a message instead of a shipped app that never
+        # updates.
+        updates_errors = config.updates_errors
+        UI.die!("updates: in config/everywhere.yml:\n#{updates_errors.join("\n")}") unless updates_errors.empty?
+
         # Builder dispatch on the target's os (build-engine.md §5): macOS is
         # the tebako+tauri path below; the mobile targets are Hotwire Native
         # shells, each built by its own builder. Anything else has no builder yet.
         case Everywhere::Config.os_of(target)
         when "ios", "android"
-          app = mobile_builder(target).new(config: config, root: root_path, target: target)
-                                      .build!(dist_dir: File.expand_path("dist", root_path))
-          UI.success("built #{rel(app, root_path)}")
+          # --output names a file for the pressed desktop binary, but a mobile
+          # build's product is whatever the platform toolchain emits — so here it
+          # names the directory those products land in.
+          dist_dir = output ? File.expand_path(output) : File.expand_path("dist", root_path)
+          app = mobile_builder(target).new(config: config, root: root_path, target: target,
+                                           template_dir: template_dir, **channel_option(target, channel))
+                                      .build!(dist_dir: dist_dir, **mobile_options(target, device: device, format: format))
+          UI.success("built #{UI.rel_path(app, root_path)}")
           return
-        when "macos" # the rest of this method
+        when "macos" # ...which is the rest of this method
+          # Every step of it ends in codesign and an .app bundle, so a Linux
+          # host can only fail — the question is whether it fails here or
+          # thirty minutes in, at the first codesign.
+          UI.die!("desktop builds are macOS-only for now") unless Host.darwin?
         else
           UI.die!("no builder for target #{target} — macos-*, ios-* and android-* are supported")
         end
@@ -88,7 +117,7 @@ module Everywhere
         # required locally, nothing to press — just shell + config in a bundle.
         if config.remote?
           UI.step("#{UI.bold("remote")} mode → #{UI.cyan(config.remote_url)} #{UI.dim("(no local server packaged)")}")
-          app_dir = bundle_app(nil, app_name, shell_dir, config, target: target, dist_dir: File.expand_path("dist", root_path))
+          bundle_app(nil, app_name, shell_dir, config, target: target, dist_dir: File.expand_path("dist", root_path))
           return
         end
 
@@ -108,15 +137,15 @@ module Everywhere
         UI.step("#{UI.bold(framework.name)} app at #{framework.root}")
 
         if skip_press
-          UI.die!("--skip-press given but #{rel(output_path, root_path)} doesn't exist") unless File.exist?(output_path)
-          UI.step("reusing pressed binary #{rel(output_path, root_path)}")
+          UI.die!("--skip-press given but #{UI.rel_path(output_path, root_path)} doesn't exist") unless File.exist?(output_path)
+          UI.step("reusing pressed binary #{UI.rel_path(output_path, root_path)}")
         else
           press!(framework, entry, ruby, output_path)
         end
 
-        bundle_app(output_path, app_name, shell_dir, config, target: target) if RUBY_PLATFORM.include?("darwin")
+        bundle_app(output_path, app_name, shell_dir, config, target: target)
 
-        UI.success("built #{rel(output_path, root_path)} (#{(File.size(output_path) / 1024.0 / 1024.0).round}MB)")
+        UI.success("built #{UI.rel_path(output_path, root_path)} (#{(File.size(output_path) / 1024.0 / 1024.0).round}MB)")
       end
 
       private
@@ -128,6 +157,34 @@ module Everywhere
         Everywhere::Config.os_of(target) == "android" ? Builders::Android : Builders::Ios
       end
 
+      # Only iOS distributes from the build host — the store upload rides along
+      # with the archive that's already on this machine. Android's Play upload
+      # happens platform-side, so its builder has no channel to know about.
+      def channel_option(target, channel)
+        Everywhere::Config.os_of(target) == "android" ? {} : { channel: channel }
+      end
+
+      # Each mobile builder takes the one flag that only makes sense for it, so
+      # `--format aab` on an iOS build is a mistake we name rather than drop.
+      def mobile_options(target, device:, format:)
+        if Everywhere::Config.os_of(target) == "android"
+          UI.die!("--device is an iOS flag — Android always builds an installable artifact") if device
+          { format: android_format(format) }
+        else
+          UI.die!("--format is an Android flag (#{ANDROID_FORMATS.join("/")}) — iOS builds a .app or .ipa") if format
+          { device: device }
+        end
+      end
+
+      def android_format(format)
+        return :apk if format.nil?
+
+        unless ANDROID_FORMATS.include?(format.to_s)
+          UI.die!("--format must be one of #{ANDROID_FORMATS.join(", ")} (got #{format})")
+        end
+        format.to_s.to_sym
+      end
+
       # --ios/--android are shorthand for their target, and disagreeing with an
       # explicit --target is a mistake worth naming rather than silently
       # resolving one way: both spellings were deliberate, so we can't know
@@ -149,8 +206,6 @@ module Everywhere
         target
       end
 
-      def rel(path, root_path) = UI.short_path(path.sub("#{root_path}/", "").sub("#{Dir.pwd}/", ""))
-
       # The precompile step runs against the HOST Ruby — unlike tebako press,
       # which installs the app's gems itself inside the packaged Ruby. A fresh
       # machine (a hosted build runner, a brand-new checkout) has Gemfile.lock
@@ -173,6 +228,7 @@ module Everywhere
       end
 
       def press!(framework, entry, ruby, output_path)
+        bison_prefix! # fail here, not forty minutes deep in tebako's log
         ensure_gems!(framework) if framework.precompile?
 
         UI.step("precompiling assets")
@@ -184,21 +240,24 @@ module Everywhere
         # into the new binary. dist/ is ours — clear it.
         FileUtils.rm_rf(out_dir) if out_dir.start_with?(framework.root + File::SEPARATOR)
         FileUtils.mkdir_p(out_dir)
-        # Press into a staging dir OUTSIDE the app root for the same reason
-        # (tebako prints a big warning about exactly this).
-        staging = File.join(Dir.mktmpdir("everywhere-press"), File.basename(output_path))
         log = "#{output_path}.build.log"
 
         UI.step("rbe-tebako press #{UI.dim("(Ruby #{ruby} — grab a coffee on first run)")}")
         UI.detail("full build log: #{UI.short_path(log)}")
-        Shellout.run_logged!(press_env, ["rbe-tebako", "press",
-             "--root=#{framework.root}", "--entry-point=#{entry}",
-             "--Ruby=#{ruby}", "--output=#{staging}"], log: log, filter: LogFilter.for(:tebako))
-
-        # Tebako's final strip step only warns (and still exits 0) if it can't
-        # write the output, so verify the artifact instead of trusting exit codes.
-        UI.die!("tebako reported success but no binary was created") unless File.exist?(staging)
-        FileUtils.mv(staging, output_path)
+        # Press into a staging dir OUTSIDE the app root for the same reason
+        # (tebako prints a big warning about exactly this). Block form: the
+        # staging copy is a 100MB+ binary, and a failed press never reaches the mv.
+        Dir.mktmpdir("everywhere-press") do |staging_dir|
+          staging = File.join(staging_dir, File.basename(output_path))
+          Shellout.run_logged!(press_env, ["rbe-tebako", "press",
+               "--root=#{framework.root}", "--entry-point=#{entry}",
+               "--Ruby=#{ruby}", "--output=#{staging}"], log: log, filter: LogFilter.for(:tebako))
+
+          # Tebako's final strip step only warns (and still exits 0) if it can't
+          # write the output, so verify the artifact instead of trusting exit codes.
+          UI.die!("tebako reported success but no binary was created") unless File.exist?(staging)
+          FileUtils.mv(staging, output_path)
+        end
 
         UI.step("re-signing for macOS")
         Shellout.run!({}, "codesign", "--remove-signature", output_path)
@@ -215,11 +274,16 @@ module Everywhere
       # Assemble dist/<App Name>.app: the release shell binary + the pressed
       # Rails binary (as "app-server") + Info.plist + icon. An .app bundle is
       # just a directory layout, so we build it by hand — no tauri-cli needed.
-      def bundle_app(server_binary, app_name, shell_dir, config, target: "macos-arm64", dist_dir: nil)
-        # An app with native.desktop gets a stamped per-app shell; everyone else
-        # compiles the gem's copy against the shared target dir, exactly as
-        # before. Builders::Desktop decides which, and the rest of this method
-        # doesn't need to know.
+      def bundle_app(server_binary, app_name, shell_dir, config, target: DEFAULT_TARGET, dist_dir: nil)
+        Shellout.ensure_tool!("cargo", "the desktop shell is built with Rust — install it from https://rustup.rs")
+
+        # cargo always runs in a STAGED copy of the shell under
+        # ~/.rubyeverywhere, never in the gem (or in whatever --shell-dir
+        # points at): the icon swap below and cargo's own Cargo.lock would
+        # otherwise write into the installed gem — Errno::EACCES on a
+        # system-wide install, and one app's branding in the next app's build.
+        # An app with native.desktop additionally gets its Rust stamped in and a
+        # private target dir; the rest of this method doesn't need to know which.
         prepared = Builders::Desktop.new(config: config, root: config.root, template_dir: shell_dir).prepare!
         shell_dir = prepared.dir
         dist_dir ||= File.dirname(server_binary)
@@ -249,21 +313,15 @@ module Everywhere
 
         # Tauri bakes icons/icon.png into the shell binary and sets it as the
         # Dock icon at runtime (stomping the bundle's icns after launch), so the
-        # shell must be COMPILED with the app's icon. Swap in the shaped master
-        # for the build, restore the placeholder after; touch build.rs so
-        # tauri-build re-embeds.
-        #
-        # The restore only matters on the fast path, where shell_dir is the
-        # INSTALLED GEM and every app shares it — leaving one app's icon there
-        # would brand the next app's build. A stamped work dir belongs to this
-        # app alone, so its icon can stay: restoring would only force another
-        # re-embed on the next build.
+        # shell must be COMPILED with the app's icon. Swap the shaped master into
+        # the staged copy and touch build.rs so tauri-build re-embeds. Nothing to
+        # restore: staging re-seeds the copy from the template on every build, so
+        # the placeholder comes back by itself when app.icon goes away.
         shell_icon = File.join(shell_dir, "icons", "icon.png")
-        placeholder_backup = "#{shell_icon}.placeholder"
         if icon_source
-          FileUtils.cp(shell_icon, placeholder_backup) unless File.exist?(placeholder_backup)
           # The shaped master is already RGBA; fall back to raw RGBA conversion
-          # if shaping failed, and to the placeholder if even that fails.
+          # if shaping failed. ensure_rgba refuses before writing, so a failure
+          # leaves the staged placeholder untouched.
           dock_ok = if macos_icon == icon_source
                       Everywhere::PNG.ensure_rgba(icon_source, shell_icon)
                     else
@@ -272,21 +330,13 @@ module Everywhere
                     end
           unless dock_ok
             UI.warn "couldn't convert #{File.basename(icon_source)} to RGBA (unusual PNG flavor) — Dock icon will use the placeholder after launch"
-            FileUtils.cp(placeholder_backup, shell_icon)
           end
           FileUtils.touch(File.join(shell_dir, "build.rs"))
         end
 
         UI.step("building shell #{UI.dim(prepared.stamped? ? "(cargo release, per-app)" : "(cargo release)")}")
         target_dir = prepared.target_dir
-        begin
-          Shellout.run!({ "CARGO_TARGET_DIR" => target_dir }, "cargo", "build", "--release", chdir: shell_dir)
-        ensure
-          if !prepared.stamped? && icon_source && File.exist?(placeholder_backup)
-            FileUtils.mv(placeholder_backup, shell_icon)
-            FileUtils.touch(File.join(shell_dir, "build.rs"))
-          end
-        end
+        Shellout.run!({ "CARGO_TARGET_DIR" => target_dir }, "cargo", "build", "--release", chdir: shell_dir)
         shell_bin = Dir[File.join(target_dir, "release/*")]
                     .find { |f| File.file?(f) && File.executable?(f) && !f.end_with?(".d") }
         UI.die!("couldn't find release shell binary in #{target_dir}/release") unless shell_bin
@@ -312,7 +362,7 @@ module Everywhere
             UI.warn "splash #{splash} not found — using the default splash"
           end
         end
-        icns = make_icns(macos_icon || File.join(shell_dir, "icons", "icon.png"), resources)
+        icns = make_icns(macos_icon || shell_icon, resources)
         File.write(File.join(app_dir, "Contents", "Info.plist"),
                    info_plist(app_name, exe_name, icns, config.bundle_id(target: target), config.version(target: target)))
 
@@ -361,6 +411,8 @@ module Everywhere
       # and CFBundleVersion come from `app.version` in everywhere.yml (via
       # config.version), so the bundle and the release.json receipt agree.
       def info_plist(app_name, exe_name, icon, identifier, version)
+        app_name, exe_name, icon, identifier, version =
+          [app_name, exe_name, icon, identifier, version].map { |v| Everywhere::Plist.escape(v) if v }
         icon_keys = icon ? "  <key>CFBundleIconFile</key><string>#{icon}</string>\n" : ""
         <<~PLIST
           <?xml version="1.0" encoding="UTF-8"?>
@@ -381,8 +433,6 @@ module Everywhere
         PLIST
       end
 
-      private
-
       # Tebako's output is thousands of lines; re-surface the warnings that
       # actually matter to the app developer after the build finishes.
       def surface_warnings(log)
@@ -404,14 +454,30 @@ module Everywhere
       end
 
       def press_env
-        env = {
+        {
           "BUNDLE_FORCE_RUBY_PLATFORM" => "true",
-          "LG_VADDR" => "39"
+          "LG_VADDR" => "39",
+          "PATH" => "#{bison_prefix!}/bin:#{ENV.fetch("PATH")}"
         }
-        env["CXX"] = SHIM if File.exist?(SHIM)
-        bison = `brew --prefix bison 2>/dev/null`.strip
-        env["PATH"] = "#{bison}/bin:#{ENV.fetch("PATH")}" unless bison.empty?
-        env
+      end
+
+      # tebako builds Ruby from source and macOS still ships bison 2.3 (2006),
+      # which fails deep inside that build with no hint of the cause. Homebrew's
+      # is the only one that works, so a missing one is a hard stop rather than
+      # a silently dropped PATH entry.
+      def bison_prefix!
+        @bison_prefix ||= brew_bison_prefix ||
+                          UI.die!("tebako needs Homebrew bison — brew install bison")
+      end
+
+      def brew_bison_prefix
+        return nil unless Shellout.tool?("brew")
+
+        prefix, status = Shellout.capture("brew", "--prefix", "bison")
+        prefix = prefix.to_s.strip
+        # `brew --prefix <formula>` answers with the opt path whether or not the
+        # formula is installed, so the bin dir has to be checked too.
+        prefix if status&.success? && !prefix.empty? && File.directory?(File.join(prefix, "bin"))
       end
 
     end

data/lib/everywhere/commands/clean.rb

@@ -6,9 +6,9 @@ require "fileutils"
 module Everywhere
   module Commands
     # Wipes the shared build caches under ~/.rubyeverywhere (or
-    # $RUBYEVERYWHERE_HOME): the cargo shell cache, the iOS DerivedData / SPM /
-    # stamped-project dirs, and the Android Gradle home / icon font / stamped
-    # projects. Safe to run any time: everything here is derived output, so the
+    # $RUBYEVERYWHERE_HOME): the cargo shell cache, the staged desktop shells
+    # and their dev staging dirs, the iOS DerivedData / SPM / stamped-project
+    # dirs, and the Android Gradle home / icon font / stamped projects. Safe to run any time: everything here is derived output, so the
     # next `every dev`/`every build` rebuilds it — cold, and for Android that
     # includes re-downloading Gradle and the Material icon font.
     class Clean < Dry::CLI::Command
@@ -16,6 +16,11 @@ module Everywhere
 
       def call(**)
         caches = [Everywhere::Paths.cargo_target_dir,
+                  File.join(Everywhere::Paths.cache_dir, "desktop"),
+                  File.join(Everywhere::Paths.cache_dir, "desktop-target"),
+                  File.join(Everywhere::Paths.cache_dir, "desktop-app"),
+                  File.join(Everywhere::Paths.cache_dir, "desktop-icon"),
+                  File.join(Everywhere::Paths.cache_dir, "desktop-assets"),
                   Everywhere::Paths.ios_derived_data_dir,
                   Everywhere::Paths.ios_packages_dir,
                   File.join(Everywhere::Paths.cache_dir, "ios"),