@elizaos/app-core 2.0.0-alpha.85 → 2.0.0-beta.1

package/packaging/msix/AppxManifest.store.xml

@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  AppxManifest.store.xml — AppContainer-sandboxed manifest for Microsoft Store distribution.
+
+  This is the store-build flavor (MILADY_BUILD_VARIANT=store). It deliberately omits
+  runFullTrust and windows.fullTrustApplication so the app runs as a regular AppContainer
+  process. As a consequence, local-agent execution paths that rely on PATH-lookup, spawning
+  external CLIs (node, bun, codex, claude), or arbitrary filesystem access are NOT available
+  in the store build — the app is forced into Cloud hosting mode (sandbox-runtime gating).
+
+  For the desktop build that can run local agents (NSIS/MSI / direct download), see
+  AppxManifest.xml.
+
+  Identity Name / Publisher / Version MUST match AppxManifest.xml so both flavors are
+  recognized as the same product by users.
+-->
+<Package
+  xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
+  xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
+  xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
+  IgnorableNamespaces="uap rescap">
+
+  <Identity
+    Name="ElizaOS.App"
+    Publisher="CN=elizaOS"
+    Version="0.0.0.0"
+    ProcessorArchitecture="x64" />
+
+  <Properties>
+    <DisplayName>elizaOS App</DisplayName>
+    <PublisherDisplayName>elizaOS</PublisherDisplayName>
+    <Logo>assets\StoreLogo.png</Logo>
+    <Description>Personal AI assistant — cute agents for the acceleration</Description>
+  </Properties>
+
+  <Dependencies>
+    <TargetDeviceFamily Name="Windows.Desktop" MinVersion="10.0.17763.0" MaxVersionTested="10.0.22621.0" />
+  </Dependencies>
+
+  <Resources>
+    <Resource Language="en-us" />
+  </Resources>
+
+  <Applications>
+    <Application Id="ElizaOSApp"
+      Executable="launcher.exe">
+      <uap:VisualElements
+        DisplayName="elizaOS App"
+        Description="Personal AI assistant"
+        BackgroundColor="transparent"
+        Square150x150Logo="assets\Square150x150Logo.png"
+        Square44x44Logo="assets\Square44x44Logo.png">
+        <uap:DefaultTile Wide310x150Logo="assets\Wide310x150Logo.png" Square310x310Logo="assets\LargeTile.png" />
+      </uap:VisualElements>
+      <Extensions>
+        <uap:Extension Category="windows.protocol">
+          <uap:Protocol Name="elizaos-app" />
+        </uap:Extension>
+      </Extensions>
+    </Application>
+  </Applications>
+
+  <Capabilities>
+    <!--
+      AppContainer capability set. Intentionally minimal:
+        - internetClient: outbound HTTPS to Eliza Cloud and model providers.
+        - internetClientServer: the renderer talks to the bundled local API process
+          on a loopback port; loopback bind requires this capability.
+        - privateNetworkClientServer: NOT included by default. Add only if a future
+          feature needs to talk to a LAN device (e.g. local Ollama on another host).
+        - broadFileSystemAccess: NOT included. The app uses the file picker contract
+          for any file the user explicitly selects.
+        - runFullTrust: NOT included. This is the whole point of the store build —
+          stay inside the AppContainer sandbox.
+    -->
+    <Capability Name="internetClient" />
+    <Capability Name="internetClientServer" />
+  </Capabilities>
+</Package>

package/packaging/msix/AppxManifest.xml

@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Package
+  xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
+  xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
+  xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
+  IgnorableNamespaces="uap rescap">
+
+  <Identity
+    Name="ElizaOS.App"
+    Publisher="CN=elizaOS"
+    Version="0.0.0.0"
+    ProcessorArchitecture="x64" />
+
+  <Properties>
+    <DisplayName>elizaOS App</DisplayName>
+    <PublisherDisplayName>elizaOS</PublisherDisplayName>
+    <Logo>assets\StoreLogo.png</Logo>
+    <Description>Personal AI assistant — cute agents for the acceleration</Description>
+  </Properties>
+
+  <Dependencies>
+    <TargetDeviceFamily Name="Windows.Desktop" MinVersion="10.0.17763.0" MaxVersionTested="10.0.22621.0" />
+  </Dependencies>
+
+  <Resources>
+    <Resource Language="en-us" />
+  </Resources>
+
+  <Applications>
+    <Application Id="ElizaOSApp"
+      Executable="launcher.exe"
+      EntryPoint="Windows.FullTrustApplication">
+      <uap:VisualElements
+        DisplayName="elizaOS App"
+        Description="Personal AI assistant"
+        BackgroundColor="transparent"
+        Square150x150Logo="assets\Square150x150Logo.png"
+        Square44x44Logo="assets\Square44x44Logo.png">
+        <uap:DefaultTile Wide310x150Logo="assets\Wide310x150Logo.png" Square310x310Logo="assets\LargeTile.png" />
+      </uap:VisualElements>
+      <Extensions>
+        <uap:Extension Category="windows.protocol">
+          <uap:Protocol Name="elizaos-app" />
+        </uap:Extension>
+      </Extensions>
+    </Application>
+  </Applications>
+
+  <Capabilities>
+    <Capability Name="internetClient" />
+    <rescap:Capability Name="runFullTrust" />
+  </Capabilities>
+</Package>

package/packaging/msix/README.md

@@ -0,0 +1,201 @@
+# MSIX Packaging for Microsoft Store
+
+## Overview
+
+This directory builds MSIX packages for two distinct Windows distribution flavors,
+selected via the `MILADY_BUILD_VARIANT` env var:
+
+| Variant | Manifest | Sandbox | Local agents | Distribution |
+|---------|----------|---------|---------------|--------------|
+| `direct` (default) | `AppxManifest.xml` | Full-trust (`runFullTrust`) | Yes | NSIS / MSI / direct download |
+| `store` | `AppxManifest.store.xml` | AppContainer | **No** (cloud only) | Microsoft Store |
+
+The two manifests share the same `Identity Name` (`ElizaOS.App`), `Publisher`
+(`CN=elizaOS`), and `Version` placeholder, so users see them as the same product.
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| `AppxManifest.xml` | Direct-build manifest (full-trust desktop) |
+| `AppxManifest.store.xml` | Store-build manifest (AppContainer-sandboxed) |
+| `build-msix.ps1` | Build script — picks manifest by `MILADY_BUILD_VARIANT`, signs, verifies |
+| `generate-placeholder-assets.ps1` | Creates placeholder visual assets |
+| `assets/` | Tile / logo artwork |
+| `store/` | Partner Center listing metadata + screenshots |
+
+## Why two manifests
+
+The original single manifest declared both `internetClient` AND `runFullTrust`,
+which defeats AppContainer entirely — the app runs with full user privileges and
+none of the store sandbox protections apply. Microsoft Store policy strongly prefers
+sandboxed apps; full-trust packages require a `runFullTrust` restricted-capability
+review and a higher bar for approval.
+
+The split lets us keep full-trust behavior for users who download us directly
+(local-agent operation requires it) while shipping a genuinely sandboxed flavor to
+the Store.
+
+## Capabilities chosen for the store build
+
+`AppxManifest.store.xml` declares only what's required for cloud-mode operation:
+
+- **`internetClient`** — outbound HTTPS to Eliza Cloud and model providers.
+- **`internetClientServer`** — the renderer talks to the bundled local API process
+  on a loopback port; loopback bind requires this capability under AppContainer.
+
+Deliberately excluded:
+
+- **`runFullTrust`** (restricted) — would void the sandbox; whole point of the
+  store flavor is to live inside AppContainer.
+- **`broadFileSystemAccess`** (restricted) — store users grant file access via the
+  file-picker contract per file. No app-wide `%USERPROFILE%` access.
+- **`privateNetworkClientServer`** — only add if a future store-build feature
+  needs to talk to a LAN device (e.g. local Ollama on a different host). Not
+  needed for cloud-only operation.
+
+We do not declare `runFullTrust` even with the `rescap` namespace. If we ever
+need it, the discussion is "do we ship a different product on the Store" — not
+"add the capability and hope the review board misses it."
+
+## Store-build runtime constraints
+
+Code paths that require full-trust will fail under AppContainer. The store build
+forces cloud hosting mode and gates these paths off via the sandbox-runtime layer
+(parallel work in the Foundation agent track). Specific paths to verify on a real
+Windows AppContainer host before Partner Center submission:
+
+- **`plugins/plugin-agent-orchestrator/src/services/pty-init.ts`** —
+  `resolveNodeWorkerPath()` walks `/opt/homebrew/bin/node`, `/usr/local/bin/node`,
+  and `~/.nvm/versions/node/*/bin/node` looking for a Node binary. Under
+  AppContainer, none of those paths are reachable, and `PATH`-lookup spawns of
+  arbitrary binaries (`node`, `bun`, `codex`, `claude`) are blocked. The store
+  build must never reach this code; gating belongs in the runtime-mode resolver.
+
+- **`packages/app-core/scripts/desktop-build.mjs`** — uses `child_process.spawn`
+  for build-time tooling (rcedit, vite, electrobun). This runs at build time on
+  the developer/CI machine, not at runtime inside the package, so it is not an
+  AppContainer concern.
+
+- **Bun-runtime subprocess shell** — anything that spawns user-supplied commands
+  (`runShell` chokepoint, `EXECUTE_CODE` action, coding-agent PTY adapters) must
+  be disabled in store builds. The runtime-mode flag must hard-error these
+  surfaces before they reach `Bun.spawn` / `child_process.spawn`.
+
+- **Filesystem writes outside the package storage** — AppContainer redirects
+  writes under `%USERPROFILE%` to per-app virtualized locations. Code that writes
+  to `~/.milady/...` outside the runtime workspace must use either the package
+  storage API or ask via file picker. The default state-dir resolution
+  (`MILADY_STATE_DIR`) already points at the per-user app data path, so this
+  largely works; verify `~/.milady/optimized-prompts` and
+  `~/.milady/audit/app-loads.jsonl` writes succeed inside the package container.
+
+This list is verification-only; the actual gating lives in the sandbox-runtime
+agent's work. If you hit a failing path here, file it against that agent rather
+than punching a hole in the manifest.
+
+## Wire-up with desktop-build
+
+`packages/app-core/scripts/desktop-build.mjs` produces the Electrobun bundle (the
+input to MSIX) but does NOT build MSIX itself. MSIX is a separate Windows-only
+step driven by `build-msix.ps1`. To produce a store MSIX:
+
+```powershell
+$env:MILADY_BUILD_VARIANT = "store"
+pwsh -File packaging/msix/build-msix.ps1 `
+  -BuildDir ./apps/app/electrobun/build `
+  -OutputDir ./apps/app/electrobun/artifacts `
+  -Version "2.0.0-beta.0"
+```
+
+The `MILADY_BUILD_VARIANT` env var is the same flag used by the runtime to gate
+local-agent execution and force cloud hosting mode. Setting it for the build also
+sets it for the packaged app's runtime via Electrobun's env propagation.
+
+## Prerequisites
+
+1. **Code signing**:
+   - For `direct` builds: `WINDOWS_SIGN_CERT_BASE64` + `WINDOWS_SIGN_CERT_PASSWORD`,
+     or Azure Trusted Signing.
+   - For `store` builds: `MILADY_MSIX_STORE_CERT_PATH` (path to the `.pfx` issued
+     by Partner Center for the registered Identity Name) +
+     `MILADY_MSIX_STORE_CERT_PASSWORD`. If absent, the MSIX is delivered unsigned
+     and Partner Center re-signs server-side on upload.
+2. **Windows SDK** — installed on CI runner (available on `windows-latest`).
+3. **Microsoft Partner Center account** — for Store submission ($19 one-time).
+
+## Building locally
+
+```powershell
+# 1. Sign the executables first (direct flavor)
+pwsh -File apps/app/electrobun/scripts/sign-windows.ps1 `
+  -ArtifactsDir ./apps/app/electrobun/artifacts `
+  -BuildDir ./apps/app/electrobun/build
+
+# 2. Build MSIX (default: direct)
+pwsh -File packaging/msix/build-msix.ps1 `
+  -BuildDir ./apps/app/electrobun/build `
+  -OutputDir ./apps/app/electrobun/artifacts `
+  -Version "2.0.0-beta.0"
+
+# 3. Build store MSIX
+$env:MILADY_BUILD_VARIANT = "store"
+pwsh -File packaging/msix/build-msix.ps1 `
+  -BuildDir ./apps/app/electrobun/build `
+  -OutputDir ./apps/app/electrobun/artifacts `
+  -Version "2.0.0-beta.0"
+```
+
+Output filenames:
+- `direct`: `ElizaOSApp-<version>-x64.msix`
+- `store`: `ElizaOSApp-<version>-x64-store.msix`
+
+## CI pipeline
+
+`release-electrobun.yml` runs the direct flavor automatically when
+`WINDOWS_SIGN_CERT_BASE64` is configured. The store flavor is opt-in: set
+`MILADY_BUILD_VARIANT=store` on the CI step that targets Partner Center upload.
+
+## Store submission
+
+1. Create a Microsoft Partner Center account at https://partner.microsoft.com.
+2. Register the app identity (`ElizaOS.App`).
+3. Replace the `Publisher="CN=elizaOS"` placeholder in **both**
+   `AppxManifest.xml` and `AppxManifest.store.xml` with the Partner Center
+   publisher ID (e.g. `CN=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX`). They MUST match
+   so users see one product.
+4. Replace placeholder assets in `assets/` with final artwork.
+5. Add screenshots to `store/screenshots/`.
+6. Build the store MSIX (`MILADY_BUILD_VARIANT=store`) and upload via Partner
+   Center. Submit for certification review.
+
+## Updating the publisher identity
+
+After registering in Partner Center, update the `Publisher=` attribute in:
+- `AppxManifest.xml`
+- `AppxManifest.store.xml`
+- `store/listing.json` → `identity.publisher`
+
+The values must match exactly. A mismatch between the manifest's `Publisher` and
+the certificate subject (or the Partner Center identity) is the most common
+cause of a rejected submission.
+
+## What to verify on a Windows host before submission
+
+These cannot be verified from a non-Windows worktree; they are a checklist for
+the Windows submission engineer:
+
+- [ ] `xmllint --noout AppxManifest.store.xml` (or any XML validator) succeeds.
+- [ ] `makeappx pack /d <staging> /p out.msix /o` succeeds against the store
+      manifest.
+- [ ] `signtool verify /pa /v out-store.msix` returns success when signed with
+      `MILADY_MSIX_STORE_CERT_PATH`.
+- [ ] App launches inside AppContainer (Task Manager → Details column "AppContainer
+      = Yes" on the launcher process).
+- [ ] Renderer reaches the local API on its loopback port without firewall prompt.
+- [ ] Outbound HTTPS to Eliza Cloud succeeds.
+- [ ] Cloud hosting mode is active; Settings → Hosting shows "Cloud (sandboxed)";
+      attempting any local-agent action surfaces the gating error rather than
+      silently failing.
+- [ ] No write attempts hit `%USERPROFILE%` outside the per-app virtualized
+      locations (use Process Monitor with the launcher process to confirm).

package/packaging/msix/build-msix.ps1

@@ -0,0 +1,206 @@
+# build-msix.ps1 — Build an MSIX package from a signed Electrobun Windows build.
+# Intended to run in CI after sign-windows.ps1.
+#
+# Usage:
+#   pwsh -File build-msix.ps1 -BuildDir ./build -OutputDir ./artifacts -Version 2.0.0
+#
+# Variant selection (env var MILADY_BUILD_VARIANT):
+#   - "store"  — Microsoft Store flavor. Uses AppxManifest.store.xml (AppContainer-
+#                sandboxed, no runFullTrust). Local-agent execution is gated off at
+#                runtime; cloud hosting only. Sign with the Microsoft Store certificate
+#                (env var MILADY_MSIX_STORE_CERT_PATH) — see TODO below.
+#   - "direct" — Default. Uses AppxManifest.xml (full-trust desktop). Distributed via
+#                NSIS/MSI; supports local agents.
+#
+# Prerequisites:
+#   - Windows SDK installed (for makeappx.exe and signtool.exe)
+#   - Executables already code-signed (sign-windows.ps1 or Azure Trusted Signing)
+#   - Either WINDOWS_SIGN_CERT_BASE64 + WINDOWS_SIGN_CERT_PASSWORD, or AZURE_TENANT_ID,
+#     or SKIP_MSIX_SIGN (build unsigned MSIX for SKIP_WINDOWS_SIGNING / Azure path)
+
+param(
+  [Parameter(Mandatory)][string]$BuildDir,
+  [Parameter(Mandatory)][string]$OutputDir,
+  [Parameter(Mandatory)][string]$Version
+)
+
+$ErrorActionPreference = "Stop"
+
+# Build variant — "store" (AppContainer / Microsoft Store) or "direct" (full-trust NSIS/MSI flavor).
+$buildVariant = if ($env:MILADY_BUILD_VARIANT) { $env:MILADY_BUILD_VARIANT.ToLower() } else { "direct" }
+if ($buildVariant -ne "store" -and $buildVariant -ne "direct") {
+  Write-Error "Invalid MILADY_BUILD_VARIANT='$buildVariant' (expected 'store' or 'direct')"
+  exit 1
+}
+Write-Host "Build variant: $buildVariant"
+
+$certBase64 = $env:WINDOWS_SIGN_CERT_BASE64
+$certPassword = $env:WINDOWS_SIGN_CERT_PASSWORD
+$timestampUrl = if ($env:WINDOWS_SIGN_TIMESTAMP_URL) { $env:WINDOWS_SIGN_TIMESTAMP_URL } else { "http://timestamp.digicert.com" }
+$azureSigning = $env:AZURE_TENANT_ID -or $env:AZURE_CLIENT_ID -or $env:SKIP_MSIX_SIGN -or $env:SKIP_WINDOWS_SIGNING
+
+if ($buildVariant -eq "store") {
+  # TODO(store-cert): When Microsoft Partner Center registration is finalized, set
+  #   MILADY_MSIX_STORE_CERT_PATH (path to the .pfx issued for the registered Identity Name)
+  #   and MILADY_MSIX_STORE_CERT_PASSWORD. Until then, store builds run unsigned and the
+  #   Partner Center upload pipeline re-signs server-side. The Identity Publisher in
+  #   AppxManifest.store.xml MUST match the publisher ID issued by Partner Center.
+  $storeCertPath = $env:MILADY_MSIX_STORE_CERT_PATH
+  $storeCertPassword = $env:MILADY_MSIX_STORE_CERT_PASSWORD
+  if ($storeCertPath -and (Test-Path $storeCertPath)) {
+    Write-Host "Store cert: $storeCertPath"
+  } else {
+    Write-Host "MILADY_MSIX_STORE_CERT_PATH not set or missing — store MSIX will be built unsigned for Partner Center re-sign."
+  }
+}
+
+if (-not $certBase64 -and -not $azureSigning) {
+  Write-Host "::warning::WINDOWS_SIGN_CERT_BASE64 not set and no Azure Trusted Signing - skipping MSIX generation"
+  exit 0
+}
+
+# Find SDK tools
+$sdkBin = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin" -Directory -ErrorAction SilentlyContinue |
+  Where-Object { $_.Name -match '^\d+\.\d+\.\d+\.\d+$' } |
+  Sort-Object { [version]$_.Name } -Descending |
+  Select-Object -First 1
+
+if (-not $sdkBin) {
+  Write-Error "Windows SDK not found"
+  exit 1
+}
+
+$makeappx = Join-Path $sdkBin.FullName "x64\makeappx.exe"
+$signtool = Join-Path $sdkBin.FullName "x64\signtool.exe"
+
+if (-not (Test-Path $makeappx)) {
+  Write-Error "makeappx.exe not found at: $makeappx"
+  exit 1
+}
+
+Write-Host "Using makeappx: $makeappx"
+Write-Host "Using signtool: $signtool"
+
+# Prepare MSIX staging directory
+$msixStaging = Join-Path $env:RUNNER_TEMP "msix-staging"
+Remove-Item $msixStaging -Recurse -Force -ErrorAction SilentlyContinue
+New-Item -ItemType Directory -Force -Path $msixStaging | Out-Null
+
+# Find the Electrobun build output (launcher.exe and its directory)
+$launcher = Get-ChildItem -Path $BuildDir -Recurse -Filter "launcher.exe" -ErrorAction SilentlyContinue |
+  Select-Object -First 1
+
+if (-not $launcher) {
+  Write-Error "launcher.exe not found under $BuildDir"
+  exit 1
+}
+
+$launcherParent = Split-Path -Parent $launcher.FullName
+# launcher.exe lives under bin/ in the Electrobun app bundle; the app root is one level up
+$appDir = if ((Split-Path -Leaf $launcherParent) -eq "bin") {
+  Split-Path -Parent $launcherParent
+} else {
+  $launcherParent
+}
+Write-Host "App directory: $appDir"
+
+# Copy app contents to staging
+Copy-Item -Path "$appDir\*" -Destination $msixStaging -Recurse -Force
+
+# Copy MSIX assets
+$msixDir = $PSScriptRoot
+$assetsSource = Join-Path $msixDir "assets"
+$assetsDest = Join-Path $msixStaging "assets"
+New-Item -ItemType Directory -Force -Path $assetsDest | Out-Null
+Copy-Item -Path "$assetsSource\*" -Destination $assetsDest -Recurse -Force
+
+# Process AppxManifest — inject version. Pick variant-specific manifest.
+$manifestFileName = if ($buildVariant -eq "store") { "AppxManifest.store.xml" } else { "AppxManifest.xml" }
+$manifestSource = Join-Path $msixDir $manifestFileName
+$manifestDest = Join-Path $msixStaging "AppxManifest.xml"
+Write-Host "Manifest source: $manifestSource"
+
+if (-not (Test-Path $manifestSource)) {
+  Write-Error "Manifest not found: $manifestSource"
+  exit 1
+}
+
+# Convert semver (2.0.0-beta.0) to Windows quad version (2.0.0.0)
+$parts = $Version -split '[-.]'
+$major = $parts[0]
+$minor = $parts[1]
+$patch = $parts[2]
+$build = if ($parts.Count -ge 5) { $parts[4] } else { "0" }
+$winVersion = "$major.$minor.$patch.$build"
+
+$manifestContent = Get-Content $manifestSource -Raw
+$manifestContent = $manifestContent -replace 'Version="0\.0\.0\.0"', "Version=`"$winVersion`""
+Set-Content -Path $manifestDest -Value $manifestContent
+Write-Host "Manifest version set to: $winVersion"
+
+# Build MSIX package
+$variantSuffix = if ($buildVariant -eq "store") { "-store" } else { "" }
+$msixOutput = Join-Path $OutputDir "ElizaOSApp-$Version-x64$variantSuffix.msix"
+New-Item -ItemType Directory -Force -Path $OutputDir | Out-Null
+
+& $makeappx pack /d $msixStaging /p $msixOutput /o
+if ($LASTEXITCODE -ne 0) {
+  Write-Error "makeappx pack failed"
+  exit 1
+}
+
+Write-Host "MSIX package created: $msixOutput"
+
+# Pick signing identity. Store builds prefer MILADY_MSIX_STORE_CERT_PATH; if absent, fall
+# through to the standard signing path (Azure Trusted Signing or WINDOWS_SIGN_CERT_BASE64).
+# If neither is configured, the MSIX is delivered unsigned for Partner Center server-side re-sign.
+$useStoreCert = $false
+$storeCertPath = $env:MILADY_MSIX_STORE_CERT_PATH
+$storeCertPassword = $env:MILADY_MSIX_STORE_CERT_PASSWORD
+if ($buildVariant -eq "store" -and $storeCertPath -and (Test-Path $storeCertPath)) {
+  $useStoreCert = $true
+}
+
+if ($env:SKIP_MSIX_SIGN -or ($azureSigning -and -not $certBase64 -and -not $useStoreCert)) {
+  if ($env:SKIP_WINDOWS_SIGNING) {
+    Write-Host "SKIP_WINDOWS_SIGNING - delivering unsigned MSIX"
+  } else {
+    Write-Host "Azure Trusted Signing path - skipping PFX signing. Azure will sign the MSIX next."
+  }
+  exit 0
+}
+
+if ($useStoreCert) {
+  Write-Host "Signing store MSIX with MILADY_MSIX_STORE_CERT_PATH"
+  & $signtool sign /f $storeCertPath /p $storeCertPassword /fd sha256 /tr $timestampUrl /td sha256 /v $msixOutput
+  if ($LASTEXITCODE -ne 0) {
+    Write-Error "Failed to sign MSIX package with store cert"
+    exit 1
+  }
+} else {
+  if (-not $certBase64) {
+    Write-Host "No signing cert available — delivering unsigned MSIX"
+    exit 0
+  }
+  # Sign the MSIX package with the dev/CI cert (WINDOWS_SIGN_CERT_BASE64)
+  $pfxPath = Join-Path $env:RUNNER_TEMP "code-signing-cert.pfx"
+  [System.IO.File]::WriteAllBytes($pfxPath, [System.Convert]::FromBase64String($certBase64))
+
+  & $signtool sign /f $pfxPath /p $certPassword /fd sha256 /tr $timestampUrl /td sha256 /v $msixOutput
+  if ($LASTEXITCODE -ne 0) {
+    Remove-Item $pfxPath -Force -ErrorAction SilentlyContinue
+    Write-Error "Failed to sign MSIX package"
+    exit 1
+  }
+
+  Remove-Item $pfxPath -Force -ErrorAction SilentlyContinue
+}
+
+# Verify
+& $signtool verify /pa /v $msixOutput
+if ($LASTEXITCODE -ne 0) {
+  Write-Error "MSIX signature verification failed"
+  exit 1
+}
+
+Write-Host "MSIX package signed and verified: $msixOutput"

package/packaging/msix/generate-placeholder-assets.ps1

@@ -0,0 +1,49 @@
+# generate-placeholder-assets.ps1 — Generate placeholder MSIX visual assets.
+# Run manually once, then replace with final artwork before Store submission.
+#
+# Usage: pwsh -File generate-placeholder-assets.ps1
+
+param(
+  [string]$OutputDir = (Join-Path $PSScriptRoot "assets")
+)
+
+$ErrorActionPreference = "Stop"
+
+New-Item -ItemType Directory -Force -Path $OutputDir | Out-Null
+
+Add-Type -AssemblyName System.Drawing
+
+$sizes = @{
+  "StoreLogo.png" = @(50, 50)
+  "Square44x44Logo.png" = @(44, 44)
+  "Square150x150Logo.png" = @(150, 150)
+  "Wide310x150Logo.png" = @(310, 150)
+  "LargeTile.png" = @(310, 310)
+}
+
+foreach ($entry in $sizes.GetEnumerator()) {
+  $width = $entry.Value[0]
+  $height = $entry.Value[1]
+  $bitmap = New-Object System.Drawing.Bitmap($width, $height)
+  $graphics = [System.Drawing.Graphics]::FromImage($bitmap)
+  $graphics.Clear([System.Drawing.Color]::FromArgb(255, 26, 26, 46))
+
+  $fontSize = [math]::Min($width, $height) * 0.4
+  $font = New-Object System.Drawing.Font("Arial", $fontSize, [System.Drawing.FontStyle]::Bold)
+  $brush = New-Object System.Drawing.SolidBrush([System.Drawing.Color]::White)
+  $sf = New-Object System.Drawing.StringFormat
+  $sf.Alignment = [System.Drawing.StringAlignment]::Center
+  $sf.LineAlignment = [System.Drawing.StringAlignment]::Center
+  $rect = New-Object System.Drawing.RectangleF(0, 0, $width, $height)
+  $graphics.DrawString("M", $font, $brush, $rect, $sf)
+
+  $outputPath = Join-Path $OutputDir $entry.Key
+  $bitmap.Save($outputPath, [System.Drawing.Imaging.ImageFormat]::Png)
+  $graphics.Dispose()
+  $bitmap.Dispose()
+
+  Write-Host "Created: $($entry.Key) (${width}x${height})"
+}
+
+Write-Host "Placeholder assets generated in $OutputDir"
+Write-Host "Replace these with final artwork before Store submission."

package/packaging/msix/store/description.md

@@ -0,0 +1,31 @@
+# elizaOS App — Microsoft Store Listing
+
+## Short Description (max 100 chars)
+Personal AI assistant that runs on your machine. Private, fast, extensible.
+
+## Description (max 10,000 chars)
+elizaOS App is a personal AI assistant that runs entirely on YOUR machine. Not in the cloud. Not on someone else's server. Your computer.
+
+Built on elizaOS, it manages your sessions, tools, and workflows through a Gateway control plane. Connect to Telegram, Discord, or use the built-in WebChat UI.
+
+**Features:**
+- Local-first AI — your data stays on your machine
+- Multiple AI providers (Anthropic Claude, OpenAI GPT, Ollama for fully local)
+- Plugin system for extensibility
+- Built-in web dashboard at localhost:2138
+- Gateway for multi-client connections
+- Customizable agent personality
+
+**Requirements:**
+- Windows 10 version 1809 or later
+- 8 GB RAM minimum (16 GB recommended)
+- Internet connection for cloud AI providers (optional with Ollama)
+
+## Search Keywords
+AI, assistant, local AI, privacy, agent, chatbot, ollama, claude, GPT
+
+## Category
+Productivity
+
+## Age Rating
+12+

package/packaging/msix/store/listing.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://partner.microsoft.com/dashboard",
+  "_comment": "Microsoft Partner Center listing metadata template. Fill in before submission.",
+  "identity": {
+    "name": "ElizaOS.App",
+    "publisher": "CN=PLACEHOLDER_PUBLISHER_ID",
+    "publisherDisplayName": "elizaOS"
+  },
+  "listing": {
+    "language": "en-us",
+    "displayName": "elizaOS App",
+    "shortDescription": "Personal AI assistant that runs on your machine. Private, fast, extensible.",
+    "category": "Productivity",
+    "subcategory": "Personal Assistant",
+    "ageRating": "12+",
+    "website": "https://app.elizaos.ai",
+    "supportUrl": "https://github.com/elizaos/elizaos-app/issues",
+    "privacyUrl": "https://app.elizaos.ai/privacy"
+  },
+  "screenshots": {
+    "_comment": "Required: 1-10 screenshots, 1366x768 or 2560x1440 recommended",
+    "files": []
+  },
+  "pricing": {
+    "model": "free"
+  }
+}

package/packaging/pypi/README.md

@@ -0,0 +1,14 @@
+# elizaos-app
+
+Python launcher for the elizaOS App.
+
+This package provides the `elizaos-app` command for environments that install
+applications through PyPI. The launcher validates that Node.js is available,
+then delegates to the version-matched npm `elizaos` command.
+
+```bash
+pip install elizaos-app
+elizaos-app --help
+```
+
+Node.js 22 or newer must be available on `PATH`.