@elizaos/app-core 2.0.0-beta.2 → 2.0.11-beta.5

package/scripts/desktop-build.mjs

@@ -35,11 +35,149 @@ const COMMAND_PREFIX = (process.env.ELIZA_DESKTOP_COMMAND_PREFIX ?? "")
   .trim()
   .split(/\s+/)
   .filter(Boolean);
+const DESKTOP_BUILD_LOCK_DIR = path.join(ROOT, ".turbo", "desktop-build.lock");
 const RUNTIME_COPY_SCRIPT = fs.existsSync(
   path.join(ROOT, "scripts", "copy-runtime-node-modules.ts"),
 )
   ? path.join(ROOT, "scripts", "copy-runtime-node-modules.ts")
   : path.join(SCRIPT_DIR, "copy-runtime-node-modules.ts");
+const WRITE_BUILD_INFO_SCRIPT = fs.existsSync(
+  path.join(ROOT, "scripts", "write-build-info.ts"),
+)
+  ? path.join(ROOT, "scripts", "write-build-info.ts")
+  : path.join(ROOT, "packages", "scripts", "write-build-info.ts");
+
+function resolveWorkspacePackageDir(packageDirName) {
+  const candidates = [
+    path.join(ROOT, "packages", packageDirName),
+    path.join(ROOT, "eliza", "packages", packageDirName),
+  ];
+  return (
+    candidates.find((candidate) =>
+      fs.existsSync(path.join(candidate, "package.json")),
+    ) ?? candidates[0]
+  );
+}
+
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function readDesktopBuildLockOwnerPid() {
+  try {
+    const rawOwner = fs.readFileSync(
+      path.join(DESKTOP_BUILD_LOCK_DIR, "owner"),
+      "utf8",
+    );
+    const pid = Number.parseInt(rawOwner.split(/\r?\n/, 1)[0] ?? "", 10);
+    return Number.isFinite(pid) && pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
+
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (error?.code === "ESRCH") return false;
+    return true;
+  }
+}
+
+function withDesktopBuildLock(run) {
+  const lockParent = path.dirname(DESKTOP_BUILD_LOCK_DIR);
+  const staleAfterMs = 30 * 60 * 1000;
+  let announcedWait = false;
+
+  fs.mkdirSync(lockParent, { recursive: true });
+
+  for (;;) {
+    try {
+      fs.mkdirSync(DESKTOP_BUILD_LOCK_DIR);
+      fs.writeFileSync(
+        path.join(DESKTOP_BUILD_LOCK_DIR, "owner"),
+        `${process.pid}\n${new Date().toISOString()}\n`,
+      );
+      break;
+    } catch (error) {
+      if (error?.code !== "EEXIST") {
+        throw error;
+      }
+
+      let stat = null;
+      try {
+        stat = fs.statSync(DESKTOP_BUILD_LOCK_DIR);
+      } catch {
+        continue;
+      }
+
+      const ownerPid = readDesktopBuildLockOwnerPid();
+      if (
+        (ownerPid !== null && !isProcessAlive(ownerPid)) ||
+        Date.now() - stat.mtimeMs > staleAfterMs
+      ) {
+        fs.rmSync(DESKTOP_BUILD_LOCK_DIR, { recursive: true, force: true });
+        continue;
+      }
+
+      if (!announcedWait) {
+        console.log(
+          "[desktop-build] Waiting for another desktop build to finish...",
+        );
+        announcedWait = true;
+      }
+      sleepSync(250);
+    }
+  }
+
+  try {
+    run();
+  } finally {
+    fs.rmSync(DESKTOP_BUILD_LOCK_DIR, { recursive: true, force: true });
+  }
+}
+
+function resolveWorkspacePluginDir(pluginDirName) {
+  const candidates = [
+    path.join(ROOT, "plugins", pluginDirName),
+    path.join(ROOT, "eliza", "plugins", pluginDirName),
+  ];
+  return (
+    candidates.find((candidate) =>
+      fs.existsSync(path.join(candidate, "package.json")),
+    ) ?? candidates[0]
+  );
+}
+
+const APP_CORE_PACKAGE_DIR = resolveWorkspacePackageDir("app-core");
+const AGENT_PACKAGE_DIR = resolveWorkspacePackageDir("agent");
+const CLOUD_SDK_PACKAGE_DIR = resolveWorkspacePackageDir("cloud-sdk");
+const CORE_PACKAGE_DIR = resolveWorkspacePackageDir("core");
+const PLUGIN_AGENT_ORCHESTRATOR_PACKAGE_DIR = resolveWorkspacePluginDir(
+  "plugin-agent-orchestrator",
+);
+const APP_MODEL_TESTER_PACKAGE_DIR =
+  resolveWorkspacePluginDir("app-model-tester");
+const PLUGIN_LOCAL_INFERENCE_PACKAGE_DIR = resolveWorkspacePluginDir(
+  "plugin-local-inference",
+);
+const PLUGIN_REMOTE_MANIFEST_PACKAGE_DIR = resolveWorkspacePackageDir(
+  "plugin-remote-manifest",
+);
+const PLUGIN_WORKER_RUNTIME_PACKAGE_DIR = resolveWorkspacePackageDir(
+  "plugin-worker-runtime",
+);
+const SHARED_PACKAGE_DIR = resolveWorkspacePackageDir("shared");
+const SECURITY_PACKAGE_DIR = resolveWorkspacePackageDir("security");
+const UI_PACKAGE_DIR = resolveWorkspacePackageDir("ui");
+const VAULT_PACKAGE_DIR = resolveWorkspacePackageDir("vault");
+const DESKTOP_BUILD_TMP_DIR = path.join(ELECTROBUN_DIR, "tmp");
+const DESKTOP_BUILD_BUN_CACHE_DIR = path.join(
+  DESKTOP_BUILD_TMP_DIR,
+  "bun-cache",
+);
 
 const argv = process.argv.slice(2);
 const command = argv[0] && !argv[0].startsWith("--") ? argv[0] : "build";
@@ -51,18 +189,22 @@ const buildProfile =
 const variant =
   getArgValue(args, "variant") ?? process.env.VITE_APP_VARIANT ?? "base";
 const buildVariant = resolveBuildVariant(
-  getArgValue(args, "build-variant") ?? process.env.MILADY_BUILD_VARIANT,
+  getArgValue(args, "build-variant") ?? process.env.ELIZA_BUILD_VARIANT,
 );
 const buildEnv = getArgValue(args, "env") ?? process.env.BUILD_ENV ?? "";
-const buildWhisper = getBooleanArg(args, "build-whisper");
 const stageMacosReleaseApp = getBooleanArg(args, "stage-macos-release-app");
+// The macOS native-effects dylib build shells to `xcrun clang++` (Xcode CLT).
+// "Explicitly requested" decides whether missing native tooling is a hard
+// failure (CI passes --build-native-effects on a tooled runner) or a graceful
+// skip (out-of-box dev build).
+const nativeEffectsExplicitlyRequested =
+  getBooleanArg(args, "build-native-effects") ||
+  process.env.ELIZA_DESKTOP_BUILD_NATIVE_EFFECTS === "1";
 
 function resolveBuildVariant(raw) {
   if (raw === "store" || raw === "direct") return raw;
   if (raw === undefined || raw === null || raw === "") return "direct";
-  fail(
-    `Unknown --build-variant value: ${raw}. Expected "store" or "direct".`,
-  );
+  fail(`Unknown --build-variant value: ${raw}. Expected "store" or "direct".`);
 }
 const excludedOptionalPacks = [
   ...new Set([
@@ -170,7 +312,12 @@ function buildInvocation(binary, binaryArgs = []) {
 }
 
 function run(commandName, commandArgs, options = {}) {
-  const { cwd = ROOT, env = process.env, label } = options;
+  const {
+    cwd = ROOT,
+    env = process.env,
+    label,
+    allowFailure = false,
+  } = options;
   const invocation = buildInvocation(commandName, commandArgs);
   const rendered = [invocation.command, ...invocation.args].join(" ");
   console.log(`[desktop-build] ${label ?? rendered}`);
@@ -182,6 +329,12 @@ function run(commandName, commandArgs, options = {}) {
   });
 
   if (result.status !== 0) {
+    if (allowFailure) {
+      console.warn(
+        `[desktop-build] ${rendered} exited ${result.status ?? 1} (tolerated)`,
+      );
+      return;
+    }
     fail(
       `${rendered} failed with exit code ${result.status ?? 1}`,
       result.status ?? 1,
@@ -189,6 +342,24 @@ function run(commandName, commandArgs, options = {}) {
   }
 }
 
+function runStatus(commandName, commandArgs, options = {}) {
+  const { cwd = ROOT, env = process.env, label } = options;
+  const invocation = buildInvocation(commandName, commandArgs);
+  const rendered = [invocation.command, ...invocation.args].join(" ");
+  console.log(`[desktop-build] ${label ?? rendered}`);
+
+  const result = spawnSync(invocation.command, invocation.args, {
+    cwd,
+    env,
+    stdio: "inherit",
+  });
+
+  return {
+    command: rendered,
+    status: result.status ?? 1,
+  };
+}
+
 function runCapture(commandName, commandArgs, options = {}) {
   const { cwd = ROOT, env = process.env } = options;
   const invocation = buildInvocation(commandName, commandArgs);
@@ -223,6 +394,50 @@ function runBunCapture(commandArgs, options = {}) {
   return runCapture(bun, commandArgs, options);
 }
 
+function runBunStatus(commandArgs, options = {}) {
+  const bun = resolveBunBinary();
+  if (!bun) {
+    fail('Could not find "bun" in PATH.');
+  }
+  return runStatus(bun, commandArgs, options);
+}
+
+function desktopBuildTempEnv(extraEnv = {}) {
+  fs.mkdirSync(DESKTOP_BUILD_TMP_DIR, { recursive: true });
+  return {
+    ...process.env,
+    ...extraEnv,
+    TMPDIR: DESKTOP_BUILD_TMP_DIR,
+    TMP: DESKTOP_BUILD_TMP_DIR,
+    TEMP: DESKTOP_BUILD_TMP_DIR,
+    BUN_TMPDIR: DESKTOP_BUILD_TMP_DIR,
+    BUN_INSTALL_CACHE_DIR: DESKTOP_BUILD_BUN_CACHE_DIR,
+  };
+}
+
+function dependencyTreePresent(cwd) {
+  return (
+    fs.existsSync(path.join(cwd, "node_modules")) ||
+    fs.existsSync(path.join(ROOT, "node_modules"))
+  );
+}
+
+function runOptionalWorkspaceInstall(cwd, label) {
+  if (dependencyTreePresent(cwd)) {
+    console.log(`[desktop-build] ${label} (skipped; dependencies present)`);
+    return;
+  }
+  runBun(
+    ["install", "--ignore-scripts", "--cache-dir", DESKTOP_BUILD_BUN_CACHE_DIR],
+    {
+      cwd,
+      env: desktopBuildTempEnv(),
+      label,
+      allowFailure: true,
+    },
+  );
+}
+
 function resolveBunBinary() {
   if (process.platform === "win32") {
     const whereResult = spawnSync("where", ["bun"], {
@@ -257,11 +472,6 @@ function resolveBunBinary() {
   return bun;
 }
 
-function runNode(commandArgs, options = {}) {
-  const node = which("node") ?? process.execPath;
-  run(node, commandArgs, options);
-}
-
 function runPackageBinary(binary, binaryArgs, options = {}) {
   const bunx = which("bunx");
   if (bunx) {
@@ -278,6 +488,16 @@ function runPackageBinary(binary, binaryArgs, options = {}) {
   fail(`Could not find bunx or npx to run ${binary}.`);
 }
 
+function runBunPackageBinary(binary, binaryArgs, options = {}) {
+  const bunx = which("bunx");
+  if (bunx) {
+    run(bunx, ["--bun", binary, ...binaryArgs], options);
+    return;
+  }
+
+  runPackageBinary(binary, binaryArgs, options);
+}
+
 function runElectrobun(commandArgs, options = {}) {
   const direct = which("electrobun");
   if (direct) {
@@ -427,6 +647,53 @@ function runDesktopPreflight() {
     bunVersion,
     errorCode: "OK",
   });
+
+  preflightStoreVariantSigning();
+}
+
+/**
+ * Store-variant signing preflight.
+ *
+ * When building the store flavor of a desktop variant outside CI (no
+ * ELECTROBUN_SKIP_CODESIGN=1, no CI=true), fail loudly if the required
+ * signing-identity env vars aren't set. Without this, the build runs all
+ * the way through staging + packaging only to die in codesign-mas.mjs
+ * or build-msix.ps1 — wasting minutes of clock per attempt.
+ *
+ * CI builds skip this preflight because the secrets are provisioned at
+ * job-step level, after this script's preflight runs.
+ */
+function preflightStoreVariantSigning() {
+  if (buildVariant !== "store") return;
+  if (process.env.CI === "true" || process.env.ELECTROBUN_SKIP_CODESIGN === "1")
+    return;
+
+  const missing = [];
+  if (process.platform === "darwin") {
+    if (!process.env.ELIZA_MAS_SIGNING_IDENTITY?.trim()) {
+      missing.push("ELIZA_MAS_SIGNING_IDENTITY");
+    }
+  } else if (process.platform === "win32") {
+    if (!process.env.ELIZA_MSIX_STORE_CERT_PATH?.trim()) {
+      missing.push("ELIZA_MSIX_STORE_CERT_PATH");
+    }
+  } else if (process.platform === "linux") {
+    // Flatpak builds use `flatpak-builder`; no signing env vars are required
+    // (Flathub signs the repo server-side).
+  }
+
+  if (missing.length === 0) return;
+
+  failPreflight(
+    "Store-variant build requires signing env vars (or set ELECTROBUN_SKIP_CODESIGN=1 for unsigned local builds).",
+    {
+      step: "store-signing",
+      platform: process.platform,
+      buildVariant,
+      missing,
+    },
+    missing.map((name) => `  set ${name}=... before running`),
+  );
 }
 
 function findLatestMacAppBundle() {
@@ -461,60 +728,299 @@ function findLatestMacAppBundle() {
   return candidates[0].appBundlePath;
 }
 
-function stageDesktopBuild() {
-  ensureAppDirs();
+function hasRootTsdownEntry() {
+  return (
+    fs.existsSync(path.join(ROOT, "tsdown.config.ts")) ||
+    fs.existsSync(path.join(ROOT, "tsdown.config.mts")) ||
+    fs.existsSync(path.join(ROOT, "tsdown.config.js")) ||
+    fs.existsSync(path.join(ROOT, "src", "index.ts"))
+  );
+}
 
-  runPackageBinary("tsdown", [], {
-    cwd: ROOT,
-    label: "Building core runtime bundle with tsdown",
+function ensureRootRuntimeBundle() {
+  if (hasRootTsdownEntry()) {
+    runPackageBinary("tsdown", [], {
+      cwd: ROOT,
+      label: "Building core runtime bundle with tsdown",
+    });
+    return;
+  }
+
+  const distDir = path.join(ROOT, "dist");
+  const entrySource = [
+    "// auto-generated by desktop-build.mjs",
+    "// Standalone elizaOS checkouts do not have a root tsdown entry.",
+    "// Packaged desktop runtimes resolve the real CLI entry from the bundled node_modules tree.",
+    'import "./node_modules/@elizaos/app-core/dist/entry.js";',
+    "",
+  ].join("\n");
+
+  fs.mkdirSync(distDir, { recursive: true });
+  fs.writeFileSync(path.join(distDir, "entry.js"), entrySource);
+  fs.writeFileSync(path.join(distDir, "index.js"), entrySource);
+  fs.writeFileSync(path.join(distDir, "package.json"), '{"type":"module"}\n');
+}
+
+// The desktop build compiles the @elizaos/* workspace packages from source, so
+// it only works when those packages are present on disk (a workspace/local
+// checkout). In packages mode they are resolved from node_modules instead and
+// resolveWorkspacePackageDir() falls back to a non-existent ROOT/packages/* dir,
+// which previously surfaced deep in the build as a cryptic
+// "Expected @elizaos/core package not found". Detect this once, up front, with
+// an actionable message instead.
+function ensureWorkspaceCheckoutPresent() {
+  if (fs.existsSync(path.join(CORE_PACKAGE_DIR, "package.json"))) {
+    return;
+  }
+  fail(
+    "Desktop build requires the @elizaos/* workspace packages on disk, but " +
+      `none were found (looked for ${path.join(CORE_PACKAGE_DIR, "package.json")}).\n` +
+      "  Run the desktop build from a workspace checkout where packages/* (or " +
+      "eliza/packages/*) are present.",
+  );
+}
+
+function ensureWorkspaceRuntimePackageBuilt(packageName, packageDir) {
+  const packageJson = path.join(packageDir, "package.json");
+  if (!fs.existsSync(packageJson)) {
+    fail(`Expected ${packageName} package not found: ${packageDir}`);
+  }
+
+  if (
+    process.env.ELIZA_DESKTOP_REBUILD_RUNTIME_PACKAGES !== "1" &&
+    workspaceRuntimePackageLooksBuilt(packageName, packageDir)
+  ) {
+    console.log(
+      `[desktop-build] Reusing existing ${packageName} runtime package`,
+    );
+    return;
+  }
+
+  runBun(["run", "build"], {
+    cwd: packageDir,
+    label: `Building ${packageName} runtime package`,
   });
+}
 
-  runNode(["--import", "tsx", "scripts/write-build-info.ts"], {
-    cwd: ROOT,
-    label: "Writing build metadata",
+function workspaceRuntimePackageLooksBuilt(packageName, packageDir) {
+  const distDir = path.join(packageDir, "dist");
+  if (!fs.existsSync(distDir)) return false;
+
+  if (packageName === "@elizaos/core") {
+    return (
+      fs.existsSync(path.join(distDir, "node", "index.node.js")) &&
+      fs.existsSync(path.join(distDir, "index.node.d.ts")) &&
+      fs.existsSync(path.join(distDir, "testing", "live-provider.d.ts"))
+    );
+  }
+
+  if (packageName === "@elizaos/ui") {
+    return (
+      fs.existsSync(path.join(distDir, "index.js")) &&
+      fs.existsSync(path.join(distDir, "App.js")) &&
+      fs.existsSync(path.join(distDir, "components", "pages", "LogsView.js"))
+    );
+  }
+
+  return true;
+}
+
+function ensureWorkspaceRuntimePackagesBuilt() {
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/core", CORE_PACKAGE_DIR);
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/shared", SHARED_PACKAGE_DIR);
+  ensureWorkspaceRuntimePackageBuilt(
+    "@elizaos/cloud-sdk",
+    CLOUD_SDK_PACKAGE_DIR,
+  );
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/security", SECURITY_PACKAGE_DIR);
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/vault", VAULT_PACKAGE_DIR);
+  ensureWorkspaceRuntimePackageBuilt(
+    "@elizaos/plugin-remote-manifest",
+    PLUGIN_REMOTE_MANIFEST_PACKAGE_DIR,
+  );
+  ensureWorkspaceRuntimePackageBuilt(
+    "@elizaos/plugin-agent-orchestrator",
+    PLUGIN_AGENT_ORCHESTRATOR_PACKAGE_DIR,
+  );
+  ensureWorkspaceRuntimePackageBuilt(
+    "@elizaos/app-model-tester",
+    APP_MODEL_TESTER_PACKAGE_DIR,
+  );
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/ui", UI_PACKAGE_DIR);
+  ensureWorkspaceRuntimePackageBuilt(
+    "@elizaos/plugin-local-inference",
+    PLUGIN_LOCAL_INFERENCE_PACKAGE_DIR,
+  );
+  ensureWorkspaceRuntimePackageBuilt(
+    "@elizaos/plugin-worker-runtime",
+    PLUGIN_WORKER_RUNTIME_PACKAGE_DIR,
+  );
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/agent", AGENT_PACKAGE_DIR);
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/app-core", APP_CORE_PACKAGE_DIR);
+}
+
+function ensureUiGeneratedAssets() {
+  runBun(["run", "generate:css-strings"], {
+    cwd: UI_PACKAGE_DIR,
+    label: "Generating @elizaos/ui CSS string modules",
   });
+}
+
+function desktopRendererBuildEnv() {
+  const env = {
+    ...process.env,
+    VITE_APP_VARIANT: variant,
+    ELIZA_BUILD_VARIANT: buildVariant,
+  };
+  if (env.ELIZA_SKIP_LOCAL_UPSTREAMS !== "1") {
+    env.ELIZA_FORCE_LOCAL_UPSTREAMS = "1";
+  }
+  return env;
+}
+
+function runtimeCopyArgs() {
+  return [
+    RUNTIME_COPY_SCRIPT,
+    "--scan-dir",
+    "dist",
+    "--target-dist",
+    "dist",
+    ...excludedOptionalPacks.flatMap((pack) => [
+      "--exclude-optional-pack",
+      pack,
+    ]),
+  ];
+}
+
+function runtimeCopyLabel() {
+  return excludedOptionalPacks.length > 0
+    ? `Bundling runtime node_modules into dist (profile=${buildProfile}, excluding: ${excludedOptionalPacks.join(", ")})`
+    : `Bundling runtime node_modules into dist (profile=${buildProfile})`;
+}
+
+function formatGiB(bytes) {
+  return `${(bytes / 1024 / 1024 / 1024).toFixed(1)} GiB`;
+}
+
+function directorySizeBytes(dir) {
+  if (!fs.existsSync(dir)) return 0;
 
-  runNode(
+  let total = 0;
+  const visit = (currentDir) => {
+    for (const entry of fs.readdirSync(currentDir, { withFileTypes: true })) {
+      const entryPath = path.join(currentDir, entry.name);
+      const stat = fs.lstatSync(entryPath);
+      if (stat.isDirectory()) {
+        visit(entryPath);
+        continue;
+      }
+      total += stat.size;
+    }
+  };
+
+  visit(dir);
+  return total;
+}
+
+function assertRuntimeCopyDiskHeadroom() {
+  if (typeof fs.statfsSync !== "function") return;
+
+  const stat = fs.statfsSync(ROOT);
+  const availableBytes = Number(stat.bavail) * Number(stat.bsize);
+  const minimumBytes = Number.parseInt(
+    process.env.ELIZA_DESKTOP_MIN_FREE_BYTES ?? `${4 * 1024 * 1024 * 1024}`,
+    10,
+  );
+  if (!Number.isFinite(minimumBytes) || minimumBytes <= 0) return;
+  if (availableBytes >= minimumBytes) return;
+
+  const existingRuntimeNodeModules = path.join(ROOT, "dist", "node_modules");
+  const recyclableBytes = directorySizeBytes(existingRuntimeNodeModules);
+  const effectiveAvailableBytes = availableBytes + recyclableBytes;
+  if (effectiveAvailableBytes >= minimumBytes) {
+    if (recyclableBytes > 0) {
+      console.log(
+        `[desktop-build] Runtime copy has ${formatGiB(availableBytes)} free plus ${formatGiB(recyclableBytes)} recyclable generated node_modules output.`,
+      );
+    }
+    return;
+  }
+
+  fail(
     [
-      "--import",
-      "tsx",
-      RUNTIME_COPY_SCRIPT,
-      "--scan-dir",
-      "dist",
-      "--target-dist",
-      "dist",
-      ...excludedOptionalPacks.flatMap((pack) => [
-        "--exclude-optional-pack",
-        pack,
-      ]),
-    ],
-    {
+      `Desktop runtime bundling needs at least ${formatGiB(minimumBytes)} free before copying node_modules; only ${formatGiB(availableBytes)} is available (${formatGiB(effectiveAvailableBytes)} after replacing generated dist/node_modules).`,
+      "Free disk space, remove stale build outputs such as dist/.turbo, or rerun with ELIZA_DESKTOP_MIN_FREE_BYTES=0 if you intentionally want to risk a partial copy.",
+    ].join(" "),
+  );
+}
+
+function copyRuntimeNodeModulesWithRetry() {
+  assertRuntimeCopyDiskHeadroom();
+
+  const maxAttempts = 2;
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    const result = runBunStatus(runtimeCopyArgs(), {
       cwd: ROOT,
       label:
-        excludedOptionalPacks.length > 0
-          ? `Bundling runtime node_modules into dist (profile=${buildProfile}, excluding: ${excludedOptionalPacks.join(", ")})`
-          : `Bundling runtime node_modules into dist (profile=${buildProfile})`,
-    },
-  );
+        attempt === 1
+          ? runtimeCopyLabel()
+          : `${runtimeCopyLabel()} (retry ${attempt}/${maxAttempts})`,
+    });
+    if (result.status === 0) {
+      return;
+    }
+    if (attempt < maxAttempts) {
+      console.warn(
+        `[desktop-build] ${result.command} exited ${result.status}; retrying runtime node_modules bundle`,
+      );
+      continue;
+    }
+    fail(
+      `${result.command} failed with exit code ${result.status}`,
+      result.status,
+    );
+  }
+}
 
-  runBun(["install", "--ignore-scripts"], {
-    cwd: APP_DIR,
-    label: "Ensuring app workspace dependencies are installed",
+function stageDesktopBuild() {
+  ensureWorkspaceCheckoutPresent();
+  ensureAppDirs();
+
+  ensureRootRuntimeBundle();
+  ensureWorkspaceRuntimePackagesBuilt();
+
+  runBun(["run", "generate:css-strings"], {
+    cwd: UI_PACKAGE_DIR,
+    label: "Generating UI runtime CSS string modules",
   });
 
-  runBun(["install", "--ignore-scripts"], {
-    cwd: ELECTROBUN_DIR,
-    label: "Ensuring Electrobun workspace dependencies are installed",
+  runBun([WRITE_BUILD_INFO_SCRIPT], {
+    cwd: ROOT,
+    label: "Writing build metadata",
   });
 
-  runPackageBinary("vite", ["build"], {
+  copyRuntimeNodeModulesWithRetry();
+
+  // `bun install` for these workspaces can emit benign EEXIST errors when
+  // file: deps overlap with manually-linked @elizaos/* symlinks. The links
+  // get created successfully; bun exits non-zero only because of the dup
+  // attempt. Tolerate so the build can proceed.
+  runOptionalWorkspaceInstall(
+    APP_DIR,
+    "Ensuring app workspace dependencies are installed",
+  );
+
+  runOptionalWorkspaceInstall(
+    ELECTROBUN_DIR,
+    "Ensuring Electrobun workspace dependencies are installed",
+  );
+
+  ensureUiGeneratedAssets();
+
+  runBunPackageBinary("vite", ["build"], {
     cwd: APP_DIR,
-    env: {
-      ...process.env,
-      VITE_APP_VARIANT: variant,
-      MILADY_BUILD_VARIANT: buildVariant,
-    },
-    label: `Building renderer bundle (VITE_APP_VARIANT=${variant}, MILADY_BUILD_VARIANT=${buildVariant})`,
+    env: desktopRendererBuildEnv(),
+    label: `Building renderer bundle (VITE_APP_VARIANT=${variant}, ELIZA_BUILD_VARIANT=${buildVariant})`,
   });
 
   runDesktopPreflight();
@@ -525,20 +1031,32 @@ function stageDesktopBuild() {
   });
 
   if (process.platform === "darwin") {
-    runBun(["run", "build:native-effects"], {
-      cwd: ELECTROBUN_DIR,
-      label: "Building native macOS effects dylib",
-    });
-  }
-
-  if (
-    buildWhisper &&
-    (process.platform === "darwin" || process.platform === "linux")
-  ) {
-    runBun(["run", "build:whisper"], {
-      cwd: ELECTROBUN_DIR,
-      label: "Building whisper.cpp native binary",
-    });
+    // build:native-effects shells to `xcrun clang++` (Xcode Command Line
+    // Tools). On a dev machine without the CLT the compile would hard-fail
+    // deep in the stage; skip gracefully unless the build was explicitly asked
+    // for the native bits (CI passes --build-native-effects on a tooled runner).
+    const clangAvailable =
+      which("xcrun") && runCapture("xcrun", ["-f", "clang++"]).status === 0;
+    if (!clangAvailable) {
+      if (nativeEffectsExplicitlyRequested) {
+        fail(
+          "Native macOS effects build requires the Xcode Command Line Tools " +
+            "(xcrun clang++), which are missing. Install them with " +
+            "`xcode-select --install`, or omit --build-native-effects / " +
+            "ELIZA_DESKTOP_BUILD_NATIVE_EFFECTS=1.",
+        );
+      }
+      console.warn(
+        "[desktop-build] Skipping native macOS effects dylib — Xcode Command " +
+          "Line Tools (xcrun clang++) not found. Request the native build " +
+          "explicitly with --build-native-effects to make this a hard error.",
+      );
+    } else {
+      runBun(["run", "build:native-effects"], {
+        cwd: ELECTROBUN_DIR,
+        label: "Building native macOS effects dylib",
+      });
+    }
   }
 }
 
@@ -700,9 +1218,9 @@ function mirrorCanonicalToLegacy(name) {
 
 function packageDesktopBuild() {
   ensureAppDirs();
-  const packageArgs = ["run", "build"];
+  const packageArgs = ["build"];
   if (buildEnv) {
-    packageArgs.push("--", `--env=${buildEnv}`);
+    packageArgs.push(`--env=${buildEnv}`);
   }
 
   if (process.platform === "darwin") {
@@ -720,15 +1238,17 @@ function packageDesktopBuild() {
 
   const packageEnv = {
     ...process.env,
+    ELECTROBUN_SKIP_CODESIGN: process.env.ELECTROBUN_SKIP_CODESIGN ?? "1",
     ELIZA_ELECTROBUN_REPO_ROOT: process.env.ELIZA_ELECTROBUN_REPO_ROOT ?? ROOT,
-    MILADY_BUILD_VARIANT: buildVariant,
+    ELIZA_BUILD_VARIANT: buildVariant,
+    PATH: `${path.join(ELECTROBUN_DIR, "scripts", "bin")}${path.delimiter}${process.env.PATH ?? ""}`,
     ...appIdentityEnv(APP_DIR),
     ...(stageMacosReleaseApp && process.platform === "darwin"
       ? { ELIZA_ELECTROBUN_NOTARIZE: "0" }
       : {}),
   };
 
-  runBun(packageArgs, {
+  runElectrobun(packageArgs, {
     cwd: ELECTROBUN_DIR,
     env: packageEnv,
     label: buildEnv
@@ -760,9 +1280,11 @@ function packageDesktopBuild() {
 
   // Mac App Store post-package codesign: when building the store variant on
   // macOS with real signing enabled, walk the bundle and re-sign every nested
-  // Mach-O with mas-child.entitlements (sandbox + cs.inherit), then sign the
-  // parent .app with mas.entitlements. Required because Electrobun's config
-  // exposes only one entitlements field; helpers must inherit explicitly.
+  // Mach-O with the narrowest applicable entitlements. Most helpers get
+  // mas-child.entitlements, the Bun helper gets mas-bun.entitlements
+  // (Bun-scoped allow-jit), and the parent .app gets mas.entitlements.
+  // Required because Electrobun's config exposes only one entitlements field;
+  // helpers must inherit explicitly.
   if (
     process.platform === "darwin" &&
     buildVariant === "store" &&
@@ -773,9 +1295,9 @@ function packageDesktopBuild() {
       path.join(SCRIPT_DIR, "codesign-mas.mjs"),
       `--app=${appBundlePath}`,
     ];
-    if (process.env.MILADY_MAS_INSTALLER_IDENTITY) {
+    if (process.env.ELIZA_MAS_INSTALLER_IDENTITY) {
       codesignArgs.push(
-        `--installer-identity=${process.env.MILADY_MAS_INSTALLER_IDENTITY}`,
+        `--installer-identity=${process.env.ELIZA_MAS_INSTALLER_IDENTITY}`,
       );
     }
     run("node", codesignArgs, {
@@ -783,6 +1305,26 @@ function packageDesktopBuild() {
       env: packageEnv,
       label: `MAS post-package codesign (${path.basename(appBundlePath)})`,
     });
+
+    // Opt-in post-sign verification. Walks every Mach-O and asserts the
+    // tightened entitlement set is what actually shipped — protects against
+    // future regressions in the signer or in the entitlement plists. Skipped
+    // by default because most builds don't want the extra walk; CI store
+    // builds and developers debugging MAS signing should enable it.
+    if (
+      getBooleanArg(args, "verify-mas") ||
+      process.env.ELIZA_VERIFY_MAS === "1"
+    ) {
+      run(
+        "node",
+        [path.join(SCRIPT_DIR, "mas-smoke.mjs"), `--app=${appBundlePath}`],
+        {
+          cwd: ROOT,
+          env: packageEnv,
+          label: `MAS entitlements verification (${path.basename(appBundlePath)})`,
+        },
+      );
+    }
   }
 
   if (stageMacosReleaseApp && process.platform === "darwin") {
@@ -829,39 +1371,51 @@ Options:
                                    and forces Cloud hosting at runtime; "direct"
                                    keeps current unsandboxed behavior.
   --env <channel>                  Electrobun build env (e.g. canary, stable)
-  --build-whisper                  Build whisper.cpp on macOS/Linux during stage
   --stage-macos-release-app        Stage a direct macOS .app + DMG from the Electrobun build output
   --exclude-optional-pack <name>   Exclude a manifest-classified optional capability pack during staging
+  --build-native-effects           Require the native macOS effects dylib build (hard-fail if Xcode CLT is missing)
+  --verify-mas                     After MAS codesign, walk the bundle and verify the tightened
+                                   entitlements via mas-smoke.mjs. Off by default; ELIZA_VERIFY_MAS=1
+                                   also enables it.
 
 Environment:
   ELIZA_DESKTOP_COMMAND_PREFIX    Prefix every spawned command, e.g. "arch -x86_64"
+  ELIZA_VERIFY_MAS=1              Enable mas-smoke entitlement verification on store builds.
 `);
 }
 
-switch (command) {
-  case "preflight":
-    runDesktopPreflight();
-    break;
-  case "stage":
-    stageDesktopBuild();
-    break;
-  case "package":
-    packageDesktopBuild();
-    break;
-  case "build":
-    stageDesktopBuild();
-    packageDesktopBuild();
-    break;
-  case "run":
-    stageDesktopBuild();
-    packageDesktopBuild();
-    runDesktopBuild();
-    break;
-  case "help":
-  case "--help":
-  case "-h":
-    printUsage();
-    break;
-  default:
-    fail(`Unknown command: ${command}`);
+function runCommand() {
+  switch (command) {
+    case "preflight":
+      runDesktopPreflight();
+      break;
+    case "stage":
+      stageDesktopBuild();
+      break;
+    case "package":
+      packageDesktopBuild();
+      break;
+    case "build":
+      stageDesktopBuild();
+      packageDesktopBuild();
+      break;
+    case "run":
+      stageDesktopBuild();
+      packageDesktopBuild();
+      runDesktopBuild();
+      break;
+    case "help":
+    case "--help":
+    case "-h":
+      printUsage();
+      break;
+    default:
+      fail(`Unknown command: ${command}`);
+  }
+}
+
+if (["preflight", "help", "--help", "-h"].includes(command)) {
+  runCommand();
+} else {
+  withDesktopBuildLock(runCommand);
 }