@elizaos/app-core 2.0.0-beta.3 → 2.0.3-beta.3

package/scripts/desktop-build.mjs

@@ -5,6 +5,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { resolveElectrobunDir, resolveMainAppDir } from "./lib/app-dir.mjs";
+import { maxMtimeUnder } from "./lib/artifact-staleness.mjs";
 import {
   buildWindowsRepairSteps,
   classifyElectrobunViewFailure,
@@ -13,6 +14,7 @@ import {
   isSupportedBunVersion,
 } from "./lib/desktop-preflight.mjs";
 import { appIdentityEnv } from "./lib/read-app-identity.mjs";
+import { assertRendererRebuiltSince } from "./lib/renderer-build-manifest.mjs";
 
 const ROOT = process.cwd();
 const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
@@ -35,11 +37,149 @@ const COMMAND_PREFIX = (process.env.ELIZA_DESKTOP_COMMAND_PREFIX ?? "")
   .trim()
   .split(/\s+/)
   .filter(Boolean);
+const DESKTOP_BUILD_LOCK_DIR = path.join(ROOT, ".turbo", "desktop-build.lock");
 const RUNTIME_COPY_SCRIPT = fs.existsSync(
   path.join(ROOT, "scripts", "copy-runtime-node-modules.ts"),
 )
   ? path.join(ROOT, "scripts", "copy-runtime-node-modules.ts")
   : path.join(SCRIPT_DIR, "copy-runtime-node-modules.ts");
+const WRITE_BUILD_INFO_SCRIPT = fs.existsSync(
+  path.join(ROOT, "scripts", "write-build-info.ts"),
+)
+  ? path.join(ROOT, "scripts", "write-build-info.ts")
+  : path.join(ROOT, "packages", "scripts", "write-build-info.ts");
+
+function resolveWorkspacePackageDir(packageDirName) {
+  const candidates = [
+    path.join(ROOT, "packages", packageDirName),
+    path.join(ROOT, "eliza", "packages", packageDirName),
+  ];
+  return (
+    candidates.find((candidate) =>
+      fs.existsSync(path.join(candidate, "package.json")),
+    ) ?? candidates[0]
+  );
+}
+
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function readDesktopBuildLockOwnerPid() {
+  try {
+    const rawOwner = fs.readFileSync(
+      path.join(DESKTOP_BUILD_LOCK_DIR, "owner"),
+      "utf8",
+    );
+    const pid = Number.parseInt(rawOwner.split(/\r?\n/, 1)[0] ?? "", 10);
+    return Number.isFinite(pid) && pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
+
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (error?.code === "ESRCH") return false;
+    return true;
+  }
+}
+
+function withDesktopBuildLock(run) {
+  const lockParent = path.dirname(DESKTOP_BUILD_LOCK_DIR);
+  const staleAfterMs = 30 * 60 * 1000;
+  let announcedWait = false;
+
+  fs.mkdirSync(lockParent, { recursive: true });
+
+  for (;;) {
+    try {
+      fs.mkdirSync(DESKTOP_BUILD_LOCK_DIR);
+      fs.writeFileSync(
+        path.join(DESKTOP_BUILD_LOCK_DIR, "owner"),
+        `${process.pid}\n${new Date().toISOString()}\n`,
+      );
+      break;
+    } catch (error) {
+      if (error?.code !== "EEXIST") {
+        throw error;
+      }
+
+      let stat = null;
+      try {
+        stat = fs.statSync(DESKTOP_BUILD_LOCK_DIR);
+      } catch {
+        continue;
+      }
+
+      const ownerPid = readDesktopBuildLockOwnerPid();
+      if (
+        (ownerPid !== null && !isProcessAlive(ownerPid)) ||
+        Date.now() - stat.mtimeMs > staleAfterMs
+      ) {
+        fs.rmSync(DESKTOP_BUILD_LOCK_DIR, { recursive: true, force: true });
+        continue;
+      }
+
+      if (!announcedWait) {
+        console.log(
+          "[desktop-build] Waiting for another desktop build to finish...",
+        );
+        announcedWait = true;
+      }
+      sleepSync(250);
+    }
+  }
+
+  try {
+    run();
+  } finally {
+    fs.rmSync(DESKTOP_BUILD_LOCK_DIR, { recursive: true, force: true });
+  }
+}
+
+function resolveWorkspacePluginDir(pluginDirName) {
+  const candidates = [
+    path.join(ROOT, "plugins", pluginDirName),
+    path.join(ROOT, "eliza", "plugins", pluginDirName),
+  ];
+  return (
+    candidates.find((candidate) =>
+      fs.existsSync(path.join(candidate, "package.json")),
+    ) ?? candidates[0]
+  );
+}
+
+const APP_CORE_PACKAGE_DIR = resolveWorkspacePackageDir("app-core");
+const AGENT_PACKAGE_DIR = resolveWorkspacePackageDir("agent");
+const CLOUD_SDK_PACKAGE_DIR = resolveWorkspacePackageDir("cloud-sdk");
+const CORE_PACKAGE_DIR = resolveWorkspacePackageDir("core");
+const PLUGIN_AGENT_ORCHESTRATOR_PACKAGE_DIR = resolveWorkspacePluginDir(
+  "plugin-agent-orchestrator",
+);
+const APP_MODEL_TESTER_PACKAGE_DIR =
+  resolveWorkspacePluginDir("app-model-tester");
+const PLUGIN_LOCAL_INFERENCE_PACKAGE_DIR = resolveWorkspacePluginDir(
+  "plugin-local-inference",
+);
+const PLUGIN_REMOTE_MANIFEST_PACKAGE_DIR = resolveWorkspacePackageDir(
+  "plugin-remote-manifest",
+);
+const PLUGIN_WORKER_RUNTIME_PACKAGE_DIR = resolveWorkspacePackageDir(
+  "plugin-worker-runtime",
+);
+const SHARED_PACKAGE_DIR = resolveWorkspacePackageDir("shared");
+const SECURITY_PACKAGE_DIR = resolveWorkspacePackageDir("security");
+const UI_PACKAGE_DIR = resolveWorkspacePackageDir("ui");
+const VAULT_PACKAGE_DIR = resolveWorkspacePackageDir("vault");
+const DESKTOP_BUILD_TMP_DIR = path.join(ELECTROBUN_DIR, "tmp");
+const DESKTOP_BUILD_BUN_CACHE_DIR = path.join(
+  DESKTOP_BUILD_TMP_DIR,
+  "bun-cache",
+);
 
 const argv = process.argv.slice(2);
 const command = argv[0] && !argv[0].startsWith("--") ? argv[0] : "build";
@@ -51,18 +191,22 @@ const buildProfile =
 const variant =
   getArgValue(args, "variant") ?? process.env.VITE_APP_VARIANT ?? "base";
 const buildVariant = resolveBuildVariant(
-  getArgValue(args, "build-variant") ?? process.env.MILADY_BUILD_VARIANT,
+  getArgValue(args, "build-variant") ?? process.env.ELIZA_BUILD_VARIANT,
 );
 const buildEnv = getArgValue(args, "env") ?? process.env.BUILD_ENV ?? "";
-const buildWhisper = getBooleanArg(args, "build-whisper");
 const stageMacosReleaseApp = getBooleanArg(args, "stage-macos-release-app");
+// The macOS native-effects dylib build shells to `xcrun clang++` (Xcode CLT).
+// "Explicitly requested" decides whether missing native tooling is a hard
+// failure (CI passes --build-native-effects on a tooled runner) or a graceful
+// skip (out-of-box dev build).
+const nativeEffectsExplicitlyRequested =
+  getBooleanArg(args, "build-native-effects") ||
+  process.env.ELIZA_DESKTOP_BUILD_NATIVE_EFFECTS === "1";
 
 function resolveBuildVariant(raw) {
   if (raw === "store" || raw === "direct") return raw;
   if (raw === undefined || raw === null || raw === "") return "direct";
-  fail(
-    `Unknown --build-variant value: ${raw}. Expected "store" or "direct".`,
-  );
+  fail(`Unknown --build-variant value: ${raw}. Expected "store" or "direct".`);
 }
 const excludedOptionalPacks = [
   ...new Set([
@@ -170,7 +314,12 @@ function buildInvocation(binary, binaryArgs = []) {
 }
 
 function run(commandName, commandArgs, options = {}) {
-  const { cwd = ROOT, env = process.env, label } = options;
+  const {
+    cwd = ROOT,
+    env = process.env,
+    label,
+    allowFailure = false,
+  } = options;
   const invocation = buildInvocation(commandName, commandArgs);
   const rendered = [invocation.command, ...invocation.args].join(" ");
   console.log(`[desktop-build] ${label ?? rendered}`);
@@ -182,6 +331,12 @@ function run(commandName, commandArgs, options = {}) {
   });
 
   if (result.status !== 0) {
+    if (allowFailure) {
+      console.warn(
+        `[desktop-build] ${rendered} exited ${result.status ?? 1} (tolerated)`,
+      );
+      return;
+    }
     fail(
       `${rendered} failed with exit code ${result.status ?? 1}`,
       result.status ?? 1,
@@ -189,6 +344,24 @@ function run(commandName, commandArgs, options = {}) {
   }
 }
 
+function runStatus(commandName, commandArgs, options = {}) {
+  const { cwd = ROOT, env = process.env, label } = options;
+  const invocation = buildInvocation(commandName, commandArgs);
+  const rendered = [invocation.command, ...invocation.args].join(" ");
+  console.log(`[desktop-build] ${label ?? rendered}`);
+
+  const result = spawnSync(invocation.command, invocation.args, {
+    cwd,
+    env,
+    stdio: "inherit",
+  });
+
+  return {
+    command: rendered,
+    status: result.status ?? 1,
+  };
+}
+
 function runCapture(commandName, commandArgs, options = {}) {
   const { cwd = ROOT, env = process.env } = options;
   const invocation = buildInvocation(commandName, commandArgs);
@@ -223,6 +396,50 @@ function runBunCapture(commandArgs, options = {}) {
   return runCapture(bun, commandArgs, options);
 }
 
+function runBunStatus(commandArgs, options = {}) {
+  const bun = resolveBunBinary();
+  if (!bun) {
+    fail('Could not find "bun" in PATH.');
+  }
+  return runStatus(bun, commandArgs, options);
+}
+
+function desktopBuildTempEnv(extraEnv = {}) {
+  fs.mkdirSync(DESKTOP_BUILD_TMP_DIR, { recursive: true });
+  return {
+    ...process.env,
+    ...extraEnv,
+    TMPDIR: DESKTOP_BUILD_TMP_DIR,
+    TMP: DESKTOP_BUILD_TMP_DIR,
+    TEMP: DESKTOP_BUILD_TMP_DIR,
+    BUN_TMPDIR: DESKTOP_BUILD_TMP_DIR,
+    BUN_INSTALL_CACHE_DIR: DESKTOP_BUILD_BUN_CACHE_DIR,
+  };
+}
+
+function dependencyTreePresent(cwd) {
+  return (
+    fs.existsSync(path.join(cwd, "node_modules")) ||
+    fs.existsSync(path.join(ROOT, "node_modules"))
+  );
+}
+
+function runOptionalWorkspaceInstall(cwd, label) {
+  if (dependencyTreePresent(cwd)) {
+    console.log(`[desktop-build] ${label} (skipped; dependencies present)`);
+    return;
+  }
+  runBun(
+    ["install", "--ignore-scripts", "--cache-dir", DESKTOP_BUILD_BUN_CACHE_DIR],
+    {
+      cwd,
+      env: desktopBuildTempEnv(),
+      label,
+      allowFailure: true,
+    },
+  );
+}
+
 function resolveBunBinary() {
   if (process.platform === "win32") {
     const whereResult = spawnSync("where", ["bun"], {
@@ -257,11 +474,6 @@ function resolveBunBinary() {
   return bun;
 }
 
-function runNode(commandArgs, options = {}) {
-  const node = which("node") ?? process.execPath;
-  run(node, commandArgs, options);
-}
-
 function runPackageBinary(binary, binaryArgs, options = {}) {
   const bunx = which("bunx");
   if (bunx) {
@@ -278,7 +490,46 @@ function runPackageBinary(binary, binaryArgs, options = {}) {
   fail(`Could not find bunx or npx to run ${binary}.`);
 }
 
+function resolveLocalPackageBinary(binary, cwdCandidates = []) {
+  const executableNames =
+    process.platform === "win32"
+      ? [`${binary}.cmd`, `${binary}.exe`, binary]
+      : [binary];
+  const candidates = [];
+
+  for (const cwd of cwdCandidates) {
+    for (const executableName of executableNames) {
+      candidates.push(path.join(cwd, "node_modules", ".bin", executableName));
+    }
+  }
+
+  for (const executableName of executableNames) {
+    candidates.push(path.join(ROOT, "node_modules", ".bin", executableName));
+  }
+
+  return candidates.find((candidate) => fs.existsSync(candidate)) ?? null;
+}
+
+function runBunPackageBinary(binary, binaryArgs, options = {}) {
+  const bunx = which("bunx");
+  if (bunx) {
+    run(bunx, ["--bun", binary, ...binaryArgs], options);
+    return;
+  }
+
+  runPackageBinary(binary, binaryArgs, options);
+}
+
 function runElectrobun(commandArgs, options = {}) {
+  const local = resolveLocalPackageBinary(
+    "electrobun",
+    [options.cwd, ELECTROBUN_DIR].filter(Boolean),
+  );
+  if (local) {
+    run(local, commandArgs, options);
+    return;
+  }
+
   const direct = which("electrobun");
   if (direct) {
     run(direct, commandArgs, options);
@@ -427,6 +678,53 @@ function runDesktopPreflight() {
     bunVersion,
     errorCode: "OK",
   });
+
+  preflightStoreVariantSigning();
+}
+
+/**
+ * Store-variant signing preflight.
+ *
+ * When building the store flavor of a desktop variant outside CI (no
+ * ELECTROBUN_SKIP_CODESIGN=1, no CI=true), fail loudly if the required
+ * signing-identity env vars aren't set. Without this, the build runs all
+ * the way through staging + packaging only to die in codesign-mas.mjs
+ * or build-msix.ps1 — wasting minutes of clock per attempt.
+ *
+ * CI builds skip this preflight because the secrets are provisioned at
+ * job-step level, after this script's preflight runs.
+ */
+function preflightStoreVariantSigning() {
+  if (buildVariant !== "store") return;
+  if (process.env.CI === "true" || process.env.ELECTROBUN_SKIP_CODESIGN === "1")
+    return;
+
+  const missing = [];
+  if (process.platform === "darwin") {
+    if (!process.env.ELIZA_MAS_SIGNING_IDENTITY?.trim()) {
+      missing.push("ELIZA_MAS_SIGNING_IDENTITY");
+    }
+  } else if (process.platform === "win32") {
+    if (!process.env.ELIZA_MSIX_STORE_CERT_PATH?.trim()) {
+      missing.push("ELIZA_MSIX_STORE_CERT_PATH");
+    }
+  } else if (process.platform === "linux") {
+    // Flatpak builds use `flatpak-builder`; no signing env vars are required
+    // (Flathub signs the repo server-side).
+  }
+
+  if (missing.length === 0) return;
+
+  failPreflight(
+    "Store-variant build requires signing env vars (or set ELECTROBUN_SKIP_CODESIGN=1 for unsigned local builds).",
+    {
+      step: "store-signing",
+      platform: process.platform,
+      buildVariant,
+      missing,
+    },
+    missing.map((name) => `  set ${name}=... before running`),
+  );
 }
 
 function findLatestMacAppBundle() {
@@ -461,60 +759,581 @@ function findLatestMacAppBundle() {
   return candidates[0].appBundlePath;
 }
 
-function stageDesktopBuild() {
-  ensureAppDirs();
+function hasRootTsdownEntry() {
+  return (
+    fs.existsSync(path.join(ROOT, "tsdown.config.ts")) ||
+    fs.existsSync(path.join(ROOT, "tsdown.config.mts")) ||
+    fs.existsSync(path.join(ROOT, "tsdown.config.js")) ||
+    fs.existsSync(path.join(ROOT, "src", "index.ts"))
+  );
+}
 
-  runPackageBinary("tsdown", [], {
-    cwd: ROOT,
-    label: "Building core runtime bundle with tsdown",
+function ensureRootRuntimeBundle() {
+  if (hasRootTsdownEntry()) {
+    runPackageBinary("tsdown", [], {
+      cwd: ROOT,
+      label: "Building core runtime bundle with tsdown",
+    });
+    return;
+  }
+
+  const distDir = path.join(ROOT, "dist");
+  const entrySource = [
+    "// auto-generated by desktop-build.mjs",
+    "// Standalone elizaOS checkouts do not have a root tsdown entry.",
+    "// Packaged desktop runtimes resolve the real CLI entry from the bundled node_modules tree.",
+    'import "./node_modules/@elizaos/app-core/dist/entry.js";',
+    "",
+  ].join("\n");
+
+  fs.mkdirSync(distDir, { recursive: true });
+  fs.writeFileSync(path.join(distDir, "entry.js"), entrySource);
+  fs.writeFileSync(path.join(distDir, "index.js"), entrySource);
+  fs.writeFileSync(path.join(distDir, "package.json"), '{"type":"module"}\n');
+}
+
+// The desktop build compiles the @elizaos/* workspace packages from source, so
+// it only works when those packages are present on disk (a workspace/local
+// checkout). In packages mode they are resolved from node_modules instead and
+// resolveWorkspacePackageDir() falls back to a non-existent ROOT/packages/* dir,
+// which previously surfaced deep in the build as a cryptic
+// "Expected @elizaos/core package not found". Detect this once, up front, with
+// an actionable message instead.
+function ensureWorkspaceCheckoutPresent() {
+  if (fs.existsSync(path.join(CORE_PACKAGE_DIR, "package.json"))) {
+    return;
+  }
+  fail(
+    "Desktop build requires the @elizaos/* workspace packages on disk, but " +
+      `none were found (looked for ${path.join(CORE_PACKAGE_DIR, "package.json")}).\n` +
+      "  Run the desktop build from a workspace checkout where packages/* (or " +
+      "eliza/packages/*) are present.",
+  );
+}
+
+function ensureWorkspaceRuntimePackageBuilt(packageName, packageDir) {
+  const packageJson = path.join(packageDir, "package.json");
+  if (!fs.existsSync(packageJson)) {
+    fail(`Expected ${packageName} package not found: ${packageDir}`);
+  }
+
+  if (
+    process.env.ELIZA_DESKTOP_REBUILD_RUNTIME_PACKAGES !== "1" &&
+    workspaceRuntimePackageLooksBuilt(packageName, packageDir)
+  ) {
+    console.log(
+      `[desktop-build] Reusing existing ${packageName} runtime package`,
+    );
+    return;
+  }
+
+  runBun(["run", "build"], {
+    cwd: packageDir,
+    label: `Building ${packageName} runtime package`,
   });
+}
 
-  runNode(["--import", "tsx", "scripts/write-build-info.ts"], {
-    cwd: ROOT,
-    label: "Writing build metadata",
+function workspaceRuntimePackageMarkersPresent(packageName, distDir) {
+  if (packageName === "@elizaos/core") {
+    return (
+      fs.existsSync(path.join(distDir, "node", "index.node.js")) &&
+      fs.existsSync(path.join(distDir, "index.node.d.ts")) &&
+      fs.existsSync(path.join(distDir, "testing", "live-provider.d.ts"))
+    );
+  }
+
+  if (packageName === "@elizaos/ui") {
+    return (
+      fs.existsSync(path.join(distDir, "index.js")) &&
+      fs.existsSync(path.join(distDir, "App.js")) &&
+      fs.existsSync(path.join(distDir, "components", "pages", "LogsView.js"))
+    );
+  }
+
+  return true;
+}
+
+function workspaceRuntimePackageLooksBuilt(packageName, packageDir) {
+  const distDir = path.join(packageDir, "dist");
+  if (!fs.existsSync(distDir)) return false;
+  if (!workspaceRuntimePackageMarkersPresent(packageName, distDir))
+    return false;
+
+  // Presence of the marker files isn't enough — a dist built from older sources
+  // would silently reuse stale runtime code (issue #9309). Reuse only when the
+  // dist is at least as new as the package's src. ELIZA_DESKTOP_TRUST_RUNTIME_-
+  // PACKAGE_DIST=1 bypasses the mtime check for environments where checkout
+  // mtimes are unreliable.
+  if (process.env.ELIZA_DESKTOP_TRUST_RUNTIME_PACKAGE_DIST === "1") return true;
+  const srcDir = path.join(packageDir, "src");
+  if (!fs.existsSync(srcDir)) return true;
+  const srcMtime = maxMtimeUnder(srcDir);
+  const distMtime = maxMtimeUnder(distDir);
+  if (srcMtime > distMtime) {
+    console.log(
+      `[desktop-build] ${packageName} dist is stale (src newer than dist) — rebuilding`,
+    );
+    return false;
+  }
+  return true;
+}
+
+function ensureWorkspaceRuntimePackagesBuilt() {
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/core", CORE_PACKAGE_DIR);
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/shared", SHARED_PACKAGE_DIR);
+  ensureWorkspaceRuntimePackageBuilt(
+    "@elizaos/cloud-sdk",
+    CLOUD_SDK_PACKAGE_DIR,
+  );
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/security", SECURITY_PACKAGE_DIR);
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/vault", VAULT_PACKAGE_DIR);
+  ensureWorkspaceRuntimePackageBuilt(
+    "@elizaos/plugin-remote-manifest",
+    PLUGIN_REMOTE_MANIFEST_PACKAGE_DIR,
+  );
+  ensureWorkspaceRuntimePackageBuilt(
+    "@elizaos/plugin-agent-orchestrator",
+    PLUGIN_AGENT_ORCHESTRATOR_PACKAGE_DIR,
+  );
+  ensureWorkspaceRuntimePackageBuilt(
+    "@elizaos/app-model-tester",
+    APP_MODEL_TESTER_PACKAGE_DIR,
+  );
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/ui", UI_PACKAGE_DIR);
+  ensureWorkspaceRuntimePackageBuilt(
+    "@elizaos/plugin-local-inference",
+    PLUGIN_LOCAL_INFERENCE_PACKAGE_DIR,
+  );
+  ensureWorkspaceRuntimePackageBuilt(
+    "@elizaos/plugin-worker-runtime",
+    PLUGIN_WORKER_RUNTIME_PACKAGE_DIR,
+  );
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/agent", AGENT_PACKAGE_DIR);
+  ensureWorkspaceRuntimePackageBuilt("@elizaos/app-core", APP_CORE_PACKAGE_DIR);
+}
+
+function ensureUiGeneratedAssets() {
+  runBun(["run", "generate:css-strings"], {
+    cwd: UI_PACKAGE_DIR,
+    label: "Generating @elizaos/ui CSS string modules",
   });
+}
+
+function desktopRendererBuildEnv() {
+  const env = {
+    ...process.env,
+    VITE_APP_VARIANT: variant,
+    ELIZA_BUILD_VARIANT: buildVariant,
+  };
+  if (env.ELIZA_SKIP_LOCAL_UPSTREAMS !== "1") {
+    env.ELIZA_FORCE_LOCAL_UPSTREAMS = "1";
+  }
+  return env;
+}
+
+function runtimeCopyArgs() {
+  return [
+    RUNTIME_COPY_SCRIPT,
+    "--scan-dir",
+    "dist",
+    "--target-dist",
+    "dist",
+    ...excludedOptionalPacks.flatMap((pack) => [
+      "--exclude-optional-pack",
+      pack,
+    ]),
+  ];
+}
+
+function runtimeCopyLabel() {
+  return excludedOptionalPacks.length > 0
+    ? `Bundling runtime node_modules into dist (profile=${buildProfile}, excluding: ${excludedOptionalPacks.join(", ")})`
+    : `Bundling runtime node_modules into dist (profile=${buildProfile})`;
+}
+
+function formatGiB(bytes) {
+  return `${(bytes / 1024 / 1024 / 1024).toFixed(1)} GiB`;
+}
+
+function directorySizeBytes(dir) {
+  if (!fs.existsSync(dir)) return 0;
+
+  let total = 0;
+  const visit = (currentDir) => {
+    for (const entry of fs.readdirSync(currentDir, { withFileTypes: true })) {
+      const entryPath = path.join(currentDir, entry.name);
+      const stat = fs.lstatSync(entryPath);
+      if (stat.isDirectory()) {
+        visit(entryPath);
+        continue;
+      }
+      total += stat.size;
+    }
+  };
+
+  visit(dir);
+  return total;
+}
+
+function assertRuntimeCopyDiskHeadroom() {
+  if (typeof fs.statfsSync !== "function") return;
+
+  const stat = fs.statfsSync(ROOT);
+  const availableBytes = Number(stat.bavail) * Number(stat.bsize);
+  const minimumBytes = Number.parseInt(
+    process.env.ELIZA_DESKTOP_MIN_FREE_BYTES ?? `${4 * 1024 * 1024 * 1024}`,
+    10,
+  );
+  if (!Number.isFinite(minimumBytes) || minimumBytes <= 0) return;
+  if (availableBytes >= minimumBytes) return;
+
+  const existingRuntimeNodeModules = path.join(ROOT, "dist", "node_modules");
+  const recyclableBytes = directorySizeBytes(existingRuntimeNodeModules);
+  const effectiveAvailableBytes = availableBytes + recyclableBytes;
+  if (effectiveAvailableBytes >= minimumBytes) {
+    if (recyclableBytes > 0) {
+      console.log(
+        `[desktop-build] Runtime copy has ${formatGiB(availableBytes)} free plus ${formatGiB(recyclableBytes)} recyclable generated node_modules output.`,
+      );
+    }
+    return;
+  }
+
+  fail(
+    [
+      `Desktop runtime bundling needs at least ${formatGiB(minimumBytes)} free before copying node_modules; only ${formatGiB(availableBytes)} is available (${formatGiB(effectiveAvailableBytes)} after replacing generated dist/node_modules).`,
+      "Free disk space, remove stale build outputs such as dist/.turbo, or rerun with ELIZA_DESKTOP_MIN_FREE_BYTES=0 if you intentionally want to risk a partial copy.",
+    ].join(" "),
+  );
+}
+
+function copyRuntimeNodeModulesWithRetry() {
+  assertRuntimeCopyDiskHeadroom();
+
+  const maxAttempts = 2;
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    const result = runBunStatus(runtimeCopyArgs(), {
+      cwd: ROOT,
+      label:
+        attempt === 1
+          ? runtimeCopyLabel()
+          : `${runtimeCopyLabel()} (retry ${attempt}/${maxAttempts})`,
+    });
+    if (result.status === 0) {
+      return;
+    }
+    if (attempt < maxAttempts) {
+      console.warn(
+        `[desktop-build] ${result.command} exited ${result.status}; retrying runtime node_modules bundle`,
+      );
+      continue;
+    }
+    fail(
+      `${result.command} failed with exit code ${result.status}`,
+      result.status,
+    );
+  }
+}
+
+const FUSED_LIB_STAGE_SCRIPT = path.join(
+  SCRIPT_DIR,
+  "stage-desktop-fused-lib.mjs",
+);
+// "auto" → the stager picks the host's best backend (Metal on macOS, CUDA when
+// nvcc is present, else CPU) with the CPU fallback always baked in, so a local
+// `--build-fused-lib` produces "CPU + platform GPU" for the build host.
+const FUSED_LIB_VARIANT =
+  getArgValue(args, "fused-lib-variant") ??
+  process.env.ELIZA_DESKTOP_FUSED_LIB_VARIANT ??
+  "auto";
+// Where the fused lib is staged so the Electrobun copy (dist -> eliza-dist)
+// carries it; app-core's runtime probe (ensureBundledFusedLibDir) then finds
+// `<eliza-dist>/local-inference/lib` with no env wiring.
+const FUSED_LIB_OUT_DIR = path.join(ROOT, "dist", "local-inference", "lib");
+
+function fusedLibFilenames() {
+  if (process.platform === "darwin") return ["libelizainference.dylib"];
+  if (process.platform === "win32")
+    return ["elizainference.dll", "libelizainference.dll"];
+  return ["libelizainference.so"];
+}
+
+function fusedLibAlreadyStaged() {
+  return fusedLibFilenames().some((name) =>
+    fs.existsSync(path.join(FUSED_LIB_OUT_DIR, name)),
+  );
+}
+
+// Provenance for the staged fused lib so the reuse gate never silently reuses a
+// lib built for a DIFFERENT variant/platform than this build targets (#9309).
+const FUSED_LIB_SIDECAR = path.join(FUSED_LIB_OUT_DIR, "staged-fused-lib.json");
+
+function readFusedLibSidecar() {
+  try {
+    return JSON.parse(fs.readFileSync(FUSED_LIB_SIDECAR, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function writeFusedLibSidecar() {
+  fs.mkdirSync(FUSED_LIB_OUT_DIR, { recursive: true });
+  fs.writeFileSync(
+    FUSED_LIB_SIDECAR,
+    `${JSON.stringify(
+      {
+        variant: FUSED_LIB_VARIANT,
+        platform: process.platform,
+        builtAt: new Date().toISOString(),
+      },
+      null,
+      2,
+    )}\n`,
+  );
+}
+
+/**
+ * A staged lib whose provenance sidecar names a DIFFERENT variant/platform than
+ * this build targets — a confirmed wrong-variant lib we must not ship.
+ */
+function fusedLibStagedVariantMismatch() {
+  if (!fusedLibAlreadyStaged()) return false;
+  const sidecar = readFusedLibSidecar();
+  if (!sidecar) return false; // no provenance ≠ wrong provenance
+  return (
+    sidecar.variant !== FUSED_LIB_VARIANT ||
+    sidecar.platform !== process.platform
+  );
+}
+
+/**
+ * Whether a staged lib can be reused. A lib with a matching sidecar is reused; a
+ * sidecar-less lib (e.g. a prebuilt artifact a CI step dropped into
+ * dist/local-inference/lib) is TRUSTED and reused — we can't confirm its variant
+ * but it was deliberately staged. Only a sidecar that names a different
+ * variant/platform forces a rebuild.
+ */
+function fusedLibStagedForCurrentVariant() {
+  return fusedLibAlreadyStaged() && !fusedLibStagedVariantMismatch();
+}
+
+const FUSED_LIB_FORK_DIR = path.join(
+  PLUGIN_LOCAL_INFERENCE_PACKAGE_DIR,
+  "native",
+  "llama.cpp",
+);
+
+/**
+ * Ensure the native llama.cpp fork submodule is checked out (the fused build
+ * needs its CMakeLists). Release CI checks out with `submodules: false`, so the
+ * fork is absent; init just the one path on demand rather than requiring the
+ * workflow to fetch every submodule. Returns true if the fork is present after.
+ */
+function ensureFusedLibSubmodule() {
+  if (fs.existsSync(path.join(FUSED_LIB_FORK_DIR, "CMakeLists.txt")))
+    return true;
+  const rel = path.relative(ROOT, FUSED_LIB_FORK_DIR).split(path.sep).join("/");
+  console.log(
+    `[desktop-build] Native fork missing; initializing submodule ${rel}`,
+  );
+  // NB: no --depth/shallow here — a shallow submodule fetch fails with
+  // "Server does not allow request for unadvertised object <sha>" when the
+  // recorded gitlink commit isn't the remote tip, which is common. Reliability
+  // over speed: this path must actually produce the fork.
+  spawnSync(
+    "git",
+    ["-C", ROOT, "submodule", "update", "--init", "--recursive", rel],
+    { stdio: "inherit" },
+  );
+  return fs.existsSync(path.join(FUSED_LIB_FORK_DIR, "CMakeLists.txt"));
+}
+
+/**
+ * Build + stage the fused `libelizainference` into the desktop bundle so a
+ * COMPILED app ships with working local inference — no first-run download, no
+ * manual `build:fused-desktop`. The "auto" variant bakes CPU in and layers the
+ * host's best GPU backend (Metal on macOS; CUDA when nvcc is present; else CPU),
+ * so it works on every host.
+ *
+ * Gating:
+ *   - Reuses an already-staged lib (a prior build, or a prebuilt artifact a CI
+ *     step dropped into dist/local-inference/lib).
+ *   - Builds when explicitly asked (`--build-fused-lib` /
+ *     ELIZA_DESKTOP_BUILD_FUSED_LIB=1) OR automatically on CI release builds
+ *     (CI=true) — initializing the native submodule on demand. Off for plain
+ *     local dev builds (keeps iteration fast).
+ *   - An EXPLICIT request hard-fails if it can't produce the lib (unless
+ *     ELIZA_DESKTOP_FUSED_LIB_OPTIONAL=1). A CI auto-build is BEST-EFFORT: a
+ *     missing toolchain or a build failure warns and ships without the lib
+ *     (cloud fallback) rather than breaking the release. Set
+ *     ELIZA_DESKTOP_FUSED_LIB_REQUIRED=1 to make CI auto-builds hard-fail too.
+ */
+function stageDesktopFusedLib() {
+  const explicitlyRequested =
+    getBooleanArg(args, "build-fused-lib") ||
+    process.env.ELIZA_DESKTOP_BUILD_FUSED_LIB === "1";
+  const ciAutoBuild = process.env.CI === "true";
+  const shouldBuild = explicitlyRequested || ciAutoBuild;
+  const required =
+    (explicitlyRequested ||
+      process.env.ELIZA_DESKTOP_FUSED_LIB_REQUIRED === "1") &&
+    process.env.ELIZA_DESKTOP_FUSED_LIB_OPTIONAL !== "1";
+
+  if (
+    fusedLibStagedForCurrentVariant() &&
+    process.env.ELIZA_DESKTOP_REBUILD_FUSED_LIB !== "1"
+  ) {
+    console.log(
+      `[desktop-build] Reusing already-staged fused lib in ${FUSED_LIB_OUT_DIR} ` +
+        `(variant=${FUSED_LIB_VARIANT}, ${process.platform})`,
+    );
+    return;
+  }
+
+  // A staged lib whose sidecar names a DIFFERENT variant/platform is a confirmed
+  // wrong-variant lib — never silently reused. (A sidecar-less drop-in is trusted
+  // and was already reused above.)
+  const variantMismatch = fusedLibStagedVariantMismatch();
+  if (variantMismatch) {
+    const sidecar = readFusedLibSidecar();
+    console.warn(
+      `[desktop-build] Staged fused lib does not match this build ` +
+        `(want variant=${FUSED_LIB_VARIANT}/${process.platform}, found ` +
+        `${sidecar.variant}/${sidecar.platform}). ` +
+        `It will be rebuilt to avoid shipping a wrong-variant native lib.`,
+    );
+  }
+
+  if (!shouldBuild) {
+    if (variantMismatch) {
+      // Can't rebuild here (no toolchain requested) and the staged lib is the
+      // wrong variant — drop it so the app cleanly falls back to cloud inference
+      // instead of dlopen()-ing a mismatched backend on the device.
+      for (const name of fusedLibFilenames()) {
+        fs.rmSync(path.join(FUSED_LIB_OUT_DIR, name), { force: true });
+      }
+      fs.rmSync(FUSED_LIB_SIDECAR, { force: true });
+      console.warn(
+        "[desktop-build] Removed the mismatched fused lib; this build ships without " +
+          "local inference. Rebuild with --build-fused-lib to stage the right variant.",
+      );
+      return;
+    }
+    console.log(
+      "[desktop-build] Skipping fused libelizainference build (local-inference will be " +
+        "unavailable in this build). Enable with --build-fused-lib or " +
+        "ELIZA_DESKTOP_BUILD_FUSED_LIB=1 (CI release builds enable it automatically).",
+    );
+    return;
+  }
 
-  runNode(
+  // Surface a hard failure for an explicit request that can't proceed; otherwise
+  // warn and ship without the lib so a release never breaks on the native build.
+  const giveUp = (reason) => {
+    if (required) {
+      fail(
+        `Cannot build the fused libelizainference for the desktop bundle: ${reason}. ` +
+          "Install the toolchain / init submodules, or set " +
+          "ELIZA_DESKTOP_FUSED_LIB_OPTIONAL=1 to ship without local inference.",
+      );
+    }
+    console.warn(
+      `[desktop-build] Skipping fused libelizainference build — ${reason}. ` +
+        "The compiled app will fall back to cloud inference.",
+    );
+  };
+
+  if (!which("cmake")) {
+    giveUp("cmake not found on PATH");
+    return;
+  }
+  if (!ensureFusedLibSubmodule()) {
+    giveUp(`native fork not available at ${FUSED_LIB_FORK_DIR}`);
+    return;
+  }
+
+  fs.mkdirSync(FUSED_LIB_OUT_DIR, { recursive: true });
+  run(
+    "node",
     [
-      "--import",
-      "tsx",
-      RUNTIME_COPY_SCRIPT,
-      "--scan-dir",
-      "dist",
-      "--target-dist",
-      "dist",
-      ...excludedOptionalPacks.flatMap((pack) => [
-        "--exclude-optional-pack",
-        pack,
-      ]),
+      FUSED_LIB_STAGE_SCRIPT,
+      "--variant",
+      FUSED_LIB_VARIANT,
+      "--out",
+      FUSED_LIB_OUT_DIR,
     ],
     {
       cwd: ROOT,
-      label:
-        excludedOptionalPacks.length > 0
-          ? `Bundling runtime node_modules into dist (profile=${buildProfile}, excluding: ${excludedOptionalPacks.join(", ")})`
-          : `Bundling runtime node_modules into dist (profile=${buildProfile})`,
+      // A CI auto-build that fails must not abort the whole release; an explicit
+      // request is allowed to hard-fail.
+      allowFailure: !required,
+      label: `Building + staging fused libelizainference (${FUSED_LIB_VARIANT}) into the desktop bundle`,
     },
   );
 
-  runBun(["install", "--ignore-scripts"], {
-    cwd: APP_DIR,
-    label: "Ensuring app workspace dependencies are installed",
+  if (!fusedLibAlreadyStaged()) {
+    giveUp("the build produced no lib in the output dir");
+    return;
+  }
+  // Record provenance so a later build with a different variant/platform won't
+  // silently reuse this lib.
+  writeFusedLibSidecar();
+}
+
+function stageDesktopBuild() {
+  ensureWorkspaceCheckoutPresent();
+  ensureAppDirs();
+
+  ensureRootRuntimeBundle();
+  ensureWorkspaceRuntimePackagesBuilt();
+
+  // Build + bundle the fused local-inference native lib so the packaged app
+  // serves local AI out of the box. Gated (see stageDesktopFusedLib) so plain
+  // dev builds stay fast; auto-built best-effort on CI release builds.
+  stageDesktopFusedLib();
+
+  runBun(["run", "generate:css-strings"], {
+    cwd: UI_PACKAGE_DIR,
+    label: "Generating UI runtime CSS string modules",
   });
 
-  runBun(["install", "--ignore-scripts"], {
-    cwd: ELECTROBUN_DIR,
-    label: "Ensuring Electrobun workspace dependencies are installed",
+  runBun([WRITE_BUILD_INFO_SCRIPT], {
+    cwd: ROOT,
+    label: "Writing build metadata",
   });
 
-  runPackageBinary("vite", ["build"], {
+  copyRuntimeNodeModulesWithRetry();
+
+  // `bun install` for these workspaces can emit benign EEXIST errors when
+  // file: deps overlap with manually-linked @elizaos/* symlinks. The links
+  // get created successfully; bun exits non-zero only because of the dup
+  // attempt. Tolerate so the build can proceed.
+  runOptionalWorkspaceInstall(
+    APP_DIR,
+    "Ensuring app workspace dependencies are installed",
+  );
+
+  runOptionalWorkspaceInstall(
+    ELECTROBUN_DIR,
+    "Ensuring Electrobun workspace dependencies are installed",
+  );
+
+  ensureUiGeneratedAssets();
+
+  // Capture the moment the renderer build starts so we can prove afterward that
+  // a FRESH bundle was produced — not a stale dist silently reused (issue #9309).
+  const rendererBuildStartedAt = Date.now() - 1000;
+  runBunPackageBinary("vite", ["build"], {
     cwd: APP_DIR,
-    env: {
-      ...process.env,
-      VITE_APP_VARIANT: variant,
-      MILADY_BUILD_VARIANT: buildVariant,
-    },
-    label: `Building renderer bundle (VITE_APP_VARIANT=${variant}, MILADY_BUILD_VARIANT=${buildVariant})`,
+    env: desktopRendererBuildEnv(),
+    label: `Building renderer bundle (VITE_APP_VARIANT=${variant}, ELIZA_BUILD_VARIANT=${buildVariant})`,
+  });
+  // Fail loudly if the renderer manifest is missing or predates this build (a
+  // cached/stale dist was reused) or was built for a different variant.
+  assertRendererRebuiltSince(path.join(APP_DIR, "dist"), {
+    notBefore: rendererBuildStartedAt,
+    expectVariant: buildVariant,
+    label: "desktop",
   });
 
   runDesktopPreflight();
@@ -525,20 +1344,32 @@ function stageDesktopBuild() {
   });
 
   if (process.platform === "darwin") {
-    runBun(["run", "build:native-effects"], {
-      cwd: ELECTROBUN_DIR,
-      label: "Building native macOS effects dylib",
-    });
-  }
-
-  if (
-    buildWhisper &&
-    (process.platform === "darwin" || process.platform === "linux")
-  ) {
-    runBun(["run", "build:whisper"], {
-      cwd: ELECTROBUN_DIR,
-      label: "Building whisper.cpp native binary",
-    });
+    // build:native-effects shells to `xcrun clang++` (Xcode Command Line
+    // Tools). On a dev machine without the CLT the compile would hard-fail
+    // deep in the stage; skip gracefully unless the build was explicitly asked
+    // for the native bits (CI passes --build-native-effects on a tooled runner).
+    const clangAvailable =
+      which("xcrun") && runCapture("xcrun", ["-f", "clang++"]).status === 0;
+    if (!clangAvailable) {
+      if (nativeEffectsExplicitlyRequested) {
+        fail(
+          "Native macOS effects build requires the Xcode Command Line Tools " +
+            "(xcrun clang++), which are missing. Install them with " +
+            "`xcode-select --install`, or omit --build-native-effects / " +
+            "ELIZA_DESKTOP_BUILD_NATIVE_EFFECTS=1.",
+        );
+      }
+      console.warn(
+        "[desktop-build] Skipping native macOS effects dylib — Xcode Command " +
+          "Line Tools (xcrun clang++) not found. Request the native build " +
+          "explicitly with --build-native-effects to make this a hard error.",
+      );
+    } else {
+      runBun(["run", "build:native-effects"], {
+        cwd: ELECTROBUN_DIR,
+        label: "Building native macOS effects dylib",
+      });
+    }
   }
 }
 
@@ -700,9 +1531,9 @@ function mirrorCanonicalToLegacy(name) {
 
 function packageDesktopBuild() {
   ensureAppDirs();
-  const packageArgs = ["run", "build"];
+  const packageArgs = ["build"];
   if (buildEnv) {
-    packageArgs.push("--", `--env=${buildEnv}`);
+    packageArgs.push(`--env=${buildEnv}`);
   }
 
   if (process.platform === "darwin") {
@@ -720,15 +1551,17 @@ function packageDesktopBuild() {
 
   const packageEnv = {
     ...process.env,
+    ELECTROBUN_SKIP_CODESIGN: process.env.ELECTROBUN_SKIP_CODESIGN ?? "1",
     ELIZA_ELECTROBUN_REPO_ROOT: process.env.ELIZA_ELECTROBUN_REPO_ROOT ?? ROOT,
-    MILADY_BUILD_VARIANT: buildVariant,
+    ELIZA_BUILD_VARIANT: buildVariant,
+    PATH: `${path.join(ELECTROBUN_DIR, "scripts", "bin")}${path.delimiter}${process.env.PATH ?? ""}`,
     ...appIdentityEnv(APP_DIR),
     ...(stageMacosReleaseApp && process.platform === "darwin"
       ? { ELIZA_ELECTROBUN_NOTARIZE: "0" }
       : {}),
   };
 
-  runBun(packageArgs, {
+  runElectrobun(packageArgs, {
     cwd: ELECTROBUN_DIR,
     env: packageEnv,
     label: buildEnv
@@ -760,9 +1593,11 @@ function packageDesktopBuild() {
 
   // Mac App Store post-package codesign: when building the store variant on
   // macOS with real signing enabled, walk the bundle and re-sign every nested
-  // Mach-O with mas-child.entitlements (sandbox + cs.inherit), then sign the
-  // parent .app with mas.entitlements. Required because Electrobun's config
-  // exposes only one entitlements field; helpers must inherit explicitly.
+  // Mach-O with the narrowest applicable entitlements. Most helpers get
+  // mas-child.entitlements, the Bun helper gets mas-bun.entitlements
+  // (Bun-scoped allow-jit), and the parent .app gets mas.entitlements.
+  // Required because Electrobun's config exposes only one entitlements field;
+  // helpers must inherit explicitly.
   if (
     process.platform === "darwin" &&
     buildVariant === "store" &&
@@ -773,9 +1608,9 @@ function packageDesktopBuild() {
       path.join(SCRIPT_DIR, "codesign-mas.mjs"),
       `--app=${appBundlePath}`,
     ];
-    if (process.env.MILADY_MAS_INSTALLER_IDENTITY) {
+    if (process.env.ELIZA_MAS_INSTALLER_IDENTITY) {
       codesignArgs.push(
-        `--installer-identity=${process.env.MILADY_MAS_INSTALLER_IDENTITY}`,
+        `--installer-identity=${process.env.ELIZA_MAS_INSTALLER_IDENTITY}`,
       );
     }
     run("node", codesignArgs, {
@@ -783,6 +1618,26 @@ function packageDesktopBuild() {
       env: packageEnv,
       label: `MAS post-package codesign (${path.basename(appBundlePath)})`,
     });
+
+    // Opt-in post-sign verification. Walks every Mach-O and asserts the
+    // tightened entitlement set is what actually shipped — protects against
+    // future regressions in the signer or in the entitlement plists. Skipped
+    // by default because most builds don't want the extra walk; CI store
+    // builds and developers debugging MAS signing should enable it.
+    if (
+      getBooleanArg(args, "verify-mas") ||
+      process.env.ELIZA_VERIFY_MAS === "1"
+    ) {
+      run(
+        "node",
+        [path.join(SCRIPT_DIR, "mas-smoke.mjs"), `--app=${appBundlePath}`],
+        {
+          cwd: ROOT,
+          env: packageEnv,
+          label: `MAS entitlements verification (${path.basename(appBundlePath)})`,
+        },
+      );
+    }
   }
 
   if (stageMacosReleaseApp && process.platform === "darwin") {
@@ -829,39 +1684,51 @@ Options:
                                    and forces Cloud hosting at runtime; "direct"
                                    keeps current unsandboxed behavior.
   --env <channel>                  Electrobun build env (e.g. canary, stable)
-  --build-whisper                  Build whisper.cpp on macOS/Linux during stage
   --stage-macos-release-app        Stage a direct macOS .app + DMG from the Electrobun build output
   --exclude-optional-pack <name>   Exclude a manifest-classified optional capability pack during staging
+  --build-native-effects           Require the native macOS effects dylib build (hard-fail if Xcode CLT is missing)
+  --verify-mas                     After MAS codesign, walk the bundle and verify the tightened
+                                   entitlements via mas-smoke.mjs. Off by default; ELIZA_VERIFY_MAS=1
+                                   also enables it.
 
 Environment:
   ELIZA_DESKTOP_COMMAND_PREFIX    Prefix every spawned command, e.g. "arch -x86_64"
+  ELIZA_VERIFY_MAS=1              Enable mas-smoke entitlement verification on store builds.
 `);
 }
 
-switch (command) {
-  case "preflight":
-    runDesktopPreflight();
-    break;
-  case "stage":
-    stageDesktopBuild();
-    break;
-  case "package":
-    packageDesktopBuild();
-    break;
-  case "build":
-    stageDesktopBuild();
-    packageDesktopBuild();
-    break;
-  case "run":
-    stageDesktopBuild();
-    packageDesktopBuild();
-    runDesktopBuild();
-    break;
-  case "help":
-  case "--help":
-  case "-h":
-    printUsage();
-    break;
-  default:
-    fail(`Unknown command: ${command}`);
+function runCommand() {
+  switch (command) {
+    case "preflight":
+      runDesktopPreflight();
+      break;
+    case "stage":
+      stageDesktopBuild();
+      break;
+    case "package":
+      packageDesktopBuild();
+      break;
+    case "build":
+      stageDesktopBuild();
+      packageDesktopBuild();
+      break;
+    case "run":
+      stageDesktopBuild();
+      packageDesktopBuild();
+      runDesktopBuild();
+      break;
+    case "help":
+    case "--help":
+    case "-h":
+      printUsage();
+      break;
+    default:
+      fail(`Unknown command: ${command}`);
+  }
+}
+
+if (["preflight", "help", "--help", "-h"].includes(command)) {
+  runCommand();
+} else {
+  withDesktopBuildLock(runCommand);
 }