@elizaos/app-core 2.0.3-beta.4 → 2.0.3-beta.6

package/scripts/copy-runtime-node-modules.ts

@@ -52,6 +52,12 @@ const TRACKED_PACKAGE_CACHE = path.join(
   os.tmpdir(),
   "eliza-tracked-package-cache",
 );
+const RM_PATH_RECURSIVE_SCRIPT = path.join(
+  ROOT,
+  "packages",
+  "scripts",
+  "rm-path-recursive.mjs",
+);
 const PUBLISHED_PACKAGE_FETCH_TIMEOUT_MS = 10_000;
 const ALLOW_REGISTRY_FETCH =
   process.env.ELIZA_RUNTIME_COPY_ALLOW_REGISTRY_FETCH === "1";
@@ -208,10 +214,6 @@ function readJson<T>(filePath: string): T {
   return JSON.parse(fs.readFileSync(filePath, "utf8")) as T;
 }
 
-function sleepSync(ms: number): void {
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-
 function isEnoentError(error: unknown): boolean {
   return Boolean(
     error &&
@@ -220,20 +222,6 @@ function isEnoentError(error: unknown): boolean {
   );
 }
 
-function isRetryableRemoveError(error: unknown): boolean {
-  if (!error || typeof error !== "object") {
-    return false;
-  }
-  const code = (error as { code?: string }).code;
-  return (
-    code === "EBUSY" ||
-    code === "EMFILE" ||
-    code === "ENFILE" ||
-    code === "ENOTEMPTY" ||
-    code === "EPERM"
-  );
-}
-
 function isProcessAlive(pid: number): boolean {
   try {
     process.kill(pid, 0);
@@ -259,55 +247,72 @@ function readRuntimeCopyLockOwnerPid(lockDir: string): number | null {
   }
 }
 
-function rmRecursive(pathToRemove: string): void {
-  const maxAttempts = 8;
-  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-    try {
-      fs.rmSync(pathToRemove, {
-        force: true,
-        maxRetries: 5,
-        recursive: true,
-        retryDelay: 100,
-      });
-      return;
-    } catch (error) {
-      if (!isRetryableRemoveError(error)) {
-        throw error;
-      }
-      if (attempt === maxAttempts - 1) break;
-      sleepSync(100 * (attempt + 1));
-    }
+function recursiveRemoveErrorDetail(error: unknown): string {
+  if (error && typeof error === "object") {
+    const output = error as {
+      message?: string;
+      stderr?: unknown;
+      stdout?: unknown;
+    };
+    const detail = [output.stdout, output.stderr]
+      .filter(
+        (chunk): chunk is Buffer | string =>
+          Buffer.isBuffer(chunk) || typeof chunk === "string",
+      )
+      .map((chunk) => chunk.toString().trim())
+      .filter(Boolean)
+      .join("\n");
+    if (detail) return detail;
+    if (typeof output.message === "string") return output.message;
   }
+  return String(error);
+}
 
-  if (!fs.existsSync(pathToRemove)) {
-    return;
+function runSharedRecursiveRemove(pathToRemove: string): void {
+  try {
+    execFileSync(
+      "node",
+      [RM_PATH_RECURSIVE_SCRIPT, path.resolve(pathToRemove)],
+      {
+        encoding: "utf8",
+        stdio: "pipe",
+      },
+    );
+  } catch (error) {
+    throw new Error(recursiveRemoveErrorDetail(error), { cause: error });
   }
+}
 
-  const parentDir = path.dirname(pathToRemove);
-  const tombstone = path.join(
-    parentDir,
-    `.${path.basename(pathToRemove)}.delete-${process.pid}-${Date.now()}`,
-  );
+function rmRecursive(pathToRemove: string): void {
   try {
-    fs.renameSync(pathToRemove, tombstone);
+    runSharedRecursiveRemove(pathToRemove);
+    return;
   } catch (error) {
     if (!fs.existsSync(pathToRemove)) {
       return;
     }
-    throw error;
-  }
 
-  try {
-    fs.rmSync(tombstone, {
-      force: true,
-      maxRetries: 10,
-      recursive: true,
-      retryDelay: 100,
-    });
-  } catch (error) {
-    console.warn(
-      `[runtime-copy] warning: moved retry-resistant path aside but could not fully remove ${tombstone}: ${error instanceof Error ? error.message : String(error)}`,
+    const parentDir = path.dirname(pathToRemove);
+    const tombstone = path.join(
+      parentDir,
+      `.${path.basename(pathToRemove)}.delete-${process.pid}-${Date.now()}`,
     );
+    try {
+      fs.renameSync(pathToRemove, tombstone);
+    } catch {
+      if (!fs.existsSync(pathToRemove)) {
+        return;
+      }
+      throw error;
+    }
+
+    try {
+      runSharedRecursiveRemove(tombstone);
+    } catch (tombstoneError) {
+      console.warn(
+        `[runtime-copy] warning: moved retry-resistant path aside but could not fully remove ${tombstone}: ${recursiveRemoveErrorDetail(tombstoneError)}`,
+      );
+    }
   }
 }
 
@@ -331,7 +336,7 @@ function acquireRuntimeCopyLock(targetDist: string): () => void {
         )}\n`,
       );
       return () => {
-        fs.rmSync(lockDir, { force: true, recursive: true });
+        rmRecursive(lockDir);
       };
     } catch (error) {
       if (
@@ -877,7 +882,7 @@ function pruneCopiedPackageDir(name: string, packageDir: string): void {
       const relativePath = path.relative(packageDir, entryPath);
 
       if (shouldPrunePackageRelativePath(name, relativePath)) {
-        fs.rmSync(entryPath, { recursive: true, force: true });
+        rmRecursive(entryPath);
         continue;
       }
 
@@ -887,7 +892,7 @@ function pruneCopiedPackageDir(name: string, packageDir: string): void {
           !isRequiredRuntimeDocDirectory(entryPath) &&
           !shouldPreservePrunedPackageEntry(name, packageDir, entryPath))
       ) {
-        fs.rmSync(entryPath, { recursive: true, force: true });
+        rmRecursive(entryPath);
         continue;
       }
 
@@ -908,7 +913,7 @@ function pruneCopiedPackageDir(name: string, packageDir: string): void {
           name,
         )
       ) {
-        fs.rmSync(entryPath, { recursive: true, force: true });
+        rmRecursive(entryPath);
         continue;
       }
 
@@ -1489,7 +1494,7 @@ function patchCopiedElevenLabsTarSafePaths(
 function patchCopiedAiSdkProviderRuntimeSurface(packageDir: string): void {
   const distIndex = path.join(packageDir, "dist", "index.js");
   if (fs.existsSync(distIndex)) {
-    fs.rmSync(path.join(packageDir, "src"), { recursive: true, force: true });
+    rmRecursive(path.join(packageDir, "src"));
   }
 }
 
@@ -1686,7 +1691,7 @@ function fetchPublishedPackage(
     return resolved;
   }
 
-  fs.rmSync(cacheDir, { recursive: true, force: true });
+  rmRecursive(cacheDir);
   fs.mkdirSync(cacheDir, { recursive: true });
 
   try {
@@ -1742,7 +1747,7 @@ function materializeTrackedWorkspacePackage(
     return resolved;
   }
 
-  fs.rmSync(cacheDir, { recursive: true, force: true });
+  rmRecursive(cacheDir);
   fs.mkdirSync(cacheDir, { recursive: true });
 
   try {

package/scripts/desktop-build.mjs

@@ -38,6 +38,12 @@ const COMMAND_PREFIX = (process.env.ELIZA_DESKTOP_COMMAND_PREFIX ?? "")
   .split(/\s+/)
   .filter(Boolean);
 const DESKTOP_BUILD_LOCK_DIR = path.join(ROOT, ".turbo", "desktop-build.lock");
+const CLEANUP_HELPER_SCRIPT = path.join(
+  ROOT,
+  "packages",
+  "scripts",
+  "rm-path-recursive.mjs",
+);
 const RUNTIME_COPY_SCRIPT = fs.existsSync(
   path.join(ROOT, "scripts", "copy-runtime-node-modules.ts"),
 )
@@ -88,6 +94,33 @@ function isProcessAlive(pid) {
   }
 }
 
+function removePathRecursive(targetPath, label = "path cleanup") {
+  const result = spawnSync("node", [CLEANUP_HELPER_SCRIPT, targetPath], {
+    cwd: ROOT,
+    encoding: "utf8",
+    stdio: "pipe",
+  });
+
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    const detail = [result.stdout, result.stderr]
+      .filter(Boolean)
+      .join("\n")
+      .trim();
+    throw new Error(
+      `${label} failed with exit code ${result.status ?? 1}${
+        detail ? `: ${detail}` : ""
+      }`,
+    );
+  }
+}
+
+function removeDesktopBuildLockDir() {
+  removePathRecursive(DESKTOP_BUILD_LOCK_DIR, "desktop build lock cleanup");
+}
+
 function withDesktopBuildLock(run) {
   const lockParent = path.dirname(DESKTOP_BUILD_LOCK_DIR);
   const staleAfterMs = 30 * 60 * 1000;
@@ -120,7 +153,7 @@ function withDesktopBuildLock(run) {
         (ownerPid !== null && !isProcessAlive(ownerPid)) ||
         Date.now() - stat.mtimeMs > staleAfterMs
       ) {
-        fs.rmSync(DESKTOP_BUILD_LOCK_DIR, { recursive: true, force: true });
+        removeDesktopBuildLockDir();
         continue;
       }
 
@@ -137,7 +170,7 @@ function withDesktopBuildLock(run) {
   try {
     run();
   } finally {
-    fs.rmSync(DESKTOP_BUILD_LOCK_DIR, { recursive: true, force: true });
+    removeDesktopBuildLockDir();
   }
 }
 
@@ -1467,7 +1500,7 @@ function mirrorTreePreservingSymlinks(src, dst) {
     if (dstLstat) {
       try {
         if (dstLstat.isDirectory() && !dstLstat.isSymbolicLink()) {
-          fs.rmSync(dst, { force: true, recursive: true });
+          removePathRecursive(dst, "desktop mirror directory cleanup");
         } else {
           fs.unlinkSync(dst);
         }
@@ -1569,8 +1602,16 @@ function packageDesktopBuild() {
       : "Packaging Electrobun app",
   });
 
-  mirrorCanonicalToLegacy("build");
-  mirrorCanonicalToLegacy("artifacts");
+  // The legacy compatibility path (APP_DIR/electrobun) is not read by any
+  // production code — only docs and this mirror fn reference it (the inno
+  // installer takes BuildDir as a param; copy-runtime-node-modules reads the
+  // canonical platforms/electrobun path). Mirroring the entire ~2.3 GB /
+  // ~110k-file build tree on every package build is pure waste, so make it
+  // opt-in (default off). Set ELIZA_ELECTROBUN_MIRROR_LEGACY=1 to restore it.
+  if (process.env.ELIZA_ELECTROBUN_MIRROR_LEGACY === "1") {
+    mirrorCanonicalToLegacy("build");
+    mirrorCanonicalToLegacy("artifacts");
+  }
 
   // Electrobun's built-in rcedit call references a CI-local D:\ path that
   // doesn't exist on developer machines. Re-embed the icon from a locally

package/scripts/dev-platform-no-install.test.mjs

@@ -0,0 +1,19 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const scriptPath = path.join(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "dev-platform.mjs",
+);
+
+describe("dev-platform API child command", () => {
+  it("disables Bun auto-install for the runtime process", () => {
+    const source = readFileSync(scriptPath, "utf8");
+
+    expect(source).toContain(
+      'const apiSourceConditionArgs = ["--no-install", "--conditions=eliza-source"];',
+    );
+  });
+});

package/scripts/dev-platform.mjs

@@ -877,9 +877,13 @@ async function launch() {
     ...apiEmbeddingWarmupPolicy.env,
   };
   const apiWatchEnabled = envFlagEnabled("ELIZA_DESKTOP_API_WATCH");
+  // Runtime startup must never mutate dependencies. Optional plugin imports
+  // should fail fast when a package is absent instead of letting Bun auto-install
+  // transitive native packages inside the desktop app process.
+  const apiSourceConditionArgs = ["--no-install", "--conditions=eliza-source"];
   const apiArgs = apiWatchEnabled
-    ? ["--watch", devServerEntry]
-    : [devServerEntry];
+    ? [...apiSourceConditionArgs, "--watch", devServerEntry]
+    : [...apiSourceConditionArgs, devServerEntry];
   if (!apiWatchEnabled) {
     console.log(
       "[eliza] API file watcher disabled (set ELIZA_DESKTOP_API_WATCH=1 to enable).",

package/scripts/disable-local-eliza-workspace.mjs

@@ -43,6 +43,7 @@
  * untouched.
  */
 
+import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -63,6 +64,11 @@ export const CI_LOCKFILES = ["bun.lock", "bun.lockb"];
 
 const ELIZAOS_CORE_NAME = "@elizaos/core";
 const SCRIPT_PATH = fileURLToPath(import.meta.url);
+const SCRIPT_DIR = path.dirname(SCRIPT_PATH);
+const RECURSIVE_CLEANUP_SCRIPT = path.resolve(
+  SCRIPT_DIR,
+  "../../scripts/rm-path-recursive.mjs",
+);
 const DEFAULT_REPO_ROOT = process.cwd();
 
 function isExactRegistryVersion(specifier) {
@@ -123,6 +129,22 @@ export function writePackageJson(filePath, originalRaw, pkg) {
   return true;
 }
 
+function removeDirectoryRecursive(targetPath) {
+  try {
+    execFileSync("node", [RECURSIVE_CLEANUP_SCRIPT, path.resolve(targetPath)], {
+      cwd: DEFAULT_REPO_ROOT,
+      encoding: "utf8",
+      stdio: "pipe",
+    });
+  } catch (error) {
+    const detail = [error?.stdout, error?.stderr].filter(Boolean).join("\n");
+    throw new Error(
+      `Failed to remove directory ${targetPath}${detail ? `: ${detail}` : ""}`,
+      { cause: error },
+    );
+  }
+}
+
 export function expandGlob(glob, { rootDir = DEFAULT_REPO_ROOT } = {}) {
   if (!glob.includes("*")) {
     return [glob];
@@ -244,7 +266,7 @@ export function disableLocalElizaWorkspace(
   const removedLockfiles = [];
 
   if (fs.existsSync(elizaRoot)) {
-    fs.rmSync(disabledElizaRoot, { recursive: true, force: true });
+    removeDirectoryRecursive(disabledElizaRoot);
     fs.renameSync(elizaRoot, disabledElizaRoot);
     log(
       `[disable-local-eliza-workspace] Disabled repo-local eliza workspace at ${elizaRoot}`,

package/scripts/docker-ci-smoke.sh

@@ -207,6 +207,7 @@ else
 fi
 APP_CORE_SCRIPTS_DIR="$APP_CORE_DIR/scripts"
 AGENT_DIR="$PACKAGES_DIR/agent"
+RM_PATH_RECURSIVE=(node "$PACKAGES_DIR/scripts/rm-path-recursive.mjs")
 # @elizaos/core source lives under packages/core (current) or packages/typescript
 # (legacy). Prefer the current name; fall back to the legacy path so older branches
 # still work.
@@ -668,7 +669,7 @@ if [[ -f packages/contracts/package.json ]] && jq -e '.scripts.build' packages/c
   "$BUN_BIN" run build
   popd >/dev/null
   mkdir -p node_modules/@elizaos
-  rm -rf node_modules/@elizaos/contracts
+  "${RM_PATH_RECURSIVE[@]}" node_modules/@elizaos/contracts
   ln -s ../../packages/contracts node_modules/@elizaos/contracts
 fi
 
@@ -682,7 +683,7 @@ if [[ -f packages/logger/package.json ]] && jq -e '.scripts.build' packages/logg
   "$BUN_BIN" run build
   popd >/dev/null
   mkdir -p node_modules/@elizaos
-  rm -rf node_modules/@elizaos/logger
+  "${RM_PATH_RECURSIVE[@]}" node_modules/@elizaos/logger
   ln -s ../../packages/logger node_modules/@elizaos/logger
 fi
 
@@ -693,7 +694,7 @@ if [[ -f "$TYPESCRIPT_DIR/package.json" ]]; then
   popd >/dev/null
   node packages/scripts/prepare-package-dist.mjs "$TYPESCRIPT_DIR"
   CORE_NODE_MODULE="node_modules/@elizaos/core"
-  rm -rf "$CORE_NODE_MODULE"
+  "${RM_PATH_RECURSIVE[@]}" "$CORE_NODE_MODULE"
   mkdir -p "$(dirname "$CORE_NODE_MODULE")"
   ln -s "../../$TYPESCRIPT_DIR" "$CORE_NODE_MODULE"
   node packages/scripts/patch-nested-core-dist.mjs || true
@@ -713,7 +714,7 @@ for package_dir in packages/shared packages/cloud-sdk packages/cloud-routing pac
   fi
 done
 mkdir -p node_modules/@elizaos
-rm -rf node_modules/@elizaos/shared node_modules/@elizaos/cloud-sdk node_modules/@elizaos/cloud-routing node_modules/@elizaos/skills
+"${RM_PATH_RECURSIVE[@]}" node_modules/@elizaos/shared node_modules/@elizaos/cloud-sdk node_modules/@elizaos/cloud-routing node_modules/@elizaos/skills
 ln -s ../../packages/shared node_modules/@elizaos/shared
 ln -s ../../packages/cloud-sdk node_modules/@elizaos/cloud-sdk
 ln -s ../../packages/cloud-routing node_modules/@elizaos/cloud-routing
@@ -802,7 +803,7 @@ popd >/dev/null
 
 if [[ -n "${CORE_NODE_MODULE:-}" && -f "$TYPESCRIPT_DIR/dist/package.json" ]]; then
   log "Relinking @elizaos/core to built dist for Docker runtime"
-  rm -rf "$CORE_NODE_MODULE"
+  "${RM_PATH_RECURSIVE[@]}" "$CORE_NODE_MODULE"
   mkdir -p "$(dirname "$CORE_NODE_MODULE")"
   ln -s "../../$TYPESCRIPT_DIR/dist" "$CORE_NODE_MODULE"
 fi

package/scripts/ensure-avatars.mjs

@@ -11,7 +11,7 @@
  *   node scripts/ensure-avatars.mjs
  *   node scripts/ensure-avatars.mjs --force   # re-download even if present
  */
-import { execSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
 import {
   cpSync,
   existsSync,
@@ -31,6 +31,12 @@ import { resolveRepoRootFromImportMeta } from "./lib/repo-root.mjs";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const ROOT = resolveRepoRootFromImportMeta(import.meta.url);
+const cleanupHelperScript = join(
+  ROOT,
+  "packages",
+  "scripts",
+  "rm-path-recursive.mjs",
+);
 const PUBLIC = join(ROOT, "eliza", "plugins", "app-companion", "public");
 const VRMS_DIR = join(PUBLIC, "vrms");
 const ANIMATIONS_DIR = join(PUBLIC, "animations");
@@ -89,6 +95,13 @@ function gitAvailable() {
   }
 }
 
+function removePathRecursive(targetPath) {
+  execFileSync(process.execPath, [cleanupHelperScript, targetPath], {
+    cwd: ROOT,
+    stdio: "inherit",
+  });
+}
+
 /** Count files matching an extension in a directory (non-recursive). */
 function countFiles(dir, ext) {
   if (!existsSync(dir)) return 0;
@@ -212,7 +225,7 @@ export function runEnsureAvatars({
   try {
     // Clean up any previous failed attempt
     if (existsSync(tmpDir)) {
-      rmSync(tmpDir, { recursive: true, force: true });
+      removePathRecursive(tmpDir);
     }
 
     // Clone and checkout pinned commit for reproducibility.
@@ -236,7 +249,7 @@ export function runEnsureAvatars({
 
     const avatarVrms = join(tmpDir, "vrms");
     if (existsSync(avatarVrms) && !useLocalVrms) {
-      rmSync(VRMS_DIR, { recursive: true, force: true });
+      removePathRecursive(VRMS_DIR);
       mkdirSync(VRMS_DIR, { recursive: true });
       mkdirSync(join(VRMS_DIR, "previews"), { recursive: true });
       mkdirSync(join(VRMS_DIR, "backgrounds"), { recursive: true });
@@ -269,7 +282,7 @@ export function runEnsureAvatars({
 
     const avatarAnims = join(tmpDir, "animations");
     if (existsSync(avatarAnims)) {
-      rmSync(ANIMATIONS_DIR, { recursive: true, force: true });
+      removePathRecursive(ANIMATIONS_DIR);
       mkdirSync(ANIMATIONS_DIR, { recursive: true });
       copyPathIfExists(
         join(avatarAnims, "idle.glb"),
@@ -317,7 +330,7 @@ export function runEnsureAvatars({
   } finally {
     try {
       if (existsSync(tmpDir)) {
-        rmSync(tmpDir, { recursive: true, force: true });
+        removePathRecursive(tmpDir);
       }
     } catch {
       // Ignore cleanup errors

package/scripts/ensure-bundled-workspaces.mjs

@@ -13,22 +13,11 @@ const DEFAULT_REPO_ROOT = resolveRepoRootFromImportMeta(import.meta.url);
 export const BUNDLED_WORKSPACE_BUILDS = [
   {
     label: "@elizaos/plugin-agent-skills",
-    cwd: path.join("plugins", "plugin-agent-skills", "typescript"),
-    manifest: path.join(
-      "plugins",
-      "plugin-agent-skills",
-      "typescript",
-      "package.json",
-    ),
-    artifact: path.join(
-      "plugins",
-      "plugin-agent-skills",
-      "typescript",
-      "dist",
-      "index.js",
-    ),
+    cwd: path.join("plugins", "plugin-agent-skills"),
+    manifest: path.join("plugins", "plugin-agent-skills", "package.json"),
+    artifact: path.join("plugins", "plugin-agent-skills", "dist", "index.js"),
     args: [
-      "../../../packages/app-core/scripts/build-bundled-agent-skills-artifact.mjs",
+      "../../packages/app-core/scripts/build-bundled-agent-skills-artifact.mjs",
     ],
   },
   // Only build workspaces that downstream packaging consumes directly. Building

package/scripts/ensure-type-package-aliases.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import { spawnSync } from "node:child_process";
 import {
   cpSync,
   existsSync,
@@ -8,7 +9,6 @@ import {
   readdirSync,
   readFileSync,
   readlinkSync,
-  rmSync,
   unlinkSync,
   writeFileSync,
 } from "node:fs";
@@ -18,6 +18,7 @@ import { resolveRepoRootFromImportMeta } from "./lib/repo-root.mjs";
 
 const __filename = fileURLToPath(import.meta.url);
 const REPO_ROOT = resolveRepoRootFromImportMeta(import.meta.url);
+const CLEANUP_HELPER_SCRIPT = resolveCleanupHelperScript();
 const ROOT_NODE_MODULES = path.join(REPO_ROOT, "node_modules");
 const ELIZA_NODE_MODULES = path.join(REPO_ROOT, "eliza", "node_modules");
 const GLOBAL_TYPES_CACHE_DIR = path.join(
@@ -58,6 +59,49 @@ const MATERIALIZED_TYPE_PACKAGES = [
 ];
 const MATERIALIZED_PACKAGES = ["bun-types", "csstype"];
 
+function resolveCleanupHelperScript() {
+  const candidates = [
+    path.join(REPO_ROOT, "packages", "scripts", "rm-path-recursive.mjs"),
+    path.join(
+      REPO_ROOT,
+      "eliza",
+      "packages",
+      "scripts",
+      "rm-path-recursive.mjs",
+    ),
+  ];
+  return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];
+}
+
+function removePathRecursive(targetPath) {
+  if (!existsSync(targetPath)) {
+    return;
+  }
+
+  const result = spawnSync(
+    "node",
+    [CLEANUP_HELPER_SCRIPT, path.relative(REPO_ROOT, targetPath)],
+    {
+      cwd: REPO_ROOT,
+      encoding: "utf8",
+      stdio: "pipe",
+    },
+  );
+
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    const output = [result.stdout, result.stderr]
+      .filter(Boolean)
+      .join("\n")
+      .trim();
+    throw new Error(
+      `cleanup helper failed for ${targetPath}${output ? `:\n${output}` : ""}`,
+    );
+  }
+}
+
 function collectBrokenBundledTypePackages() {
   const packageNames = new Set();
 
@@ -132,7 +176,7 @@ function repairBrokenDirectoryLink(dir) {
 }
 
 function recreateTypeRoot(targetTypesDir) {
-  rmSync(targetTypesDir, { recursive: true, force: true });
+  removePathRecursive(targetTypesDir);
   mkdirSync(targetTypesDir, { recursive: true });
 }
 
@@ -176,7 +220,7 @@ function removeExistingTypeEntry(targetPath) {
     throw error;
   }
   if (stat.isDirectory()) {
-    rmSync(targetPath, { recursive: true, force: true });
+    removePathRecursive(targetPath);
   } else {
     unlinkSync(targetPath);
   }

package/scripts/ffi-stub/Makefile

@@ -31,6 +31,9 @@ VERIFY_TARGET  := linux-x64-cpu-fused
 NM             := nm -D --defined-only
 endif
 
+REPO_ROOT := $(abspath ../../../..)
+RM_PATH_RECURSIVE := node $(REPO_ROOT)/packages/scripts/rm-path-recursive.mjs
+
 .PHONY: all clean verify verify-stub-rejected
 all: $(DEFAULT_TARGET)
 
@@ -51,14 +54,14 @@ verify-stub-rejected: $(DEFAULT_TARGET)
 	if node ../build-helpers/verify-fused-symbols.mjs --out-dir $$tmp --target $(VERIFY_TARGET) --json >$$tmp/stdout 2>$$tmp/stderr; then \
 		echo "[verify] FAILED: real verifier accepted the stub as $(REAL_LIB_NAME)"; \
 		cat $$tmp/stdout; \
-		rm -rf $$tmp; \
+		$(RM_PATH_RECURSIVE) $$tmp; \
 		exit 1; \
 	fi; \
 	test -s $$tmp/OMNIVOICE_FUSE_VERIFY.json; \
 	grep -q '"ok": false' $$tmp/OMNIVOICE_FUSE_VERIFY.json; \
 	grep -q 'stub' $$tmp/OMNIVOICE_FUSE_VERIFY.json; \
 	echo "[verify] PASS: real verifier rejects stub-only libelizainference"; \
-	rm -rf $$tmp
+	$(RM_PATH_RECURSIVE) $$tmp
 
 clean:
 	rm -f libelizainference_stub.dylib libelizainference_stub.so