electron-builder.template.yml

# ──────────────────────────────────────────────────────────────────────────────
# electron-builder template — DO NOT edit electron-builder.yml by hand.
#
# This file is used by `scripts/generate-builder-config.ts` to produce the
# final electron-builder.yml with values from `branding.config.ts`.
# Placeholders use double-brace tokens where the name matches a branding config property.
# ──────────────────────────────────────────────────────────────────────────────
appId: "{{appId}}"
productName: "{{productName}}"
executableName: "{{executableName}}"
afterPack: scripts/after-pack.cjs
# Do NOT let electron-builder recompile native deps from source at package time.
# Every native dep we ship installs a prebuilt binary during `pnpm install`
# (active-win → node-pre-gyp napi prebuilt on Windows / source-built on mac+linux
# at install; sharp → prebuilt). @electron/rebuild otherwise recompiles active-win
# from source on Windows, which needs a Visual Studio toolchain the CI runner
# doesn't expose → build failure. active-win's .node is Windows-only anyway
# (mac uses the bundled universal binary, Linux shells out to xprop/xdotool), and
# all these prebuilts are NAPI (ABI-stable across the Node↔Electron boundary), so
# reusing the install-time binary is correct on every platform.
# TODO(#254): true RCA on why --frozen-lockfile flips @electron/rebuild from
# reuse-prebuilt to recompile-from-source; revisit whether this can be narrower.
npmRebuild: false
directories:
  buildResources: build
  output: dist
files:
  - out/**/*
  - "!**/*.map"
  # active-win's .node addon is loaded only by lib/windows.js; node-pre-gyp
  # builds it per-arch on darwin/linux anyway, which breaks @electron/universal's
  # mach-o symmetry check. Exclude the non-win32 binding dirs (macOS uses the
  # bundled universal `main` binary, Linux shells out to xprop/xdotool).
  - "!**/node_modules/active-win/lib/binding/napi-*-darwin-*/**"
  - "!**/node_modules/active-win/lib/binding/napi-*-linux-*/**"
  - "!**/node_modules/active-win/build-tmp-*/**"
  # node-addon-api is a BUILD-TIME header-only package (no `main`, no runtime JS/
  # .node) pulled in transitively by active-win + node-mac-permissions. With
  # npmRebuild:false its files differ between the x64 and arm64 dependency trees,
  # tripping @electron/universal's "unique file not covered by allowList"
  # symmetry check. Nothing require()s it at runtime, so drop it from the package.
  - "!**/node_modules/node-addon-api/**"
  # Dev-only cruft some packages ship (e.g. strnum's `.vscode/`) can appear in
  # only ONE arch's dependency tree under pnpm's --frozen-lockfile layout, which
  # trips @electron/universal's arch-symmetry check — AND it can't be covered by
  # singleArchFiles because minimatch runs without `dot:true`, so `pkg/**` never
  # matches a dot-dir like `.vscode`. Strip these dev/editor/CI dirs from every
  # bundled module (never needed at runtime) so they never reach the check.
  - "!**/node_modules/**/.vscode/**"
  - "!**/node_modules/**/.github/**"
  - "!**/node_modules/**/.idea/**"
# smartUnpack auto-detects most native binaries, but the Codex CLI lives deep
# under vendor/<triple>/codex/codex inside an optionalDependency and has been
# missed — leaving it inside app.asar makes spawn() fail with ENOTDIR. List it
# explicitly so the unpacked copy is guaranteed.
asarUnpack:
  - "**/@openai/codex*/**"
  # React artifacts are esbuild-bundled at runtime (electron/ipc/artifact-bundle.ts).
  # esbuild's native service reads inputs from the real FS and cannot resolve
  # modules inside app.asar, so React + its bundling inputs must be unpacked.
  - "**/node_modules/react/**"
  - "**/node_modules/react-dom/**"
  - "**/node_modules/scheduler/**"
  # esbuild is dynamically imported at runtime to bundle React artifacts. Its JS
  # package spawns a native service binary (node_modules/@esbuild/<platform>/bin);
  # both must be OUTSIDE app.asar or spawn() fails and every React artifact
  # preview breaks. smartUnpack doesn't reliably catch the dynamic import, so
  # list them explicitly (same reasoning as @openai/codex above).
  - "**/node_modules/esbuild/**"
  - "**/node_modules/@esbuild/**"
extraResources:
  - from: bundled-plugins
    to: bundled-plugins
    filter:
      - "**/*"
      - "!.gitkeep"
  # Prebuilt mermaid render runtime (scripts/build-mermaid-runtime.mjs, run in
  # `pnpm build`). Landed at process.resourcesPath/mermaid-runtime.js and read by
  # the artifact:bundle-mermaid IPC — so mermaid + its ~58 deps do NOT need to be
  # asarUnpack'd and there's no runtime esbuild on the render path.
  - from: resources/mermaid-runtime.js
    to: mermaid-runtime.js
  # One signed Node SEA executable is reused by every compatible plugin. Each
  # plugin still receives a distinct OS process; architecture-specific hosts
  # let universal macOS builds select the native executable at runtime.
  - from: resources/plugin-host
    to: plugin-host
    filter:
      - "manifest.json"
      - "**/kai-plugin-host"
      - "**/kai-plugin-host.exe"
{{esbuildExtraResources}}
icon: build/icon
# Electron Fuses — locked-down per ADR 0001 (docs/adr/0001-electron-fuses-policy.md).
# verify-fuses.ts (run from the pr-mac-build job after `pnpm build:mac`)
# reads these back off the packaged .app and fails CI on any drift.
electronFuses:
  runAsNode: false
  enableCookieEncryption: true
  enableNodeOptionsEnvironmentVariable: false
  enableNodeCliInspectArguments: false
  enableEmbeddedAsarIntegrityValidation: true
  onlyLoadAppFromAsar: true
mac:
  category: "{{macCategory}}"
  # Platform-package binaries (@libsql/darwin-*, @lydell/node-pty-darwin-*,
  # claude-agent-sdk, codex, esbuild) land in app.asar.unpacked identically in
  # both per-arch temp builds because pnpm installs both cpu variants
  # (supportedArchitectures) and electron-builder copies node_modules verbatim.
  # Tell @electron/universal to copy these as-is instead of failing the
  # same-SHA mach-o check; the runtime loader of each package picks the right
  # darwin-${process.arch} variant. The bundled esbuild extraResource is
  # host-arch-only and currently unused at runtime. The plugin-host resource also
  # intentionally contains BOTH darwin-arm64 and darwin-x64 SEA executables in
  # each temp build; plugin-runtime.ts selects the matching process.arch at
  # runtime. Cover the whole resource so @electron/universal keeps one identical
  # copy instead of rejecting the duplicate cross-arch files.
  x64ArchFiles: "Contents/Resources/{esbuild/bin/esbuild,app.asar.unpacked/**,plugin-host/**}"
  # The AWS SDK's deep transitive tree is PURE JS (no arch-specific binaries) but
  # @electron/universal's mergeASARs can flag a package DIRECTORY as a "unique
  # file not covered by allowList" because pnpm places packages at slightly
  # different positions in the x64 vs arm64 packed asar — whack-a-mole across the
  # whole closure (xml-builder → @smithy/core → fast-xml-builder …). Every one of
  # these is byte-identical across arches and needed at runtime (Bedrock), so
  # allow the whole AWS SDK closure — the scoped packages AND its bare-name deps
  # (fast-xml-parser + its leaves fast-xml-builder/path-expression-matcher/strnum,
  # plus @smithy's bowser/mnemonist) — to appear in a single arch's asar; the universal merge keeps one copy. `{,/**}` matches the package DIRECTORY
  # entry itself AND its descendants (a trailing `/**` alone misses the dir entry).
  singleArchFiles: "{node_modules,**/node_modules}/{@aws-sdk,@smithy,@aws-crypto,fast-xml-parser,fast-xml-builder,path-expression-matcher,strnum,bowser,mnemonist}{,/**}"
  hardenedRuntime: true
  entitlements: build/entitlements.mac.plist
  entitlementsInherit: build/entitlements.mac.inherit.plist
  notarize: true
  extraResources:
    - from: build/bin/LocalMacosHelper
      to: bin/LocalMacosHelper
    # `kai` terminal-client launcher — execs this app's binary with --kai-cli.
    # Shipped in Contents/Resources/bin; the app offers to symlink it onto PATH
    # (e.g. /usr/local/bin/kai) from settings, à la VS Code's `code` command.
    - from: bin/kai
      to: bin/kai
  extendInfo:
    CFBundleDisplayName: "{{productName}}"
    CFBundleName: "{{productName}}"
    NSMicrophoneUsageDescription: "{{microphoneUsage}}"
    NSAppleEventsUsageDescription: "{{appleEventsUsage}}"
    NSScreenCaptureUsageDescription: "{{screenCaptureUsage}}"
    NSLocalNetworkUsageDescription: "{{localNetworkUsage}}"
    NSContactsUsageDescription: "{{contactsUsage}}"
    NSAppTransportSecurity:
      NSAllowsLocalNetworking: true
  target:
    - target: dmg
      arch:
        - universal
    - target: zip
      arch:
        - universal
  artifactName: "{{artifactPrefix}}-${version}-${arch}.${ext}"
dmg:
  background: build/dmg-background.png
  icon: build/icon.icns
  iconSize: 128
  window:
    width: 660
    height: 400
  contents:
    - x: 180
      y: 200
      type: file
    - x: 480
      y: 200
      type: link
      path: /Applications
publish:
  - provider: github
    owner: legionio
    repo: kai-desktop
# NOTE: the `win`/`nsis` blocks below are INCLUDED by default (experimental-on
# posture — win/linux ship as experimental for feedback). They are stripped from
# the generated config only when KAI_DISABLE_WIN_BUILD is set (e.g. a mac-only
# release). See ADR-0005 and #82.
win:
  icon: build/icon.ico
  extraResources:
    - from: build/bin/LocalWindowsHelper.ps1
      to: bin/LocalWindowsHelper.ps1
    # `kai` terminal-client launcher (Windows). The app offers to add it to PATH.
    - from: bin/kai.cmd
      to: bin/kai.cmd
  target:
    - target: nsis
      arch:
        - x64
  artifactName: "{{artifactPrefix}}-${version}-win-x64.${ext}"
nsis:
  oneClick: false
  perMachine: false
  allowToChangeInstallationDirectory: true
  deleteAppDataOnUninstall: false
linux:
  category: Development
  maintainer: "{{linuxMaintainer}}"
  icon: build/icon.png
  extraResources:
    - from: build/bin/LocalLinuxHelper.sh
      to: bin/LocalLinuxHelper.sh
    - from: build/bin/atspi_helper.py
      to: bin/atspi_helper.py
    # `kai` terminal-client launcher (Linux). The app offers to add it to PATH.
    - from: bin/kai
      to: bin/kai
  target:
    - target: AppImage
      arch:
        - x64
    - target: deb
      arch:
        - x64
  artifactName: "{{artifactPrefix}}-${version}-linux-${arch}.${ext}"