build(desktop): stop shipping the renderer's dependency tree twice

`app.asar` carried a second copy of the renderer's dependency sources. Vite
emits everything the renderer loads into `dist-renderer`; electron-builder
then walked the production dependency closure of `apps/desktop/package.json`
and packaged those same packages again, as sources nothing ever loads.

A `files` denylist was the first attempt and could not hold. It has to name
every transitive package too, so excluding `mermaid` did not stop
electron-builder from independently collecting what `mermaid` hoists, and
`d3-*` never matched the bare `d3` meta-package.

Move the nine renderer-only direct dependencies to `devDependencies` instead.
That removes them and everything only reachable through them from the
closure, so the denylist is deleted rather than extended.

Notices follow what ships, not what npm places in node_modules. The generator
now unions the Node production closure with the closure of the renderer roots,
declared once in `maka.rendererBundledDependencies` and read by both the
generator and the packaged-artifact check so the two cannot drift. Without
that, moving these packages out of the production closure would have dropped
the notices for code that still ships inside `dist-renderer`.

Verification moved from the manifest to the artifact.
`assertPackagedDependencyClosure` reads `app.asar` directly: the nine must be
absent, `@xterm/headless` and `@xterm/addon-unicode11` must be present because
the PTY stack loads them, and every shipped renderer package must have a
notice. A manifest assertion would have stayed green through a change in how
electron-builder walks the closure, a transitive package leaking back in, or
the notices regressing.

Measured on the archive: 307 packages / 131.39 MiB of `node_modules` before,
240 / 122.98 MiB after — 67 packages and 8.41 MiB out, none added.

Generated-by: Claude Code

Author: Joob1n

apps/desktop/electron-builder.config.mjs

@@ -6,6 +6,15 @@ export default {
   directories: {
     output: 'release',
   },
+  // `files` names what to include; the production dependency closure of
+  // `package.json` comes along automatically. Renderer-only packages are kept
+  // out of that closure by living in `devDependencies` — vite bundles them into
+  // `dist-renderer`, so a second copy of their sources in `app.asar` is never
+  // loaded. A hand-written exclude list was tried first and could not hold: it
+  // has to name every transitive package too, and it silently went stale.
+  //
+  // `@xterm/headless` stays a dependency on purpose — `@maka/runtime` imports
+  // it for the PTY stack, so only the renderer-side xterm packages moved.
   files: ['dist/**/*', 'dist-renderer/**/*', 'package.json', '!**/__tests__/**'],
   extraResources: [
     {

apps/desktop/package.json

@@ -41,44 +41,57 @@
     "smoke:browser": "npm run build:workspace-deps && npm run build:main && electron scripts/browser-observe-act-smoke.mjs"
   },
   "dependencies": {
-    "@astryxdesign/core": "0.4.0",
-    "@astryxdesign/theme-neutral": "0.4.0",
-    "@dnd-kit/core": "^6.3.1",
-    "@dnd-kit/sortable": "^10.0.0",
     "@jackwener/opencli": "1.8.6",
     "@maka/computer-use": "0.1.0",
     "@maka/core": "0.1.0",
     "@maka/mcp": "0.1.0",
     "@maka/runtime": "0.1.0",
     "@maka/runtime-host": "0.1.0",
     "@maka/storage": "0.1.0",
-    "@maka/ui": "0.1.0",
-    "@xterm/addon-fit": "^0.11.0",
-    "@xterm/xterm": "^6.0.0",
     "electron-updater": "^6.8.9",
     "node-pty": "^1.2.0-beta.15",
     "qrcode": "^1.5.4",
-    "react": "^19.2.1",
-    "react-dom": "^19.2.1",
     "ws": "^8.21.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@ant-design/icons-svg": "4.5.0",
+    "@astryxdesign/core": "0.4.0",
+    "@astryxdesign/theme-neutral": "0.4.0",
+    "@dnd-kit/core": "^6.3.1",
+    "@dnd-kit/sortable": "^10.0.0",
     "@fontsource-variable/geist": "^5.3.0",
     "@fontsource-variable/geist-mono": "^5.3.0",
+    "@maka/ui": "0.1.0",
     "@playwright/test": "^1.62.1",
     "@storybook/react-vite": "^10.5.5",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.4",
     "@types/ws": "^8.18.1",
     "@vitejs/plugin-react": "^6.0.5",
+    "@xterm/addon-fit": "^0.11.0",
+    "@xterm/xterm": "^6.0.0",
     "electron": "43.2.0",
     "electron-builder": "26.15.3",
     "esbuild": "^0.27.7",
     "linkedom": "^0.18.13",
+    "react": "^19.2.1",
+    "react-dom": "^19.2.1",
     "simple-icons": "16.28.0",
     "storybook": "^10.4.6",
     "vite": "^8.1.5"
+  },
+  "maka": {
+    "rendererBundledDependencies": [
+      "@astryxdesign/core",
+      "@astryxdesign/theme-neutral",
+      "@dnd-kit/core",
+      "@dnd-kit/sortable",
+      "@maka/ui",
+      "@xterm/addon-fit",
+      "@xterm/xterm",
+      "react",
+      "react-dom"
+    ]
   }
 }

apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt

@@ -3466,6 +3466,66 @@ MIT License
 
 ================================================================================
 
+Package: @types/react@19.2.18
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/react
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
+Package: @types/react-dom@19.2.4
+Declared license: MIT
+Selected license: MIT
+Repository: https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/react-dom
+
+--- LICENSE ---
+MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE
+
+================================================================================
+
 Package: @types/retry@0.12.0
 Declared license: MIT
 Selected license: MIT

package-lock.json

@@ -19,6 +19,10 @@ const TARGETS = {
     underline: '====================================================',
     outputPath: join(repoRoot, 'apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt'),
     validateAssets: true,
+    // Only this target bundles a renderer, so only this one unions the vite
+    // module graph into its notices. The CLI ships its production closure and
+    // nothing else, and must not be asked for renderer roots it has none of.
+    manifestPath: join(repoRoot, 'apps/desktop/package.json'),
   },
   cli: {
     workspaceName: 'maka-agent',
@@ -164,11 +168,11 @@ function normalizeText(text) {
     .trim();
 }
 
-function collectWorkspaceClosure(workspaceName) {
+function npmWorkspaceTree(workspaceName, omitDev) {
   const tree = JSON.parse(
     execFileSync(
       'npm',
-      ['ls', '--workspace', workspaceName, '--omit=dev', '--all', '--json'],
+      ['ls', '--workspace', workspaceName, ...(omitDev ? ['--omit=dev'] : []), '--all', '--json'],
       npmSpawnOptions({
         cwd: repoRoot,
         encoding: 'utf8',
@@ -178,21 +182,74 @@ function collectWorkspaceClosure(workspaceName) {
   );
   const workspace = tree.dependencies?.[workspaceName];
   if (!workspace) throw new Error(`npm ls did not return the ${workspaceName} workspace`);
+  return workspace;
+}
+
+function collectInto(packages, dependencies) {
+  for (const [name, dependency] of Object.entries(dependencies ?? {})) {
+    if (!dependency || typeof dependency !== 'object') continue;
+    if (!name.startsWith(WORKSPACE_PREFIX) && typeof dependency.version === 'string') {
+      packages.set(`${name}@${dependency.version}`, { name, version: dependency.version });
+    }
+    collectInto(packages, dependency.dependencies);
+  }
+}
+
+/**
+ * Packages the desktop workspace declares as bundled into the renderer.
+ *
+ * They live in `devDependencies` so electron-builder keeps a second, unread
+ * copy of their sources out of `app.asar` — but vite bundles them into
+ * `dist-renderer`, which the archive does carry. So they ship, and their
+ * notices have to ship with them. Reading the list from the manifest keeps this
+ * generator and `packaged-dependency-closure` from drifting apart.
+ */
+function rendererBundledRoots() {
+  if (!target.manifestPath) return [];
+  const declared = readJson(target.manifestPath)?.maka?.rendererBundledDependencies;
+  if (!Array.isArray(declared) || declared.length === 0) {
+    throw new Error(
+      `${target.manifestPath}: maka.rendererBundledDependencies must list the renderer roots`,
+    );
+  }
+  return declared;
+}
 
+/**
+ * What the packaged application actually carries: the Node production closure
+ * that lands in `app.asar/node_modules`, plus everything reachable from the
+ * renderer roots, which lands inside the vite bundle. Generating from the
+ * production closure alone would drop notices for code that still ships.
+ */
+function collectWorkspaceClosure(workspaceName) {
   const packages = new Map();
-  const visit = (dependencies) => {
-    for (const [name, dependency] of Object.entries(dependencies ?? {})) {
-      if (!dependency || typeof dependency !== 'object') continue;
-      if (!name.startsWith(WORKSPACE_PREFIX) && typeof dependency.version === 'string') {
-        packages.set(`${name}@${dependency.version}`, {
-          name,
-          version: dependency.version,
-        });
-      }
-      visit(dependency.dependencies);
+  collectInto(packages, npmWorkspaceTree(workspaceName, true).dependencies);
+
+  const roots = new Set(rendererBundledRoots());
+  if (roots.size === 0) {
+    return [...packages.values()].sort(
+      (left, right) =>
+        left.name.localeCompare(right.name) || left.version.localeCompare(right.version),
+    );
+  }
+  const full = npmWorkspaceTree(workspaceName, false).dependencies ?? {};
+  for (const [name, dependency] of Object.entries(full)) {
+    if (!roots.has(name) || !dependency || typeof dependency !== 'object') continue;
+    if (!name.startsWith(WORKSPACE_PREFIX) && typeof dependency.version === 'string') {
+      packages.set(`${name}@${dependency.version}`, { name, version: dependency.version });
     }
-  };
-  visit(workspace.dependencies);
+    collectInto(packages, dependency.dependencies);
+  }
+  // A workspace root (`@maka/ui`) carries no notice of its own — it is first
+  // party — but its dependencies do, so absence from `packages` is only a
+  // problem for a third-party root.
+  const missing = [...roots].filter(
+    (root) => !root.startsWith(WORKSPACE_PREFIX) && !Object.hasOwn(full, root),
+  );
+  if (missing.length > 0) {
+    throw new Error(`renderer roots absent from the dependency tree: ${missing.join(', ')}`);
+  }
+
   return [...packages.values()].sort(
     (left, right) =>
       left.name.localeCompare(right.name) || left.version.localeCompare(right.version),

scripts/generate-third-party-notices.mjs

@@ -14,6 +14,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { FILESYSTEM_WORKER_PROTOCOL_VERSION } from '../packages/runtime/dist/filesystem-worker/protocol.js';
 import {
   assertMissing,
+  assertPackagedDependencyClosure,
   assertPackagedResources,
   isolatedUserEnv,
   makePtyProbe,
@@ -125,6 +126,7 @@ export async function verifyPackagedMacApp(
 
   await requirePath(executable);
   await assertPackagedResources(resources, { requirePath, forbidPath });
+  await assertPackagedDependencyClosure(resources);
   await requirePath(join(resources, 'git', 'bin', 'git'));
 
   const executableArchitectures = await run('lipo', ['-archs', executable]);