EvanAgent/dsh-desktop/app/tools/package.sh

#!/bin/bash
# Build ../dist/DoTouchAI.app + a drag-install DMG from the local electron
# dist + app sources. (Manual bundle construction: deterministic, no network,
# no @electron/get.)
set -euo pipefail
cd "$(dirname "$0")/.."

SRC="node_modules/electron/dist/Electron.app"
OUT="../dist"
APP="$OUT/DoTouchAI.app"
PLIST="$APP/Contents/Info.plist"
VERSION="$(node -p "require('./package.json').version")"
DMG="$OUT/DoTouchAI-${VERSION}-arm64.dmg"

rm -rf "$APP"
mkdir -p "$OUT" "$APP/Contents/Resources/app/assets"

cp -R "$SRC/." "$APP/"
rm -rf "$APP/Contents/Resources/default_app.asar"

# App sources — this shell has zero runtime npm deps, so node_modules stays out.
cp main.js env.js service.js updater.js plugins.js package.json "$APP/Contents/Resources/app/"
cp assets/trayTemplate.png assets/trayTemplate@2x.png assets/icon.icns \
	"$APP/Contents/Resources/app/assets/"

# Build metadata (shown in the About dialog so installs are distinguishable).
node -e "require('fs').writeFileSync('$APP/Contents/Resources/app/build.json', JSON.stringify({version:'$VERSION', builtAt:new Date().toLocaleString('zh-CN',{hour12:false})}, null, 2) + '\n')"

# Bundled dsh plugins (voice suite) — copied from DSWorkSpace, deps hoisted
# flat next to the plugins (same layout the profile already uses), and
# auto-installed into the web profile on first launch (see app/plugins.js).
# Dep sources come from the live profile root (the real files — the
# DSWorkSpace copies are pnpm symlinks).
VOICE_SRC="/Users/eastudio/Documents/DSWorkSpace"
DEP_SRC="$HOME/.dsh/profiles/web/node_modules"
BUNDLED="$APP/Contents/Resources/app/plugins"
mkdir -p "$BUNDLED"
rm -rf "$BUNDLED"/*
cp -R "$VOICE_SRC/dsh-voice-client" "$BUNDLED/dsh-voice-client"
rm -rf "$BUNDLED/dsh-voice-client/node_modules"
cp -R "$VOICE_SRC/dsh-voice-server" "$BUNDLED/dsh-voice-server"
rm -rf "$BUNDLED/dsh-voice-server/node_modules"
for dep in sherpa-onnx-node sherpa-onnx-darwin-arm64 ws; do
	cp -R "$DEP_SRC/$dep" "$BUNDLED/$dep"
done
node -e "require('fs').writeFileSync('$BUNDLED/manifest.json', JSON.stringify({
  'dsh-voice-client': { id: 'dsh-voice-client', name: 'dsh-voice-client' },
  'dsh-voice-server': { id: 'dsh-voice-server', name: 'dsh-voice-server/lib/index-v6.js' },
  'sherpa-onnx-node': { dep: true },
  'sherpa-onnx-darwin-arm64': { dep: true },
  'ws': { dep: true }
}, null, 2) + '\n')"
echo "bundled plugins: $(du -sh "$BUNDLED" | cut -f1) — $(ls "$BUNDLED" | tr '\n' ' ')"

# Identity + icon.
cp assets/icon.icns "$APP/Contents/Resources/electron.icns"
plutil -replace CFBundleName -string "DoTouchAI" "$PLIST"
plutil -replace CFBundleDisplayName -string "DoTouchAI" "$PLIST"
plutil -replace CFBundleIdentifier -string "local.eastudio.dsh-desktop" "$PLIST"
plutil -replace CFBundleShortVersionString -string "$VERSION" "$PLIST"

# Ad-hoc signature with --deep: re-signs the top-level AND all nested
# frameworks/helpers consistently (the Electron dist ships a linker-signed
# framework whose seal is incomplete; --deep replaces it with a full ad-hoc
# signature so `codesign --verify --deep --strict` passes). No Apple ID needed;
# Gatekeeper still requires a one-time bypass on foreign Macs (see 安装说明.txt).
codesign --deep --force --sign - "$APP" >/dev/null 2>&1 || true
codesign --verify --deep --strict "$APP" 2>/dev/null || echo "warn: signature did not pass --deep --strict (app may be rejected by Gatekeeper on other Macs)"

echo "built: $APP ($(du -sh "$APP" | cut -f1))"

# Drag-install DMG: the app beside a symlink to /Applications, plus a
# first-run readme (Gatekeeper unblock + Node/dsh install steps for new Macs).
STAGING="../.dmg-staging"
rm -rf "$STAGING"
mkdir -p "$STAGING"
cp -R "$APP" "$STAGING/"
ln -sfn /Applications "$STAGING/Applications"
cat > "$STAGING/安装说明.txt" << 'EOF'
DoTouchAI 安装说明
====================

一、安装
  把 DoTouchAI 拖到右侧 Applications 文件夹。

二、首次打开（重要）
  本应用未经 Apple 开发者签名公证，拷到新 Mac 后首次打开会被拦截
  （提示"无法打开"或"已损坏"），属正常现象，任选其一解除：
  ▸ 方法 A：在应用程序文件夹里右键 DoTouchAI → 打开 → 再点"打开"（只需一次）
  ▸ 方法 B（推荐）：终端执行，清除全部标记
        xattr -cr "/Applications/DoTouchAI.app"
    注：macOS 14.4+/26 会同时打 com.apple.quarantine 和 com.apple.provenance
    两个标记，只去 quarantine 不够（"还是打不开"），必须 -cr 全清或分别去两个
  ▸ 方法 C：双击被拦后，系统设置 → 隐私与安全性 → 底部点"仍要打开"

三、新 Mac 需要先装 Node.js 与 dsh（一次性）
  1. 安装 Node.js LTS：https://nodejs.org（或 brew install node）
  2. 终端执行：
        npm config set prefix ~/.local
        npm install -g @deepseek-ai/dsh
        echo 'export PATH=$HOME/.local/bin:$PATH' >> ~/.zshrc
  3. 启动 DoTouchAI：若弹出"未检测到 dsh"引导，点"复制安装命令"照做即可；
     语音插件已内置，会自动安装，无需其他操作。

四、验证
  托盘菜单 → 关于 DoTouchAI：能看到 dsh 版本号即安装成功。
EOF
rm -f "$DMG"
hdiutil create -volname "DoTouchAI $VERSION" -srcfolder "$STAGING" -ov -format UDZO "$DMG" >/dev/null
rm -rf "$STAGING"
hdiutil verify "$DMG" >/dev/null && echo "built: $DMG ($(du -sh "$DMG" | cut -f1))"