Bundle fd and ripgrep in managed desktop runtime

[amekawaii]

Summary

• bundle pinned, SHA-256-verified fd and ripgrep assets for Windows x64/arm64 and macOS x64/arm64
• expose the shared package-level tool directory through OPENALICE_MANAGED_TOOLCHAIN_PATH in packaged Electron and pnpm dev
• assert both binaries are present in desktop packages and execute them in packaged toolchain smoke
• prove Pi resolves both commands from the managed PATH with an empty agent directory, so it never enters its runtime download path
• retry build-time asset downloads while retaining checksum verification

Root cause

Pi 0.80.6 unconditionally checks fd and rg during interactive startup. OpenAlice redirects PI_CODING_AGENT_DIR into each Workspace, which also makes Pi's binary cache per-Workspace. A fresh Workspace therefore attempted anonymous GitHub API and Release downloads. Shared proxy rate limits and slow/reset release downloads caused repeated fd not found. Downloading... failures.

This moves the downloads to the reproducible release build and stores one shared copy in the application runtime.

Pinned assets

Platform	fd	ripgrep
Windows x64/arm64	10.4.2	15.1.0
macOS arm64	10.4.2	15.1.0
macOS x64	10.3.0	15.1.0

Intel macOS stays on fd 10.3.0 because fd 10.4.x no longer publishes an x86_64 Apple asset.

Windows validation

• pnpm test: 2497 passed, 9 skipped
• pnpm exec tsc --noEmit
• fresh unpacked Windows package built with native rebuild skipped on this machine
• desktop package assertion passed
• packaged Electron Node 22.22.1 launched managed Pi 0.80.6
• packaged fd 10.4.2 and ripgrep 15.1.0 executed successfully
• Pi's own getToolPath resolved fd rg from the package PATH with a missing/empty agent directory
• existing managed Git Bash, Workspace CLI launcher, and named-pipe transport smoke remained green

macOS handoff

Run the same flow on both available architectures:

pnpm vendor:runtime
pnpm electron:pack
pnpm electron:assert-package
pnpm electron:smoke-toolchain

Please specifically verify executable permissions plus code signing/notarization of the bundled Mach-O binaries. The package assertions and smoke plan are already shared across Windows and macOS.

Closes #498

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openalice-demo	Ready	Preview, Comment	Jul 11, 2026 9:16am

[amekawaii]

CI handoff: both macOS package jobs (ARM and Intel) passed. The Windows package job failed before vendor/package steps in the pre-existing Guardian takeover smoke: PTY + CLI socket reached OK, then temp Workspace cleanup hit EBUSY. Local fresh Windows package assertion and packaged toolchain smoke are green. This collaborator account cannot rerun Actions jobs, so please rerun the failed Windows package job from a maintainer account.