fix(desktop): build real sidecars in desktop-release-build (0-byte bundle bug)

[mfethe1]

Problem

/Applications/Buzz.app/Contents/MacOS/ ships all six sidecars at 0 bytes (only buzz-desktop is real). Every in-app buzz invocation therefore succeeds with exit 0 and empty output — a silent no-op that is very hard to attribute, since nothing errors.

Root cause

desktop-release-build depended only on _ensure-sidecar-stubs, which touches 0-byte placeholders so Tauri's compile-time externalBin validation passes (needed by the clippy/check/test recipes). It then ran pnpm tauri build directly and never ran cargo build --release or scripts/bundle-sidecars.sh. Tauri happily bundled the stubs.

desktop-demo-build did it correctly — the release path simply never got the same treatment.

Fix

Extract the build+bundle into a shared _build-sidecars recipe and call it from both release and demo paths, rather than adding a third copy of the logic. desktop-demo-build had its own inline copy; the justfile already warns that duplicated sidecar logic drifts apart, so this consolidates instead of duplicating. Net -1 line, one definition.

_ensure-sidecar-stubs is intentionally left cheap and unchanged — the stubs exist only for the compile-time check used by non-bundling recipes.

Verification

Behaviour (the real gate for this change):

cargo build --release --target aarch64-apple-darwin -p buzz-acp -p buzz-agent \
  -p buzz-backend-kubernetes -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
./scripts/bundle-sidecars.sh aarch64-apple-darwin

Finished release profile in 3m 24s → Sidecars bundled for aarch64-apple-darwin. desktop/src-tauri/binaries/ went from six 0-byte files to six non-zero arm64 Mach-O executables:

sidecar	bytes
buzz	14,821,712
buzz-acp	16,992,240
buzz-agent	10,900,064
buzz-backend-kubernetes	10,130,848
buzz-dev-mcp	20,992,048
git-credential-nostr	1,288,400

Each was then executed to confirm it is functional, not merely non-empty — all six produce real argument parsing / config validation / MCP handshake output (file -b → arm64 for each), versus the stubs' empty exit 0.

Recipe semantics: just --evaluate parses clean; just --dry-run desktop-release-build shows the dependency order _ensure-sidecar-stubs → _build-sidecars (cargo build → bundle-sidecars.sh) → pnpm install → pnpm tauri build; just --dry-run desktop-demo-build acme resolves _build-sidecars via {{just_executable()}} (absolute path, so it does not depend on just being on PATH inside the recipe).

JS gate: pnpm run check from desktop/ → RC=0 (4 warnings, all pre-existing CSS/lint items untouched by this change). Noting for reviewers that this gate covers desktop JS only and cannot validate justfile semantics — hence the build-level verification above.

Scope

Build tooling only; no runtime code. Follows Path B (branch + PR) rather than direct-to-main because build/CI config is a sensitive path under AGENTS.md.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 9ec27507-465f-4dc4-a5b5-c14536fba726

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mfethe1]

🧪 Jev PR-Triage (v3)

PR #68: fix(desktop): build real sidecars in desktop-release-build (0-byte bundle bug) — verdict: REVIEW

dimension	metric	value
Correctness	problem resolved	P(yes)=0.90
Correctness	rework needed	0.13/2
Quality	code quality	1.88/2
Quality	test coverage	P(yes)=0.48
Architecture	integration compatibility	1.96/2
Architecture	future proof	1.16/2
Governance	sensitive path	P(yes)=0.20
Governance	size concern	P(yes)=0.06
Synthesis	merge risk	0.87/2
Synthesis	route	needs_review (0.87)
Diff	security exposure	P(yes)=0.06
Diff	performance impact	0.01/2

🔍 Reviewer focus

• File: Justfile
• Concern: correctness_edge_cases

Block reason (if any): none
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.