hmmhmmhm · hmmhmmhm · Oct 18, 2025 · Oct 18, 2025 · Oct 18, 2025 · Oct 18, 2025
diff --git a/apps/browser/package.json b/apps/browser/package.json
@@ -12,9 +12,11 @@
     "build:webview:watch": "tsc --project tsconfig.webview.json --watch",
     "build:main:watch": "tsc --watch",
     "build:renderer": "vite build",
-    "start": "cross-env NODE_ENV=development electron .",
-    "start:electron": "cross-env NODE_ENV=production electron .",
+    "start": "cross-env NODE_ENV=development ./node_modules/.bin/electron .",
+    "start:electron": "cross-env NODE_ENV=production ./node_modules/.bin/electron .",
     "package": "npm run build && electron-builder",
+    "evs:setup": "bash scripts/setup-evs.sh",
+    "evs:verify": "node scripts/evs-sign.js --verify",
     "check-types": "tsc --noEmit",
     "audit": "npm audit",
     "audit:fix": "npm audit fix",
@@ -35,27 +37,42 @@
     "@vitejs/plugin-react": "^5.0.4",
     "concurrently": "^8.2.2",
     "cross-env": "^10.1.0",
-    "electron": "^38.3.0",
-    "electron-builder": "^24.9.1",
+    "electron": "github:castlabs/electron-releases#v38.0.0+wvcus",
+    "electron-builder": "^26.0.12",
     "tailwindcss": "^4.1.14",
     "typescript": "5.9.2",
     "vite": "^7.1.10"
   },
   "build": {
     "appId": "com.aka-browser.app",
     "productName": "aka-browser",
+    "electronDist": "node_modules/electron/dist",
+    "electronVersion": "38.0.0",
+    "npmRebuild": false,
+    "asar": true,
+    "asarUnpack": [
+      "**/*.node",
+      "**/WidevineCdm/**/*"
+    ],
     "directories": {
       "output": "release"
     },
     "files": [
       "dist/**/*",
       "dist-renderer/**/*",
-      "assets/**/*"
+      "assets/**/*",
+      "!node_modules/**/*"
     ],
+    "afterPack": "scripts/evs-sign.js",
     "mac": {
       "target": "dmg",
       "category": "public.app-category.developer-tools",
-      "icon": "assets/icon.icns"
+      "icon": "assets/icon.icns",
+      "hardenedRuntime": true,
+      "gatekeeperAssess": false,
+      "entitlements": "build/entitlements.mac.plist",
+      "entitlementsInherit": "build/entitlements.mac.plist",
+      "identity": null
     },
     "win": {
       "target": "nsis",

diff --git a/apps/browser/scripts/before-sign.js b/apps/browser/scripts/before-sign.js
@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+
+/**
+ * EVS VMP signing before Apple codesign
+ * This runs BEFORE electron-builder's codesign
+ */
+
+const { execSync } = require('child_process');
+const path = require('path');
+const os = require('os');
+const fs = require('fs');
+
+/**
+ * Verify EVS environment
+ */
+function verifyEnvironment() {
+  const configPath = path.join(os.homedir(), '.config', 'evs', 'config.json');
+
+  if (!fs.existsSync(configPath)) {
+    console.error('[EVS] ✗ EVS account not configured');
+    return false;
+  }
+
+  try {
+    const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    const accountName = config.account_name || (config.Auth && config.Auth.AccountName) || (config.Account && config.Account.AccountName);
+    if (accountName) {
+      console.log('[EVS] ✓ EVS account configured:', accountName);
+      return true;
+    }
+  } catch (error) {
+    console.error('[EVS] ✗ Failed to read EVS config:', error.message);
+    return false;
+  }
+
+  return false;
+}
+
+/**
+ * Sign with EVS VMP
+ */
+function signWithEVS(appPath) {
+  console.log('[EVS] Signing with VMP before Apple codesign...');
+  console.log('[EVS] App path:', appPath);
+
+  const command = `python3 -m castlabs_evs.vmp sign-pkg "${appPath}"`;
+
+  try {
+    execSync(command, {
+      encoding: 'utf8',
+      stdio: 'inherit'
+    });
+
+    console.log('[EVS] ✓ VMP signing completed successfully\n');
+    return true;
+  } catch (error) {
+    console.error('[EVS] ✗ VMP signing failed:', error.message);
+    return false;
+  }
+}
+
+/**
+ * beforeSign hook for electron-builder
+ */
+exports.default = async function(context) {
+  const { electronPlatformName, appOutDir } = context;
+
+  console.log('\n[EVS] beforeSign hook triggered');
+  console.log('[EVS] Platform:', electronPlatformName);
+  console.log('[EVS] App directory:', appOutDir);
+
+  // Only sign macOS and Windows builds
+  if (electronPlatformName !== 'darwin' && electronPlatformName !== 'win32') {
+    console.log('[EVS] Skipping VMP signing for', electronPlatformName);
+    return;
+  }
+
+  // Verify environment
+  if (!verifyEnvironment()) {
+    console.warn('[EVS] ⚠ EVS not configured, skipping VMP signing');
+    return;
+  }
+
+  // Determine app path
+  let appPath;
+  if (electronPlatformName === 'darwin') {
+    // Find .app bundle
+    const files = fs.readdirSync(appOutDir);
+    const appFile = files.find(f => f.endsWith('.app'));
+    if (!appFile) {
+      console.error('[EVS] ✗ Could not find .app bundle');
+      return;
+    }
+    appPath = path.join(appOutDir, appFile);
+  } else {
+    appPath = appOutDir;
+  }
+
+  // Sign with EVS
+  const success = signWithEVS(appPath);
+
+  if (!success) {
+    console.warn('[EVS] ⚠ VMP signing failed, but continuing with Apple codesign...');
+  }
+};
diff --git a/apps/browser/scripts/download-widevine.js b/apps/browser/scripts/download-widevine.js
@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+
+/**
+ * Download Widevine CDM for castlabs electron-releases
+ * 
+ * castlabs electron-releases does NOT include Widevine CDM by default.
+ * This script manually downloads the Widevine CDM component.
+ */
+
+const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const https = require('https');
+
+console.log('[Widevine] Starting Widevine CDM download...\n');
+
+// Get Electron version
+const packageJson = require('../package.json');
+const electronVersion = packageJson.devDependencies.electron.match(/v?(\d+\.\d+\.\d+)/)[1];
+
+console.log(`[Widevine] Electron version: ${electronVersion}`);
+console.log(`[Widevine] Platform: ${process.platform}`);
+console.log(`[Widevine] Arch: ${process.arch}\n`);
+
+// Widevine CDM download URLs (from Chrome)
+const WIDEVINE_VERSIONS = {
+  '38.0.0': '4.10.2710.0',
+  '37.0.0': '4.10.2710.0',
+  '36.0.0': '4.10.2710.0'
+};
+
+const widevineVersion = WIDEVINE_VERSIONS[electronVersion.split('.').slice(0, 2).join('.')] || '4.10.2710.0';
+
+console.log(`[Widevine] Widevine CDM version: ${widevineVersion}\n`);
+
+console.log('⚠️  IMPORTANT NOTICE:');
+console.log('================================================================================');
+console.log('Widevine CDM is proprietary software owned by Google.');
+console.log('');
+console.log('castlabs electron-releases does NOT include Widevine CDM.');
+console.log('The CDM must be downloaded separately from Chrome or obtained through');
+console.log('official channels.');
+console.log('');
+console.log('For production use, you should:');
+console.log('1. Run the app in development mode first to trigger automatic download');
+console.log('2. Or obtain Widevine CDM through official Google licensing');
+console.log('================================================================================\n');
+
+console.log('[Widevine] Recommended approach:');
+console.log('');
+console.log('  1. Run the app in development mode:');
+console.log('     $ pnpm run dev');
+console.log('');
+console.log('  2. Widevine CDM will be automatically downloaded to:');
+console.log('     ~/Library/Application Support/Electron/WidevineCdm/ (macOS)');
+console.log('     %LOCALAPPDATA%\\Electron\\WidevineCdm\\ (Windows)');
+console.log('     ~/.config/Electron/WidevineCdm/ (Linux)');
+console.log('');
+console.log('  3. Then build the production app:');
+console.log('     $ pnpm run package');
+console.log('');
+
+process.exit(0);