perf(desktop): cut macOS signing calls by 81%

[t3dotgg]

Recent macOS releases spend 87 to 97 seconds on signing and notarization. Electron Builder signs files one at a time and packages dependencies that the Mac does not need.

Use batched macOS code signing, keep only server dependencies that remain outside the bundle, and remove Windows terminal binaries. Add detailed signing and notarization logs so the next signed release shows where Apple processing time goes.

Measured in a real unsigned macOS CI build with ad-hoc signatures:

• Codesign calls: 82 to 16, down 80.5%.
• Local signing time without Apple timestamps: 2.188 seconds to 1.119 seconds, down 48.9%.
• Packaged app archive: 215,977,916 bytes in the latest release to 181,878,491 bytes in the validation build, down 15.8%.
• Direct packaged dependencies: 19 to 12.
• Removed 2,371 unused syntax-highlighting files and six Windows native binaries.
• The packaged server starts successfully.

The non-publishing macOS validation run completed in 2 minutes 7 seconds without Apple credentials.

Linux and Windows packaging do not change.

Built with GPT-5.6 Sol in the Codex harness.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9fed1e69-c98d-41f5-ae52-d4ec9b019c79

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.4 KiB	+10 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	+9 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+15 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−6 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.6 KiB	+21 B (+0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.8 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: f035a0f · PR result: f3091df · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR changes macOS production packaging by removing platform-specific files, changing staged runtime dependencies, and routing signed builds through a custom batched signing hook. Because it affects signed artifact contents and release signing/notarization behavior rather than only build-time performance, the changes warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}