v0.2.3: run AppImage runtime patch after electron-builder, not in hook (#11)

v0.2.2's Linux build showed that electron-builder's `afterAllArtifactBuild`
hook fires BEFORE `latest-linux.yml` gets written — so our hook patched
the AppImage bytes but never found the YAML to update, leaving the sha512
in the manifest pointing at the original (pre-patch) file. electron-updater
would have rejected the download on signature mismatch.

Fix: demote the hook to a standalone CLI script and run it from the
`dist:linux` npm script AFTER `electron-builder` has finished producing
everything it writes (AppImage + latest-linux.yml both present on disk).

  "dist:linux": "electron-vite build && electron-builder --linux && node scripts/patch-appimage-runtime.mjs artifacts"

Script logic is identical — download static runtime once, splice it over
the original runtime prefix of each .AppImage in the given dir, recompute
sha512/size, rewrite matching entries in latest-linux.yml. Just runs at
the right time now.

Removed `afterAllArtifactBuild` from electron-builder.yml since the
script is no longer wired there.

Version bump to 0.2.3.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: beautyfree

electron-builder.yml

@@ -26,12 +26,6 @@ extraResources:
 asarUnpack:
   - "**/*.node"
 
-# After every platform finishes, run post-processing. Currently: swap the
-# stock AppImage runtime for the static one from AppImage/type2-runtime so
-# the AppImage works on distros without libfuse2 (CachyOS and other Arch
-# spin-offs). Also recomputes sha512/size in latest-linux.yml.
-afterAllArtifactBuild: scripts/patch-appimage-runtime.mjs
-
 # Notarization: electron-builder 26+ handles it natively when the expected env
 # vars are present (APPLE_API_KEY, APPLE_API_KEY_ID, APPLE_API_ISSUER for the
 # API-key flow; APPLE_ID + APPLE_APP_SPECIFIC_PASSWORD + APPLE_TEAM_ID as

package.json

@@ -1,6 +1,6 @@
 {
   "name": "skiller",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "A desktop app for managing AI agent skills across Claude Code, Cursor, Copilot, Gemini CLI, and more",
   "license": "MIT",
   "author": {
@@ -21,7 +21,7 @@
     "typecheck": "tsc --noEmit && tsc -p tsconfig.node.json --noEmit",
     "dist:mac": "electron-vite build && electron-builder --mac && bash scripts/repack-dmg.sh",
     "dist:win": "electron-vite build && electron-builder --win",
-    "dist:linux": "electron-vite build && electron-builder --linux"
+    "dist:linux": "electron-vite build && electron-builder --linux && node scripts/patch-appimage-runtime.mjs artifacts"
   },
   "dependencies": {
     "@base-ui/react": "^1.3.0",

scripts/patch-appimage-runtime.mjs

@@ -1,24 +1,29 @@
+#!/usr/bin/env node
 /**
- * electron-builder `afterAllArtifactBuild` hook.
+ * Standalone CLI — patches every `*.AppImage` in the given directory to use
+ * the static runtime from AppImage/type2-runtime, then rewrites matching
+ * entries in `latest-linux.yml` so electron-updater's sha512 check still
+ * passes.
  *
- * Swaps the ELF runtime at the head of every produced AppImage with the
- * static runtime from https://github.com/AppImage/type2-runtime. That runtime
- * ships with squashfuse compiled in, so the resulting AppImage launches on
- * systems that have libfuse2, libfuse3, or no FUSE at all — which matters
- * most for Arch-based distros (CachyOS, Manjaro, EndeavourOS) where libfuse2
- * is not preinstalled.
+ * Usage:
+ *   node scripts/patch-appimage-runtime.mjs <artifacts-dir>
  *
- * AppImage layout (type 2):
- *   [ ELF runtime (~180 KB) | squashfs FS image ('hsqs' magic) ]
+ * Designed to run AFTER `electron-builder --linux` has finished producing
+ * both the AppImage and the update manifest (electron-builder's own
+ * `afterAllArtifactBuild` hook fires before the manifest is written, so we
+ * invoke this at the `dist:linux` npm-script level instead).
  *
- * We locate the squashfs magic, drop everything before it, prepend the new
- * runtime. Then we recompute sha512 + size and patch `latest-linux.yml` so
- * electron-updater's signature check keeps passing.
+ * Why we patch: the stock AppImage runtime electron-builder ships dynamically
+ * links against libfuse.so.2. Arch-based distros (CachyOS, Manjaro,
+ * EndeavourOS) ship fuse3 by default, so double-clicking a stock AppImage
+ * there fails with "dlopen failed for libfuse.so.2". The static runtime
+ * bundles squashfuse, falls back to extract-and-run where kernel FUSE is
+ * unavailable, and works on every distro.
  */
 import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
+import { chmod, mkdir, readdir, readFile, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
 import YAML from "yaml";
 
 const STATIC_RUNTIME_URL =
@@ -30,9 +35,7 @@ const RUNTIME_CACHE_PATH = join(RUNTIME_CACHE_DIR, "appimage-runtime-x86_64");
 const SQUASHFS_MAGIC = Buffer.from([0x68, 0x73, 0x71, 0x73]);
 
 async function downloadStaticRuntime() {
-	if (existsSync(RUNTIME_CACHE_PATH)) {
-		return RUNTIME_CACHE_PATH;
-	}
+	if (existsSync(RUNTIME_CACHE_PATH)) return RUNTIME_CACHE_PATH;
 	await mkdir(RUNTIME_CACHE_DIR, { recursive: true });
 	console.log(
 		`[patch-appimage] downloading static runtime from ${STATIC_RUNTIME_URL}`,
@@ -75,7 +78,7 @@ async function patchAppImage(appImagePath) {
 async function updateLatestLinuxYaml(ymlPath, appImageName, patched) {
 	if (!existsSync(ymlPath)) {
 		console.log(
-			`[patch-appimage] ${basename(ymlPath)} not found — skipping manifest update`,
+			`[patch-appimage] ${basename(ymlPath)} not found — skipping manifest update (auto-update will not work on Linux)`,
 		);
 		return;
 	}
@@ -109,20 +112,31 @@ async function updateLatestLinuxYaml(ymlPath, appImageName, patched) {
 	}
 }
 
-export default async function afterAllArtifactBuild(buildResult) {
-	const appImages = (buildResult?.artifactPaths ?? []).filter((p) =>
-		p.endsWith(".AppImage"),
-	);
+async function main() {
+	const dir = resolve(process.argv[2] ?? "artifacts");
+	if (!existsSync(dir)) {
+		console.log(
+			`[patch-appimage] directory ${dir} does not exist — nothing to do`,
+		);
+		return;
+	}
+	const entries = await readdir(dir);
+	const appImages = entries
+		.filter((e) => e.endsWith(".AppImage"))
+		.map((e) => join(dir, e));
 	if (appImages.length === 0) {
-		return [];
+		console.log(`[patch-appimage] no .AppImage files in ${dir}`);
+		return;
 	}
 
 	for (const appImagePath of appImages) {
 		const patched = await patchAppImage(appImagePath);
 		const ymlPath = join(dirname(appImagePath), "latest-linux.yml");
 		await updateLatestLinuxYaml(ymlPath, basename(appImagePath), patched);
 	}
-
-	// Don't advertise additional artifacts — we mutated existing ones in place.
-	return [];
 }
+
+void main().catch((err) => {
+	console.error("[patch-appimage] FAILED:", err);
+	process.exit(1);
+});