fix(desktop): bundle runtime packages for Windows

[NubsCarson]

Summary

• bundle runtime support packages required by the embedded desktop agent (plugin-worker-runtime, plugin-remote-manifest, and desktop plugin-agent-orchestrator)
• copy Electrobun remotes/ into direct embedded desktop packages so first-party remotes have their plugin.json
• keep runtime payload files that are loaded dynamically, including bundled skill markdown, and add package entrypoint assertions so unsafe bundles fail during packaging
• avoid Windows tar-unsafe nested Octokit paths by using the top-level peer supplied by the bundled orchestrator graph

Verification

• node packages/scripts/run-vitest.mjs run --config packages/agent/vitest.config.ts packages/agent/src/runtime/release-plugin-policy.test.ts
• node packages/scripts/run-vitest.mjs run --config packages/app-core/vitest.config.ts packages/app-core/scripts/assert-required-bundled-packages.test.ts packages/app-core/platforms/electrobun/src/electrobun-config.test.ts
• Windows local-source package build from Milady wrapper completed successfully with MILADY_ELIZA_SOURCE=local
• Packaged runtime contained required files:
  • eliza-dist/node_modules/@elizaos/plugin-agent-orchestrator/dist/index.js
  • eliza-dist/node_modules/@elizaos/plugin-worker-runtime/dist/bootstrap.js
  • eliza-dist/node_modules/@elizaos/plugin-remote-manifest/dist/index.js
  • eliza-dist/node_modules/@elizaos/skills/skills/task-agent-eliza-bridge/SKILL.md
  • remotes/runtime/plugin.json
• Packaged Windows app launched, /api/health reported ready: true and plugins.failed: 0
• First-run onboarding smoke passed in packaged CEF: skip voice setup -> local setup -> /chat
• Main UI smoke passed: Views, Character, Browser, Automations, Chat tabs rendered; chat returned Echo: hello from final latest package

Greptile Summary

This PR fixes the Windows desktop build by ensuring plugin-worker-runtime, plugin-remote-manifest, and plugin-agent-orchestrator are built and bundled into the packaged runtime, and copies Electrobun remotes/ so first-party remote plugins carry their plugin.json.

• Policy split: BASELINE_BUNDLED_RUNTIME_PACKAGES now includes the new runtime-support packages for filesystem bundling, but a separate BASELINE_REGISTRY_BUNDLED_PLUGIN_PACKAGES list keeps them out of the registry "bundled" classification; classifyRegistryPluginRelease is tightened to require both a static whitelist check and a runtime-availability check before marking a plugin as bundled.
• Asset preservation: shouldPreservePrunedPackageEntry gains explicit rules to retain skill markdown files, googleapis docs API files, three.js JSM/fonts examples, and @elizaos/ui component docs that are loaded dynamically at runtime.
• Windows tar-safety fix: @octokit/rest is skipped when bundling git-workspace-service's transitive deps, relying on the top-level peer supplied by plugin-agent-orchestrator to avoid deeply-nested Windows-unsafe paths.

Confidence Score: 5/5

Safe to merge — all changes are build-tooling and policy metadata with no modifications to runtime logic or data paths.

All changes are confined to the desktop packaging pipeline and release-policy classification. The new preservation rules and entrypoint assertions are well-covered by the added tests, the Windows tar-path fix is correctly scoped to the one package that triggers the problem, and the policy split between bundled-for-filesystem and bundled-for-registry correctly prevents runtime-support packages from being surfaced as user-installable plugins.

No files require special attention.

Important Files Changed

Filename	Overview
packages/agent/src/runtime/release-plugin-policy.ts	Splits BASELINE_BUNDLED_RUNTIME_PACKAGES from BASELINE_REGISTRY_BUNDLED_PLUGIN_PACKAGES so runtime-support packages (plugin-remote-manifest, plugin-worker-runtime) ship in the bundle but are excluded from "bundled" registry classification; classifyRegistryPluginRelease now requires both static and dynamic checks.
packages/app-core/scripts/copy-runtime-node-modules.ts	Adds shouldPreservePrunedPackageEntry rules for skill markdown, googleapis docs, three.js jsm/fonts examples, and @elizaos/ui docs; adds @octokit/rest skip for git-workspace-service to fix Windows tar-unsafe nested paths; adds commander to ALWAYS_HOISTED_PACKAGES; extends assertRequiredBundledPackagesLanded to also verify declared runtime entrypoints.
packages/app-core/platforms/electrobun/electrobun.config.ts	Copies the electrobunDir's remotes/ directory into the packaged app for direct desktop builds so first-party remote plugins have their plugin.json; correctly skipped for Store and external-API builds.
packages/app-core/scripts/desktop-build.mjs	Adds build steps for plugin-agent-orchestrator and plugin-worker-runtime before packaging; uses a new resolveWorkspacePluginDir helper that searches plugins/ before eliza/plugins/, falling back with a clear fail() error if the package.json is missing.
packages/app-core/vitest.config.ts	Adds Vite resolve aliases for @elizaos/plugin-remote-manifest and @elizaos/plugin-worker-runtime source directories to enable test-time type resolution without a build step.
packages/core/src/tests/service-type-collisions.test.ts	Adds two new allowlist entries for capability-router (mid-migration, three co-existing services) and xr-session (alternative providers) service type duplicates.
packages/app-core/scripts/assert-required-bundled-packages.test.ts	Extensive new test coverage for entrypoint existence checks, skill markdown preservation, dynamic asset preservation for googleapis/three/ui, Solana hoisting, Octokit skip, and getRuntimeDependencies lucide-react retention.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[desktop-build.mjs] --> B[Build core + shared + vault]
    A --> C[Build plugin-remote-manifest]
    A --> D[Build plugin-agent-orchestrator NEW]
    A --> E[Build plugin-worker-runtime NEW]
    A --> F[Build app-core]

    G[copy-runtime-node-modules] --> H{shouldSkipPackagedDependency?}
    H -->|git-workspace-service and octokit-rest| I[Skip - use root peer]
    H -->|other deps| J[selectCopyTargetNodeModules]
    J -->|solana or ALWAYS_HOISTED| K[Root node_modules]
    J -->|version matches top-level| K
    J -->|version mismatch| L[Nested node_modules]

    M[pruneCopiedPackageDir] --> N{shouldPreservePrunedPackageEntry?}
    N -->|skills markdown| O[Keep SKILL.md]
    N -->|googleapis docs api| P[Keep docs API files]
    N -->|three jsm and fonts| Q[Keep runtime loaders]
    N -->|elizaos-ui component docs| R[Keep component docs]
    N -->|other pruned entries| S[Delete]

    T[assertRequiredBundledPackagesLanded] --> U{package.json exists?}
    U -->|No| V[FAIL missing package]
    U -->|Yes baseline package| W{entrypoints exist?}
    W -->|No| X[FAIL missing runtime entry]
    W -->|Yes| Y[PASS]

Loading

_{Reviews (4): Last reviewed commit: "fix(test): allowlist known service type ..." | Re-trigger Greptile}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 83892e83-c91b-4ab7-b47a-06c949806d9c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/windows-desktop-runtime-packaging

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[lalalune]

Landed on develop via rebase: commits 55b8fe1 (fix(desktop): bundle runtime packages for Windows), c361674 (fix(test): align app-core server expectations), and 7bddb5d (style: biome auto-fix lint nits in PR #7878 merge).

Validation:

• assertRequiredBundledPackagesLanded test suite: 17 passed
• release-plugin-policy test: 1 passed
• biome check on touched files: clean (after auto-fix of useLiteralKeys, noPrototypeBuiltins, organizeImports)
• typecheck on packages/agent and packages/app-core: 0 errors in PR's own files (88 pre-existing failures in unbuilt local plugin modules, unrelated)

Thanks @NubsCarson.