From 5d3cfcec2dc068754db52af8d00653cefadc80c6 Mon Sep 17 00:00:00 2001
From: ciregenz <ciregenz@berkeley.edu>
Date: Thu, 14 May 2026 01:42:31 -0700
Subject: [PATCH] [eric] Mac publish fixes: NODE_OPTIONS heap + rsync excludes
 for user-state and template_cache

---
 debugger/build/lib/swarm_debug.py | 21 +++++++++++++++++++++
 scripts/build-app.sh              | 17 +++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 debugger/build/lib/swarm_debug.py

diff --git a/debugger/build/lib/swarm_debug.py b/debugger/build/lib/swarm_debug.py
new file mode 100644
index 00000000..0d811605
--- /dev/null
+++ b/debugger/build/lib/swarm_debug.py
@@ -0,0 +1,21 @@
+"""Module alias — exposes the `debug()` function under the `swarm_debug`
+name so code that does `from swarm_debug import debug` resolves to the
+same OpenSwarm-bundled package that the legacy `import debug` path
+already serves.
+
+`debug.py` ends with `sys.modules[__name__] = debug`, which replaces the
+module object with the bare function. That trick lets OpenSwarm's own
+code write `import debug; debug(x)` (the imported name binds to the
+function directly), but it means `from debug import debug` doesn't work
+(you can't attribute-walk a function). This shim captures the function
+via `import debug` (which now binds to the function thanks to the
+sys.modules swap) and re-exports it as a normal module attribute, so
+the more conventional `from swarm_debug import debug` pattern works.
+"""
+
+import debug as _debug  # noqa: F401 — `_debug` is actually the function
+
+# Re-export as a module attribute so `from swarm_debug import debug` resolves.
+debug = _debug
+
+__all__ = ["debug"]
diff --git a/scripts/build-app.sh b/scripts/build-app.sh
index 9f36ce2d..78834aeb 100755
--- a/scripts/build-app.sh
+++ b/scripts/build-app.sh
@@ -367,9 +367,19 @@ rsync -a \
     --exclude='__pycache__' --exclude='**/__pycache__' \
     --exclude='*.pyc' --exclude='.venv' \
     --exclude='data/tools' \
+    --exclude='data/outputs_workspace' \
+    --exclude='data/agent_history' --exclude='data/sessions' \
+    --exclude='apps/outputs/webapp_template_cache' \
     --exclude='tests' --exclude='**/tests' \
     --exclude='/.env' --exclude='/.env.*' \
     "$PROJECT_ROOT/backend/" "$STAGING_DIR/backend/"
+# webapp_template_cache: a pre-built node_modules.tar.gz that gets shipped
+# to speed up first-app-create. Apple notarization extracts it and rejects
+# the build because upstream native binaries inside (esbuild, fsevents, etc.)
+# aren't signed with our Developer ID. Backend's _try_extract_bundled_archive
+# in view_builder_templates.py falls through cleanly when the archive is
+# missing, so first-app create just runs `npm install` (about 90s extra).
+# Long-term fix: sign native binaries before tarring in build-template-archive.sh.
 # Note: .env exclude is anchored to the backend/ source root (`/.env` /
 # `/.env.*`), not recursive. The vendored webapp-template snapshot at
 # backend/apps/outputs/webapp_template/.env.example MUST be shipped so
@@ -424,6 +434,13 @@ echo "[5/5] Packaging with electron-builder..."
 cd "$PROJECT_ROOT/electron"
 npm install
 
+# Node's default ~4 GB heap OOMs while codesign'ing the .app on dual-arch
+# publish runs (the .app is ~4.8 GB and electron-builder walks every file
+# to hash + sign, holding paths + metadata in memory). Bump the old-space
+# ceiling so V8 has headroom; 12 GB covers both arches in one invocation.
+# Caller's NODE_OPTIONS is respected if already set.
+export NODE_OPTIONS="${NODE_OPTIONS:---max-old-space-size=12288}"
+
 if $PUBLISH_MODE; then
     npx electron-builder --mac --arm64 --x64 --publish always
 elif $SIGN_MODE; then