From 1974c941b84be0122a0d48988b149db615632c49 Mon Sep 17 00:00:00 2001 From: mikehasa Date: Mon, 31 Aug 2026 06:38:13 +0900 Subject: [PATCH] fix(packaging): strip pip direct_url.json from the frozen CLI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pip install . into the build venv writes a PEP 610 direct_url.json into agentacct-*.dist-info recording the absolute local build path (file:///Users//.../worktrees/...); --collect-all copies it into the frozen bundle, so the shipped DMG leaked the builder's account name and build path. It has no runtime purpose in a frozen bundle — delete it after freezing. --- packaging/freeze-cli.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/packaging/freeze-cli.sh b/packaging/freeze-cli.sh index e0cad8d..763b451 100755 --- a/packaging/freeze-cli.sh +++ b/packaging/freeze-cli.sh @@ -67,6 +67,14 @@ rm -rf "$DIST_DIR" "$WORK_DIR" "$HERE"/*.spec --hidden-import=uvicorn.lifespan.on \ "$HERE/pyinstaller_entry.py" +# Strip pip's install-source record from the frozen bundle. `pip install .` into +# the build venv writes a PEP 610 direct_url.json into agentacct-*.dist-info that +# records the ABSOLUTE local build path (file:///Users//.../worktrees/...); +# --collect-all then copies that dist-info into _internal/. The file has no +# runtime purpose here and would ship the builder's account name + build path +# inside the public DMG, so delete every direct_url.json from the output. +find "$DIST_DIR/agentacct" -name direct_url.json -delete 2>/dev/null || true + BIN="$DIST_DIR/agentacct/agentacct" echo "==> smoke-testing the frozen binary" "$BIN" --version