Skip to content

feat(office): bundle DSH's Python runtime and Office skills - #1692

Merged
Astro-Han merged 4 commits into
mainfrom
feat/bundled-python-runtime
Sep 24, 2026
Merged

Astro-Han merged 4 commits into
mainfrom
feat/bundled-python-runtime

Conversation

@Astro-Han

@Astro-Han Astro-Han commented Sep 24, 2026 •

Copy link
Copy Markdown
Owner

Summary

Bundle the same Python payload DSH's own desktop app ships and switch PawWork's Word, PowerPoint and Excel skills to DSH's dsh-skill-office, so Office tasks work offline instead of uv run-installing libraries from PyPI/GitHub mid-task (slow or failing from mainland China and behind company proxies).

  • scripts/prepare-primary-runtime.ts builds resources/runtime/primary-runtime from primary-runtime.lock.json, a verbatim copy of upstream's scripts/primary-runtime/lock.json (CPython 3.12.14 from python-build-standalone + 13 pinned, sha256-verified wheels), in the layout dsh-tool-workspace-dependencies reads. Runs in CI and the release workflow next to prepare-uv.
  • Product bundle mounts dsh-tool-workspace-dependencies (copied to <DSH home>/dsh-runtimes/dsh-primary-runtime on first use, as upstream does) and dsh-skill-office (LibreOffice Kit run through the app executable as Node).
  • Removes PawWork's skills/office-docx, office-pptx, office-xlsx (same names as DSH's); keeps office-pdf. uv stays for uvx and the PDF skill.
  • Size: +189MB unpacked on macOS arm64 (~60MB compressed).

Verification

  • pnpm run typecheck, pnpm test pass; new tests pin the lock's per-target coverage and that the payload paths equal what the upstream tool resolves.
  • Raw Electron CI smoke with CDP passes.
  • Real model on a raw build: the agent called load_workspace_dependencies, wrote a .docx with the bundled python-docx, converted it with the bundled LibreOffice Kit and rendered page 1 for a visual check (12 steps, 110 s). Rendered output checked by eye.
  • A signed + notarized dev-channel macOS arm64 build of this branch (no publish target) is running to confirm the Python binaries survive Apple notarization; results will be posted here.

Summary by CodeRabbit

  • New Features
    • Desktop builds now include a bundled Python 3.12 runtime and Office libraries for Word, PowerPoint, and Excel workflows. These workflows can run without relying on system Python; bundled LibreOffice supports visual checks.
    • The PDF skill continues to run through bundled uv.
  • Documentation
    • Updated product and development guidance to explain the Office and PDF runtime requirements, including how to prepare runtimes for local desktop development.

Ship the same Python payload DSH's own desktop app bundles and mount DSH's
Word, PowerPoint and Excel skills on it, replacing PawWork's v1-era
office-docx/pptx/xlsx skills.

Why: PawWork's Office skills fetched python-docx and friends through
`uv run` on first use, from PyPI and GitHub. From mainland China and
behind company proxies that is slow or fails outright, mid-task, where
neither the user nor the model can tell why. DSH now maintains Office
skills of its own that author with a bundled interpreter and check the
result visually with the LibreOffice engine PawWork already ships (DSH
0.1.7's libreoffice-kit, ~147MB), so following upstream both removes the
network dependency and hands the skills' upkeep to DSH.

- scripts/prepare-primary-runtime.ts assembles resources/runtime/
  primary-runtime from primary-runtime.lock.json, a verbatim copy of
  deepseek-harness scripts/primary-runtime/lock.json at 477b4f4205:
  python-build-standalone CPython 3.12.14 plus 13 pinned wheels (numpy,
  pandas, python-docx, python-pptx, openpyxl, Pillow, lxml, XlsxWriter
  and dependencies), every archive sha256-verified, unpacked the way
  upstream's prepare.ts does, in the runtime.json + dependencies/python
  layout dsh-tool-workspace-dependencies reads. Python-only: PawWork
  already runs Node through its own executable. On a native target it
  imports every library and runs `pip check`. CI and the release
  workflow run it next to prepare-uv.
- The product bundle mounts dsh-tool-workspace-dependencies (source: the
  packaged payload, via PAWWORK_PRIMARY_RUNTIME; root: dsh-runtimes/
  dsh-primary-runtime under the DSH home, where it is copied on first use
  as upstream does, since the app bundle is signed and read-only) and
  dsh-skill-office with node set to the app executable, which the agent
  shell runs as Node; inside Electron the plugin will not guess one.
- skills/office-docx, office-pptx and office-xlsx are removed; DSH's
  skills register the same names. office-pdf stays: DSH has no PDF skill.
- uv stays for `uvx` MCP servers and the PDF skill.

Cost: +189MB unpacked on macOS arm64 (about 60MB compressed download).

Verified on a raw Electron build: CI smoke with CDP passes; with a real
model (opencode-go-deepseek/deepseek-v4.1-flash) the agent called
load_workspace_dependencies, wrote quarterly.docx with the bundled
python-docx, converted it with the bundled LibreOffice Kit through the app
executable as Node, rendered page 1 to PNG and checked it (12 steps,
110 s); the rendered page shows the title, heading and 3-column table.
The payload also validates against the tool's own resolvePrimaryRuntime.
@Astro-Han Astro-Han added enhancement New feature or request harness Model harness, prompts, tool descriptions, and session mechanics desktop labels Sep 24, 2026
@github-actions github-actions Bot added ci Continuous integration / GitHub Actions app Application behavior and product flows platform Electron shell, OS integration, packaging, updater, signing, paths, and permissions P2 Medium priority labels Sep 24, 2026

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested priority: P2 (includes user-path files (packages/desktop-electron/resources/dsh/bundle/cordis.patch.yml, packages/desktop-electron/src/main/dsh-product-home.test.ts, packages/desktop-electron/src/main/dsh-product-home.ts, packages/desktop-electron/src/main/index.ts)).

P1/P0 are reserved for maintainer confirmation. Please relabel manually if this is a release blocker, security issue, data-loss risk, or updater/runtime failure.

@coderabbitai

coderabbitai Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: Astro-Han/pawwork/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 8bbe55dc-18b2-40a7-8878-5e9bcb84b2e8

📥 Commits

Reviewing files that changed from the base of the PR and between 0f4bd74 and e9970cd.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (63)
  • .github/workflows/build.yml
  • .github/workflows/ci.yml
  • CONTRIBUTING.md
  • README.md
  • README_CN.md
  • THIRD_PARTY_NOTICES.md
  • packages/desktop-electron/.gitignore
  • packages/desktop-electron/electron-builder-app-update.test.ts
  • packages/desktop-electron/electron-builder.config.ts
  • packages/desktop-electron/package.json
  • packages/desktop-electron/primary-runtime.lock.json
  • packages/desktop-electron/resources/dsh/bundle/cordis.patch.yml
  • packages/desktop-electron/scripts/prepare-primary-runtime.test.ts
  • packages/desktop-electron/scripts/prepare-primary-runtime.ts
  • packages/desktop-electron/scripts/release-workflow-contract.test.ts
  • packages/desktop-electron/src/main/dsh-product-home.test.ts
  • packages/desktop-electron/src/main/dsh-product-home.ts
  • packages/desktop-electron/src/main/index.ts
  • skills/office-docx/SKILL.md
  • skills/office-docx/pyproject.toml
  • skills/office-docx/scripts/check_docx.py
  • skills/office-pptx/LICENSE
  • skills/office-pptx/SKILL.md
  • skills/office-pptx/VENDORED.md
  • skills/office-pptx/pyproject.toml
  • skills/office-pptx/scripts/check_pptx_assets.py
  • skills/office-pptx/scripts/check_text_budget.py
  • skills/office-pptx/scripts/console_encoding.py
  • skills/office-pptx/scripts/resource_paths.py
  • skills/office-pptx/scripts/svg_finalize/__init__.py
  • skills/office-pptx/scripts/svg_finalize/flatten_tspan.py
  • skills/office-pptx/scripts/svg_to_pptx.py
  • skills/office-pptx/scripts/svg_to_pptx/__init__.py
  • skills/office-pptx/scripts/svg_to_pptx/animation_config.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/__init__.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/context.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/converter.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/elements.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/paths.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/styles.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/utils.py
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/__init__.py
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/chart_data.py
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/chart_style.py
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/chart_xml.py
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/chartex.py
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/marker_common.py
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/table.py
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/workbook.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/__init__.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/builder.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/cli.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/dimensions.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/discovery.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/media.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/narration.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/notes.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/slide_xml.py
  • skills/office-pptx/scripts/svg_to_pptx/tspan_flattener.py
  • skills/office-pptx/scripts/svg_to_pptx/use_expander.py
  • skills/office-xlsx/SKILL.md
  • skills/office-xlsx/pyproject.toml
  • skills/office-xlsx/scripts/check_xlsx.py
💤 Files with no reviewable changes (45)
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/table.py
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/workbook.py
  • skills/office-docx/pyproject.toml
  • skills/office-pptx/scripts/svg_to_pptx/init.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/context.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/media.py
  • skills/office-pptx/scripts/check_pptx_assets.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/paths.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/notes.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/init.py
  • skills/office-pptx/scripts/svg_to_pptx/use_expander.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/utils.py
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/chart_xml.py
  • skills/office-xlsx/pyproject.toml
  • skills/office-pptx/VENDORED.md
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/chart_data.py
  • skills/office-pptx/scripts/svg_to_pptx/tspan_flattener.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/discovery.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/cli.py
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/marker_common.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/dimensions.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/narration.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/styles.py
  • skills/office-xlsx/SKILL.md
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/init.py
  • skills/office-xlsx/scripts/check_xlsx.py
  • skills/office-pptx/pyproject.toml
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/chartex.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/builder.py
  • skills/office-docx/SKILL.md
  • skills/office-pptx/scripts/resource_paths.py
  • skills/office-pptx/scripts/svg_finalize/init.py
  • skills/office-pptx/scripts/console_encoding.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/init.py
  • skills/office-pptx/scripts/svg_to_pptx/native_objects/chart_style.py
  • skills/office-pptx/scripts/svg_to_pptx/pptx_package/slide_xml.py
  • skills/office-pptx/scripts/svg_to_pptx/animation_config.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/elements.py
  • skills/office-pptx/scripts/svg_finalize/flatten_tspan.py
  • skills/office-pptx/scripts/svg_to_pptx/drawingml/converter.py
  • skills/office-pptx/SKILL.md
  • skills/office-pptx/scripts/svg_to_pptx.py
  • skills/office-docx/scripts/check_docx.py
  • skills/office-pptx/LICENSE
  • skills/office-pptx/scripts/check_text_budget.py

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.


📝 Walkthrough

Walkthrough

Desktop builds now prepare and package a locked Python runtime alongside uv, then pass its path to DSH plugins. The repository removes the previous vendored Word, PowerPoint, and Excel skill files and updates documentation about the Office and PDF skill runtimes.

Changes

Office runtime and skills

Layer / File(s) Summary
Lock and prepare the Python runtime
packages/desktop-electron/primary-runtime.lock.json, packages/desktop-electron/scripts/prepare-primary-runtime.ts, packages/desktop-electron/scripts/prepare-primary-runtime.test.ts
The lock file pins Python runtime artifacts and wheels for platform targets. The preparation script downloads and verifies artifacts, extracts Python and wheels, writes a manifest, and runs host checks. Tests cover lock metadata, path mapping, and wheel data directories.
Prepare and package the runtime
packages/desktop-electron/package.json, packages/desktop-electron/electron-builder.config.ts, packages/desktop-electron/electron-builder-app-update.test.ts, packages/desktop-electron/.gitignore, .github/workflows/build.yml, .github/workflows/ci.yml, packages/desktop-electron/scripts/release-workflow-contract.test.ts, CONTRIBUTING.md
Package scripts and workflows prepare Python alongside uv. Electron Builder includes the runtime resources, and tests check the packaging resource and preparation step. The contributor guide documents local runtime preparation commands.
Pass runtime resources to DSH plugins
packages/desktop-electron/src/main/dsh-product-home.ts, packages/desktop-electron/src/main/index.ts, packages/desktop-electron/src/main/dsh-product-home.test.ts, packages/desktop-electron/resources/dsh/bundle/cordis.patch.yml
The app resolves a primary runtime path and sets PAWWORK_PRIMARY_RUNTIME in the DSH environment. The Cordis patch configures the workspace-dependencies and skill-office plugins. Tests cover resource paths and environment values.
Remove vendored Word and Excel skill files
skills/office-docx/*, skills/office-docx/scripts/*, skills/office-xlsx/*, skills/office-xlsx/scripts/*
The Word and Excel skill instructions, project metadata, and document or workbook validation scripts are removed.
Remove vendored PowerPoint skill tooling
skills/office-pptx/*, skills/office-pptx/scripts/*, README.md, README_CN.md, THIRD_PARTY_NOTICES.md, CONTRIBUTING.md
The PowerPoint skill instructions, project metadata, conversion and packaging implementation, and validation scripts are removed. The README files and third-party notices describe the bundled Python runtime for Office skills and distinguish the PDF skill's use of uv. The contributor guide describes which skills are vendored.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant launchDsh
  participant resolveProductResources
  participant buildDshEnvironment
  participant WorkspaceDependencies
  launchDsh->>resolveProductResources: Resolve skills and primary runtime paths
  resolveProductResources->>launchDsh: Return product resources
  launchDsh->>buildDshEnvironment: Pass product resources
  buildDshEnvironment->>WorkspaceDependencies: Set PAWWORK_PRIMARY_RUNTIME
Loading

Merge Risk: ⚪ Minimal · up to e9970

The supported macOS and Windows packaging paths are not affected by the Linux concern, and the replacement Office skills are registered. No identified issue prevents merging.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 7.69% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 13 functions across 8 files. (10 skipped: … Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the primary change: bundling DSH's Python runtime and Office skills.
Description check ✅ Passed The description provides a clear summary, rationale, verification results, platform impact, and pending notarization status. It uses "Verification" instead of the required "How To Verify" heading and …
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

Docstring coverage is 7.69% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 13 functions across 8 files. (10 skipped: 10 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@qodo-free-for-open-source-projects

Copy link
Copy Markdown

PR Summary by Qodo

Bundle DSH Python Runtime and Offline Office Skills

✨ Enhancement ⚙️ Configuration changes 🧪 Tests 📝 Documentation 🕐 40+ Minutes

Grey Divider

AI Description

• Bundle pinned, checksum-verified CPython and Office libraries for offline document tasks.
• Replace local Office skills with DSH-maintained Word, PowerPoint, and Excel integrations.
• Prepare, package, mount, and verify the runtime across supported desktop targets.
Diagram

graph TD
  B["Build Pipeline"] --> P["Runtime Builder"] --> A["App Bundle"] --> D["DSH Bundle"]
  L["Runtime Lock"] --> P
  D --> W["Workspace Tool"] --> H[("DSH Home Runtime")]
  D --> O["Office Skills"] --> H
Loading
High-Level Assessment

The selected approach is appropriate: it follows DSH's runtime layout and delegates Office behavior to DSH's maintained plugin while preserving a writable per-user copy. Retaining task-time uv installations would keep the network and proxy failure mode, while continuing PawWork's custom Office skills would duplicate upstream maintenance and validation logic.

Files changed (17) +424 / -30

Enhancement (4) +157 / -5
cordis.patch.ymlMount workspace runtime and DSH Office skills +15/-0

Mount workspace runtime and DSH Office skills

• Registers the workspace-dependencies tool with bundled and writable runtime paths. It also mounts DSH's Office skill and supplies the Electron executable for its Node-based LibreOffice CLI.

packages/desktop-electron/resources/dsh/bundle/cordis.patch.yml

prepare-primary-runtime.tsAssemble the checksum-verified Python runtime +132/-0

Assemble the checksum-verified Python runtime

• Downloads and verifies the target CPython archive and pinned wheels, unpacks them into DSH's expected layout, and writes runtime metadata. Native builds additionally validate imports and package consistency with pip check.

packages/desktop-electron/scripts/prepare-primary-runtime.ts

dsh-product-home.tsExpose the bundled runtime to DSH +9/-4

Expose the bundled runtime to DSH

• Resolves the primary-runtime path for development and packaged applications. It injects that path into DSH through a PawWork-owned environment variable while removing conflicting inherited values.

packages/desktop-electron/src/main/dsh-product-home.ts

index.tsPass product resources into DSH startup +1/-1

Pass product resources into DSH startup

• Supplies the complete resolved resource set when building the DSH environment so both skills and the Python payload are available.

packages/desktop-electron/src/main/index.ts

Tests (4) +58 / -16
electron-builder-app-update.test.tsAssert runtime resources are packaged +1/-0

Assert runtime resources are packaged

• Extends the Electron Builder configuration test to require the runtime resource directory in application artifacts.

packages/desktop-electron/electron-builder-app-update.test.ts

prepare-primary-runtime.test.tsVerify runtime targets and layout contracts +40/-0

Verify runtime targets and layout contracts

• Tests shipped-target coverage, checksum presence, interpreter and site-packages compatibility with DSH's resolver, and rejection of unsupported wheel installation schemes.

packages/desktop-electron/scripts/prepare-primary-runtime.test.ts

release-workflow-contract.test.tsEnforce Python preparation before packaging +3/-2

Enforce Python preparation before packaging

• Updates the release workflow contract to require both uv and primary-runtime preparation before every application packaging step.

packages/desktop-electron/scripts/release-workflow-contract.test.ts

dsh-product-home.test.tsTest runtime resource and environment resolution +14/-14

Test runtime resource and environment resolution

• Covers packaged and development runtime paths and verifies that PawWork replaces ambient runtime variables case-insensitively when constructing the DSH environment.

packages/desktop-electron/src/main/dsh-product-home.test.ts

Documentation (3) +7 / -3
README.mdDocument offline Office runtime behavior +1/-1

Document offline Office runtime behavior

• Explains that DSH Office skills use bundled Python libraries and LibreOffice visual checks, while the PDF skill and uvx continue using uv.

README.md

README_CN.mdDocument bundled Office support in Chinese +1/-1

Document bundled Office support in Chinese

• Updates the Chinese architecture overview to describe the offline Python 3.12 Office runtime, LibreOffice checks, and remaining uv usage.

README_CN.md

THIRD_PARTY_NOTICES.mdAdd notices for bundled Python components +5/-1

Add notices for bundled Python components

• Documents CPython, python-build-standalone, and bundled library licenses. It also narrows uv's stated purpose to on-demand tooling and the PDF skill.

THIRD_PARTY_NOTICES.md

Other (6) +202 / -6
build.ymlPrepare bundled Python during release builds +2/-1

Prepare bundled Python during release builds

• Runs the primary-runtime preparation script beside uv for every non-finalization packaging target, ensuring release artifacts contain the matching platform payload.

.github/workflows/build.yml

ci.ymlBuild the Python payload in desktop CI +4/-2

Build the Python payload in desktop CI

• Extends the desktop build matrix to prepare the target-specific Python runtime before compiling the Electron application.

.github/workflows/ci.yml

electron-builder.config.tsInclude runtime payload in Electron packages +5/-0

Include runtime payload in Electron packages

• Copies the generated runtime resources into the packaged application's runtime directory.

packages/desktop-electron/electron-builder.config.ts

package.jsonAdd DSH Office runtime dependencies and build steps +5/-3

Add DSH Office runtime dependencies and build steps

• Adds the DSH Office skill and workspace-dependencies packages. Local packaging commands now prepare the primary Python runtime before building Electron artifacts.

packages/desktop-electron/package.json

primary-runtime.lock.jsonLock cross-platform Python and Office dependencies +180/-0

Lock cross-platform Python and Office dependencies

• Pins CPython 3.12.14 and checksum-verified wheels for Windows, macOS, and Linux targets. The manifest records thirteen Office and data-processing package versions.

packages/desktop-electron/primary-runtime.lock.json

pnpm-lock.yamlLock DSH Office integration packages +6/-0

Lock DSH Office integration packages

• Records the resolved DSH Office skill and workspace-dependencies package graph at version 0.1.7-rc.2.

pnpm-lock.yaml

@qodo-free-for-open-source-projects

qodo-free-for-open-source-projects Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

Grey Divider


Action required

1. Interrupted builds poison the cache ✓ Resolved 🐞 Bug ☼ Reliability
Description
download writes verified bytes directly to the checksum-named cache file and treats every existing
file as authoritative before validating it. If a build is terminated during that write, every later
preparation reads the truncated entry and throws the same checksum error without deleting or
refetching it.
Code

packages/desktop-electron/scripts/prepare-primary-runtime.ts[R59-61]

+  const actual = createHash("sha256").update(bytes).digest("hex")
+  if (actual !== sha256) throw new Error(`Checksum mismatch for ${url}: expected ${sha256}, got ${actual}`)
+  await writeFile(cached, bytes)
Evidence
The cache filename is stable for each expected checksum, readFile consumes it whenever present,
and the mismatch branch throws before the unconditional direct writeFile. Because no invalidation
or atomic staging exists, a partial file survives and blocks every interpreter or wheel download
using that checksum.

packages/desktop-electron/scripts/prepare-primary-runtime.ts[48-62]
packages/desktop-electron/scripts/prepare-primary-runtime.ts[98-103]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A process interruption can leave a partial checksum-named download in the shared cache, and subsequent builds repeatedly fail instead of recovering.
## Fix Focus Areas
- packages/desktop-electron/scripts/prepare-primary-runtime.ts[48-62]
## Recommended Fix
Keep cache handling inside the existing `download` seam: write verified downloads to a uniquely named temporary file and atomically publish them, and remove then refetch an existing entry whose checksum is invalid. Deletion alone cannot prevent another interrupted write, while a separate cache authority is unnecessary; the only new branch should be the bounded recovery path for an invalid cached entry.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


2. Source builds lose Office support 🐞 Bug ≡ Correctness
Description
resolveProductResources always supplies resources/runtime/primary-runtime to the
workspace-dependencies plugin, but the desktop predev hook only generates icons while
prepare-primary-runtime.ts runs only in package and CI flows. On a fresh checkout launched through
the documented pnpm dev:desktop command, the plugin receives no generated source payload, so
Office tasks cannot load their bundled interpreter or libraries.
Code

packages/desktop-electron/src/main/dsh-product-home.ts[R66-68]

+    primaryRuntime: options.isPackaged
+      ? join(options.resourcesPath, "runtime", "primary-runtime")
+      : join(options.appPath, "resources", "runtime", "primary-runtime"),
Evidence
The README directs source users to pnpm dev:desktop, which reaches the desktop package's dev
script after a predev hook that only generates icons. The changed development resource resolver
exports resources/runtime/primary-runtime and the bundle passes it directly to
workspace-dependencies, but the repository contains no prepared runtime directory and the
preparation command appears only in packaging scripts, proving that the documented fresh-checkout
development flow starts without creating the required payload.

README.md[110-115]
packages/desktop-electron/package.json[17-22]
packages/desktop-electron/src/main/dsh-product-home.ts[63-68]
packages/desktop-electron/resources/dsh/bundle/cordis.patch.yml[155-164]
packages/desktop-electron/package.json[16-22]
README.md[106-115]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Development launches expose `resources/runtime/primary-runtime` to the Office workspace-dependencies plugin without first generating that payload because the documented development lifecycle does not run `prepare-primary-runtime.ts`. A clean checkout launched with `pnpm dev:desktop` therefore starts without the bundled interpreter and libraries required by Office tasks.
## Fix Focus Areas
- packages/desktop-electron/package.json[16-22]
- packages/desktop-electron/src/main/dsh-product-home.ts[63-68]
## Recommended Fix
Reuse the existing `predev` lifecycle seam by running `tsx ./scripts/prepare-primary-runtime.ts` before `generate-icons.ts`, or otherwise before `electron-vite dev` starts Electron. Keep the runtime source because the Office plugin consumes it; reusing the existing preparer preserves its platform selection, download verification, extraction, and caching behavior without introducing new configuration or runtime authority, while adding only the unavoidable runtime preparation work to development startup.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Tip of the day
💡 Did you know, you can choose which labels appear on a finding, and whether they show icons or text

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Qodo Logo

Comment thread packages/desktop-electron/scripts/prepare-primary-runtime.ts Outdated
Comment thread packages/desktop-electron/src/main/dsh-product-home.ts
…on Windows

Git Bash's GNU tar parses a C:\ archive path as host:file and fails with
'Cannot connect to C: resolve failed'.
…dows

Git Bash puts GNU tar first on PATH. It reads a C:\ archive as host:file
and escapes a D:\ -C target into a path that does not exist, so a
relative archive name alone does not help. Windows ships bsdtar as
System32\tar.exe, which takes drive-letter paths and gzip.
…me prep

A cache entry left truncated by an interrupted build failed the checksum
on every later run; it is now re-downloaded instead. The cache hit no
longer rewrites the file.

pnpm dev:desktop does not download uv or the Python payload, so
CONTRIBUTING now names the two prepare commands for developers who need
the Office and PDF skills, and its skills row reflects that Word,
PowerPoint and Excel come from DSH.
@Astro-Han
Astro-Han merged commit 4c4e48b into main Sep 24, 2026
12 checks passed
@Astro-Han
Astro-Han deleted the feat/bundled-python-runtime branch September 24, 2026 19:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

app Application behavior and product flows ci Continuous integration / GitHub Actions desktop enhancement New feature or request harness Model harness, prompts, tool descriptions, and session mechanics P2 Medium priority platform Electron shell, OS integration, packaging, updater, signing, paths, and permissions

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant