From 77989bef3c858cf1009ad912e65b11e3e3903bea Mon Sep 17 00:00:00 2001
From: goodsventures <bosses@goodscompany.io>
Date: Fri, 31 Jul 2026 11:27:06 -0700
Subject: [PATCH] fix(dev): stage real sidecar binaries in just dev and
 desktop-standalone
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The desktop app resolves buzz-acp and the other agent helpers next to its
own executable. In the documented dev flow (just setup && just dev) the
Tauri build copies the zero-byte externalBin stubs from _ensure-sidecar-stubs
there, and because the stub exists, the PATH fallback never runs — agent
sign-in fails with 'failed to run buzz-acp auth helper: Permission denied
(os error 13)' during onboarding and in Settings → Agents.

just dev already builds the real helper crates; it just never staged them.
Extract desktop-standalone's copy loop into a shared _sync-sidecar-binaries
recipe and run it after the cargo build in both lanes. _ensure-sidecar-stubs
stays untouched so compile-only lanes (desktop-tauri-clippy/check/test) keep
their cheap placeholder path.

Fixes #3927. Fixes #3664. Overlaps with #2597, which fixes the same bug by
staging real binaries inside _ensure-sidecar-stubs itself.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: goodsventures <bosses@goodscompany.io>
---
 Justfile | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/Justfile b/Justfile
index 2d76f1a7b9..6082c87b91 100644
--- a/Justfile
+++ b/Justfile
@@ -159,6 +159,22 @@ _ensure-sidecar-stubs:
         touch "desktop/src-tauri/binaries/${bin}-${TARGET}"
     done
 
+# Copy freshly built sidecar binaries over the placeholder stubs. The desktop
+# app resolves buzz-acp & co. next to its own executable, and a zero-byte stub
+# there shadows the PATH fallback — dev builds must ship the real helpers or
+# agent sign-in fails with "Permission denied (os error 13)".
+# Sidecar binary list must stay in sync with _ensure-sidecar-stubs above.
+_sync-sidecar-binaries:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    export PATH="{{justfile_directory()}}/bin:$PATH"
+    TARGET=$(rustc -vV | sed -n 's|host: ||p')
+    TARGET_DIR=$(cargo metadata --format-version 1 --no-deps | node -p "JSON.parse(require('fs').readFileSync(0, 'utf8')).target_directory")
+    for bin in buzz-acp buzz-agent buzz-dev-mcp git-credential-nostr buzz; do
+        cp "${TARGET_DIR}/debug/${bin}" "desktop/src-tauri/binaries/${bin}-${TARGET}"
+        chmod +x "desktop/src-tauri/binaries/${bin}-${TARGET}"
+    done
+
 # Ensure Docker dev services (Postgres, Redis, etc.) are running and healthy
 _ensure-services:
     #!/usr/bin/env bash
@@ -430,6 +446,7 @@ dev *ARGS: bootstrap _ensure-sidecar-stubs _ensure-migrations
         done
     fi
     cargo build -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p buzz-cli -p git-credential-nostr -p buzz-relay
+    "{{justfile_directory()}}/bin/just" _sync-sidecar-binaries
     if [[ -n "{{mesh}}" ]]; then
         export MESH_LLM_NATIVE_RUNTIME_CACHE_DIR="$(./scripts/ensure-mesh-native-runtime.sh)"
     fi
@@ -477,12 +494,7 @@ desktop-standalone *ARGS: _ensure-sidecar-stubs
     set -euo pipefail
     export PATH="{{justfile_directory()}}/bin:$PATH"
     cargo build -p buzz-acp -p buzz-agent -p buzz-dev-mcp -p buzz-cli -p git-credential-nostr
-    TARGET=$(rustc -vV | sed -n 's|host: ||p')
-    TARGET_DIR=$(cargo metadata --format-version 1 --no-deps | node -p "JSON.parse(require('fs').readFileSync(0, 'utf8')).target_directory")
-    for bin in buzz-acp buzz-agent buzz-dev-mcp git-credential-nostr buzz; do
-        cp "${TARGET_DIR}/debug/${bin}" "desktop/src-tauri/binaries/${bin}-${TARGET}"
-        chmod +x "desktop/src-tauri/binaries/${bin}-${TARGET}"
-    done
+    "{{justfile_directory()}}/bin/just" _sync-sidecar-binaries
     cd {{desktop_dir}}
     [[ -d node_modules ]] || pnpm install
     unset BUZZ_PRIVATE_KEY BUZZ_SHARE_IDENTITY