fix(electron): isolate packaged runtime setup

electron/build/entitlements.mac.plist

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <key>com.apple.security.device.audio-input</key>
+    <true/>
+  </dict>
+</plist>

electron/src/main/backend.ts

@@ -889,7 +889,7 @@ export class BackendSupervisor extends EventEmitter<{
       // Python passes this child-side descriptor to every nested operation.
       // Reading the parent side keeps the ownership channel live and lets
       // Node observe EOF only after the complete backend subtree releases it.
-      const drain = child.stdio[processOptions.drainFd] as NodeJS.ReadableStream | null;
+      const drain = child.stdio?.[processOptions.drainFd] as NodeJS.ReadableStream | null | undefined;
       drain?.on('error', (error: unknown) => {
         if (!isExpectedPipeClose(error)) {
           this.pushLog('err', `Backend drain stream failed: ${errorMessage(error)}`);

electron/src/main/runtime-project.test.ts

@@ -241,11 +241,25 @@ describe('packaged runtime setup', () => {
         return `VOICESTUDIO_CUDNN8_PROBE=${JSON.stringify({ device: 'cuda', sitePackages })}\n`;
       }
       if (args[0] === 'pip') {
-        const libDir = join(sitePackages, 'cudnn8_compat', 'nvidia', 'cudnn', 'bin');
+        const libDir = join(
+          sitePackages,
+          'cudnn8_compat',
+          'nvidia',
+          'cudnn',
+          process.platform === 'win32' ? 'bin' : 'lib',
+        );
         await mkdir(libDir, { recursive: true });
         await Promise.all(
           Array.from({ length: 5 }, (_, index) =>
-            writeFile(join(libDir, `cudnn-${index}64_8.dll`), 'library'),
+            writeFile(
+              join(
+                libDir,
+                process.platform === 'win32'
+                  ? `cudnn-${index}64_8.dll`
+                  : `libcudnn-${index}.so.8`,
+              ),
+              'library',
+            ),
           ),
         );
       }

electron/src/main/runtime-project.ts

@@ -369,8 +369,8 @@ export async function installRuntime(
     UV_PROJECT_ENVIRONMENT: join(project, '.venv'),
     // Keep immutable downloads beside the replaceable project. Clean & Retry can
     // rebuild a broken venv without paying the multi-gigabyte transfer twice.
-    UV_CACHE_DIR: process.env.UV_CACHE_DIR || join(project, '..', '.uv-cache'),
-    UV_PYTHON_INSTALL_DIR: process.env.UV_PYTHON_INSTALL_DIR || join(project, '..', '.python'),
+    UV_CACHE_DIR: join(project, '..', '.uv-cache'),
+    UV_PYTHON_INSTALL_DIR: join(project, '..', '.python'),
   };
   if (!uv) {
     phase('downloading_uv');