chore(desktop-client): gate dev-only debug paths in packaged builds

Wrap the network observer, renderer-devtools proxy (both the main-side
ipc handler registration and the preload-side response listener), and
the auto-open-devtools triggers behind !app.isPackaged so packaged
builds don't ship debugging side channels. Add a tiny console-guard
imported first in renderer/main.ts that no-ops console.* in
import.meta.env.PROD so a packaged build stays quiet.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/src/main/execution-devtools.ts

@@ -1,3 +1,4 @@
+import { app } from "electron/main";
 import type { WebContents } from "electron/main";
 
 function normalizeBooleanEnv(value: string | undefined): boolean | null {
@@ -16,6 +17,10 @@ function normalizeBooleanEnv(value: string | undefined): boolean | null {
 }
 
 export function shouldAutoOpenExecutionDevtools(): boolean {
+  if (app.isPackaged) {
+    return false;
+  }
+
   const explicit = normalizeBooleanEnv(process.env.GEO_DESKTOP_EXECUTION_DEVTOOLS);
   if (explicit !== null) {
     return explicit;
@@ -25,6 +30,10 @@ export function shouldAutoOpenExecutionDevtools(): boolean {
 }
 
 export function shouldAutoOpenBackgroundExecutionDevtools(): boolean {
+  if (app.isPackaged) {
+    return false;
+  }
+
   const explicit = normalizeBooleanEnv(process.env.GEO_DESKTOP_EXECUTION_DEVTOOLS);
   if (explicit !== null) {
     return explicit;

apps/desktop-client/src/main/network-observer.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 
+import { app } from "electron/main";
 import type { Session, WebContents } from "electron/main";
 
 import type {
@@ -39,11 +40,16 @@ const requestFilter = {
   urls: ["http://*/*", "https://*/*", "ws://*/*", "wss://*/*"],
 };
 const redactedQueryKeys = /token|signature|sig|auth|key|password|session/i;
+const networkObserverEnabled = !app.isPackaged;
 
 let rendererTarget: WebContents | null = null;
 let originalFetch: typeof globalThis.fetch | null = null;
 
 export function installObservedGlobalFetch(): void {
+  if (!networkObserverEnabled) {
+    return;
+  }
+
   if (originalFetch || typeof globalThis.fetch !== "function") {
     return;
   }
@@ -79,6 +85,10 @@ export function installObservedGlobalFetch(): void {
 }
 
 export function registerObservedRequestRendererTarget(webContents: WebContents): void {
+  if (!networkObserverEnabled) {
+    return;
+  }
+
   rendererTarget = webContents;
   webContents.once("destroyed", () => {
     if (rendererTarget === webContents) {
@@ -91,6 +101,10 @@ export function observeSessionRequests(
   target: Session,
   options: { label: string; partition?: string | null },
 ): void {
+  if (!networkObserverEnabled) {
+    return;
+  }
+
   if (observedSessions.has(target)) {
     return;
   }
@@ -175,6 +189,10 @@ export function observeSessionRequests(
 }
 
 export function startObservedRequest(options: StartObservedRequestOptions): string {
+  if (!networkObserverEnabled) {
+    return "";
+  }
+
   const id = `main:${randomUUID()}`;
   const active: ActiveObservedRequest = {
     id,
@@ -239,6 +257,14 @@ export function failObservedRequest(id: string, error: unknown): void {
 }
 
 export function getObservedRequestSnapshot(): DesktopObservedRequestSnapshot {
+  if (!networkObserverEnabled) {
+    return {
+      rendererAttached: false,
+      activeCount: 0,
+      recent: [],
+    };
+  }
+
   return {
     rendererAttached: Boolean(rendererTarget && !rendererTarget.isDestroyed()),
     activeCount: activeRequests.size,

apps/desktop-client/src/main/renderer-devtools-proxy.ts

@@ -1,4 +1,4 @@
-import { ipcMain } from "electron/main";
+import { app, ipcMain } from "electron/main";
 import type { IpcMainEvent, WebContents } from "electron/main";
 
 interface RendererProxyRequest {
@@ -26,10 +26,17 @@ const pendingRequests = new Map<string, {
 }>();
 const rendererProxyRequestChannel = "desktop:renderer-devtools-proxy:request";
 const rendererProxyResponseChannel = "desktop:renderer-devtools-proxy:response";
+const rendererDevtoolsProxyEnabled = !app.isPackaged;
 
+if (rendererDevtoolsProxyEnabled) {
   ipcMain.on(rendererProxyResponseChannel, handleRendererProxyResponse);
+}
 
 export function registerRendererDevtoolsProxyTarget(webContents: WebContents): void {
+  if (!rendererDevtoolsProxyEnabled) {
+    return;
+  }
+
   rendererWebContents = webContents;
   webContents.once("destroyed", () => {
     if (rendererWebContents === webContents) {
@@ -39,12 +46,17 @@ export function registerRendererDevtoolsProxyTarget(webContents: WebContents): v
 }
 
 export function canUseRendererDevtoolsProxy(): boolean {
-  return Boolean(rendererWebContents && !rendererWebContents.isDestroyed());
+  return rendererDevtoolsProxyEnabled
+    && Boolean(rendererWebContents && !rendererWebContents.isDestroyed());
 }
 
 export async function rendererDevtoolsFetch(
   request: RendererProxyRequest,
 ): Promise<RendererProxyResponse> {
+  if (!rendererDevtoolsProxyEnabled) {
+    throw new Error("renderer_devtools_proxy_unavailable");
+  }
+
   if (!rendererWebContents || rendererWebContents.isDestroyed()) {
     throw new Error("renderer_devtools_proxy_unavailable");
   }

apps/desktop-client/src/preload/bridge.ts

@@ -35,6 +35,7 @@ interface DesktopAppSettings {
 const rendererProxyRequestChannel = "desktop:renderer-devtools-proxy:request";
 const rendererProxyResponseChannel = "desktop:renderer-devtools-proxy:response";
 
+if (import.meta.env.DEV) {
   ipcRenderer.on(
     rendererProxyRequestChannel,
     async (
@@ -93,6 +94,7 @@ ipcRenderer.on(
       });
     },
   );
+}
 
 const desktopBridge = {
   app: {

apps/desktop-client/src/renderer/console-guard.ts

@@ -0,0 +1,8 @@
+if (import.meta.env.PROD) {
+  const noop = () => undefined;
+  console.log = noop;
+  console.info = noop;
+  console.warn = noop;
+  console.error = noop;
+  console.debug = noop;
+}

apps/desktop-client/src/renderer/main.ts

@@ -1,3 +1,5 @@
+import "./console-guard";
+
 import { createApp } from "vue";
 
 import App from "./App.vue";