fix(desktop): bundle the preload to CommonJS so the dshApp bridge loads under sandbox

The renderer opens with sandbox:true, and Electron sandboxed preload scripts
only support CommonJS. The preload was emitted as ESM (package.json is
"type": "module"), so it failed to load silently and window.dshApp was never
injected. The About section then fell back to plain-web mode: current version
stayed on the '—' fallback and check-for-updates reported up-to-date without
querying. Build the preload with esbuild into lib/types/preload.cjs and point
the main process at it.

Co-Authored-By: Claude <noreply@anthropic.com>

apps/desktop/electron-builder.yml

@@ -24,6 +24,7 @@ directories:
   output: dist
 files:
   - lib/types/**/*.js
+  - lib/types/**/*.cjs
   - package.json
 # The self-contained harness (build/harness) lands at Contents/Resources/harness
 # in the packaged app; src/main.ts spawns the bundled node + dsh CLI from there.

apps/desktop/package.json

@@ -8,11 +8,13 @@
   "main": "lib/types/main.js",
   "files": [
     "lib/types/*.js",
+    "lib/types/*.cjs",
     "lib/types/*.d.ts",
     "electron-builder.yml"
   ],
   "scripts": {
-    "build": "tsc -b tsconfig.json",
+    "build": "tsc -b tsconfig.json && pnpm run build:preload",
+    "build:preload": "esbuild src/preload.ts --bundle --platform=node --format=cjs --external:electron --outfile=lib/types/preload.cjs",
     "build:harness": "node scripts/build-harness.mjs",
     "generate-release-json": "node scripts/generate-release-json.mjs",
     "stage-release": "node scripts/stage-release.mjs",
@@ -27,6 +29,7 @@
     "@types/node": "^22.0.0",
     "electron": "^42.4.1",
     "electron-builder": "^25.1.8",
+    "esbuild": "^0.28.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.8"
   }

apps/desktop/src/main.ts

@@ -50,8 +50,14 @@ const PRODUCT_NAME = 'DeepSeek Harness'
 /** Window icon: the branded PNG in build/, resolved from this ES module's URL. */
 const APP_ICON = fileURLToPath(new URL('../../build/icon.png', import.meta.url))
 
-/** Renderer preload (compiled to lib/types/preload.js), resolved from this ES module's URL. */
-const PRELOAD = fileURLToPath(new URL('./preload.js', import.meta.url))
+/**
+ * Renderer preload, resolved from this ES module's URL. The preload is bundled
+ * to CommonJS (`lib/types/preload.cjs`) rather than left as ESM: the renderer
+ * runs `sandbox: true`, and Electron sandboxed preload scripts only support
+ * CommonJS. An ESM preload would silently fail to load and drop the `dshApp`
+ * bridge from the SPA.
+ */
+const PRELOAD = fileURLToPath(new URL('./preload.cjs', import.meta.url))
 
 /**
  * The self-contained harness runtime bundled into the packaged app by