refactor(cli): unify on clawdis CLI + node permissions

scripts/codesign-mac-app.sh

@@ -126,13 +126,10 @@ sign_plain_item() {
   codesign --force --options runtime --timestamp=none --sign "$IDENTITY" "$target"
 }
 
-# Sign main binary and CLI helper if present
+# Sign main binary
 if [ -f "$APP_BUNDLE/Contents/MacOS/Clawdis" ]; then
   echo "Signing main binary"; sign_item "$APP_BUNDLE/Contents/MacOS/Clawdis" "$APP_ENTITLEMENTS"
 fi
-if [ -f "$APP_BUNDLE/Contents/MacOS/ClawdisCLI" ]; then
-  echo "Signing CLI helper"; sign_item "$APP_BUNDLE/Contents/MacOS/ClawdisCLI" "$ENT_TMP_BASE"
-fi
 
 # Sign bundled gateway payload (native addons, libvips dylibs)
 if [ -d "$APP_BUNDLE/Contents/Resources/Relay" ]; then
@@ -142,6 +139,9 @@ if [ -d "$APP_BUNDLE/Contents/Resources/Relay" ]; then
   if [ -f "$APP_BUNDLE/Contents/Resources/Relay/clawdis-gateway" ]; then
     echo "Signing embedded gateway"; sign_item "$APP_BUNDLE/Contents/Resources/Relay/clawdis-gateway" "$ENT_TMP_BUN"
   fi
+  if [ -f "$APP_BUNDLE/Contents/Resources/Relay/clawdis" ]; then
+    echo "Signing embedded CLI"; sign_item "$APP_BUNDLE/Contents/Resources/Relay/clawdis" "$ENT_TMP_BUN"
+  fi
 fi
 
 # Sign Sparkle deeply if present

scripts/package-mac-app.sh

@@ -36,12 +36,10 @@ fi
 cd "$ROOT_DIR/apps/macos"
 
 echo "🔨 Building $PRODUCT ($BUILD_CONFIG)"
-swift build -c "$BUILD_CONFIG" --product "$PRODUCT" --product "${PRODUCT}CLI" --build-path "$BUILD_PATH"
+swift build -c "$BUILD_CONFIG" --product "$PRODUCT" --build-path "$BUILD_PATH"
 
 BIN="$BUILD_PATH/$BUILD_CONFIG/$PRODUCT"
-CLI_BIN="$BUILD_PATH/$BUILD_CONFIG/ClawdisCLI"
 echo "pkg: binary $BIN" >&2
-echo "pkg: cli $CLI_BIN" >&2
 echo "🧹 Cleaning old app bundle"
 rm -rf "$APP_ROOT"
 mkdir -p "$APP_ROOT/Contents/MacOS"
@@ -146,6 +144,18 @@ if [[ "${SKIP_GATEWAY_PACKAGE:-0}" != "1" ]]; then
 	    --define "__CLAWDIS_VERSION__=\\\"$PKG_VERSION\\\""
 	  chmod +x "$BUN_OUT"
 
+  echo "🧰 Building bundled CLI (bun --compile)"
+  CLI_OUT="$RELAY_DIR/clawdis"
+  bun build "$ROOT_DIR/dist/index.js" \
+    --compile \
+    --bytecode \
+    --outfile "$CLI_OUT" \
+    -e playwright-core \
+    -e electron \
+    -e "chromium-bidi*" \
+    --define "__CLAWDIS_VERSION__=\\\"$PKG_VERSION\\\""
+  chmod +x "$CLI_OUT"
+
   echo "📄 Writing embedded runtime package.json (Pi compatibility)"
   cat > "$RELAY_DIR/package.json" <<JSON
 {
@@ -173,12 +183,6 @@ else
   echo "🧰 Skipping gateway payload packaging (SKIP_GATEWAY_PACKAGE=1)"
 fi
 
-if [ -f "$CLI_BIN" ]; then
-  echo "🔧 Copying CLI helper"
-  cp "$CLI_BIN" "$APP_ROOT/Contents/MacOS/ClawdisCLI"
-  chmod +x "$APP_ROOT/Contents/MacOS/ClawdisCLI"
-fi
-
 echo "⏹  Stopping any running Clawdis"
 killall -q Clawdis 2>/dev/null || true