diff --git a/apps/macos/Tests/ClawdisIPCTests/VoiceWakeForwarderTests.swift b/apps/macos/Tests/ClawdisIPCTests/VoiceWakeForwarderTests.swift
index 911378f45..5acf448ab 100644
--- a/apps/macos/Tests/ClawdisIPCTests/VoiceWakeForwarderTests.swift
+++ b/apps/macos/Tests/ClawdisIPCTests/VoiceWakeForwarderTests.swift
@@ -63,4 +63,14 @@ import Testing
 
         #expect(!command.contains("/tmp/custom-cli"))
     }
+
+    @Test func shellEscapeHandlesQuotesAndParens() {
+        let text = "Debug test works (and a funny pun)"
+        let escaped = VoiceWakeForwarder.shellEscape(text)
+        #expect(escaped == "'Debug test works (and a funny pun)'")
+
+        let textWithQuote = "Debug test works (and a funny pun)'"
+        let escapedQuote = VoiceWakeForwarder.shellEscape(textWithQuote)
+        #expect(escapedQuote == "'Debug test works (and a funny pun)'\\'''")
+    }
 }
diff --git a/scripts/package-mac-app.sh b/scripts/package-mac-app.sh
index 2474ebdc3..3cca39ba1 100755
--- a/scripts/package-mac-app.sh
+++ b/scripts/package-mac-app.sh
@@ -15,6 +15,8 @@ GIT_COMMIT=$(cd "$ROOT_DIR" && git rev-parse --short HEAD 2>/dev/null || echo "u
 APP_VERSION="${APP_VERSION:-$PKG_VERSION}"
 APP_BUILD="${APP_BUILD:-$PKG_VERSION}"
 
+echo "📦 Ensuring deps (pnpm install)"
+(cd "$ROOT_DIR" && pnpm install --no-frozen-lockfile --config.node-linker=hoisted)
 echo "📦 Building JS (pnpm exec tsc)"
 (cd "$ROOT_DIR" && pnpm exec tsc -p tsconfig.json)
 
@@ -117,7 +119,7 @@ pnpm install \
   --config.shared-workspace-lockfile=false \
   --lockfile-dir "$ROOT_DIR" \
   --dir "$TMP_DEPLOY"
-rsync -a "$TMP_DEPLOY/node_modules" "$RELAY_DIR/"
+rsync -aL "$TMP_DEPLOY/node_modules" "$RELAY_DIR/"
 rm -rf "$TMP_DEPLOY"
 
 if [ -f "$CLI_BIN" ]; then