refactor: remove keytar dependency and simplify token storage fallback mechanism

forge.config.ts

@@ -15,7 +15,6 @@ import { execSync } from 'node:child_process';
 // Keep this list in sync with the Vite external array.
 const externalPackages = [
   'better-sqlite3',
-  'keytar',
   '@github/copilot-sdk',
   '@langchain/core',
   '@langchain/langgraph',
@@ -69,8 +68,9 @@ const config: ForgeConfig = {
         env: { ...process.env, npm_config_nodedir: '' },
       });
 
-      // When cross-compiling, native addons (better-sqlite3, keytar) are built
-      // for the build machine (Linux). Re-download prebuilts for the target.
+      // When cross-compiling, native addons (better-sqlite3) are built
+      // for the build machine (Linux). Use @electron/rebuild to get the
+      // correct binaries for the target platform.
       const targetKey = `${platform}-${arch}`;
       const buildKey = `${process.platform}-${process.arch}`;
       if (targetKey !== buildKey) {
@@ -79,22 +79,27 @@ const config: ForgeConfig = {
           fs.readFileSync(path.resolve(__dirname, 'node_modules', 'electron', 'package.json'), 'utf-8'),
         ).version;
 
-        // Use prebuild-install to fetch correct native binaries
-        const prebuildModules = ['better-sqlite3', 'keytar'];
-        for (const mod of prebuildModules) {
-          const modDir = path.join(buildPath, 'node_modules', mod);
-          if (fs.existsSync(modDir)) {
-            console.log(`[forge] Downloading ${mod} prebuilt for ${targetKey} (Electron ${electronVersion})...`);
-            try {
-              execSync(
-                `npx --yes prebuild-install -r electron -t ${electronVersion} --platform ${platform} --arch ${arch} --verbose`,
-                { cwd: modDir, stdio: 'inherit' },
-              );
-            } catch (e) {
-              console.warn(`[forge] prebuild-install failed for ${mod}, trying node-gyp rebuild...`);
-            }
+        // Clean stale build artifacts before rebuilding — a leftover
+        // build/Release/*.node for the host platform must not survive.
+        const nativeModules = ['better-sqlite3'];
+        for (const mod of nativeModules) {
+          const buildRelease = path.join(buildPath, 'node_modules', mod, 'build', 'Release');
+          if (fs.existsSync(buildRelease)) {
+            fs.rmSync(buildRelease, { recursive: true, force: true });
+            console.log(`[forge] Cleaned stale build/Release for ${mod}`);
           }
         }
+
+        // Rebuild native modules for target platform using @electron/rebuild.
+        // This is fatal — a Linux .node in a Windows package is always broken.
+        console.log(`[forge] Rebuilding native modules for ${targetKey} (Electron ${electronVersion})...`);
+        execSync(
+          `npx --yes @electron/rebuild --platform ${platform} --arch ${arch} ` +
+          `--module-dir "${path.join(buildPath, 'node_modules')}" ` +
+          `--electron-version ${electronVersion} ` +
+          `--only better-sqlite3`,
+          { cwd: buildPath, stdio: 'inherit' },
+        );
       }
 
       // vectordb uses platform-specific optional deps (@lancedb/vectordb-<platform>-<arch>-*).