Bundle Python and adb so the app needs nothing installed

- app/build/fetch-deps.js downloads a standalone Python 3.12
  (python-build-standalone) for every build and adb from Google's
  platform-tools, pinned by SHA-256, and prunes what the server never
  uses. It replaces the Windows-only embeddable Python.
- The app runs the bundled Python with -I -u -B -X utf8, so a PYTHONHOME
  or PYTHONPATH meant for another Python can't break it and nothing is
  written inside the signed macOS bundle.
- An adb you already have still goes first, so two adb versions don't
  keep restarting each other's server. arm64 Linux has no official
  platform-tools and keeps using the system adb.
- ui/frame_apk.py reads APK badging (package, label, version, min SDK,
  ABIs, icon) from the binary manifest and resources.arsc, replacing
  aapt2. It matches aapt2 on nine F-Droid APKs and finds launcher icons
  the old path missed with adaptive icons.
- The app reads the computer's clipboard through Electron, so Linux no
  longer needs wl-clipboard or xclip.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

app/.gitignore

@@ -1,3 +1,3 @@
 node_modules/
 dist/
-build/python-win/
+build/deps/

app/build/fetch-deps.js

@@ -0,0 +1,118 @@
+// Downloads what the app bundles so users install nothing else: a standalone
+// Python (python-build-standalone) and adb (Android platform-tools). Each goes in
+// build/deps/<os>-<arch>/{python,tools}, which package.json copies into the app's
+// resources. Everything is pinned by version and SHA-256.
+//   node build/fetch-deps.js mac arm64 | win x64 | linux x64 arm64
+const crypto = require("crypto");
+const fs = require("fs");
+const https = require("https");
+const path = require("path");
+const { execFileSync } = require("child_process");
+
+const PY = "3.12.14+20260924";
+const PY_URL = (triple) => "https://github.com/astral-sh/python-build-standalone/releases/download/"
+  + `${PY.split("+")[1]}/cpython-${PY}-${triple}-install_only_stripped.tar.gz`;
+const PYTHON = {
+  "mac-arm64": ["aarch64-apple-darwin", "c2edb321cd32ec2b170df208db0446dccc4398db602ca27cf2079098fb1f7d9d"],
+  "win-x64": ["x86_64-pc-windows-msvc", "c5bf8edfe858c1df9891be498b5bbc8761d383df5b9790658b088fea4870433a"],
+  "linux-x64": ["x86_64-unknown-linux-gnu", "269b2c99e4db15b242bf01832f4fea1e8f1a664f273cff519393f296e9820b41"],
+  "linux-arm64": ["aarch64-unknown-linux-gnu", "c8499b61252c433280f134df954464d19811527b31cb920c35fc6967c1222e35"],
+};
+
+// Google publishes no arm64 Linux platform-tools; there the app uses the system adb.
+const PT = "37.0.1";
+const PT_URL = (os) => `https://dl.google.com/android/repository/platform-tools_r${PT}-${os}.zip`;
+const TOOLS = {
+  mac: ["darwin", "ee39ad5967e95c2a07f04dbcbde96b1a0c916ba376096db5d2f498b7727a5d1d", ["adb"]],
+  win: ["win", "45f4d63113e895ebde0c90f194099a4676b6ac653bd28d54314a9e022bbc1a99",
+        ["adb.exe", "AdbWinApi.dll", "AdbWinUsbApi.dll", "libwinpthread-1.dll"]],
+  linux: ["linux", "d230f13842f60f782a8645f9c813f8f845bf36089ea7289f28c48f17979313f1", ["adb"]],
+};
+
+// Parts of Python the server never imports (GUI, tests, packaging, headers).
+const PRUNE = [
+  "include", "share", "Scripts", "libs", "tcl", "lib/pkgconfig", "lib/itcl4", "lib/tcl8", "lib/tcl8.6",
+  "lib/tk8.6", "lib/thread2.8", "bin/idle3", "bin/idle3.12", "bin/pip", "bin/pip3", "bin/pip3.12",
+  "bin/pydoc3", "bin/pydoc3.12", "bin/2to3", "bin/2to3-3.12", "bin/python3-config", "bin/python3.12-config",
+  ...["test", "idlelib", "tkinter", "turtledemo", "ensurepip", "lib2to3", "site-packages/pip"]
+    .flatMap((d) => [`lib/python3.12/${d}`, `Lib/${d}`]),
+];
+
+function get(url) {
+  return new Promise((resolve, reject) => {
+    https.get(url, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume();
+        return resolve(get(res.headers.location));
+      }
+      if (res.statusCode !== 200) return reject(new Error(`${url}: HTTP ${res.statusCode}`));
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("end", () => resolve(Buffer.concat(chunks)));
+    }).on("error", reject);
+  });
+}
+
+async function download(url, sha256, file) {
+  const data = await get(url);
+  const sum = crypto.createHash("sha256").update(data).digest("hex");
+  if (sum !== sha256) throw new Error(`checksum mismatch for ${url}: ${sum}`);
+  fs.writeFileSync(file, data);
+}
+
+// Windows' own bsdtar: Git's GNU tar, often first on PATH, reads C:\ as a remote host.
+const TAR = process.platform === "win32" ? path.join(process.env.SystemRoot, "System32", "tar.exe") : "tar";
+
+function extract(file, dir) {
+  fs.mkdirSync(dir, { recursive: true });
+  // bsdtar (macOS, Windows 10+) reads zip files; GNU tar doesn't, so fall back to unzip.
+  try { execFileSync(TAR, ["-xf", file, "-C", dir]); }
+  catch (e) {
+    if (!file.endsWith(".zip")) throw e;
+    execFileSync("unzip", ["-q", "-o", file, "-d", dir]);
+  }
+  fs.rmSync(file);
+}
+
+async function fetch(os, arch) {
+  const key = `${os}-${arch}`;
+  if (!PYTHON[key]) throw new Error(`no bundle for ${key}`);
+  const out = path.join(__dirname, "deps", key);
+  const stamp = path.join(out, ".version");
+  const version = `python ${PY}, platform-tools ${PT}`;
+  if (fs.existsSync(stamp) && fs.readFileSync(stamp, "utf8") === version) {
+    console.log(`${key}: already fetched (${version})`);
+    return;
+  }
+  fs.rmSync(out, { recursive: true, force: true });
+  fs.mkdirSync(out, { recursive: true });
+
+  const [triple, pySha] = PYTHON[key];
+  const tgz = path.join(out, "python.tar.gz");
+  await download(PY_URL(triple), pySha, tgz);
+  extract(tgz, out);  // unpacks to python/
+  for (const p of PRUNE) fs.rmSync(path.join(out, "python", p), { recursive: true, force: true });
+
+  const tools = path.join(out, "tools");
+  fs.mkdirSync(tools);
+  if (!(os === "linux" && arch === "arm64")) {
+    const [name, ptSha, keep] = TOOLS[os];
+    const zip = path.join(out, "pt.zip");
+    const tmp = path.join(out, "pt");
+    await download(PT_URL(name), ptSha, zip);
+    extract(zip, tmp);
+    for (const f of [...keep, "NOTICE.txt", "source.properties"]) {
+      fs.copyFileSync(path.join(tmp, "platform-tools", f), path.join(tools, f));
+    }
+    if (os !== "win") fs.chmodSync(path.join(tools, "adb"), 0o755);
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+  fs.writeFileSync(stamp, version);
+  console.log(`${key}: ${version} -> ${out}`);
+}
+
+(async () => {
+  const [os, ...archs] = process.argv.slice(2);
+  if (!os || !archs.length) throw new Error("usage: node build/fetch-deps.js <mac|win|linux> <arch>...");
+  for (const arch of archs) await fetch(os, arch);
+})().catch((e) => { console.error(e.message); process.exit(1); });

app/build/fetch-python.js

@@ -1,49 +0,0 @@
-// Downloads the official Windows embeddable Python into build/python-win, which
-// the Windows build bundles as resources/python (so Windows users need no Python).
-// Pinned by version and SHA-256. Run: node build/fetch-python.js
-const crypto = require("crypto");
-const fs = require("fs");
-const https = require("https");
-const path = require("path");
-const { execFileSync } = require("child_process");
-
-const VERSION = "3.12.10";
-const SHA256 = "4acbed6dd1c744b0376e3b1cf57ce906f9dc9e95e68824584c8099a63025a3c3";
-const URL = `https://www.python.org/ftp/python/${VERSION}/python-${VERSION}-embed-amd64.zip`;
-const OUT = path.join(__dirname, "python-win");
-
-function get(url) {
-  return new Promise((resolve, reject) => {
-    https.get(url, (res) => {
-      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-        res.resume();
-        return resolve(get(res.headers.location));
-      }
-      if (res.statusCode !== 200) return reject(new Error(`${url}: HTTP ${res.statusCode}`));
-      const chunks = [];
-      res.on("data", (c) => chunks.push(c));
-      res.on("end", () => resolve(Buffer.concat(chunks)));
-    }).on("error", reject);
-  });
-}
-
-(async () => {
-  const stamp = path.join(OUT, ".version");
-  if (fs.existsSync(path.join(OUT, "python.exe")) && fs.existsSync(stamp) && fs.readFileSync(stamp, "utf8") === VERSION) {
-    console.log(`Python ${VERSION} already in ${OUT}`);
-    return;
-  }
-  const zip = await get(URL);
-  const sum = crypto.createHash("sha256").update(zip).digest("hex");
-  if (sum !== SHA256) throw new Error(`checksum mismatch for ${URL}: ${sum}`);
-  fs.rmSync(OUT, { recursive: true, force: true });
-  fs.mkdirSync(OUT, { recursive: true });
-  const file = path.join(OUT, "python.zip");
-  fs.writeFileSync(file, zip);
-  // bsdtar (macOS, Windows 10+) reads zip files; GNU tar doesn't, so fall back to unzip.
-  try { execFileSync("tar", ["-xf", file, "-C", OUT]); }
-  catch { execFileSync("unzip", ["-q", "-o", file, "-d", OUT]); }
-  fs.rmSync(file);
-  fs.writeFileSync(path.join(OUT, ".version"), VERSION);
-  console.log(`Python ${VERSION} -> ${OUT}`);
-})().catch((e) => { console.error(e.message); process.exit(1); });

app/main.js

@@ -1,7 +1,7 @@
 // Frame Control as a desktop app (macOS, Windows, Linux): starts ui/server.py on
 // a free loopback port and shows it in a native window. The server does all the
 // work over the `frame` SSH alias; this file only hosts it.
-const { app, BrowserWindow, Menu, dialog, shell } = require("electron");
+const { app, BrowserWindow, Menu, clipboard, dialog, ipcMain, shell } = require("electron");
 const { execFile, spawn } = require("child_process");
 const { promisify } = require("util");
 const fs = require("fs");
@@ -17,6 +17,7 @@ const IS_WIN = process.platform === "win32";
 
 // Packaged: <resources>/{ui,scripts,python}. Dev: the repo checkout.
 const ROOT = app.isPackaged ? process.resourcesPath : path.join(__dirname, "..");
+const TOOLS = path.join(ROOT, "tools");  // bundled adb
 const SERVER = path.join(ROOT, "ui", "server.py");
 const SCRIPTS = path.join(ROOT, "scripts");
 const LOG_DIR = IS_MAC ? path.join(os.homedir(), "Library", "Logs", "Frame Control")
@@ -54,10 +55,16 @@ async function loginPath() {
 }
 
 // The Windows build bundles Python; elsewhere use the system's python3 (3.8+).
+// -I ignores PYTHON* variables and user site-packages, so a PYTHONHOME or
+// PYTHONPATH set for another Python can't break the bundled one. That makes these
+// flags stand in for PYTHONUNBUFFERED, PYTHONDONTWRITEBYTECODE (no __pycache__
+// inside the signed app) and PYTHONUTF8.
+const PY_FLAGS = ["-I", "-u", "-B", "-X", "utf8"];
+
 async function findPython(env) {
   const names = IS_WIN ? ["python.exe", "python3.exe"] : ["python3"];
-  const candidates = [];
-  if (IS_WIN) candidates.push(path.join(ROOT, "python", "python.exe"));
+  // The packaged app bundles Python (app/build/fetch-deps.js); a checkout uses PATH.
+  const candidates = [path.join(ROOT, "python", ...(IS_WIN ? ["python.exe"] : ["bin", "python3"]))];
   for (const dir of env.PATH.split(path.delimiter)) {
     // The WindowsApps "python.exe" is a stub that opens the Microsoft Store.
     if (!dir || (IS_WIN && /\\WindowsApps\\?$/i.test(dir))) continue;
@@ -67,7 +74,7 @@ async function findPython(env) {
     try {
       fs.accessSync(p, fs.constants.X_OK);
       // /usr/bin/python3 on macOS is a stub until the Command Line Tools are installed.
-      await run(p, ["-c", "import http.server, sys; assert sys.version_info >= (3, 8)"],
+      await run(p, [...PY_FLAGS, "-c", "import http.server, sys; assert sys.version_info >= (3, 8)"],
                 { timeout: 10000, env, windowsHide: true });
       return p;
     } catch {}
@@ -79,10 +86,8 @@ async function hasSsh(env) {
   try { await run("ssh", ["-V"], { timeout: 5000, env, windowsHide: true }); return true; } catch { return false; }
 }
 
-const PYTHON_HELP = IS_MAC
-  ? "Install the Xcode Command Line Tools (xcode-select --install) or Homebrew's python, then reopen the app."
-  : IS_WIN ? "The bundled Python is missing; reinstall Frame Control."
-  : "Install Python 3.8 or later from your distribution (e.g. sudo apt install python3), then reopen the app.";
+const PYTHON_HELP = app.isPackaged ? "The bundled Python is missing; reinstall Frame Control."
+  : "Install Python 3.8 or later, then reopen the app.";
 const SSH_HELP = IS_WIN
   ? "Turn on Windows' OpenSSH client: Settings → System → Optional features → Add a feature → OpenSSH Client."
   : "Install the OpenSSH client (e.g. sudo apt install openssh-client).";
@@ -108,8 +113,8 @@ function ping(target) {
 }
 
 async function startServer() {
-  const env = { ...process.env, PATH: await loginPath(), PYTHONUNBUFFERED: "1", PYTHONDONTWRITEBYTECODE: "1",
-                PYTHONIOENCODING: "utf-8", PYTHONUTF8: "1", FRAME_CONTROL_APP: "1" };
+  const env = { ...process.env, PATH: await loginPath(), FRAME_CONTROL_APP: "1",
+                ...(fs.existsSync(TOOLS) ? { FRAME_CONTROL_TOOLS: TOOLS } : {}) };
   python = await findPython(env);
   if (!python) throw new Error(`Frame Control needs Python 3.8 or later. ${PYTHON_HELP}`);
   if (!await hasSsh(env)) throw new Error(`Frame Control needs the ssh command. ${SSH_HELP}`);
@@ -118,8 +123,7 @@ async function startServer() {
   const log = fs.openSync(LOG, "a");
   fs.writeSync(log, `\n--- ${new Date().toISOString()} ${python} ${SERVER} --port ${port}\n`);
   // stdin stays open while the app runs; the server exits cleanly when it closes.
-  // -X utf8: the bundled Windows Python ignores PYTHON* variables (isolated mode).
-  const child = spawn(python, ["-X", "utf8", SERVER, "--port", String(port), "--exit-on-eof"],
+  const child = spawn(python, [...PY_FLAGS, SERVER, "--port", String(port), "--exit-on-eof"],
                       { env, stdio: ["pipe", log, log], windowsHide: true });
   child.stdin.on("error", () => {});
   fs.closeSync(log);
@@ -229,13 +233,19 @@ async function firstRunCheck() {
   if (response === 0) setUpConnection();
 }
 
+ipcMain.handle("clipboard:read", (e) => {
+  if (!win || e.sender !== win.webContents || !url || new URL(e.senderFrame.url).origin !== new URL(url).origin) return "";
+  return clipboard.readText();
+});
+
 function createWindow() {
   win = new BrowserWindow({
     width: 1400, height: 950, minWidth: 760, minHeight: 560,
     title: "Frame Control", backgroundColor: BG, show: false,
     ...(IS_MAC ? { titleBarStyle: "hiddenInset", trafficLightPosition: { x: 18, y: 26 } }
                : { icon: path.join(__dirname, "build", "icon.png") }),
-    webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true },
+    webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true,
+                      preload: path.join(__dirname, "preload.js") },
   });
   win.once("ready-to-show", () => win.show());
   if (CHROME_CSS) win.webContents.on("did-finish-load", () => win.webContents.insertCSS(CHROME_CSS));
@@ -259,7 +269,7 @@ async function runInTerminal(argv) {
     const env = { ...process.env, PATH: await loginPath() };
     const py = python || await findPython(env);
     if (!py) throw new Error(`Python 3.8 or later is needed. ${PYTHON_HELP}`);
-    await run(py, [path.join(ROOT, "ui", "frame_host.py"), "terminal", "--", ...argv],
+    await run(py, [...PY_FLAGS, path.join(ROOT, "ui", "frame_host.py"), "terminal", "--", ...argv],
               { env, timeout: 15000, windowsHide: true });
   } catch (err) {
     dialog.showErrorBox("Couldn't open a terminal", String((err.stderr || err.message || err)).trim());
@@ -270,7 +280,7 @@ async function setUpConnection() {
   const alias = `FRAME_ALIAS=${FRAME}`;
   if (IS_MAC) return runInTerminal(["env", alias, "zsh", path.join(SCRIPTS, "connect.sh")]);
   const py = python || await findPython({ ...process.env, PATH: await loginPath() });
-  const setup = [py || "python3", path.join(ROOT, "ui", "frame_connect.py")];
+  const setup = [py || "python3", ...PY_FLAGS, path.join(ROOT, "ui", "frame_connect.py")];
   // A new console inherits our environment on Windows; Linux terminals may not.
   runInTerminal(IS_WIN ? setup : ["env", alias, ...setup]);
 }

app/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "frame-control",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "frame-control",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "license": "MIT",
       "devDependencies": {
         "electron": "^44.4.5",

app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "frame-control",
   "productName": "Frame Control",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Desktop app for managing a Valve Steam Frame over SSH",
   "private": true,
   "main": "main.js",
@@ -9,10 +9,10 @@
   "scripts": {
     "start": "env -u ELECTRON_RUN_AS_NODE electron .",
     "icon": "env -u ELECTRON_RUN_AS_NODE electron build/make-icon.js",
-    "dist": "electron-builder --mac --arm64 --publish never",
-    "dist:dir": "electron-builder --mac --arm64 --dir",
-    "dist:linux": "electron-builder --linux --x64 --arm64 --publish never",
-    "dist:win": "node build/fetch-python.js && electron-builder --win --x64 --publish never"
+    "dist": "node build/fetch-deps.js mac arm64 && electron-builder --mac --arm64 --publish never",
+    "dist:dir": "node build/fetch-deps.js mac arm64 && electron-builder --mac --arm64 --dir",
+    "dist:linux": "node build/fetch-deps.js linux x64 arm64 && electron-builder --linux --x64 --arm64 --publish never",
+    "dist:win": "node build/fetch-deps.js win x64 && electron-builder --win --x64 --publish never"
   },
   "devDependencies": {
     "electron": "^44.4.5",
@@ -27,6 +27,7 @@
     },
     "files": [
       "main.js",
+      "preload.js",
       "package.json",
       "build/icon.png"
     ],
@@ -62,6 +63,20 @@
           "pins.json",
           "site/apps.js"
         ]
+      },
+      {
+        "from": "build/deps/${os}-${arch}/python",
+        "to": "python",
+        "filter": [
+          "**/*"
+        ]
+      },
+      {
+        "from": "build/deps/${os}-${arch}/tools",
+        "to": "tools",
+        "filter": [
+          "**/*"
+        ]
       }
     ],
     "mac": {
@@ -105,7 +120,6 @@
     },
     "deb": {
       "depends": [
-        "python3",
         "openssh-client"
       ]
     },
@@ -115,16 +129,7 @@
         "zip"
       ],
       "icon": "build/icon.png",
-      "artifactName": "Frame-Control-win-${arch}.${ext}",
-      "extraResources": [
-        {
-          "from": "build/python-win",
-          "to": "python",
-          "filter": [
-            "**/*"
-          ]
-        }
-      ]
+      "artifactName": "Frame-Control-win-${arch}.${ext}"
     },
     "nsis": {
       "oneClick": false,

app/preload.js

@@ -0,0 +1,7 @@
+// Lets the page read this computer's clipboard through Electron, so sending it
+// to the Frame needs no pbpaste, PowerShell, xclip or wl-clipboard.
+const { contextBridge, ipcRenderer } = require("electron");
+
+contextBridge.exposeInMainWorld("frameApp", {
+  readClipboard: () => ipcRenderer.invoke("clipboard:read"),
+});