Desktop artifacts ship Git Credential Manager and its .NET runtime, which Maka disables

[Joob1n]

Problem

The bundled Git distribution ships Git Credential Manager and the .NET runtime it needs. Maka cannot reach either: every git invocation sets credential.helper= explicitly — packages/storage/src/git-workspace-service.ts:1257 and :2873 — so the helper is not merely unused, it is switched off at the call site. Credentials live in Maka's own credentials.json under the permission contract in SECURITY.md.

The entry point is 140 KB. What follows it is not:

libSkiaSharp.dylib — 2D graphics, for a login window that never opens	14.4 MB
System.Private.CoreLib.dll	13.5 MB
System.Private.Xml.dll	8.8 MB
libcoreclr.dylib	6.1 MB
…216 .dll and 16 .dylib in total
Total	223 files, 103.1 MiB

Measured impact

Packaged main and a pruned build, both macOS arm64:

	installed .app	downloaded DMG
main	781 MB	279.6 MB
pruned	648 MB	235.0 MB
delta	−133 MB	−44.6 MB (−16%)

The two differ because .NET assemblies are IL and compress well. Both are real: users download 45 MB less and reclaim 133 MB of disk.

Verification that git still works

The exclusion has to be a name filter over libexec/git-core, which holds git's own commands interleaved with the .NET payload — there is no directory to drop, so over-matching is the risk worth testing rather than assuming. Against a pruned copy, every subcommand git-workspace-service.ts actually invokes:

init · config · add · commit (with credential.helper=) · status
rev-parse · cat-file · for-each-ref · worktree

All pass. git --version reports 2.53.0 and share/git-core/templates is intact.

Scope

• Exclude the credential-manager runtime from extraResources in the electron-builder config. .dll and .dylib appear nowhere else in the distribution, and all 16 dylibs are .NET, Avalonia or Skia.
• Assert both halves in the packaged-artifact verifier: the payload is absent and the git commands Maka invokes are present. Checking only the absence would pass for an empty directory.
• macOS and Linux only as written. The Windows distribution has a different layout (git/cmd/git.exe, and its own .dll set that git itself loads); trimming it needs its own measurement first.

Relationship to the other size items

Same origin as #3146: both are part of the 151 MB #2199 added when it bundled a hermetic Git runtime. #3146 explicitly scoped this payload out — "The bundled Git runtime is a larger and separate finding … I will file that separately if it is wanted." This is that separate filing, so the two do not overlap: #3146 / #3148 removes the renderer's duplicated dependency tree, this removes the credential-manager runtime.

Still unfiled from that same note: the 27 git builtins that lost their hardlinks, about 13 MB.

Supersedes the size half of #3202, which is closed — its packaging-time attribution did not survive measurement.