What

The Mac app is meant to be the web app in a native shell. Meeting recording , the detection popup, the in-call UI, calendar auto-join, and the ⌘⇧A/S/D flag shortcuts , is now inert unless CEDAR_RECORDING=1 at build time. Nothing is deleted; the flag turns all of it back on.

Why this also unblocks releasing

The desktop app itself was never broken , it builds and runs today. The release pipeline is what's been failing since April (last published build is v0.1.27, 2026-04-01, while package.json had drifted to 0.1.32).

Two causes, both traceable to @recallai/desktop-sdk:

1. Notarization returns HTTP 401 Invalid credentials , the APPLE_APP_SPECIFIC_PASSWORD secret is expired. Not fixed by this PR; it needs rotating at appleid.apple.com by whichever Apple ID sits in APPLE_ID (must be a member of team 2QR5XNJVRF).
2. sign-gstreamer.cjs failed to sign all 102 GStreamer dylibs (no identity found) because its identity lookup misses CI's temp keychain. Even with valid credentials, notarization would likely reject those unsigned nested binaries.

The SDK bundles a ~335MB GStreamer.framework , the thing afterPack has to hand-sign, and the reason mergeASARs had to be disabled. With the flag clear it's excluded from the bundle entirely, so the standard signing path handles the whole app and both workarounds drop out.

How

• __RECORDING_ENABLED__ build-time define, in both main and preload
• services/recallSdk.ts (new) loads the SDK lazily , a top-level import would crash a disabled build on launch, since the package isn't in the bundle
• Startup, IPC registration, and the global shortcuts all gate on the flag
• Preload does the heavy lifting: the renderer decides whether recording exists purely by probing electronAPI.meetingRecorder and .callUI, so withholding those two keys disables every recording surface in the web app , with zero changes to apps/mail
• electron-builder excludes @recallai/** and drops the afterPack / mergeASARs / signIgnore workarounds when the flag is clear

Verification

⚠️ Before merging

• This PR is a single commit touching only apps/desktop , no other work rides along.
• Merging to staging fires Desktop Release, which builds and publishes a v0.1.33-staging prerelease. It will still fail at notarization until the Apple credential is rotated.
• Version bumped 0.1.32 → 0.1.33 so desktop-version-check passes.

Greptile Summary

The PR makes desktop meeting recording opt-in at build time and removes the Recall SDK and its native-signing workarounds from default packages.

• Defines one recording flag for the Electron main and preload builds.
• Gates recording startup, IPC handlers, global shortcuts, and renderer bridge capabilities.
• Loads the Recall SDK lazily so disabled packages can omit it safely.
• Conditionally applies Recall-specific packaging and signing settings.
• Bumps the desktop package version to 0.1.33.

Confidence Score: 5/5

The PR appears safe to merge, with recording-disabled and recording-enabled paths consistently gated across packaging, startup, IPC, and preload boundaries.

Current renderer callers safely treat recording capabilities as optional, disabled builds omit both bridge methods and handlers, and no changed-code-triggered blocking or independently actionable issue remains.

Important Files Changed