feat(desktop): add Windows support

Source: per-simmons/damon-ade#9

Author: Chi944

.github/workflows/build-desktop.yml

@@ -46,7 +46,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.3.2"
+          bun-version: "1.3.6"
 
       - name: Cache dependencies
         uses: actions/cache@v4
@@ -152,7 +152,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v1
         with:
-          bun-version: "1.3.2"
+          bun-version: "1.3.6"
 
       - name: Cache dependencies
         uses: actions/cache@v4
@@ -234,3 +234,104 @@ jobs:
           path: apps/desktop/release/*-linux.yml
           retention-days: ${{ inputs.artifact_retention_days }}
           if-no-files-found: error
+
+  build-windows:
+    name: Build - Windows (x64)
+    runs-on: windows-latest
+    environment: production
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: "1.3.6"
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+
+      - name: Install dependencies
+        run: bun install --frozen
+
+      - name: Set version suffix
+        if: inputs.version_suffix != ''
+        working-directory: apps/desktop
+        shell: bash
+        run: |
+          CURRENT_VERSION=$(node -p "require('./package.json').version")
+          NEW_VERSION="${CURRENT_VERSION}${{ inputs.version_suffix }}"
+          echo "Setting version to: $NEW_VERSION"
+          node -e "
+            const fs = require('fs');
+            const pkg = require('./package.json');
+            pkg.version = '$NEW_VERSION';
+            fs.writeFileSync('./package.json', JSON.stringify(pkg, null, '\t') + '\n');
+          "
+          echo "Updated package.json version to $NEW_VERSION"
+
+      - name: Clean dev folder
+        working-directory: apps/desktop
+        run: bun run clean:dev
+
+      - name: Compile app with electron-vite
+        working-directory: apps/desktop
+        env:
+          NEXT_PUBLIC_POSTHOG_KEY: ${{ secrets.NEXT_PUBLIC_POSTHOG_KEY }}
+          NEXT_PUBLIC_POSTHOG_HOST: ${{ secrets.NEXT_PUBLIC_POSTHOG_HOST }}
+          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
+          GH_CLIENT_ID: ${{ secrets.GH_CLIENT_ID }}
+          NEXT_PUBLIC_WEB_URL: ${{ secrets.NEXT_PUBLIC_WEB_URL }}
+          NEXT_PUBLIC_API_URL: ${{ secrets.NEXT_PUBLIC_API_URL }}
+          NEXT_PUBLIC_DOCS_URL: ${{ secrets.NEXT_PUBLIC_DOCS_URL }}
+          NEXT_PUBLIC_STREAMS_URL: ${{ secrets.NEXT_PUBLIC_STREAMS_URL }}
+          NEXT_PUBLIC_ELECTRIC_URL: ${{ secrets.NEXT_PUBLIC_ELECTRIC_URL }}
+          SENTRY_DSN_DESKTOP: ${{ secrets.SENTRY_DSN_DESKTOP }}
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SUPERSET_WORKSPACE_NAME: superset
+        run: bun run compile:app
+
+      - name: Build Electron app
+        working-directory: apps/desktop
+        env:
+          CSC_IDENTITY_AUTO_DISCOVERY: false
+          WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
+          WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
+          CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
+        run: bun run package -- --publish never --config ${{ inputs.electron_builder_config }}
+
+      - name: Verify Windows installer + update manifest exist
+        working-directory: apps/desktop
+        shell: pwsh
+        run: |
+          Get-ChildItem release
+          if (-not (Get-ChildItem release -Filter "*.exe" -File)) {
+            Write-Error "No Windows installer generated in apps/desktop/release"
+          }
+          if (-not (Test-Path release/latest.yml)) {
+            Write-Error "No Windows auto-update manifest generated in apps/desktop/release"
+          }
+
+      - name: Upload Windows installer artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ inputs.artifact_prefix }}-windows-installer
+          path: apps/desktop/release/*.exe
+          retention-days: ${{ inputs.artifact_retention_days }}
+          if-no-files-found: error
+
+      - name: Upload Windows auto-update manifest
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ inputs.artifact_prefix }}-windows-update-manifest
+          path: apps/desktop/release/latest.yml
+          retention-days: ${{ inputs.artifact_retention_days }}
+          if-no-files-found: error

.github/workflows/release-desktop-canary.yml

@@ -106,6 +106,13 @@ jobs:
               echo "Created canary copy: ADE-Canary-${arch}.AppImage"
             fi
           done
+          for file in *.exe; do
+            if [[ -f "$file" && "$file" != *.__uninstaller.exe ]]; then
+              arch=$(echo "$file" | sed -E 's/.*-([^-]+)\.exe$/\1/')
+              cp "$file" "ADE-Canary-${arch}.exe"
+              echo "Created canary copy: ADE-Canary-${arch}.exe"
+            fi
+          done
           # Prerelease builds may request canary-linux.yml; keep latest-linux.yml as fallback.
           for file in *-linux.yml; do
             if [[ -f "$file" && "$file" != "canary-linux.yml" && "$file" != "latest-linux.yml" ]]; then
@@ -115,6 +122,11 @@ jobs:
               break
             fi
           done
+          # Windows generic provider uses latest.yml by default and may request canary.yml for prereleases.
+          if [[ -f latest.yml && ! -f canary.yml ]]; then
+            cp latest.yml canary.yml
+            echo "Created Windows canary manifest: canary.yml"
+          fi
 
       - name: List artifacts
         run: |

.github/workflows/release-desktop.yml

@@ -86,6 +86,14 @@ jobs:
               echo "Created stable copy: ADE-${arch}.AppImage"
             fi
           done
+          for file in *.exe; do
+            if [[ -f "$file" && "$file" != *.__uninstaller.exe ]]; then
+              # Extract architecture from filename (e.g., ADE-1.0.3-x64.exe -> x64)
+              arch=$(echo "$file" | sed -E 's/.*-([^-]+)\.exe$/\1/')
+              cp "$file" "ADE-${arch}.exe"
+              echo "Created stable copy: ADE-${arch}.exe"
+            fi
+          done
           # Keep Linux updater manifest at a stable filename for generic provider lookups.
           for file in *-linux.yml; do
             if [[ -f "$file" && "$file" != "latest-linux.yml" ]]; then

README.md

@@ -1,6 +1,6 @@
 # ADE
 
-An agentic development environment for macOS. ADE is a local-first, single-user desktop app where you build a roster of persistent coding agents and work alongside them in the terminal. Every agent is a durable identity — its own name, photo, git repository, runtime CLI, and long-lived memory — not a throwaway chat session. You come back to the same agent tomorrow and it remembers what it learned today.
+An agentic development environment for macOS, Windows, and Linux. ADE is a local-first, single-user desktop app where you build a roster of persistent coding agents and work alongside them in the terminal. Every agent is a durable identity — its own name, photo, git repository, runtime CLI, and long-lived memory — not a throwaway chat session. You come back to the same agent tomorrow and it remembers what it learned today.
 
 The interface is a two-level left rail. **Teams** group your work (a name and a square photo); inside each team live **Agents** (a name and a circular photo). Selecting an agent opens its workspace: a strip of **session** tabs, each a real terminal running the agent's coding CLI inside that agent's own git worktree. A **model bar** under the tabs lets you spawn a session on a different model without leaving the agent. On the right, the **Agent Files** panel shows the agent's memory growing as it works.
 
@@ -16,16 +16,19 @@ ADE runs whatever CLI coding agents you already have installed. Claude Code, Ope
 
 ### Download (recommended)
 
-Download the signed DMG from the [latest release](https://github.com/per-simmons/damon-ade/releases/latest), open it, and drag ADE to your Applications folder. macOS only.
+Download the installer for your platform from the [latest release](https://github.com/per-simmons/damon-ade/releases/latest):
 
+- macOS: signed `.dmg`
+- Windows: `ADE-<version>-x64.exe`
+- Linux: `.AppImage`
 
 ### Build from source
 
-Requires [Bun](https://bun.sh) 1.0+.
+Requires [Bun](https://bun.sh) 1.3.6+.
 
 ```bash
 git clone https://github.com/per-simmons/damon-ade.git
-cd REPO
+cd damon-ade
 bun install
 cd apps/desktop
 bun run compile:app        # builds main + preload + renderer into dist/
@@ -34,11 +37,19 @@ bunx electron .            # launches the built app
 
 `compile:app` runs the full production build; `bunx electron .` then launches it directly. (Avoid `electron-vite preview` for a full run — it can exhaust memory.)
 
+To package a desktop installer from `apps/desktop`, run:
+
+```bash
+bun run build
+```
+
+On Windows, the installer is written to `apps/desktop/release/ADE-<version>-x64.exe`.
+
 ## Prerequisites
 
 ADE orchestrates coding CLIs; it does not bundle them. You need:
 
-- **Git** — required. Each agent gets its own repository or worktree. Install Apple's command line tools with `xcode-select --install`.
+- **Git** — required. Each agent gets its own repository or worktree. On macOS, install Apple's command line tools with `xcode-select --install`; on Windows, install [Git for Windows](https://git-scm.com/download/win).
 - **At least one agent CLI.** Claude Code is recommended, because it also powers the Kimi, MiniMax, and GLM sessions from the model bar (they run Claude Code pointed at OpenRouter):
 
   ```bash
@@ -75,7 +86,7 @@ ADE orchestrates coding CLIs; it does not bundle them. You need:
 
 **6. Switch models from the model bar.** Below the session tabs is a quiet row of model logos: **Claude** (the default), **OpenAI** (Codex on GPT-5.5), **Kimi K2.7**, **MiniMax M3**, and **GLM 5.2**. Click any logo to open a new session in the current agent's worktree running that model — the same code, a different model, no context switch.
 
-**7. Connect OpenRouter (first open model only).** The first time you click Kimi, MiniMax, or GLM, ADE asks for your OpenRouter API key (get one at [openrouter.ai/keys](https://openrouter.ai/keys)). Paste it and choose **Save & Launch**. The key is encrypted with the macOS keychain, stored locally, and injected only into the agent's terminal — it never leaves your machine and is never shown back to the app's UI. You enter it once; later open-model sessions launch straight away.
+**7. Connect OpenRouter (first open model only).** The first time you click Kimi, MiniMax, or GLM, ADE asks for your OpenRouter API key (get one at [openrouter.ai/keys](https://openrouter.ai/keys)). Paste it and choose **Save & Launch**. The key is encrypted with the OS credential store, stored locally, and injected only into the agent's terminal — it never leaves your machine and is never shown back to the app's UI. You enter it once; later open-model sessions launch straight away.
 
 **8. Watch the memory grow.** The **Agent Files** panel on the right lists the agent's memory surface, grouped into **Memory**, **Skills**, and **Worktree**. It starts nearly empty and fills in as the agent learns — its identity, your profile, its notes, and any skills it writes for itself. Click a file to open it in a viewer tab.
 

apps/admin/package.json

@@ -6,7 +6,7 @@
 	"scripts": {
 		"build": "next build",
 		"clean": "git clean -xdf .cache .next .turbo node_modules",
-		"dev": "dotenv -e ../../.env -- sh -c 'next dev --port ${ADMIN_PORT:-3003}'",
+		"dev": "dotenv -e ../../.env -- bun run ../../scripts/next-dev.ts ADMIN_PORT 3003",
 		"start": "next start",
 		"typecheck": "tsc --noEmit"
 	},

apps/api/package.json

@@ -6,7 +6,7 @@
 	"scripts": {
 		"build": "next build",
 		"clean": "git clean -xdf .cache .next .turbo node_modules",
-		"dev": "dotenv -e ../../.env -- sh -c 'next dev --port ${API_PORT:-3001}'",
+		"dev": "dotenv -e ../../.env -- bun run ../../scripts/next-dev.ts API_PORT 3001",
 		"start": "next start --port 3001",
 		"typecheck": "tsc --noEmit"
 	},

apps/desktop/BUILDING.md

@@ -10,7 +10,24 @@ This skips environment variable validation and the sign-in screen, useful for lo
 
 # Release
 
-When building for release, make sure `node-pty` is built for the correct architecture with `bun run install:deps`, then run `bun run release`.
+When building for release, run `bun run prebuild` first so native modules are copied into the desktop package and validated, then run `bun run release`.
+
+# Windows (NSIS) local build
+
+From `apps/desktop` in PowerShell, cmd, or Git Bash:
+
+```bash
+bun run clean:dev
+bun run compile:app
+bun run package -- --publish never --config electron-builder.ts
+```
+
+Expected outputs in `apps/desktop/release/`:
+
+- `ADE-<version>-x64.exe`
+- `latest.yml` (Windows auto-update manifest)
+
+Unsigned local Windows builds leave executable signing/resource editing off by default unless Windows signing credentials are configured. Set `ADE_WIN_EDIT_EXECUTABLE=true` to force executable metadata/icon editing in a Developer Mode or elevated shell.
 
 # Linux (AppImage) local build
 
@@ -36,4 +53,4 @@ ls -la release/*.AppImage
 ls -la release/*-linux.yml
 ```
 
-If both files exist, packaging produced the Linux artifact + updater metadata that `electron-updater` expects.
+If both files exist, packaging produced the Linux artifact + updater metadata that `electron-updater` expects.

apps/desktop/RELEASE.md

@@ -60,8 +60,10 @@ Releases. Replace `ade` (and confirm the owner) below:
 
 - **macOS manifest**: `https://github.com/per-simmons/damon-ade/releases/latest/download/latest-mac.yml`
 - **Linux manifest**: `https://github.com/per-simmons/damon-ade/releases/latest/download/latest-linux.yml`
+- **Windows manifest**: `https://github.com/per-simmons/damon-ade/releases/latest/download/latest.yml`
 - **macOS installer**: `https://github.com/per-simmons/damon-ade/releases/latest/download/ADE-arm64.dmg`
 - **Linux installer**: `https://github.com/per-simmons/damon-ade/releases/latest/download/ADE-x64.AppImage`
+- **Windows installer**: `https://github.com/per-simmons/damon-ade/releases/latest/download/ADE-x64.exe`
 
 The workflow creates stable-named copies (without version) so these URLs always point to the latest build.
 
@@ -75,6 +77,12 @@ macOS code signing uses these repository secrets:
 - `MAC_CERTIFICATE` / `MAC_CERTIFICATE_PASSWORD`
 - `APPLE_ID` / `APPLE_ID_PASSWORD` / `APPLE_TEAM_ID`
 
+Windows code signing uses the standard electron-builder variables when present:
+
+- `WIN_CSC_LINK` / `WIN_CSC_KEY_PASSWORD`
+- or `CSC_LINK` / `CSC_KEY_PASSWORD`
+- or Azure Trusted Signing variables
+
 ## Local Testing
 
 ```bash
@@ -91,8 +99,15 @@ Linux output should include:
 - `*.AppImage`
 - `*-linux.yml` (auto-update manifest)
 
+Windows output should include:
+
+- `ADE-<version>-x64.exe`
+- `latest.yml` (auto-update manifest)
+
 ## Troubleshooting
 
 - **Linux auto-update not working**: Verify `release/*-linux.yml` is uploaded to the GitHub release
+- **Windows auto-update not working**: Verify `release/latest.yml` and the matching `.exe` are uploaded to the GitHub release
 - **Build icon warnings/failures**: Add icons under `src/resources/build/icons/` (`icon.icns`, `icon.ico`, optional Linux `.png`)
 - **Native module errors**: Ensure `node-pty` is in externals in both `electron.vite.config.ts` and `electron-builder.ts`
+- **Windows symlink errors while packaging**: Run from Developer Mode/elevated shell, or leave executable editing disabled for unsigned local builds

apps/desktop/create-release.sh

@@ -441,6 +441,7 @@ else
         echo -e "${BLUE}Direct download:${NC}"
         echo "  • ${LATEST_URL}/download/ADE-arm64.dmg"
         echo "  • ${LATEST_URL}/download/ADE-x64.AppImage"
+        echo "  • ${LATEST_URL}/download/ADE-x64.exe"
         echo ""
     else
         success "Draft release created!"

apps/desktop/electron-builder.ts

@@ -25,6 +25,15 @@ const RELEASE_REPO_NAME = "damon-ade"; // TODO(release): set public repo name
 // notarytool. Unsigned local smoke-test builds leave APPLE_TEAM_ID unset and
 // skip notarization automatically.
 const notarize = Boolean(process.env.APPLE_TEAM_ID);
+const hasWindowsSigningConfig = Boolean(
+	process.env.WIN_CSC_LINK ||
+		process.env.CSC_LINK ||
+		process.env.WIN_CSC_NAME ||
+		process.env.CSC_NAME ||
+		process.env.AZURE_TENANT_ID,
+);
+const shouldSignAndEditWindowsExecutable =
+	hasWindowsSigningConfig || process.env.ADE_WIN_EDIT_EXECUTABLE === "true";
 const macIconPath = join(pkg.resources, "build/icons/icon.icns");
 const linuxIconPath = join(pkg.resources, "build/icons");
 const winIconPath = join(pkg.resources, "build/icons/icon.ico");
@@ -151,8 +160,10 @@ const config: Configuration = {
 		"!**/.DS_Store",
 	],
 
-	// Rebuild native modules for Electron's Node.js version
-	npmRebuild: true,
+	// Native modules are prepared by scripts/copy-native-modules.ts and
+	// validated before packaging. Rebuilding here forces node-gyp for node-pty
+	// on Windows even though node-pty ships prebuilds for win32-x64/win32-arm64.
+	npmRebuild: false,
 
 	// macOS
 	mac: {
@@ -211,6 +222,7 @@ const config: Configuration = {
 	// Windows
 	win: {
 		...(existsSync(winIconPath) ? { icon: winIconPath } : {}),
+		signAndEditExecutable: shouldSignAndEditWindowsExecutable,
 		target: [
 			{
 				target: "nsis",