Duct Desktop 0.4.1

What changed

Three release-pipeline defects that 0.4.0 made visible. A published release is
immutable, so a corrected build needs a version.

Fixed

• Windows was never offered a self-update. latest.json for 0.4.0 carried
  darwin and linux targets and no windows-x86_64, so every Windows install
  polled forever. Tauri signs the installer directly now, so the upload's
  *-setup.nsis.zip.sig glob matched nothing — and if-no-files-found: error
  stayed quiet, because it asks whether any pattern matched and the .exe
  did. The signature uploads under either name and the job fails loudly when
  neither exists.
• The site had no download URL it could hold on to. Tauri puts the version
  in every filename, so releases/latest/download/<name> had nothing stable to
  redirect to and the page resolved the release through the GitHub API at
  runtime — an API call subject to CORS, rate limits and JavaScript, to answer
  a question that does not change between releases. Each installer is published
  a second time under a version-independent name.
• The site served a build from before September while every workflow stayed
  green. Cloudflare Pages' git integration decided whether to build from
  "Build watch paths", a dashboard-only setting that is not in this repository
  and had stopped matching site/**; a build it skips reports as skipped,
  which reads like "nothing to do". The site deploys from Actions now, gated on
  the checks in the same file.

Install

Duct Desktop runs the backend locally as a sidecar. No account is required and
no data leaves your machine — you bring your own model API key, stored in the
OS keychain.

macOS (Apple silicon) — download the .dmg, then drag Duct to
Applications. On first launch macOS may say the app cannot be verified; open it
once with right-click → Open, or clear the quarantine flag:

xattr -dr com.apple.quarantine /Applications/Duct.app

Windows — download and run the .exe installer. SmartScreen may warn on a
new signing identity; choose More info → Run anyway.

Linux — download the .AppImage, then:

chmod +x Duct_0.4.1_amd64.AppImage && ./Duct_0.4.1_amd64.AppImage

Existing installs update themselves — the app polls latest.json in this
release and verifies the signature before applying anything.

Downloads

File	Size	SHA-256
Duct_0.4.1_amd64.AppImage	81 MB	1700c738a4ece95f9f52961427b7040720e3630f81055e0ca535987d52425744
Duct_0.4.1_amd64.deb	8 MB	9af7036617e93fdf49ef43a49edb5d719242ed0d52acfe859337be9a2acaa41d
Duct_0.4.1_universal.dmg	12 MB	58ea6627a99d43cab9061409e0ff58ec847d10edad04316fc1e5f82de99f1d4f
Duct_0.4.1_x64-setup.exe	4 MB	e5c9e05bac670f409729b239c515c347b33a8b0a88bfd2dd43c3e7e82219f671

---

Duct is open source under the MIT licence.
Found a bug? Open an issue.
Found a vulnerability? Report it privately.

Duct Desktop 0.4.0

What changed

First version cut after the desktop shell became self-contained.

Added

• Local sidecar. The desktop bundle ships the FastAPI backend frozen by
  PyInstaller and runs it on loopback, so the app works with no server and no
  account. SQLite lives in the per-user data directory.
• Credential encryption on desktop. The shell mints a Fernet key into the OS
  keychain and passes it to the sidecar, so linking a data source can persist.
  Before this, connecting Google Ads completed OAuth and then failed to save.
• Sign-in that survives a frozen bundle. JWT_SECRET is generated once into
  a 0600 file in the data directory and reused across restarts.
• Browser-based OAuth for desktop, for both sign-in and connectors, over
  ai.getduct.desktop:// deep links carrying single-use codes rather than
  credentials.
• Model tiers. Heavy / Standard / Light, assigned per job in
  /settings/models.
• Connectors: Mixpanel, Microsoft Clarity, GrowthBook, Apple Search Ads,
  Meta Ads, OpenAI Ads, Stripe, RevenueCat, Google Tag Manager.
• Staged execution. Agents propose change sets against Google Ads and GA4;
  a human previews, approves and can roll back. No approve or apply tool exists
  in either harness.
• Agent memory. Bi-temporal, provenance-linked project memory with a
  timeline view.

Fixed

• A project with no project_members row disappeared from the owner's project
  list; migration a4d18e5c26bf backfills owner membership.
• A token that fails to resolve is rejected rather than treated as an anonymous
  caller.

Install

Duct Desktop runs the backend locally as a sidecar. No account is required and
no data leaves your machine — you bring your own model API key, stored in the
OS keychain.

macOS (Apple silicon) — download the .dmg, then drag Duct to
Applications. On first launch macOS may say the app cannot be verified; open it
once with right-click → Open, or clear the quarantine flag:

xattr -dr com.apple.quarantine /Applications/Duct.app

Windows — download and run the .exe installer. SmartScreen may warn on a
new signing identity; choose More info → Run anyway.

Linux — download the .AppImage, then:

chmod +x Duct_0.4.0_amd64.AppImage && ./Duct_0.4.0_amd64.AppImage

Existing installs update themselves — the app polls latest.json in this
release and verifies the signature before applying anything.

Downloads

File	Size	SHA-256
Duct_0.4.0_amd64.AppImage	81 MB	c4537e67f046260e18bf5fe860152a03a257e68a7a7db9b60e5d0a71589d77bc
Duct_0.4.0_amd64.deb	8 MB	db262f06c119646320eb8414b945ec7f91c8dabfff7e499dd1520d69fb454346
Duct_0.4.0_universal.dmg	12 MB	30829b8cd2db30a6fb76571e6fcf74a42d8919f96c15686515bf401e3c7fb178
Duct_0.4.0_x64-setup.exe	4 MB	863eb94af30f6954700cedbd8b30ddfa6e113c7c62666c1b9e272ecb188c51a6

---

Duct is open source under the MIT licence.
Found a bug? Open an issue.
Found a vulnerability? Report it privately.