Add initial Windows port for the desktop app

.github/workflows/ci.yml

@@ -73,6 +73,50 @@ jobs:
           test -f apps/desktop/dist-electron/preload.js
           grep -nE "desktopBridge|getWsUrl|PICK_FOLDER_CHANNEL|wsUrl" apps/desktop/dist-electron/preload.js
 
+  desktop_windows:
+    name: Windows Desktop Build
+    runs-on: windows-2022
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: package.json
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+
+      - name: Cache Bun, Turbo, and electron-builder
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.bun/install/cache
+            ~\AppData\Local\electron-builder\Cache
+            .turbo
+          key: ${{ runner.os }}-desktop-${{ hashFiles('bun.lock') }}-${{ hashFiles('turbo.json') }}
+          restore-keys: |
+            ${{ runner.os }}-desktop-${{ hashFiles('bun.lock') }}-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build Windows desktop artifact
+        run: bun run dist:desktop:artifact -- --platform win --target nsis --arch x64 --verbose
+
+      - name: Upload Windows desktop artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: desktop-windows-x64
+          path: |
+            release/*.exe
+            release/*.exe.blockmap
+            release/builder-debug.yml
+          if-no-files-found: error
+
   release_smoke:
     name: Release Smoke
     runs-on: ubuntu-24.04

scripts/build-desktop-artifact.ts

@@ -506,6 +506,14 @@ const createBuildConfig = Effect.fn("createBuildConfig")(function* (
     };
     if (signed) {
       winConfig.azureSignOptions = yield* AzureTrustedSigningOptionsConfig;
+    } else {
+      // Production dependencies are installed into the staged app ahead of packaging.
+      // Skip electron-builder's extra native rebuild step so Windows builds can use
+      // shipped prebuilds like node-pty instead of requiring local Spectre libs.
+      buildConfig.npmRebuild = false;
+      // Unsigned local builds shouldn't need the Windows code-signing toolchain or
+      // rcedit metadata pass; skipping it avoids symlink-privileged cache extraction.
+      winConfig.signAndEditExecutable = false;
     }
     buildConfig.win = winConfig;
   }

scripts/generate-brand-assets.py

@@ -28,13 +28,11 @@ def resize(img: Image.Image, size: int) -> Image.Image:
 
 
 def save_ico(path: Path, source: Image.Image, sizes: tuple[int, ...]) -> None:
-    images = [resize(source, s) for s in sizes]
     path.parent.mkdir(parents=True, exist_ok=True)
-    images[0].save(
+    source.save(
         path,
         format="ICO",
         sizes=[(s, s) for s in sizes],
-        append_images=images[1:],
     )