Desktop 0.1.7

The one-click Windows build — bundles Node, boots the agent worker and the dashboard, opens it in a native window. No terminal, no npm.

147 MB, down from 260 MB in 0.1.6.

Why it shrank

That drop is a bug fix, not better compression.

The desktop app depends on merrymen as a local path, which npm resolves to a symlink pointing at the repo root. The packager followed that symlink and copied the entire tree — including the build output directory holding previously built installers. Every release was packaging the previous release inside itself. 0.1.6 went out carrying 0.1.5; the first 0.1.7 build came out at 520 MB. It doubled every time.

The obvious fix — exclusion patterns in the packager config — does not work here, and fails silently: exclusions are not applied inside a symlinked package. Seven patterns were added and the rebuilt bundle still contained every directory they named. That silence is how this survived six releases. What ships is now decided by the same files allowlist that governs the npm package, so there is one list instead of two and a new directory cannot reach an installer without first being something deliberately published.

On the local-state directory

The same over-broad copy also swept in .data/, the directory where an agent running from a source checkout keeps its settings and trade database.

The published 0.1.6 was audited before this release. The database inside it is an empty scaffold — schema only, zero rows across agents, trades, positions, equity, events and fee_accruals — and the settings file is {}, last modified more than two weeks before that build. No keys, addresses, or trade history were ever published. Nothing needs to be rotated.

The mechanism was still a genuine hazard: on a machine that had actually run an agent from a checkout, that directory holds real API keys, and it would have gone into a public installer. It is now excluded structurally rather than by a pattern that can quietly stop matching.

Verified against the packaged build, not the source tree

• Dashboard serves from the bundle — HTTP 200
• Worker starts under the bundled runtime and ticks live — reached mainnet block 22008707
• Bundle contains cli, node_modules, packages, strategies, web, worker and nothing else

Installing

Windows will show a SmartScreen warning, because the installer is unsigned. Click More info → Run anyway. If you would rather not, npm i -g merrymen gets you the same agent from a terminal.

To check what you downloaded:

Get-FileHash .\merrymen.Setup.0.1.7.exe -Algorithm SHA256

b9294b430da9010a7c12f0bce6a6657df03822ccbc15db92a1c46d21482b3418

macOS and Linux: npm i -g merrymen, then merrymen start.

Your keys stay on your machine. This app never sends them anywhere.