Fix/windows acceptance

.github/workflows/publish.yml

@@ -118,7 +118,7 @@ jobs:
       - name: Build (release identity pinned)
         id: build
         run: |
-          ./packages/deepagent-code/script/build.ts ${{ (needs.version.outputs.channel == 'beta' && '--sourcemaps') || '' }}
+          ./packages/deepagent-code/script/build.ts --exclude-win32 ${{ (needs.version.outputs.channel == 'beta' && '--sourcemaps') || '' }}
           ./packages/cli/script/build.ts ${{ (needs.version.outputs.channel == 'beta' && '--sourcemaps') || '' }}
           # Ship the authorization row at every binary's appRoot (dirname of the executable —
           # V2OwnerSeed.defaultOwnerAuthorizationAppRoot) so default installs self-qualify.
@@ -153,6 +153,15 @@ jobs:
           path: ${{ runner.temp }}/owner-authorization.json
           if-no-files-found: warn
 
+      # Public half of the ephemeral release owner key: the native Windows build job pins the
+      # same key into its binaries via DEEPAGENT_CODE_RELEASE_OWNER_PUBLIC_KEY, keeping one
+      # build identity across every platform artifact. Public material — safe as an artifact.
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: release-owner-public-key
+          path: ${{ runner.temp }}/release-owner-public-key.pem
+          if-no-files-found: warn
+
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: deepagent-code-cli
@@ -162,11 +171,6 @@ jobs:
             packages/deepagent-code/dist/deepagent-code-darwin*.zip
             packages/deepagent-code/dist/deepagent-code-linux*.tar.gz
 
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: deepagent-code-cli-windows
-          path: packages/deepagent-code/dist/deepagent-code-windows*
-
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: deepagent-code-preview-cli
@@ -175,9 +179,67 @@ jobs:
     outputs:
       version: ${{ needs.version.outputs.version }}
 
-  sign-cli-windows:
+  # Windows binaries build NATIVELY on a Windows runner: bun cross-compilation with the large
+  # embedded web UI produced non-starting Windows PEs when the build host was macOS (verified on
+  # the acceptance box), and native builds have been validated end-to-end there dozens of times.
+  # The build script's own smoke test actually executes the exe here, so a broken build fails CI.
+  build-cli-windows:
     needs:
+      - version
       - build-cli
+    runs-on: blacksmith-4vcpu-windows-2025
+    if: github.repository == 'deepagent-ltd/deepagent-code'
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        with:
+          ref: ${{ needs.version.outputs.candidate_commit }}
+          fetch-tags: true
+
+      - uses: ./.github/actions/setup-bun
+
+      - name: Setup git committer
+        id: committer
+        uses: ./.github/actions/setup-git-committer
+        with:
+          deepagent-code-app-id: ${{ vars.DEEPAGENT_CODE_APP_ID }}
+          deepagent-code-app-secret: ${{ secrets.DEEPAGENT_CODE_APP_SECRET }}
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: owner-authorization
+          path: ${{ runner.temp }}/owner-auth
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: release-owner-public-key
+          path: ${{ runner.temp }}/owner-key
+
+      - name: Build (release identity pinned, native)
+        shell: bash
+        run: |
+          bun install
+          cd packages/deepagent-code
+          bun script/build.ts --single --baseline ${{ (needs.version.outputs.channel == 'beta' && '--sourcemaps') || '' }}
+          for dir in dist/deepagent-code-*/bin; do
+            [ -d "$dir" ] && cp "$RUNNER_TEMP/owner-auth/owner-authorization.json" "$dir/owner-authorization.json"
+          done
+        env:
+          DEEPAGENT_CODE_VERSION: ${{ needs.version.outputs.version }}
+          DEEPAGENT_CODE_CHANNEL: ${{ needs.version.outputs.channel }}
+          DEEPAGENT_CODE_RELEASE: ${{ needs.version.outputs.release }}
+          DEEPAGENT_CODE_RELEASE_OWNER_AUTHORIZATION_FILE: ${{ runner.temp }}/owner-auth/owner-authorization.json
+          DEEPAGENT_CODE_RELEASE_OWNER_PUBLIC_KEY: ${{ runner.temp }}/owner-key/release-owner-public-key.pem
+          GH_REPO: ${{ needs.version.outputs.repo }}
+          GH_TOKEN: ${{ steps.committer.outputs.token }}
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: deepagent-code-cli-windows
+          path: packages/deepagent-code/dist/deepagent-code-windows*
+
+  sign-cli-windows:
+    needs:
+      - build-cli-windows
       - version
     runs-on: blacksmith-4vcpu-windows-2025
     if: github.repository == 'deepagent-ltd/deepagent-code'
@@ -269,6 +331,7 @@ jobs:
   build-electron:
     needs:
       - build-cli
+      - build-cli-windows
       - version
     if: github.repository == 'deepagent-ltd/deepagent-code'
     continue-on-error: false
@@ -452,6 +515,7 @@ jobs:
     needs:
       - version
       - build-cli
+      - build-cli-windows
       - sign-cli-windows
       - build-electron
     if: always() && !failure() && !cancelled() && needs.version.outputs.channel != 'beta'

CHANGELOG.md

@@ -6,6 +6,26 @@ This changelog contains public, user-facing product changes. Internal incident i
 
 Release labels: `core-v2.0.2` and `desktop-v2.0.2` (`2.0.2`).
 
+### Windows
+
+- Fixed a startup crash that hit Windows installs on every launch after the one-time data migration had completed, as well as in the migration-guarded and migration-failed paths.
+- The interactive TUI now starts on Windows; it previously crashed during the first draw.
+- Hardened the CLI runtime and file-search picker against two crash classes found in short-lived Windows commands.
+
+### Terminal (web & desktop)
+
+- The terminal panel no longer sticks on "Loading terminal..." when a session opens in a fresh page load: terminals now start automatically within seconds, and a failed readiness probe retries instead of deadlocking the panel.
+
+### Security and configuration
+
+- Plaintext MCP server secrets found in config files are now erased exactly where they came from: migration rewrites the originating file in place (comments preserved) after moving each secret into the OS credential store (DPAPI on Windows), transactionally and idempotently — the plaintext no longer survives on disk.
+- Instance-level configuration updates made through the HTTP config API now persist to the project config file that is actually loaded, instead of a file nothing reads back.
+
+### Release engineering
+
+- Windows release binaries are now built natively on Windows runners in CI instead of cross-compiled; the build pipeline executes the produced executable as a smoke test, so a non-starting Windows build fails the release instead of shipping.
+- Embedded web UI builds start from a clean output directory so stale chunks from an interrupted build cannot ship inside the binary.
+
 ### Sessions and history
 
 - Legacy sessions no longer accept writes through the old surfaces: editing or deleting historical message parts returns typed guidance to adopt the session instead of silently writing the legacy projection, and sharing actions validate session state first, with conflicts surfaced honestly in the UI.