fix(desktop): make Windows package rebuild transactional and self-healing

.github/pr91079-actions-kick

@@ -0,0 +1 @@
+retrigger fork final-tree publisher from ae143040a06d04210b6449624a6ebd13b12ccc73

.github/pr91079-actions-kick-2

@@ -0,0 +1 @@
+retrigger exact-current-main materializer

.github/workflows/pr91079-materialize-patch.yml

@@ -0,0 +1,47 @@
+name: PR 91079 upstream commit-object authority probe
+
+on:
+  pull_request:
+    types: [synchronize, edited]
+
+permissions:
+  contents: write
+
+jobs:
+  probe:
+    if: >-
+      github.event.pull_request.number == 91079 &&
+      github.event.pull_request.head.repo.full_name == 'andrexibiza/hermes-agent' &&
+      github.event.pull_request.head.ref == 'fix/windows-desktop-pack-transaction'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Create one unreferenced exact-author commit object
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          repo="$GITHUB_REPOSITORY"
+          main_sha="$(gh api "repos/$repo/git/ref/heads/main" --jq '.object.sha')"
+          main_tree="$(gh api "repos/$repo/git/commits/$main_sha" --jq '.tree.sha')"
+          authored_at="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
+
+          jq -n \
+            --arg message 'chore(pr91079): verify upstream commit-object authority' \
+            --arg tree "$main_tree" \
+            --arg parent "$main_sha" \
+            --arg name 'Axl Ibiza, MBA' \
+            --arg email 'andrexibiza@gmail.com' \
+            --arg date "$authored_at" \
+            '{message:$message, tree:$tree, parents:[$parent], author:{name:$name,email:$email,date:$date}, committer:{name:$name,email:$email,date:$date}}' \
+            | gh api --method POST "repos/$repo/git/commits" --input - > "$RUNNER_TEMP/commit.json"
+
+          object_sha="$(jq -r '.sha' "$RUNNER_TEMP/commit.json")"
+          test -n "$object_sha"
+          gh api "repos/$repo/git/commits/$object_sha" > "$RUNNER_TEMP/verified.json"
+          test "$(jq -r '.author.name' "$RUNNER_TEMP/verified.json")" = 'Axl Ibiza, MBA'
+          test "$(jq -r '.author.email' "$RUNNER_TEMP/verified.json")" = 'andrexibiza@gmail.com'
+          test "$(jq -r '.committer.name' "$RUNNER_TEMP/verified.json")" = 'Axl Ibiza, MBA'
+          test "$(jq -r '.committer.email' "$RUNNER_TEMP/verified.json")" = 'andrexibiza@gmail.com'
+          echo "created_unreferenced_commit_object=$object_sha"

.github/workflows/pr91079-publish-final.yml

@@ -0,0 +1,23 @@
+name: PR 91079 Actions execution probe
+
+on:
+  push:
+    branches:
+      - fix/windows-desktop-pack-transaction
+
+permissions:
+  contents: read
+
+jobs:
+  probe:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Record exact event object
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "repository=$GITHUB_REPOSITORY"
+          echo "ref=$GITHUB_REF"
+          echo "sha=$GITHUB_SHA"
+          test "$GITHUB_REPOSITORY" = "andrexibiza/hermes-agent"
+          test "$GITHUB_REF_NAME" = "fix/windows-desktop-pack-transaction"

apps/desktop/package.json

@@ -28,7 +28,7 @@
     "profile:main:cpu": "tsc --build tsconfig.electron.json && wait-on http://127.0.0.1:5174 && node scripts/bundle-electron-main.mjs --dev && cross-env XCURSOR_SIZE=24 NODE_OPTIONS=--cpu-prof HERMES_DESKTOP_DEV_SERVER=http://127.0.0.1:5174 electron .",
     "start": "npm run build && electron .",
     "prebuild": "npm run clean",
-    "build": "node scripts/assert-root-install.mjs && node scripts/write-build-stamp.mjs && vite build && node scripts/bundle-electron-main.mjs && node scripts/stage-native-deps.mjs",
+    "build": "node scripts/assert-root-install.mjs && node scripts/write-build-stamp.mjs && vite build && node scripts/bundle-electron-main.mjs && node scripts/stage-native-deps-recovery.mjs",
     "postbuild": "node scripts/assert-dist-built.mjs",
     "prebuilder": "node scripts/patch-electron-builder-mac-binary.mjs",
     "builder": "cross-env NODE_OPTIONS=--max-old-space-size=16384 node scripts/run-electron-builder.mjs",
@@ -71,7 +71,7 @@
     "check:test:ui:shard-1of3": "node scripts/run-ui-shard.mjs",
     "check:test:ui:shard-2of3": "node scripts/run-ui-shard.mjs",
     "check:test:ui:shard-3of3": "node scripts/run-ui-shard.mjs",
-    "check:test:desktop:all": "npm run test:desktop:all",
+    "check:test:desktop:all": "node --test scripts/stage-native-deps-recovery.test.mjs && npm run test:desktop:all",
     "check:lint": "npm run typecheck && npm run lint",
     "check": "npm run check:lint && npm run test:ui && npm run test:desktop:platforms && npm run test:desktop:all",
     "test:e2e": "npm run build && playwright test e2e/",
@@ -212,7 +212,7 @@
       "package.json"
     ],
     "beforeBuild": "scripts/before-build.mjs",
-    "beforePack": "scripts/before-pack.mjs",
+    "beforePack": "scripts/before-pack-recovery.mjs",
     "afterPack": "scripts/after-pack.mjs",
     "extraResources": [
       {

apps/desktop/scripts/before-pack-recovery.mjs

@@ -0,0 +1,45 @@
+// Recovery wrapper around the canonical electron-builder beforePack hook.
+// The base hook remains the owner of stale-app cleanup, rollback preservation,
+// and native staging. This wrapper handles only one residual: a corrupt or
+// unresolvable get-windows package root on a supported native build host.
+
+import { Arch } from 'electron-builder'
+
+import beforePack from './before-pack.mjs'
+import {
+  isMissingGetWindowsPackageError,
+  stageGetWindowsWithRecovery
+} from './stage-native-deps-recovery.mjs'
+
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error)
+}
+
+export default async function beforePackWithRecovery(context) {
+  try {
+    return await beforePack(context)
+  } catch (error) {
+    if (!isMissingGetWindowsPackageError(error)) {
+      throw error
+    }
+
+    const platform = context && context.electronPlatformName
+    const arch = context && typeof context.arch === 'number' ? Arch[context.arch] : undefined
+    if (!platform || !arch) {
+      throw error
+    }
+
+    console.warn(
+      `[before-pack] canonical native staging found a corrupt get-windows package root; ` +
+        `retrying ${platform}-${arch} from an isolated dependency realization`
+    )
+    try {
+      stageGetWindowsWithRecovery({ platform, arch })
+      console.log(`[before-pack] recovered and staged get-windows for target ${platform}-${arch}`)
+    } catch (recoveryError) {
+      throw new Error(
+        `[before-pack] isolated get-windows recovery failed for ${platform}-${arch}: ${errorMessage(recoveryError)}`
+      )
+    }
+  }
+}