feat(desktop): Windows native port

.github/workflows/build-desktop.yml

@@ -143,6 +143,89 @@ jobs:
           retention-days: ${{ inputs.artifact_retention_days }}
           if-no-files-found: error
 
+  build-windows:
+    name: Build - Windows (x64)
+    runs-on: windows-latest
+    environment: production
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Enable git long paths
+        run: git config --global core.longpaths true
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: "1.3.2"
+
+      - name: Cache dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+
+      - name: Install dependencies
+        run: bun install --frozen
+
+      - name: Set version suffix
+        if: inputs.version_suffix != ''
+        working-directory: apps/desktop
+        shell: bash
+        run: |
+          CURRENT_VERSION=$(node -p "require('./package.json').version")
+          NEW_VERSION="${CURRENT_VERSION}${{ inputs.version_suffix }}"
+          node -e "
+            const fs = require('fs');
+            const pkg = require('./package.json');
+            pkg.version = '$NEW_VERSION';
+            fs.writeFileSync('./package.json', JSON.stringify(pkg, null, '\t') + '\n');
+          "
+
+      - name: Clean dev folder
+        working-directory: apps/desktop
+        run: bun run clean:dev
+
+      - name: Generate icons
+        working-directory: apps/desktop
+        run: bun run generate:icons
+
+      - name: Compile app
+        working-directory: apps/desktop
+        run: bun run compile:app
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_DSN_DESKTOP: ${{ secrets.SENTRY_DSN_DESKTOP }}
+
+      - name: Copy native modules
+        working-directory: apps/desktop
+        run: bun run copy:native-modules
+
+      - name: Validate native runtime
+        working-directory: apps/desktop
+        run: bun run validate:native-runtime
+
+      - name: Build installer
+        working-directory: apps/desktop
+        run: bun run build
+        env:
+          CSC_IDENTITY_AUTO_DISCOVERY: "false"
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ inputs.artifact_prefix }}-windows-x64
+          path: |
+            apps/desktop/release/*.exe
+            apps/desktop/release/*.yml
+            apps/desktop/release/*.blockmap
+          retention-days: ${{ inputs.artifact_retention_days }}
+          if-no-files-found: error
+
   build-linux:
     name: Build - Linux (x64)
     runs-on: ubuntu-latest

.github/workflows/ci.yml

@@ -130,3 +130,25 @@ jobs:
         env:
           NEXT_PUBLIC_OUTLIT_KEY: ${{ secrets.NEXT_PUBLIC_OUTLIT_KEY || 'ci-outlit-placeholder-key' }}
         run: bun turbo run build --filter=@superset/desktop
+
+  test-windows:
+    name: Test (Windows)
+    runs-on: windows-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Enable git long paths
+        run: git config --global core.longpaths true
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: "1.3.2"
+
+      - name: Install dependencies
+        run: bun install --frozen
+
+      - name: Run desktop tests
+        working-directory: apps/desktop
+        run: bun test

.github/workflows/release-desktop.yml

@@ -86,6 +86,14 @@ jobs:
               echo "Created stable copy: Superset-${arch}.AppImage"
             fi
           done
+          # Windows exe
+          for file in *.exe; do
+            if [[ -f "$file" ]]; then
+              arch=$(echo "$file" | sed -E 's/.*-([^-]+)\.exe$/\1/')
+              cp "$file" "Superset-${arch}.exe"
+              echo "Created stable copy: Superset-${arch}.exe"
+            fi
+          done
           # Keep Linux updater manifest at a stable filename for generic provider lookups.
           for file in *-linux.yml; do
             if [[ -f "$file" && "$file" != "latest-linux.yml" ]]; then

README.md

@@ -63,12 +63,21 @@ If it runs in a terminal, it runs on Superset
 
 | Requirement | Details |
 |:------------|:--------|
-| **OS** | macOS (Windows/Linux untested) |
+| **OS** | macOS, Windows 10+ (Linux untested) |
 | **Runtime** | [Bun](https://bun.sh/) v1.0+ |
 | **Version Control** | Git 2.20+ |
 | **GitHub CLI** | [gh](https://cli.github.com/) |
 | **Caddy** | [caddy](https://caddyserver.com/docs/install) (for dev server) |
 
+### Windows Support
+
+| Requirement | Details |
+|---|---|
+| OS | Windows 10 1809+ (ConPTY support required) |
+| Developer Mode | Enable in Settings > Privacy & Security > For developers |
+| Git long paths | `git config --global core.longpaths true` |
+| Build Tools | Visual Studio Build Tools with "Desktop development with C++" (for native modules) |
+
 ## Getting Started
 
 ### Quick Start (Pre-built)

apps/desktop/electron-builder.ts

@@ -198,6 +198,8 @@ const config: Configuration = {
 			},
 		],
 		artifactName: `${productName}-${pkg.version}-\${arch}.\${ext}`,
+		signAndEditExecutable: false,
+		forceCodeSigning: false,
 	},
 
 	// NSIS installer (Windows)

apps/desktop/scripts/copy-native-modules.ts

@@ -99,8 +99,10 @@ function copyModuleIfSymlink(
 		console.log(`  ${moduleName}: symlink -> replacing with real files`);
 		console.log(`    Real path: ${realPath}`);
 
-		// Remove the symlink
-		rmSync(modulePath);
+		// Remove the symlink/junction
+		// On Windows, Bun creates junctions for symlinked node_modules.
+		// rmSync without options fails on junctions, so use recursive+force.
+		rmSync(modulePath, { recursive: true, force: true });
 
 		// Copy the actual files
 		cpSync(realPath, modulePath, { recursive: true });

apps/desktop/src/lib/trpc/routers/workspaces/utils/git.ts

@@ -1,6 +1,6 @@
-import { execFile, spawn } from "node:child_process";
+import { execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { mkdir, rename } from "node:fs/promises";
+import { mkdir, rename, rm } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { promisify } from "node:util";
 
@@ -680,26 +680,12 @@ export async function removeWorktree(
 		});
 
 		// Delete the moved directory in the background — don't block the caller.
-		// Use spawned `rm -rf` instead of Node's fs.rm which can hang on macOS
-		// when encountering .app bundles with extended attributes.
-		const child = spawn("/bin/rm", ["-rf", tempPath], {
-			detached: true,
-			stdio: "ignore",
-		});
-		child.unref();
-		child.on("error", (err) => {
+		rm(tempPath, { recursive: true, force: true }).catch((err) => {
 			console.error(
-				`[removeWorktree] Failed to spawn rm for ${tempPath}:`,
+				`[removeWorktree] Background cleanup of ${tempPath} failed:`,
 				err.message,
 			);
 		});
-		child.on("exit", (code: number | null) => {
-			if (code !== 0) {
-				console.error(
-					`[removeWorktree] Background cleanup of ${tempPath} failed (exit ${code})`,
-				);
-			}
-		});
 	} catch (error) {
 		const code = (error as NodeJS.ErrnoException).code;
 		// If the worktree directory is already gone, just prune metadata

apps/desktop/src/lib/trpc/routers/workspaces/utils/shell-env.ts

@@ -54,6 +54,20 @@ async function getShellEnvWithTimeout(): Promise<Record<string, string>> {
  * Results are cached for 1 minute to avoid spawning shells repeatedly.
  */
 export async function getShellEnvironment(): Promise<Record<string, string>> {
+	// Windows: process.env already contains the full user environment.
+	// Unlike macOS GUI apps launched from Finder/Dock, Windows apps inherit
+	// the complete user environment including PATH modifications.
+	if (process.platform === "win32") {
+		const env: Record<string, string> = {};
+		for (const [key, value] of Object.entries(process.env)) {
+			if (typeof value === "string") {
+				env[key] = value;
+			}
+		}
+		return env;
+	}
+
+	// Existing macOS/Linux code follows...
 	const now = Date.now();
 	const ttl = isFallbackCache ? fallbackCacheTtlMs : CACHE_TTL_MS;
 	if (cachedEnv && now - cacheTime < ttl) {

apps/desktop/src/lib/trpc/routers/workspaces/utils/teardown.ts

@@ -5,8 +5,9 @@ import {
 	getCommandShellArgs,
 	getShellEnv,
 } from "main/lib/agent-setup/shell-wrappers";
-import { buildSafeEnv, sanitizeEnv } from "main/lib/terminal/env";
+import { buildSafeEnv, getDefaultShell, sanitizeEnv } from "main/lib/terminal/env";
 import { SUPERSET_DIR_NAME } from "shared/constants";
+import treeKill from "tree-kill";
 import { removeWorktree } from "./git";
 import { loadSetupConfig } from "./setup";
 
@@ -42,9 +43,7 @@ export async function runTeardown({
 	console.log(`[teardown] Running for "${workspaceName}": ${command}`);
 
 	try {
-		const shell =
-			process.env.SHELL ||
-			(process.platform === "darwin" ? "/bin/zsh" : "/bin/bash");
+		const shell = process.env.SHELL || getDefaultShell();
 		const supersetHomeDir =
 			process.env.SUPERSET_HOME_DIR || join(homedir(), SUPERSET_DIR_NAME);
 		const shellWrapperPaths = {
@@ -60,7 +59,8 @@ export async function runTeardown({
 		const output = await new Promise<string>((resolve, reject) => {
 			const child = spawn(shell, args, {
 				cwd: worktreePath,
-				detached: true,
+				detached: process.platform !== "win32",
+			...(process.platform === "win32" ? { windowsHide: true } : {}),
 				stdio: ["ignore", "pipe", "pipe"],
 				env: {
 					...baseEnv,
@@ -114,7 +114,14 @@ export async function runTeardown({
 						`[teardown] Timed out after ${TEARDOWN_TIMEOUT_MS}ms, killing process group`,
 					);
 					try {
-						if (child.pid) process.kill(-child.pid, "SIGKILL");
+						if (child.pid) {
+						if (process.platform === "win32") {
+							// Windows: can't use negative PID for process group kill
+							treeKill(child.pid, "SIGKILL");
+						} else {
+							process.kill(-child.pid, "SIGKILL");
+						}
+					}
 					} catch {}
 					reject(
 						new Error(`Teardown timed out after ${TEARDOWN_TIMEOUT_MS}ms`),

apps/desktop/src/main/lib/agent-setup/agent-wrappers-copilot.ts

@@ -8,7 +8,8 @@ import {
 } from "./agent-wrappers-common";
 import { HOOKS_DIR } from "./paths";
 
-export const COPILOT_HOOK_SCRIPT_NAME = "copilot-hook.sh";
+export const COPILOT_HOOK_SCRIPT_NAME =
+	process.platform === "win32" ? "copilot-hook.ps1" : "copilot-hook.sh";
 
 const COPILOT_HOOK_SIGNATURE = "# Superset copilot hook";
 const COPILOT_HOOK_VERSION = "v1";
@@ -17,7 +18,9 @@ export const COPILOT_HOOK_MARKER = `${COPILOT_HOOK_SIGNATURE} ${COPILOT_HOOK_VER
 const COPILOT_HOOK_TEMPLATE_PATH = path.join(
 	__dirname,
 	"templates",
-	"copilot-hook.template.sh",
+	process.platform === "win32"
+		? "copilot-hook.template.ps1"
+		: "copilot-hook.template.sh",
 );
 
 export function getCopilotHookScriptPath(): string {

apps/desktop/src/main/lib/agent-setup/agent-wrappers-gemini.ts

@@ -11,7 +11,8 @@ import {
 } from "./agent-wrappers-common";
 import { HOOKS_DIR } from "./paths";
 
-export const GEMINI_HOOK_SCRIPT_NAME = "gemini-hook.sh";
+export const GEMINI_HOOK_SCRIPT_NAME =
+	process.platform === "win32" ? "gemini-hook.ps1" : "gemini-hook.sh";
 
 const GEMINI_HOOK_SIGNATURE = "# Superset gemini hook";
 const GEMINI_HOOK_VERSION = "v1";
@@ -20,7 +21,9 @@ export const GEMINI_HOOK_MARKER = `${GEMINI_HOOK_SIGNATURE} ${GEMINI_HOOK_VERSIO
 const GEMINI_HOOK_TEMPLATE_PATH = path.join(
 	__dirname,
 	"templates",
-	"gemini-hook.template.sh",
+	process.platform === "win32"
+		? "gemini-hook.template.ps1"
+		: "gemini-hook.template.sh",
 );
 
 interface GeminiHookConfig {

apps/desktop/src/main/lib/agent-setup/notify-hook.ts

@@ -3,13 +3,16 @@ import path from "node:path";
 import { env } from "shared/env.shared";
 import { HOOKS_DIR } from "./paths";
 
-export const NOTIFY_SCRIPT_NAME = "notify.sh";
+export const NOTIFY_SCRIPT_NAME =
+	process.platform === "win32" ? "notify.ps1" : "notify.sh";
 export const NOTIFY_SCRIPT_MARKER = "# Superset agent notification hook";
 
 const NOTIFY_SCRIPT_TEMPLATE_PATH = path.join(
 	__dirname,
 	"templates",
-	"notify-hook.template.sh",
+	process.platform === "win32"
+		? "notify-hook.template.ps1"
+		: "notify-hook.template.sh",
 );
 
 function writeFileIfChanged(