fix(desktop): update Windows executable in place

.github/scripts/generate-portable-update.mjs

@@ -0,0 +1,71 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { basename, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+function readOptions(args) {
+  const options = new Map();
+  for (let index = 0; index < args.length; index += 2) {
+    const name = args[index];
+    const value = args[index + 1];
+    if (!name?.startsWith("--") || value === undefined) {
+      throw new Error(`invalid argument near ${name ?? "end of command"}`);
+    }
+    options.set(name.slice(2), value);
+  }
+  return options;
+}
+
+function required(options, name) {
+  const value = options.get(name)?.trim();
+  if (!value) throw new Error(`--${name} is required`);
+  return value;
+}
+
+export function generatePortableUpdate({ version, repository, assetName, signature }) {
+  const normalizedVersion = version.replace(/^v/, "");
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(normalizedVersion)) {
+    throw new Error(`invalid semantic version: ${normalizedVersion}`);
+  }
+  if (!/^[^/\s]+\/[^/\s]+$/.test(repository)) {
+    throw new Error(`invalid GitHub repository: ${repository}`);
+  }
+  if (!assetName || basename(assetName) !== assetName) {
+    throw new Error("asset name must be a file name");
+  }
+  if (!signature.trim()) throw new Error("signature is required");
+
+  return {
+    version: normalizedVersion,
+    notes: `Cursor BYOK v${normalizedVersion}`,
+    pub_date: new Date().toISOString(),
+    platforms: {
+      "windows-x86_64": {
+        signature: signature.trim(),
+        url: `https://github.com/${repository}/releases/download/v${normalizedVersion}/${encodeURIComponent(assetName)}`,
+      },
+    },
+  };
+}
+
+async function main() {
+  const options = readOptions(process.argv.slice(2));
+  const version = required(options, "version");
+  const repository = required(options, "repository");
+  const asset = required(options, "asset");
+  const signaturePath = resolve(required(options, "signature"));
+  const output = resolve(required(options, "output"));
+  const manifest = generatePortableUpdate({
+    version,
+    repository,
+    assetName: basename(asset),
+    signature: await readFile(signaturePath, "utf8"),
+  });
+  await writeFile(output, `${JSON.stringify(manifest, null, 2)}\n`);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  main().catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  });
+}

.github/scripts/generate-portable-update.test.mjs

@@ -0,0 +1,41 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { generatePortableUpdate } from "./generate-portable-update.mjs";
+
+test("generates a signed Windows portable updater manifest", () => {
+  const manifest = generatePortableUpdate({
+    version: "v1.2.3-beta.1",
+    repository: "owner/repository",
+    assetName: "cursor-byok-1.2.3-beta.1-windows-amd64.zip",
+    signature: "signed-payload\n",
+  });
+
+  assert.equal(manifest.version, "1.2.3-beta.1");
+  assert.deepEqual(Object.keys(manifest.platforms), ["windows-x86_64"]);
+  assert.equal(manifest.platforms["windows-x86_64"].signature, "signed-payload");
+  assert.equal(
+    manifest.platforms["windows-x86_64"].url,
+    "https://github.com/owner/repository/releases/download/v1.2.3-beta.1/cursor-byok-1.2.3-beta.1-windows-amd64.zip",
+  );
+});
+
+test("rejects invalid inputs", () => {
+  assert.throws(() => generatePortableUpdate({
+    version: "latest",
+    repository: "owner/repository",
+    assetName: "update.zip",
+    signature: "signature",
+  }), /semantic version/);
+  assert.throws(() => generatePortableUpdate({
+    version: "1.2.3",
+    repository: "owner/repository",
+    assetName: "../update.zip",
+    signature: "signature",
+  }), /file name/);
+  assert.throws(() => generatePortableUpdate({
+    version: "1.2.3",
+    repository: "owner/repository",
+    assetName: "update.zip",
+    signature: " ",
+  }), /signature/);
+});

.github/workflows/release.yml

@@ -158,14 +158,27 @@ jobs:
           mkdir -p legacy-update
           tar -czf "legacy-update/cursor-byok-${VERSION}-linux-amd64.tar.gz" -C target/release cursor-byok-desktop
 
-      - name: Package legacy Windows updater asset
+      - name: Package and sign legacy Windows updater asset
         if: matrix.platform == 'windows-x86_64'
         shell: pwsh
         env:
           VERSION: ${{ needs.prepare.outputs.version }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: |
           New-Item -ItemType Directory -Force legacy-update | Out-Null
-          Compress-Archive -LiteralPath target/release/cursor-byok-desktop.exe -DestinationPath "legacy-update/cursor-byok-$env:VERSION-windows-amd64.zip"
+          $asset = "legacy-update/cursor-byok-$env:VERSION-windows-amd64.zip"
+          Compress-Archive -LiteralPath target/release/cursor-byok-desktop.exe -DestinationPath $asset
+          Push-Location apps/desktop
+          npm exec tauri signer sign -- "../../$asset"
+          Pop-Location
+          $entries = @(tar -tf $asset)
+          if ($entries.Count -ne 1 -or [System.IO.Path]::GetFileName($entries[0]) -ne 'cursor-byok-desktop.exe') {
+            throw "Windows updater archive must contain only cursor-byok-desktop.exe"
+          }
+          if (!(Test-Path "$asset.sig")) {
+            throw "Windows updater archive signature was not generated"
+          }
 
       - name: Package legacy macOS updater asset
         if: contains(matrix.platform, 'macos')
@@ -213,6 +226,20 @@ jobs:
             --output legacy-update/update.json \
             --notes "Cursor BYOK v${VERSION}"
 
+      - name: Generate signed Windows portable update manifest
+        env:
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: |
+          asset="cursor-byok-${VERSION}-windows-amd64.zip"
+          test -f "legacy-update/${asset}"
+          test -f "legacy-update/${asset}.sig"
+          node .github/scripts/generate-portable-update.mjs \
+            --version "${VERSION}" \
+            --repository "${GITHUB_REPOSITORY}" \
+            --asset "${asset}" \
+            --signature "legacy-update/${asset}.sig" \
+            --output legacy-update/portable-latest.json
+
       - name: Normalize Tauri updater download URLs
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}