fix(desktop): sign Windows native addons

[Lumbreras2306]

Problem

The signed Windows desktop build only signs .exe files by default. Native addons and libraries copied into app.asar.unpacked and server.asar.unpacked remain unsigned, so Windows Smart App Control can block them independently from the signed T3 Code executable. Blocking ffi-rs.win32-x64-msvc.node crash-loops the embedded backend and leaves the renderer on the generic fetch-session-state (HTTP 500) error screen.

Fix

Add .node and .dll to Electron Builder's Windows signExts configuration. Release builds will use the existing Azure Trusted Signing configuration for these native runtime files as well as the default executable targets.

The Windows build-config test now asserts that both native extensions remain covered.

Fixes #8201.

Testing

• vp test run scripts/build-desktop-artifact.test.ts -t "configures Windows executable metadata and native signing extensions"
• vp lint scripts/build-desktop-artifact.ts scripts/build-desktop-artifact.test.ts
• pnpm --filter @t3tools/scripts typecheck

A full run of scripts/build-desktop-artifact.test.ts reached 46 passing tests; 6 existing environment-sensitive tests failed locally on Windows because the sandbox cannot create symlinks/spawn the packaged probe and an ancestor node_modules is intentionally rejected. The focused test, lint, and typecheck pass.

Generated with GPT-5 via Codex.

---

Note

Medium Risk
Changes Windows release signing scope for all signed builds; misconfiguration could break signing CI or leave natives unsigned if Electron Builder behavior differs from expectations.

Overview
Extends Windows release packaging so Electron Builder signs .node and .dll files, not just the main .exe. The change sets win.signExts to ['.node', '.dll'] in createBuildConfig, so Azure Trusted Signing (when signed is enabled) also covers native addons and libraries unpacked from app.asar and the server sidecar—addressing Smart App Control blocking unsigned runtime natives (e.g. ffi-rs) that can crash-loop the embedded backend.

The build-config test was renamed and now asserts signExts alongside existing checks for icon, signAndEditExecutable, and absent azureSignOptions on unsigned builds.

^{Reviewed by Cursor Bugbot for commit 2fda067. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add signExts to Windows build config in createBuildConfig

Sets winConfig.signExts to ['.node', '.dll'] in the Windows branch of createBuildConfig so Electron-builder signs native addons. Updates the test in build-desktop-artifact.test.ts to assert the extension list.

^{Macroscope summarized 2fda067.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3a69afde-73ec-4158-8abe-29deac3b74aa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The change expands signed Windows release artifacts to include native .node and .dll libraries, affecting security-sensitive packaging and the Azure signing workflow. Although the diff is small and configuration-tested, end-to-end release-signing behavior warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 2fda067. Configure here.}

[cursor]

Linux addons submitted for Windows signing

High Severity

signExts matches every unpacked .node file by extension, including Linux WSL natives in server.asar.unpacked such as Linux ffi-rs addons and pty.node. Azure Trusted Signing then attempts Authenticode on ELF binaries, which is likely to fail the signed Windows release build.

 

^{Reviewed by Cursor Bugbot for commit 2fda067. Configure here.}