Windows support groundwork (#77)

.github/workflows/ci.yml

@@ -10,18 +10,37 @@ permissions:
 jobs:
   check:
     name: Lint, Type-check, Build, Test
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
     steps:
       - uses: actions/checkout@v4
 
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
 
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-action@stable
+
+      - name: Install dependencies (Ubuntu only)
+        if: matrix.os == 'ubuntu-latest'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
+
       - run: bun install
 
       - name: Type-check and build
         run: bun run build
 
       - name: Run tests
         run: bun run test
+
+      - name: Build Tauri (Windows only)
+        if: matrix.os == 'windows-latest'
+        run: bun run tauri build
+        env:
+          CI: true

.github/workflows/publish.yml

@@ -24,6 +24,8 @@ jobs:
             args: "--target aarch64-apple-darwin"
           - platform: macos-latest
             args: "--target x86_64-apple-darwin"
+          - platform: windows-latest
+            args: "--target x86_64-pc-windows-msvc"
     runs-on: ${{ matrix.platform }}
     env:
       RELEASE_TAG: ${{ github.ref_type == 'tag' && github.ref_name || inputs.tag }}
@@ -34,7 +36,7 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@stable
         with:
-          targets: aarch64-apple-darwin,x86_64-apple-darwin
+          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || 'x86_64-pc-windows-msvc' }}
       - uses: swatinem/rust-cache@v2
         with:
           workspaces: "./src-tauri -> target"
@@ -46,14 +48,20 @@ jobs:
       - name: Bundle plugins
         run: bun run bundle:plugins
       - name: Verify bundled plugins
+        shell: bash
         run: |
-          COUNT=$(find src-tauri/resources/bundled_plugins -maxdepth 2 -name plugin.json | wc -l | tr -d ' ')
+          if [[ "${{ matrix.platform }}" == "windows-latest" ]]; then
+            COUNT=$(find src-tauri/resources/bundled_plugins -maxdepth 2 -name plugin.json | wc -l | tr -d ' \r')
+          else
+            COUNT=$(find src-tauri/resources/bundled_plugins -maxdepth 2 -name plugin.json | wc -l | tr -d ' ')
+          fi
           if [[ "$COUNT" -lt 1 ]]; then
             echo "No bundled plugins found under src-tauri/resources/bundled_plugins."
             exit 1
           fi
 
       - name: Validate release tag
+        shell: bash
         run: |
           if [[ -z "$RELEASE_TAG" ]]; then
             echo "Missing RELEASE_TAG (push a v* tag, or provide workflow_dispatch input 'tag')."
@@ -65,6 +73,7 @@ jobs:
           fi
 
       - name: Validate app version matches tag
+        shell: bash
         run: |
           TAG_VERSION="${RELEASE_TAG#v}"
 
@@ -86,6 +95,7 @@ jobs:
           fi
 
       - name: Import Apple Developer Certificate
+        if: matrix.platform == 'macos-latest'
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -100,6 +110,38 @@ jobs:
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
           rm certificate.p12
 
+      - name: Validate Windows signing secrets
+        if: matrix.platform == 'windows-latest'
+        shell: pwsh
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        run: |
+          if ([string]::IsNullOrWhiteSpace($env:WINDOWS_CERTIFICATE)) {
+            Write-Error "Missing WINDOWS_CERTIFICATE secret for Windows release signing."
+            exit 1
+          }
+          if ([string]::IsNullOrWhiteSpace($env:WINDOWS_CERTIFICATE_PASSWORD)) {
+            Write-Error "Missing WINDOWS_CERTIFICATE_PASSWORD secret for Windows release signing."
+            exit 1
+          }
+
+      - name: Import Windows signing certificate
+        if: matrix.platform == 'windows-latest'
+        shell: pwsh
+        env:
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        run: |
+          $certDir = Join-Path $env:RUNNER_TEMP "windows-cert"
+          New-Item -ItemType Directory -Path $certDir | Out-Null
+          $certBase64 = Join-Path $certDir "cert.base64"
+          $certPfx = Join-Path $certDir "cert.pfx"
+          Set-Content -Path $certBase64 -Value $env:WINDOWS_CERTIFICATE -NoNewline
+          certutil -decode $certBase64 $certPfx | Out-Null
+          $securePassword = ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force
+          Import-PfxCertificate -FilePath $certPfx -CertStoreLocation Cert:\CurrentUser\My -Password $securePassword | Out-Null
+
       - uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -114,6 +156,9 @@ jobs:
 
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
         with:
           tagName: ${{ env.RELEASE_TAG }}
           releaseName: ${{ env.RELEASE_TAG }}
@@ -123,6 +168,7 @@ jobs:
           args: ${{ matrix.args }}
 
       - name: Verify updater assets uploaded
+        shell: bash
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |

OWNER_GUIDE.md

@@ -0,0 +1,134 @@
+# Owner Guide: Windows Release Setup
+
+Generate Windows certificate from your Mac, add GitHub secrets, push a tag.
+
+## 1. Generate Windows Certificate
+
+Install OpenSSL if not present:
+
+```bash
+brew install openssl
+```
+
+Create certificate:
+
+```bash
+# Create private key
+openssl genrsa -out windows.key 4096
+
+# Create certificate
+openssl req -new -x509 -key windows.key -out windows.crt -days 365 \
+  -subj "/CN=Sunstory/O=Sunstory/C=US"
+
+# Convert to PFX
+openssl pkcs12 -export -out codesign.pfx -inkey windows.key -in windows.crt
+# Enter password when prompted (save this!)
+```
+
+For production: Buy a certificate from DigiCert/Sectigo instead.
+
+## 2. Encode for GitHub Secrets
+
+```bash
+# Base64 encode
+cat codesign.pfx | base64 > cert_base64.txt
+
+# Copy to clipboard (macOS)
+cat cert_base64.txt | pbcopy
+
+# Cleanup sensitive files
+rm windows.key windows.crt codesign.pfx
+```
+
+## 3. Add GitHub Secrets
+
+Go to: `https://github.com/robinebers/openusage/settings/secrets/actions`
+
+Add:
+
+| Secret | Value |
+|--------|-------|
+| `WINDOWS_CERTIFICATE` | Paste from clipboard (base64) |
+| `WINDOWS_CERTIFICATE_PASSWORD` | Password from step 1 |
+
+## 4. Update Versions
+
+Set same version in all 3 files:
+
+```bash
+# Check current
+grep '"version"' package.json src-tauri/tauri.conf.json
+grep '^version' src-tauri/Cargo.toml
+
+# Edit files (use your editor)
+cursor src-tauri/tauri.conf.json  # "version": "0.6.4"
+cursor src-tauri/Cargo.toml       # version = "0.6.4"
+cursor package.json               # "version": "0.6.4"
+```
+
+## 5. Create Release
+
+```bash
+# Commit
+git add src-tauri/tauri.conf.json src-tauri/Cargo.toml package.json
+git commit -m "chore: release v0.6.4"
+
+# Push
+git push origin main
+
+# Tag
+git tag v0.6.4
+git push origin v0.6.4
+```
+
+## 6. Monitor Build
+
+```bash
+# Watch workflow
+gh run watch
+
+# Or open browser
+open "https://github.com/robinebers/openusage/actions"
+```
+
+## 7. Verify
+
+```bash
+# Check release assets
+gh release view v0.6.4
+```
+
+Should have:
+- `OpenUsage_0.6.4_aarch64.dmg`
+- `OpenUsage_0.6.4_x64.dmg`
+- `OpenUsage_0.6.4_x64_en-US.msi` (Windows)
+- `OpenUsage_0.6.4_x64-setup.exe` (Windows)
+- `latest.json`
+
+## Troubleshooting
+
+**Missing WINDOWS_CERTIFICATE**
+- Check secret exists in GitHub → Settings → Secrets
+
+**Version mismatch**
+- All 3 files must have same version number
+
+**No Windows assets**
+- Check workflow logs for Windows build errors
+- Verify `WINDOWS_CERTIFICATE_PASSWORD` is correct
+
+## Commands Reference
+
+```bash
+# Check versions
+grep -h version package.json src-tauri/tauri.conf.json src-tauri/Cargo.toml
+
+# List releases
+gh release list
+
+# View workflow runs
+gh run list --workflow=publish.yml
+
+# Check specific run
+gh run view <run-id>
+```

docs/breadcrumbs.md

@@ -0,0 +1,25 @@
+# Breadcrumbs
+
+## 2026-02-09
+
+- Windows dev: align AppState plugin/probe types with LoadedPlugin + PluginOutput, and persist arrow offset for tray alignment fallback.
+- Arrow alignment: account for panel horizontal padding when positioning tray arrow.
+- Side taskbar: compute arrow offset on Y axis and render left/right arrows.
+- Side taskbar: use work area bounds to avoid overlapping the taskbar.
+- Windows plugin scan: identified OS path/keychain blockers per plugin.
+- Windows plugins: add Windows path candidates for Codex/Claude/Cursor/Windsurf and guard keychain usage to macOS.
+- Windows OS gating: enable windows in plugin manifests and add actionable missing-path errors for testers.
+- Cleanup: moved `WINDOWS_CHANGES.md` and reserved `nul` file to trash; kept `src/contexts/taskbar-context.tsx` for later wiring.
+- Windows updater: documented that production updates require Authenticode signing; marked current state as test-only.
+- Windows signing: added conditional PFX import step and owner follow-up checklist.
+- Cleanup: removed unused `src/contexts/taskbar-context.tsx`.
+- PR 77 fixes: re-enabled tray icon updates, restored Linux tray click handling, guarded window clamp, and replaced env-based Windows probes with `~`-based paths under a CODEX_HOME-only allowlist.
+
+## 2026-02-10
+
+- Switched plugin host sqlite to embedded `rusqlite` with bundled SQLite for cross-platform availability.
+- Replaced Windows process discovery `wmic` with PowerShell CIM JSON parsing in `src-tauri/src/plugin_engine/host_api.rs`.
+- Added Windows DPAPI-backed `host.vault` and updated Copilot auth to use it.
+- Enforced Windows signing secrets in publish workflow to prevent unsigned releases.
+- Adjusted dynamic tray icon rendering to stay visible on dark Windows taskbars.
+- Restored Linux placeholders for tray positioning and plugin availability.