ci(python): gate the Windows x64 installed wheel

Add node24-win-x64 to the required pull-request and public-release matrices on a native windows-2025 runner, and publish the same win_amd64 artifact from the GitLab tag pipeline. GitHub uses Git Bash for the shared release script while selecting the Windows venv's Scripts/python.exe explicitly; the Linux and macOS legs retain their existing commands and native checks.

Run the complete installed-wheel keyless suite and the trusted two-turn DeepSeek smoke on Windows exactly as on the existing targets. Make the minimal blackbox choose persistent PowerShell on Windows, keep advanced and restart snapshots platform-stable by disabling both one-shot shell variants, locate the generated dsh.exe console command, and validate text lines without assuming POSIX newlines.

Workflow tests pin the four-target matrix, Windows runner and wheel tag, cross-platform venv selection, GitLab publication dependency, and full blackbox invocation. The existing POSIX minimal snapshot changes only its platform-neutral prompt wording; Windows owns a separate model-visible snapshot.

.github/workflows/build-exe-for-python-sdk.yml

@@ -2,7 +2,7 @@ name: Build single-exe
 
 # Native builds for the release targets; see
 # .agents/notes/implemented/architecture/2026-07-10-single-file-executable-sdk-runtime-distribution.md.
-# A full target run retains one SDK wheel and three runtime wheels; subset
+# A full target run retains one SDK wheel and four runtime wheels; subset
 # dispatch retains the SDK wheel and selected runtime wheels. Bare executables
 # and source closures are test inputs. Run manually, label a PR `build-exe`
 # (remove and reapply to rerun), or call it from the Python release workflow.
@@ -11,7 +11,7 @@ on:
   workflow_call:
     inputs:
       targets:
-        description: Comma-separated pkg targets to build; empty builds all three.
+        description: Comma-separated pkg targets to build; empty builds all four.
         type: string
         required: false
         default: ''
@@ -34,8 +34,8 @@ on:
       targets:
         description: >-
           Comma-separated pkg targets to build. Any subset of:
-          node24-linux-x64, node24-linux-arm64, node24-macos-arm64.
-          Empty builds all three.
+          node24-linux-x64, node24-linux-arm64, node24-macos-arm64,
+          node24-win-x64. Empty builds all four.
         type: string
         required: false
         default: ''
@@ -90,7 +90,7 @@ jobs:
         id: plan
         env:
           # Label runs and blank dispatch inputs build all targets.
-          TARGETS: ${{ inputs.targets || 'node24-linux-x64,node24-linux-arm64,node24-macos-arm64' }}
+          TARGETS: ${{ inputs.targets || 'node24-linux-x64,node24-linux-arm64,node24-macos-arm64,node24-win-x64' }}
         run: |
           set -euo pipefail
           matrix='[]'
@@ -104,8 +104,9 @@ jobs:
               node24-linux-x64)   runner=ubuntu-latest ;;
               node24-linux-arm64) runner=ubuntu-24.04-arm ;;
               node24-macos-arm64) runner=macos-latest ;;
+              node24-win-x64)     runner=windows-2025 ;;
               *)
-                echo "::error::Unknown target '$t'. Supported: node24-linux-x64, node24-linux-arm64, node24-macos-arm64."
+                echo "::error::Unknown target '$t'. Supported: node24-linux-x64, node24-linux-arm64, node24-macos-arm64, node24-win-x64."
                 exit 1
                 ;;
             esac
@@ -155,10 +156,22 @@ jobs:
       fail-fast: false
       matrix:
         include: ${{ fromJSON(needs.plan.outputs.matrix) }}
+    defaults:
+      run:
+        shell: bash
     steps:
       - uses: actions/checkout@v6
 
       - uses: pnpm/action-setup@v4
+        with:
+          dest: ${{ runner.temp }}/setup-pnpm-js
+
+      - name: Enable Windows Developer Mode (symlink support)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: >-
+          reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"
+          /t REG_DWORD /f /v "AllowDevelopmentWithoutDevLicense" /d "1"
 
       # setup-node's built-in pnpm store cache keys on platform AND arch, so
       # the Linux architectures sharing runner.os stay on separate caches.
@@ -198,6 +211,7 @@ jobs:
             *) echo "::error::Unsupported Linux runner architecture $RUNNER_ARCH"; exit 1 ;;
           esac
           addon_dir="$(realpath packages/subprocess/subprocess-local/node_modules/node-pty)"
+          pnpm_setup_root="$(realpath "$(dirname "$(dirname "$PNPM_HOME")")")"
           (cd "$addon_dir" && npm_config_build_from_source=true pnpm run install)
           addon="$addon_dir/build/Release/pty.node"
           [ -f "$addon_dir/build/Makefile" ] || {
@@ -208,7 +222,7 @@ jobs:
             --user "$(id -u):$(id -g)" \
             -v "$PWD:$PWD" \
             -v "$HOME/.cache/node-gyp:$HOME/.cache/node-gyp:ro" \
-            -v "$HOME/setup-pnpm:$HOME/setup-pnpm:ro" \
+            -v "$pnpm_setup_root:$pnpm_setup_root:ro" \
             -w "$addon_dir" \
             "$image" \
             bash -euxo pipefail -c \
@@ -236,13 +250,21 @@ jobs:
           set -euo pipefail
           platform="${TARGET#node24-}"
           exe="$PWD/dist-exe/deepseek-harness-sdk-runtime-$platform"
-          [ -x "$exe" ] || { echo "::error::$exe missing or not executable"; exit 1; }
           case "$platform" in
             linux-x64) wheel=deepseek_harness_runtime_bin-$VERSION-py3-none-manylinux_2_28_x86_64.whl ;;
             linux-arm64) wheel=deepseek_harness_runtime_bin-$VERSION-py3-none-manylinux_2_28_aarch64.whl ;;
             macos-arm64) wheel=deepseek_harness_runtime_bin-$VERSION-py3-none-macosx_14_0_arm64.whl ;;
+            win-x64)
+              exe="$exe.exe"
+              wheel=deepseek_harness_runtime_bin-$VERSION-py3-none-win_amd64.whl
+              ;;
             *) echo "::error::Unsupported runtime platform $platform"; exit 1 ;;
           esac
+          if [ "$RUNNER_OS" = Windows ]; then
+            [ -f "$exe" ] || { echo "::error::$exe missing"; exit 1; }
+          else
+            [ -x "$exe" ] || { echo "::error::$exe missing or not executable"; exit 1; }
+          fi
           echo "platform=$platform" >> "$GITHUB_OUTPUT"
           echo "exe=$exe" >> "$GITHUB_OUTPUT"
           echo "wheel=$wheel" >> "$GITHUB_OUTPUT"
@@ -261,24 +283,32 @@ jobs:
           path: dist-python
 
       - name: Install local SDK and runtime wheels into a clean venv
+        id: smoke-venv
         env:
           RUNTIME_WHEEL: ${{ steps.runtime.outputs.wheel }}
           SDK_WHEEL: deepseek_harness_sdk-${{ needs.plan.outputs.version }}-py3-none-any.whl
         run: |
           set -euo pipefail
-          python -m venv "$RUNNER_TEMP/dsh-sdk-smoke"
-          "$RUNNER_TEMP/dsh-sdk-smoke/bin/python" -m pip install \
+          venv="$(python -c 'import tempfile; print(tempfile.mkdtemp(prefix="dsh-sdk-smoke-"))')"
+          python -m venv "$venv"
+          if [ "$RUNNER_OS" = Windows ]; then
+            smoke_python="$(cygpath -u "$venv")/Scripts/python.exe"
+          else
+            smoke_python="$venv/bin/python"
+          fi
+          "$smoke_python" -m pip install \
             "dist-python/$SDK_WHEEL" \
             "dist-python/$RUNTIME_WHEEL"
+          echo "python=$smoke_python" >> "$GITHUB_OUTPUT"
 
       - name: Run installed-wheel keyless black-box tests
         run: |
           set -euo pipefail
-          blackbox_root="$RUNNER_TEMP/dsh-sdk-blackbox"
-          mkdir -p "$blackbox_root"
+          blackbox_root="$(python -c 'import tempfile; print(tempfile.mkdtemp(prefix="dsh-sdk-blackbox-"))')"
+          if [ "$RUNNER_OS" = Windows ]; then blackbox_root="$(cygpath -u "$blackbox_root")"; fi
           cd "$blackbox_root"
           env -u PYTHONPATH -u DSH_RUNTIME_MODE \
-            "$RUNNER_TEMP/dsh-sdk-smoke/bin/python" \
+            "${{ steps.smoke-venv.outputs.python }}" \
             "$GITHUB_WORKSPACE/scripts/smoke-python-runtime.py" \
             --scenario all \
             --installed-wheel
@@ -309,11 +339,11 @@ jobs:
           DEEPSEEK_BASE_URL: https://api.deepseek.com
         run: |
           set -euo pipefail
-          blackbox_root="$RUNNER_TEMP/dsh-sdk-blackbox-live"
-          mkdir -p "$blackbox_root"
+          blackbox_root="$(python -c 'import tempfile; print(tempfile.mkdtemp(prefix="dsh-sdk-blackbox-live-"))')"
+          if [ "$RUNNER_OS" = Windows ]; then blackbox_root="$(cygpath -u "$blackbox_root")"; fi
           cd "$blackbox_root"
           env -u PYTHONPATH -u DSH_RUNTIME_MODE \
-            "$RUNNER_TEMP/dsh-sdk-smoke/bin/python" \
+            "${{ steps.smoke-venv.outputs.python }}" \
             "$GITHUB_WORKSPACE/scripts/smoke-python-runtime.py" \
             --scenario sdk-live \
             --installed-wheel

.github/workflows/ci.yml

@@ -302,7 +302,7 @@ jobs:
     name: python runtime / release-shaped matrix
     uses: ./.github/workflows/build-exe-for-python-sdk.yml
     with:
-      targets: node24-linux-x64,node24-linux-arm64,node24-macos-arm64
+      targets: node24-linux-x64,node24-linux-arm64,node24-macos-arm64,node24-win-x64
       ci: true
     secrets:
       DEEPSEEK_API_KEY_EXTERNAL: ${{ secrets.DEEPSEEK_API_KEY_EXTERNAL }}

.github/workflows/python-release.yml

@@ -24,10 +24,10 @@ concurrency:
 
 jobs:
   build:
-    name: Build four wheels
+    name: Build five wheels
     uses: ./.github/workflows/build-exe-for-python-sdk.yml
     with:
-      targets: node24-linux-x64,node24-linux-arm64,node24-macos-arm64
+      targets: node24-linux-x64,node24-linux-arm64,node24-macos-arm64,node24-win-x64
       release: true
 
   python-compat:
@@ -151,6 +151,7 @@ jobs:
             "deepseek_harness_runtime_bin-$VERSION-py3-none-macosx_14_0_arm64.whl" \
             "deepseek_harness_runtime_bin-$VERSION-py3-none-manylinux_2_28_aarch64.whl" \
             "deepseek_harness_runtime_bin-$VERSION-py3-none-manylinux_2_28_x86_64.whl" \
+            "deepseek_harness_runtime_bin-$VERSION-py3-none-win_amd64.whl" \
             "deepseek_harness_sdk-$VERSION-py3-none-any.whl" > "$expected"
           find dist -maxdepth 1 -type f -name '*.whl' -exec basename {} \; | sort > "$actual"
           diff -u "$expected" "$actual"