[eric] windows shipping: electron-builder win+nsis + Azure Trusted Signing hook, build-app-win.ps1 / build-python-env-win.ps1 mirroring mac, release-windows.yml tag-triggered CI, icon.ico + .env.windows.example, .claude/ + .env.* gitignored. Runtime fixes: PYTHONUTF8=1 (cp1252 UnicodeDecode), python.exe / Lib\site-packages paths, PYTHONPATH path.delimiter, taskkill /T /F process tree, OAuth UA platform branch, sign-vmp postinstall via node wrapper. Backend: _resolve_command PATHEXT probing (fixes uvx not found), UV_PYTHON Windows path. Cross-env added to 9router+electron for NODE_ENV prefix on cmd. Onboarding: poll subscriptions/status while connect step is open, render Connected for active providers (was stuck on "Connect" after 30s OAuth poll timeout).

electron/scripts/sign-vmp.js

@@ -0,0 +1,14 @@
+// Cross-platform wrapper around sign-vmp.sh.
+// VMP signing (CastLabs Widevine) only runs on macOS. On Windows/Linux this
+// is a no-op so `npm install` doesn't blow up trying to invoke bash.
+const { spawnSync } = require('child_process');
+const path = require('path');
+
+if (process.platform !== 'darwin') {
+  console.log(`[vmp] Skipping VMP signing on ${process.platform} (macOS-only)`);
+  process.exit(0);
+}
+
+const script = path.join(__dirname, 'sign-vmp.sh');
+const result = spawnSync('bash', [script], { stdio: 'inherit' });
+process.exit(result.status ?? 0);