fix(windows): stop shipping broken arm64 installers from x64 CI

Hard-coded win.target arches made pack:win-x64 also emit win-arm64 and
a universal NSIS package that can leave Netcatty.exe missing on ARM
Windows (#2570). Let CLI --x64/--arm64 control packaging instead.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/build.yml

@@ -176,9 +176,10 @@ jobs:
             pack_script: pack:mac
           - name: windows
             os: windows-latest
-            # The mosh binary workflow currently produces win32-x64 only.
-            # Keep official packages aligned with bundled-mosh coverage
-            # until Cygwin arm64 is stable enough to build win32-arm64.
+            # Official Windows releases are x64-only for now. Bundled mosh/et
+            # are win32-x64, and win.target must not hard-code arm64 or the
+            # x64 job still emits broken win-arm64 / universal NSIS packages
+            # (#2570). Use pack:win-x64 until a dedicated arm64 job exists.
             pack_script: pack:win-x64
     env:
       MOSH_BIN_RELEASE: ${{ needs.resolve-mosh.outputs.mosh_bin_release }}

electron-builder.config.cjs

@@ -214,19 +214,14 @@ module.exports = {
     },
     win: {
         icon: 'public/icon-win.png',
-        target: [
-            {
-                target: 'nsis',
-                arch: ['x64', 'arm64']
-            },
-            {
-                target: 'portable',
-                arch: ['x64', 'arm64']
-            },
-            {
-                target: 'zip'
-            }
-        ],
+        // Do not hard-code arch here. pack:win-x64 / pack:win pass --x64/--arm64,
+        // and electron-builder unions config arch with the CLI set. Hard-coding
+        // ['x64', 'arm64'] made the official x64 CI job also emit win-arm64 and
+        // a universal win.exe whose 32-bit NSIS stub can mis-detect on ARM
+        // Windows, install to Program Files (x86), and leave Netcatty.exe
+        // missing (#2570). Keep official releases on pack:win-x64 until win32
+        // arm64 bundled mosh/et + native rebuilds are ready.
+        target: ['nsis', 'portable', 'zip'],
         extraResources: [...moshExtraResources('win32'), ...etExtraResources('win32')]
     },
     portable: {

scripts/electron-builder-config.test.cjs

@@ -193,8 +193,18 @@ test("rpm packaging uses gzip compression for RHEL-family package hosts", () =>
   );
 });
 
+test("Windows package arch is controlled by pack script CLI flags", () => {
+  assert.deepEqual(
+    config.win.target,
+    ["nsis", "portable", "zip"],
+    "win.target must not hard-code x64 and arm64 or pack:win-x64 will still emit broken arm64 installers",
+  );
+});
+
 test("windows packaging includes a zip archive target", () => {
-  const winTargets = config.win.target.map((entry) => entry.target);
+  const winTargets = config.win.target.map((entry) => (
+    typeof entry === "string" ? entry : entry.target
+  ));
   assert.ok(
     winTargets.includes("zip"),
     "windows package builds must publish a zip archive for no-install environments",
@@ -244,13 +254,15 @@ test("windows zip follows the requested build architecture", () => {
     Platform.WINDOWS,
   );
 
-  assert.ok(
-    targetsByArch.get(Arch.x64)?.includes("zip"),
-    "pack:win-x64 must publish an x64 zip archive",
+  assert.deepEqual(
+    targetsByArch.get(Arch.x64)?.slice().sort(),
+    ["nsis", "portable", "zip"].sort(),
+    "pack:win-x64 must publish x64 nsis, portable, and zip",
   );
-  assert.ok(
-    !targetsByArch.get(Arch.arm64)?.includes("zip"),
-    "pack:win-x64 must not publish an arm64 zip archive without arm64 bundled binaries",
+  assert.equal(
+    targetsByArch.has(Arch.arm64),
+    false,
+    "pack:win-x64 must not publish arm64 nsis/portable/zip without a dedicated arm64 job",
   );
 });