chore(master): release 0.29.0

[arcbox-labs]

🤖 I have created a release beep boop

0.29.0 (2026-08-31)

Features

• mobile: add in-app permanent account deletion (#481) (cc5388a)

Bug Fixes

• codex: route account providers explicitly (#497) (b18fdc4)

---

This PR was generated with Release Please. See documentation.

[greptile-apps]

Greptile Summary

Updates the release metadata and desktop package version from 0.28.0 to 0.29.0.

• Advances the Release Please manifest to 0.29.0.
• Adds the 0.29.0 release notes to the desktop changelog.
• Updates the desktop package version to 0.29.0.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.release-please-manifest.json	Advances the repository release version from 0.28.0 to 0.29.0.
apps/desktop/CHANGELOG.md	Adds generated release notes for version 0.29.0.
apps/desktop/package.json	Keeps the desktop package version aligned with the 0.29.0 release.

_{Reviews (2): Last reviewed commit: "chore(master): release 0.29.0" | Re-trigger Greptile}

[pullfrog]

ℹ️ The release cut itself is correct. One sequencing note about what rides along in it.

Reviewed changes — verified the three mechanical release-please files, then audited what the release actually ships beyond them.

• Version bump 0.28.0 → 0.29.0 — .release-please-manifest.json, apps/desktop/package.json, and apps/desktop/CHANGELOG.md all name the same version. Minor bump is correct for a feat: under bump-minor-pre-major.
• No version drift — the only repo hits for 0.28.0 outside changelogs are unrelated third-party pins (nix 0.28.0 in Cargo.lock, scheduler@0.28.0-canary-…).
• No undocumented riders — git log origin/master --not HEAD^ is empty, so the PR base is master HEAD; v0.28.0 exists as a tag, so the changelog compare link resolves.
• Changelog is complete — three commits ship since v0.28.0; the two omitted ones are chore: and refactor:, correctly hidden by release-please's default changelog-sections.

ℹ️ The rewritten post-pack release gate has never run, and 0.29.0 is its first execution

The changelog's only entry is mobile-only, but what the desktop artifact actually gains from this release is two changelog-invisible sweeps (chore: housekeeping & make eslint happy, refactor: cleanup…) totalling 360 files. Those sweeps moved the packageManager pin pnpm@11.10.0 → pnpm@11.24.0 and mechanically rewrote the desktop packaging scripts.

CI coverage across those scripts is uneven. package-app.mts, build.mts, and stage-sidecar.mts are exercised on Linux CI through e2e:packaged → package:devshell. verify-artifacts.mts is not: it is invoked from exactly one place, build-desktop.yml:359, and that workflow's pull_request: trigger is commented out. So the release gate that runs after signing and notarization has not executed since it was rewritten.

I traced the rewrite and had a second reviewer do so independently — both found it behavior-preserving, so this is a sequencing concern rather than a suspected bug. Worth one release-desktop.yml dispatch with dry_run: true before publishing; it is not a reason to hold the merge.

Technical details

# 0.29.0 ships reworked release machinery with a gap in CI coverage

## Affected sites
- `package.json` — `packageManager` bumped `pnpm@11.10.0` → `pnpm@11.24.0`. Every release job picks this up: all `pnpm/action-setup@v6` uses pass no `version:` input, so the pin is read from `package.json`. `apps/desktop/scripts/package-app.mts:95` carries a standing comment that `pnpm deploy`'s file selection "skips .gitignore'd paths inconsistently across pnpm versions" — a documented sensitivity to exactly this pin.
- `apps/desktop/scripts/verify-artifacts.mts` — rewritten (`for…of` → hoisted-length indexed loops); invoked only from `.github/workflows/build-desktop.yml:359`, whose `pull_request:` trigger is commented out at lines 48-55. Zero executions since the rewrite.
- `apps/desktop/scripts/{config-bundle,package-config,render-config-bundle}.mts` — `localeCompare` → a module-level `Intl.Collator`, feeding the generated-config drift gate.
- Root `pnpm-lock.yaml` — ~2874 lines churned alongside a major `eslint-config-sukka` 8 → 9 bump.

## Required outcome
- Confirm the desktop packaging + post-pack verification path succeeds end to end under pnpm 11.24.0 before a published artifact depends on it.

## Suggested approach
- Dispatch `release-desktop.yml` via `workflow_dispatch` with `dry_run: true`. It builds and signs but publishes nothing, which exercises `verify-artifacts.mts` on the real signed output — the one step CI never reaches.

## Already checked — no action needed
- No converted loop mutates the array it iterates; the nested loops in `verifyNoAgentBinaries` and `package-daemon.mts` use distinct `j`/`entryCount` rather than shadowing the outer `i`/`len`.
- `localeCompare` → `new Intl.Collator().compare` is spec-equivalent (ECMA-402 §13.1.1). Both are locale-sensitive, so the drift gate's exposure is unchanged.
- `statSync(...).size` → `statSync(…, { throwIfNoEntry: false })?.size` preserves the `missing artifact` outcome for ENOENT and non-ENOENT failures alike. Not fail-open.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — the branch was recut on top of a newer master; re-ran the release-cut checks against the new base.

• Changelog gained a Bug Fixes section — fix(codex): route account providers explicitly (#497) (b18fdc47) is now listed under 0.29.0. That commit touches only packages/host/agent-adapter source, tests, and its AGENTS.md — no workflow, packaging script, or toolchain pin, so it adds no new release machinery.
• Version target unchanged — .release-please-manifest.json, apps/desktop/package.json, and apps/desktop/CHANGELOG.md all still name 0.29.0. Minor remains correct: a feat: is in range under bump-minor-pre-major, and an added fix: cannot change the bump.
• Base is master HEAD — git log origin/master --not HEAD^ is empty at b18fdc4, so nothing rides into the release undocumented.
• Changelog is complete for the new range — four commits ship since v0.28.0; the two omitted are chore: and refactor:, correctly hidden by release-please's default changelog-sections.

The sequencing note from the previous review is unaffected by this recut and still applies as written.

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}