Publish prebuilt agent binaries and harden Windows install.

GitHub Actions builds platform agents on main; the Windows installer defaults SOCKS to 1080, busts stale TEMP cache, downloads release binaries first, and re-enters bootstrap via env vars only.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Skillz147

.github/workflows/release-binaries.yml

@@ -0,0 +1,80 @@
+name: Release agent binaries
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goos: windows
+            goarch: amd64
+            asset: trinityproxy-windows-amd64.exe
+          - goos: linux
+            goarch: amd64
+            asset: trinityproxy-linux-amd64
+          - goos: darwin
+            goarch: amd64
+            asset: trinityproxy-darwin-amd64
+          - goos: darwin
+            goarch: arm64
+            asset: trinityproxy-darwin-arm64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build agent binary
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          CGO_ENABLED: "0"
+        run: |
+          mkdir -p dist
+          go build -ldflags="-s -w" -trimpath -o "dist/${{ matrix.asset }}" .
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.asset }}
+          path: dist/${{ matrix.asset }}
+          if-no-files-found: error
+
+  release:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download all platform binaries
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+
+      - name: List release files
+        run: ls -la dist/
+
+      - name: Publish continuous pre-release (tag latest)
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: latest
+          name: Latest dev agent binaries
+          prerelease: true
+          make_latest: false
+          generate_release_notes: true
+          files: dist/*
+          overwrite_files: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

docs/WINDOWS_AGENT.md

@@ -6,9 +6,17 @@ The agent:
 1. Starts an embedded SOCKS5 listener on `TRINITY_SOCKS_PORT` (default **1080**)
 2. Sends heartbeats every 60 seconds with the node's public IP, SOCKS port, and credentials
 
+## Pre-built binary (recommended)
+
+No Go required on the Windows PC. After the [Release agent binaries](https://github.com/Skillz147/TrinityProxy/actions/workflows/release-binaries.yml) workflow has run on `main`, download:
+
+`https://github.com/Skillz147/TrinityProxy/releases/download/latest/trinityproxy-windows-amd64.exe`
+
+The dashboard one-liner and `scripts/install-agent-windows.ps1` use this URL automatically.
+
 ---
 
-## Step 1 — Build the agent binary
+## Step 1 — Build the agent binary (optional)
 
 On a machine with Go installed (macOS, Linux, or Windows):
 

internal/dashboard/deployment/commands.go

@@ -62,11 +62,11 @@ func BuildDeployCommands(settings *Settings, envFallback, agentKey string) Deplo
 		{
 			ID:            "windows",
 			Label:         "Windows",
-			Description:   "One paste in elevated PowerShell: downloads the installer from GitHub, extracts to %TEMP% (no Git), builds or downloads the agent binary, and registers a Windows service with embedded SOCKS5.",
+			Description:   "One paste in elevated PowerShell: downloads the installer and pre-built trinityproxy-windows-amd64.exe from GitHub Releases (no Go on your PC). Falls back to a fresh source zip only if the release is not published yet.",
 			ControllerURL: productionURL,
 			Command:       windowsCommand(productionURL, agentKey),
 			RunAs:         "Administrator (elevated PowerShell)",
-			Prerequisites: "Git for Windows (for first-time install). Run the command in elevated PowerShell — no manual clone or cd. Optional: pre-copy build\\trinityproxy.exe via TRINITY_LOCAL_BINARY or TRINITY_DOWNLOAD_URL to skip Go build.",
+			Prerequisites: "Elevated PowerShell only — no Git or Go required once GitHub Release latest is published. Optional: TRINITY_LOCAL_BINARY or TRINITY_DOWNLOAD_URL to use your own binary.",
 		},
 		{
 			ID:            "docker",