release/0.0.131

.cargo/audit.toml

@@ -0,0 +1,50 @@
+# cargo-audit ignore list — all transitive deps we cannot directly upgrade.
+# These are informational-only advisories (unmaintained / unsound);
+# no actual vulnerabilities are present.
+
+# Yanked crates — transitive deps we can't control.
+[yanked]
+enabled = false
+
+[advisories]
+ignore = [
+    # ── gtk-rs GTK3 family — unmaintained, no GTK4 upgrade path until Tauri migrates ──
+    "RUSTSEC-2024-0411", # gdkwayland-sys
+    "RUSTSEC-2024-0412", # gdk
+    "RUSTSEC-2024-0413", # atk
+    "RUSTSEC-2024-0414", # gdkx11-sys
+    "RUSTSEC-2024-0415", # gtk
+    "RUSTSEC-2024-0416", # atk-sys
+    "RUSTSEC-2024-0417", # gdkx11
+    "RUSTSEC-2024-0418", # gdk-sys
+    "RUSTSEC-2024-0419", # gtk3-macros
+    "RUSTSEC-2024-0420", # gtk-sys
+
+    # ── glib — unsound VariantStrIter, patched in >=0.20.0; blocked by gtk3 above ──
+    "RUSTSEC-2024-0429", # glib
+
+    # ── Other unmaintained transitive deps ────────────────────────────────────
+    "RUSTSEC-2021-0139", # ansi_term (via structopt/clap2 in iroh test clients)
+    "RUSTSEC-2023-0089", # atomic-polyfill (via heapless 0.7 in iroh stack)
+    "RUSTSEC-2024-0370", # proc-macro-error (via gtk3-macros)
+    "RUSTSEC-2024-0375", # atty unmaintained (via structopt/clap2 in iroh test clients)
+    "RUSTSEC-2024-0436", # paste
+    "RUSTSEC-2025-0057", # fxhash
+    "RUSTSEC-2025-0075", # unic-char-range
+    "RUSTSEC-2025-0080", # unic-common
+    "RUSTSEC-2025-0081", # unic-char-property
+    "RUSTSEC-2025-0098", # unic-ucd-version
+    "RUSTSEC-2025-0100", # unic-ucd-ident
+    "RUSTSEC-2025-0119", # number_prefix
+    "RUSTSEC-2025-0134", # rustls-pemfile (via oura-api/reqwest 0.11)
+    "RUSTSEC-2025-0141", # bincode
+
+    # ── Unsound warnings in legacy transitive deps ────────────────────────────
+    "RUSTSEC-2021-0145", # atty potential unaligned read (legacy clap2 chain)
+
+    # ── lru — unsound IterMut, patched in >=0.16.3; transitive dep ───────────
+    "RUSTSEC-2026-0002", # lru
+
+    # ── rand — unsound with custom logger using rand::rng(); transitive dep ──
+    "RUSTSEC-2026-0097", # rand (0.7.3 via tauri/phf, 0.8.5 via keyring/emotiv/etc.)
+]

.cargo/config.toml

@@ -0,0 +1,204 @@
+# ── Workspace-level Cargo configuration ────────────────────────────────────────
+#
+# Moved from src-tauri/.cargo/config.toml to the workspace root so that all
+# workspace members share the same build configuration.
+#
+# RLX (optional): Cargo resolves `rlx` via ../rlx/rlx (workspace.dependencies).
+#   CI — .github/actions/checkout-rlx clones https://github.com/MIT-RLX/rlx.git
+#   Local — `npm run setup:rlx` or direnv (.envrc) symlinks ../rlx -> RLX_ROOT
+#           (default /Users/Shared/rlx; override in gitignored rlx.path).
+#
+# `relative = true` paths are resolved relative to this file's parent
+# directory (the project root).
+
+# ── Default build target ──────────────────────────────────────────────────────
+#
+# cargo's [build] section has no per-host-OS conditionals, so a hardcoded
+# `target = "aarch64-apple-darwin"` here would break Windows / Linux builds
+# ("can't find crate for `core`").
+#
+# Platform default is therefore left as the host triple.  Per-platform
+# targeting is handled at two levels:
+#
+#   1. npm / Tauri builds (recommended):
+#        npm run tauri:build          ← auto-selects target via scripts/tauri-build.js
+#        macOS  → --target aarch64-apple-darwin
+#        Windows/Linux → host triple (no --target flag)
+#
+#   2. Raw `cargo` on macOS:
+#        Either pass --target aarch64-apple-darwin explicitly, or let direnv
+#        source the repo-root .envrc which exports CARGO_BUILD_TARGET for you.
+#
+# ── Windows build prerequisite: LLVM / libclang ───────────────────────────────
+#
+# llama-cpp-sys uses bindgen to generate Rust↔C bindings at build time.
+# bindgen requires libclang.dll, which ships with the LLVM toolchain.
+#
+# One-time setup (run once, then restart your terminal):
+#
+#   winget install LLVM.LLVM
+#
+#   # Then add to your user environment (PowerShell):
+#   [System.Environment]::SetEnvironmentVariable(
+#       "LIBCLANG_PATH", "C:\Program Files\LLVM\bin", "User")
+#
+# Without this, cargo build fails with:
+#   "Unable to find libclang: couldn't find any valid shared libraries
+#    matching: ['clang.dll', 'libclang.dll']"
+#
+# LIBCLANG_PATH is intentionally NOT set here because the path is
+# installation-dependent and force=true would break machines where LLVM
+# lives elsewhere.  Set it in your system/user environment variables instead.
+
+[build]
+# target intentionally omitted — defaults to the host triple
+#
+# ── Shared target directory ───────────────────────────────────────────────────
+#
+# All workspace members compile into src-tauri/target/.  This keeps the
+# binary output where the Tauri CLI and build scripts (tauri-build.js,
+# assemble-macos-app.sh, etc.) expect it, and avoids the multi-GB
+# duplication that occurred when individual crates had their own target/.
+target-dir = "src-tauri/target"
+#
+# ── Build caching (sccache) ───────────────────────────────────────────────────
+#
+# Do NOT hardcode `rustc-wrapper = "sccache"` here.
+#
+# Some developer machines (especially fresh Windows setups) do not have
+# sccache installed, and a workspace-level rustc-wrapper makes *every* cargo
+# command fail with:
+#   "could not execute process `sccache ... rustc.exe -vV` (program not found)"
+#
+# Instead, scripts/tauri-build.js auto-detects sccache and sets
+# RUSTC_WRAPPER only when the executable is present.
+
+[env]
+# Dynamic CRT for cmake-based -sys crates (llama-cpp-sys, etc.).
+# Several native dependencies (DirectML, ONNX Runtime, Vulkan loader) ship
+# as pre-built DLLs linked against the dynamic CRT (/MD).  Mixing /MT and
+# /MD in the same process causes heap corruption and "side-by-side
+# configuration is incorrect" errors.  Using /MD everywhere is consistent
+# and the NSIS installer bundles the VC++ Redistributable DLLs app-locally
+# so end users don't need a separate install.
+# On non-Windows platforms cmake ignores this variable.
+CMAKE_MSVC_RUNTIME_LIBRARY = "MultiThreadedDLL"
+
+# ── macOS: cmake / sccache paths ──────────────────────────────────────────────
+# Homebrew cmake/sccache are not on the default PATH when cargo invokes build
+# scripts. The cmake-0.1.x crate respects the CMAKE env var as the binary path.
+#
+# These are NOT set here because cargo's [env] table is unconditional: a value
+# like "/opt/homebrew/bin/cmake" leaks to Windows / Linux runners where the
+# path doesn't exist, causing cmake-rs to panic with "is `cmake` not installed?"
+# (os error 3 / ENOENT). Instead they are exported only on macOS by:
+#   - .envrc (for `cargo build` via direnv)
+#   - scripts/tauri-build.js (for `npm run tauri:build`)
+
+# ── macOS deployment target ───────────────────────────────────────────────────
+#
+# 14.0 satisfies both:
+#   - llama.cpp's std::filesystem (available since 10.15)
+#   - MLX Metal kernels using simdgroup_matrix (requires Metal 3.0 / macOS 14+)
+#
+# Apple Silicon (M-series, MacBook Neo A-series) — same Rust triple for all arm64 Macs.
+# Aliases: mac-neo, aarch64-apple-darwin-neo, apple-a18 (see scripts/lib/target-triples.mjs).
+#
+# Apple Silicon (M1+) ships with macOS 11.0 minimum, so 14.0 is fine.
+#
+# Two separate knobs are needed:
+#
+#   MACOSX_DEPLOYMENT_TARGET
+#     Read by the `cc` crate to generate -mmacosx-version-min in
+#     CMAKE_C_FLAGS / CMAKE_CXX_FLAGS (passed by cmake-0.1.57).
+#
+#   CMAKE_OSX_DEPLOYMENT_TARGET
+#     llama-cpp-sys-2/build.rs forwards all CMAKE_* env vars directly to
+#     cmake configure via config.define(key, value).  cmake then appends
+#     its own -mmacosx-version-min AFTER CMAKE_C_FLAGS, so Clang's
+#     "last flag wins" rule overrides any default baked into CMAKE_C_FLAGS.
+#
+# force=true is required so that a system-level MACOSX_DEPLOYMENT_TARGET
+# (e.g. set by Xcode to 10.13) cannot silently override these values.
+#
+# ⚠️  After changing either value you MUST delete the stale cmake cache:
+#     rm -rf src-tauri/target/release/build/llama-cpp-sys-2-*/
+#     rm -rf src-tauri/target/debug/build/mlx-sys-burn-*/
+MACOSX_DEPLOYMENT_TARGET    = { value = "14.0", force = true }
+CMAKE_OSX_DEPLOYMENT_TARGET = { value = "14.0", force = true }
+
+# ── macOS: increase main-thread stack size ────────────────────────────────────
+#
+# macOS defaults to an 8 MB main-thread stack.  The Tauri `run()` function
+# has an enormous frame because `generate_handler!` expands ~150 command
+# handlers inline, plus the setup/run closures, `AppState::default()`, and
+# deep generics from serde / HNSW / llama.cpp.  8 MB is not enough.
+#
+# The stack-size flag is emitted from build.rs via `cargo:rustc-link-arg-bins`
+# so it only applies to the final executable, NOT to the lib crate (ld64
+# rejects `-stack_size` on dylibs).  See build.rs for the actual value.
+#
+# NOTE: [target.aarch64-apple-darwin] and [target.x86_64-apple-darwin]
+# sections are intentionally absent here because macOS needs no target-wide
+# rustflags.  The stack size is handled exclusively by build.rs.
+
+# ── Linux: fast linker (mold) ─────────────────────────────────────────────────
+#
+# mold is a drop-in replacement for ld/lld that is significantly faster for
+# large binaries.  When mold + clang are installed, scripts/tauri-build.js
+# automatically sets CARGO_TARGET_*_LINKER and CARGO_TARGET_*_RUSTFLAGS
+# environment variables so cargo uses mold without hardcoding it here.
+#
+# Do NOT hardcode [target.*-unknown-linux-gnu] linker/rustflags here — it
+# breaks builds for developers who don't have mold or clang installed.
+#
+# Install (Debian/Ubuntu): sudo apt install mold clang
+# Install (Fedora):        sudo dnf install mold clang
+# Install (Arch):          sudo pacman -S mold clang
+# Install (macOS):         not needed — Apple's ld is already fast
+
+# ── Windows MSVC: increase main-thread stack size ────────────────────────────
+#
+# Windows allocates only 1 MB of stack to the main thread by default (vs 8 MB
+# on macOS / Linux).  The Tauri + llama.cpp initialisation path uses enough
+# stack (serde, HNSW, deep generics) to hit the guard page and produce a
+# STATUS_STACK_OVERFLOW (0xC00000FD) crash before any window is shown.
+#
+# /STACK:<reserve>[,<commit>]  — PE header stack reservation.
+#   reserve = 8 MB  (8 * 1024 * 1024 = 8388608)
+#   commit  = 64 KB (default; pages are committed lazily, so this is fine)
+#
+# The flag is passed through -C link-args so it works without a separate
+# .cargo/config linker directive.  It only affects the main thread; worker
+# threads set their own size via std::thread::Builder::stack_size.
+# ── Windows MSVC: fast linker (lld-link) ─────────────────────────────────────
+#
+# lld-link is LLVM's drop-in replacement for MSVC's link.exe.  It is
+# significantly faster for large Rust projects (the Windows release build
+# spends most of its time linking).  When LLVM is installed (winget or CI),
+# lld-link.exe is available in the LLVM bin directory.
+#
+# The linker is set via CARGO_TARGET_*_LINKER in the CI workflow and in
+# tauri-build.js (auto-detected).  Do NOT hardcode it here because it
+# breaks builds for developers who don't have LLVM installed — they
+# fall back to the default MSVC link.exe which always works.
+#
+# Install: winget install LLVM.LLVM
+
+# Dynamic CRT: the binary links against vcruntime140.dll / msvcp140.dll.
+# The NSIS installer bundles these DLLs app-locally (in $INSTDIR alongside
+# skill.exe) so users don't need the VC++ Redistributable pre-installed.
+# The installer also offers to download the full VC++ Redist as a fallback.
+[target.x86_64-pc-windows-msvc]
+rustflags = ["-C", "link-args=/STACK:8388608"]
+
+[target.aarch64-pc-windows-msvc]
+rustflags = ["-C", "link-args=/STACK:8388608"]
+
+# ── Windows MinGW (x86_64-pc-windows-gnu): MinGW bash build script ────────────
+#
+[target.x86_64-pc-windows-gnu]
+rustflags = ["-C", "link-args=-Wl,--stack,8388608"]
+
+[target.i686-pc-windows-gnu]
+rustflags = ["-C", "link-args=-Wl,--stack,8388608"]

.dockerignore

@@ -0,0 +1,36 @@
+# Heavy artifacts that should never be sent to the Docker build context.
+# Without this, `docker build` for Dockerfile.upgrade-test transfers tens of
+# GB of local target/ output and chokes on I/O.
+
+# Rust build artifacts
+target/
+src-tauri/target/
+crates/*/target/
+**/*.rlib
+
+# Node / frontend
+node_modules/
+.svelte-kit/
+build/
+.vite/
+
+# IDE / OS
+.git/
+.idea/
+.vscode/
+.DS_Store
+
+# Logs / test results
+test-results/
+playwright-report/
+logs/
+*.log
+*.log.zst
+
+# Local data
+.skill/
+data/
+fixtures/
+
+# Cargo registry should come from the volume mount, not the context
+.cargo/

.envrc

@@ -0,0 +1,48 @@
+# direnv — https://direnv.net/
+# Run `direnv allow` once after cloning.
+#
+# On macOS: sets the default cargo target to Apple Silicon so that
+#   `cargo build`, `cargo check`, `cargo clippy` etc. all target
+#   aarch64-apple-darwin without an explicit --target flag.
+#
+# On Windows / Linux: CARGO_BUILD_TARGET is left unset, cargo uses the
+#   host triple (x86_64-pc-windows-msvc / x86_64-unknown-linux-gnu).
+
+if [ "$(uname)" = "Darwin" ]; then
+  export CARGO_BUILD_TARGET=aarch64-apple-darwin
+
+  # Use GNU ar if available (Homebrew binutils) to suppress
+  # "illegal option -- D" warnings from Apple's system ar.
+  # Install: brew install binutils
+  GAR="$(brew --prefix binutils 2>/dev/null)/bin/gar"
+  if [ -x "$GAR" ]; then
+    export AR="$GAR"
+  fi
+
+  # Homebrew cmake/sccache are not on the default PATH when cargo invokes
+  # build scripts. The cmake-0.1.x crate respects CMAKE as the binary path.
+  # Kept out of .cargo/config.toml because [env] is unconditional and would
+  # leak these macOS paths to Windows / Linux runners (cmake-rs panics with
+  # "is `cmake` not installed?" / os error 3).
+  if [ -z "${CMAKE:-}" ] && [ -x "/opt/homebrew/bin/cmake" ]; then
+    export CMAKE="/opt/homebrew/bin/cmake"
+  fi
+  if [ -z "${SCCACHE_PATH:-}" ] && [ -x "/opt/homebrew/bin/sccache" ]; then
+    export SCCACHE_PATH="/opt/homebrew/bin/sccache"
+  fi
+fi
+
+# Use prebuilt llama.cpp if available (skip cmake rebuild).
+# Run `npm run setup:llama-prebuilt` to download.
+if [ -d ".llama-prebuilt/lib" ]; then
+  export LLAMA_PREBUILT_DIR="$(pwd)/.llama-prebuilt"
+fi
+
+# Sibling RLX checkout for optional llm-rlx / text-embeddings-rlx features.
+# Default: symlink ../rlx -> /Users/Shared/rlx (override via rlx.path or RLX_ROOT).
+if [ -f "scripts/ensure-rlx.sh" ]; then
+  bash scripts/ensure-rlx.sh
+fi
+if [ -f "scripts/ensure-rlx-models.sh" ]; then
+  bash scripts/ensure-rlx-models.sh
+fi