0.11.0

.github/workflows/ci.yml

@@ -4,19 +4,6 @@ on:
   push:
 
 jobs:
-  shellcheck:
-    name: ShellCheck
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install shellcheck
-        run: sudo apt-get update && sudo apt-get install -y shellcheck
-
-      - name: Run shellcheck
-        run: shellcheck runtime/overlay-run.sh
-
   test:
     name: Compiler and unit tests
     runs-on: ubuntu-latest
@@ -275,9 +262,86 @@ jobs:
           $bashScript = $bashScript -replace "`r", ""
           wsl -d "$distro" -- bash -lc "$bashScript"
 
+  installer-powershell:
+    name: PowerShell installer (windows-x64)
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build TypeScript + embed assets
+        run: npm run build
+
+      # Same build as release.yml's windows-x64 leg, so the acceptance runs the
+      # real self-contained binary the release ships.
+      - name: Cross-compile windows-x64 standalone binary
+        shell: bash
+        run: |
+          set -euo pipefail
+          bun build --compile --target=bun-windows-x64 ./src/cli.ts --outfile jaiph-windows-x64.exe
+          ls -la jaiph-windows-x64.exe
+
+      - name: Run PowerShell installer acceptance (docs/install.ps1)
+        shell: pwsh
+        run: |
+          $env:JAIPH_TEST_WINDOWS_EXE = Join-Path $env:GITHUB_WORKSPACE "jaiph-windows-x64.exe"
+          ./e2e/tests/installer_powershell.ps1
+
+  windows-native-smoke:
+    name: Native Windows smoke (windows-latest, no WSL)
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build TypeScript + embed assets
+        run: npm run build
+
+      # Same build as release.yml's windows-x64 leg / the installer-powershell
+      # job, so the smoke test runs the real self-contained binary we ship.
+      - name: Cross-compile windows-x64 standalone binary
+        shell: bash
+        run: |
+          set -euo pipefail
+          bun build --compile --target=bun-windows-x64 ./src/cli.ts --outfile jaiph-windows-x64.exe
+          ls -la jaiph-windows-x64.exe
+
+      # Native run only — no `wsl`. Git for Windows' sh.exe (preinstalled on the
+      # runner) is the POSIX shell for inline lines; the harness shadows `wsl` so
+      # any accidental invocation fails the job.
+      - name: Run native Windows smoke (e2e/tests/windows_native_smoke.ps1)
+        shell: pwsh
+        run: |
+          $env:JAIPH_TEST_WINDOWS_EXE = Join-Path $env:GITHUB_WORKSPACE "jaiph-windows-x64.exe"
+          ./e2e/tests/windows_native_smoke.ps1
+
   docker-publish:
     name: Publish Docker runtime image
-    needs: [test, e2e, docs-local, e2e-wsl]
+    needs: [test, e2e, docs-local, e2e-wsl, installer-powershell, windows-native-smoke]
     if: github.ref == 'refs/heads/nightly' || startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     permissions:
@@ -323,4 +387,4 @@ jobs:
         run: |
           TAG="$(echo '${{ steps.meta.outputs.tags }}' | cut -d',' -f1)"
           docker run --rm --entrypoint sh "${TAG}" -lc "command -v jaiph && jaiph --version"
-          docker run --rm --user 0:0 --cap-drop ALL --cap-add SYS_ADMIN --entrypoint sh "${TAG}" -lc "command -v jaiph"
+          docker run --rm --cap-drop ALL --entrypoint sh "${TAG}" -lc "command -v jaiph"

.github/workflows/release.yml

@@ -57,15 +57,24 @@ jobs:
           - target: bun-darwin-arm64
             os: darwin
             arch: arm64
+            ext: ""
           - target: bun-darwin-x64
             os: darwin
             arch: x64
+            ext: ""
           - target: bun-linux-x64
             os: linux
             arch: x64
+            ext: ""
           - target: bun-linux-arm64
             os: linux
             arch: arm64
+            ext: ""
+          # Bun has no bun-windows-arm64 target; windows ships x64 only.
+          - target: bun-windows-x64
+            os: windows
+            arch: x64
+            ext: ".exe"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -88,20 +97,61 @@ jobs:
       - name: Cross-compile standalone binary for ${{ matrix.target }}
         run: |
           set -euo pipefail
-          bun build --compile --target=${{ matrix.target }} ./src/cli.ts --outfile "jaiph-${{ matrix.os }}-${{ matrix.arch }}"
-          ls -la "jaiph-${{ matrix.os }}-${{ matrix.arch }}"
+          out="jaiph-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.ext }}"
+          bun build --compile --target=${{ matrix.target }} ./src/cli.ts --outfile "${out}"
+          ls -la "${out}"
 
       - name: Upload binary artifact
         uses: actions/upload-artifact@v4
         with:
-          name: jaiph-${{ matrix.os }}-${{ matrix.arch }}
-          path: jaiph-${{ matrix.os }}-${{ matrix.arch }}
+          name: jaiph-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.ext }}
+          path: jaiph-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.ext }}
           if-no-files-found: error
           retention-days: 7
 
+  sanity-windows:
+    name: Sanity gate (windows-x64 --version)
+    needs: build
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Resolve tag and channel
+        id: meta
+        shell: bash
+        run: |
+          set -euo pipefail
+          case "${GITHUB_REF}" in
+            refs/tags/v*)
+              tag="${GITHUB_REF_NAME}"; channel="stable" ;;
+            refs/heads/nightly)
+              tag="nightly"; channel="nightly" ;;
+            *)
+              echo "Unsupported ref for release: ${GITHUB_REF}" >&2; exit 1 ;;
+          esac
+          echo "tag=${tag}" >> "${GITHUB_OUTPUT}"
+          echo "channel=${channel}" >> "${GITHUB_OUTPUT}"
+
+      - name: Download windows binary artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: jaiph-windows-x64.exe
+          path: release-assets
+
+      - name: Sanity gate (windows-x64 --version)
+        working-directory: release-assets
+        shell: bash
+        run: |
+          set -euo pipefail
+          got="$(./jaiph-windows-x64.exe --version)"
+          echo "got: ${got}"
+          bash ../scripts/release-version-check.sh \
+            "${{ steps.meta.outputs.channel }}" "${{ steps.meta.outputs.tag }}" "${got}"
+
   release:
     name: Publish release assets
-    needs: build
+    needs: [build, sanity-windows]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -118,7 +168,7 @@ jobs:
           case "${GITHUB_REF}" in
             refs/tags/v*)
               tag="${GITHUB_REF_NAME}"; channel="stable" ;;
-            refs/heads/nightly|refs/tags/nightly)
+            refs/heads/nightly)
               tag="nightly"; channel="nightly" ;;
             *)
               echo "Unsupported ref for release: ${GITHUB_REF}" >&2; exit 1 ;;
@@ -138,67 +188,125 @@ jobs:
           set -euo pipefail
           ls -la
           rm -f SHA256SUMS
-          sha256sum jaiph-darwin-arm64 jaiph-darwin-x64 jaiph-linux-x64 jaiph-linux-arm64 > SHA256SUMS
+          sha256sum jaiph-darwin-arm64 jaiph-darwin-x64 jaiph-linux-x64 jaiph-linux-arm64 jaiph-windows-x64.exe > SHA256SUMS
           cat SHA256SUMS
 
-      - name: Sanity gate (linux-x64 --version)
+      - name: Install minisign
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq minisign
+
+      - name: Sign SHA256SUMS with minisign
         working-directory: release-assets
+        env:
+          MINISIGN_SECRET_KEY: ${{ secrets.MINISIGN_SECRET_KEY }}
         run: |
           set -euo pipefail
-          chmod +x jaiph-linux-x64
-          got="$(./jaiph-linux-x64 --version)"
-          echo "got: ${got}"
-          if [ "${{ steps.meta.outputs.channel }}" = "stable" ]; then
-            tag="${{ steps.meta.outputs.tag }}"
-            expected="jaiph ${tag#v}"
-            if [ "${got}" != "${expected}" ]; then
-              echo "Version sanity check failed: expected '${expected}', got '${got}'" >&2
+          rm -f SHA256SUMS.minisig
+          if [ -z "${MINISIGN_SECRET_KEY}" ]; then
+            echo "MINISIGN_SECRET_KEY secret is not set — skipping detached signature." >&2
+            echo "Set the secret to enable signed releases (see docs/contributing.md)." >&2
+            echo "Installers fail closed without SHA256SUMS.minisig; do not upload an empty stub" >&2
+            echo "(GitHub rejects 0-byte release assets with HTTP 400 Bad Content-Length)." >&2
+          else
+            command -v minisign >/dev/null
+            key_file="$(mktemp)"
+            cleanup() { rm -f "${key_file}"; }
+            trap cleanup EXIT
+
+            if [[ "${MINISIGN_SECRET_KEY}" == untrusted\ comment:* ]]; then
+              printf '%s' "${MINISIGN_SECRET_KEY}" > "${key_file}"
+            else
+              if ! printf '%s' "${MINISIGN_SECRET_KEY}" | base64 -d > "${key_file}" 2>/dev/null; then
+                echo "MINISIGN_SECRET_KEY must be the full jaiph.key file or base64 -w0 jaiph.key" >&2
+                exit 1
+              fi
+            fi
+            chmod 600 "${key_file}"
+
+            first_line="$(head -1 "${key_file}")"
+            if [[ "${first_line}" == *"public key"* ]]; then
+              echo "MINISIGN_SECRET_KEY is jaiph.pub (public key). Paste jaiph.key (secret key) instead." >&2
               exit 1
             fi
-          else
-            if ! printf '%s\n' "${got}" | grep -Eq '^jaiph [0-9]+\.[0-9]+\.[0-9]+'; then
-              echo "Version sanity check failed: '${got}' does not look like a jaiph version" >&2
+            if [[ "${first_line}" != *"secret key"* ]]; then
+              echo "MINISIGN_SECRET_KEY does not look like a minisign secret key." >&2
+              echo "First line: ${first_line}" >&2
               exit 1
             fi
+            if [ "$(grep -c . "${key_file}")" -lt 2 ]; then
+              echo "MINISIGN_SECRET_KEY is incomplete — need header line and base64 body line." >&2
+              exit 1
+            fi
+
+            # minisign -W still writes "encrypted secret key" with an empty password.
+            if [[ "${first_line}" == *"encrypted secret key"* ]]; then
+              printf '\n' | minisign -S -s "${key_file}" -m SHA256SUMS -x SHA256SUMS.minisig
+            else
+              minisign -S -s "${key_file}" -m SHA256SUMS -x SHA256SUMS.minisig
+            fi
+            echo "SHA256SUMS.minisig written."
           fi
 
+      - name: Sanity gate (linux-x64 --version)
+        working-directory: release-assets
+        run: |
+          set -euo pipefail
+          chmod +x jaiph-linux-x64
+          got="$(./jaiph-linux-x64 --version)"
+          echo "got: ${got}"
+          bash ../scripts/release-version-check.sh \
+            "${{ steps.meta.outputs.channel }}" "${{ steps.meta.outputs.tag }}" "${got}"
+
       - name: Publish stable release ${{ steps.meta.outputs.tag }}
         if: steps.meta.outputs.channel == 'stable'
         working-directory: release-assets
         run: |
           set -euo pipefail
           tag="${{ steps.meta.outputs.tag }}"
+          assets=(
+            jaiph-darwin-arm64 jaiph-darwin-x64
+            jaiph-linux-x64 jaiph-linux-arm64
+            jaiph-windows-x64.exe
+            SHA256SUMS
+          )
+          if [ -s SHA256SUMS.minisig ]; then
+            assets+=(SHA256SUMS.minisig)
+          elif gh release view "${tag}" >/dev/null 2>&1; then
+            # Drop a stale signature so installers fail closed instead of verifying an old one.
+            gh release delete-asset "${tag}" SHA256SUMS.minisig --yes 2>/dev/null || true
+          fi
           if gh release view "${tag}" >/dev/null 2>&1; then
-            gh release upload "${tag}" --clobber \
-              jaiph-darwin-arm64 jaiph-darwin-x64 \
-              jaiph-linux-x64 jaiph-linux-arm64 \
-              SHA256SUMS
+            gh release upload "${tag}" --clobber "${assets[@]}"
           else
             gh release create "${tag}" \
               --title "${tag}" \
-              --notes "Jaiph ${tag} — standalone binaries (darwin/linux × arm64/x64) plus SHA256SUMS." \
-              jaiph-darwin-arm64 jaiph-darwin-x64 \
-              jaiph-linux-x64 jaiph-linux-arm64 \
-              SHA256SUMS
+              --notes "Jaiph ${tag} — standalone binaries (darwin/linux × arm64/x64, windows x64) plus SHA256SUMS." \
+              "${assets[@]}"
           fi
 
       - name: Publish nightly prerelease
         if: steps.meta.outputs.channel == 'nightly'
         working-directory: release-assets
         run: |
           set -euo pipefail
+          assets=(
+            jaiph-darwin-arm64 jaiph-darwin-x64
+            jaiph-linux-x64 jaiph-linux-arm64
+            jaiph-windows-x64.exe
+            SHA256SUMS
+          )
+          if [ -s SHA256SUMS.minisig ]; then
+            assets+=(SHA256SUMS.minisig)
+          elif gh release view nightly >/dev/null 2>&1; then
+            # Drop a stale signature so installers fail closed instead of verifying an old one.
+            gh release delete-asset nightly SHA256SUMS.minisig --yes 2>/dev/null || true
+          fi
           if gh release view nightly >/dev/null 2>&1; then
-            gh release upload nightly --clobber \
-              jaiph-darwin-arm64 jaiph-darwin-x64 \
-              jaiph-linux-x64 jaiph-linux-arm64 \
-              SHA256SUMS
+            gh release upload nightly --clobber "${assets[@]}"
           else
             gh release create nightly \
               --title "Nightly" \
               --notes "Rolling nightly prerelease — standalone binaries built from the latest \`nightly\` branch." \
               --prerelease \
               --target "${GITHUB_SHA}" \
-              jaiph-darwin-arm64 jaiph-darwin-x64 \
-              jaiph-linux-x64 jaiph-linux-arm64 \
-              SHA256SUMS
+              "${assets[@]}"
           fi

.gitignore

@@ -24,6 +24,9 @@ pnpm-debug.log*
 .env
 .env.*
 
+# minisign release signing (public key jaiph.pub is committed)
+jaiph.key
+
 # OS/editor files
 .DS_Store
 .vscode/

.jaiph/architect_review.jh

@@ -4,11 +4,9 @@ import "jaiphlang/queue" as queue
 import "./lib_common.jh" as common
 
 config {
-  agent.backend = "cursor"
-  agent.default_model = "composer-2"
-  agent.cursor_flags = "--force"
-  # agent.backend = "claude"
-  # agent.claude_flags = "--permission-mode bypassPermissions"
+  agent.backend = "claude"
+  agent.model = "opus"
+  agent.claude_flags = "--permission-mode bypassPermissions"
 }
 
 script jaiph_review_body_file = `printf '%s\n' "$JAIPH_WORKSPACE/.jaiph/tmp/architect_review_body.txt"`