tokio 1.54 deprecates AsyncFd::with_interest as unsound (RUSTSEC-2026-0386)
and Linux clippy flagged it. register_with_interest states the contract
the OwnedFd already keeps: the fd stays open and the same while the
AsyncFd owns it.
The removed jsonwebtoken/rsa stack leaves the notices; updated crates
carry their new versions. tonic 0.14.9 puts MIT headers on its sources,
which cargo-about pasted in as ten license texts; about.toml now pins
tonic to its LICENSE file by checksum.
unsafe-libyaml comes through serde_yaml 0.9, its final release. zvariant,
zbus_names and zvariant_derive were folded into zbus 6, but dark-light,
even at 3.0, still needs zbus 5. cargo deny check advisories passes.
The workspace pin goes from 0.13 to 0.14, which brings zstd-safe 8.2.
tonic 0.14.9 follows onto zstd 0.14, so 0.13 leaves the lock. kigi-shell
declared zstd but never used it; the declaration goes.
The workspace pin goes from 8 to 9, kigi-tools drops its separate zip 3
pin for the workspace dependency, and office_oxide 0.1.16 follows onto
zip 9. zip 9 decodes entry names on demand and can fail; the PPTX reader
and the Windows update unpacker now report that error. The zip unpacker
gains the two tests the tar path already had.
kigi-shell declared both, but nothing has used them since the device-flow
rewrite (021b824). Removing them takes 24 crates out of the graph,
crypto-bigint 0.5 (RUSTSEC-2026-0387) among them, and retires the rsa
ignore (RUSTSEC-2023-0071) in deny.toml.
cargo deny advisories went red after 0.1.21. These are the semver-compatible
fixes: rustls 0.23.46, rustls-webpki 0.103.16, webpki-roots and
webpki-root-certs 1.0.11, tokio 1.54.1, ctutils 0.4.7, libz-sys 1.1.31,
pulldown-cmark 0.13.6, zstd-safe 7.3.0, zstd-sys 2.1.2. clipboard-win 5.4.1
was yanked; 5.4.3 replaces it.
Generated on Linux with cargo-about 0.9.2. 0.9.3 pastes ring's source
files in as license text, and a Windows run lists a different crate set,
so RELEASE.md now pins both.
- Worker proxies install.sh/install.ps1 from raw.githubusercontent.com.
- dist bundle: repo, releases and issues links go to
github.com/ELY-Open-Source/Kigi-CLI, and the Gitea icon and labels become
the GitHub mark ("Star on GitHub").
Co-Authored-By: Claude <noreply@anthropic.com>
- kigi-env: update_base_url defaults to
api.github.com/repos/ELY-Open-Source/Kigi-CLI/releases.
- install.sh / install.ps1: resolve releases from the same API.
- /feedback and the no-session feedback fallback open GitHub issues/new;
/docs opens the README on GitHub.
- SECURITY, NOTICE, AGENTS, CONTRIBUTING: GitHub repo, issues and fork-based
pull requests replace git.zacharyzhang.com and AGit.
Co-Authored-By: Claude <noreply@anthropic.com>
The first release built and published on Gitea since the forge moved back.
THIRD-PARTY-NOTICES carries the new workspace crate versions; no dependency changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The GitHub account is gone again, so git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI
is the canonical repo. Reverse f7a4cb6:
- .gitea/workflows/release.yml: restore the Gitea edition retired in f7a4cb6
(draft release, per-target upload, SHA256SUMS, then publish). The Windows
leg runs on the windows-amd64 label the current runner advertises.
- .github/workflows/{release,warm-cache}.yml: drop them; they target hosted
GitHub runners and softprops, and Gitea ignores them once .gitea exists.
- kigi-env: update_base_url defaults to the Gitea Releases API again.
- install.sh / install.ps1: resolve releases from git.zacharyzhang.com.
- feedback, /docs, SECURITY.md, frontend worker + site: repo, issues and
raw-file links point at git.zacharyzhang.com.
- docs/RELEASE.md: Gitea edition of the checklist with the current runners.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
After the base URL, name, and key steps, the login now opens a model
selection screen instead of blindly saving. The listing fetch runs
concurrently with a manual-id input — a WAF challenge page or a 404 no
longer passes validation silently: a base without a /vN tail is probed
once as {base}/v1 and the working base is adopted, an anthropic-wire
listing that 401s on x-api-key retries once with Bearer (relays gate
GET /models on Bearer while /messages takes the key header), and a
failed fetch shows its reason while manual add stays usable. The chosen
ids persist as [platforms.<name>] models = [...]; catalog assembly
synthesizes selected ids the listing never served (before [model.*]
overrides so they compose) and filters unselected provider entries
(after overrides, authoritative in the provider namespace). Provider-
owned entries keep their declared wire against donor backend
inheritance, and listing errors quote line/column only — a reflected
body could carry the key.
The API-key, custom-provider, and loopback paste boxes matched
KeyCode::Char without checking modifiers, so Ctrl+V inserted a literal
'v' and no chord read the host clipboard. The arms now read the
clipboard through is_paste_key/is_inline_paste_key (the picker.rs
pattern) and the char fallthrough is gated by is_text_input_key, so
Ctrl+letter chords no longer type.
The subagent auth-scheme lookup is now a function with a test. The failed-login
span carries the same method id as the successful one. README order matches the
code: the provider is saved, then the key is checked.
The Codex backend (client_version 0.159.0) served eight list+supported models on
2026-09-29, gpt-6.1-sol first: context 272000, efforts low..max, default low.
POST /codex/responses with kigi's codex headers answers 200 and completes.
The picker lists Custom provider (OpenAI compatible) and (Anthropic compatible).
The TUI asks for a base URL, a name (default from the host), and a key, saves the
definition and the key, and the agent validates the key against GET {base}/models.
PTY e2e covers both wires against the mock inference server.
reconstruct_full_config and the subagent spawn resolved both from a disk reload
that never holds fetched entries, so a fetched Messages model (anthropic,
minimax) went out with Authorization: Bearer instead of x-api-key.
[platforms.<name>] with base_url and api (openai or anthropic) declares a provider.
Its key lives in auth.json under the name or in the table; /models is fetched per
provider, entries are keyed <name>/<model>, and the key is stamped in memory only.
The first Ctrl+C clears the draft; the second did nothing and left the user in
comment mode. Both the approval and the casual preview paths now cancel.
y copied the truncated display row. Saving or discarding a row edit left focus on
the queue pane, so the next Enter re-opened the edit instead of sending.
The Codex backend (client_version 0.156.0) served seven list+supported
models on 2026-09-22: gpt-6-astra, gpt-6-sol, gpt-6-luna, then
gpt-5.6-sol/terra/luna and gpt-5.5. Sol and Luna carry context 272000,
efforts low..max, default medium. POST /codex/responses with kigi's codex
headers answers 200 and completes for both.
`shift_enter_unavailable` kept its own list of brands and missed every
other reason the Kitty keyboard protocol gets skipped: JetBrains, screen,
tmux below 3.3 and tmux with `extended-keys off` all swallow it, yet the
prompt still advertised Shift+Enter there. It now reads
`kitty_skip_reason` directly. Two skips deliver the modifier another way
and stay available: Apple Terminal, where `route_enter` polls
CoreGraphics, and Windows Terminal, where the console key record carries
SHIFT — a bare ConHost, only optimistically refined to Windows Terminal,
keeps advertising Alt+Enter.
The old list also carried a `VTE_VERSION >= 8200` cutoff, citing VTE
0.82.0 as the first release with the protocol. It is not: at tag 0.82.0
the string "kitty" appears nowhere in `src/parser-seq.py`, `src/vte.cc`
or `src/widget.cc`, and `_vte_keymap_GDK_Return` encodes only Alt
(`ESC CR`), so Shift+Enter leaves a VTE terminal as the same bare CR as
Enter. Every VTE now advertises Alt+Enter, and `/terminal-setup` stops
telling GNOME Terminal users to upgrade to a version that would not
help. It also stops advertising Alt+Enter to WezTerm, which binds that
chord to ToggleFullScreen.
雷电芽衣
ZacharyZhang-NYandClaude