chore(release): bump workspace version to 0.1.12

Every crate inherits `workspace.package.version`, so the single edit plus
the refreshed lockfile carries the release. The `v0.1.12` tag is what
triggers the build; release.yml gates the tag against this value, and
`cargo metadata --locked` passes so the build's `--locked` will too.

This is the first release cut on Gitea Actions. v0.1.6 through v0.1.9 were
all cancelled for want of a runner whose label matched anything, so nothing
has ever published from the new forge — `releases/latest` still 404s, which
is exactly why `kigi update` finds nothing today. Ships the link migration
in the previous commit, so the installers and self-updater published here
point at Gitea instead of a GitHub repo that no longer serves them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -0,0 +1,375 @@
+name: Release
+
+# PRD F8, Gitea edition. On a v* tag push, build the single-file kigi binary
+# for the five supported targets, package kigi-<version>-<target-triple>.
+# {tar.gz|zip} (binary + LICENSE + NOTICE + THIRD-PARTY-NOTICES), and publish
+# them as a Gitea Release alongside SHA256SUMS. install.sh, install.ps1 and
+# auto_update::release_asset_name() all resolve these exact names — keep the
+# naming in lockstep with them.
+#
+# RUNNERS. Gitea has no hosted runners; every label below must be a runner you
+# registered yourself (docs/RELEASE.md has the register commands):
+#
+#   ubuntu-latest   Linux x86_64, container mode — the label the Dokploy box's
+#                   runner already advertises. Builds both Linux targets;
+#                   aarch64 is a cross-compile, so this leg installs the
+#                   aarch64 GNU toolchain. Because the image is a bare
+#                   runner-image, the Linux legs provision their own apt
+#                   packages and rustup (see the provision steps below).
+#                   Registering a dedicated `linux-x86_64:docker://...` runner
+#                   instead is fine — swap the three labels back if you do.
+#   macos-arm64     Apple Silicon Mac, host mode. Builds both Darwin targets;
+#                   x86_64 is a cross-compile against the same SDK. macOS
+#                   CANNOT be built anywhere else — Apple's SDK licence
+#                   restricts it to Apple hardware.
+#   windows-x86_64  Windows x86_64, host mode, with VS 2022 Build Tools
+#                   (C++ workload). Needed because the tree links ring,
+#                   mimalloc, zstd-sys and libz-sys against a static MSVC CRT
+#                   (-C target-feature=+crt-static).
+#
+# SHELLS. Every step names its shell explicitly and the Windows leg never uses
+# bash. On a normal Windows box `bash` resolves to WSL (not Git Bash), and
+# `pwsh` (PowerShell 7) is usually absent — so Windows steps use `powershell`,
+# which is the built-in 5.1. Keep those steps 5.1-compatible: no `&&`, no
+# ternary, no null-coalescing.
+#
+# Note: because this file exists, Gitea ignores .github/workflows entirely.
+#
+# PUBLISH ORDER. The release is created as a draft and only made public once
+# SHA256SUMS is attached, so `releases/latest` never hands the installer a
+# release whose checksum manifest is still missing.
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+env:
+  CARGO_TERM_COLOR: always
+  # Matches the version pinned by the dotslash launcher in bin/protoc. That
+  # launcher is not used here: it has no Windows entry and needs a `cargo
+  # install dotslash` first, so every platform fetches protoc directly.
+  PROTOC_VERSION: "29.3"
+
+jobs:
+  prepare:
+    name: prepare draft release
+    runs-on: ubuntu-latest
+    outputs:
+      release_id: ${{ steps.draft.outputs.release_id }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check tag matches workspace version
+        shell: bash
+        run: |
+          tag_version="${GITHUB_REF_NAME#v}"
+          cargo_version="$(sed -n 's/^version = "\(.*\)"$/\1/p' Cargo.toml | head -n 1)"
+          if [ "$tag_version" != "$cargo_version" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match workspace version $cargo_version" >&2
+            exit 1
+          fi
+
+      - name: Create or reuse draft release
+        id: draft
+        shell: bash
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+        run: |
+          set -eu
+          # The runner-image is bare; jq and curl are both used below.
+          if ! command -v jq >/dev/null || ! command -v curl >/dev/null; then
+            SUDO=""; command -v sudo >/dev/null && SUDO=sudo
+            export DEBIAN_FRONTEND=noninteractive
+            $SUDO apt-get update -qq
+            $SUDO apt-get install -y -qq --no-install-recommends jq curl ca-certificates
+          fi
+
+          # Idempotent so a re-run of a failed tag build reuses the same draft
+          # instead of erroring on a duplicate tag_name.
+          existing="$(curl -sS -H "Authorization: token $TOKEN" \
+            "$API/releases/tags/$GITHUB_REF_NAME")"
+          release_id="$(printf '%s' "$existing" | jq -r '.id // empty')"
+
+          if [ -z "$release_id" ]; then
+            prerelease=false
+            case "$GITHUB_REF_NAME" in *-*) prerelease=true ;; esac
+            created="$(curl -fsS -X POST \
+              -H "Authorization: token $TOKEN" \
+              -H "Content-Type: application/json" \
+              -d "{\"tag_name\":\"$GITHUB_REF_NAME\",\"name\":\"$GITHUB_REF_NAME\",\"draft\":true,\"prerelease\":$prerelease}" \
+              "$API/releases")"
+            release_id="$(printf '%s' "$created" | jq -r '.id')"
+            echo "Created draft release $release_id (prerelease=$prerelease)"
+          else
+            echo "Reusing release $release_id for $GITHUB_REF_NAME"
+          fi
+
+          echo "release_id=$release_id" >> "$GITHUB_OUTPUT"
+
+  build:
+    name: build (${{ matrix.target }})
+    needs: prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            runner: ubuntu-latest
+            protoc: linux-x86_64
+            ext: tar.gz
+            linux: true
+          - target: aarch64-unknown-linux-gnu
+            runner: ubuntu-latest
+            protoc: linux-x86_64
+            ext: tar.gz
+            linux: true
+            cross_gnu: true
+          - target: aarch64-apple-darwin
+            runner: macos-arm64
+            protoc: osx-aarch_64
+            ext: tar.gz
+          - target: x86_64-apple-darwin
+            runner: macos-arm64
+            protoc: osx-aarch_64
+            ext: tar.gz
+          - target: x86_64-pc-windows-msvc
+            runner: windows-x86_64
+            protoc: win64
+            ext: zip
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+
+      # ── linux container provisioning ──────────────────────────────────────
+      # The Linux legs run in a bare gitea runner-image, which ships git and
+      # node for the JavaScript actions but no compiler, no unzip (protoc) and
+      # no rustup. Host-mode macOS and Windows already have their toolchains
+      # installed, so this step is Linux-only.
+      - name: Provision Linux build deps
+        if: matrix.linux
+        shell: bash
+        run: |
+          set -eu
+          SUDO=""; command -v sudo >/dev/null && SUDO=sudo
+          export DEBIAN_FRONTEND=noninteractive
+          $SUDO apt-get update -qq
+          $SUDO apt-get install -y -qq --no-install-recommends \
+            build-essential pkg-config ca-certificates curl unzip tar jq
+
+      # ── protoc ────────────────────────────────────────────────────────────
+      - name: Install protoc (unix)
+        if: matrix.ext == 'tar.gz'
+        shell: bash
+        run: |
+          set -eu
+          url="https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-${{ matrix.protoc }}.zip"
+          curl -fsSL -o protoc.zip "$url"
+          rm -rf "$HOME/protoc"
+          unzip -q -o protoc.zip -d "$HOME/protoc"
+          chmod +x "$HOME/protoc/bin/protoc"
+          echo "$HOME/protoc/bin" >> "$GITHUB_PATH"
+
+      - name: Install protoc (windows)
+        if: matrix.ext == 'zip'
+        shell: powershell
+        run: |
+          $ErrorActionPreference = "Stop"
+          $url = "https://github.com/protocolbuffers/protobuf/releases/download/v$env:PROTOC_VERSION/protoc-$env:PROTOC_VERSION-${{ matrix.protoc }}.zip"
+          Invoke-WebRequest -Uri $url -OutFile protoc.zip
+          $dest = Join-Path $env:USERPROFILE "protoc"
+          if (Test-Path $dest) { Remove-Item $dest -Recurse -Force }
+          Expand-Archive protoc.zip -DestinationPath $dest -Force
+          Add-Content -Path $env:GITHUB_PATH -Value (Join-Path $dest "bin")
+
+      # ── toolchain ─────────────────────────────────────────────────────────
+      # rust-toolchain.toml pins the channel (1.97.0) and preinstalls both
+      # Linux targets; `rustup show` materialises exactly that.
+      - name: Install toolchain (unix)
+        if: matrix.ext == 'tar.gz'
+        shell: bash
+        run: |
+          set -eu
+          # No-op on the macOS host runner, which has rustup installed already.
+          # `--default-toolchain none` leaves the channel choice to
+          # rust-toolchain.toml, which `rustup show` then materialises.
+          if ! command -v rustup >/dev/null; then
+            curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs \
+              | sh -s -- -y --no-modify-path --profile minimal --default-toolchain none
+            echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+            export PATH="$HOME/.cargo/bin:$PATH"
+          fi
+          rustup show
+          rustup target add ${{ matrix.target }}
+
+      - name: Install toolchain (windows)
+        if: matrix.ext == 'zip'
+        shell: powershell
+        run: |
+          $ErrorActionPreference = "Stop"
+          rustup show
+          rustup target add ${{ matrix.target }}
+
+      # ring, mimalloc, zstd-sys and libz-sys are all cc-rs builds, so the
+      # cross target needs its own C toolchain — cc-rs picks these up from the
+      # target-suffixed vars.
+      - name: Install aarch64 cross toolchain
+        if: matrix.cross_gnu
+        shell: bash
+        run: |
+          set -eu
+          SUDO=""; command -v sudo >/dev/null && SUDO=sudo
+          $SUDO apt-get update -qq
+          $SUDO apt-get install -y -qq gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+          {
+            echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc"
+            echo "CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc"
+            echo "CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++"
+            echo "AR_aarch64_unknown_linux_gnu=aarch64-linux-gnu-ar"
+          } >> "$GITHUB_ENV"
+
+      # ── build ─────────────────────────────────────────────────────────────
+      - name: Build kigi (unix)
+        if: matrix.ext == 'tar.gz'
+        shell: bash
+        run: cargo build --profile release-dist -p kigi-bin --locked --target ${{ matrix.target }}
+
+      - name: Build kigi (windows)
+        if: matrix.ext == 'zip'
+        shell: powershell
+        run: |
+          $ErrorActionPreference = "Stop"
+          cargo build --profile release-dist -p kigi-bin --locked --target ${{ matrix.target }}
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+      # ── package, upload, checksum ─────────────────────────────────────────
+      # Archives go straight to the release rather than through the artifact
+      # store: they are large, and the release is the only place install.sh
+      # can read them from anyway. Only the checksum line travels as an
+      # artifact, for the publish job to concatenate.
+      - name: Package and upload (unix)
+        if: matrix.ext == 'tar.gz'
+        shell: bash
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+          RELEASE_ID: ${{ needs.prepare.outputs.release_id }}
+        run: |
+          set -eu
+          version="${GITHUB_REF_NAME#v}"
+          archive="kigi-${version}-${{ matrix.target }}.tar.gz"
+          staging="$(mktemp -d)"
+          cp "target/${{ matrix.target }}/release-dist/kigi" "$staging/kigi"
+          cp LICENSE "$staging/"
+          [ -f NOTICE ] && cp NOTICE "$staging/"
+          for f in THIRD-PARTY-NOTICES THIRD-PARTY-NOTICES.md; do
+            [ -f "$f" ] && cp "$f" "$staging/"
+          done
+          tar -C "$staging" -czf "$archive" .
+
+          curl -fsS -X POST \
+            -H "Authorization: token $TOKEN" \
+            -F "attachment=@${archive}" \
+            "$API/releases/$RELEASE_ID/assets?name=${archive}" > /dev/null
+          echo "Uploaded $archive"
+
+          if command -v sha256sum >/dev/null; then
+            sha256sum "$archive" > "checksum-${{ matrix.target }}.txt"
+          else
+            shasum -a 256 "$archive" > "checksum-${{ matrix.target }}.txt"
+          fi
+          cat "checksum-${{ matrix.target }}.txt"
+
+      - name: Package and upload (windows)
+        if: matrix.ext == 'zip'
+        shell: powershell
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+          RELEASE_ID: ${{ needs.prepare.outputs.release_id }}
+        run: |
+          $ErrorActionPreference = "Stop"
+          $version = $env:GITHUB_REF_NAME.TrimStart("v")
+          $archive = "kigi-$version-${{ matrix.target }}.zip"
+          $staging = Join-Path $env:RUNNER_TEMP "staging"
+          if (Test-Path $staging) { Remove-Item $staging -Recurse -Force }
+          New-Item -ItemType Directory -Force -Path $staging | Out-Null
+          Copy-Item "target/${{ matrix.target }}/release-dist/kigi.exe" (Join-Path $staging "kigi.exe")
+          Copy-Item LICENSE $staging
+          if (Test-Path NOTICE) { Copy-Item NOTICE $staging }
+          foreach ($f in @("THIRD-PARTY-NOTICES", "THIRD-PARTY-NOTICES.md")) {
+            if (Test-Path $f) { Copy-Item $f $staging }
+          }
+          Compress-Archive -Path (Join-Path $staging "*") -DestinationPath $archive -Force
+
+          # System32\curl.exe, not PowerShell's `curl` alias for
+          # Invoke-WebRequest, which cannot do multipart uploads.
+          $api = "$env:API/releases/$env:RELEASE_ID/assets?name=$archive"
+          & "$env:SystemRoot\System32\curl.exe" -fsS -X POST `
+            -H "Authorization: token $env:TOKEN" `
+            -F "attachment=@$archive" $api
+          if ($LASTEXITCODE -ne 0) { throw "asset upload failed ($LASTEXITCODE)" }
+          Write-Host "Uploaded $archive"
+
+          # sha256sum's exact format, so the publish job can just concatenate.
+          # ASCII keeps the BOM out — a BOM would corrupt the first hash.
+          $hash = (Get-FileHash -Algorithm SHA256 -Path $archive).Hash.ToLowerInvariant()
+          "$hash  $archive" | Out-File -FilePath "checksum-${{ matrix.target }}.txt" -Encoding ascii
+          Get-Content "checksum-${{ matrix.target }}.txt"
+
+      - uses: actions/upload-artifact@v3
+        with:
+          name: checksum-${{ matrix.target }}
+          path: checksum-${{ matrix.target }}.txt
+          if-no-files-found: error
+
+  publish:
+    name: publish release
+    needs: [prepare, build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          path: checksums
+
+      - name: Assemble SHA256SUMS
+        shell: bash
+        run: |
+          set -eu
+          # download-artifact v3 nests each artifact in its own directory. The
+          # Windows line arrives CRLF-terminated; strip CR so every line is LF
+          # for install.sh's `read -r hash name`.
+          find checksums -name 'checksum-*.txt' -exec cat {} + \
+            | tr -d '\r' | grep -v '^$' | sort -k2 > SHA256SUMS
+          lines="$(wc -l < SHA256SUMS)"
+          if [ "$lines" -ne 5 ]; then
+            echo "expected 5 checksum lines, got $lines" >&2
+            cat SHA256SUMS >&2
+            exit 1
+          fi
+          cat SHA256SUMS
+
+      - name: Attach SHA256SUMS and publish
+        shell: bash
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+          RELEASE_ID: ${{ needs.prepare.outputs.release_id }}
+        run: |
+          set -eu
+          curl -fsS -X POST \
+            -H "Authorization: token $TOKEN" \
+            -F "attachment=@SHA256SUMS" \
+            "$API/releases/$RELEASE_ID/assets?name=SHA256SUMS" > /dev/null
+
+          # Flip the draft public only now that every asset install.sh looks
+          # for is attached.
+          curl -fsS -X PATCH \
+            -H "Authorization: token $TOKEN" \
+            -H "Content-Type: application/json" \
+            -d '{"draft":false}' \
+            "$API/releases/$RELEASE_ID" > /dev/null
+          echo "Published $GITHUB_REF_NAME"

.gitignore

@@ -1,3 +1,10 @@
 /target
 **/*.rs.bk
 .DS_Store
+
+# frontend/ (kigicli.dev worker)
+.wrangler/
+node_modules/
+
+# Runner-setup prompt; holds a Gitea registration token once filled in.
+/prompt.txt

Cargo.lock

@@ -5442,7 +5442,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-acp-lib"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "agent-client-protocol",
  "async-trait",
@@ -5456,7 +5456,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-agent"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "chrono",
  "dirs 6.0.0",
@@ -5486,7 +5486,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-agent-lifecycle"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "async-trait",
  "tokio",
@@ -5495,7 +5495,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-auth"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "async-trait",
  "http 1.4.2",
@@ -5508,7 +5508,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-bin"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "clap",
@@ -5543,7 +5543,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-chat-state"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "indexmap",
  "kigi-compaction",
@@ -5560,7 +5560,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-codebase-graph"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "ahash",
  "clap",
@@ -5596,7 +5596,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-compaction"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5609,7 +5609,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-config"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "base64",
  "blake3",
@@ -5632,7 +5632,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-config-types"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "agent-client-protocol",
  "indexmap",
@@ -5646,7 +5646,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-crash-handler"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "backtrace",
  "libc",
@@ -5657,7 +5657,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-env"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "tracing",
  "url",
@@ -5665,7 +5665,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-fast-worktree"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "bytes",
@@ -5697,7 +5697,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-file-utils"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "aws-config",
@@ -5721,7 +5721,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-fsnotify"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "criterion",
  "dunce",
@@ -5742,7 +5742,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-gix-status"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "gix",
  "kigi-test-utils",
@@ -5752,7 +5752,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-hooks"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "fastrand",
  "kigi-config",
@@ -5771,7 +5771,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-hooks-plugins-types"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "serde",
  "serde_json",
@@ -5779,7 +5779,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-http"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "kigi-auth",
  "kigi-log",
@@ -5794,7 +5794,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-hunk-tracker"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "chrono",
  "dunce",
@@ -5815,14 +5815,14 @@ dependencies = [
 
 [[package]]
 name = "kigi-interjection-core"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "kigi-log"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "chrono",
@@ -5840,7 +5840,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-markdown"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anstyle",
  "anstyle-lossy",
@@ -5864,14 +5864,14 @@ dependencies = [
 
 [[package]]
 name = "kigi-markdown-core"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "pulldown-cmark",
 ]
 
 [[package]]
 name = "kigi-mcp"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "agent-client-protocol",
  "async-trait",
@@ -5908,7 +5908,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-memory"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -5942,7 +5942,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-mermaid"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "fontdb",
  "image",
@@ -5960,7 +5960,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-models"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "kigi-env",
  "serde",
@@ -5970,7 +5970,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-pager-minimal"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "chrono",
  "crossterm",
@@ -5987,7 +5987,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-pager-pty-harness"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "alacritty_terminal",
  "anyhow",
@@ -6012,7 +6012,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-pager-render"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "agent-client-protocol",
  "anstyle",
@@ -6064,7 +6064,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-paths"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "camino",
  "serde",
@@ -6074,7 +6074,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-prompt-queue"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "serde",
  "serde_json",
@@ -6082,7 +6082,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-proto-build"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "pbjson-build",
@@ -6093,7 +6093,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-ratatui-inline"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "ansi-width",
  "anstyle-parse 0.2.7",
@@ -6110,7 +6110,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-ratatui-textarea"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "arboard",
  "chrono",
@@ -6131,7 +6131,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-sampler"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "async-openai",
  "async-stream",
@@ -6154,7 +6154,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-sampling-types"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "assert_matches",
  "async-openai",
@@ -6171,7 +6171,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-sandbox"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "chrono",
@@ -6192,7 +6192,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-secrets"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "regex",
  "serde_json",
@@ -6230,7 +6230,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-shell"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "agent-client-protocol",
  "anyhow",
@@ -6367,7 +6367,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-shell-base"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "chrono",
@@ -6392,7 +6392,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-sqlite-journal"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "libc",
  "rusqlite",
@@ -6403,7 +6403,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-subagent-resolution"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "kigi-sampling-types",
  "kigi-tool-types",
@@ -6418,7 +6418,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-system-power"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "windows-sys 0.59.0",
  "zbus",
@@ -6426,7 +6426,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-test-support"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "agent-client-protocol",
  "anyhow",
@@ -6448,7 +6448,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-test-utils"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "runfiles",
  "tracing",
@@ -6457,11 +6457,11 @@ dependencies = [
 
 [[package]]
 name = "kigi-token-estimation"
-version = "0.1.10"
+version = "0.1.12"
 
 [[package]]
 name = "kigi-tool-protocol"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "kigi-tool-types",
  "serde",
@@ -6472,7 +6472,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-tool-runtime"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -6490,7 +6490,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-tool-types"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "minijinja",
  "schemars 1.2.1",
@@ -6500,7 +6500,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-tools"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -6577,7 +6577,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-tools-api"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "kigi-proto-build",
  "kigi-tool-protocol",
@@ -6590,11 +6590,11 @@ dependencies = [
 
 [[package]]
 name = "kigi-tracing-macros"
-version = "0.1.10"
+version = "0.1.12"
 
 [[package]]
 name = "kigi-tty-utils"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "libc",
  "nix 0.30.1",
@@ -6604,7 +6604,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-tui"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "agent-client-protocol",
  "ansi-to-tui",
@@ -6691,7 +6691,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-update"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "dunce",
@@ -6720,14 +6720,14 @@ dependencies = [
 
 [[package]]
 name = "kigi-version"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "semver",
 ]
 
 [[package]]
 name = "kigi-workspace"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "agent-client-protocol",
  "anyhow",
@@ -6806,7 +6806,7 @@ dependencies = [
 
 [[package]]
 name = "kigi-workspace-types"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "base64",
  "chrono",
@@ -8840,7 +8840,7 @@ dependencies = [
 
 [[package]]
 name = "ptyctl"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "alacritty_terminal",
  "anyhow",
@@ -8858,7 +8858,7 @@ dependencies = [
 
 [[package]]
 name = "ptyctl-cli"
-version = "0.1.10"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "axum",

Cargo.toml

@@ -76,7 +76,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.1.10"
+version = "0.1.12"
 edition = "2024"
 license = "Apache-2.0"
 

README.md

@@ -36,12 +36,12 @@ key? OpenAI, Anthropic, Google, DeepSeek, Groq, Moonshot and
 
 ```sh
 # macOS / Linux
-curl -fsSL https://raw.githubusercontent.com/ZacharyZhang-NY/Kigi-CLI/main/install.sh | bash
+curl -fsSL https://kigicli.dev/install.sh | bash
 ```
 
 ```powershell
 # Windows PowerShell
-irm https://raw.githubusercontent.com/ZacharyZhang-NY/Kigi-CLI/main/install.ps1 | iex
+irm https://kigicli.dev/install.ps1 | iex
 ```
 
 ```sh
@@ -176,8 +176,8 @@ keyring entry, and its own `KIGI_*` env vars, and never touches what the
 official `kimi` CLI installed. `kigi import-kimi` copies your old config over
 once, read-only.
 
-**Zero telemetry.** It talks to the APIs you configured, GitHub Releases, and
-your own MCP servers. Nothing else.
+**Zero telemetry.** It talks to the APIs you configured, the Kigi release
+server, and your own MCP servers. Nothing else.
 
 ## License
 

SECURITY.md

@@ -1,8 +1,10 @@
 # Security Policy
 
-Kigi is a community build; report vulnerabilities via
-[GitHub private vulnerability reporting](https://github.com/ZacharyZhang-NY/Kigi-CLI/security/advisories/new)
-on this repository. Please do not open public issues for security reports.
+Kigi is a community build; report vulnerabilities on the
+[Kigi issue tracker](https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/issues).
+Issues there are public, so please leave out any detail that would make a
+report directly exploitable — open with the affected area and impact, and a
+maintainer will follow up for the rest.
 
 Dependency advisories are gated in CI with `cargo deny check advisories`;
 documented exceptions live in `deny.toml`.

crates/codegen/kigi-env/src/lib.rs

@@ -11,7 +11,8 @@ pub struct KigiEndpoints {
     pub coding_api_base_url: &'static str,
     /// OAuth device-flow host for Kimi Code subscription login.
     pub oauth_host: &'static str,
-    /// GitHub Releases API endpoint the self-updater polls.
+    /// Releases API endpoint the self-updater polls (GitHub-Releases-shaped;
+    /// Gitea's `/api/v1` serves the same wire format).
     pub update_base_url: &'static str,
     /// Human-facing page for subscription upgrade guidance.
     pub upgrade_page_url: &'static str,
@@ -20,7 +21,7 @@ pub struct KigiEndpoints {
 pub const PRODUCTION_ENDPOINTS: KigiEndpoints = KigiEndpoints {
     coding_api_base_url: "https://api.kimi.com/coding/v1",
     oauth_host: "https://auth.kimi.com",
-    update_base_url: "https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases",
+    update_base_url: "https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases",
     upgrade_page_url: "https://www.kimi.com/code/",
 };
 
@@ -29,7 +30,7 @@ pub const CODE_BASE_URL_ENV: &str = "KIGI_CODE_BASE_URL";
 /// Env var overriding [`oauth_host`] (PRD F1).
 pub const OAUTH_HOST_ENV: &str = "KIGI_OAUTH_HOST";
 /// Env var overriding [`update_base_url`] (PRD F8). Points the self-updater
-/// at an alternate GitHub-Releases-shaped API (mirrors, tests).
+/// at an alternate GitHub/Gitea-Releases-shaped API (mirrors, tests).
 pub const UPDATE_BASE_URL_ENV: &str = "KIGI_UPDATE_BASE_URL";
 
 fn resolve(var: &str, compiled: &'static str) -> String {

crates/codegen/kigi-shell/src/agent/feedback_client.rs

@@ -3,7 +3,7 @@
 //! Port of kimi-cli's `/feedback` slash command (kimi-cli
 //! `src/kimi_cli/ui/shell/slash.py`, `feedback()`): subscription (OAuth)
 //! sessions POST the user's feedback text to `{coding_api_base_url}/feedback`
-//! with a Bearer token; everyone else is pointed at the GitHub issue tracker.
+//! with a Bearer token; everyone else is pointed at the project issue tracker.
 //! The request body carries exactly the fields kimi-cli sends:
 //! `session_id`, `content`, `version`, `os`, `model`.
 
@@ -12,7 +12,8 @@ use std::sync::Arc;
 use serde::Serialize;
 
 /// Where non-subscription users (no OAuth session) submit feedback instead.
-pub const FEEDBACK_ISSUES_URL: &str = "https://github.com/ZacharyZhang-NY/Kigi-CLI/issues";
+pub const FEEDBACK_ISSUES_URL: &str =
+    "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/issues";
 
 /// HTTP error from the feedback endpoint with a preserved status code, so
 /// callers can distinguish auth failures (401) without string matching.

crates/codegen/kigi-tools/src/implementations/kigi/web_fetch/config.rs

@@ -10,7 +10,7 @@ use crate::register_resource;
 pub const MAX_URL_LENGTH: usize = 2_000;
 pub const MAX_REDIRECTS: usize = 10;
 pub const USER_AGENT_STRING: &str =
-    "Mozilla/5.0 (compatible; kigi-agent/1.0; +https://github.com/ZacharyZhang-NY/Kigi-CLI)";
+    "Mozilla/5.0 (compatible; kigi-agent/1.0; +https://kigicli.dev)";
 
 /// Runtime-configurable parameters for the `web_fetch` tool.
 ///

crates/codegen/kigi-tui/src/app/dispatch/router.rs

@@ -62,6 +62,7 @@ use super::session::lifecycle::{
     clear_startup_actions, dispatch_agent_type_mismatch_answered, dispatch_exit_session,
     dispatch_new_session, dispatch_new_session_inner, dispatch_new_session_with_id,
     dispatch_new_worktree_session, dispatch_trust_folder, open_new_session_question,
+    skip_picker_and_create_session,
 };
 use super::session::load::{
     dispatch_cycle_session_source_filter, dispatch_load_session, dispatch_pick_content_session,
@@ -749,7 +750,12 @@ pub(crate) fn dispatch(action: Action, app: &mut AppView) -> Vec<Effect> {
             };
             let Some(session_id) = agent.session.session_id.clone() else {
                 agent.session.deferred_model_switch = Some((model_id, effort));
-                return vec![];
+                // No session bound: with a create in flight this is a no-op
+                // and `SessionCreated` applies the stash; with none in flight
+                // (project question pending — only a plain prompt opens it) a
+                // switch would dangle forever, so start the session like the
+                // QueueCommand arm does for queued slash work.
+                return skip_picker_and_create_session(app, id);
             };
             agent.session.model_switch_pending = true;
             vec![Effect::SwitchModel {

crates/codegen/kigi-tui/src/app/dispatch/settings/setters.rs

@@ -1519,12 +1519,20 @@ pub(in crate::app::dispatch) fn set_default_model(
             effort: None,
             prev_model_id: prev_id.clone(),
         });
-    } else if let Some(agent) = app.agents.get_mut(&aid) {
-        // No session id yet — stash for
-        // `EventLoop::on_session_created` to apply once the session
-        // id materialises. Mirrors the deferred-switch handling in
-        // `Action::SwitchModel`.
-        agent.session.deferred_model_switch = Some((new_id, None));
+    } else {
+        if let Some(agent) = app.agents.get_mut(&aid) {
+            // No session id yet — stash for
+            // `EventLoop::on_session_created` to apply once the session
+            // id materialises. Mirrors the deferred-switch handling in
+            // `Action::SwitchModel`.
+            agent.session.deferred_model_switch = Some((new_id, None));
+        }
+        // With no create in flight (project question pending), the stash
+        // would dangle forever — start the session it drains into. No-op
+        // when a create is already pending.
+        effects.extend(
+            crate::app::dispatch::session::lifecycle::skip_picker_and_create_session(app, aid),
+        );
     }
     effects
 }

crates/codegen/kigi-tui/src/app/dispatch/tests/session/lifecycle.rs

@@ -481,7 +481,7 @@ fn session_failed_clears_flag_no_fetches() {
     assert!(!app.agents[&id].pending_extensions_fetch);
 }
 #[test]
-fn switch_model_without_session_does_nothing() {
+fn switch_model_without_session_starts_the_session() {
     let mut app = test_app_with_agent();
     let id = AgentId(0);
     app.agents.get_mut(&id).unwrap().session.session_id = None;
@@ -493,7 +493,14 @@ fn switch_model_without_session_does_nothing() {
         },
         &mut app,
     );
-    assert!(effects.is_empty());
+    // No create was in flight, so the switch starts the session its stash
+    // drains into (the stash alone dangled forever — the /model-in-Downloads
+    // silent no-op). `model_switch_pending` flips on SessionCreated.
+    assert!(
+        effects
+            .iter()
+            .any(|e| matches!(e, Effect::CreateSession { .. }))
+    );
     assert!(!app.agents[&id].session.model_switch_pending);
 }
 #[test]
@@ -668,11 +675,17 @@ fn switch_model_deferred_when_no_session_id() {
         },
         &mut app,
     );
-    assert!(effects.is_empty());
+    // Stashed for SessionCreated — and the session it drains into is started
+    // (no create was in flight; a bare stash never drained).
     assert_eq!(
         app.agents[&id].session.deferred_model_switch,
         Some((model_id, None))
     );
+    assert!(
+        effects
+            .iter()
+            .any(|e| matches!(e, Effect::CreateSession { .. }))
+    );
     assert!(!app.agents[&id].session.model_switch_pending);
 }
 #[test]

crates/codegen/kigi-tui/src/app/dispatch/tests/task_result.rs

@@ -977,6 +977,77 @@ fn switch_model_pending_lifecycle() {
     assert!(!app.agents[&id].session.model_switch_pending);
 }
 
+/// A model switch with no session AND no create in flight (the project-picker
+/// question is pending; only a plain prompt can open it) must start the
+/// deferred session itself, or the stashed switch dangles forever with zero
+/// feedback — `/model X eff` in `~/Downloads` looked like "the model never
+/// changes". Mirrors the `QueueCommand` arm: queued slash work bypasses the
+/// picker and creates the session so the stash drains.
+#[test]
+fn switch_model_without_session_creates_the_deferred_session() {
+    let mut app = test_app_with_agent();
+    let id = AgentId(0);
+    app.agents.get_mut(&id).unwrap().session.session_id = None;
+    // Harness cwd is `/tmp` (a non-project dir); arm the picker gate the way
+    // startup leaves it (the harness pre-marks it shown for other tests).
+    app.project_picker_shown = false;
+    assert!(app.needs_project_picker());
+
+    let model_id = acp::ModelId::new(std::sync::Arc::from("kigi-4.5"));
+    let effects = dispatch(
+        Action::SwitchModel {
+            model_id: model_id.clone(),
+            effort: None,
+        },
+        &mut app,
+    );
+
+    assert_eq!(
+        app.agents[&id].session.deferred_model_switch,
+        Some((model_id, None)),
+        "switch must stay stashed for SessionCreated to apply"
+    );
+    assert!(
+        effects
+            .iter()
+            .any(|e| matches!(e, Effect::CreateSession { .. })),
+        "sessionless switch must start the session the stash drains into"
+    );
+}
+
+/// Same stash path while a create IS in flight (`mcp_init_progress` set):
+/// no duplicate `CreateSession` — the pending create applies the stash.
+#[test]
+fn switch_model_with_create_in_flight_does_not_duplicate_create() {
+    let mut app = test_app_with_agent();
+    let id = AgentId(0);
+    {
+        let agent = app.agents.get_mut(&id).unwrap();
+        agent.session.session_id = None;
+        agent.mcp_init_progress = Some(crate::app::agent_view::McpInitProgress {
+            total: 0,
+            connected: 0,
+            started_at: std::time::Instant::now(),
+        });
+    }
+
+    let effects = dispatch(
+        Action::SwitchModel {
+            model_id: acp::ModelId::new(std::sync::Arc::from("kigi-4.5")),
+            effort: None,
+        },
+        &mut app,
+    );
+
+    assert!(app.agents[&id].session.deferred_model_switch.is_some());
+    assert!(
+        !effects
+            .iter()
+            .any(|e| matches!(e, Effect::CreateSession { .. })),
+        "an in-flight create must not be duplicated"
+    );
+}
+
 #[test]
 fn no_deferred_switch_means_no_extra_effect() {
     // When there is no deferred model switch, SessionCreated should

crates/codegen/kigi-tui/src/slash/commands/docs.rs

@@ -9,8 +9,9 @@ use crate::docs::{all_titles, find_doc};
 use crate::slash::command::{AppCtx, ArgItem, CommandExecCtx, CommandResult, SlashCommand};
 
 /// Online docs landing page (hardcoded like other TUI deep-links; the
-/// project README is the docs entry point for the GitHub-hosted docs).
-pub const BUILD_DOCS_URL: &str = "https://github.com/ZacharyZhang-NY/Kigi-CLI#readme";
+/// project README is the docs entry point for the repo-hosted docs).
+pub const BUILD_DOCS_URL: &str =
+    "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/src/branch/main/README.md";
 
 /// Open How-to Guides or online Build docs.
 pub struct DocsCommand;

crates/codegen/kigi-tui/src/slash/commands/feedback.rs

@@ -1,12 +1,13 @@
-//! `/feedback` -- open the Kigi GitHub issues page.
+//! `/feedback` -- open the Kigi issues page.
 
 use crate::app::actions::Action;
 use crate::slash::command::{CommandExecCtx, CommandResult, SlashCommand};
 
 /// Where feedback goes: the project's own issue tracker. Kigi is a community
-/// build, so its feedback belongs on its GitHub repo — mirroring the official
+/// build, so its feedback belongs on its own repo — mirroring the official
 /// kimi-cli, whose `/feedback` opens its repo's issues page.
-pub const FEEDBACK_ISSUES_URL: &str = "https://github.com/ZacharyZhang-NY/Kigi-CLI/issues";
+pub const FEEDBACK_ISSUES_URL: &str =
+    "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/issues";
 
 /// Open the Kigi issue tracker in the browser.
 pub struct FeedbackCommand;
@@ -17,7 +18,7 @@ impl SlashCommand for FeedbackCommand {
     }
 
     fn description(&self) -> &str {
-        "Report feedback on the Kigi GitHub issues page"
+        "Report feedback on the Kigi issues page"
     }
 
     fn usage(&self) -> &str {

crates/codegen/kigi-update/src/auto_update.rs

@@ -29,17 +29,18 @@ const MSG_AUTO_UPDATE_BACKGROUND: &str = "Auto-update running in background.";
 const MSG_RUN_UPDATE_MANUAL: &str = "Run `kigi update` to get the latest version.";
 
 /// Manual-install one-liner for this platform's bootstrap installer
-/// (install.sh / install.ps1 hosted at the repo root, PRD F8).
+/// (install.sh / install.ps1, PRD F8). Served from kigicli.dev rather than the
+/// repo host directly, so the published command survives a forge migration.
 fn manual_install_cmd() -> &'static str {
     if cfg!(windows) {
-        "irm https://raw.githubusercontent.com/ZacharyZhang-NY/Kigi-CLI/main/install.ps1 | iex"
+        "irm https://kigicli.dev/install.ps1 | iex"
     } else {
-        "curl -fsSL https://raw.githubusercontent.com/ZacharyZhang-NY/Kigi-CLI/main/install.sh | sh"
+        "curl -fsSL https://kigicli.dev/install.sh | sh"
     }
 }
 
 /// Build a reinstall hint for a known installer type. Every installer is
-/// "internal" (GitHub Releases) today; the parameter survives so the hint
+/// "internal" (the repo's Releases) today; the parameter survives so the hint
 /// stays correct if another backend ever returns.
 fn reinstall_hint(_installer: &str) -> String {
     format!("Please reinstall via:\n  {}", manual_install_cmd())
@@ -694,7 +695,7 @@ pub(crate) fn detect_platform() -> Result<(&'static str, &'static str)> {
 
 /// Rust target triple for this build — the key that maps a platform to its
 /// release-asset name. Must stay in lockstep with the five targets built by
-/// `.github/workflows/release.yml` and the tables in install.sh/install.ps1.
+/// `.gitea/workflows/release.yml` and the tables in install.sh/install.ps1.
 pub(crate) fn target_triple() -> Result<&'static str> {
     let triple = if cfg!(all(target_os = "macos", target_arch = "aarch64")) {
         "aarch64-apple-darwin"
@@ -2604,19 +2605,19 @@ mod tests {
     // reinstall_hint / manual_install_cmd
 
     #[test]
-    fn test_reinstall_hint_points_at_repo_install_script() {
+    fn test_reinstall_hint_points_at_published_install_script() {
         let hint = reinstall_hint("internal");
         if cfg!(windows) {
             assert!(hint.contains("irm"), "should suggest irm install: {hint}");
             assert!(
-                hint.contains("ZacharyZhang-NY/Kigi-CLI/main/install.ps1"),
-                "should reference the repo's install.ps1: {hint}"
+                hint.contains("kigicli.dev/install.ps1"),
+                "should reference the published install.ps1: {hint}"
             );
         } else {
             assert!(hint.contains("curl"), "should suggest curl install: {hint}");
             assert!(
-                hint.contains("ZacharyZhang-NY/Kigi-CLI/main/install.sh"),
-                "should reference the repo's install.sh: {hint}"
+                hint.contains("kigicli.dev/install.sh"),
+                "should reference the published install.sh: {hint}"
             );
         }
         // Unknown installers fall back to the same hint.
@@ -2652,7 +2653,7 @@ mod tests {
     #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
     #[test]
     fn test_release_asset_name_matches_release_workflow_naming() {
-        // Must stay in lockstep with .github/workflows/release.yml, which
+        // Must stay in lockstep with .gitea/workflows/release.yml, which
         // publishes kigi-<version>-<target-triple>.{tar.gz|zip}.
         let triple = target_triple().unwrap();
         assert!(

crates/codegen/kigi-update/src/version.rs

@@ -8,9 +8,9 @@ use kigi_shell::util::kigi_home::kigi_home;
 
 const TTL_SECONDS_BEFORE_AUTO_UPDATE: Duration = Duration::from_secs(60 * 30);
 
-/// Release channel: this repo's GitHub Releases (PRD F8). The API base is
-/// resolved through [`kigi_env::update_base_url`] — production default
-/// `https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases`,
+/// Release channel: this repo's Releases (PRD F8). The API base is resolved
+/// through [`kigi_env::update_base_url`] — production default
+/// `https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases`,
 /// overridable via `KIGI_UPDATE_BASE_URL` for mirrors and tests.
 pub(crate) fn update_base_url() -> String {
     kigi_env::update_base_url()
@@ -167,16 +167,19 @@ async fn fetch_github_json<T: serde::de::DeserializeOwned>(url: &str) -> Result<
 
 /// Latest release for `channel` from a GitHub-Releases-shaped API at `base`.
 ///
-/// - `stable` / `enterprise`: `GET {base}/latest` — GitHub's "latest" already
-///   excludes drafts and pre-releases.
-/// - `alpha`: `GET {base}?per_page=30` (newest first) and take the semver-max
-///   non-draft entry. The list includes both pre-releases and stable
-///   releases, so this preserves the max(alpha, stable) channel semantics —
-///   alpha users are never stuck behind a newer stable.
+/// - `stable` / `enterprise`: `GET {base}/latest` — "latest" already excludes
+///   drafts and pre-releases on both GitHub and Gitea.
+/// - `alpha`: `GET {base}?per_page=30&limit=30` (newest first) and take the
+///   semver-max non-draft entry. The list includes both pre-releases and
+///   stable releases, so this preserves the max(alpha, stable) channel
+///   semantics — alpha users are never stuck behind a newer stable. GitHub
+///   reads the page size from `per_page` and Gitea from `limit`; each ignores
+///   the other's parameter, so sending both keeps one URL valid on either.
 pub async fn fetch_latest_release_from_base(channel: &str, base: &str) -> Result<Release> {
     let base = base.trim_end_matches('/');
     if channel == "alpha" {
-        let releases: Vec<Release> = fetch_github_json(&format!("{base}?per_page=30")).await?;
+        let releases: Vec<Release> =
+            fetch_github_json(&format!("{base}?per_page=30&limit=30")).await?;
         return releases
             .into_iter()
             .filter(|r| !r.draft)

crates/codegen/kigi-update/tests/common/mod.rs

@@ -114,7 +114,7 @@ pub fn host_platform() -> String {
 }
 
 /// Host Rust target triple, matching `auto_update::target_triple()` and the
-/// release-asset naming in `.github/workflows/release.yml`.
+/// release-asset naming in `.gitea/workflows/release.yml`.
 pub fn host_triple() -> &'static str {
     if cfg!(all(target_os = "macos", target_arch = "aarch64")) {
         "aarch64-apple-darwin"

docs/RELEASE.md

@@ -1,10 +1,14 @@
 # Release checklist (PRD F8)
 
 Kigi ships as a single-file binary for five targets, published on this
-repo's GitHub Releases by `.github/workflows/release.yml`. Users install via
+repo's Gitea Releases by `.gitea/workflows/release.yml`. Users install via
 `install.sh` / `install.ps1` and stay current through the in-app
 self-updater (`kigi-update`), which resolves the same Releases API.
 
+`.github/workflows/release.yml` is the retired GitHub pipeline. Gitea ignores
+`.github/workflows` entirely whenever `.gitea/workflows` is non-empty, so it
+does not run — it is kept only as a reference for the GitHub-hosted layout.
+
 ## Cutting a release
 
 1. Bump `[workspace.package] version` in `Cargo.toml`; land the change on
@@ -30,16 +34,146 @@ self-updater (`kigi-update`), which resolves the same Releases API.
    `release-dist` profile, packages
    `kigi-<version>-<target-triple>.{tar.gz|zip}` archives (binary +
    LICENSE + NOTICE + THIRD-PARTY-NOTICES), generates `SHA256SUMS`, and
-   publishes the GitHub Release. Tags containing `-` (e.g.
+   publishes the Gitea Release. Tags containing `-` (e.g.
    `v0.2.0-alpha.1`) publish as pre-releases, which only the `alpha`
    update channel picks up.
+
+   The release is created as a **draft** and only flipped public once
+   `SHA256SUMS` is attached, so `releases/latest` never hands the installer
+   a release whose checksum manifest is still missing. A failed run leaves
+   the draft in place; re-pushing the tag reuses it rather than erroring on
+   a duplicate `tag_name`.
 5. Smoke-test an installed artifact:
 
    ```sh
-   curl -fsSL https://raw.githubusercontent.com/ZacharyZhang-NY/Kigi-CLI/main/install.sh | sh
+   curl -fsSL https://kigicli.dev/install.sh | sh
    ~/.kigi/bin/kigi --version
    ```
 
+## Build runners
+
+Gitea has no hosted runners, so all three `runs-on` labels below are machines
+we register ourselves with `gitea-runner` (the binary formerly called
+`act_runner`). Labels are declared in the runner's `config.yaml` as
+`<label>:host` (run directly on the machine) or `<label>:docker://<image>` (run
+in a container) — with `gitea-runner` v2, `register --labels` is ignored
+whenever a config file supplies them.
+
+| Label            | Machine                        | Mode   | Builds                                             |
+| ---------------- | ------------------------------ | ------ | -------------------------------------------------- |
+| `ubuntu-latest`  | the Dokploy box                | docker | `x86_64-unknown-linux-gnu`, `aarch64-unknown-linux-gnu` |
+| `macos-arm64`    | Mac Mini (M4)                  | host   | `aarch64-apple-darwin`, `x86_64-apple-darwin`      |
+| `windows-x86_64` | ZACHARYZHANG-PC                | host   | `x86_64-pc-windows-msvc`                           |
+
+The Linux legs use `ubuntu-latest` because that is what the Dokploy box's
+runner already advertises. That image is a bare runner-image, so those legs
+provision their own apt packages and rustup per run (`rustup show` then picks
+up the `rust-toolchain.toml` pin). If you register a dedicated
+`linux-x86_64:docker://…` runner later, change the three Linux `runs-on`
+values back to match it.
+
+**The Mac is not optional.** Apple's SDK licence limits macOS builds to
+Apple-branded hardware, and the Darwin targets need the real Apple linker
+anyway (`.cargo/config.toml` passes `-ObjC` and `-undefined dynamic_lookup`).
+There is no supported way to produce our macOS artifacts on the Linux server.
+One Apple Silicon Mac covers both Darwin targets — `x86_64-apple-darwin` is a
+cross-compile against the same SDK, exactly as the old GitHub `macos-14`
+runner did it.
+
+Windows is a softer requirement but still wants a real machine: the tree links
+`ring`, `mimalloc`, `zstd-sys` and `libz-sys` against a static MSVC CRT
+(`-C target-feature=+crt-static`). Cross-compiling that from Linux with
+`cargo-xwin` is possible but means debugging four C builds under `clang-cl`;
+a Windows runner with the VS 2022 C++ Build Tools reproduces today's binary
+exactly.
+
+Linux arm64 *is* cross-compiled on the x86_64 box — the workflow installs
+`gcc-aarch64-linux-gnu` and points `cc-rs` at it. The one thing this loses is
+the ability to smoke-test the arm64 binary before publishing (the old GitHub
+pipeline did not test it either). Register a native arm64 runner and change
+that matrix leg's `runner:` if you want it built natively.
+
+### Registering a runner
+
+Get a registration token from **Settings → Actions → Runners** (repo scope),
+your user settings (all your repos) or the site admin panel (instance-wide).
+Over the API it is a **POST**, not a GET — a GET is parsed as runner id `0` and
+404s:
+
+```sh
+curl -fsS -X POST -H "Authorization: token $GITEA_API_TOKEN" \
+  https://git.zacharyzhang.com/api/v1/user/actions/runners/registration-token
+```
+
+Write the labels into `config.yaml` first (see `runner.labels` in
+`gitea-runner generate-config`), then register on each machine:
+
+```sh
+# Linux (the Dokploy box) — container mode
+gitea-runner --config config.yaml register --no-interactive \
+  --instance https://git.zacharyzhang.com \
+  --token <REGISTRATION_TOKEN> \
+  --name kigi-linux-x86_64
+
+# macOS (Apple Silicon) — host mode, needs Xcode CLT + rustup + Node on PATH
+gitea-runner --config config.yaml register --no-interactive \
+  --instance https://git.zacharyzhang.com \
+  --token <REGISTRATION_TOKEN> \
+  --name kigi-macos-arm64
+
+# Windows — host mode, needs VS 2022 Build Tools + rustup + Node on PATH
+gitea-runner --config config.yaml register --no-interactive `
+  --instance https://git.zacharyzhang.com `
+  --token <REGISTRATION_TOKEN> `
+  --name kigi-windows-x86_64
+```
+
+Host-mode runners execute steps with the daemon's own environment, so each
+needs its build prerequisites installed up front — and the supervisor that
+launches the daemon must put them on `PATH`:
+
+- **macOS**: `xcode-select --install`, `rustup`, and Node (for
+  `actions/checkout`, which is a JavaScript action).
+- **Windows**: VS 2022 Build Tools with the "Desktop development with C++"
+  workload, `rustup`, Git for Windows, and Node. Every Windows step in the
+  workflow uses `shell: powershell` (5.1) — never `bash`, which on a normal
+  Windows box resolves to WSL.
+- **Linux (docker mode)**: nothing on the host — the workflow installs
+  `build-essential`, `jq`, `unzip`, protoc, rustup and the cross toolchain
+  inside the container per run.
+
+### Keeping the runners alive
+
+Each host-mode runner is supervised so it survives reboots and crashes. Both
+supervisors export `CARGO_HOME`/`RUSTUP_HOME` and prepend the toolchain, git
+and node directories to `PATH`, because host-mode jobs inherit exactly the
+daemon's environment.
+
+| Machine  | Supervisor                                    | Manage with                                            |
+| -------- | --------------------------------------------- | ------------------------------------------------------ |
+| Windows  | Task Scheduler task `Gitea Runner (Kigi)` running `C:\Users\zhang\gitea-runner\run-runner.ps1` | `Get-ScheduledTask`, `Start-ScheduledTask`, `Stop-ScheduledTask` |
+| macOS    | LaunchAgent `com.kigi.gitea-runner` (`KeepAlive`) | `launchctl kickstart -k gui/$(id -u)/com.kigi.gitea-runner` |
+
+`prompt.txt` at the repo root is a one-shot setup prompt for the Mac Mini leg.
+Both runners also expose a liveness probe on `http://127.0.0.1:9101/healthz`.
+
+### Gitea-specific things that differ from GitHub
+
+- Workflows live in `.gitea/workflows/`. Once that directory is non-empty,
+  `.github/workflows/` is ignored completely — you cannot run both.
+- The automatic token is `secrets.GITEA_TOKEN`, and the release steps call the
+  Gitea API directly (`POST /releases`, `POST /releases/{id}/assets`,
+  `PATCH /releases/{id}`) rather than `softprops/action-gh-release`, which
+  targets GitHub's API and does not work here.
+- `uses:` actions are fetched from `github.com` by default
+  (`DEFAULT_ACTIONS_URL`), so the runners need outbound access to it — our
+  GitHub *account* being suspended does not affect downloading public actions.
+  Absolute URLs (`uses: https://gitea.com/actions/checkout@v4`) work too.
+- Artifacts carry only the five checksum lines; the archives themselves go
+  straight to the release. If `actions/upload-artifact@v3` misbehaves on the
+  instance, the fallback is to drop the artifact steps and have `publish`
+  download the archives from the release and hash them there.
+
 ## Invariants to keep in lockstep
 
 - Asset naming `kigi-<version>-<target-triple>.{tar.gz|zip}` and the

install.ps1

@@ -1,17 +1,17 @@
 # Kigi installer (Windows x86_64) — PRD F8.
 #
-# Downloads the x86_64-pc-windows-msvc artifact from this repo's GitHub
-# Releases, verifies its SHA-256 against the release's SHA256SUMS manifest,
-# and installs the binary as %USERPROFILE%\.kigi\bin\kigi.exe.
+# Downloads the x86_64-pc-windows-msvc artifact from this repo's Releases,
+# verifies its SHA-256 against the release's SHA256SUMS manifest, and
+# installs the binary as %USERPROFILE%\.kigi\bin\kigi.exe.
 #
 # Usage:
-#   irm https://raw.githubusercontent.com/ZacharyZhang-NY/Kigi-CLI/main/install.ps1 | iex
+#   irm https://kigicli.dev/install.ps1 | iex
 #   powershell -ExecutionPolicy Bypass -File install.ps1 -Version v0.1.0
 #
 # Environment:
 #   KIGI_SHARE_DIR        install root (default: %USERPROFILE%\.kigi)
-#   KIGI_UPDATE_BASE_URL  GitHub-Releases-shaped API base (default:
-#                         https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases)
+#   KIGI_UPDATE_BASE_URL  releases API base, GitHub/Gitea-shaped (default:
+#                         https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases)
 
 [CmdletBinding()]
 param(
@@ -27,7 +27,8 @@ function Fail([string]$Message) {
 }
 
 $Repo = "ZacharyZhang-NY/Kigi-CLI"
-$ApiBase = if ($env:KIGI_UPDATE_BASE_URL) { $env:KIGI_UPDATE_BASE_URL } else { "https://api.github.com/repos/$Repo/releases" }
+$Forge = "https://git.zacharyzhang.com"
+$ApiBase = if ($env:KIGI_UPDATE_BASE_URL) { $env:KIGI_UPDATE_BASE_URL } else { "$Forge/api/v1/repos/$Repo/releases" }
 $KigiHome = if ($env:KIGI_SHARE_DIR) { $env:KIGI_SHARE_DIR } else { Join-Path $env:USERPROFILE ".kigi" }
 $Triple = "x86_64-pc-windows-msvc"
 
@@ -49,7 +50,7 @@ if ($Version -and $Version -notmatch '^\d+\.\d+\.\d+([-.][0-9A-Za-z.-]+)?$') {
 # TLS 1.2 for older PowerShell 5.1 defaults.
 [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
 
-$Headers = @{ "User-Agent" = "kigi-install"; "Accept" = "application/vnd.github+json" }
+$Headers = @{ "User-Agent" = "kigi-install"; "Accept" = "application/json" }
 
 # ── Resolve the release ──────────────────────────────────────────────────────
 $ReleaseUrl = if ($Version) { "$ApiBase/tags/v$Version" } else { "$ApiBase/latest" }

install.sh

@@ -2,26 +2,27 @@
 #
 # Kigi installer (macOS / Linux) — PRD F8.
 #
-# Downloads the matching platform artifact from this repo's GitHub Releases,
-# verifies its SHA-256 against the release's SHA256SUMS manifest, and installs
-# the binary as ~/.kigi/bin/kigi (the same managed layout the self-updater
+# Downloads the matching platform artifact from this repo's Releases, verifies
+# its SHA-256 against the release's SHA256SUMS manifest, and installs the
+# binary as ~/.kigi/bin/kigi (the same managed layout the self-updater
 # maintains: versioned binary in ~/.kigi/downloads/, atomic symlink in bin/).
 #
 # Usage:
-#   curl -fsSL https://raw.githubusercontent.com/ZacharyZhang-NY/Kigi-CLI/main/install.sh | sh
+#   curl -fsSL https://kigicli.dev/install.sh | sh
 #   sh install.sh --version v0.1.0        # pin a specific release
 #
 # Environment:
 #   KIGI_SHARE_DIR        install root (default: ~/.kigi)
-#   KIGI_UPDATE_BASE_URL  GitHub-Releases-shaped API base (default:
-#                         https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases)
+#   KIGI_UPDATE_BASE_URL  releases API base, GitHub/Gitea-shaped (default:
+#                         https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases)
 #
 # Fails fast on any error; never leaves a partial binary as the active kigi.
 
 set -eu
 
 REPO="ZacharyZhang-NY/Kigi-CLI"
-API_BASE="${KIGI_UPDATE_BASE_URL:-https://api.github.com/repos/${REPO}/releases}"
+FORGE="https://git.zacharyzhang.com"
+API_BASE="${KIGI_UPDATE_BASE_URL:-${FORGE}/api/v1/repos/${REPO}/releases}"
 KIGI_HOME="${KIGI_SHARE_DIR:-$HOME/.kigi}"
 
 err() {