Return the forge to GitHub: releases, self-update, links, CI

The GitHub account is restored, so github.com/ZacharyZhang-NY/Kigi-CLI is the canonical repo again. Reverse the 2026-08 Gitea migration: - .github/workflows/{release,warm-cache}.yml: restore the GitHub-hosted pipeline dropped in 3e1652c, unchanged — hosted runners, rust-cache, softprops release with every asset attached atomically. - .gitea/workflows/release.yml: retire the Gitea edition (the runners are being deregistered; git.zacharyzhang.com keeps the v0.1.12/v0.1.13 releases for old clients). - kigi-env: update_base_url now defaults to the GitHub Releases API. The updater already speaks GitHub wire format and sends a User-Agent; v0.1.14 is published to BOTH forges with identical assets so pre-0.1.14 installs polling Gitea self-update onto the GitHub channel. - install.sh / install.ps1: resolve releases from api.github.com. - feedback, /docs, SECURITY.md, frontend worker + site: repo, issues and raw-file links point at github.com / raw.githubusercontent.com. - docs/RELEASE.md: GitHub edition of the checklist; Gitea runner sections retired. - version: 0.1.13 -> 0.1.14 (the cross-forge transition release). Claude-Session: https://claude.ai/code/session_01A6RcwHhhsFYYrNdQB4ASuP
2026-09-01 01:05:22 -04:00
17 changed files with 336 additions and 589 deletions
@@ -1,375 +0,0 @@
-name: Release
-
-# PRD F8, Gitea edition. On a v* tag push, build the single-file kigi binary
-# for the five supported targets, package kigi-<version>-<target-triple>.
-# {tar.gz|zip} (binary + LICENSE + NOTICE + THIRD-PARTY-NOTICES), and publish
-# them as a Gitea Release alongside SHA256SUMS. install.sh, install.ps1 and
-# auto_update::release_asset_name() all resolve these exact names — keep the
-# naming in lockstep with them.
-#
-# RUNNERS. Gitea has no hosted runners; every label below must be a runner you
-# registered yourself (docs/RELEASE.md has the register commands):
-#
-#   ubuntu-latest   Linux x86_64, container mode — the label the Dokploy box's
-#                   runner already advertises. Builds both Linux targets;
-#                   aarch64 is a cross-compile, so this leg installs the
-#                   aarch64 GNU toolchain. Because the image is a bare
-#                   runner-image, the Linux legs provision their own apt
-#                   packages and rustup (see the provision steps below).
-#                   Registering a dedicated `linux-x86_64:docker://...` runner
-#                   instead is fine — swap the three labels back if you do.
-#   macos-arm64     Apple Silicon Mac, host mode. Builds both Darwin targets;
-#                   x86_64 is a cross-compile against the same SDK. macOS
-#                   CANNOT be built anywhere else — Apple's SDK licence
-#                   restricts it to Apple hardware.
-#   windows-x86_64  Windows x86_64, host mode, with VS 2022 Build Tools
-#                   (C++ workload). Needed because the tree links ring,
-#                   mimalloc, zstd-sys and libz-sys against a static MSVC CRT
-#                   (-C target-feature=+crt-static).
-#
-# SHELLS. Every step names its shell explicitly and the Windows leg never uses
-# bash. On a normal Windows box `bash` resolves to WSL (not Git Bash), and
-# `pwsh` (PowerShell 7) is usually absent — so Windows steps use `powershell`,
-# which is the built-in 5.1. Keep those steps 5.1-compatible: no `&&`, no
-# ternary, no null-coalescing.
-#
-# Note: because this file exists, Gitea ignores .github/workflows entirely.
-#
-# PUBLISH ORDER. The release is created as a draft and only made public once
-# SHA256SUMS is attached, so `releases/latest` never hands the installer a
-# release whose checksum manifest is still missing.
-
-on:
-  push:
-    tags: ["v*"]
-
-permissions:
-  contents: write
-
-env:
-  CARGO_TERM_COLOR: always
-  # Matches the version pinned by the dotslash launcher in bin/protoc. That
-  # launcher is not used here: it has no Windows entry and needs a `cargo
-  # install dotslash` first, so every platform fetches protoc directly.
-  PROTOC_VERSION: "29.3"
-
-jobs:
-  prepare:
-    name: prepare draft release
-    runs-on: ubuntu-latest
-    outputs:
-      release_id: ${{ steps.draft.outputs.release_id }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Check tag matches workspace version
-        shell: bash
-        run: |
-          tag_version="${GITHUB_REF_NAME#v}"
-          cargo_version="$(sed -n 's/^version = "\(.*\)"$/\1/p' Cargo.toml | head -n 1)"
-          if [ "$tag_version" != "$cargo_version" ]; then
-            echo "Tag $GITHUB_REF_NAME does not match workspace version $cargo_version" >&2
-            exit 1
-          fi
-
-      - name: Create or reuse draft release
-        id: draft
-        shell: bash
-        env:
-          TOKEN: ${{ secrets.GITEA_TOKEN }}
-          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
-        run: |
-          set -eu
-          # The runner-image is bare; jq and curl are both used below.
-          if ! command -v jq >/dev/null || ! command -v curl >/dev/null; then
-            SUDO=""; command -v sudo >/dev/null && SUDO=sudo
-            export DEBIAN_FRONTEND=noninteractive
-            $SUDO apt-get update -qq
-            $SUDO apt-get install -y -qq --no-install-recommends jq curl ca-certificates
-          fi
-
-          # Idempotent so a re-run of a failed tag build reuses the same draft
-          # instead of erroring on a duplicate tag_name.
-          existing="$(curl -sS -H "Authorization: token $TOKEN" \
-            "$API/releases/tags/$GITHUB_REF_NAME")"
-          release_id="$(printf '%s' "$existing" | jq -r '.id // empty')"
-
-          if [ -z "$release_id" ]; then
-            prerelease=false
-            case "$GITHUB_REF_NAME" in *-*) prerelease=true ;; esac
-            created="$(curl -fsS -X POST \
-              -H "Authorization: token $TOKEN" \
-              -H "Content-Type: application/json" \
-              -d "{\"tag_name\":\"$GITHUB_REF_NAME\",\"name\":\"$GITHUB_REF_NAME\",\"draft\":true,\"prerelease\":$prerelease}" \
-              "$API/releases")"
-            release_id="$(printf '%s' "$created" | jq -r '.id')"
-            echo "Created draft release $release_id (prerelease=$prerelease)"
-          else
-            echo "Reusing release $release_id for $GITHUB_REF_NAME"
-          fi
-
-          echo "release_id=$release_id" >> "$GITHUB_OUTPUT"
-
-  build:
-    name: build (${{ matrix.target }})
-    needs: prepare
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-gnu
-            runner: ubuntu-latest
-            protoc: linux-x86_64
-            ext: tar.gz
-            linux: true
-          - target: aarch64-unknown-linux-gnu
-            runner: ubuntu-latest
-            protoc: linux-x86_64
-            ext: tar.gz
-            linux: true
-            cross_gnu: true
-          - target: aarch64-apple-darwin
-            runner: macos-arm64
-            protoc: osx-aarch_64
-            ext: tar.gz
-          - target: x86_64-apple-darwin
-            runner: macos-arm64
-            protoc: osx-aarch_64
-            ext: tar.gz
-          - target: x86_64-pc-windows-msvc
-            runner: windows-x86_64
-            protoc: win64
-            ext: zip
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v4
-
-      # ── linux container provisioning ──────────────────────────────────────
-      # The Linux legs run in a bare gitea runner-image, which ships git and
-      # node for the JavaScript actions but no compiler, no unzip (protoc) and
-      # no rustup. Host-mode macOS and Windows already have their toolchains
-      # installed, so this step is Linux-only.
-      - name: Provision Linux build deps
-        if: matrix.linux
-        shell: bash
-        run: |
-          set -eu
-          SUDO=""; command -v sudo >/dev/null && SUDO=sudo
-          export DEBIAN_FRONTEND=noninteractive
-          $SUDO apt-get update -qq
-          $SUDO apt-get install -y -qq --no-install-recommends \
-            build-essential pkg-config ca-certificates curl unzip tar jq
-
-      # ── protoc ────────────────────────────────────────────────────────────
-      - name: Install protoc (unix)
-        if: matrix.ext == 'tar.gz'
-        shell: bash
-        run: |
-          set -eu
-          url="https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-${{ matrix.protoc }}.zip"
-          curl -fsSL -o protoc.zip "$url"
-          rm -rf "$HOME/protoc"
-          unzip -q -o protoc.zip -d "$HOME/protoc"
-          chmod +x "$HOME/protoc/bin/protoc"
-          echo "$HOME/protoc/bin" >> "$GITHUB_PATH"
-
-      - name: Install protoc (windows)
-        if: matrix.ext == 'zip'
-        shell: powershell
-        run: |
-          $ErrorActionPreference = "Stop"
-          $url = "https://github.com/protocolbuffers/protobuf/releases/download/v$env:PROTOC_VERSION/protoc-$env:PROTOC_VERSION-${{ matrix.protoc }}.zip"
-          Invoke-WebRequest -Uri $url -OutFile protoc.zip
-          $dest = Join-Path $env:USERPROFILE "protoc"
-          if (Test-Path $dest) { Remove-Item $dest -Recurse -Force }
-          Expand-Archive protoc.zip -DestinationPath $dest -Force
-          Add-Content -Path $env:GITHUB_PATH -Value (Join-Path $dest "bin")
-
-      # ── toolchain ─────────────────────────────────────────────────────────
-      # rust-toolchain.toml pins the channel (1.97.0) and preinstalls both
-      # Linux targets; `rustup show` materialises exactly that.
-      - name: Install toolchain (unix)
-        if: matrix.ext == 'tar.gz'
-        shell: bash
-        run: |
-          set -eu
-          # No-op on the macOS host runner, which has rustup installed already.
-          # `--default-toolchain none` leaves the channel choice to
-          # rust-toolchain.toml, which `rustup show` then materialises.
-          if ! command -v rustup >/dev/null; then
-            curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs \
-              | sh -s -- -y --no-modify-path --profile minimal --default-toolchain none
-            echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-            export PATH="$HOME/.cargo/bin:$PATH"
-          fi
-          rustup show
-          rustup target add ${{ matrix.target }}
-
-      - name: Install toolchain (windows)
-        if: matrix.ext == 'zip'
-        shell: powershell
-        run: |
-          $ErrorActionPreference = "Stop"
-          rustup show
-          rustup target add ${{ matrix.target }}
-
-      # ring, mimalloc, zstd-sys and libz-sys are all cc-rs builds, so the
-      # cross target needs its own C toolchain — cc-rs picks these up from the
-      # target-suffixed vars.
-      - name: Install aarch64 cross toolchain
-        if: matrix.cross_gnu
-        shell: bash
-        run: |
-          set -eu
-          SUDO=""; command -v sudo >/dev/null && SUDO=sudo
-          $SUDO apt-get update -qq
-          $SUDO apt-get install -y -qq gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
-          {
-            echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc"
-            echo "CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc"
-            echo "CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++"
-            echo "AR_aarch64_unknown_linux_gnu=aarch64-linux-gnu-ar"
-          } >> "$GITHUB_ENV"
-
-      # ── build ─────────────────────────────────────────────────────────────
-      - name: Build kigi (unix)
-        if: matrix.ext == 'tar.gz'
-        shell: bash
-        run: cargo build --profile release-dist -p kigi-bin --locked --target ${{ matrix.target }}
-
-      - name: Build kigi (windows)
-        if: matrix.ext == 'zip'
-        shell: powershell
-        run: |
-          $ErrorActionPreference = "Stop"
-          cargo build --profile release-dist -p kigi-bin --locked --target ${{ matrix.target }}
-          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-
-      # ── package, upload, checksum ─────────────────────────────────────────
-      # Archives go straight to the release rather than through the artifact
-      # store: they are large, and the release is the only place install.sh
-      # can read them from anyway. Only the checksum line travels as an
-      # artifact, for the publish job to concatenate.
-      - name: Package and upload (unix)
-        if: matrix.ext == 'tar.gz'
-        shell: bash
-        env:
-          TOKEN: ${{ secrets.GITEA_TOKEN }}
-          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
-          RELEASE_ID: ${{ needs.prepare.outputs.release_id }}
-        run: |
-          set -eu
-          version="${GITHUB_REF_NAME#v}"
-          archive="kigi-${version}-${{ matrix.target }}.tar.gz"
-          staging="$(mktemp -d)"
-          cp "target/${{ matrix.target }}/release-dist/kigi" "$staging/kigi"
-          cp LICENSE "$staging/"
-          [ -f NOTICE ] && cp NOTICE "$staging/"
-          for f in THIRD-PARTY-NOTICES THIRD-PARTY-NOTICES.md; do
-            [ -f "$f" ] && cp "$f" "$staging/"
-          done
-          tar -C "$staging" -czf "$archive" .
-
-          curl -fsS -X POST \
-            -H "Authorization: token $TOKEN" \
-            -F "attachment=@${archive}" \
-            "$API/releases/$RELEASE_ID/assets?name=${archive}" > /dev/null
-          echo "Uploaded $archive"
-
-          if command -v sha256sum >/dev/null; then
-            sha256sum "$archive" > "checksum-${{ matrix.target }}.txt"
-          else
-            shasum -a 256 "$archive" > "checksum-${{ matrix.target }}.txt"
-          fi
-          cat "checksum-${{ matrix.target }}.txt"
-
-      - name: Package and upload (windows)
-        if: matrix.ext == 'zip'
-        shell: powershell
-        env:
-          TOKEN: ${{ secrets.GITEA_TOKEN }}
-          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
-          RELEASE_ID: ${{ needs.prepare.outputs.release_id }}
-        run: |
-          $ErrorActionPreference = "Stop"
-          $version = $env:GITHUB_REF_NAME.TrimStart("v")
-          $archive = "kigi-$version-${{ matrix.target }}.zip"
-          $staging = Join-Path $env:RUNNER_TEMP "staging"
-          if (Test-Path $staging) { Remove-Item $staging -Recurse -Force }
-          New-Item -ItemType Directory -Force -Path $staging | Out-Null
-          Copy-Item "target/${{ matrix.target }}/release-dist/kigi.exe" (Join-Path $staging "kigi.exe")
-          Copy-Item LICENSE $staging
-          if (Test-Path NOTICE) { Copy-Item NOTICE $staging }
-          foreach ($f in @("THIRD-PARTY-NOTICES", "THIRD-PARTY-NOTICES.md")) {
-            if (Test-Path $f) { Copy-Item $f $staging }
-          }
-          Compress-Archive -Path (Join-Path $staging "*") -DestinationPath $archive -Force
-
-          # System32\curl.exe, not PowerShell's `curl` alias for
-          # Invoke-WebRequest, which cannot do multipart uploads.
-          $api = "$env:API/releases/$env:RELEASE_ID/assets?name=$archive"
-          & "$env:SystemRoot\System32\curl.exe" -fsS -X POST `
-            -H "Authorization: token $env:TOKEN" `
-            -F "attachment=@$archive" $api
-          if ($LASTEXITCODE -ne 0) { throw "asset upload failed ($LASTEXITCODE)" }
-          Write-Host "Uploaded $archive"
-
-          # sha256sum's exact format, so the publish job can just concatenate.
-          # ASCII keeps the BOM out — a BOM would corrupt the first hash.
-          $hash = (Get-FileHash -Algorithm SHA256 -Path $archive).Hash.ToLowerInvariant()
-          "$hash  $archive" | Out-File -FilePath "checksum-${{ matrix.target }}.txt" -Encoding ascii
-          Get-Content "checksum-${{ matrix.target }}.txt"
-
-      - uses: actions/upload-artifact@v3
-        with:
-          name: checksum-${{ matrix.target }}
-          path: checksum-${{ matrix.target }}.txt
-          if-no-files-found: error
-
-  publish:
-    name: publish release
-    needs: [prepare, build]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/download-artifact@v3
-        with:
-          path: checksums
-
-      - name: Assemble SHA256SUMS
-        shell: bash
-        run: |
-          set -eu
-          # download-artifact v3 nests each artifact in its own directory. The
-          # Windows line arrives CRLF-terminated; strip CR so every line is LF
-          # for install.sh's `read -r hash name`.
-          find checksums -name 'checksum-*.txt' -exec cat {} + \
-            | tr -d '\r' | grep -v '^$' | sort -k2 > SHA256SUMS
-          lines="$(wc -l < SHA256SUMS)"
-          if [ "$lines" -ne 5 ]; then
-            echo "expected 5 checksum lines, got $lines" >&2
-            cat SHA256SUMS >&2
-            exit 1
-          fi
-          cat SHA256SUMS
-
-      - name: Attach SHA256SUMS and publish
-        shell: bash
-        env:
-          TOKEN: ${{ secrets.GITEA_TOKEN }}
-          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
-          RELEASE_ID: ${{ needs.prepare.outputs.release_id }}
-        run: |
-          set -eu
-          curl -fsS -X POST \
-            -H "Authorization: token $TOKEN" \
-            -F "attachment=@SHA256SUMS" \
-            "$API/releases/$RELEASE_ID/assets?name=SHA256SUMS" > /dev/null
-
-          # Flip the draft public only now that every asset install.sh looks
-          # for is attached.
-          curl -fsS -X PATCH \
-            -H "Authorization: token $TOKEN" \
-            -H "Content-Type: application/json" \
-            -d '{"draft":false}' \
-            "$API/releases/$RELEASE_ID" > /dev/null
-          echo "Published $GITHUB_REF_NAME"
@@ -0,0 +1,147 @@
+name: Release
+
+# PRD F8: on tag push v*, build the single-file kigi binary for the five
+# supported targets, package per-target archives named
+# kigi-<version>-<target-triple>.{tar.gz|zip} (binary + LICENSE + NOTICE +
+# THIRD-PARTY-NOTICES), generate SHA256SUMS, and publish everything as a
+# GitHub Release. install.sh / install.ps1 and the in-app self-updater
+# (kigi-update) both resolve these exact asset names — keep the naming in
+# lockstep with auto_update::release_asset_name().
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build:
+    name: build (${{ matrix.target }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: aarch64-apple-darwin
+            os: macos-14
+          # macos-14 runners are arm64; the x86_64 slice is a cross-compile
+          # against the same SDK (macos-13 Intel runners are deprecated).
+          - target: x86_64-apple-darwin
+            os: macos-14
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-24.04
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-24.04-arm
+          - target: x86_64-pc-windows-msvc
+            os: windows-2022
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check tag matches workspace version
+        shell: bash
+        run: |
+          tag_version="${GITHUB_REF_NAME#v}"
+          cargo_version="$(sed -n 's/^version = "\(.*\)"$/\1/p' Cargo.toml | head -n 1)"
+          if [ "$tag_version" != "$cargo_version" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match workspace version $cargo_version" >&2
+            exit 1
+          fi
+
+      - name: Install toolchain (rust-toolchain.toml)
+        run: rustup show
+
+      - name: Add build target
+        run: rustup target add ${{ matrix.target }}
+
+      - name: Install dotslash (protoc launcher)
+        run: cargo install dotslash --locked
+
+      # Windows cannot exec the dotslash launcher directly (no shebang
+      # support → os error 193), and the build script's documented fallback
+      # is a protoc on PATH — install the same version the dotslash file
+      # pins (v29.3).
+      - name: Install protoc (Windows PATH fallback)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.3/protoc-29.3-win64.zip"
+          Invoke-WebRequest -Uri $url -OutFile protoc.zip
+          Expand-Archive protoc.zip -DestinationPath "$env:USERPROFILE\protoc"
+          Add-Content $env:GITHUB_PATH "$env:USERPROFILE\protoc\bin"
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.target }}
+
+      - name: Build kigi (release-dist)
+        run: cargo build --profile release-dist -p kigi-bin --locked --target ${{ matrix.target }}
+
+      - name: Package archive (tar.gz)
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          archive="kigi-${version}-${{ matrix.target }}.tar.gz"
+          staging="$(mktemp -d)"
+          cp "target/${{ matrix.target }}/release-dist/kigi" "$staging/kigi"
+          cp LICENSE "$staging/"
+          [ -f NOTICE ] && cp NOTICE "$staging/"
+          for f in THIRD-PARTY-NOTICES THIRD-PARTY-NOTICES.md; do
+            [ -f "$f" ] && cp "$f" "$staging/"
+          done
+          tar -C "$staging" -czf "$archive" .
+          shasum -a 256 "$archive" || sha256sum "$archive"
+          echo "ARCHIVE=$archive" >> "$GITHUB_ENV"
+
+      - name: Package archive (zip)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $version = $env:GITHUB_REF_NAME.TrimStart("v")
+          $archive = "kigi-$version-${{ matrix.target }}.zip"
+          $staging = New-Item -ItemType Directory -Path (Join-Path $env:RUNNER_TEMP "staging")
+          Copy-Item "target/${{ matrix.target }}/release-dist/kigi.exe" (Join-Path $staging "kigi.exe")
+          Copy-Item LICENSE $staging
+          if (Test-Path NOTICE) { Copy-Item NOTICE $staging }
+          foreach ($f in @("THIRD-PARTY-NOTICES", "THIRD-PARTY-NOTICES.md")) {
+            if (Test-Path $f) { Copy-Item $f $staging }
+          }
+          Compress-Archive -Path (Join-Path $staging "*") -DestinationPath $archive
+          Get-FileHash -Algorithm SHA256 $archive
+          Add-Content -Path $env:GITHUB_ENV -Value "ARCHIVE=$archive"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.ARCHIVE }}
+          path: ${{ env.ARCHIVE }}
+          if-no-files-found: error
+
+  release:
+    name: publish GitHub Release
+    needs: build
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+
+      - name: Generate SHA256SUMS
+        working-directory: dist
+        run: |
+          ls -l
+          sha256sum kigi-* > SHA256SUMS
+          cat SHA256SUMS
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/*
+          prerelease: ${{ contains(github.ref_name, '-') }}
+          generate_release_notes: true
+          fail_on_unmatched_files: true
@@ -0,0 +1,85 @@
+name: Warm build cache
+
+# Release builds run on TAG refs, and GitHub Actions cache isolation only
+# lets a run restore caches created on its OWN ref or the DEFAULT branch.
+# No workflow ran on `main`, so every release compiled the whole workspace
+# cold on all five targets (~50 min wall clock, gated by Windows). This
+# workflow builds the same `release-dist` profile on `main` so tag builds
+# restore a warm default-branch cache.
+#
+# Triggers: dependency-affecting pushes to main (each release's version-bump
+# commit warms the cache for the NEXT release), a weekly refresh so the
+# cache never hits GitHub's 7-day unused-eviction, and manual dispatch.
+#
+# The setup steps mirror release.yml's build job (toolchain, target,
+# dotslash/protoc, rust-cache key) — keep them in lockstep, or the cache
+# key won't match and releases go back to cold builds.
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - "Cargo.lock"
+      - "Cargo.toml"
+      - "rust-toolchain.toml"
+      - ".github/workflows/warm-cache.yml"
+  schedule:
+    - cron: "17 5 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+concurrency:
+  group: warm-cache
+  cancel-in-progress: true
+
+jobs:
+  warm:
+    name: warm (${{ matrix.target }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: aarch64-apple-darwin
+            os: macos-14
+          - target: x86_64-apple-darwin
+            os: macos-14
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-24.04
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-24.04-arm
+          - target: x86_64-pc-windows-msvc
+            os: windows-2022
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install toolchain (rust-toolchain.toml)
+        run: rustup show
+
+      - name: Add build target
+        run: rustup target add ${{ matrix.target }}
+
+      - name: Install dotslash (protoc launcher)
+        run: cargo install dotslash --locked
+
+      - name: Install protoc (Windows PATH fallback)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.3/protoc-29.3-win64.zip"
+          Invoke-WebRequest -Uri $url -OutFile protoc.zip
+          Expand-Archive protoc.zip -DestinationPath "$env:USERPROFILE\protoc"
+          Add-Content $env:GITHUB_PATH "$env:USERPROFILE\protoc\bin"
+
+      # Same key as release.yml so tag builds restore this cache verbatim.
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.target }}
+
+      - name: Build kigi (release-dist)
+        run: cargo build --profile release-dist -p kigi-bin --locked --target ${{ matrix.target }}
@@ -5442,7 +5442,7 @@ dependencies = [

 [[package]]
 name = "kigi-acp-lib"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "agent-client-protocol",
 "async-trait",
@@ -5456,7 +5456,7 @@ dependencies = [

 [[package]]
 name = "kigi-agent"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "chrono",
 "dirs 6.0.0",
@@ -5486,7 +5486,7 @@ dependencies = [

 [[package]]
 name = "kigi-agent-lifecycle"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "async-trait",
 "tokio",
@@ -5495,7 +5495,7 @@ dependencies = [

 [[package]]
 name = "kigi-auth"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "async-trait",
 "http 1.4.2",
@@ -5508,7 +5508,7 @@ dependencies = [

 [[package]]
 name = "kigi-bin"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anyhow",
 "clap",
@@ -5543,7 +5543,7 @@ dependencies = [

 [[package]]
 name = "kigi-chat-state"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "indexmap",
 "kigi-compaction",
@@ -5560,7 +5560,7 @@ dependencies = [

 [[package]]
 name = "kigi-codebase-graph"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "ahash",
 "clap",
@@ -5596,7 +5596,7 @@ dependencies = [

 [[package]]
 name = "kigi-compaction"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -5609,7 +5609,7 @@ dependencies = [

 [[package]]
 name = "kigi-config"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "base64",
 "blake3",
@@ -5632,7 +5632,7 @@ dependencies = [

 [[package]]
 name = "kigi-config-types"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "agent-client-protocol",
 "indexmap",
@@ -5646,7 +5646,7 @@ dependencies = [

 [[package]]
 name = "kigi-crash-handler"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "backtrace",
 "libc",
@@ -5657,7 +5657,7 @@ dependencies = [

 [[package]]
 name = "kigi-env"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "tracing",
 "url",
@@ -5665,7 +5665,7 @@ dependencies = [

 [[package]]
 name = "kigi-fast-worktree"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anyhow",
 "bytes",
@@ -5697,7 +5697,7 @@ dependencies = [

 [[package]]
 name = "kigi-file-utils"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anyhow",
 "aws-config",
@@ -5721,7 +5721,7 @@ dependencies = [

 [[package]]
 name = "kigi-fsnotify"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "criterion",
 "dunce",
@@ -5742,7 +5742,7 @@ dependencies = [

 [[package]]
 name = "kigi-gix-status"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "gix",
 "kigi-test-utils",
@@ -5752,7 +5752,7 @@ dependencies = [

 [[package]]
 name = "kigi-hooks"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "fastrand",
 "kigi-config",
@@ -5771,7 +5771,7 @@ dependencies = [

 [[package]]
 name = "kigi-hooks-plugins-types"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "serde",
 "serde_json",
@@ -5779,7 +5779,7 @@ dependencies = [

 [[package]]
 name = "kigi-http"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "kigi-auth",
 "kigi-log",
@@ -5794,7 +5794,7 @@ dependencies = [

 [[package]]
 name = "kigi-hunk-tracker"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "chrono",
 "dunce",
@@ -5815,14 +5815,14 @@ dependencies = [

 [[package]]
 name = "kigi-interjection-core"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "kigi-log"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anyhow",
 "chrono",
@@ -5840,7 +5840,7 @@ dependencies = [

 [[package]]
 name = "kigi-markdown"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anstyle",
 "anstyle-lossy",
@@ -5864,14 +5864,14 @@ dependencies = [

 [[package]]
 name = "kigi-markdown-core"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "pulldown-cmark",
 ]

 [[package]]
 name = "kigi-mcp"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "agent-client-protocol",
 "async-trait",
@@ -5908,7 +5908,7 @@ dependencies = [

 [[package]]
 name = "kigi-memory"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -5942,7 +5942,7 @@ dependencies = [

 [[package]]
 name = "kigi-mermaid"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "fontdb",
 "image",
@@ -5960,7 +5960,7 @@ dependencies = [

 [[package]]
 name = "kigi-models"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "kigi-env",
 "serde",
@@ -5970,7 +5970,7 @@ dependencies = [

 [[package]]
 name = "kigi-pager-minimal"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "chrono",
 "crossterm",
@@ -5987,7 +5987,7 @@ dependencies = [

 [[package]]
 name = "kigi-pager-pty-harness"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "alacritty_terminal",
 "anyhow",
@@ -6012,7 +6012,7 @@ dependencies = [

 [[package]]
 name = "kigi-pager-render"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "agent-client-protocol",
 "anstyle",
@@ -6064,7 +6064,7 @@ dependencies = [

 [[package]]
 name = "kigi-paths"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "camino",
 "serde",
@@ -6074,7 +6074,7 @@ dependencies = [

 [[package]]
 name = "kigi-prompt-queue"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "serde",
 "serde_json",
@@ -6082,7 +6082,7 @@ dependencies = [

 [[package]]
 name = "kigi-proto-build"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anyhow",
 "pbjson-build",
@@ -6093,7 +6093,7 @@ dependencies = [

 [[package]]
 name = "kigi-ratatui-inline"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "ansi-width",
 "anstyle-parse 0.2.7",
@@ -6110,7 +6110,7 @@ dependencies = [

 [[package]]
 name = "kigi-ratatui-textarea"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "arboard",
 "chrono",
@@ -6131,7 +6131,7 @@ dependencies = [

 [[package]]
 name = "kigi-sampler"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "async-openai",
 "async-stream",
@@ -6154,7 +6154,7 @@ dependencies = [

 [[package]]
 name = "kigi-sampling-types"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "assert_matches",
 "async-openai",
@@ -6171,7 +6171,7 @@ dependencies = [

 [[package]]
 name = "kigi-sandbox"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anyhow",
 "chrono",
@@ -6192,7 +6192,7 @@ dependencies = [

 [[package]]
 name = "kigi-secrets"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "regex",
 "serde_json",
@@ -6230,7 +6230,7 @@ dependencies = [

 [[package]]
 name = "kigi-shell"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "agent-client-protocol",
 "anyhow",
@@ -6367,7 +6367,7 @@ dependencies = [

 [[package]]
 name = "kigi-shell-base"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anyhow",
 "chrono",
@@ -6392,7 +6392,7 @@ dependencies = [

 [[package]]
 name = "kigi-sqlite-journal"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "libc",
 "rusqlite",
@@ -6403,7 +6403,7 @@ dependencies = [

 [[package]]
 name = "kigi-subagent-resolution"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "kigi-sampling-types",
 "kigi-tool-types",
@@ -6418,7 +6418,7 @@ dependencies = [

 [[package]]
 name = "kigi-system-power"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "windows-sys 0.59.0",
 "zbus",
@@ -6426,7 +6426,7 @@ dependencies = [

 [[package]]
 name = "kigi-test-support"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "agent-client-protocol",
 "anyhow",
@@ -6448,7 +6448,7 @@ dependencies = [

 [[package]]
 name = "kigi-test-utils"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "runfiles",
 "tracing",
@@ -6457,11 +6457,11 @@ dependencies = [

 [[package]]
 name = "kigi-token-estimation"
-version = "0.1.13"
+version = "0.1.14"

 [[package]]
 name = "kigi-tool-protocol"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "kigi-tool-types",
 "serde",
@@ -6472,7 +6472,7 @@ dependencies = [

 [[package]]
 name = "kigi-tool-runtime"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -6490,7 +6490,7 @@ dependencies = [

 [[package]]
 name = "kigi-tool-types"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "minijinja",
 "schemars 1.2.1",
@@ -6500,7 +6500,7 @@ dependencies = [

 [[package]]
 name = "kigi-tools"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -6577,7 +6577,7 @@ dependencies = [

 [[package]]
 name = "kigi-tools-api"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "kigi-proto-build",
 "kigi-tool-protocol",
@@ -6590,11 +6590,11 @@ dependencies = [

 [[package]]
 name = "kigi-tracing-macros"
-version = "0.1.13"
+version = "0.1.14"

 [[package]]
 name = "kigi-tty-utils"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "libc",
 "nix 0.30.1",
@@ -6604,7 +6604,7 @@ dependencies = [

 [[package]]
 name = "kigi-tui"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "agent-client-protocol",
 "ansi-to-tui",
@@ -6691,7 +6691,7 @@ dependencies = [

 [[package]]
 name = "kigi-update"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anyhow",
 "dunce",
@@ -6720,14 +6720,14 @@ dependencies = [

 [[package]]
 name = "kigi-version"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "semver",
 ]

 [[package]]
 name = "kigi-workspace"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "agent-client-protocol",
 "anyhow",
@@ -6806,7 +6806,7 @@ dependencies = [

 [[package]]
 name = "kigi-workspace-types"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "base64",
 "chrono",
@@ -8840,7 +8840,7 @@ dependencies = [

 [[package]]
 name = "ptyctl"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "alacritty_terminal",
 "anyhow",
@@ -8858,7 +8858,7 @@ dependencies = [

 [[package]]
 name = "ptyctl-cli"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
 "anyhow",
 "axum",
@@ -76,7 +76,7 @@ members = [
 ]

 [workspace.package]
-version = "0.1.13"
+version = "0.1.14"
 edition = "2024"
 license = "Apache-2.0"

@@ -1,7 +1,7 @@
 # Security Policy

 Kigi is a community build; report vulnerabilities on the
-[Kigi issue tracker](https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/issues).
+[Kigi issue tracker](https://github.com/ZacharyZhang-NY/Kigi-CLI/issues).
 Issues there are public, so please leave out any detail that would make a
 report directly exploitable — open with the affected area and impact, and a
 maintainer will follow up for the rest.
@@ -21,7 +21,7 @@ pub struct KigiEndpoints {
 pub const PRODUCTION_ENDPOINTS: KigiEndpoints = KigiEndpoints {
    coding_api_base_url: "https://api.kimi.com/coding/v1",
    oauth_host: "https://auth.kimi.com",
-    update_base_url: "https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases",
+    update_base_url: "https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases",
    upgrade_page_url: "https://www.kimi.com/code/",
 };

@@ -13,7 +13,7 @@ use serde::Serialize;

 /// Where non-subscription users (no OAuth session) submit feedback instead.
 pub const FEEDBACK_ISSUES_URL: &str =
-    "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/issues";
+    "https://github.com/ZacharyZhang-NY/Kigi-CLI/issues";

 /// HTTP error from the feedback endpoint with a preserved status code, so
 /// callers can distinguish auth failures (401) without string matching.
@@ -11,7 +11,7 @@ use crate::slash::command::{AppCtx, ArgItem, CommandExecCtx, CommandResult, Slas
 /// Online docs landing page (hardcoded like other TUI deep-links; the
 /// project README is the docs entry point for the repo-hosted docs).
 pub const BUILD_DOCS_URL: &str =
-    "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/src/branch/main/README.md";
+    "https://github.com/ZacharyZhang-NY/Kigi-CLI/blob/main/README.md";

 /// Open How-to Guides or online Build docs.
 pub struct DocsCommand;
@@ -7,7 +7,7 @@ use crate::slash::command::{CommandExecCtx, CommandResult, SlashCommand};
 /// build, so its feedback belongs on its own repo — mirroring the official
 /// kimi-cli, whose `/feedback` opens its repo's issues page.
 pub const FEEDBACK_ISSUES_URL: &str =
-    "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/issues";
+    "https://github.com/ZacharyZhang-NY/Kigi-CLI/issues";

 /// Open the Kigi issue tracker in the browser.
 pub struct FeedbackCommand;
@@ -695,7 +695,7 @@ pub(crate) fn detect_platform() -> Result<(&'static str, &'static str)> {

 /// Rust target triple for this build — the key that maps a platform to its
 /// release-asset name. Must stay in lockstep with the five targets built by
-/// `.gitea/workflows/release.yml` and the tables in install.sh/install.ps1.
+/// `.github/workflows/release.yml` and the tables in install.sh/install.ps1.
 pub(crate) fn target_triple() -> Result<&'static str> {
    let triple = if cfg!(all(target_os = "macos", target_arch = "aarch64")) {
        "aarch64-apple-darwin"
@@ -2653,7 +2653,7 @@ mod tests {
    #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
    #[test]
    fn test_release_asset_name_matches_release_workflow_naming() {
-        // Must stay in lockstep with .gitea/workflows/release.yml, which
+        // Must stay in lockstep with .github/workflows/release.yml, which
        // publishes kigi-<version>-<target-triple>.{tar.gz|zip}.
        let triple = target_triple().unwrap();
        assert!(
@@ -10,7 +10,7 @@ const TTL_SECONDS_BEFORE_AUTO_UPDATE: Duration = Duration::from_secs(60 * 30);

 /// Release channel: this repo's Releases (PRD F8). The API base is resolved
 /// through [`kigi_env::update_base_url`] — production default
-/// `https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases`,
+/// `https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases`,
 /// overridable via `KIGI_UPDATE_BASE_URL` for mirrors and tests.
 pub(crate) fn update_base_url() -> String {
    kigi_env::update_base_url()
@@ -1,17 +1,14 @@
 # Release checklist (PRD F8)

 Kigi ships as a single-file binary for five targets, published on this
-repo's Gitea Releases by `.gitea/workflows/release.yml`. Users install via
+repo's GitHub Releases by `.github/workflows/release.yml`. Users install via
 `install.sh` / `install.ps1` and stay current through the in-app
 self-updater (`kigi-update`), which resolves the same Releases API.

-`.github/workflows/release.yml` is the retired GitHub pipeline. Gitea ignores
-`.github/workflows` entirely whenever `.gitea/workflows` is non-empty, so it
-does not run — it is kept only as a reference for the GitHub-hosted layout.
-
 ## Cutting a release

-1. Bump `[workspace.package] version` in `Cargo.toml`; land the change on
+1. Bump `[workspace.package] version` in `Cargo.toml` (and refresh
+   `Cargo.lock` with `cargo update --workspace`); land the change on
   `main` with green CI.
 2. Regenerate the third-party notices (not enforced by CI — this is the
   step that keeps `THIRD-PARTY-NOTICES.md` fresh):
@@ -34,15 +31,10 @@ does not run — it is kept only as a reference for the GitHub-hosted layout.
   `release-dist` profile, packages
   `kigi-<version>-<target-triple>.{tar.gz|zip}` archives (binary +
   LICENSE + NOTICE + THIRD-PARTY-NOTICES), generates `SHA256SUMS`, and
-   publishes the Gitea Release. Tags containing `-` (e.g.
-   `v0.2.0-alpha.1`) publish as pre-releases, which only the `alpha`
-   update channel picks up.
-
-   The release is created as a **draft** and only flipped public once
-   `SHA256SUMS` is attached, so `releases/latest` never hands the installer
-   a release whose checksum manifest is still missing. A failed run leaves
-   the draft in place; re-pushing the tag reuses it rather than erroring on
-   a duplicate `tag_name`.
+   publishes the GitHub Release with every asset attached in one step, so
+   `releases/latest` never serves a release whose checksum manifest is
+   missing. Tags containing `-` (e.g. `v0.2.0-alpha.1`) publish as
+   pre-releases, which only the `alpha` update channel picks up.
 5. Smoke-test an installed artifact:

   ```sh
@@ -52,127 +44,27 @@ does not run — it is kept only as a reference for the GitHub-hosted layout.

 ## Build runners

-Gitea has no hosted runners, so all three `runs-on` labels below are machines
-we register ourselves with `gitea-runner` (the binary formerly called
-`act_runner`). Labels are declared in the runner's `config.yaml` as
-`<label>:host` (run directly on the machine) or `<label>:docker://<image>` (run
-in a container) — with `gitea-runner` v2, `register --labels` is ignored
-whenever a config file supplies them.
+All five legs run on GitHub-hosted runners — nothing self-hosted to keep
+alive:

-| Label            | Machine                        | Mode   | Builds                                             |
-| ---------------- | ------------------------------ | ------ | -------------------------------------------------- |
-| `ubuntu-latest`  | the Dokploy box                | docker | `x86_64-unknown-linux-gnu`, `aarch64-unknown-linux-gnu` |
-| `macos-arm64`    | Mac Mini (M4)                  | host   | `aarch64-apple-darwin`, `x86_64-apple-darwin`      |
-| `windows-x86_64` | ZACHARYZHANG-PC                | host   | `x86_64-pc-windows-msvc`                           |
+| `runs-on`          | Builds                                                  |
+| ------------------ | ------------------------------------------------------- |
+| `macos-14` (arm64) | `aarch64-apple-darwin`, `x86_64-apple-darwin` (cross)   |
+| `ubuntu-24.04`     | `x86_64-unknown-linux-gnu`                              |
+| `ubuntu-24.04-arm` | `aarch64-unknown-linux-gnu` (native)                    |
+| `windows-2022`     | `x86_64-pc-windows-msvc`                                |

-The Linux legs use `ubuntu-latest` because that is what the Dokploy box's
-runner already advertises. That image is a bare runner-image, so those legs
-provision their own apt packages and rustup per run (`rustup show` then picks
-up the `rust-toolchain.toml` pin). If you register a dedicated
-`linux-x86_64:docker://…` runner later, change the three Linux `runs-on`
-values back to match it.
+`warm-cache.yml` rebuilds the `release-dist` profile on `main` whenever the
+dependency graph changes (plus a weekly refresh), so tag builds restore a
+warm default-branch cache instead of compiling the workspace cold. Its setup
+steps mirror `release.yml`'s build job — keep them in lockstep, or the cache
+key stops matching.

-**The Mac is not optional.** Apple's SDK licence limits macOS builds to
-Apple-branded hardware, and the Darwin targets need the real Apple linker
-anyway (`.cargo/config.toml` passes `-ObjC` and `-undefined dynamic_lookup`).
-There is no supported way to produce our macOS artifacts on the Linux server.
-One Apple Silicon Mac covers both Darwin targets — `x86_64-apple-darwin` is a
-cross-compile against the same SDK, exactly as the old GitHub `macos-14`
-runner did it.
-
-Windows is a softer requirement but still wants a real machine: the tree links
-`ring`, `mimalloc`, `zstd-sys` and `libz-sys` against a static MSVC CRT
-(`-C target-feature=+crt-static`). Cross-compiling that from Linux with
-`cargo-xwin` is possible but means debugging four C builds under `clang-cl`;
-a Windows runner with the VS 2022 C++ Build Tools reproduces today's binary
-exactly.
-
-Linux arm64 *is* cross-compiled on the x86_64 box — the workflow installs
-`gcc-aarch64-linux-gnu` and points `cc-rs` at it. The one thing this loses is
-the ability to smoke-test the arm64 binary before publishing (the old GitHub
-pipeline did not test it either). Register a native arm64 runner and change
-that matrix leg's `runner:` if you want it built natively.
-
-### Registering a runner
-
-Get a registration token from **Settings → Actions → Runners** (repo scope),
-your user settings (all your repos) or the site admin panel (instance-wide).
-Over the API it is a **POST**, not a GET — a GET is parsed as runner id `0` and
-404s:
-
-```sh
-curl -fsS -X POST -H "Authorization: token $GITEA_API_TOKEN" \
-  https://git.zacharyzhang.com/api/v1/user/actions/runners/registration-token
-```
-
-Write the labels into `config.yaml` first (see `runner.labels` in
-`gitea-runner generate-config`), then register on each machine:
-
-```sh
-# Linux (the Dokploy box) — container mode
-gitea-runner --config config.yaml register --no-interactive \
-  --instance https://git.zacharyzhang.com \
-  --token <REGISTRATION_TOKEN> \
-  --name kigi-linux-x86_64
-
-# macOS (Apple Silicon) — host mode, needs Xcode CLT + rustup + Node on PATH
-gitea-runner --config config.yaml register --no-interactive \
-  --instance https://git.zacharyzhang.com \
-  --token <REGISTRATION_TOKEN> \
-  --name kigi-macos-arm64
-
-# Windows — host mode, needs VS 2022 Build Tools + rustup + Node on PATH
-gitea-runner --config config.yaml register --no-interactive `
-  --instance https://git.zacharyzhang.com `
-  --token <REGISTRATION_TOKEN> `
-  --name kigi-windows-x86_64
-```
-
-Host-mode runners execute steps with the daemon's own environment, so each
-needs its build prerequisites installed up front — and the supervisor that
-launches the daemon must put them on `PATH`:
-
- **macOS**: `xcode-select --install`, `rustup`, and Node (for
-  `actions/checkout`, which is a JavaScript action).
- **Windows**: VS 2022 Build Tools with the "Desktop development with C++"
-  workload, `rustup`, Git for Windows, and Node. Every Windows step in the
-  workflow uses `shell: powershell` (5.1) — never `bash`, which on a normal
-  Windows box resolves to WSL.
- **Linux (docker mode)**: nothing on the host — the workflow installs
-  `build-essential`, `jq`, `unzip`, protoc, rustup and the cross toolchain
-  inside the container per run.
-
-### Keeping the runners alive
-
-Each host-mode runner is supervised so it survives reboots and crashes. Both
-supervisors export `CARGO_HOME`/`RUSTUP_HOME` and prepend the toolchain, git
-and node directories to `PATH`, because host-mode jobs inherit exactly the
-daemon's environment.
-
-| Machine  | Supervisor                                    | Manage with                                            |
-| -------- | --------------------------------------------- | ------------------------------------------------------ |
-| Windows  | Task Scheduler task `Gitea Runner (Kigi)` running `C:\Users\zhang\gitea-runner\run-runner.ps1` | `Get-ScheduledTask`, `Start-ScheduledTask`, `Stop-ScheduledTask` |
-| macOS    | LaunchAgent `com.kigi.gitea-runner` (`KeepAlive`) | `launchctl kickstart -k gui/$(id -u)/com.kigi.gitea-runner` |
-
-`prompt.txt` at the repo root is a one-shot setup prompt for the Mac Mini leg.
-Both runners also expose a liveness probe on `http://127.0.0.1:9101/healthz`.
-
-### Gitea-specific things that differ from GitHub
-
- Workflows live in `.gitea/workflows/`. Once that directory is non-empty,
-  `.github/workflows/` is ignored completely — you cannot run both.
- The automatic token is `secrets.GITEA_TOKEN`, and the release steps call the
-  Gitea API directly (`POST /releases`, `POST /releases/{id}/assets`,
-  `PATCH /releases/{id}`) rather than `softprops/action-gh-release`, which
-  targets GitHub's API and does not work here.
- `uses:` actions are fetched from `github.com` by default
-  (`DEFAULT_ACTIONS_URL`), so the runners need outbound access to it — our
-  GitHub *account* being suspended does not affect downloading public actions.
-  Absolute URLs (`uses: https://gitea.com/actions/checkout@v4`) work too.
- Artifacts carry only the five checksum lines; the archives themselves go
-  straight to the release. If `actions/upload-artifact@v3` misbehaves on the
-  instance, the fallback is to drop the artifact steps and have `publish`
-  download the archives from the release and hash them there.
+> History note: between 2026-08 and 2026-09 this pipeline ran as
+> `.gitea/workflows/release.yml` on self-hosted runners against
+> `git.zacharyzhang.com` while the GitHub account was unavailable. The Gitea
+> instance still hosts the pre-migration releases (`v0.1.12`, `v0.1.13`);
+> everything from `v0.1.14` on is built and published here.

 ## Invariants to keep in lockstep

@@ -11,4 +11,4 @@ Error generating stack: `+e.message+`
 <path d="M12 16.25C11.5858 16.25 11.25 16.5858 11.25 17C11.25 17.4142 11.5858 17.75 12 17.75H17C17.4142 17.75 17.75 17.4142 17.75 17C17.75 16.5858 17.4142 16.25 17 16.25H12Z" fill="currentColor"/>
 <path fill-rule="evenodd" clip-rule="evenodd" d="M18.1318 2.25H5.86821C5.12513 2.24999 4.52196 2.24999 4.03273 2.28996C3.52778 2.33121 3.07851 2.41876 2.66103 2.63148C2.00247 2.96703 1.46703 3.50247 1.13148 4.16103C0.918762 4.57851 0.831214 5.02778 0.789958 5.53273C0.749986 6.02196 0.749993 6.62511 0.75 7.36819V16.6318C0.749993 17.3749 0.749986 17.978 0.789958 18.4673C0.831214 18.9722 0.918762 19.4215 1.13148 19.839C1.46703 20.4975 2.00247 21.033 2.66103 21.3685C3.07851 21.5812 3.52778 21.6688 4.03273 21.71C4.52195 21.75 5.12507 21.75 5.86811 21.75H18.1318C18.8748 21.75 19.4781 21.75 19.9673 21.71C20.4722 21.6688 20.9215 21.5812 21.339 21.3685C21.9975 21.033 22.533 20.4975 22.8685 19.839C23.0812 19.4215 23.1688 18.9722 23.21 18.4673C23.25 17.9781 23.25 17.3749 23.25 16.6319V7.36819C23.25 6.62515 23.25 6.02195 23.21 5.53273C23.1688 5.02778 23.0812 4.57851 22.8685 4.16103C22.533 3.50247 21.9975 2.96703 21.339 2.63148C20.9215 2.41876 20.4722 2.33121 19.9673 2.28996C19.478 2.24999 18.8749 2.24999 18.1318 2.25ZM21.75 7.25C21.7498 6.54743 21.7472 6.04838 21.715 5.65488C21.6813 5.24269 21.619 5.0128 21.532 4.84202C21.3403 4.4657 21.0343 4.15973 20.658 3.96799C20.4872 3.88097 20.2573 3.81865 19.8451 3.78498C19.4242 3.75058 18.8824 3.75 18.1 3.75H5.9C5.11755 3.75 4.57582 3.75058 4.15488 3.78498C3.74269 3.81865 3.5128 3.88097 3.34202 3.96799C2.9657 4.15973 2.65973 4.4657 2.46799 4.84202C2.38097 5.0128 2.31865 5.24269 2.28498 5.65488C2.25283 6.04838 2.25022 6.54743 2.25002 7.25H21.75ZM2.25 8.75H21.75V16.6C21.75 17.3824 21.7494 17.9242 21.715 18.3451C21.6813 18.7573 21.619 18.9872 21.532 19.158C21.3403 19.5343 21.0343 19.8403 20.658 20.032C20.4872 20.119 20.2573 20.1813 19.8451 20.215C19.4242 20.2494 18.8824 20.25 18.1 20.25H5.9C5.11755 20.25 4.57582 20.2494 4.15488 20.215C3.74269 20.1813 3.5128 20.119 3.34202 20.032C2.9657 19.8403 2.65973 19.5343 2.46799 19.158C2.38097 18.9872 2.31865 18.7573 2.28498 18.3451C2.25058 17.9242 2.25 17.3824 2.25 16.6V8.75Z" fill="currentColor"/>`,F:`<path d="M7.46967 10.4697C7.76256 10.1768 8.23744 10.1768 8.53033 10.4697L11.5303 13.4697C11.8232 13.7626 11.8232 14.2374 11.5303 14.5303L8.53033 17.5303C8.23744 17.8232 7.76256 17.8232 7.46967 17.5303C7.17678 17.2374 7.17678 16.7626 7.46967 16.4697L9.93934 14L7.46967 11.5303C7.17678 11.2374 7.17678 10.7626 7.46967 10.4697Z" fill="currentColor"/>
 <path d="M12 16.25C11.5858 16.25 11.25 16.5858 11.25 17C11.25 17.4142 11.5858 17.75 12 17.75H17C17.4142 17.75 17.75 17.4142 17.75 17C17.75 16.5858 17.4142 16.25 17 16.25H12Z" fill="currentColor"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M4.03273 2.28996C4.52196 2.24999 5.12511 2.24999 5.86819 2.25H18.1318C18.8749 2.24999 19.478 2.24999 19.9673 2.28996C20.4722 2.33121 20.9215 2.41876 21.339 2.63148C21.9975 2.96703 22.533 3.50247 22.8685 4.16103C23.0812 4.57851 23.1688 5.02778 23.21 5.53273C23.25 6.02195 23.25 6.62507 23.25 7.36811V16.6318C23.25 17.3748 23.25 17.9781 23.21 18.4673C23.1688 18.9722 23.0812 19.4215 22.8685 19.839C22.533 20.4975 21.9975 21.033 21.339 21.3685C20.9215 21.5812 20.4722 21.6688 19.9673 21.71C19.4781 21.75 18.8749 21.75 18.1319 21.75H5.86819C5.12515 21.75 4.52195 21.75 4.03273 21.71C3.52778 21.6688 3.07851 21.5812 2.66103 21.3685C2.00247 21.033 1.46703 20.4975 1.13148 19.839C0.918762 19.4215 0.831214 18.9722 0.789958 18.4673C0.749986 17.978 0.749993 17.3749 0.75 16.6318V7.36821C0.749993 6.62513 0.749986 6.02196 0.789958 5.53273C0.831214 5.02778 0.918762 4.57851 1.13148 4.16103C1.46703 3.50247 2.00247 2.96703 2.66103 2.63148C3.07851 2.41876 3.52778 2.33121 4.03273 2.28996ZM2.25 8.75V16.6C2.25 17.3824 2.25058 17.9242 2.28498 18.3451C2.31865 18.7573 2.38097 18.9872 2.46799 19.158C2.65973 19.5343 2.9657 19.8403 3.34202 20.032C3.5128 20.119 3.74269 20.1813 4.15488 20.215C4.57582 20.2494 5.11755 20.25 5.9 20.25H18.1C18.8824 20.25 19.4242 20.2494 19.8451 20.215C20.2573 20.1813 20.4872 20.119 20.658 20.032C21.0343 19.8403 21.3403 19.5343 21.532 19.158C21.619 18.9872 21.6813 18.7573 21.715 18.3451C21.7494 17.9242 21.75 17.3824 21.75 16.6V8.75H2.25Z" fill="currentColor"/>`}),m=d(`Check`,{O:`<path d="M21.5303 5.46967C21.8232 5.76256 21.8232 6.23744 21.5303 6.53033L9.53033 18.5303C9.23744 18.8232 8.76256 18.8232 8.46967 18.5303L2.46967 12.5303C2.17678 12.2374 2.17678 11.7626 2.46967 11.4697C2.76256 11.1768 3.23744 11.1768 3.53033 11.4697L9 16.9393L20.4697 5.46967C20.7626 5.17678 21.2374 5.17678 21.5303 5.46967Z" fill="currentColor"/>`,F:`<path d="M21.7071 5.29289C22.0976 5.68342 22.0976 6.31658 21.7071 6.70711L9.70711 18.7071C9.31658 19.0976 8.68342 19.0976 8.29289 18.7071L2.29289 12.7071C1.90237 12.3166 1.90237 11.6834 2.29289 11.2929C2.68342 10.9024 3.31658 10.9024 3.70711 11.2929L9 16.5858L20.2929 5.29289C20.6834 4.90237 21.3166 4.90237 21.7071 5.29289Z" fill="currentColor"/>`}),h=d(`ChevronDown`,{F:`<g transform="scale(1.33333)"><path d="M9,13.5c-.192,0-.384-.073-.53-.22L2.22,7.03c-.293-.293-.293-.768,0-1.061s.768-.293,1.061,0l5.72,5.72,5.72-5.72c.293-.293,.768-.293,1.061,0s.293,.768,0,1.061l-6.25,6.25c-.146,.146-.338,.22-.53,.22Z" fill="currentColor"></path></g>`,O:`<g transform="scale(1.33333)"><polyline points="15.25 6.5 9 12.75 2.75 6.5" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></polyline></g>`}),g=d(`Code`,{O:`<path d="M14.1809 4.2755C14.581 4.3827 14.8185 4.79396 14.7113 5.19406L10.7377 20.0238C10.6304 20.4239 10.2192 20.6613 9.81909 20.5541C9.41899 20.4469 9.18156 20.0356 9.28876 19.6355L13.2624 4.80583C13.3696 4.40573 13.7808 4.16829 14.1809 4.2755Z" fill="currentColor"/><path d="M16.4425 7.32781C16.7196 7.01993 17.1938 6.99497 17.5017 7.27206L19.2392 8.8358C19.9756 9.49847 20.5864 10.0482 21.0058 10.5467C21.4468 11.071 21.7603 11.6342 21.7603 12.3295C21.7603 13.0248 21.4468 13.5881 21.0058 14.1123C20.5864 14.6109 19.9756 15.1606 19.2392 15.8233L17.5017 17.387C17.1938 17.6641 16.7196 17.6391 16.4425 17.3313C16.1654 17.0234 16.1904 16.5492 16.4983 16.2721L18.1947 14.7452C18.9826 14.0362 19.5138 13.5558 19.8579 13.1467C20.1882 12.7541 20.2603 12.525 20.2603 12.3295C20.2603 12.1341 20.1882 11.9049 19.8579 11.5123C19.5138 11.1033 18.9826 10.6229 18.1947 9.91383L16.4983 8.387C16.1904 8.10991 16.1654 7.63569 16.4425 7.32781Z" fill="currentColor"/><path d="M7.50178 8.387C7.80966 8.10991 7.83462 7.63569 7.55752 7.32781C7.28043 7.01993 6.80621 6.99497 6.49833 7.27206L4.76084 8.8358C4.0245 9.49847 3.41369 10.0482 2.99428 10.5467C2.55325 11.071 2.23975 11.6342 2.23975 12.3295C2.23975 13.0248 2.55325 13.5881 2.99428 14.1123C3.41369 14.6109 4.02449 15.1606 4.76082 15.8232L6.49833 17.387C6.80621 17.6641 7.28043 17.6391 7.55752 17.3313C7.83462 17.0234 7.80966 16.5492 7.50178 16.2721L5.80531 14.7452C5.01743 14.0362 4.48623 13.5558 4.14213 13.1467C3.81188 12.7541 3.73975 12.525 3.73975 12.3295C3.73975 12.1341 3.81188 11.9049 4.14213 11.5123C4.48623 11.1033 5.01743 10.6229 5.80531 9.91383L7.50178 8.387Z" fill="currentColor"/>`,F:`<path d="M14.1809 4.2755C14.581 4.3827 14.8185 4.79396 14.7113 5.19406L10.7377 20.0238C10.6304 20.4239 10.2192 20.6613 9.81909 20.5541C9.41899 20.4469 9.18156 20.0356 9.28876 19.6355L13.2624 4.80583C13.3696 4.40573 13.7808 4.16829 14.1809 4.2755Z" fill="currentColor"/><path d="M16.4425 7.32781C16.7196 7.01993 17.1938 6.99497 17.5017 7.27206L19.2392 8.8358C19.9756 9.49847 20.5864 10.0482 21.0058 10.5467C21.4468 11.071 21.7603 11.6342 21.7603 12.3295C21.7603 13.0248 21.4468 13.5881 21.0058 14.1123C20.5864 14.6109 19.9756 15.1606 19.2392 15.8233L17.5017 17.387C17.1938 17.6641 16.7196 17.6391 16.4425 17.331Line truncated
+<path fill-rule="evenodd" clip-rule="evenodd" d="M4.03273 2.28996C4.52196 2.24999 5.12511 2.24999 5.86819 2.25H18.1318C18.8749 2.24999 19.478 2.24999 19.9673 2.28996C20.4722 2.33121 20.9215 2.41876 21.339 2.63148C21.9975 2.96703 22.533 3.50247 22.8685 4.16103C23.0812 4.57851 23.1688 5.02778 23.21 5.53273C23.25 6.02195 23.25 6.62507 23.25 7.36811V16.6318C23.25 17.3748 23.25 17.9781 23.21 18.4673C23.1688 18.9722 23.0812 19.4215 22.8685 19.839C22.533 20.4975 21.9975 21.033 21.339 21.3685C20.9215 21.5812 20.4722 21.6688 19.9673 21.71C19.4781 21.75 18.8749 21.75 18.1319 21.75H5.86819C5.12515 21.75 4.52195 21.75 4.03273 21.71C3.52778 21.6688 3.07851 21.5812 2.66103 21.3685C2.00247 21.033 1.46703 20.4975 1.13148 19.839C0.918762 19.4215 0.831214 18.9722 0.789958 18.4673C0.749986 17.978 0.749993 17.3749 0.75 16.6318V7.36821C0.749993 6.62513 0.749986 6.02196 0.789958 5.53273C0.831214 5.02778 0.918762 4.57851 1.13148 4.16103C1.46703 3.50247 2.00247 2.96703 2.66103 2.63148C3.07851 2.41876 3.52778 2.33121 4.03273 2.28996ZM2.25 8.75V16.6C2.25 17.3824 2.25058 17.9242 2.28498 18.3451C2.31865 18.7573 2.38097 18.9872 2.46799 19.158C2.65973 19.5343 2.9657 19.8403 3.34202 20.032C3.5128 20.119 3.74269 20.1813 4.15488 20.215C4.57582 20.2494 5.11755 20.25 5.9 20.25H18.1C18.8824 20.25 19.4242 20.2494 19.8451 20.215C20.2573 20.1813 20.4872 20.119 20.658 20.032C21.0343 19.8403 21.3403 19.5343 21.532 19.158C21.619 18.9872 21.6813 18.7573 21.715 18.3451C21.7494 17.9242 21.75 17.3824 21.75 16.6V8.75H2.25Z" fill="currentColor"/>`}),m=d(`Check`,{O:`<path d="M21.5303 5.46967C21.8232 5.76256 21.8232 6.23744 21.5303 6.53033L9.53033 18.5303C9.23744 18.8232 8.76256 18.8232 8.46967 18.5303L2.46967 12.5303C2.17678 12.2374 2.17678 11.7626 2.46967 11.4697C2.76256 11.1768 3.23744 11.1768 3.53033 11.4697L9 16.9393L20.4697 5.46967C20.7626 5.17678 21.2374 5.17678 21.5303 5.46967Z" fill="currentColor"/>`,F:`<path d="M21.7071 5.29289C22.0976 5.68342 22.0976 6.31658 21.7071 6.70711L9.70711 18.7071C9.31658 19.0976 8.68342 19.0976 8.29289 18.7071L2.29289 12.7071C1.90237 12.3166 1.90237 11.6834 2.29289 11.2929C2.68342 10.9024 3.31658 10.9024 3.70711 11.2929L9 16.5858L20.2929 5.29289C20.6834 4.90237 21.3166 4.90237 21.7071 5.29289Z" fill="currentColor"/>`}),h=d(`ChevronDown`,{F:`<g transform="scale(1.33333)"><path d="M9,13.5c-.192,0-.384-.073-.53-.22L2.22,7.03c-.293-.293-.293-.768,0-1.061s.768-.293,1.061,0l5.72,5.72,5.72-5.72c.293-.293,.768-.293,1.061,0s.293,.768,0,1.061l-6.25,6.25c-.146,.146-.338,.22-.53,.22Z" fill="currentColor"></path></g>`,O:`<g transform="scale(1.33333)"><polyline points="15.25 6.5 9 12.75 2.75 6.5" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></polyline></g>`}),g=d(`Code`,{O:`<path d="M14.1809 4.2755C14.581 4.3827 14.8185 4.79396 14.7113 5.19406L10.7377 20.0238C10.6304 20.4239 10.2192 20.6613 9.81909 20.5541C9.41899 20.4469 9.18156 20.0356 9.28876 19.6355L13.2624 4.80583C13.3696 4.40573 13.7808 4.16829 14.1809 4.2755Z" fill="currentColor"/><path d="M16.4425 7.32781C16.7196 7.01993 17.1938 6.99497 17.5017 7.27206L19.2392 8.8358C19.9756 9.49847 20.5864 10.0482 21.0058 10.5467C21.4468 11.071 21.7603 11.6342 21.7603 12.3295C21.7603 13.0248 21.4468 13.5881 21.0058 14.1123C20.5864 14.6109 19.9756 15.1606 19.2392 15.8233L17.5017 17.387C17.1938 17.6641 16.7196 17.6391 16.4425 17.3313C16.1654 17.0234 16.1904 16.5492 16.4983 16.2721L18.1947 14.7452C18.9826 14.0362 19.5138 13.5558 19.8579 13.1467C20.1882 12.7541 20.2603 12.525 20.2603 12.3295C20.2603 12.1341 20.1882 11.9049 19.8579 11.5123C19.5138 11.1033 18.9826 10.6229 18.1947 9.91383L16.4983 8.387C16.1904 8.10991 16.1654 7.63569 16.4425 7.32781Z" fill="currentColor"/><path d="M7.50178 8.387C7.80966 8.10991 7.83462 7.63569 7.55752 7.32781C7.28043 7.01993 6.80621 6.99497 6.49833 7.27206L4.76084 8.8358C4.0245 9.49847 3.41369 10.0482 2.99428 10.5467C2.55325 11.071 2.23975 11.6342 2.23975 12.3295C2.23975 13.0248 2.55325 13.5881 2.99428 14.1123C3.41369 14.6109 4.02449 15.1606 4.76082 15.8232L6.49833 17.387C6.80621 17.6641 7.28043 17.6391 7.55752 17.3313C7.83462 17.0234 7.80966 16.5492 7.50178 16.2721L5.80531 14.7452C5.01743 14.0362 4.48623 13.5558 4.14213 13.1467C3.81188 12.7541 3.73975 12.525 3.73975 12.3295C3.73975 12.1341 3.81188 11.9049 4.14213 11.5123C4.48623 11.1033 5.01743 10.6229 5.80531 9.91383L7.50178 8.387Z" fill="currentColor"/>`,F:`<path d="M14.1809 4.2755C14.581 4.3827 14.8185 4.79396 14.7113 5.19406L10.7377 20.0238C10.6304 20.4239 10.2192 20.6613 9.81909 20.5541C9.41899 20.4469 9.18156 20.0356 9.28876 19.6355L13.2624 4.80583C13.3696 4.40573 13.7808 4.16829 14.1809 4.2755Z" fill="currentColor"/><path d="M16.4425 7.32781C16.7196 7.01993 17.1938 6.99497 17.5017 7.27206L19.2392 8.8358C19.9756 9.49847 20.5864 10.0482 21.0058 10.5467C21.4468 11.071 21.7603 11.6342 21.7603 12.3295C21.7603 13.0248 21.4468 13.5881 21.0058 14.1123C20.5864 14.6109 19.9756 15.1606 19.2392 15.8233L17.5017 17.387C17.1938 17.6641 16.7196 17.6391 16.4425 17.331Line truncated
@@ -16,11 +16,11 @@ interface Env {
  ASSETS: Fetcher;
 }

-/** Raw-file base for the canonical Kigi repo (Gitea, `main` branch). */
-const UPSTREAM = "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/raw/branch/main";
+/** Raw-file base for the canonical Kigi repo (GitHub, `main` branch). */
+const UPSTREAM = "https://raw.githubusercontent.com/ZacharyZhang-NY/Kigi-CLI/main";

 /** Human-facing repo URL, used in the installer-unavailable message. */
-const REPO_URL = "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI";
+const REPO_URL = "https://github.com/ZacharyZhang-NY/Kigi-CLI";

 interface Installer {
  file: string;
@@ -11,7 +11,7 @@
 # Environment:
 #   KIGI_SHARE_DIR        install root (default: %USERPROFILE%\.kigi)
 #   KIGI_UPDATE_BASE_URL  releases API base, GitHub/Gitea-shaped (default:
-#                         https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases)
+#                         https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases)

 [CmdletBinding()]
 param(
@@ -27,8 +27,7 @@ function Fail([string]$Message) {
 }

 $Repo = "ZacharyZhang-NY/Kigi-CLI"
-$Forge = "https://git.zacharyzhang.com"
-$ApiBase = if ($env:KIGI_UPDATE_BASE_URL) { $env:KIGI_UPDATE_BASE_URL } else { "$Forge/api/v1/repos/$Repo/releases" }
+$ApiBase = if ($env:KIGI_UPDATE_BASE_URL) { $env:KIGI_UPDATE_BASE_URL } else { "https://api.github.com/repos/$Repo/releases" }
 $KigiHome = if ($env:KIGI_SHARE_DIR) { $env:KIGI_SHARE_DIR } else { Join-Path $env:USERPROFILE ".kigi" }
 $Triple = "x86_64-pc-windows-msvc"

@@ -14,15 +14,14 @@
 # Environment:
 #   KIGI_SHARE_DIR        install root (default: ~/.kigi)
 #   KIGI_UPDATE_BASE_URL  releases API base, GitHub/Gitea-shaped (default:
-#                         https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases)
+#                         https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases)
 #
 # Fails fast on any error; never leaves a partial binary as the active kigi.

 set -eu

 REPO="ZacharyZhang-NY/Kigi-CLI"
-FORGE="https://git.zacharyzhang.com"
-API_BASE="${KIGI_UPDATE_BASE_URL:-${FORGE}/api/v1/repos/${REPO}/releases}"
+API_BASE="${KIGI_UPDATE_BASE_URL:-https://api.github.com/repos/${REPO}/releases}"
 KIGI_HOME="${KIGI_SHARE_DIR:-$HOME/.kigi}"

 err() {