feat!: Tauri rewrite — Rust backend, full frontend wiring, ship pipeline (M0–M5)

.github/workflows/ci.yml

@@ -1,27 +1,11 @@
-# CI — runs on every push to master and every PR.
-#
-# Why this exists: green main is a P0. Before this workflow the only CI was
-# release.yml, which fires on v* tags — so a broken main could sit for
-# days and only surface at release time. This gates the default branch on the
-# cheap, fast checks (lint, typecheck, unit tests) so a red main is
-# visible immediately, not at the next release.
-#
-# Toolchain intentionally mirrors release.yml (bun + Hutch) so a push build
-# and a release build can never disagree about the environment. Gates invoke
-# the local node_modules/.bin entries directly (same binaries build/build.js
-# drives) rather than package.json scripts. setup-bun caches ~/.bun keyed on
-# bun.lock automatically.
-#
-# `hutch electrobun sync` is not optional: app/tsconfig.json extends
-# .hutch/devkit/tsconfig.json, which is gitignored and only exists after
-# sync — without it `tsc -b` can't even load the app project. bun install
-# also runs the root postinstall (build/copy-tree-sitter-grammars.mjs),
-# which vendors the tree-sitter grammars the rag chunker tests load.
+# CI — PRs + pushes to dev/master. verify (renderer) + rust (workspace)
+# + versions (single-source version check). The prompt-bundle step generates
+# the gitignored _*-bundle.ts files tsc resolves.
 name: CI
 
 on:
   push:
-    branches: [master]
+    branches: [master, dev]
   pull_request:
 
 permissions:
@@ -32,6 +16,14 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  versions:
+    name: version files agree
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - run: node build/sync-version.mjs --check
+
   verify:
     name: lint · typecheck · test
     runs-on: ubuntu-latest
@@ -41,34 +33,44 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
 
-      - name: Setup Hutch
-        shell: bash
-        run: |
-          curl -fsSL https://hutch.blackboard.sh/hutch/install.sh | bash -s -- --channel production --no-modify-path
-          echo "$HOME/.hutch/bin" >> "$GITHUB_PATH"
-
       - name: Install
         run: bun install
 
-      # Generates .hutch/devkit (gitignored) — extended by app/tsconfig.json
-      # and the target of the electrobun/electrobun-main/electrobun-view
-      # path mappings the typecheck below resolves against.
-      - name: Sync Electrobun devkit
-        run: hutch electrobun sync
-
       # Generates src/lib/prompts/_*-bundle.ts from the markdown sources —
       # these are gitignored and only exist after this step, but tsc -b
-      # resolves them (and app/core/agent imports their types).
+      # resolves them (and src/lib/prompts/tide-system-prompt.ts imports
+      # their types).
       - name: Generate prompt bundles
         run: node build/promptMarkdownUtils.mjs
 
       - name: Lint
-        run: ./node_modules/.bin/oxlint
+        run: bun run lint
 
-      # Type gate: tsc -b covers the renderer + app projects via tsconfig
+      # Type gate: tsc -b covers the renderer + node projects via tsconfig
       # references. A red build here means main doesn't compile.
       - name: Typecheck
-        run: ./node_modules/.bin/tsc -b
+        run: bunx tsc -b
 
       - name: Test
-        run: ./node_modules/.bin/vitest run
+        run: bun run test
+
+  rust:
+    name: cargo · test + clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri
+
+      - name: install linux webkit deps
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev patchelf
+
+      - run: cargo test --workspace
+        working-directory: src-tauri
+
+      - run: cargo clippy --workspace --all-targets -- -D warnings
+        working-directory: src-tauri

.github/workflows/release-pkgs.yml

@@ -1,38 +1,41 @@
-# Publishes package-manager manifests (winget, homebrew tap) after each
-# Release workflow succeeds. Wakes via workflow_run on the "Release"
-# workflow (name: Release in release.yml), which fires on v* tags.
+# Active (gated on secrets): winget + homebrew manifests for the Tauri
+# artifacts (Tide_<ver>_<arch>-setup.exe / .dmg / .deb). Requires secrets
+# WINGET_GITHUB_TOKEN + HOMEBREW_GITHUB_API_TOKEN — a missing secret skips
+# that platform's publish job with a notice.
 #
-# Flow: parse the version from the workflow_run tag → render.mjs hashes the
-# release assets and fills the packaging/ templates → platform jobs submit.
-# Each platform job is gated on (a) its manifest actually being rendered
-# (partial releases skip with a notice) and (b) its secret being configured.
-#
-# One-time setup (see packaging/README.md):
-#   winget   — set WINGET_GITHUB_TOKEN (PAT: public_repo + workflow scopes).
-#   homebrew — set HOMEBREW_GITHUB_API_TOKEN.
-#
-# NOTE: workflow_run always executes the copy of this file from the repo's
-# default branch, so changes here only take effect once merged there.
+# Wakes via workflow_run when the Release workflow succeeds on a v* tag. The
+# Release workflow creates DRAFT releases — until the draft is published the
+# asset URLs don't resolve, so a still-draft release is skipped with a notice;
+# publish it and re-run this workflow (workflow_dispatch, tag defaults to the
+# latest published release) to submit the manifests.
 name: Publish package manifests
 
 on:
   workflow_run:
     workflows: [Release]
     types: [completed]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to render (e.g. v0.4.0-beta.1); empty = latest published release'
+        required: false
+        default: ''
 
 permissions:
   contents: read
 
 concurrency:
-  group: pkg-manifests-${{ github.event.workflow_run.head_branch }}
+  group: pkg-manifests-${{ github.event.workflow_run.head_branch || 'manual' }}
   cancel-in-progress: false
 
 jobs:
   render:
     # Only act when the Release workflow that woke us up actually succeeded
     # and was cutting a release (its only trigger is v* tags, but guard
-    # anyway in case Release ever grows other triggers).
-    if: ${{ github.event.workflow_run.conclusion == 'success' && startsWith(github.event.workflow_run.head_branch, 'v') }}
+    # anyway in case Release ever grows other triggers). Manual dispatch
+    # bypasses the guard — that is the recovery path for a release that was
+    # still a draft when the automatic run fired.
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && startsWith(github.event.workflow_run.head_branch, 'v')) }}
     name: render · manifests
     runs-on: ubuntu-latest
     outputs:
@@ -49,25 +52,50 @@ jobs:
           node-version: 22
 
       # For tag pushes, workflow_run.head_branch is the tag name
-      # (e.g. "v0.3.0-beta.1") — strip the v prefix.
-      - name: Resolve version from release tag
+      # (e.g. "v0.4.0-beta.1"). For dispatch, take the input tag or the
+      # latest published (non-draft) release. Draft releases are skipped
+      # with a notice and empty outputs, which skips everything downstream.
+      - name: Resolve release tag (skip drafts)
         id: ver
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
-          TAG="${{ github.event.workflow_run.head_branch }}"
+          set -eu
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            TAG="${{ inputs.tag }}"
+            if [ -z "$TAG" ]; then
+              TAG="$(gh api "repos/${{ github.repository }}/releases?per_page=10" \
+                --jq '[.[] | select(.draft == false)][0].tag_name')"
+              if [ -z "$TAG" ] || [ "$TAG" = "null" ]; then
+                echo "no published release found — pass the tag explicitly via the 'tag' input"
+                exit 1
+              fi
+            fi
+          else
+            TAG="${{ github.event.workflow_run.head_branch }}"
+          fi
+          DRAFT="$(gh api "repos/${{ github.repository }}/releases/tags/$TAG" --jq '.draft')"
+          if [ "$DRAFT" = "true" ]; then
+            echo "::notice::$TAG is still a draft release — publish it, then re-run this workflow (workflow_dispatch) to submit manifests."
+            exit 0
+          fi
           VERSION="${TAG#v}"
           if ! printf '%s' "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9._-]+)?$'; then
             echo "tag $TAG does not carry a semver (expected vX.Y.Z)"; exit 1
           fi
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Render manifests
+        if: ${{ steps.ver.outputs.version != '' }}
         run: |
           node packaging/render.mjs \
             --version "${{ steps.ver.outputs.version }}" \
             --repo "${{ github.repository }}"
 
       - name: Expose manifest values to downstream jobs
         id: meta
+        if: ${{ steps.ver.outputs.version != '' }}
         run: |
           M=packaging/out/meta.json
           echo "version=$(jq -r .version "$M")" >> "$GITHUB_OUTPUT"
@@ -77,6 +105,7 @@ jobs:
           echo "winget=$(jq -r .platforms.winget "$M")" >> "$GITHUB_OUTPUT"
 
       - uses: actions/upload-artifact@v4
+        if: ${{ steps.ver.outputs.version != '' }}
         with:
           name: manifests
           path: packaging/out/