Fixes and packaging

.cargo/config.toml

@@ -1,5 +1,16 @@
-# whisper-rs-sys builds whisper.cpp with CUDA and the static CRT (/MT);
-# Rust links with the dynamic CRT (/MD). The linker resolves this fine
-# but warns about the conflicting default lib. Suppress it.
+# Link the whole binary with the static CRT (/MT), end to end. The old
+# arrangement mixed CRTs - whisper.cpp and the WebView2 loader compile /MT,
+# Rust links /MD - and suppressed the conflict warning with
+# /NODEFAULTLIB:LIBCMT; that held only while the dynamic import libs carried
+# every symbol the /MT objects needed. CUDA 13.2's cudart.lib (built with
+# /guard:cf) and the WebView2 loader's nothrow-new reference broke it. The
+# rustflags line covers Rust and the cc-built C++ (cc follows crt-static);
+# the two env vars ride whisper-rs-sys's CMAKE_* passthrough so cmake
+# compiles the whisper core and the NVCC kernels /MT to match (CMP0091 NEW
+# because whisper.cpp's cmake_minimum_required predates the abstraction).
 [target.x86_64-pc-windows-msvc]
-rustflags = ["-C", "link-args=/NODEFAULTLIB:LIBCMT"]
+rustflags = ["-C", "target-feature=+crt-static"]
+
+[env]
+CMAKE_POLICY_DEFAULT_CMP0091 = "NEW"
+CMAKE_MSVC_RUNTIME_LIBRARY = "MultiThreaded"

.gitattributes

@@ -1,7 +1,18 @@
-# The UI artifact verifier hashes ui/ source bytes; CRLF conversion on
-# Windows checkouts would stale the checked-in dist/ manifest.
+* text=auto eol=lf
+*.ps1 text eol=crlf
+*.bat text eol=crlf
+*.png binary
+*.ico binary
+*.icns binary
+*.gguf binary
+*.bin binary
+# The UI sources are bundled by esbuild; CRLF conversion on Windows
+# checkouts would change bundle bytes between platforms.
 crates/promptforge-gateway-config-ui/ui/** text eol=lf
 crates/promptforge-workshop-server/ui/** text eol=lf
 # Images are not text; the blanket rules above must not convert them.
 crates/promptforge-gateway-config-ui/ui/**/*.png binary
 crates/promptforge-workshop-server/ui/**/*.png binary
+# The event-log schema canary pins the version-1 file exactly as the log
+# writer emits it (LF); autocrlf must not rewrite it on Windows checkouts.
+crates/promptforge-workshop-server/tests/it/observer/*.jsonl text eol=lf

.github/workflows/ci.yml

@@ -12,6 +12,10 @@ concurrency:
 jobs:
   check:
     runs-on: ubuntu-latest
+    # RUSTUP_TOOLCHAIN outranks the repo's rust-toolchain.toml (pinned to the
+    # MSRV for local builds); this job means to test stable.
+    env:
+      RUSTUP_TOOLCHAIN: stable
     steps:
       - uses: actions/checkout@v4
 
@@ -42,18 +46,18 @@ jobs:
       # features, which need a CUDA Toolkit these runners do not have. Their
       # non-CUDA surfaces are exercised by the dedicated steps below.
       - name: Clippy
-        run: cargo clippy --workspace --exclude promptforge-workshop --exclude promptforge-workshop-server --exclude promptforge-desktop-shell --exclude promptforge-gateway --exclude promptforge-transcribe --exclude promptforge-stt --all-targets --all-features -- -D warnings
+        run: cargo clippy --workspace --exclude promptforge-workshop --exclude promptforge-workshop-server --exclude promptforge-gateway --exclude promptforge-transcribe --exclude promptforge-stt --all-targets --all-features -- -D warnings
 
       - name: Test
-        run: cargo test --locked --workspace --exclude promptforge-workshop --exclude promptforge-workshop-server --exclude promptforge-desktop-shell --exclude promptforge-gateway --exclude promptforge-transcribe --exclude promptforge-stt --all-features
+        run: cargo test --locked --workspace --exclude promptforge-workshop --exclude promptforge-workshop-server --exclude promptforge-gateway --exclude promptforge-transcribe --exclude promptforge-stt --all-features
 
       - name: Doctests
-        run: cargo test --workspace --exclude promptforge-workshop --exclude promptforge-workshop-server --exclude promptforge-desktop-shell --exclude promptforge-gateway --exclude promptforge-transcribe --exclude promptforge-stt --doc
+        run: cargo test --workspace --exclude promptforge-workshop --exclude promptforge-workshop-server --exclude promptforge-gateway --exclude promptforge-transcribe --exclude promptforge-stt --doc
 
       - name: Docs
         env:
           RUSTDOCFLAGS: -D warnings
-        run: cargo doc --workspace --no-deps --all-features --exclude promptforge-workshop --exclude promptforge-workshop-server --exclude promptforge-desktop-shell --exclude promptforge-gateway --exclude promptforge-transcribe --exclude promptforge-stt
+        run: cargo doc --workspace --no-deps --all-features --exclude promptforge-workshop --exclude promptforge-workshop-server --exclude promptforge-gateway --exclude promptforge-transcribe --exclude promptforge-stt
 
       # The transcription engine and STT runtime without their cuda features:
       # whisper then builds its CPU backend, which needs no toolkit.
@@ -76,8 +80,21 @@ jobs:
       - name: Test (gateway)
         run: cargo test --locked -p promptforge-gateway --features workshop
 
+      # No build step may write into the repository (the UI bundles build
+      # into OUT_DIR now); catch a regression here rather than in a diff.
+      - name: Clean tree
+        shell: bash
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "the build dirtied the repository:"
+            git status --porcelain
+            exit 1
+          fi
+
   check-workshop:
     runs-on: windows-latest
+    env:
+      RUSTUP_TOOLCHAIN: stable
     steps:
       - uses: actions/checkout@v4
 
@@ -107,15 +124,69 @@ jobs:
       # feature, and windows-latest has no CUDA toolkit; CI builds the
       # CPU-only whisper path instead.
       - name: Clippy (workshop)
-        run: cargo clippy -p promptforge-workshop -p promptforge-workshop-server -p promptforge-desktop-shell --all-targets --no-default-features -- -D warnings
+        run: cargo clippy -p promptforge-workshop -p promptforge-workshop-server --all-targets --no-default-features -- -D warnings
 
       - name: Test (workshop)
-        run: cargo test --locked -p promptforge-workshop -p promptforge-workshop-server -p promptforge-desktop-shell --no-default-features
+        run: cargo test --locked -p promptforge-workshop -p promptforge-workshop-server --no-default-features
+
+      - name: Clean tree
+        shell: bash
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "the build dirtied the repository:"
+            git status --porcelain
+            exit 1
+          fi
+
+  # First Linux build of the desktop app: compile-only, against the Tauri
+  # system packages a Linux developer installs per the README. Catches the
+  # missing-system-package class of failure the Windows-only job cannot see.
+  check-workshop-linux:
+    runs-on: ubuntu-22.04
+    env:
+      RUSTUP_TOOLCHAIN: stable
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+
+      - name: Install Tauri system packages
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libxdo-dev libssl-dev libayatana-appindicator3-dev librsvg2-dev
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
 
-  # The UI build is its own job: it typechecks, tests, and packages the
-  # versioned ui/dist artifact that release builds of promptforge-workshop-server
-  # verify and embed (the debug-profile cargo jobs above still drive the UI
-  # build in place through the crate's build script, hence their npm ci).
+      - name: Install UI dependencies
+        working-directory: crates/promptforge-workshop-server/ui
+        run: npm ci
+
+      - name: Install config UI dependencies
+        working-directory: crates/promptforge-gateway-config-ui/ui
+        run: npm ci
+
+      - name: Build (workshop, Linux)
+        run: cargo build --locked -p promptforge-workshop --no-default-features
+
+      - name: Clean tree
+        shell: bash
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "the build dirtied the repository:"
+            git status --porcelain
+            exit 1
+          fi
+
+  # The UI build is its own job: typecheck, bundle, and test. The cargo
+  # jobs drive the same bundle through the crates' build scripts, hence
+  # their npm ci.
   ui:
     runs-on: ubuntu-latest
     steps:
@@ -141,16 +212,6 @@ jobs:
         working-directory: crates/promptforge-workshop-server/ui
         run: npm test
 
-      - name: Package the UI artifact
-        working-directory: crates/promptforge-workshop-server/ui
-        run: npm run package
-
-      - name: Upload the UI artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: promptforge-workshop-ui-dist
-          path: crates/promptforge-workshop-server/ui/dist/
-
       - name: Install config UI dependencies
         working-directory: crates/promptforge-gateway-config-ui/ui
         run: npm ci
@@ -167,18 +228,10 @@ jobs:
         working-directory: crates/promptforge-gateway-config-ui/ui
         run: npm test
 
-      - name: Package the config UI artifact
-        working-directory: crates/promptforge-gateway-config-ui/ui
-        run: npm run package
-
-      - name: Upload the config UI artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: promptforge-gateway-config-ui-dist
-          path: crates/promptforge-gateway-config-ui/ui/dist/
-
   msrv:
     runs-on: ubuntu-latest
+    env:
+      RUSTUP_TOOLCHAIN: 1.89.0
     steps:
       - uses: actions/checkout@v4
 
@@ -203,8 +256,8 @@ jobs:
 
       - name: Build and test on MSRV
         run: |
-          cargo build --locked --workspace --exclude promptforge-workshop --exclude promptforge-workshop-server --exclude promptforge-desktop-shell --exclude promptforge-gateway --exclude promptforge-transcribe --exclude promptforge-stt --all-features
-          cargo test --locked --workspace --exclude promptforge-workshop --exclude promptforge-workshop-server --exclude promptforge-desktop-shell --exclude promptforge-gateway --exclude promptforge-transcribe --exclude promptforge-stt --all-features
+          cargo build --locked --workspace --exclude promptforge-workshop --exclude promptforge-workshop-server --exclude promptforge-gateway --exclude promptforge-transcribe --exclude promptforge-stt --all-features
+          cargo test --locked --workspace --exclude promptforge-workshop --exclude promptforge-workshop-server --exclude promptforge-gateway --exclude promptforge-transcribe --exclude promptforge-stt --all-features
 
       - name: Build and test gateway on MSRV
         run: |
@@ -218,6 +271,8 @@ jobs:
 
   supply-chain:
     runs-on: ubuntu-latest
+    env:
+      RUSTUP_TOOLCHAIN: stable
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/dist-ci/build-setup.yml

@@ -0,0 +1,14 @@
+# Injected into cargo-dist's build-local-artifacts job (github-build-setup
+# in dist-workspace.toml). The gateway build bundles the two web UIs with
+# esbuild, which needs Node 22 and the npm installs. Keep in sync with the
+# setup steps in ci.yml. Every step needs a `name`, and only
+# name/uses/with/run survive the cargo-dist template, so the npm paths go
+# through --prefix rather than working-directory.
+- name: Set up Node.js 22
+  uses: actions/setup-node@v4
+  with:
+    node-version: 22
+- name: Install UI dependencies
+  run: npm ci --prefix crates/promptforge-workshop-server/ui
+- name: Install config UI dependencies
+  run: npm ci --prefix crates/promptforge-gateway-config-ui/ui

.github/workflows/gateway-release-test.yml

@@ -0,0 +1,57 @@
+name: Gateway release test
+
+# Reusable gate called by the cargo-dist release workflow as a host-job
+# (pre-publish, see host-jobs in dist-workspace.toml): the GitHub Release
+# is created only when this passes. Runs the built archive on a clean
+# machine: checksums, --version, boot, and the config page.
+
+on:
+  workflow_call:
+    inputs:
+      plan:
+        required: true
+        type: string
+
+jobs:
+  test:
+    runs-on: ubuntu-22.04
+    env:
+      PLAN: ${{ inputs.plan }}
+    steps:
+      - name: Download the built artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: artifacts-*
+          path: target/distrib
+          merge-multiple: true
+
+      - name: Verify the archive checksums
+        working-directory: target/distrib
+        run: sha256sum -c sha256.sum
+
+      - name: Install from the archive
+        working-directory: target/distrib
+        run: |
+          tar -xf promptforge-gateway-x86_64-unknown-linux-gnu.tar.xz
+          sudo install -m 755 promptforge-gateway-x86_64-unknown-linux-gnu/promptforge-gateway /usr/local/bin/promptforge-gateway
+
+      - name: Version check
+        run: |
+          tag="$(jq -r .announcement_tag <<<"$PLAN")"
+          version="${tag#promptforge-gateway-v}"
+          output="$(promptforge-gateway --version)"
+          echo "$output"
+          grep -F "$version" <<<"$output"
+
+      - name: The gateway serves the config page
+        run: |
+          workdir="$(mktemp -d)"
+          printf 'config-version = 2\n[server]\nbind = "127.0.0.1:8081"\napi_key = "test-key"\n\n[[profile]]\nname = "main"\nmodels = []\n' > "$workdir/gateway.toml"
+          promptforge-gateway serve "$workdir/gateway.toml" --profile main &
+          server_pid=$!
+          trap 'kill $server_pid 2>/dev/null || true' EXIT
+          for attempt in $(seq 1 30); do
+            if curl -sf http://127.0.0.1:8081/config/ -o "$workdir/config.html"; then break; fi
+            sleep 1
+          done
+          grep -F "PromptForge Gateway Config" "$workdir/config.html"

.github/workflows/guide.yml

@@ -11,7 +11,10 @@ concurrency:
   group: pages
   cancel-in-progress: false
 jobs:
+  # Forks have no Pages site for this guide; skip the whole deployment
+  # there. The deploy job follows through its `needs: build`.
   build:
+    if: github.repository == 'cppalliance/promptforge'
     runs-on: ubuntu-latest
     env:
       MDBOOK_VERSION: 0.4.44