chore: merge main into val/perf-command-integration-audit; resolve conflicts

- TUI files: took main's trusted_command_path helpers over HEAD's hardcoded cmds
- app.rs: kept HistorySearch::default impl, took main's clipboard delegation
- cli/main.rs: took main (already has #27 + #38 fixes); fixed EffortLevel::from_str → ::parse
- All other Rust files: took main (formatting/reformatting only)

cargo check clean.

Author: BunsDev

.github/workflows/auto-release.yml

@@ -2,7 +2,7 @@ name: Auto Release (commit marker)
 
 # Two flows, both driven by markers in the head commit message:
 #
-#   --release vMAJOR.MINOR.PATCH
+#   --release vMAJOR.MINOR.PATCH  (restricted to OpenCoven release bot)
 #       Cut a brand-new release.  The requested tag must be strictly greater
 #       (semver) than the highest existing tag, and must not already exist.
 #       Stamps the version across Cargo.toml/lock, npm, README, docs, and the
@@ -36,8 +36,11 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # Restricted to the release bot so contributor-controlled PR titles or
+  # commit messages cannot authorize a release when a maintainer merges them.
   auto-release:
     runs-on: ubuntu-latest
+    if: github.actor == 'opencoven-bot'
 
     steps:
       # ── 0. Skip our own bump commits ──────────────────────────────────

.github/workflows/npm-publish.yml

@@ -165,6 +165,49 @@ jobs:
           "
           echo "Publishing coven-code@${VERSION}"
 
+      - name: Generate npm checksum manifest
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.version.outputs.tag }}"
+          mkdir -p release-assets
+          gh release download "$TAG" \
+            --repo "${{ github.repository }}" \
+            --pattern 'coven-code-*.tar.gz' \
+            --pattern 'coven-code-*.zip' \
+            --dir release-assets
+
+          node <<'NODE'
+          const fs = require('fs');
+          const path = require('path');
+          const crypto = require('crypto');
+
+          const expectedArchives = [
+            'coven-code-windows-x86_64.zip',
+            'coven-code-linux-x86_64.tar.gz',
+            'coven-code-linux-aarch64.tar.gz',
+            'coven-code-macos-x86_64.tar.gz',
+            'coven-code-macos-aarch64.tar.gz',
+          ];
+
+          const manifest = {};
+          for (const archive of expectedArchives) {
+            const archivePath = path.join('release-assets', archive);
+            if (!fs.existsSync(archivePath)) {
+              console.error(`::error::Missing release archive ${archive}`);
+              process.exit(1);
+            }
+            const hash = crypto.createHash('sha256');
+            hash.update(fs.readFileSync(archivePath));
+            manifest[archive] = { sha256: hash.digest('hex') };
+          }
+
+          fs.writeFileSync('npm/checksums.json', JSON.stringify(manifest, null, 2) + '\n');
+          NODE
+
+          cat npm/checksums.json
+
       - name: Publish to npm
         working-directory: npm
         env:

.github/workflows/patch-release.yml

@@ -42,6 +42,7 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
+  PATCH_RELEASE_VERSION: ${{ inputs.version }}
 
 jobs:
   # ── Preflight ───────────────────────────────────────────────────────
@@ -53,6 +54,14 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Validate version input
+        run: |
+          if [[ ! "$PATCH_RELEASE_VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.-]+)?$ ]]; then
+            echo "::error::Invalid version: $PATCH_RELEASE_VERSION"
+            echo "::error::Expected a tag like v1.2.3 or v1.2.3-rc.1."
+            exit 1
+          fi
+
       - name: Must be on main branch
         run: |
           if [[ "${{ github.ref }}" != "refs/heads/main" ]]; then
@@ -64,17 +73,17 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          if ! gh release view "${{ inputs.version }}" \
+          if ! gh release view "$PATCH_RELEASE_VERSION" \
                --repo "${{ github.repository }}" >/dev/null 2>&1; then
-            echo "::error::Release ${{ inputs.version }} does not exist."
+            echo "::error::Release $PATCH_RELEASE_VERSION does not exist."
             echo "::error::To cut a brand-new release, use the regular Release workflow instead."
             exit 1
           fi
 
       - name: Cargo.toml version must still match the patched tag
         run: |
           CARGO_VERSION=$(grep '^version' src-rust/Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
-          TAG_VERSION="${{ inputs.version }}"
+          TAG_VERSION="$PATCH_RELEASE_VERSION"
           TAG_VERSION="${TAG_VERSION#v}"  # strip leading v
           if [[ "$CARGO_VERSION" != "$TAG_VERSION" ]]; then
             echo "::error::Cargo.toml ($CARGO_VERSION) does not match patched tag ($TAG_VERSION)."
@@ -263,9 +272,9 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git tag -f "${{ inputs.version }}" "${{ github.sha }}"
-          git push -f origin "refs/tags/${{ inputs.version }}"
-          echo "Tag ${{ inputs.version }} now points at ${{ github.sha }}."
+          git tag -f "$PATCH_RELEASE_VERSION" "${{ github.sha }}"
+          git push -f origin "refs/tags/$PATCH_RELEASE_VERSION"
+          echo "Tag $PATCH_RELEASE_VERSION now points at ${{ github.sha }}."
 
       # `gh release upload --clobber` overwrites assets one at a time without
       # touching the release body, name, draft state, or prerelease flag.
@@ -279,7 +288,7 @@ jobs:
           for f in release/*; do
             echo "→ Uploading $(basename "$f")"
           done
-          gh release upload "${{ inputs.version }}" release/* \
+          gh release upload "$PATCH_RELEASE_VERSION" release/* \
             --repo "${{ github.repository }}" \
             --clobber
 
@@ -298,13 +307,15 @@ jobs:
         run: python3 scripts/append-patch-note.py
 
       - name: Summary
+        env:
+          PATCH_RELEASE_NOTE: ${{ inputs.patch_note }}
         run: |
           {
-            echo "## ✅ Patched ${{ inputs.version }} in place"
+            echo "## ✅ Patched $PATCH_RELEASE_VERSION in place"
             echo
             echo "- Tag force-moved to commit \`${{ github.sha }}\`."
             echo "- 5 binary archives + install scripts rebuilt and re-uploaded."
-            if [[ -n "${{ inputs.patch_note }}" ]]; then
+            if [[ -n "$PATCH_RELEASE_NOTE" ]]; then
               echo "- Release body received a new bullet under \`## 🩹 Patches\` at the top."
             else
               echo "- Release title, body, contributors, and Full Changelog link unchanged."

.github/workflows/release.yml

@@ -22,6 +22,7 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
+  RELEASE_VERSION: ${{ inputs.version }}
 
 jobs:
   # ── Preflight: validate branch, tag, and version match ──────────────
@@ -32,6 +33,14 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
+
+      - name: Validate version input
+        run: |
+          if [[ ! "$RELEASE_VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+            echo "::error::Version must be a v-prefixed SemVer tag, for example v0.1.0."
+            exit 1
+          fi
 
       - name: Must be on main branch
         run: |
@@ -42,15 +51,15 @@ jobs:
 
       - name: Tag must not already exist
         run: |
-          if git ls-remote --exit-code --tags origin "refs/tags/${{ inputs.version }}" >/dev/null 2>&1; then
-            echo "::error::Tag ${{ inputs.version }} already exists"
+          if git ls-remote --exit-code --tags origin "refs/tags/$RELEASE_VERSION" >/dev/null 2>&1; then
+            echo "::error::Tag $RELEASE_VERSION already exists"
             exit 1
           fi
 
       - name: Version tag must match Cargo.toml
         run: |
           CARGO_VERSION=$(grep '^version' src-rust/Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
-          TAG_VERSION="${{ inputs.version }}"
+          TAG_VERSION="$RELEASE_VERSION"
           TAG_VERSION="${TAG_VERSION#v}"  # strip leading v
           if [[ "$CARGO_VERSION" != "$TAG_VERSION" ]]; then
             echo "::error::Tag version ($TAG_VERSION) does not match Cargo.toml ($CARGO_VERSION). Update Cargo.toml first."
@@ -92,6 +101,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -181,6 +192,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Download all artifacts
         uses: actions/download-artifact@v4
@@ -258,7 +270,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          CURRENT_TAG="${{ inputs.version }}"
+          CURRENT_TAG="$RELEASE_VERSION"
           PREVIOUS_TAG="$(git tag --sort=-v:refname | grep -vxF "$CURRENT_TAG" | head -n 1 || true)"
 
           # ── Pass 1: GitHub-generated PR notes ──────────────────────────
@@ -361,9 +373,9 @@ jobs:
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{ inputs.version }}
+          tag_name: ${{ env.RELEASE_VERSION }}
           target_commitish: ${{ github.sha }}
-          name: Coven Code ${{ inputs.version }}
+          name: Coven Code ${{ env.RELEASE_VERSION }}
           draft: false
           prerelease: false
           body_path: release-notes.md
@@ -387,5 +399,5 @@ jobs:
           gh workflow run npm-publish.yml \
             --repo "${{ github.repository }}" \
             --ref main \
-            -f version="${{ inputs.version }}"
-          echo "Dispatched npm-publish.yml for ${{ inputs.version }}."
+            -f version="$RELEASE_VERSION"
+          echo "Dispatched npm-publish.yml for $RELEASE_VERSION."

npm/bin/coven-code

@@ -7,12 +7,12 @@ const os = require('os');
 const fs = require('fs');
 
 const ext = os.platform() === 'win32' ? '.exe' : '';
-const binary = path.join(__dirname, '..', 'native', `coven-code`);
+const binary = path.join(__dirname, '..', 'native', `coven-code${ext}`);
 
 if (!fs.existsSync(binary)) {
   console.error(
     'coven-code: native binary not found.\n' +
-    'Try reinstalling: npm install -g /coven-code\n' +
+    'Try reinstalling: npm install -g @opencoven/coven-code\n' +
     `Expected: ${binary}`
   );
   process.exit(1);

npm/checksums.json

@@ -0,0 +1 @@
+{}

npm/install.js

@@ -2,13 +2,14 @@
 'use strict';
 
 const https = require('https');
-const http = require('http');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const crypto = require('crypto');
 const { execFileSync } = require('child_process');
 
 const pkg = require('./package.json');
+const checksums = require('./checksums.json');
 const VERSION = pkg.version;
 const REPO = 'OpenCoven/coven-code';
 const BASE_URL = `https://github.com/${REPO}/releases/download/v${VERSION}`;
@@ -41,13 +42,29 @@ function getPlatform() {
 
 function download(url, dest) {
   return new Promise((resolve, reject) => {
+    const parsed = new URL(url);
+    if (parsed.protocol !== 'https:') {
+      reject(new Error(`Refusing to download non-HTTPS URL: ${url}`));
+      return;
+    }
+
     const file = fs.createWriteStream(dest);
-    const get = url.startsWith('https') ? https : http;
-    get.get(url, (res) => {
-      if (res.statusCode === 301 || res.statusCode === 302) {
+    https.get(url, (res) => {
+      if ([301, 302, 303, 307, 308].includes(res.statusCode)) {
         file.close();
         try { fs.unlinkSync(dest); } catch (_) {}
-        download(res.headers.location, dest).then(resolve).catch(reject);
+        if (!res.headers.location) {
+          reject(new Error(`Redirect without Location header downloading ${url}`));
+          return;
+        }
+        let location;
+        try {
+          location = new URL(res.headers.location, url).toString();
+        } catch (err) {
+          reject(err);
+          return;
+        }
+        download(location, dest).then(resolve).catch(reject);
         return;
       }
       if (res.statusCode !== 200) {
@@ -69,6 +86,31 @@ function download(url, dest) {
   });
 }
 
+function sha256File(filePath) {
+  const hash = crypto.createHash('sha256');
+  const bytes = fs.readFileSync(filePath);
+  hash.update(bytes);
+  return hash.digest('hex');
+}
+
+function expectedSha256(archiveName) {
+  const entry = checksums[archiveName];
+  if (!entry || typeof entry.sha256 !== 'string') {
+    throw new Error(`Missing SHA-256 checksum for ${archiveName} in checksums.json`);
+  }
+  return entry.sha256;
+}
+
+function verifyChecksum(filePath, archiveName) {
+  const expected = expectedSha256(archiveName).toLowerCase();
+  const actual = sha256File(filePath).toLowerCase();
+  if (actual !== expected) {
+    throw new Error(
+      `Checksum mismatch for ${archiveName}: expected ${expected}, got ${actual}`
+    );
+  }
+}
+
 async function main() {
   const { artifact, ext, archive } = getPlatform();
   const archiveName = `${artifact}${archive}`;
@@ -87,6 +129,9 @@ async function main() {
   console.log(`            ${url}`);
   await download(url, tmpPath);
 
+  console.log('coven-code: verifying checksum...');
+  verifyChecksum(tmpPath, archiveName);
+
   console.log('coven-code: extracting...');
   if (archive === '.zip') {
     execFileSync('powershell', [

npm/package.json

@@ -31,6 +31,7 @@
   "files": [
     "bin/",
     "install.js",
+    "checksums.json",
     "README.md",
     "ATTRIBUTION.md"
   ],