[Virgile-pct]

Closes #288.

Original problem

Releases publish macOS arm64 and Linux x86_64/arm64 archives only, so mesh-llm plugins install capsules (and the recommended set in Mesh-LLM/mesh-llm#2978) finds nothing to install on Windows. The plugin itself already builds and passes its chain store, import and lock tests on windows-2025 in CI (rust-windows).

Fix

• release.yml: an x86_64-pc-windows-msvc build on windows-2025. The path remapping uses %USERPROFILE% there, since rustc sees Windows paths and Git Bash's $HOME is a /c/... path; the "no build-machine paths" check looks for the same prefixes with grep -a (Git for Windows ships no strings). The package job packages four targets, SHA256SUMS covers the .zip, and the attestation and release upload include it.
• scripts/package.sh: the Windows target ships capsules-<version>-x86_64-pc-windows-msvc.zip with capsules/capsules.exe, the archive mesh-llm resolves for a windows target (ArchiveExt::Zip in mesh-llm-plugin-manager/src/target.rs). Unix targets are unchanged. min_host_version is read back out of the .zip like out of the .tar.gz.
• The .zip is the counterpart of the tar flags, so it stays byte-for-byte reproducible: Info-ZIP zip -X -D -9 over the sorted file list, every mtime SOURCE_DATE_EPOCH (raised to 1980-01-01, the earliest a zip can hold) and TZ=UTC, since zip stores local time. unzip -p reads plugin.toml back. zip and unzip are on the Ubuntu runner images.
• ci.yml: the reproducibility job also packages the Windows target twice and compares the two .zip files.
• README and INSTALL.md: Windows x86_64 in the platform list, and the PowerShell download, checksum and install steps.

Validation

On Windows 11 (a laptop), at this branch:

• cargo build --locked --release --bin capsules builds, and the executable's --print-package-manifest equals plugin.package.json.
• A .zip of that executable, laid out as package.sh stages it (the web UI bundle replaced by a stand-in file, no pnpm here), installs with mesh-llm plugins install --archive capsules-0.1.18-x86_64-pc-windows-msvc.zip --name capsules --version 0.1.18 (mesh-llm 0.78.0, plugin directory isolated with MESH_LLM_PLUGIN_DIR), and plugins list shows it enabled with capsules\capsules.exe as its command.
• The same build with the Windows remapping from release.yml (%USERPROFILE%, the checkout path) leaves 0 matches of either prefix in the executable, against 1171 without it; grep then exits 1, so the check step passes.
• sh -n passes on package.sh, and both workflows parse as YAML.

Not run here: the release workflow itself (it runs on a tag) and package.sh end to end (no jq, GNU tar or zip on this machine); the package (reproducible) CI job runs the .zip path twice on Linux and compares the two archives.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2ec29e40-9333-4af6-a4f3-395581133519

Pre-merge checks: 1 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Title check		This assessment has not completed. The check will be retried on the next pre-merge check run.

Passed checks: 1 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[StevenMih]

Thanks @Virgile-pct, the Windows packaging reads right to me: the matrix entry, the .exe/.zip paths, the read-back of min_host_version, SHA256SUMS at 4 lines, and the reproducibility check packaging the zip twice.

One blocker from CI: scripts/no-keys.sh fails on scripts/zip-deterministic.py (excluded file (python-file)). This repository doesn't track Python at all, so the deterministic zip needs another tool. A small Rust bin or test helper in the workspace would keep it on the pinned toolchain, or a shell zip with fixed -X, sorted entries and TZ=UTC mtimes. The python3 -c zipfile read-back in package.sh and ci.yml would need the same swap (unzip -p works). Everything else is green.

[Virgile-pct]

Thanks, fixed in b27e895: the zip is now Info-ZIP zip -X -D -9 over the sorted file list, with mtimes set to SOURCE_DATE_EPOCH and TZ=UTC, and unzip -p / unzip -Z1 for the read-back and the CI listing. The Python script is gone.