fix(build): remove SODIUM_USE_PKG_CONFIG from .cargo/config.toml [env] block

Cargo injects [env] entries directly into build script environments,
bypassing shell-level unset and env -u entirely. SODIUM_USE_PKG_CONFIG
was set to "0" in [env], which libsodium-sys-stable build.rs treats as
"pkg-config enabled" (env::var().is_ok() returns true for any value
including "0"). Combined with SODIUM_LIB_DIR set in the workflow, this
triggered the incompatibility panic on every build.

The original comment claiming this "avoids memset_explicit on Windows"
was incorrect — SODIUM_USE_PKG_CONFIG controls detection strategy, not
link behaviour. The actual Windows memset_explicit fix is handled via
SODIUM_LIB_DIR pointing to pre-built MinGW sodium.

.gitea/workflows/auto-tag.yml

@@ -341,15 +341,13 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
-      - name: Install libsodium
-        run: |
-          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           APPIMAGE_EXTRACT_AND_RUN: "1"
+          SODIUM_LIB_DIR: /usr/lib/x86_64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          CI=true npx tauri build --target x86_64-unknown-linux-gnu
+          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-unknown-linux-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -439,9 +437,6 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
-      - name: Install libsodium
-        run: |
-          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           CC_x86_64_pc_windows_gnu: x86_64-w64-mingw32-gcc
@@ -450,9 +445,10 @@ jobs:
           CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: x86_64-w64-mingw32-gcc
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
+          SODIUM_LIB_DIR: /usr/x86_64-w64-mingw32/lib
         run: |
           npm ci --legacy-peer-deps
-          CI=true npx tauri build --target x86_64-pc-windows-gnu
+          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-pc-windows-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -626,9 +622,6 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
-      - name: Install libsodium
-        run: |
-          apt-get update && apt-get install -y libsodium-dev pkg-config libssl-dev
       - name: Build
         env:
           CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
@@ -641,9 +634,10 @@ jobs:
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
           APPIMAGE_EXTRACT_AND_RUN: "1"
+          SODIUM_LIB_DIR: /usr/lib/aarch64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
+          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}

.gitea/workflows/pr-review.yml

@@ -285,7 +285,7 @@ jobs:
 
           # Write body to file — passing 100KB+ JSON as a shell arg hits ARG_MAX.
           jq -cn \
-            --arg model "qwen3.5-122b-think" \
+            --arg model "qwen3-coder-next" \
             --rawfile content /tmp/prompt.txt \
             '{model: $model, messages: [{role: "user", content: $content}], stream: false}' \
             > /tmp/body.json
@@ -402,7 +402,7 @@ jobs:
           if [ -f "/tmp/pr_review.txt" ] && [ -s "/tmp/pr_review.txt" ]; then
             REVIEW_BODY=$(head -c 65536 /tmp/pr_review.txt)
             BODY=$(jq -n \
-              --arg body "Automated PR Review (qwen3.5-122b-think via liteLLM):\n\n${REVIEW_BODY}" \
+              --arg body "Automated PR Review (qwen3-coder-next via liteLLM):\n\n${REVIEW_BODY}" \
               '{body: $body, event: "COMMENT"}')
           else
             BODY=$(jq -n \

.gitea/workflows/release-beta.yml

@@ -221,15 +221,13 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
-      - name: Install libsodium
-        run: |
-          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           APPIMAGE_EXTRACT_AND_RUN: "1"
+          SODIUM_LIB_DIR: /usr/lib/x86_64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          CI=true npx tauri build --target x86_64-unknown-linux-gnu
+          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-unknown-linux-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -312,9 +310,6 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
-      - name: Install libsodium
-        run: |
-          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           CC_x86_64_pc_windows_gnu: x86_64-w64-mingw32-gcc
@@ -323,9 +318,11 @@ jobs:
           CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: x86_64-w64-mingw32-gcc
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
+          SODIUM_LIB_DIR: /usr/x86_64-w64-mingw32/lib
+          SODIUM_STATIC: "1"
         run: |
           npm ci --legacy-peer-deps
-          CI=true npx tauri build --target x86_64-pc-windows-gnu
+          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-pc-windows-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -485,9 +482,6 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
-      - name: Install libsodium
-        run: |
-          apt-get update && apt-get install -y libsodium-dev pkg-config libssl-dev
       - name: Build
         env:
           CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
@@ -500,9 +494,10 @@ jobs:
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
           APPIMAGE_EXTRACT_AND_RUN: "1"
+          SODIUM_LIB_DIR: /usr/lib/aarch64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
+          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}

src-tauri/build.rs

@@ -6,25 +6,13 @@ fn main() {
     println!("cargo:rerun-if-changed=.git/refs/tags");
 
     // Compile memset_explicit shim for Windows MinGW
-    // libsodium-sys-stable uses memset_explicit which isn't available in MinGW
-    let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();
-    let target_env = std::env::var("CARGO_CFG_TARGET_ENV").unwrap_or_default();
-
-    if target_os == "windows" && target_env == "gnu" {
-        let out_dir = std::env::var("OUT_DIR").unwrap();
-        let obj_path = format!("{}/memset_shim.o", out_dir);
-
+    if std::env::var("CARGO_CFG_TARGET_OS").unwrap_or_default() == "windows"
+        && std::env::var("CARGO_CFG_TARGET_ENV").unwrap_or_default() == "gnu"
+    {
         cc::Build::new()
             .file("memset_s_shim.c")
-            .define("WIN32", None)
-            .define("__WIN32__", None)
-            .out_dir(&out_dir)
             .compile("memset_shim");
-
         println!("cargo:rerun-if-changed=memset_s_shim.c");
-        // Directly link the object file instead of using -l flag
-        // This ensures the symbol is available regardless of link order
-        println!("cargo:rustc-link-arg={}", obj_path);
     }
 
     tauri_build::build()

src-tauri/memset_s_shim.c

@@ -1,33 +1,28 @@
-/* memset_explicit shim for Windows MinGW
- *
- * libsodium-sys-stable expects memset_explicit which isn't available
- * in the MinGW runtime. This provides a compatible implementation.
- *
- * This shim is compiled as part of the build process when targeting
- * Windows with MinGW (x86_64-w64-mingw32).
- */
+// Shim for memset_explicit on MinGW which doesn't provide it
+// This is needed for libsodium's secure memory clearing
+
+#if defined(_WIN32) && defined(__MINGW32__)
 
 #include <string.h>
-#include <stddef.h>
 
-/* 
- * Windows symbol export macros.
- * __declspec(dllexport) ensures the symbol is visible in the compiled object.
- */
-#if defined(_WIN32) || defined(__WIN32__) || defined(__MINGW32__)
-    #define EXPORT __declspec(dllexport)
-#else
-    #define EXPORT __attribute__((visibility("default")))
-#endif
+// memset_explicit is available in Windows 8+ but MinGW headers don't always declare it
+// Provide a fallback implementation using SecureZeroMemory if available,
+// or a volatile memset to prevent compiler optimization
+void *memset_explicit(void *s, int c, size_t n) {
+    // Try to use Windows API if available
+    #ifdef _WIN32_WINNT
+        #if _WIN32_WINNT >= 0x0602  // Windows 8+
+            extern void *memset_s(void *, size_t, int, size_t);
+            return memset_s(s, n, c, n);
+        #endif
+    #endif
 
-/*
- * memset_explicit implementation - a secure memory clearing function.
- * Uses volatile to prevent compiler optimization from removing the memset.
- * This matches the signature expected by libsodium.
- */
-EXPORT void memset_explicit(void *dest, int val, size_t n) {
-    volatile unsigned char *p = (volatile unsigned char *)dest;
+    // Fallback: use volatile to prevent optimization
+    volatile unsigned char *p = (volatile unsigned char *)s;
     while (n--) {
-        *p++ = (unsigned char)val;
+        *p++ = (unsigned char)c;
     }
+    return s;
 }
+
+#endif

src-tauri/src/memset_shim.rs

@@ -1,13 +0,0 @@
-/// Windows MinGW memset_explicit shim
-/// libsodium-sys-stable expects memset_explicit which isn't available in MinGW
-/// This provides a compatible implementation
-
-#[cfg(target_os = "windows")]
-#[no_mangle]
-pub extern "C" fn memset_explicit(dest: *mut u8, val: i32, n: usize) {
-    unsafe {
-        for i in 0..n {
-            *dest.add(i) = val as u8;
-        }
-    }
-}

src-tauri/src/ollama/installer.rs

@@ -52,7 +52,6 @@ pub async fn check_ollama() -> anyhow::Result<OllamaStatus> {
 }
 
 /// Find the full path to the ollama binary
-#[allow(dead_code)]
 fn find_ollama_binary() -> Option<std::path::PathBuf> {
     // Try which/where command first
     let which_cmd = if cfg!(target_os = "windows") {