Merge pull request 'fix(windows): link memset_shim object directly and suppress dead_code warning' (#120) from fix/cargo-config-sodium into beta

Reviewed-on: #120

.gitea/workflows/auto-tag.yml

@@ -341,13 +341,15 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           APPIMAGE_EXTRACT_AND_RUN: "1"
-          SODIUM_LIB_DIR: /usr/lib/x86_64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-unknown-linux-gnu
+          CI=true npx tauri build --target x86_64-unknown-linux-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -437,6 +439,9 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           CC_x86_64_pc_windows_gnu: x86_64-w64-mingw32-gcc
@@ -445,10 +450,9 @@ jobs:
           CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: x86_64-w64-mingw32-gcc
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
-          SODIUM_LIB_DIR: /usr/x86_64-w64-mingw32/lib
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-pc-windows-gnu
+          CI=true npx tauri build --target x86_64-pc-windows-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -622,6 +626,9 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config libssl-dev
       - name: Build
         env:
           CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
@@ -634,10 +641,9 @@ jobs:
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
           APPIMAGE_EXTRACT_AND_RUN: "1"
-          SODIUM_LIB_DIR: /usr/lib/aarch64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
+          CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}

.gitea/workflows/pr-review.yml

@@ -285,7 +285,7 @@ jobs:
 
           # Write body to file — passing 100KB+ JSON as a shell arg hits ARG_MAX.
           jq -cn \
-            --arg model "qwen3-coder-next" \
+            --arg model "qwen3.5-122b-think" \
             --rawfile content /tmp/prompt.txt \
             '{model: $model, messages: [{role: "user", content: $content}], stream: false}' \
             > /tmp/body.json
@@ -402,7 +402,7 @@ jobs:
           if [ -f "/tmp/pr_review.txt" ] && [ -s "/tmp/pr_review.txt" ]; then
             REVIEW_BODY=$(head -c 65536 /tmp/pr_review.txt)
             BODY=$(jq -n \
-              --arg body "Automated PR Review (qwen3-coder-next via liteLLM):\n\n${REVIEW_BODY}" \
+              --arg body "Automated PR Review (qwen3.5-122b-think via liteLLM):\n\n${REVIEW_BODY}" \
               '{body: $body, event: "COMMENT"}')
           else
             BODY=$(jq -n \

.gitea/workflows/release-beta.yml

@@ -221,13 +221,15 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           APPIMAGE_EXTRACT_AND_RUN: "1"
-          SODIUM_LIB_DIR: /usr/lib/x86_64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-unknown-linux-gnu
+          CI=true npx tauri build --target x86_64-unknown-linux-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -310,6 +312,9 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           CC_x86_64_pc_windows_gnu: x86_64-w64-mingw32-gcc
@@ -318,11 +323,9 @@ jobs:
           CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: x86_64-w64-mingw32-gcc
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
-          SODIUM_LIB_DIR: /usr/x86_64-w64-mingw32/lib
-          SODIUM_STATIC: "1"
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-pc-windows-gnu
+          CI=true npx tauri build --target x86_64-pc-windows-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -482,6 +485,9 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config libssl-dev
       - name: Build
         env:
           CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
@@ -494,10 +500,9 @@ jobs:
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
           APPIMAGE_EXTRACT_AND_RUN: "1"
-          SODIUM_LIB_DIR: /usr/lib/aarch64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
+          CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}

src-tauri/build.rs

@@ -6,13 +6,25 @@ fn main() {
     println!("cargo:rerun-if-changed=.git/refs/tags");
 
     // Compile memset_explicit shim for Windows MinGW
-    if std::env::var("CARGO_CFG_TARGET_OS").unwrap_or_default() == "windows"
-        && std::env::var("CARGO_CFG_TARGET_ENV").unwrap_or_default() == "gnu"
-    {
+    // libsodium-sys-stable uses memset_explicit which isn't available in MinGW
+    let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();
+    let target_env = std::env::var("CARGO_CFG_TARGET_ENV").unwrap_or_default();
+
+    if target_os == "windows" && target_env == "gnu" {
+        let out_dir = std::env::var("OUT_DIR").unwrap();
+        let obj_path = format!("{}/memset_shim.o", out_dir);
+
         cc::Build::new()
             .file("memset_s_shim.c")
+            .define("WIN32", None)
+            .define("__WIN32__", None)
+            .out_dir(&out_dir)
             .compile("memset_shim");
+
         println!("cargo:rerun-if-changed=memset_s_shim.c");
+        // Directly link the object file instead of using -l flag
+        // This ensures the symbol is available regardless of link order
+        println!("cargo:rustc-link-arg={}", obj_path);
     }
 
     tauri_build::build()

src-tauri/memset_s_shim.c

@@ -1,28 +1,33 @@
-// Shim for memset_explicit on MinGW which doesn't provide it
-// This is needed for libsodium's secure memory clearing
-
-#if defined(_WIN32) && defined(__MINGW32__)
+/* memset_explicit shim for Windows MinGW
+ *
+ * libsodium-sys-stable expects memset_explicit which isn't available
+ * in the MinGW runtime. This provides a compatible implementation.
+ *
+ * This shim is compiled as part of the build process when targeting
+ * Windows with MinGW (x86_64-w64-mingw32).
+ */
 
 #include <string.h>
+#include <stddef.h>
 
-// memset_explicit is available in Windows 8+ but MinGW headers don't always declare it
-// Provide a fallback implementation using SecureZeroMemory if available,
-// or a volatile memset to prevent compiler optimization
-void *memset_explicit(void *s, int c, size_t n) {
-    // Try to use Windows API if available
-    #ifdef _WIN32_WINNT
-        #if _WIN32_WINNT >= 0x0602  // Windows 8+
-            extern void *memset_s(void *, size_t, int, size_t);
-            return memset_s(s, n, c, n);
-        #endif
-    #endif
-
-    // Fallback: use volatile to prevent optimization
-    volatile unsigned char *p = (volatile unsigned char *)s;
-    while (n--) {
-        *p++ = (unsigned char)c;
-    }
-    return s;
-}
-
+/* 
+ * Windows symbol export macros.
+ * __declspec(dllexport) ensures the symbol is visible in the compiled object.
+ */
+#if defined(_WIN32) || defined(__WIN32__) || defined(__MINGW32__)
+    #define EXPORT __declspec(dllexport)
+#else
+    #define EXPORT __attribute__((visibility("default")))
 #endif
+
+/*
+ * memset_explicit implementation - a secure memory clearing function.
+ * Uses volatile to prevent compiler optimization from removing the memset.
+ * This matches the signature expected by libsodium.
+ */
+EXPORT void memset_explicit(void *dest, int val, size_t n) {
+    volatile unsigned char *p = (volatile unsigned char *)dest;
+    while (n--) {
+        *p++ = (unsigned char)val;
+    }
+}

src-tauri/src/memset_shim.rs

@@ -0,0 +1,13 @@
+/// Windows MinGW memset_explicit shim
+/// libsodium-sys-stable expects memset_explicit which isn't available in MinGW
+/// This provides a compatible implementation
+
+#[cfg(target_os = "windows")]
+#[no_mangle]
+pub extern "C" fn memset_explicit(dest: *mut u8, val: i32, n: usize) {
+    unsafe {
+        for i in 0..n {
+            *dest.add(i) = val as u8;
+        }
+    }
+}

src-tauri/src/ollama/installer.rs

@@ -52,6 +52,7 @@ pub async fn check_ollama() -> anyhow::Result<OllamaStatus> {
 }
 
 /// Find the full path to the ollama binary
+#[allow(dead_code)]
 fn find_ollama_binary() -> Option<std::path::PathBuf> {
     // Try which/where command first
     let which_cmd = if cfg!(target_os = "windows") {