From fa54c5ee4e30c78a5324d7512f72e9a7d5576bee Mon Sep 17 00:00:00 2001
From: Shaun Arman <shaun.arman@motorolasolutions.com>
Date: Thu, 18 Jun 2026 21:07:29 -0500
Subject: [PATCH 1/3] fix(ci): install libsodium-dev in build jobs instead of
 using SODIUM_LIB_DIR hacks

---
 .gitea/workflows/auto-tag.yml | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/auto-tag.yml b/.gitea/workflows/auto-tag.yml
index 2fc26ed6..74ceada5 100644
--- a/.gitea/workflows/auto-tag.yml
+++ b/.gitea/workflows/auto-tag.yml
@@ -341,13 +341,15 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           APPIMAGE_EXTRACT_AND_RUN: "1"
-          SODIUM_LIB_DIR: /usr/lib/x86_64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-unknown-linux-gnu
+          CI=true npx tauri build --target x86_64-unknown-linux-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -437,6 +439,9 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           CC_x86_64_pc_windows_gnu: x86_64-w64-mingw32-gcc
@@ -445,10 +450,9 @@ jobs:
           CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: x86_64-w64-mingw32-gcc
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
-          SODIUM_LIB_DIR: /usr/x86_64-w64-mingw32/lib
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-pc-windows-gnu
+          CI=true npx tauri build --target x86_64-pc-windows-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -622,6 +626,9 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config libssl-dev
       - name: Build
         env:
           CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
@@ -634,10 +641,9 @@ jobs:
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
           APPIMAGE_EXTRACT_AND_RUN: "1"
-          SODIUM_LIB_DIR: /usr/lib/aarch64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
+          CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-- 
2.45.2


From 10fefe30889c49a456d087eafb7eebdd35abd81c Mon Sep 17 00:00:00 2001
From: Shaun Arman <shaun.arman@motorolasolutions.com>
Date: Thu, 18 Jun 2026 21:09:39 -0500
Subject: [PATCH 2/3] fix(ci): install libsodium-dev in release-beta build jobs

---
 .gitea/workflows/release-beta.yml | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/.gitea/workflows/release-beta.yml b/.gitea/workflows/release-beta.yml
index c63e68a0..0e6c7355 100644
--- a/.gitea/workflows/release-beta.yml
+++ b/.gitea/workflows/release-beta.yml
@@ -221,13 +221,15 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           APPIMAGE_EXTRACT_AND_RUN: "1"
-          SODIUM_LIB_DIR: /usr/lib/x86_64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-unknown-linux-gnu
+          CI=true npx tauri build --target x86_64-unknown-linux-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -310,6 +312,9 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config
       - name: Build
         env:
           CC_x86_64_pc_windows_gnu: x86_64-w64-mingw32-gcc
@@ -318,11 +323,9 @@ jobs:
           CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: x86_64-w64-mingw32-gcc
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
-          SODIUM_LIB_DIR: /usr/x86_64-w64-mingw32/lib
-          SODIUM_STATIC: "1"
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target x86_64-pc-windows-gnu
+          CI=true npx tauri build --target x86_64-pc-windows-gnu
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -482,6 +485,9 @@ jobs:
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-npm-
+      - name: Install libsodium
+        run: |
+          apt-get update && apt-get install -y libsodium-dev pkg-config libssl-dev
       - name: Build
         env:
           CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
@@ -494,10 +500,9 @@ jobs:
           OPENSSL_NO_VENDOR: "0"
           OPENSSL_STATIC: "1"
           APPIMAGE_EXTRACT_AND_RUN: "1"
-          SODIUM_LIB_DIR: /usr/lib/aarch64-linux-gnu
         run: |
           npm ci --legacy-peer-deps
-          env -u SODIUM_USE_PKG_CONFIG CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
+          CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
       - name: Upload artifacts
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-- 
2.45.2


From 0c774b6756815b41ec0227ef0a774cf937b3362a Mon Sep 17 00:00:00 2001
From: Shaun Arman <shaun.arman@motorolasolutions.com>
Date: Thu, 18 Jun 2026 21:33:02 -0500
Subject: [PATCH 3/3] refactor(pr-review): switch from deprecated
 qwen3-coder-next to qwen3.5-122b-think

---
 .gitea/workflows/pr-review.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/pr-review.yml b/.gitea/workflows/pr-review.yml
index ccb8fa5c..7cc76c5a 100644
--- a/.gitea/workflows/pr-review.yml
+++ b/.gitea/workflows/pr-review.yml
@@ -285,7 +285,7 @@ jobs:
 
           # Write body to file — passing 100KB+ JSON as a shell arg hits ARG_MAX.
           jq -cn \
-            --arg model "qwen3-coder-next" \
+            --arg model "qwen3.5-122b-think" \
             --rawfile content /tmp/prompt.txt \
             '{model: $model, messages: [{role: "user", content: $content}], stream: false}' \
             > /tmp/body.json
@@ -402,7 +402,7 @@ jobs:
           if [ -f "/tmp/pr_review.txt" ] && [ -s "/tmp/pr_review.txt" ]; then
             REVIEW_BODY=$(head -c 65536 /tmp/pr_review.txt)
             BODY=$(jq -n \
-              --arg body "Automated PR Review (qwen3-coder-next via liteLLM):\n\n${REVIEW_BODY}" \
+              --arg body "Automated PR Review (qwen3.5-122b-think via liteLLM):\n\n${REVIEW_BODY}" \
               '{body: $body, event: "COMMENT"}')
           else
             BODY=$(jq -n \
-- 
2.45.2