feat(platform): add Windows support

.cargo/config.toml

@@ -0,0 +1,3 @@
+[env]
+"CMAKE_PROJECT_llama.cpp_INCLUDE" = { value = "scripts/cmake/windows-llama.cmake", relative = true, force = true }
+"CMAKE_GENERATOR_x86_64-pc-windows-msvc" = { value = "Ninja", force = true }

.github/workflows/ci.yml

@@ -5,16 +5,21 @@ on:
     branches: [master, main]
   pull_request:
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
   rustfmt:
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-06-30)
         with:
           components: rustfmt
 
@@ -24,13 +29,15 @@ jobs:
   clippy:
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-06-30)
         with:
           components: clippy
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           workspaces: src-tauri
 
@@ -40,11 +47,13 @@ jobs:
   cargo-test:
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-06-30)
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           workspaces: src-tauri
 
@@ -54,20 +63,20 @@ jobs:
   frontend-build:
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v7
-
-      - uses: pnpm/action-setup@v6.0.9
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          version: 10
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: pnpm
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-06-30)
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           workspaces: src-tauri
 
@@ -90,20 +99,20 @@ jobs:
   frontend-test:
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v7
-
-      - uses: pnpm/action-setup@v6.0.9
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          version: 10
+          persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: pnpm
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-06-30)
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           workspaces: src-tauri
 
@@ -115,3 +124,137 @@ jobs:
 
       - name: vitest
         run: pnpm test
+
+  windows:
+    name: Windows x86_64 gates and NSIS smoke
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-06-30)
+        with:
+          components: clippy,rustfmt
+          targets: x86_64-pc-windows-msvc
+
+      - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
+
+      - name: Install Vulkan SDK
+        uses: humbletim/install-vulkan-sdk@30ba978f977e81b72d091fc8888feb1fb26f9aff # v1.2
+        with:
+          version: 1.3.296.0
+          cache: true
+
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          workspaces: src-tauri
+
+      - name: Verify native build tools
+        shell: pwsh
+        run: |
+          ninja --version
+          if ([string]::IsNullOrWhiteSpace($env:VULKAN_SDK)) {
+            throw "VULKAN_SDK was not configured"
+          }
+          $vulkanCmakePrefix = Join-Path $env:VULKAN_SDK "Lib\cmake"
+          $spirvHeadersConfig = Join-Path $vulkanCmakePrefix "SPIRV-HeadersConfig.cmake"
+          if (-not (Test-Path -LiteralPath $spirvHeadersConfig -PathType Leaf)) {
+            throw "Vulkan SDK is missing SPIRV-HeadersConfig.cmake: $spirvHeadersConfig"
+          }
+          $cmakePrefixPath = if ([string]::IsNullOrWhiteSpace($env:CMAKE_PREFIX_PATH)) {
+            $vulkanCmakePrefix
+          } else {
+            "$vulkanCmakePrefix;$env:CMAKE_PREFIX_PATH"
+          }
+          Add-Content -LiteralPath $env:GITHUB_ENV -Encoding utf8 `
+            -Value "CMAKE_PREFIX_PATH=$cmakePrefixPath"
+          & (Join-Path $env:VULKAN_SDK "Bin\glslc.exe") --version
+          $sevenZip = Join-Path $env:ProgramFiles "7-Zip\7z.exe"
+          if (-not (Test-Path -LiteralPath $sevenZip -PathType Leaf)) {
+            throw "Full 7-Zip is required for NSIS payload verification"
+          }
+          $sevenZipInfo = & $sevenZip i
+          if ($LASTEXITCODE -ne 0 -or -not ($sevenZipInfo | Select-String -SimpleMatch "Nsis")) {
+            throw "7-Zip does not support NSIS extraction"
+          }
+          $sevenZipInfo | Select-String -Pattern "7-Zip|Nsis"
+
+      - name: Install frontend deps
+        run: pnpm install --frozen-lockfile
+
+      - name: rustfmt
+        run: cargo fmt --check --manifest-path src-tauri/Cargo.toml
+
+      - name: Rust no-default-features check
+        run: cargo check --manifest-path src-tauri/Cargo.toml --no-default-features
+
+      - name: Rust no-default-features clippy
+        run: cargo clippy --manifest-path src-tauri/Cargo.toml --no-default-features -- -D warnings
+
+      - name: Rust no-default-features test
+        run: cargo test --manifest-path src-tauri/Cargo.toml --no-default-features
+
+      - name: Rust default check (CPU and Vulkan)
+        run: cargo check --manifest-path src-tauri/Cargo.toml
+
+      - name: Rust default clippy (CPU and Vulkan)
+        run: cargo clippy --manifest-path src-tauri/Cargo.toml -- -D warnings
+
+      - name: Rust default test (CPU and Vulkan)
+        run: cargo test --manifest-path src-tauri/Cargo.toml
+
+      - name: Generate IPC bindings
+        run: pnpm gen:ipc
+
+      - name: Frontend build
+        run: pnpm build
+
+      - name: Frontend test
+        run: pnpm test
+
+      - name: Release metadata tests
+        run: pnpm test:release-metadata
+
+      - name: Build unsigned non-release NSIS smoke installer
+        shell: pwsh
+        run: |
+          pnpm tauri build --no-bundle --ci
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+          $config = @{ bundle = @{ createUpdaterArtifacts = $false } } |
+            ConvertTo-Json -Depth 8 -Compress
+          $configPath = Join-Path $env:RUNNER_TEMP "tauri-ci.json"
+          [IO.File]::WriteAllText(
+            $configPath,
+            $config,
+            [Text.UTF8Encoding]::new($false)
+          )
+          pnpm tauri bundle --bundles nsis --ci `
+            --config src-tauri/tauri.windows.bundle.conf.json `
+            --config $configPath
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+          $bundleDir = [IO.Path]::GetFullPath("src-tauri/target/release/bundle/nsis")
+          $installer = Get-ChildItem -LiteralPath $bundleDir -Filter "*.exe" -File |
+            Select-Object -First 1
+          if (-not $installer) { throw "NSIS smoke installer was not produced" }
+          $unexpectedUpdaterArtifacts = @(
+            Get-ChildItem -LiteralPath $bundleDir -Filter "*.nsis.zip" -File
+            Get-ChildItem -LiteralPath $bundleDir -Filter "*.exe.sig" -File
+          )
+          if ($unexpectedUpdaterArtifacts.Count -gt 0) {
+            throw "Non-release smoke build unexpectedly produced updater artifacts"
+          }
+          Write-Host "NSIS smoke installer: $($installer.Name) ($($installer.Length) bytes)"
+
+      - name: Verify NSIS payload and PE dependency closure
+        shell: pwsh
+        run: ./scripts/verify-windows-bundle.ps1 -RequireInstallerExtraction