chore: bump Cargo.toml and sandbox image to 0.10.0

bump: version 0.9.0 → 0.10.0 [skip ci]
docs: reset changelog
2026-08-29 05:49:07 +00:00 · 2026-08-29 05:49:04 +00:00 · 2026-08-28 23:48:33 -06:00 · 2026-08-28 23:46:14 -06:00 · 2026-08-28 23:04:35 -06:00 · 2026-08-28 22:49:58 -06:00
11 changed files with 767 additions and 379 deletions
@@ -166,6 +166,9 @@ jobs:
            os: ubuntu-latest
            use-cross: true
            cargo-flags: ''
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-24.04-arm
+            cargo-flags: ''
          - target: aarch64-apple-darwin
            os: macos-latest
            use-cross: true
@@ -253,7 +256,7 @@ jobs:
        run: echo "BUILD_CMD=cross" >> $GITHUB_ENV

      - name: Install latest LLVM/Clang
-        if: matrix.os == 'ubuntu-latest'
+        if: startsWith(matrix.os, 'ubuntu')
        run: |
          wget https://apt.llvm.org/llvm.sh
          chmod +x llvm.sh
@@ -1,3 +1,196 @@
+## v0.10.0 (2026-08-29)
+
+### BREAKING CHANGE
+
+- invocations using --prompt <text> must switch to
+--temp-role <text>; clap rejects the old flag loudly.
+
+### Feat
+
+- Support Linux ARM64 GNU
+- Note that duckdb RAG driver is unavailable on MUSL Linux builds when initializing a RAG so users know when using the binary, not just based on docs
+- updated coyote installation scripts to detect when gnu is installable
+- upgraded to v2 mixin schema
+- improved first-time run experience and included a templated configuration file that now has comments like the config.example.yaml so users don't have to go to the repo to see all the knobs
+- **TASK-005**: carry the quality bar through sisyphus and architect
+- **TASK-004**: reviewer routing — code-reviewer quality-bar resolution, domain linter pass, surface-skill routing, rigor folding; file-reviewer surface-skill whitelist + convention/correctness marker
+- **TASK-003**: add surface skills batch B — worker-review, iac-review, migration-review, cicd-review
+- **TASK-002**: add surface skills batch A — rest-api-review, cli-review, library-review
+- **TASK-001**: add rigor/surfaces declaration layer to planning skills
+- **repl**: color .info mcp-server verdicts and complete only running servers
+- **cli**: rename mcp_config asset category to mcp-config with snake_case alias
+- create a new probe agent to probe code verifications using usage-pattern testing
+- Add in the web_search_coyote tool where helpful
+- **mcp**: add .info mcp-server, .set mcp_tools, and filtered-server listing to the REPL
+- **mcp**: enforce per-server tool allowlists across runtime, jobs, agents, and graph nodes
+- **mcp**: add mcp_tools allowlist config surfaces across roles, sessions, agents, graphs, and skills
+- **mcp**: add per-server tool allowlist policy module and allowedTools config field
+- support mcp.json in the root of bundle repos as well as in the legacy functions directory
+- prefer ~/.config/coyote/mcp.json for the user-scope MCP config
+- claude and openai native web search via web_search_coyote
+- **jobs**: node-local job ownership and capability-gated job__* visibility
+- **graph**: support max_concurrent_jobs at the graph level
+- **jobs**: allow uncapped collect via full_result
+- **jobs**: exempt polling tools from loop tracker and hint on unchanged checks
+- **supervisor**: push agent completion notifications to the spawning context
+- **jobs**: push background-job completion notifications via per-context queue
+- inject background-jobs prompt guidance when jobs are enabled
+- add background job runner, job__* handlers, and start gates
+- generalize supervisor registry to TaskHandle enum with job scaffolding, kill discipline, and max_concurrent_jobs config
+- run an advisory observability pass after implementation in sisyphus
+- add an observability-review skill for post-implementation monitoring analysis
+- check under- and over-logging in the code review gate
+- calibrate logging registers in the code-writing agents
+- add a logging-discipline skill for calibrating log output to repo conventions
+- **cli**: rename --prompt to --temp-role
+- complete --filter and --force on the first .install argument
+- **mcp**: bound tool-result passthrough and surface resource audience annotations
+- **mcp**: add mcp_prompt meta-tool and harden prompt display rendering
+- **repl**: add .prompt command with live staged tab-completion
+- **mcp**: add mcp_read meta-tool for resource reads
+- **mcp**: gate meta-function emission on advertised server capabilities
+- **mcp**: add render.rs content policy (text paging, pattern filter, blob spill)
+- **mcp**: extend the server catalog to resources, templates, and prompts
+- complete --filter and --force on the first .install argument
+- run design interviews as grilling frontier rounds across the planning agents
+- add a grilling skill for frontier-round design interviews
+- add an on-demand architecture-reviewer agent for deepening scans
+- add a codebase-design skill with the deep-module design vocabulary
+- add a feedback-loop-first diagnosing-bugs skill to the coding suite
+- add a Fowler code-smell baseline to the code-review skill
+- flag duplicate helpers in code reviews with a repo-wide DRY check
+- add a transactional-integrity review skill to the code review gate
+- add an operational-history prior-art lane to the code-reviewer agent
+- support name=value macro arguments with variable tab completion
+- add --help guides to the .install and .uninstall REPL commands
+- expand owner/repo shorthand for --install with a --git-host flag
+- remove the deprecated --install-from flag and .install remote form
+- rename install flags and unify .install dispatch
+- add --uninstall and .uninstall for installed bundles
+- add --update-bundle with provenance-aware conflict handling
+- add --list-bundles and .list bundles with drift detection
+- record bundle provenance when installing from remote repos
+- add bundle provenance store
+- parse bundle manifests and capture resolved SHAs for remote installs
+- created a new comment-discipline skill for the built in sisyphus suite
+- created a dedicated git_command tool to tighten tool calling permissions in the git-master skill
+- Added a new security review step to the code writing quality gates
+- addressed review comments
+- add --no-workspace-macros opt-out for workspace macro loading
+- execute non-isolated macros on the live REPL context
+- surface macros as first-class custom commands in the REPL
+- add lazy macro resolver with two-dir discovery and per-macro states
+- add enabled_macros config field at global, role, agent, and session levels
+- add description and isolated fields to Macro struct
+- Dynamically detect RAG embedding model dimension for any given model
+- Support auto confirmation for gatekeeper agents
+- retry LLM API calls once after 401 by force-refreshing the OAuth token
+- identity-aware rejected-token marker for LLM OAuth cache
+- typed ApiStatusError carrying HTTP status through LLM client errors
+- per-request OAuth token injection with mid-session refresh for HTTP MCP servers
+- reason-specific warnings for MCP servers that fail OAuth at startup
+- Installed duckdb into the coyote image
+- Support managing MCP servers from the CLI directly
+- append new built-in rag__query function to RAG contexts to allow further querying by LLMs
+- support static file bundling with sbx-mixins
+- **rag**: offer the storage driver when an agent initializes its RAG
+- simplified the duckdb selection prompt
+- **rag**: let several Coyote processes query one duckdb RAG at once
+- **rag**: support string and UUID Qdrant point IDs
+- **rag**: create the API key secret inline in the attach wizard
+- let workflow rag nodes select a RAG driver
+- improved wording and heuristic detection for sisyphus suite of agents
+- upgraded to sbx kit v2 spec for improved integration
+- **rag**: add attach-only Qdrant provider, attach wizard and sandbox wiring
+- **rag**: add DuckDB provider behind the RAG driver abstraction
+- **rag**: add driver/attached fields, validation floors and force-reingest
+- **mcp**: send RFC 8707 resource indicator in OAuth flows
+- Added loaded indicators to .list tools/mcp-servers/skills
+- hide .recover from tab completions when no session is active
+- add a new .recover command for sessions to recover from errors
+- integrated the git-ssh-sign kit into the coyote sandbox kit
+
+### Fix
+
+- Harden install scripts: detect libssl3 without ldconfig on PATH, survive noexec tmp dirs, and guard against partial curl|bash execution
+- ldconfig on Debian-based distros lives in /usr/sbin
+- Prefer GNU linux builds in install scripts for duckdb support, and gate duckdb support on linux hosts that are MUSL until MUSL support is added
+- **mcp**: omit declared-but-empty prompt/resource capabilities from .info mcp-server
+- **mcp**: annotate declared-but-empty prompt/resource capabilities in .info mcp-server
+- also support the .continue edge case for session crashing checkpointing
+- checkpoint sessions that crash for easy resuming
+- job__check ring buffer also collects file output for LLM_OUTPUT as well as stdout
+- **tools**: interactive-shell semantics and stderr capture in execute_command
+- **function**: gate test-only declaration appender behind cfg(test)
+- **graph**: gate unix-only test imports behind cfg(unix)
+- harden job runner lifecycle and whitelist conformance
+- **function**: floor tool-output truncation cut to a UTF-8 char boundary
+- **supervisor**: make agent__check a pure status probe that never consumes the handle
+- **supervisor**: surface finished-but-uncollected tasks in turn-end guardrail
+- fix grep "binary" errors when searching UTF-8 files with unicode characters like some of the Coyote source
+- **bundles**: harden the install pipeline for cross-platform correctness
+- **mcp**: harden the spill path for cross-platform correctness
+- **repl**: offer prompts in .list tab completion and rename its listing helpers
+- **mcp**: gate unix-only spill permission APIs for windows builds
+- harden the bundle lifecycle per code review
+- address code review findings on the bundle lifecycle
+- reserve category names, confirm fork-name collisions, report secrets on uninstall
+- make bundle provenance portable to Windows
+- user__ask should have been renamed to user__select in graph agent user interaction invocations
+- support tab completions for graph-based agents with variables as well as standard agents
+- surface macro parse errors on top-level invocation
+- render .list macros as a comfy-table instead of fixed-width columns
+- drain crossterm characters in zellij in kitty contexts to prevent DA1 responses from entering prompt
+- drain tty input when displaying inquire prompts to prevent unintentional escapes
+- breaking iwe MCP server changes with newest version
+- improved handling of non service-specific secrets using sbx custom-secrets
+- include tool output to LLM_OUTPUT in errors as well as stderr
+- prevent tmp-overwriting
+- Corrected a rare edge case on how tool files are generated during parallel executions
+- cosmetic fix after improved bash tool handling
+- Improved subagent escalation handling
+- latent parsing bugs in fs_patch and argc
+- Prevent infinite hangs in coder agent and implement timeouts for LLM API calls and interactive tools
+- allow nested italics inside bold spans in markdown renderer
+- properly handle OAuth refreshes
+- correct newline removal from fs_write and fs_patch
+- detect duplicate tool call IDs client-side before sending to Claude
+- **rag**: warn when a duckdb store is empty but files are indexed
+- **rag**: keep a local Qdrant off an ambient proxy
+- keep loopback and LAN traffic off an ambient proxy
+- **rag**: stop routing Qdrant requests through an ambient proxy
+- **rag**: treat a zero min_score as no floor on Qdrant searches
+- **rag**: address Copilot review findings on the driver abstraction
+- **rag**: delete the DuckDB write-ahead log alongside the store
+- **sandbox**: discover agent-scoped RAG mixin sidecars
+- **rag**: stop the attach wizard from silently accepting an empty collection
+- **rag**: fail loudly when a RAG's vault secret is missing
+- **rag**: serialize DuckDB extension installs to stop a Windows race
+- **rag**: emit an sbx kit v2 mixin and declare RAG credentials to the proxy
+- **rag**: install DuckDB vss and fts extensions when they are missing
+- don't output thinking blocks for claude-based models
+- additional edge case fix for duplicate tool call IDs in anthropic API calls
+- removed temperature modifier in librarian agent to mitigate invisible errors
+- strip reasoning blocks for structured LLM output in graph agents
+- prevent rare duplicate tool call IDs in long running claude prompts
+- agents inherit global reasoning effort if unset
+
+### Refactor
+
+- **function**: finish supervisor-to-agent vocabulary migration
+- **function**: rename agent-tool symbols out of supervisor vocabulary
+- Modified the naming of several generalized supervisor values
+- pulled out some imports to clean up the MCP render module a bit
+- **mcp**: centralize meta-function prefix predicates and fix list_tools pagination
+- Refactored some bundle const locations
+- drop the .install remote migration hint
+- drop the --install-from tombstone entirely
+- render .list agents and .list skills as comfy-tables
+- **rag**: discover driver_config secrets by grammar, not field name
+- **rag**: drop the hardcoded embedding model hint from attach
+- **rag**: interpolate every driver_config value, not just api_key
+- **rag**: extract RagProvider trait and add YamlProvider
+
 ## v0.8.3 (2026-08-03)

 ### Fix
@@ -213,7 +213,7 @@ dependencies = [
 "convert_case 0.11.0",
 "dirs",
 "either",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "natord",
 "nom 8.0.0",
 "num_cpus",
@@ -451,7 +451,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -755,12 +755,12 @@ dependencies = [
 "aws-smithy-runtime-api",
 "aws-smithy-types",
 "h2 0.3.27",
- "h2 0.4.15",
+ "h2 0.4.19",
 "http 0.2.12",
 "http 1.5.0",
 "http-body 0.4.6",
 "hyper 0.14.32",
- "hyper 1.11.0",
+ "hyper 1.11.1",
 "hyper-rustls 0.24.2",
 "hyper-rustls 0.27.9",
 "hyper-util",
@@ -1040,7 +1040,7 @@ dependencies = [
 "addr2line",
 "cfg-if",
 "libc",
- "miniz_oxide",
+ "miniz_oxide 0.8.9",
 "object",
 "rustc-demangle",
 "windows-link",
@@ -1284,9 +1284,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"

 [[package]]
 name = "cc"
-version = "1.4.2"
+version = "1.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d262e149917187838d5b42777c8253bcb64500067342904e7d429499a6f277e"
+checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273"
 dependencies = [
 "find-msvc-tools",
 "jobserver",
@@ -1328,12 +1328,12 @@ dependencies = [

 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
 "cfg-if",
- "cpufeatures 0.3.0",
+ "cpufeatures 0.3.1",
 "rand_core 0.10.1",
 ]

@@ -1440,7 +1440,7 @@ dependencies = [
 "heck",
 "proc-macro2",
 "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -1490,9 +1490,9 @@ dependencies = [

 [[package]]
 name = "combine"
-version = "4.6.7"
+version = "4.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
 dependencies = [
 "bytes",
 "memchr",
@@ -1636,7 +1636,7 @@ dependencies = [
 "cookie",
 "document-features",
 "idna",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "log",
 "serde",
 "serde_derive",
@@ -1663,7 +1663,7 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"

 [[package]]
 name = "coyote-ai"
-version = "0.8.3"
+version = "0.10.0"
 dependencies = [
 "ansi_colours",
 "anyhow",
@@ -1699,7 +1699,7 @@ dependencies = [
 "hnsw_rs",
 "html_to_markdown",
 "http 1.5.0",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "indoc",
 "inquire",
 "is-terminal",
@@ -1767,9 +1767,9 @@ dependencies = [

 [[package]]
 name = "cpufeatures"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
 dependencies = [
 "libc",
 ]
@@ -1785,9 +1785,9 @@ dependencies = [

 [[package]]
 name = "crc32fast"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550"
 dependencies = [
 "cfg-if",
 ]
@@ -1976,12 +1976,12 @@ dependencies = [

 [[package]]
 name = "darling"
-version = "0.24.0"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88490bf1b990d87eaaa7ac8aa887f629a08e7359765b4911faf63c3763347d23"
+checksum = "ed17f5901b6630b993ca003def43f2f8ef4014fc13b047b57aad617ff32bc2ec"
 dependencies = [
- "darling_core 0.24.0",
- "darling_macro 0.24.0",
+ "darling_core 0.24.1",
+ "darling_macro 0.24.1",
 ]

 [[package]]
@@ -2013,15 +2013,15 @@ dependencies = [

 [[package]]
 name = "darling_core"
-version = "0.24.0"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "084e274f91c482280130e1e34e0b8d6e66776a060d7b6de7b84289ca778868c4"
+checksum = "6837e2cf7485aaae18f86181d2f0e9a7ed297a025e220aeabf63fdebd3a2ddff"
 dependencies = [
 "ident_case",
 "proc-macro2",
 "quote",
 "strsim",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -2048,13 +2048,13 @@ dependencies = [

 [[package]]
 name = "darling_macro"
-version = "0.24.0"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68f5792fa0d41cd2325ce0ffa64f0a340eaebd4971a3a0c5e1ffd2cc488a355e"
+checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
 dependencies = [
- "darling_core 0.24.0",
+ "darling_core 0.24.1",
 "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -2245,7 +2245,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -2352,9 +2352,9 @@ checksum = "b2972feb8dffe7bc8c5463b1dacda1b0dfbed3710e50f977d965429692d74cd8"

 [[package]]
 name = "either"
-version = "1.17.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"

 [[package]]
 name = "encode_unicode"
@@ -2424,9 +2424,9 @@ dependencies = [

 [[package]]
 name = "error-code"
-version = "3.3.2"
+version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dea2df4cf52843e0452895c455a1a2cfbb842a1e7329671acf418fdc53ed4c59"
+checksum = "0b5343afd4a8365a643ac588dab4cf234a190c7f6c88c9f6dd6ffe00837661b7"

 [[package]]
 name = "etcetera"
@@ -2539,9 +2539,9 @@ dependencies = [

 [[package]]
 name = "find-msvc-tools"
-version = "0.1.10"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b73573e6edcd2af0cdf47bd6cb58f0b3839491263c314eaad1ccf24430e1de"
+checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"

 [[package]]
 name = "fixedbitset"
@@ -2551,12 +2551,12 @@ checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"

 [[package]]
 name = "flate2"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
 dependencies = [
 "crc32fast",
- "miniz_oxide",
+ "miniz_oxide 0.9.1",
 "zlib-rs",
 ]

@@ -2668,7 +2668,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -2728,7 +2728,7 @@ dependencies = [
 "bytes",
 "chrono",
 "futures",
- "hyper 1.11.0",
+ "hyper 1.11.1",
 "jsonwebtoken",
 "once_cell",
 "prost",
@@ -2878,7 +2878,7 @@ dependencies = [
 "futures-sink",
 "futures-util",
 "http 0.2.12",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "slab",
 "tokio",
 "tokio-util",
@@ -2887,9 +2887,9 @@ dependencies = [

 [[package]]
 name = "h2"
-version = "0.4.15"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
 "atomic-waker",
 "bytes",
@@ -2897,7 +2897,7 @@ dependencies = [
 "futures-core",
 "futures-sink",
 "http 1.5.0",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "slab",
 "tokio",
 "tokio-util",
@@ -2997,7 +2997,7 @@ dependencies = [
 "cpu-time",
 "env_logger",
 "hashbrown 0.15.5",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "lazy_static",
 "log",
 "mmap-rs",
@@ -3100,9 +3100,9 @@ dependencies = [

 [[package]]
 name = "http-body-util"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
 dependencies = [
 "bytes",
 "futures-core",
@@ -3180,15 +3180,15 @@ dependencies = [

 [[package]]
 name = "hyper"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
 dependencies = [
 "atomic-waker",
 "bytes",
 "futures-channel",
 "futures-core",
- "h2 0.4.15",
+ "h2 0.4.19",
 "http 1.5.0",
 "http-body 1.1.0",
 "httparse",
@@ -3222,7 +3222,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
 "http 1.5.0",
- "hyper 1.11.0",
+ "hyper 1.11.1",
 "hyper-util",
 "rustls 0.23.43",
 "rustls-native-certs",
@@ -3237,7 +3237,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
- "hyper 1.11.0",
+ "hyper 1.11.1",
 "hyper-util",
 "pin-project-lite",
 "tokio",
@@ -3252,7 +3252,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
 "bytes",
 "http-body-util",
- "hyper 1.11.0",
+ "hyper 1.11.1",
 "hyper-util",
 "native-tls",
 "tokio",
@@ -3272,7 +3272,7 @@ dependencies = [
 "futures-util",
 "http 1.5.0",
 "http-body 1.1.0",
- "hyper 1.11.0",
+ "hyper 1.11.1",
 "ipnet",
 "libc",
 "percent-encoding",
@@ -3309,9 +3309,9 @@ dependencies = [

 [[package]]
 name = "icu_collections"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
 dependencies = [
 "displaydoc",
 "potential_utf",
@@ -3323,9 +3323,9 @@ dependencies = [

 [[package]]
 name = "icu_locale_core"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
 "displaydoc",
 "litemap",
@@ -3336,9 +3336,9 @@ dependencies = [

 [[package]]
 name = "icu_normalizer"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
 dependencies = [
 "icu_collections",
 "icu_normalizer_data",
@@ -3350,16 +3350,17 @@ dependencies = [

 [[package]]
 name = "icu_normalizer_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"

 [[package]]
 name = "icu_properties"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
 dependencies = [
+ "displaydoc",
 "icu_collections",
 "icu_locale_core",
 "icu_properties_data",
@@ -3370,15 +3371,15 @@ dependencies = [

 [[package]]
 name = "icu_properties_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"

 [[package]]
 name = "icu_provider"
-version = "2.2.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
 "displaydoc",
 "icu_locale_core",
@@ -3441,9 +3442,9 @@ dependencies = [

 [[package]]
 name = "indexmap"
-version = "2.14.0"
+version = "2.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+checksum = "07aa2048142242915a31d35844fb311e0e53fcca590c3a0a40dcf1b841fa09eb"
 dependencies = [
 "equivalent",
 "hashbrown 0.17.1",
@@ -3837,9 +3838,9 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"

 [[package]]
 name = "libredox"
-version = "0.1.19"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2026a5056764a10b2bf5d56488cba40da507f5493a6a429340e2004d9ed085fa"
+checksum = "d7955dfc218a8afb29dfeffd540e3a6e96baeb94fe7138228dd7cc6937fbbf96"
 dependencies = [
 "libc",
 ]
@@ -3870,9 +3871,9 @@ checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"

 [[package]]
 name = "litemap"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"

 [[package]]
 name = "litrs"
@@ -3891,9 +3892,9 @@ dependencies = [

 [[package]]
 name = "log"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 dependencies = [
 "serde_core",
 ]
@@ -4044,6 +4045,15 @@ name = "miniz_oxide"
 version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
 dependencies = [
 "adler2",
 "simd-adler32",
@@ -4211,9 +4221,9 @@ checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"

 [[package]]
 name = "num-integer"
-version = "0.1.46"
+version = "0.1.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
 dependencies = [
 "num-traits",
 ]
@@ -4470,9 +4480,9 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"

 [[package]]
 name = "open"
-version = "5.4.1"
+version = "5.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9cfef937e9c486488c7e3d949ae31c0f1d06bdacd75b99c086cb35356e30408"
+checksum = "ade3be4664bc1ef537ce133015f04c176b737815c2ba9fd60edf212d6e90dd55"
 dependencies = [
 "is-wsl",
 "libc",
@@ -4664,7 +4674,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3672b37090dbd86368a4145bc067582552b29c27377cad4e0a306c97f9bd7772"
 dependencies = [
 "fixedbitset",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "serde",
 "serde_derive",
 ]
@@ -4677,7 +4687,7 @@ checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
 dependencies = [
 "fixedbitset",
 "hashbrown 0.15.5",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 ]

 [[package]]
@@ -4707,7 +4717,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
 "phf_shared",
- "rand 0.8.7",
+ "rand 0.8.8",
 ]

 [[package]]
@@ -4776,9 +4786,9 @@ dependencies = [

 [[package]]
 name = "pkg-config"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"

 [[package]]
 name = "plist"
@@ -4787,7 +4797,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da1d65da6dd5d1e44199ac0f58712d241c0f439f80adea8924d832384087f85"
 dependencies = [
 "base64 0.22.1",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "quick-xml 0.41.0",
 "serde",
 "time",
@@ -4821,9 +4831,9 @@ dependencies = [

 [[package]]
 name = "potential_utf"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
 "zerovec",
 ]
@@ -4888,7 +4898,7 @@ dependencies = [
 "proc-macro-error-attr3",
 "proc-macro2",
 "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -4907,7 +4917,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2e842efad9119158434d193c6682e2ebee4b44d6ad801d7b349623b3f57cdf55"
 dependencies = [
 "futures",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "nix 0.31.3",
 "tokio",
 "tracing",
@@ -5001,9 +5011,9 @@ dependencies = [

 [[package]]
 name = "quinn-proto"
-version = "0.11.16"
+version = "0.11.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
+checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
 dependencies = [
 "aws-lc-rs",
 "bytes",
@@ -5059,9 +5069,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"

 [[package]]
 name = "rand"
-version = "0.8.7"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
 dependencies = [
 "rand_core 0.6.4",
 ]
@@ -5082,7 +5092,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.1",
+ "chacha20 0.10.2",
 "getrandom 0.4.3",
 "rand_core 0.10.1",
 ]
@@ -5192,22 +5202,22 @@ dependencies = [

 [[package]]
 name = "ref-cast"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d"
+checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
 dependencies = [
 "ref-cast-impl",
 ]

 [[package]]
 name = "ref-cast-impl"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
+checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -5258,7 +5268,7 @@ dependencies = [
 "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
- "hyper 1.11.0",
+ "hyper 1.11.1",
 "hyper-rustls 0.27.9",
 "hyper-tls",
 "hyper-util",
@@ -5300,11 +5310,11 @@ dependencies = [
 "futures-channel",
 "futures-core",
 "futures-util",
- "h2 0.4.15",
+ "h2 0.4.19",
 "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
- "hyper 1.11.0",
+ "hyper 1.11.1",
 "hyper-rustls 0.27.9",
 "hyper-tls",
 "hyper-util",
@@ -5361,15 +5371,16 @@ dependencies = [

 [[package]]
 name = "rmcp"
-version = "3.1.2"
+version = "3.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8dddc5b1924b9a59fba420166160ca2c4663a4e01803e52eda33070f56d63c8"
+checksum = "1a15bc53261a9dc37e105df006e4656c598379a8f9581f8950debb130f27a7cf"
 dependencies = [
 "base64 0.23.1",
 "bytes",
 "chrono",
 "futures",
 "http 1.5.0",
+ "indexmap 2.14.1",
 "pastey",
 "pin-project-lite",
 "process-wrap",
@@ -5389,15 +5400,15 @@ dependencies = [

 [[package]]
 name = "rmcp-macros"
-version = "3.1.2"
+version = "3.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6898e24cd16342b59bfa8a53c2c04b9cf62fc8a2cfea57b9c038b09984bfc521"
+checksum = "a85d45508e9b4ba024fe996c2638799635d75b6dd0ba8f32ccf08f8026f0c780"
 dependencies = [
- "darling 0.24.0",
+ "darling 0.24.1",
 "proc-macro2",
 "quote",
 "serde_json",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -5419,12 +5430,12 @@ dependencies = [

 [[package]]
 name = "rtoolbox"
-version = "0.0.5"
+version = "0.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50a0e551c1e27e1731aba276dbeaeac73f53c7cd34d1bda485d02bd1e0f36844"
+checksum = "9a1efe12a1469752d0e6ff5ebec0b6ef4924cc5c4c71046b0ec730040535819d"
 dependencies = [
 "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -5542,7 +5553,7 @@ dependencies = [
 "once_cell",
 "ring",
 "rustls-pki-types",
- "rustls-webpki 0.103.14",
+ "rustls-webpki 0.103.15",
 "subtle",
 "zeroize",
 ]
@@ -5583,7 +5594,7 @@ dependencies = [
 "rustls 0.23.43",
 "rustls-native-certs",
 "rustls-platform-verifier-android",
- "rustls-webpki 0.103.14",
+ "rustls-webpki 0.103.15",
 "security-framework",
 "security-framework-sys",
 "webpki-root-certs",
@@ -5608,9 +5619,9 @@ dependencies = [

 [[package]]
 name = "rustls-webpki"
-version = "0.103.14"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
 "aws-lc-rs",
 "ring",
@@ -5683,7 +5694,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "serde_derive_internals",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -5701,7 +5712,7 @@ dependencies = [
 "cssparser",
 "ego-tree",
 "html5ever 0.29.1",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "precomputed-hash",
 "selectors",
 "tendril",
@@ -5859,7 +5870,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -5870,7 +5881,7 @@ checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -5879,7 +5890,7 @@ version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "itoa",
 "memchr",
 "serde",
@@ -5919,7 +5930,7 @@ dependencies = [
 "chrono",
 "hex",
 "indexmap 1.9.3",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "jiff",
 "schemars 0.9.0",
 "schemars 1.2.2",
@@ -5947,7 +5958,7 @@ version = "0.9.34+deprecated"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
 dependencies = [
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "itoa",
 "ryu",
 "serde",
@@ -6017,7 +6028,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
 "cfg-if",
- "cpufeatures 0.3.0",
+ "cpufeatures 0.3.1",
 "digest 0.11.3",
 ]

@@ -6321,9 +6332,9 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "3.0.3"
+version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -6526,7 +6537,7 @@ checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -6600,9 +6611,9 @@ dependencies = [

 [[package]]
 name = "tinystr"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
 "displaydoc",
 "zerovec",
@@ -6648,7 +6659,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -6743,11 +6754,11 @@ dependencies = [
 "axum",
 "base64 0.22.1",
 "bytes",
- "h2 0.4.15",
+ "h2 0.4.19",
 "http 1.5.0",
 "http-body 1.1.0",
 "http-body-util",
- "hyper 1.11.0",
+ "hyper 1.11.1",
 "hyper-timeout",
 "hyper-util",
 "percent-encoding",
@@ -6783,7 +6794,7 @@ checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
 "futures-core",
 "futures-util",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "pin-project-lite",
 "slab",
 "sync_wrapper",
@@ -6862,9 +6873,9 @@ dependencies = [

 [[package]]
 name = "tree-sitter"
-version = "0.26.12"
+version = "0.26.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83c567a8e18ae93f20982c90370b16fd24023aeaf52f6052b96957ab253a0fec"
+checksum = "17ebdd3a5a7e28a1890b876fdbd0c3c0fe0a6336cffaa104f11b9f720c9daa29"
 dependencies = [
 "cc",
 "regex",
@@ -7140,9 +7151,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"

 [[package]]
 name = "uuid"
-version = "1.24.0"
+version = "1.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
+checksum = "b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812"
 dependencies = [
 "getrandom 0.4.3",
 "js-sys",
@@ -7323,9 +7334,9 @@ dependencies = [

 [[package]]
 name = "wayland-backend"
-version = "0.3.16"
+version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "016ccf01d1c58b6f8999612813e17c9b2390f7d70671428869913310f83f54b8"
+checksum = "38a91b4eaddff87b1cd1074985e3713da4af2c49742d1b356b2c01670a67a078"
 dependencies = [
 "cc",
 "downcast-rs",
@@ -7431,9 +7442,9 @@ dependencies = [

 [[package]]
 name = "which"
-version = "8.0.5"
+version = "8.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3ef584124b911bcc3875c2f1472e80f24361ceb789bd1c62b3e9a3df9ff43c"
+checksum = "bae2f2b2b816647a1cab1acc91f5bd20812d53cb344382635ec2181940c8034f"
 dependencies = [
 "libc",
 ]
@@ -7842,9 +7853,9 @@ dependencies = [

 [[package]]
 name = "writeable"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"

 [[package]]
 name = "x11rb"
@@ -7988,9 +7999,9 @@ dependencies = [

 [[package]]
 name = "zerotrie"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
 "displaydoc",
 "yoke",
@@ -7999,9 +8010,9 @@ dependencies = [

 [[package]]
 name = "zerovec"
-version = "0.11.6"
+version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
 "yoke",
 "zerofrom",
@@ -8010,13 +8021,13 @@ dependencies = [

 [[package]]
 name = "zerovec-derive"
-version = "0.11.3"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.119",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -8028,7 +8039,7 @@ dependencies = [
 "arbitrary",
 "crc32fast",
 "flate2",
- "indexmap 2.14.0",
+ "indexmap 2.14.1",
 "memchr",
 "time",
 "zopfli",
@@ -1,6 +1,6 @@
 [package]
 name = "coyote-ai"
-version = "0.8.3"
+version = "0.10.0"
 edition = "2024"
 authors = ["Alex Clarke <alex.j.tusa@gmail.com>"]
 description = "The batteries-included runtime for LLMs"
@@ -82,7 +82,7 @@ Coyote requires the following tools to be installed on your system:
    * **npm:** `npm i -g @ast-grep/cli`
    * Optional: if `ast-grep` is not installed, the `ast_grep` tool reports it and agents fall back to `fs_grep`
 * [duckdb](https://duckdb.org/) (for fast, local RAGs)
-    * `curl https://install.duckdb.org | sh`
+    * `curl https://install.duckdb.org | bash`

 These tools are used to provide various functionalities within Coyote, such as document processing, JSON manipulation,
 etc., and they are used within agents and tools.
@@ -13,7 +13,7 @@ description: >
  CLI & REPL mode, RAG, AI tools & agents, MCP servers, skills, and macros.

 sandbox:
-  image: 'darkalex17/coyote:v0.8.3'
+  image: 'darkalex17/coyote:v0.10.0'
  entrypoint: ['bash', '-lc', 'exec /home/agent/.cargo/bin/coyote']

 permissions:
@@ -16,6 +16,8 @@ param(
  [string]$BinDir = $env:BIN_DIR
 )

+if ($Version -and $Version -match '^[0-9]') { $Version = "v$Version" }
+
 $Repo = 'Dark-Alex-17/coyote'

 function Write-Info($msg) { Write-Host "[coyote-install] $msg" }
@@ -61,79 +63,155 @@ if ($os -eq 'windows') {
  if ($arch -eq 'x86_64') { $candidates += 'coyote-x86_64-apple-darwin.tar.gz' }
  else { $candidates += 'coyote-aarch64-apple-darwin.tar.gz' }
 } elseif ($os -eq 'linux') {
-  if ($arch -eq 'x86_64') {
-    $candidates += 'coyote-x86_64-unknown-linux-gnu.tar.gz'
-    $candidates += 'coyote-x86_64-unknown-linux-musl.tar.gz'
-  } else {
-    $candidates += 'coyote-aarch64-unknown-linux-musl.tar.gz'
+  $libc = 'musl'
+  try { getconf GNU_LIBC_VERSION *> $null; if ($LASTEXITCODE -eq 0) { $libc = 'gnu' } } catch { }
+  try { if ((ldd --version 2>&1 | Out-String) -imatch 'glibc') { $libc = 'gnu' } } catch { }
+  if ($libc -eq 'gnu') {
+    # ldconfig lives in /usr/sbin on Debian/Ubuntu, often missing from non-root
+    # PATHs, so try its known locations and fall back to probing library dirs.
+    $libssl3 = $false
+    foreach ($ldc in @('ldconfig', '/sbin/ldconfig', '/usr/sbin/ldconfig')) {
+      try { if ((& $ldc -p 2>&1 | Out-String) -match 'libssl\.so\.3') { $libssl3 = $true; break } } catch { }
    }
+    if (-not $libssl3) {
+      foreach ($libDir in @('/usr/lib/*/libssl.so.3', '/lib/*/libssl.so.3', '/usr/lib64/libssl.so.3', '/usr/lib/libssl.so.3', '/usr/local/lib/libssl.so.3', '/usr/local/lib/*/libssl.so.3')) {
+        if (Get-Item -Path $libDir -ErrorAction SilentlyContinue) { $libssl3 = $true; break }
+      }
+    }
+    if ($libssl3) {
+      $candidates += "coyote-$arch-unknown-linux-gnu.tar.gz"
+    } else {
+      Write-Info "glibc detected but OpenSSL 3 (libssl.so.3) not found; using musl build"
+    }
+  }
+  $candidates += "coyote-$arch-unknown-linux-musl.tar.gz"
 } else {
  Fail "Unsupported OS for this installer: $os"
 }

-$asset = $null
-foreach ($c in $candidates) {
-  $asset = $release.assets | Where-Object { $_.name -eq $c } | Select-Object -First 1
-  if ($asset) { break }
-}
-if (-not $asset) {
-  Write-Error "No matching asset found for $os-$arch. Tried:"; $candidates | ForEach-Object { Write-Error "  - $_" }
-  exit 1
-}
-
-Write-Info "Selected asset: $($asset.name)"
-Write-Info "Download URL:  $($asset.browser_download_url)"
-
 $tmp = New-Item -ItemType Directory -Force -Path ([IO.Path]::Combine([IO.Path]::GetTempPath(), "coyote-$(Get-Random)"))
-$archive = Join-Path $tmp.FullName 'asset'
-try { Invoke-WebRequest -UseBasicParsing -Headers @{ 'User-Agent' = 'coyote-installer' } -Uri $asset.browser_download_url -OutFile $archive } catch { Fail "Failed to download asset. $_" }

-$extractDir = Join-Path $tmp.FullName 'extract'; New-Item -ItemType Directory -Force -Path $extractDir | Out-Null
+try {
+  $exec = if ($isWin) { 'coyote.exe' } else { 'coyote' }
+  $dest = Join-Path $BinDir $exec

-if ($asset.name -match '\.zip$') {
+  $installed = $false
+  $tried = @()
+  $attempt = 0
+  foreach ($c in $candidates) {
+    $asset = $release.assets | Where-Object { $_.name -eq $c } | Select-Object -First 1
+    if (-not $asset) {
+      $tried += "${c}: no matching release asset"
+      continue
+    }
+
+    $attempt++
+    $work = New-Item -ItemType Directory -Force -Path (Join-Path $tmp.FullName "attempt-$attempt")
+
+    Write-Info "Selected asset: $($asset.name)"
+    Write-Info "Download URL:  $($asset.browser_download_url)"
+
+    $archive = Join-Path $work.FullName 'asset'
+    try {
+      Invoke-WebRequest -UseBasicParsing -Headers @{ 'User-Agent' = 'coyote-installer' } -Uri $asset.browser_download_url -OutFile $archive
+    } catch {
+      Write-Info "Failed to download ${c}; trying next candidate. $_"
+      $tried += "${c}: download failed"
+      continue
+    }
+
+    $extractDir = Join-Path $work.FullName 'extract'; New-Item -ItemType Directory -Force -Path $extractDir | Out-Null
+
+    try {
+      if ($asset.name -match '\.zip$') {
        Add-Type -AssemblyName System.IO.Compression.FileSystem
        [System.IO.Compression.ZipFile]::ExtractToDirectory($archive, $extractDir)
-} elseif ($asset.name -match '\.tar\.gz$' -or $asset.name -match '\.tgz$') {
+      } elseif ($asset.name -match '\.tar\.gz$' -or $asset.name -match '\.tgz$') {
        $tar = Get-Command tar -ErrorAction SilentlyContinue
        if ($tar) { & $tar.Source -xzf $archive -C $extractDir }
-  else { Fail "Asset is tar archive but 'tar' is not available." }
-} else {
+        else { throw "Asset is tar archive but 'tar' is not available." }
+      } else {
        try { Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory($archive, $extractDir) }
        catch {
          $tar = Get-Command tar -ErrorAction SilentlyContinue
-    if ($tar) { & $tar.Source -xf $archive -C $extractDir } else { Fail "Unknown archive format; neither zip nor tar workable." }
+          if ($tar) { & $tar.Source -xf $archive -C $extractDir } else { throw "Unknown archive format; neither zip nor tar workable." }
+        }
+      }
+    } catch {
+      Write-Info "Failed to extract ${c}; trying next candidate. $_"
+      $tried += "${c}: extract failed"
+      continue
    }
-}

-$bin = $null
-Get-ChildItem -Recurse -File $extractDir | ForEach-Object {
+    $bin = $null
+    Get-ChildItem -Recurse -File $extractDir | ForEach-Object {
      if ($isWin) { if ($_.Name -ieq 'coyote.exe') { $bin = $_.FullName } }
      else { if ($_.Name -ieq 'coyote') { $bin = $_.FullName } }
-}
-if (-not $bin) { Fail "Could not find coyote binary inside the archive." }
+    }
+    if (-not $bin) {
+      Write-Info "Could not find coyote binary inside ${c}; trying next candidate"
+      $tried += "${c}: no coyote binary in archive"
+      continue
+    }

-if (-not $isWin) { try { & chmod +x -- $bin } catch {} }
+    if (-not $isWin) { try { & chmod +x -- $bin } catch {} }

-$exec = if ($isWin) { 'coyote.exe'} else { 'coyote' }
-$dest = Join-Path $BinDir $exec
-Copy-Item -Force $bin $dest
-Write-Info "Installed: $dest"
+    $works = $false
+    try { & $bin --version *> $null; if ($LASTEXITCODE -eq 0) { $works = $true } } catch { }
+    if (-not $works -and -not $isWin) {
+      # The temp dir may live on a noexec mount; retry from a probe file in
+      # the install directory before rejecting.
+      $probe = Join-Path $BinDir ".coyote-install-probe-$PID"
+      try {
+        Copy-Item -Force $bin $probe
+        & chmod +x -- $probe
+        & $probe --version *> $null
+        if ($LASTEXITCODE -eq 0) { $works = $true }
+      } catch { } finally {
+        Remove-Item -Force -ErrorAction SilentlyContinue $probe
+      }
+    }
+    if (-not $works) {
+      Write-Info "Downloaded $c but it failed to run on this system; trying next candidate"
+      $tried += "${c}: binary failed to run on this system"
+      continue
+    }

-if ($isWin) {
+    Copy-Item -Force $bin $dest
+    Write-Info "Installed: $dest"
+    $installed = $true
+    break
+  }
+
+  if (-not $installed) {
+    Write-Error "No usable asset found for $os-$arch. Tried:"
+    $tried | ForEach-Object { Write-Error "  - $_" }
+    exit 1
+  }
+
+  if ($isWin) {
    $pathParts = ($env:Path -split ';') | Where-Object { $_ -ne '' }
    if ($pathParts -notcontains $BinDir) {
-    $userPath = [Environment]::GetEnvironmentVariable('Path', 'User'); if (-not $userPath) { $userPath = '' }
-    if (-not ($userPath -split ';' | Where-Object { $_ -eq $BinDir })) {
+      # Read/write the User PATH via the registry directly: the [Environment]
+      # round-trip expands %VAR% entries and bakes them in on write.
+      $regKey = [Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Environment', $true)
+      if ($regKey) {
+        $userPath = [string]$regKey.GetValue('Path', '', [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
+        if (-not (($userPath -split ';') -contains $BinDir)) {
          $newUserPath = if ($userPath.Trim().Length -gt 0) { "$userPath;$BinDir" } else { $BinDir }
-      [Environment]::SetEnvironmentVariable('Path', $newUserPath, 'User')
+          $regKey.SetValue('Path', $newUserPath, [Microsoft.Win32.RegistryValueKind]::ExpandString)
          Write-Info "Added to User PATH: $BinDir (restart shell to take effect)"
        }
+        $regKey.Close()
      }
-} else {
+    }
+  } else {
    if (-not ($env:PATH -split ':' | Where-Object { $_ -eq $BinDir })) {
      Write-Info "Note: $BinDir is not in PATH. Add it to your shell profile."
    }
+  }
+
+  Write-Info "Done. Try: coyote --help"
+} finally {
+  Remove-Item -Recurse -Force -ErrorAction SilentlyContinue $tmp
 }
-
-Write-Info "Done. Try: coyote --help"
-
@@ -13,8 +13,6 @@ set -euo pipefail
 #   --bin-dir <dir>   Install directory (default: /usr/local/bin or ~/.local/bin). Or set BIN_DIR.

 REPO="Dark-Alex-17/coyote"
-VERSION="${COYOTE_VERSION:-}"
-BIN_DIR="${BIN_DIR:-}"

 usage() {
  echo "coyote installer (Linux/macOS)"
@@ -25,24 +23,6 @@ usage() {
  echo "  -h, --help              Show help"
 }

-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --version) VERSION="$2"; shift 2;;
-    --bin-dir) BIN_DIR="$2"; shift 2;;
-    -h|--help) usage; exit 0;;
-    *) echo "Unknown argument: $1" >&2; usage; exit 2;;
-  esac
-done
-
-if [[ -z "${BIN_DIR}" ]]; then
-  if [[ -w "/usr/local/bin" ]]; then
-    BIN_DIR="/usr/local/bin"
-  else
-    BIN_DIR="${HOME}/.local/bin"
-  fi
-fi
-mkdir -p "${BIN_DIR}"
-
 log() {
 	echo "[coyote-install] $*"
 }
@@ -54,42 +34,6 @@ need_cmd() {
  fi
 }

-need_cmd uname
-need_cmd mktemp
-need_cmd tar
-
-if command -v curl >/dev/null 2>&1; then
-  DL=curl
-elif command -v wget >/dev/null 2>&1; then
-  DL=wget
-else
-  echo "Error: need curl or wget" >&2
-  exit 1
-fi
-
-UNAME_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
-case "$UNAME_OS" in
-  linux)  OS=linux ;;
-  darwin) OS=darwin ;;
-  *) echo "Error: unsupported OS '$UNAME_OS'" >&2; exit 1;;
-esac
-
-UNAME_ARCH=$(uname -m)
-case "$UNAME_ARCH" in
-  x86_64|amd64) ARCH=x86_64 ;;
-  aarch64|arm64) ARCH=aarch64 ;;
-  *) echo "Error: unsupported arch '$UNAME_ARCH'" >&2; exit 1;;
-esac
-
-log "Target: ${OS}-${ARCH}"
-
-API_BASE="https://api.github.com/repos/${REPO}/releases"
-if [[ -z "${VERSION}" ]]; then
-  RELEASE_URL="${API_BASE}/latest"
-else
-  RELEASE_URL="${API_BASE}/tags/${VERSION}"
-fi
-
 http_get() {
  if [[ "$DL" == "curl" ]]; then
    curl -fsSL -H 'User-Agent: coyote-installer' "$1"
@@ -98,114 +42,240 @@ http_get() {
  fi
 }

-TMPDIR="$(mktemp -d)"
-trap 'rm -rf "$TMPDIR"' EXIT
+smoke_test() {
+  # The scratch dir may live on a noexec mount; if running in place fails,
+  # retry from a probe file in the install directory before rejecting.
+  local bin="$1"
+  if "$bin" --version >/dev/null 2>&1; then return 0; fi
+  local probe="${BIN_DIR}/.coyote-install-probe.$$"
+  local ok=1
+  if cp "$bin" "$probe" 2>/dev/null && chmod +x "$probe" 2>/dev/null; then
+    if "$probe" --version >/dev/null 2>&1; then ok=0; fi
+  fi
+  rm -f "$probe"
+  return "$ok"
+}

-log "Fetching release metadata from $RELEASE_URL"
-JSON="$TMPDIR/release.json"
-if ! http_get "$RELEASE_URL" > "$JSON"; then
+main() {
+  VERSION="${COYOTE_VERSION:-}"
+  BIN_DIR="${BIN_DIR:-}"
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --version) VERSION="$2"; shift 2;;
+      --bin-dir) BIN_DIR="$2"; shift 2;;
+      -h|--help) usage; exit 0;;
+      *) echo "Unknown argument: $1" >&2; usage; exit 2;;
+    esac
+  done
+
+  if [[ -n "$VERSION" && "$VERSION" =~ ^[0-9] ]]; then VERSION="v${VERSION}"; fi
+
+  if [[ -z "${BIN_DIR}" ]]; then
+    if [[ -w "/usr/local/bin" ]]; then
+      BIN_DIR="/usr/local/bin"
+    else
+      BIN_DIR="${HOME}/.local/bin"
+    fi
+  fi
+  mkdir -p "${BIN_DIR}"
+
+  need_cmd uname
+  need_cmd mktemp
+  need_cmd tar
+
+  if command -v curl >/dev/null 2>&1; then
+    DL=curl
+  elif command -v wget >/dev/null 2>&1; then
+    DL=wget
+  else
+    echo "Error: need curl or wget" >&2
+    exit 1
+  fi
+
+  UNAME_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+  case "$UNAME_OS" in
+    linux)  OS=linux ;;
+    darwin) OS=darwin ;;
+    *) echo "Error: unsupported OS '$UNAME_OS'" >&2; exit 1;;
+  esac
+
+  UNAME_ARCH=$(uname -m)
+  case "$UNAME_ARCH" in
+    x86_64|amd64) ARCH=x86_64 ;;
+    aarch64|arm64) ARCH=aarch64 ;;
+    *) echo "Error: unsupported arch '$UNAME_ARCH'" >&2; exit 1;;
+  esac
+
+  log "Target: ${OS}-${ARCH}"
+
+  API_BASE="https://api.github.com/repos/${REPO}/releases"
+  if [[ -z "${VERSION}" ]]; then
+    RELEASE_URL="${API_BASE}/latest"
+  else
+    RELEASE_URL="${API_BASE}/tags/${VERSION}"
+  fi
+
+  WORKDIR="$(mktemp -d)"
+  trap 'rm -rf "$WORKDIR"; rm -f "${BIN_DIR}/.coyote-install-probe.$$"' EXIT
+
+  log "Fetching release metadata from $RELEASE_URL"
+  JSON="$WORKDIR/release.json"
+  if ! http_get "$RELEASE_URL" > "$JSON"; then
    echo "Error: failed to fetch release metadata. Check version tag." >&2
    exit 1
-fi
+  fi

-ASSET_CANDIDATES=()
-if [[ "$OS" == "darwin" ]]; then
+  ASSET_CANDIDATES=()
+  if [[ "$OS" == "darwin" ]]; then
    if [[ "$ARCH" == "x86_64" ]]; then
      ASSET_CANDIDATES+=("coyote-x86_64-apple-darwin.tar.gz")
    else
      ASSET_CANDIDATES+=("coyote-aarch64-apple-darwin.tar.gz")
    fi
-elif [[ "$OS" == "linux" ]]; then
-  if [[ "$ARCH" == "x86_64" ]]; then
+  elif [[ "$OS" == "linux" ]]; then
    LIBC="musl"
    if command -v getconf >/dev/null 2>&1 && getconf GNU_LIBC_VERSION >/dev/null 2>&1; then LIBC="gnu"; fi
    if ldd --version 2>&1 | grep -qi glibc; then LIBC="gnu"; fi

    if [[ "$LIBC" == "gnu" ]]; then
-      ASSET_CANDIDATES+=("coyote-x86_64-unknown-linux-gnu.tar.gz")
+      # The gnu binary dynamically links OpenSSL 3. On Debian/Ubuntu, ldconfig lives
+      # in /usr/sbin, which is often missing from non-root PATHs, so try its known
+      # locations and fall back to probing the usual library directories directly.
+      LIBSSL3=""
+      for LDCONFIG in ldconfig /sbin/ldconfig /usr/sbin/ldconfig; do
+        if command -v "$LDCONFIG" >/dev/null 2>&1; then
+          if "$LDCONFIG" -p 2>/dev/null | grep -q 'libssl\.so\.3'; then LIBSSL3="yes"; fi
+          break
        fi
-
-    ASSET_CANDIDATES+=("coyote-x86_64-unknown-linux-musl.tar.gz")
+      done
+      if [[ -z "$LIBSSL3" ]]; then
+        for LIBSSL_CANDIDATE in /usr/lib/*/libssl.so.3 /lib/*/libssl.so.3 /usr/lib64/libssl.so.3 /usr/lib/libssl.so.3 /usr/local/lib/libssl.so.3 /usr/local/lib/*/libssl.so.3; do
+          if [[ -e "$LIBSSL_CANDIDATE" ]]; then LIBSSL3="yes"; break; fi
+        done
+      fi
+      if [[ -n "$LIBSSL3" ]]; then
+        ASSET_CANDIDATES+=("coyote-${ARCH}-unknown-linux-gnu.tar.gz")
      else
-    ASSET_CANDIDATES+=("coyote-aarch64-unknown-linux-musl.tar.gz")
+        log "glibc detected but OpenSSL 3 (libssl.so.3) not found; using musl build"
+      fi
    fi
-else
-  echo "Error: unsupported OS for this installer: $OS" >&2; exit 1
-fi

-DL_URLS=$(grep -oE '"browser_download_url":[[:space:]]*"[^"]+"' "$JSON" \
+    ASSET_CANDIDATES+=("coyote-${ARCH}-unknown-linux-musl.tar.gz")
+  else
+    echo "Error: unsupported OS for this installer: $OS" >&2; exit 1
+  fi
+
+  DL_URLS=$(grep -oE '"browser_download_url":[[:space:]]*"[^"]+"' "$JSON" \
    | sed -E 's/.*"browser_download_url":[[:space:]]*"//; s/"$//' \
    || true)

-ASSET_NAME=""; ASSET_URL=""
-for candidate in "${ASSET_CANDIDATES[@]}"; do
+  INSTALLED=""
+  TRIED=()
+  ATTEMPT=0
+  for candidate in "${ASSET_CANDIDATES[@]}"; do
+    ASSET_URL=""
    while IFS= read -r url; do
      [[ -z "$url" ]] && continue
      if [[ "$url" == */"$candidate" ]]; then
-      ASSET_NAME="$candidate"
        ASSET_URL="$url"
        break
      fi
    done <<< "$DL_URLS"
-  [[ -n "$ASSET_URL" ]] && break
-done

-if [[ -z "$ASSET_URL" ]]; then
-  echo "Error: no matching asset found for ${OS}-${ARCH}. Tried:" >&2
-  for c in "${ASSET_CANDIDATES[@]}"; do echo "  - $c" >&2; done
-  exit 1
-fi
-
-log "Selected asset: $ASSET_NAME"
-log "Download URL: $ASSET_URL"
-
-ARCHIVE="$TMPDIR/asset"
-if [[ "$DL" == "curl" ]]; then
-  curl -fL -H 'User-Agent: coyote-installer' "$ASSET_URL" -o "$ARCHIVE"
-else
-  wget -q --header='User-Agent: coyote-installer' "$ASSET_URL" -O "$ARCHIVE"
-fi
-
-WORK="$TMPDIR/work"; mkdir -p "$WORK"
-EXTRACTED_DIR="$WORK/extracted"; mkdir -p "$EXTRACTED_DIR"
-
-if tar -tf "$ARCHIVE" >/dev/null 2>&1; then
-  tar -xzf "$ARCHIVE" -C "$EXTRACTED_DIR"
-else
-  if command -v unzip >/dev/null 2>&1; then
-  	unzip -q "$ARCHIVE" -d "$EXTRACTED_DIR"
-  else
-  	echo "Error: unknown archive format; install 'unzip'" >&2
-  	exit 1
+    if [[ -z "$ASSET_URL" ]]; then
+      TRIED+=("$candidate: no matching release asset")
+      continue
    fi
-fi

-BIN_PATH=""
-while IFS= read -r -d '' f; do
+    ATTEMPT=$((ATTEMPT + 1))
+    WORK="$WORKDIR/attempt-$ATTEMPT"
+    mkdir -p "$WORK"
+
+    log "Selected asset: $candidate"
+    log "Download URL: $ASSET_URL"
+
+    ARCHIVE="$WORK/asset"
+    if [[ "$DL" == "curl" ]]; then
+      if ! curl -fL -H 'User-Agent: coyote-installer' "$ASSET_URL" -o "$ARCHIVE"; then
+        log "Failed to download $candidate; trying next candidate"
+        TRIED+=("$candidate: download failed")
+        continue
+      fi
+    else
+      if ! wget -q --header='User-Agent: coyote-installer' "$ASSET_URL" -O "$ARCHIVE"; then
+        log "Failed to download $candidate; trying next candidate"
+        TRIED+=("$candidate: download failed")
+        continue
+      fi
+    fi
+
+    EXTRACTED_DIR="$WORK/extracted"; mkdir -p "$EXTRACTED_DIR"
+
+    if tar -tf "$ARCHIVE" >/dev/null 2>&1; then
+      if ! tar -xzf "$ARCHIVE" -C "$EXTRACTED_DIR"; then
+        log "Failed to extract $candidate; trying next candidate"
+        TRIED+=("$candidate: extract failed")
+        continue
+      fi
+    else
+      if command -v unzip >/dev/null 2>&1; then
+        if ! unzip -q "$ARCHIVE" -d "$EXTRACTED_DIR"; then
+          log "Failed to extract $candidate; trying next candidate"
+          TRIED+=("$candidate: extract failed")
+          continue
+        fi
+      else
+        log "Unknown archive format for $candidate and 'unzip' is not available; trying next candidate"
+        TRIED+=("$candidate: unknown archive format and 'unzip' unavailable")
+        continue
+      fi
+    fi
+
+    BIN_PATH=""
+    while IFS= read -r -d '' f; do
      base=$(basename "$f")
      if [[ "$base" == "coyote" ]]; then
      	BIN_PATH="$f"
      	break
      fi
-done < <(find "$EXTRACTED_DIR" -type f -print0)
+    done < <(find "$EXTRACTED_DIR" -type f -print0)

-if [[ -z "$BIN_PATH" ]]; then
-	echo "Error: could not find 'coyote' binary in the archive" >&2
+    if [[ -z "$BIN_PATH" ]]; then
+      log "Could not find 'coyote' binary in $candidate; trying next candidate"
+      TRIED+=("$candidate: no 'coyote' binary in archive")
+      continue
+    fi
+
+    chmod +x "$BIN_PATH"
+    if ! smoke_test "$BIN_PATH"; then
+      log "Downloaded $candidate but it failed to run on this system; trying next candidate"
+      TRIED+=("$candidate: binary failed to run on this system")
+      continue
+    fi
+
+    install -m 0755 "$BIN_PATH" "${BIN_DIR}/coyote"
+    INSTALLED="$candidate"
+    break
+  done
+
+  if [[ -z "$INSTALLED" ]]; then
+    echo "Error: no usable asset found for ${OS}-${ARCH}. Tried:" >&2
+    for t in "${TRIED[@]}"; do echo "  - $t" >&2; done
    exit 1
-fi
+  fi

-chmod +x "$BIN_PATH"
-install -m 0755 "$BIN_PATH" "${BIN_DIR}/coyote"
+  log "Installed: ${BIN_DIR}/coyote"

-log "Installed: ${BIN_DIR}/coyote"
-
-case ":$PATH:" in
+  case ":$PATH:" in
    *":${BIN_DIR}:"*) ;;
    *)
      log "Note: ${BIN_DIR} is not in PATH. Add it, e.g.:"
      log "  export PATH=\"${BIN_DIR}:\$PATH\""
      ;;
-esac
+  esac

-log "Done. Try: coyote --help"
+  log "Done. Try: coyote --help"
+}

+main "$@"
@@ -70,7 +70,9 @@ fn normalize_version(requested: Option<String>) -> Option<String> {

 fn preferred_update_target() -> Option<&'static str> {
    match (env::consts::OS, env::consts::ARCH) {
+        ("linux", "x86_64") if cfg!(target_env = "gnu") => Some("x86_64-unknown-linux-gnu"),
        ("linux", "x86_64") => Some("x86_64-unknown-linux-musl"),
+        ("linux", "aarch64") if cfg!(target_env = "gnu") => Some("aarch64-unknown-linux-gnu"),
        ("linux", "aarch64") => Some("aarch64-unknown-linux-musl"),
        _ => None,
    }
@@ -1869,6 +1869,17 @@ fn select_embedding_model(models: &[&Model]) -> Result<String> {
 }

 pub(crate) fn select_rag_driver() -> Result<String> {
+    #[cfg(target_env = "musl")]
+    {
+        println!(
+            "Note: the duckdb RAG driver is only available in GNU builds of coyote \
+             (musl builds are statically linked and cannot load DuckDB extensions). \
+             Using the yaml driver."
+        );
+        Ok("yaml".to_string())
+    }
+    #[cfg(not(target_env = "musl"))]
+    {
        let options = vec![
            "yaml   — portable, in-memory HNSW; usable from several Coyote processes at once (default)",
            "duckdb — persistent on-disk store; vectors and content survive restarts; HNSW approximate search.",
@@ -1887,6 +1898,7 @@ pub(crate) fn select_rag_driver() -> Result<String> {
        } else {
            Ok("yaml".to_string())
        }
+    }
 }

 const EXTRACTOR_SKIP: &str = "Skip";
@@ -85,6 +85,21 @@ pub struct DuckDbProvider {
 }

 impl DuckDbProvider {
+    /// Fail fast on musl builds, before any filesystem or DuckDB work. Coyote's musl
+    /// builds are statically linked, and a statically linked binary cannot dlopen the
+    /// `vss`/`fts` extension shared objects, so this driver can never work there.
+    fn reject_musl() -> Result<()> {
+        #[cfg(target_env = "musl")]
+        bail!(
+            "The duckdb RAG driver is unavailable in this build of coyote: musl builds \
+             are statically linked, and a statically linked binary cannot load DuckDB \
+             extensions like `vss`/`fts` (dlopen is unsupported). Use the `qdrant` RAG \
+             driver instead, or a gnu-libc build of coyote."
+        );
+        #[cfg(not(target_env = "musl"))]
+        Ok(())
+    }
+
    /// Open (or create) the DuckDB file. `dim` is the embedding vector dimension,
    /// supplied by the caller who knows the model.
    ///
@@ -95,6 +110,7 @@ impl DuckDbProvider {
    /// created or initialized here, or lazily through `ensure_writable` on the rebuild
    /// path.
    pub fn open(db_path: &Path, dim: usize) -> Result<Self> {
+        Self::reject_musl()?;
        let (conn, writable) = Self::open_for_workload(db_path, dim)?;
        // A reopened file may already carry a live FTS index from a previous session,
        // in which case keyword search works immediately.
@@ -173,6 +189,7 @@ impl DuckDbProvider {
    }

    pub fn introspect_dim(db_path: &Path) -> Result<Option<usize>> {
+        Self::reject_musl()?;
        if !db_path.exists() {
            return Ok(None);
        }
@@ -819,7 +836,9 @@ impl RagProvider for DuckDbProvider {
    }
 }

-#[cfg(test)]
+// Not compiled for musl: `open` bails there (statically linked binaries cannot dlopen
+// the extension shared objects), so every test in this module would fail at setup.
+#[cfg(all(test, not(target_env = "musl")))]
 mod tests {
    use super::*;
    use crate::rag::provider::RagProvider;
Author	SHA1	Message	Date
github-actions[bot]	c102da5665	chore: bump Cargo.toml and sandbox image to 0.10.0 CI / All (ubuntu-latest) (push) Failing after 29s Details CI / All (macos-latest) (push) Canceled after 0s Details CI / All (windows-latest) (push) Canceled after 0s Details	2026-08-29 05:49:07 +00:00
github-actions[bot]	4402d254f6	bump: version 0.9.0 → 0.10.0 [skip ci]	2026-08-29 05:49:04 +00:00
Dark-Alex-17	02974c8abc	docs: reset changelog	2026-08-28 23:48:33 -06:00
Dark-Alex-17	9f7eeb7dc6	fix: Harden install scripts: detect libssl3 without ldconfig on PATH, survive noexec tmp dirs, and guard against partial curl\|bash execution	2026-08-28 23:46:14 -06:00
Dark-Alex-17	f3d44212d5	fix: ldconfig on Debian-based distros lives in /usr/sbin	2026-08-28 23:04:35 -06:00
Dark-Alex-17	f0661b4ea4	feat: Support Linux ARM64 GNU	2026-08-28 22:49:58 -06:00
Dark-Alex-17	0946e3ec64	feat: Note that duckdb RAG driver is unavailable on MUSL Linux builds when initializing a RAG so users know when using the binary, not just based on docs	2026-08-28 22:35:39 -06:00
Dark-Alex-17	65e6249adb	feat: updated coyote installation scripts to detect when gnu is installable	2026-08-28 22:23:31 -06:00
Dark-Alex-17	18c2cfeb41	fix: Prefer GNU linux builds in install scripts for duckdb support, and gate duckdb support on linux hosts that are MUSL until MUSL support is added	2026-08-28 20:06:39 -06:00
Dark-Alex-17	50d2a74e80	docs: updated README duckdb install script	2026-08-28 20:06:09 -06:00
github-actions[bot]	ea001ade7a	bump: version 0.8.3 → 0.9.0 [skip ci]	2026-08-29 00:36:51 +00:00