From b2d7dca2912b6b5103f6d073c25f2df5dc8fd413 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Thu, 5 Mar 2026 12:57:34 -0800
Subject: [PATCH 01/24] Add bun-compile GitHub Action workflow

Adds .github/workflows/bun-compile.yml that compiles the Auggie CLI
into self-contained native binaries using Bun, pulling the pre-built
@augmentcode/auggie package from npm.

- workflow_dispatch trigger with required version input
- 4 platform targets via matrix (darwin-arm64, darwin-x64, linux-x64, windows-x64)
- Cross-compilation on ubuntu-latest using bun build --compile --target
- Release job creates GitHub Release with all 4 binaries attached
---
 .github/workflows/bun-compile.yml | 68 +++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 .github/workflows/bun-compile.yml

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
new file mode 100644
index 0000000..de00a78
--- /dev/null
+++ b/.github/workflows/bun-compile.yml
@@ -0,0 +1,68 @@
+# Bun Compile
+# Compiles Auggie CLI into self-contained native binaries using Bun,
+# pulling the pre-built @augmentcode/auggie package from npm.
+
+name: Bun Compile
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'npm package version (e.g. 0.17.0)'
+        required: true
+        type: string
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - target: bun-darwin-arm64
+            output: auggie-bun-darwin-arm64
+          - target: bun-darwin-x64
+            output: auggie-bun-darwin-x64
+          - target: bun-linux-x64
+            output: auggie-bun-linux-x64
+          - target: bun-windows-x64
+            output: auggie-bun-windows-x64.exe
+    permissions:
+      contents: read
+    steps:
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Create entry point
+        run: |
+          echo 'await import("npm:@augmentcode/auggie@${{ inputs.version }}");' > augment.mjs
+
+      - name: Compile binary
+        run: bun build augment.mjs --compile --target=${{ matrix.target }} --outfile=${{ matrix.output }}
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.output }}
+          path: ${{ matrix.output }}
+
+  release:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          gh release create "v${{ inputs.version }}" \
+            --title "v${{ inputs.version }}" \
+            --generate-notes \
+            artifacts/*
+

From 5a63113d5f931922240a12cbf2f68514f3c78623 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Thu, 5 Mar 2026 13:20:36 -0800
Subject: [PATCH 02/24] temp: add push trigger for testing

---
 .github/workflows/bun-compile.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index de00a78..6e8608b 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -10,6 +10,9 @@ on:
         description: 'npm package version (e.g. 0.17.0)'
         required: true
         type: string
+  push:
+    branches:
+      - auggie-bun-compile-workflow
 
 jobs:
   build:
@@ -33,7 +36,7 @@ jobs:
 
       - name: Create entry point
         run: |
-          echo 'await import("npm:@augmentcode/auggie@${{ inputs.version }}");' > augment.mjs
+          echo 'await import("npm:@augmentcode/auggie@${{ inputs.version || '0.17.0-prerelease.14' }}");' > augment.mjs
 
       - name: Compile binary
         run: bun build augment.mjs --compile --target=${{ matrix.target }} --outfile=${{ matrix.output }}
@@ -61,8 +64,8 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
         run: |
-          gh release create "v${{ inputs.version }}" \
-            --title "v${{ inputs.version }}" \
+          gh release create "v${{ inputs.version || '0.17.0-prerelease.14' }}" \
+            --title "v${{ inputs.version || '0.17.0-prerelease.14' }}" \
             --generate-notes \
             artifacts/*
 

From 6659b2a841870751ef97b62b1971a9e24381b231 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Thu, 5 Mar 2026 13:23:02 -0800
Subject: [PATCH 03/24] fix: install npm package before bun compile

---
 .github/workflows/bun-compile.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 6e8608b..9a5f1dc 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -34,9 +34,12 @@ jobs:
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
 
+      - name: Install package
+        run: bun install @augmentcode/auggie@${{ inputs.version || '0.17.0-prerelease.14' }}
+
       - name: Create entry point
         run: |
-          echo 'await import("npm:@augmentcode/auggie@${{ inputs.version || '0.17.0-prerelease.14' }}");' > augment.mjs
+          echo 'await import("@augmentcode/auggie");' > augment.mjs
 
       - name: Compile binary
         run: bun build augment.mjs --compile --target=${{ matrix.target }} --outfile=${{ matrix.output }}

From 7d198cc5b329dbfccd5b4a2ec61481490feeb7b5 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Thu, 5 Mar 2026 13:32:12 -0800
Subject: [PATCH 04/24] fix: patch process.argv[1] for bun compile
 compatibility

---
 .github/workflows/bun-compile.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 9a5f1dc..8fc6c9c 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -39,7 +39,7 @@ jobs:
 
       - name: Create entry point
         run: |
-          echo 'await import("@augmentcode/auggie");' > augment.mjs
+          printf 'process.argv[1] = process.execPath;\nawait import("@augmentcode/auggie");\n' > augment.mjs
 
       - name: Compile binary
         run: bun build augment.mjs --compile --target=${{ matrix.target }} --outfile=${{ matrix.output }}

From 0753f6a3f869ebd1743e25cbf123b61893a0392c Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Thu, 5 Mar 2026 13:39:04 -0800
Subject: [PATCH 05/24] revert: remove process.argv[1] patch from entry point

---
 .github/workflows/bun-compile.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 8fc6c9c..9a5f1dc 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -39,7 +39,7 @@ jobs:
 
       - name: Create entry point
         run: |
-          printf 'process.argv[1] = process.execPath;\nawait import("@augmentcode/auggie");\n' > augment.mjs
+          echo 'await import("@augmentcode/auggie");' > augment.mjs
 
       - name: Compile binary
         run: bun build augment.mjs --compile --target=${{ matrix.target }} --outfile=${{ matrix.output }}

From 6419df67d46b82de1dc3d2c8cffd8cf8009d804e Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Thu, 5 Mar 2026 13:48:05 -0800
Subject: [PATCH 06/24] feat: add repository_dispatch trigger for automated npm
 sync

---
 .github/workflows/bun-compile.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 9a5f1dc..7560261 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -10,9 +10,8 @@ on:
         description: 'npm package version (e.g. 0.17.0)'
         required: true
         type: string
-  push:
-    branches:
-      - auggie-bun-compile-workflow
+  repository_dispatch:
+    types: [npm-published]
 
 jobs:
   build:
@@ -35,7 +34,7 @@ jobs:
         uses: oven-sh/setup-bun@v2
 
       - name: Install package
-        run: bun install @augmentcode/auggie@${{ inputs.version || '0.17.0-prerelease.14' }}
+        run: bun install @augmentcode/auggie@${{ inputs.version || github.event.client_payload.version }}
 
       - name: Create entry point
         run: |
@@ -67,8 +66,8 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
         run: |
-          gh release create "v${{ inputs.version || '0.17.0-prerelease.14' }}" \
-            --title "v${{ inputs.version || '0.17.0-prerelease.14' }}" \
+          gh release create "v${{ inputs.version || github.event.client_payload.version }}" \
+            --title "v${{ inputs.version || github.event.client_payload.version }}" \
             --generate-notes \
             artifacts/*
 

From 8e56c070132ac6aa8ab9342cff74e050555c8e02 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Thu, 5 Mar 2026 15:09:31 -0800
Subject: [PATCH 07/24] rename binary assets from auggie-bun-* to auggie-*

Agent-Id: agent-42aef0a6-de54-40e7-9889-e6dc52b9645d
---
 .github/workflows/bun-compile.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 7560261..b4b452a 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -20,13 +20,13 @@ jobs:
       matrix:
         include:
           - target: bun-darwin-arm64
-            output: auggie-bun-darwin-arm64
+            output: auggie-darwin-arm64
           - target: bun-darwin-x64
-            output: auggie-bun-darwin-x64
+            output: auggie-darwin-x64
           - target: bun-linux-x64
-            output: auggie-bun-linux-x64
+            output: auggie-linux-x64
           - target: bun-windows-x64
-            output: auggie-bun-windows-x64.exe
+            output: auggie-windows-x64.exe
     permissions:
       contents: read
     steps:

From 7e749223abedf134b7fb946226a907ab6960e166 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Fri, 6 Mar 2026 16:45:57 -0800
Subject: [PATCH 08/24] fix: use clean artifact names without .exe suffix

Agent-Id: agent-94e7274a-0a18-4a87-abb4-57e6efed6532
---
 .github/workflows/bun-compile.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index b4b452a..f5dcfaf 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -46,7 +46,7 @@ jobs:
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
-          name: ${{ matrix.output }}
+          name: auggie-${{ matrix.target }}
           path: ${{ matrix.output }}
 
   release:

From 741590cfe4c2c9788c094179500e3376a2de9559 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Fri, 6 Mar 2026 16:50:50 -0800
Subject: [PATCH 09/24] fix: clean artifact names, re-add push trigger for
 testing

Agent-Id: agent-94e7274a-0a18-4a87-abb4-57e6efed6532
---
 .github/workflows/bun-compile.yml | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index f5dcfaf..c08b8d7 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -12,6 +12,9 @@ on:
         type: string
   repository_dispatch:
     types: [npm-published]
+  push:
+    branches:
+      - auggie-bun-compile-workflow
 
 jobs:
   build:
@@ -21,12 +24,16 @@ jobs:
         include:
           - target: bun-darwin-arm64
             output: auggie-darwin-arm64
+            artifact: auggie-darwin-arm64
           - target: bun-darwin-x64
             output: auggie-darwin-x64
+            artifact: auggie-darwin-x64
           - target: bun-linux-x64
             output: auggie-linux-x64
+            artifact: auggie-linux-x64
           - target: bun-windows-x64
             output: auggie-windows-x64.exe
+            artifact: auggie-windows-x64
     permissions:
       contents: read
     steps:
@@ -34,7 +41,7 @@ jobs:
         uses: oven-sh/setup-bun@v2
 
       - name: Install package
-        run: bun install @augmentcode/auggie@${{ inputs.version || github.event.client_payload.version }}
+        run: bun install @augmentcode/auggie@${{ inputs.version || github.event.client_payload.version || '0.17.0-prerelease.14' }}
 
       - name: Create entry point
         run: |
@@ -46,7 +53,7 @@ jobs:
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
-          name: auggie-${{ matrix.target }}
+          name: ${{ matrix.artifact }}
           path: ${{ matrix.output }}
 
   release:
@@ -66,8 +73,8 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
         run: |
-          gh release create "v${{ inputs.version || github.event.client_payload.version }}" \
-            --title "v${{ inputs.version || github.event.client_payload.version }}" \
+          gh release create "v${{ inputs.version || github.event.client_payload.version || '0.17.0-prerelease.14' }}" \
+            --title "v${{ inputs.version || github.event.client_payload.version || '0.17.0-prerelease.14' }}" \
             --generate-notes \
             artifacts/*
 

From 114d5ef58f0b13b819c85d9ad9ddd498a3a99a74 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Fri, 6 Mar 2026 16:58:49 -0800
Subject: [PATCH 10/24] fix: update version fallback to 0.18.1

Agent-Id: agent-94e7274a-0a18-4a87-abb4-57e6efed6532
---
 .github/workflows/bun-compile.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index c08b8d7..70c5f61 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -41,7 +41,7 @@ jobs:
         uses: oven-sh/setup-bun@v2
 
       - name: Install package
-        run: bun install @augmentcode/auggie@${{ inputs.version || github.event.client_payload.version || '0.17.0-prerelease.14' }}
+        run: bun install @augmentcode/auggie@${{ inputs.version || github.event.client_payload.version || '0.18.1' }}
 
       - name: Create entry point
         run: |
@@ -73,8 +73,8 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
         run: |
-          gh release create "v${{ inputs.version || github.event.client_payload.version || '0.17.0-prerelease.14' }}" \
-            --title "v${{ inputs.version || github.event.client_payload.version || '0.17.0-prerelease.14' }}" \
+          gh release create "v${{ inputs.version || github.event.client_payload.version || '0.18.1' }}" \
+            --title "v${{ inputs.version || github.event.client_payload.version || '0.18.1' }}" \
             --generate-notes \
             artifacts/*
 

From e5886694896709fb27a254c44641ffe86bb58664 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Mon, 9 Mar 2026 14:00:45 -0700
Subject: [PATCH 11/24] fix: remove hardcoded version fallback, fail fast if no
 version provided

Addresses PR review comments: remove '0.18.1' fallback in both build
and release jobs. Version is now passed via env vars and the workflow
fails explicitly if no version is supplied via workflow_dispatch or
repository_dispatch.

Agent-Id: agent-94e7274a-0a18-4a87-abb4-57e6efed6532
---
 .github/workflows/bun-compile.yml | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 70c5f61..a4ced86 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -41,7 +41,14 @@ jobs:
         uses: oven-sh/setup-bun@v2
 
       - name: Install package
-        run: bun install @augmentcode/auggie@${{ inputs.version || github.event.client_payload.version || '0.18.1' }}
+        env:
+          VERSION: ${{ inputs.version || github.event.client_payload.version }}
+        run: |
+          if [ -z "$VERSION" ]; then
+            echo "::error::No version provided. Supply via workflow_dispatch input or repository_dispatch payload."
+            exit 1
+          fi
+          bun install "@augmentcode/auggie@${VERSION}"
 
       - name: Create entry point
         run: |
@@ -72,9 +79,14 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
+          VERSION: ${{ inputs.version || github.event.client_payload.version }}
         run: |
-          gh release create "v${{ inputs.version || github.event.client_payload.version || '0.18.1' }}" \
-            --title "v${{ inputs.version || github.event.client_payload.version || '0.18.1' }}" \
+          if [ -z "$VERSION" ]; then
+            echo "::error::No version provided. Cannot create release."
+            exit 1
+          fi
+          gh release create "v${VERSION}" \
+            --title "v${VERSION}" \
             --generate-notes \
             artifacts/*
 

From e4c818210b25959b23b8b91c0211242a32a6ae00 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Tue, 10 Mar 2026 11:44:41 -0700
Subject: [PATCH 12/24] Add macOS signing and checksums to bun-compile workflow

---
 .github/workflows/bun-compile.yml | 40 ++++++++++++++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index a4ced86..0227992 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -18,20 +18,24 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         include:
           - target: bun-darwin-arm64
+            os: macos-latest
             output: auggie-darwin-arm64
             artifact: auggie-darwin-arm64
           - target: bun-darwin-x64
+            os: macos-latest
             output: auggie-darwin-x64
             artifact: auggie-darwin-x64
           - target: bun-linux-x64
+            os: ubuntu-latest
             output: auggie-linux-x64
             artifact: auggie-linux-x64
           - target: bun-windows-x64
+            os: ubuntu-latest
             output: auggie-windows-x64.exe
             artifact: auggie-windows-x64
     permissions:
@@ -57,6 +61,34 @@ jobs:
       - name: Compile binary
         run: bun build augment.mjs --compile --target=${{ matrix.target }} --outfile=${{ matrix.output }}
 
+      - name: Import code signing certificate
+        if: contains(matrix.target, 'darwin')
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
+          security create-keychain -p "temppass" build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p "temppass" build.keychain
+          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "temppass" build.keychain
+
+      - name: Sign binary
+        if: contains(matrix.target, 'darwin')
+        run: |
+          codesign --force --options runtime --sign "Developer ID Application: Augment Code Inc" ${{ matrix.output }}
+
+      - name: Notarize binary
+        if: contains(matrix.target, 'darwin')
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          zip "${{ matrix.output }}.zip" "${{ matrix.output }}"
+          xcrun notarytool submit "${{ matrix.output }}.zip" --apple-id "$APPLE_ID" --password "$APPLE_APP_SPECIFIC_PASSWORD" --team-id "$APPLE_TEAM_ID" --wait
+
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
@@ -75,6 +107,12 @@ jobs:
           path: artifacts
           merge-multiple: true
 
+      - name: Generate checksums
+        run: |
+          cd artifacts
+          shasum -a 256 auggie-* > checksums.txt
+          cat checksums.txt
+
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}

From 84d74207f0a0504aac7a0dc6d805098478b3a1a0 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Tue, 10 Mar 2026 11:57:03 -0700
Subject: [PATCH 13/24] test: add temporary test config for signing workflow

---
 .github/workflows/bun-compile.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 0227992..9966dce 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -8,13 +8,15 @@ on:
     inputs:
       version:
         description: 'npm package version (e.g. 0.17.0)'
-        required: true
+        required: false
+        default: '0.18.0'
         type: string
   repository_dispatch:
     types: [npm-published]
   push:
     branches:
       - auggie-bun-compile-workflow
+      - auggie-macos-signing
 
 jobs:
   build:

From a59c124cbd65086cf3c8a37fa427dda959b9c767 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Tue, 10 Mar 2026 11:59:49 -0700
Subject: [PATCH 14/24] test: add version fallback for push trigger

---
 .github/workflows/bun-compile.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 9966dce..6efcd6e 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -48,7 +48,7 @@ jobs:
 
       - name: Install package
         env:
-          VERSION: ${{ inputs.version || github.event.client_payload.version }}
+          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.18.0' }}
         run: |
           if [ -z "$VERSION" ]; then
             echo "::error::No version provided. Supply via workflow_dispatch input or repository_dispatch payload."

From 862e0cf49a2ed0269abc7f0ba4907d65d653c98b Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Tue, 10 Mar 2026 12:06:08 -0700
Subject: [PATCH 15/24] fix: auto-detect codesign identity from keychain

---
 .github/workflows/bun-compile.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 6efcd6e..b272641 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -79,7 +79,9 @@ jobs:
       - name: Sign binary
         if: contains(matrix.target, 'darwin')
         run: |
-          codesign --force --options runtime --sign "Developer ID Application: Augment Code Inc" ${{ matrix.output }}
+          IDENTITY=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+          echo "Signing with identity: $IDENTITY"
+          codesign --force --options runtime --sign "$IDENTITY" ${{ matrix.output }}
 
       - name: Notarize binary
         if: contains(matrix.target, 'darwin')

From 1004b5143e1fa6f868646ffb1e79ac80437c53ff Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Tue, 10 Mar 2026 12:08:42 -0700
Subject: [PATCH 16/24] test: add version fallback to release job

---
 .github/workflows/bun-compile.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index b272641..19c24dc 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -121,7 +121,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
-          VERSION: ${{ inputs.version || github.event.client_payload.version }}
+          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.18.0' }}
         run: |
           if [ -z "$VERSION" ]; then
             echo "::error::No version provided. Cannot create release."

From 90f003d1a3aa5515332d98718d121878909b6ac7 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Tue, 10 Mar 2026 12:11:54 -0700
Subject: [PATCH 17/24] revert: remove temporary test config

---
 .github/workflows/bun-compile.yml | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 19c24dc..7275b6e 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -8,15 +8,13 @@ on:
     inputs:
       version:
         description: 'npm package version (e.g. 0.17.0)'
-        required: false
-        default: '0.18.0'
+        required: true
         type: string
   repository_dispatch:
     types: [npm-published]
   push:
     branches:
       - auggie-bun-compile-workflow
-      - auggie-macos-signing
 
 jobs:
   build:
@@ -48,7 +46,7 @@ jobs:
 
       - name: Install package
         env:
-          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.18.0' }}
+          VERSION: ${{ inputs.version || github.event.client_payload.version }}
         run: |
           if [ -z "$VERSION" ]; then
             echo "::error::No version provided. Supply via workflow_dispatch input or repository_dispatch payload."
@@ -121,7 +119,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
-          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.18.0' }}
+          VERSION: ${{ inputs.version || github.event.client_payload.version }}
         run: |
           if [ -z "$VERSION" ]; then
             echo "::error::No version provided. Cannot create release."

From 3089774bdff2a1a6b954886c6fdfbd8094126449 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Tue, 10 Mar 2026 12:14:42 -0700
Subject: [PATCH 18/24] test: temporary test config for v0.19.0-prerelease.1

---
 .github/workflows/bun-compile.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 7275b6e..7b099d2 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -8,13 +8,15 @@ on:
     inputs:
       version:
         description: 'npm package version (e.g. 0.17.0)'
-        required: true
+        required: false
+        default: '0.19.0-prerelease.1'
         type: string
   repository_dispatch:
     types: [npm-published]
   push:
     branches:
       - auggie-bun-compile-workflow
+      - auggie-macos-signing
 
 jobs:
   build:
@@ -46,7 +48,7 @@ jobs:
 
       - name: Install package
         env:
-          VERSION: ${{ inputs.version || github.event.client_payload.version }}
+          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.19.0-prerelease.1' }}
         run: |
           if [ -z "$VERSION" ]; then
             echo "::error::No version provided. Supply via workflow_dispatch input or repository_dispatch payload."
@@ -119,7 +121,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
-          VERSION: ${{ inputs.version || github.event.client_payload.version }}
+          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.19.0-prerelease.1' }}
         run: |
           if [ -z "$VERSION" ]; then
             echo "::error::No version provided. Cannot create release."

From b915a977cdab344ed909cc0126e909a4ddf4c906 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Tue, 10 Mar 2026 12:22:36 -0700
Subject: [PATCH 19/24] test: update to v0.19.0-prerelease.3

---
 .github/workflows/bun-compile.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 7b099d2..0f1b421 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -9,7 +9,7 @@ on:
       version:
         description: 'npm package version (e.g. 0.17.0)'
         required: false
-        default: '0.19.0-prerelease.1'
+        default: '0.19.0-prerelease.3'
         type: string
   repository_dispatch:
     types: [npm-published]
@@ -48,7 +48,7 @@ jobs:
 
       - name: Install package
         env:
-          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.19.0-prerelease.1' }}
+          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.19.0-prerelease.3' }}
         run: |
           if [ -z "$VERSION" ]; then
             echo "::error::No version provided. Supply via workflow_dispatch input or repository_dispatch payload."
@@ -121,7 +121,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
-          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.19.0-prerelease.1' }}
+          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.19.0-prerelease.3' }}
         run: |
           if [ -z "$VERSION" ]; then
             echo "::error::No version provided. Cannot create release."

From 834340a17febc07f76dd3b0c626187085d649542 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Tue, 10 Mar 2026 13:18:54 -0700
Subject: [PATCH 20/24] test: update to v0.19.0-prerelease.5

---
 .github/workflows/bun-compile.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 0f1b421..7ba7ade 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -9,7 +9,7 @@ on:
       version:
         description: 'npm package version (e.g. 0.17.0)'
         required: false
-        default: '0.19.0-prerelease.3'
+        default: '0.19.0-prerelease.5'
         type: string
   repository_dispatch:
     types: [npm-published]
@@ -48,7 +48,7 @@ jobs:
 
       - name: Install package
         env:
-          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.19.0-prerelease.3' }}
+          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.19.0-prerelease.5' }}
         run: |
           if [ -z "$VERSION" ]; then
             echo "::error::No version provided. Supply via workflow_dispatch input or repository_dispatch payload."
@@ -121,7 +121,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
-          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.19.0-prerelease.3' }}
+          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.19.0-prerelease.5' }}
         run: |
           if [ -z "$VERSION" ]; then
             echo "::error::No version provided. Cannot create release."

From bc8720f68c7b3a1ac3fec4e66451fd9b5f740c56 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Tue, 10 Mar 2026 13:22:21 -0700
Subject: [PATCH 21/24] revert: remove temporary test config

---
 .github/workflows/bun-compile.yml | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 7ba7ade..7275b6e 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -8,15 +8,13 @@ on:
     inputs:
       version:
         description: 'npm package version (e.g. 0.17.0)'
-        required: false
-        default: '0.19.0-prerelease.5'
+        required: true
         type: string
   repository_dispatch:
     types: [npm-published]
   push:
     branches:
       - auggie-bun-compile-workflow
-      - auggie-macos-signing
 
 jobs:
   build:
@@ -48,7 +46,7 @@ jobs:
 
       - name: Install package
         env:
-          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.19.0-prerelease.5' }}
+          VERSION: ${{ inputs.version || github.event.client_payload.version }}
         run: |
           if [ -z "$VERSION" ]; then
             echo "::error::No version provided. Supply via workflow_dispatch input or repository_dispatch payload."
@@ -121,7 +119,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
-          VERSION: ${{ inputs.version || github.event.client_payload.version || '0.19.0-prerelease.5' }}
+          VERSION: ${{ inputs.version || github.event.client_payload.version }}
         run: |
           if [ -z "$VERSION" ]; then
             echo "::error::No version provided. Cannot create release."

From 4bc14df6ff32591aa198184d12927625885a1aad Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Tue, 10 Mar 2026 13:45:59 -0700
Subject: [PATCH 22/24] fix: add identity guard and use sha256sum

---
 .github/workflows/bun-compile.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 7275b6e..60f6f77 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -78,6 +78,10 @@ jobs:
         if: contains(matrix.target, 'darwin')
         run: |
           IDENTITY=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+          if [ -z "$IDENTITY" ]; then
+            echo "::error::No Developer ID signing identity found in build.keychain"
+            exit 1
+          fi
           echo "Signing with identity: $IDENTITY"
           codesign --force --options runtime --sign "$IDENTITY" ${{ matrix.output }}
 
@@ -112,7 +116,7 @@ jobs:
       - name: Generate checksums
         run: |
           cd artifacts
-          shasum -a 256 auggie-* > checksums.txt
+          sha256sum auggie-* > checksums.txt
           cat checksums.txt
 
       - name: Create GitHub Release

From af0352954a0f17d0145e6a7f071dbb2b7a1842d9 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Tue, 10 Mar 2026 13:58:02 -0700
Subject: [PATCH 23/24] fix: add timestamp, clean up cert and zip after use

---
 .github/workflows/bun-compile.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index 60f6f77..d7e8054 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -73,6 +73,7 @@ jobs:
           security unlock-keychain -p "temppass" build.keychain
           security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "temppass" build.keychain
+          rm -f certificate.p12
 
       - name: Sign binary
         if: contains(matrix.target, 'darwin')
@@ -83,7 +84,7 @@ jobs:
             exit 1
           fi
           echo "Signing with identity: $IDENTITY"
-          codesign --force --options runtime --sign "$IDENTITY" ${{ matrix.output }}
+          codesign --force --options runtime --timestamp --sign "$IDENTITY" ${{ matrix.output }}
 
       - name: Notarize binary
         if: contains(matrix.target, 'darwin')
@@ -94,6 +95,7 @@ jobs:
         run: |
           zip "${{ matrix.output }}.zip" "${{ matrix.output }}"
           xcrun notarytool submit "${{ matrix.output }}.zip" --apple-id "$APPLE_ID" --password "$APPLE_APP_SPECIFIC_PASSWORD" --team-id "$APPLE_TEAM_ID" --wait
+          rm -f "${{ matrix.output }}.zip"
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4

From 1a803d67035061f2d6b1a03cab47ec2be32ad7d5 Mon Sep 17 00:00:00 2001
From: Kaiyue Jiang <kjiang@augmentcode.com>
Date: Wed, 11 Mar 2026 15:08:51 -0700
Subject: [PATCH 24/24] Add retry with backoff for npm install in Bun Compile
 workflow

npm registry propagation can take time after publish, causing
the repository_dispatch-triggered workflow to fail when bun tries
to install a version that hasn't propagated yet.

Adds a retry loop (5 attempts, 30s backoff) to handle this race
condition gracefully.
---
 .github/workflows/bun-compile.yml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/bun-compile.yml b/.github/workflows/bun-compile.yml
index d7e8054..36f9c40 100644
--- a/.github/workflows/bun-compile.yml
+++ b/.github/workflows/bun-compile.yml
@@ -52,7 +52,23 @@ jobs:
             echo "::error::No version provided. Supply via workflow_dispatch input or repository_dispatch payload."
             exit 1
           fi
-          bun install "@augmentcode/auggie@${VERSION}"
+          # Retry with backoff — npm registry may not have propagated the version yet
+          # when triggered immediately via repository_dispatch on publish.
+          max_attempts=5
+          for attempt in $(seq 1 $max_attempts); do
+            echo "Attempt $attempt/$max_attempts: installing @augmentcode/auggie@${VERSION}"
+            if bun install "@augmentcode/auggie@${VERSION}"; then
+              echo "Successfully installed on attempt $attempt"
+              exit 0
+            fi
+            if [ "$attempt" -lt "$max_attempts" ]; then
+              delay=$((attempt * 30))
+              echo "Install failed, retrying in ${delay}s..."
+              sleep "$delay"
+            fi
+          done
+          echo "::error::Failed to install @augmentcode/auggie@${VERSION} after $max_attempts attempts"
+          exit 1
 
       - name: Create entry point
         run: |