Add native Windows and Linux releases

.github/workflows/release-desktop.yml

@@ -0,0 +1,158 @@
+name: Desktop release
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: desktop-release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: ${{ matrix.name }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: macOS Apple Silicon
+            os: macos-14
+            platform: macos
+          - name: Windows x64
+            os: windows-latest
+            platform: windows
+          - name: Linux x86_64
+            os: ubuntu-22.04
+            platform: linux
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Install Linux desktop dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            build-essential \
+            curl \
+            file \
+            libappindicator3-dev \
+            librsvg2-dev \
+            libssl-dev \
+            libwebkit2gtk-4.1-dev \
+            patchelf \
+            pkg-config \
+            wget
+
+      - name: Install JavaScript dependencies
+        run: npm ci
+
+      - name: Build pinned SilverScript compilers
+        run: npm run setup:silverc
+
+      - name: Build pinned local preflight engine
+        run: npm run setup:kascov-preflight
+
+      - name: Verify application and native helpers
+        run: npm run verify
+
+      - name: Build macOS DMG
+        if: matrix.platform == 'macos'
+        env:
+          APPLE_SIGNING_IDENTITY: '-'
+        run: npm run desktop:build -- --bundles dmg
+
+      - name: Stage macOS artifact
+        if: matrix.platform == 'macos'
+        shell: bash
+        run: |
+          version="$(node -p "require('./package.json').version")"
+          artifact="$(find src-tauri/target/release/bundle/dmg -name '*.dmg' -print -quit)"
+          test -n "$artifact"
+          mkdir -p release-assets
+          cp "$artifact" "release-assets/Kaspa-SilverScript-Studio-${version}-macos-arm64.dmg"
+
+      - name: Build Windows installers
+        if: matrix.platform == 'windows'
+        run: npm run desktop:build -- --bundles nsis,msi
+
+      - name: Stage Windows artifacts
+        if: matrix.platform == 'windows'
+        shell: pwsh
+        run: |
+          $version = node -p "require('./package.json').version"
+          $msi = Get-ChildItem "src-tauri/target/release/bundle/msi" -Filter "*.msi" | Select-Object -First 1
+          $setup = Get-ChildItem "src-tauri/target/release/bundle/nsis" -Filter "*-setup.exe" | Select-Object -First 1
+          if (-not $msi -or -not $setup) { throw "Windows MSI or NSIS installer is missing" }
+          New-Item -ItemType Directory -Force -Path "release-assets" | Out-Null
+          Copy-Item $msi.FullName "release-assets/Kaspa-SilverScript-Studio-$version-windows-x64.msi"
+          Copy-Item $setup.FullName "release-assets/Kaspa-SilverScript-Studio-$version-windows-x64-setup.exe"
+
+      - name: Build Linux packages
+        if: matrix.platform == 'linux'
+        run: npm run desktop:build -- --bundles deb,appimage
+
+      - name: Stage Linux artifacts
+        if: matrix.platform == 'linux'
+        shell: bash
+        run: |
+          version="$(node -p "require('./package.json').version")"
+          deb="$(find src-tauri/target/release/bundle/deb -name '*.deb' -print -quit)"
+          appimage="$(find src-tauri/target/release/bundle/appimage -name '*.AppImage' -print -quit)"
+          test -n "$deb"
+          test -n "$appimage"
+          mkdir -p release-assets
+          cp "$deb" "release-assets/Kaspa-SilverScript-Studio-${version}-linux-amd64.deb"
+          cp "$appimage" "release-assets/Kaspa-SilverScript-Studio-${version}-linux-x86_64.AppImage"
+          chmod +x "release-assets/Kaspa-SilverScript-Studio-${version}-linux-x86_64.AppImage"
+
+      - name: Record artifact hashes
+        run: node scripts/write-release-checksums.mjs release-assets "${{ matrix.platform }}"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: desktop-${{ matrix.platform }}
+          path: release-assets/*
+          if-no-files-found: error
+
+  release:
+    name: Publish GitHub Release
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: build
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: desktop-*
+          path: release-assets
+          merge-multiple: true
+
+      - name: Create release and upload native packages
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          notes="docs/releases/${GITHUB_REF_NAME}.md"
+          test -f "$notes"
+          gh release create "$GITHUB_REF_NAME" release-assets/* \
+            --repo "$GITHUB_REPOSITORY" \
+            --verify-tag \
+            --latest \
+            --title "Kaspa SilverScript Studio ${GITHUB_REF_NAME}" \
+            --notes-file "$notes"

CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.2.1 — 2026-08-07
+
+- Added native Windows x64 and Linux x86_64 desktop build and release pipelines alongside macOS Apple Silicon.
+- Replaced Bash-only helper builds with portable Node.js scripts and added Windows `.exe` runtime wiring for `silverc` and `kascov-preflight`.
+- Removed the installed application's Python dependency by porting heuristic contract triage to built-in JavaScript.
+- Added target-OS tests, native helper verification, platform packages, and SHA-256 release manifests.
+
+## 0.2.1 — 2026-08-07（中文）
+
+- 在 macOS Apple Silicon 之外增加 Windows x64 与 Linux x86_64 原生桌面构建和发布流程。
+- 将仅支持 Bash 的辅助工具构建改为跨平台 Node.js 脚本，并补齐 Windows 下 `silverc` 与 `kascov-preflight` 的 `.exe` 运行时路径。
+- 将轻量契约扫描移植到内置 JavaScript，移除安装后应用对 Python 的依赖。
+- 增加目标操作系统测试、原生辅助工具验证、平台安装包和 SHA-256 发布清单。
+
 ## 0.2.0 — 2026-08-06
 
 - Upgraded the default pinned official SilverScript compiler to `4b0e1cd69739934f92c3ac4df1bb13d912418b2b`; retained `2a3961c` as a SHA-256-pinned legacy reproducibility profile.

README.md

@@ -90,7 +90,7 @@ cd kaspa-silverscript-studio
 npm ci
 ```
 
-首次运行需要在当前系统构建固定版本的两个原生工具：
+首次运行需要在当前系统构建固定版本的两个原生工具。以下命令由 Node.js 驱动，可直接用于 macOS、Windows 和 Linux：
 
 ```bash
 npm run setup:silverc
@@ -149,9 +149,9 @@ npm run desktop:build
 - 固定版本本地预检引擎。
 - Kaspa WASM、契约模板、知识库和第三方许可证。
 
-原生安装包应在对应系统上构建和测试。macOS、Windows 和 Linux 的二进制不能互相替代，公开发行前还需要完成各平台的代码签名。当前 GitHub Release 提供经过验证的 macOS Apple Silicon 构建；Windows 和 Linux 安装包在完成对应平台验证后发布。
+原生安装包必须在对应系统上构建和测试，macOS、Windows 和 Linux 的二进制不能互相替代。v0.2.1 发布流程在原生 GitHub Runner 上分别生成 macOS Apple Silicon DMG、Windows x64 NSIS/MSI，以及 Linux x86_64 DEB/AppImage，并附带 SHA-256 校验文件。
 
-> Windows 状态：当前原生辅助工具安装脚本仍使用 Bash 和 Unix 无后缀文件名，Windows `.exe` 路径尚未完成发行验证。完成对应修复和 Windows Runner 验证前，请不要把当前源码描述为已经验证的 Windows 发行版。
+公开包目前没有商业代码签名：macOS 使用 ad-hoc 签名且未公证，Windows 未进行 Authenticode 签名，Linux 未进行发行版签名。首次启动可能出现系统安全提示；请只从本仓库 Release 下载并核对 SHA-256。
 
 ### 自动语言识别
 
@@ -336,7 +336,7 @@ cd kaspa-silverscript-studio
 npm ci
 ```
 
-Build the two pinned native tools for the current platform:
+Build the two pinned native tools for the current platform. These Node.js-driven commands run directly on macOS, Windows, and Linux:
 
 ```bash
 npm run setup:silverc
@@ -375,9 +375,9 @@ npm run desktop:build
 
 The desktop bundle contains the frontend, local Node.js sidecar, pinned `silverc`, pinned local preflight engine, Kaspa WASM, templates, knowledge resources, and third-party license notices.
 
-Build and test native installers on their target operating systems. macOS, Windows, and Linux binaries are not interchangeable, and public releases require platform-appropriate code signing. The current GitHub Release contains a verified macOS Apple Silicon build; Windows and Linux installers will be published after target-platform verification.
+Native installers must be built and tested on their target operating systems; macOS, Windows, and Linux binaries are not interchangeable. The v0.2.1 release pipeline produces a macOS Apple Silicon DMG, Windows x64 NSIS/MSI packages, and Linux x86_64 DEB/AppImage packages on native GitHub Runners, with SHA-256 checksum files.
 
-> Windows status: the current native-helper setup scripts still use Bash and extensionless Unix paths. Windows `.exe` wiring has not completed release validation. Do not present the current source as a verified Windows release until that adaptation and Windows Runner verification are complete.
+The public packages are not commercially code-signed: macOS is ad-hoc signed and not notarized, Windows is not Authenticode-signed, and Linux is not distribution-signed. The operating system may show a warning on first launch. Download only from this repository's Releases and verify the SHA-256 checksum.
 
 ### Automatic language selection
 

docs/releases/v0.2.1.md

@@ -0,0 +1,51 @@
+## Kaspa SilverScript Studio v0.2.1
+
+This cross-platform release adds native Windows x64 and Linux x86_64 packages while retaining the macOS Apple Silicon build.
+
+### Cross-platform changes
+
+- Replaced Bash-only native-helper setup with Node.js build scripts for macOS, Windows, and Linux.
+- Added native `.exe` discovery and runtime wiring for both pinned SilverScript compilers and the local Kascov preflight engine on Windows.
+- Added explicit preflight-engine injection to the Tauri sidecar environment.
+- Replaced the Python-dependent heuristic contract scan with an equivalent built-in JavaScript implementation, so installed desktop builds do not require Python.
+- Added native GitHub Runner builds and verification for macOS Apple Silicon, Windows x64, and Linux x86_64.
+
+### Packages
+
+- macOS Apple Silicon: DMG, ad-hoc signed and not Apple-notarized.
+- Windows x64: NSIS setup executable and MSI package, not Authenticode-signed.
+- Linux x86_64: DEB package and AppImage, not distribution-signed.
+- SHA-256 checksum files are included for all platforms.
+
+### Verification boundary
+
+Each package is built on its target operating system only after syntax checks, automated tests, production frontend compilation, pinned native-helper compilation, and realistic SilverScript template compilation succeed.
+
+SilverScript and the KCC721 pack remain experimental. TN10 is recommended. KCC721 standalone and mainnet deployment remain blocked. Passing compilation and preflight tests is not an independent security audit.
+
+---
+
+## 中文说明
+
+本次跨平台版本在保留 macOS Apple Silicon 构建的同时，增加 Windows x64 和 Linux x86_64 原生安装包。
+
+### 跨平台改进
+
+- 将仅支持 Bash 的原生辅助工具构建流程改为兼容 macOS、Windows 和 Linux 的 Node.js 脚本。
+- 为 Windows 补齐两个固定版本 SilverScript 编译器和本地 Kascov 预检引擎的 `.exe` 识别与运行时路径。
+- Tauri sidecar 现在会显式传入本地预检引擎路径。
+- 将依赖 Python 的轻量契约扫描改为等价的内置 JavaScript 实现，安装后的桌面应用不再要求用户安装 Python。
+- 增加 macOS Apple Silicon、Windows x64 和 Linux x86_64 原生 GitHub Runner 构建与验证。
+
+### 安装包
+
+- macOS Apple Silicon：DMG，采用 ad-hoc 签名，未进行 Apple 公证。
+- Windows x64：NSIS 安装程序和 MSI，未进行 Authenticode 签名。
+- Linux x86_64：DEB 和 AppImage，未进行发行版签名。
+- 三个平台均提供 SHA-256 校验文件。
+
+### 验证边界
+
+每个平台仅在语法检查、自动化测试、前端生产构建、固定原生辅助工具编译和真实 SilverScript 模板编译全部成功后生成安装包。
+
+SilverScript 与 KCC721 实验包仍处于实验阶段，推荐使用 TN10。KCC721 普通单合约部署和主网部署仍保持禁用。成功编译和预检测试不等于独立安全审计。

native/kascov-preflight-main.rs

@@ -5,13 +5,43 @@
 //! stdin and writes a single JSON report to stdout. It never connects to a
 //! node, reads keys, broadcasts, or persists input.
 
-#[path = "../preflight.rs"]
+#[path = "preflight.rs"]
 mod preflight;
 
-use kascov_core::Network;
+use std::fmt;
 use std::io::{self, Read};
 use std::str::FromStr;
 
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Network {
+    Mainnet,
+    Testnet(u32),
+}
+
+impl fmt::Display for Network {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Mainnet => formatter.write_str("mainnet"),
+            Self::Testnet(suffix) => write!(formatter, "testnet-{suffix}"),
+        }
+    }
+}
+
+impl FromStr for Network {
+    type Err = String;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "mainnet" => Ok(Self::Mainnet),
+            _ => value
+                .strip_prefix("testnet-")
+                .and_then(|suffix| suffix.parse().ok())
+                .map(Self::Testnet)
+                .ok_or_else(|| format!("invalid network: {value}")),
+        }
+    }
+}
+
 fn main() {
     if let Err(error) = run() {
         eprintln!("{error}");

package.json

@@ -1,6 +1,6 @@
 {
   "name": "kaspa-silverscript-studio",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": true,
   "type": "module",
   "description": "Local bilingual AI-assisted SilverScript contract studio for Kaspa",
@@ -10,8 +10,8 @@
     "start": "node server/index.mjs",
     "check": "node scripts/check-syntax.mjs",
     "test": "node --test",
-    "setup:silverc": "bash scripts/build-silverc.sh",
-    "setup:kascov-preflight": "bash scripts/build-kascov-preflight.sh",
+    "setup:silverc": "node scripts/build-silverc.mjs",
+    "setup:kascov-preflight": "node scripts/build-kascov-preflight.mjs",
     "verify": "npm run check && npm test && npm run build",
     "desktop:prepare": "npm run build && node scripts/prepare-desktop-runtime.mjs",
     "desktop:dev": "tauri dev",