[tyrannyme]

Gets Minv ready for a full 1.0 release. The release page gets Linux .deb, .rpm and AppImage packages next to the archive, plus a Windows installer and zip. Review findings are fixed, and the site and README are updated.

Release assets

Platform	Asset	Adds minv to the terminal
Debian, Ubuntu	minv-linux-x64.deb	yes (/usr/bin/minv)
Fedora, RHEL, openSUSE	minv-linux-x64.rpm	yes (/usr/bin/minv)
Any Linux	minv-linux-x64.AppImage, minv-linux-x64.tar.gz	no (README shows an ln -s)
Windows 10/11	minv-win32-x64-setup.exe (per-user, no admin)	yes ("Add to PATH" is on by default)
Windows, portable	minv-win32-x64.zip	no

All assets are covered by one SHA256SUMS. Pushing v<version> builds both platforms, runs every install test, and publishes.

Installers

• npm run package now builds minv-linux-x64.tar.gz, .deb and .rpm, plus one SHA256SUMS. The asset names don't include a version, so releases/latest/download/<asset> always points at the newest release, and the site and README never need a version edit.
• The packages use upstream's gulp deb/rpm tasks with Minv-owned templates in fork/overlay/resources/linux. This matters because upstream's deb postinst silently added Microsoft's apt repo and signing key, and its postrm deleted them, which would break a real VS Code install. The new desktop entry, AppStream data and package descriptions are Minv's.
• Patch 0009-linux-packages: the packages carry Minv's version (1.0.0), not Code-OSS's. It also drops the Microsoft debconf question, and stops failing on the missing tunnel binary or on dependency-list drift (drift is still reported).
• glibc: CI now builds native modules the way upstream does, with Chromium's clang against the glibc 2.28 sysroot. The 0.1.0 build needed whatever glibc the runner had (2.39), so it wouldn't run on Ubuntu 22.04 or Debian 12. A new CI step fails if anything shipped needs more than 2.28.
• CI install tests: CI installs the .deb on the Ubuntu runner and launches it, installs the .rpm in a Fedora container, and launches the AppImage. The release body gets an install table.

Windows

• App identity: Minv has its own Windows AppIds; it was inheriting Code-OSS's, so its installer would have clashed with a Code-OSS install. The icon and installer artwork are generated from media/brand/minv.svg.
• Patch 0010-windows: replaces Microsoft's publisher, URLs and exe metadata. It also tolerates a missing signtool, since Minv's builds are unsigned.
• CI: runs on windows-2022, because upstream's build only accepts Visual Studio 2019 or 2022. It checks upstream out with LF line endings so the patches apply, installs the setup silently, and opens the app.

AppImage

• AppRun starts Electron directly. Going through the bin/minv CLI would hand off and exit, which unmounts the AppImage.
• Sandbox: AppRun drops the sandbox only where unprivileged user namespaces are unavailable or blocked by AppArmor (Ubuntu 24.04+).
• Tooling: appimagetool is pinned to 1.9.1 and its checksum is verified.

Fixes from the review (three subagents: tooling/CI, in-app leaks, site/docs)

• Extensions view: File › Preferences, the Manage menu and Ctrl+Shift+X still opened the hidden Extensions view. Those entry points are gone (Manage menu below).
• Source maps: CI builds linked to Microsoft's source-map CDN (useCdnSourceMapsForPackagingTasks). They no longer do.
• Dead keys: three configurationDefaults and three theme colors named keys that don't exist. The two SCM graph colors now use the real scmGraph.* ids.
• Release workflow: the tag/version check ran only after the full 60-minute build. It now runs first, and package.json is 1.0.0.
• Smoke test: it ignored the capture script's exit code because the pipe to tee had no pipefail. All steps now run with shell: bash.
• fork-capture:
  • It could hang until the CI timeout if the renderer died. Requests now time out, and a closed socket fails them.
  • It left a profile (~500 MB in total) and an xvfb-run temp dir behind on every run. Both are cleaned up now.
  • It reported "painted" even when the workbench never painted.
• fork-prepare: it now fetches again when the pin changes or an earlier fetch was interrupted.
• Archive: the tarball is reproducible (commit mtime, gzip -n). Unused config was dropped.
• Site:
  • Download links point at latest/download, with buttons for .deb, .rpm and .tar.gz.
  • Visible keyboard focus, and correct tab focus order.
  • Canonical and og tags, noindex on the 404 page, and security headers.

Tested locally (Fedora 44)

• Built the app, packaged tar and rpm, and installed the .rpm in a clean fedora:latest container: minv-1.0.0-1, /usr/bin/minv, desktop entry and no repo files.
• Drove the packaged app under Xvfb: Source Control, Markdown preview, the terminal and the Manage menu.
• The .deb can't be built on Fedora (no dpkg-deb). CI builds it and tests the install.
• CI (all green):
  • The highest glibc symbol in the shipped binaries is 2.28. The .deb is version 1.0.0 and requires libc6 (>= 2.28).
  • Every launch (archive, .deb, AppImage, Windows install) paints the workbench and shows main in the status bar.

Source Control	Markdown preview

CI smoke screenshots, taken from the installed packages:

Windows (installed from setup.exe)	Ubuntu (.deb)	AppImage

Manage menu, now without Extensions: Command Palette… · Profiles · Settings · Keyboard Shortcuts · Snippets · Tasks · Themes

Site install section:

After merging, push v1.0.0 to publish the release. The site deploys separately: cd site && wrangler deploy.