From 93be76d8697fcc0af883823ba2b22d26fbd852ae Mon Sep 17 00:00:00 2001 From: Keith Fleming <248089218+keith-mvs@users.noreply.github.com> Date: Thu, 4 Jun 2026 11:03:12 -0600 Subject: [PATCH 1/3] fix(run): resolve bundled binary on Windows Git Bash / MSYS2 / Cygwin The launcher derives the platform from `uname -s` lowercased, which under Git Bash / MSYS2 / Cygwin is `mingw64_nt-` (e.g. mingw64_nt-10.0-26200), not `windows`. It then probes `bin/lumen` and `bin/lumen-${OS}-${ARCH}` with no `.exe` suffix, so it never matches the shipped `bin/lumen-windows-amd64.exe` and falls through to a GitHub download for a non-existent `lumen--mingw64_nt-...-amd64` asset. The download 404s and the PreToolUse (Grep|Bash) hook exits non-zero on every tool call. Normalize mingw*/msys*/cygwin* to `windows` and append the `.exe` suffix to the binary candidates (and the download fallback path) so the bundled Windows binary resolves with no download attempted. Tested under Git Bash on Windows 11: `scripts/run version` prints the version with no download, and `hook pre-tool-use` exits 0. Signed-off-by: Keith Fleming <248089218+keith-mvs@users.noreply.github.com> Co-Authored-By: Claude Opus 4.8 (1M context) --- scripts/run | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/scripts/run b/scripts/run index b0bda40..d569d9e 100755 --- a/scripts/run +++ b/scripts/run @@ -14,11 +14,20 @@ case "$ARCH" in aarch64) ARCH="arm64" ;; esac +# Normalize Windows-flavored uname. Git Bash/MSYS2/Cygwin report uname -s as +# mingw*/msys*/cygwin* (and embed the Windows build number), not "windows", and +# their binaries carry a .exe suffix. Without this the loop below misses the +# bundled bin/lumen-windows-amd64.exe and falls through to a doomed download. +EXT="" +case "$OS" in + mingw*|msys*|cygwin*|windows*) OS="windows"; EXT=".exe" ;; +esac + # Find binary: check bin/ first, then goreleaser dist/ output, then download BINARY="" for candidate in \ - "${PLUGIN_ROOT}/bin/lumen" \ - "${PLUGIN_ROOT}/bin/lumen-${OS}-${ARCH}"; do + "${PLUGIN_ROOT}/bin/lumen${EXT}" \ + "${PLUGIN_ROOT}/bin/lumen-${OS}-${ARCH}${EXT}"; do if [ -x "$candidate" ]; then BINARY="$candidate" break @@ -27,7 +36,7 @@ done # Download on first run if no binary found if [ -z "$BINARY" ]; then - BINARY="${PLUGIN_ROOT}/bin/lumen-${OS}-${ARCH}" + BINARY="${PLUGIN_ROOT}/bin/lumen-${OS}-${ARCH}${EXT}" REPO="ory/lumen" From f972ac9f1b09b6954a2c5459439a4924a20b4e96 Mon Sep 17 00:00:00 2001 From: Keith Fleming <248089218+keith-mvs@users.noreply.github.com> Date: Thu, 4 Jun 2026 16:43:38 -0600 Subject: [PATCH 2/3] ci: pin ollama/ollama to 0.24.0 for reproducible embedding snapshots MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The E2E job's lang suite (TestLang_*) compares committed embedding snapshots in testdata/snapshots/. Those rankings are produced by all-minilm via the Ollama runtime, which the workflow pulled as `ollama/ollama:latest`. Between the last green main run (2026-05-20) and 2026-06-04 the `:latest` tag advanced from 0.24.0 to a newer build, changing the embedding vectors and breaking every snapshot. This is unrelated to the scripts/run change in this PR and would also fail on main if re-run. Pin the service image to 0.24.0 (digest sha256:a6149234667efc71d37766d61c1a16f24c33e4cd7a0bf4125c44a7e47e2419c4) — the last runtime the snapshots were verified green against — so the suite is reproducible. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2b6f948..a5dada0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -72,7 +72,14 @@ jobs: if: github.actor != 'release-please[bot]' services: ollama: - image: ollama/ollama:latest + # Pin the embedding runtime. The lang E2E suite (TestLang_*) asserts on + # committed embedding snapshots (testdata/snapshots/), so all-minilm must + # return identical vectors run-to-run. The `:latest` tag drifted from + # 0.24.0 to a newer build between 2026-05-20 and 2026-06-04, which shifted + # the ranked results and broke every snapshot. 0.24.0 is the last runtime + # the snapshots were verified green against (== digest + # sha256:a6149234667efc71d37766d61c1a16f24c33e4cd7a0bf4125c44a7e47e2419c4). + image: ollama/ollama:0.24.0 ports: - 11434:11434 steps: From a06abaa23ee98999fe275b16be2166a18523b2d3 Mon Sep 17 00:00:00 2001 From: Keith Fleming <248089218+keith-mvs@users.noreply.github.com> Date: Thu, 4 Jun 2026 20:09:48 -0600 Subject: [PATCH 3/3] ci: clarify pinned ollama digest is the multi-arch index digest The annotated digest (sha256:a614...19c4) is the multi-arch manifest-list (index) digest for the 0.24.0 tag -- the value `docker pull` resolves the tag to -- not a per-architecture child manifest (amd64 7db82c93..., arm64 32f9c389...). Word the comment so the digest isn't misread as a per-arch image digest. Comment-only change; the image is still pinned by tag. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a5dada0..fe1cc6d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -77,7 +77,8 @@ jobs: # return identical vectors run-to-run. The `:latest` tag drifted from # 0.24.0 to a newer build between 2026-05-20 and 2026-06-04, which shifted # the ranked results and broke every snapshot. 0.24.0 is the last runtime - # the snapshots were verified green against (== digest + # the snapshots were verified green against (== the multi-arch index + # digest that `docker pull` resolves the 0.24.0 tag to: # sha256:a6149234667efc71d37766d61c1a16f24c33e4cd7a0bf4125c44a7e47e2419c4). image: ollama/ollama:0.24.0 ports: