chore: merge develop into main for v2.1.0

.github/workflows/beta-release.yml

@@ -23,7 +23,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Determine beta version
         id: version
@@ -80,7 +80,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: ./.github/actions/setup-toolchain
 
@@ -205,7 +205,7 @@ jobs:
           echo "linux_arm64=$(sha256sum artifacts/vibe-linux-arm64 | cut -d ' ' -f 1)" >> $GITHUB_OUTPUT
           echo "linux_x64=$(sha256sum artifacts/vibe-linux-x64 | cut -d ' ' -f 1)" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: vibe-source
 

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-toolchain
       - uses: ./.github/actions/setup-takumi-guard
         with:
@@ -46,7 +46,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-toolchain
       - name: Check formatting
         working-directory: rust
@@ -87,7 +87,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-toolchain
       - name: Add Rust target
         run: rustup target add ${{ matrix.target }}
@@ -132,7 +132,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-toolchain
       - uses: ./.github/actions/setup-takumi-guard
         with:
@@ -178,7 +178,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-toolchain
 
       - uses: ./.github/actions/setup-takumi-guard
@@ -268,7 +268,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-toolchain
 
       - name: Read version
@@ -416,7 +416,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-toolchain
       - uses: ./.github/actions/setup-takumi-guard
         with:
@@ -440,7 +440,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-toolchain
       - run: pinact run --check
 
@@ -462,7 +462,7 @@ jobs:
       # every commit in the range (not just the tip), catching a secret added in
       # an intermediate commit even if a later commit removes it. On push it
       # scans the full history of the pushed ref.
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       # Why the official action instead of the dev-shell gitleaks via a plain

.github/workflows/docs.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup toolchain
         uses: ./.github/actions/setup-toolchain

.github/workflows/nix.yml

@@ -36,7 +36,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/publish-npm.yml

@@ -41,7 +41,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Resolve release tag and enforce stable-release gate
         id: meta
@@ -92,7 +92,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: ./.github/actions/setup-toolchain
 
@@ -129,7 +129,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: ./.github/actions/setup-toolchain
 
@@ -178,7 +178,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: ./.github/actions/setup-toolchain
 
@@ -296,7 +296,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: ./.github/actions/setup-toolchain
 

.github/workflows/release.yml

@@ -54,7 +54,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: ./.github/actions/setup-toolchain
 
@@ -144,7 +144,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: ./.github/actions/setup-toolchain
 
@@ -207,7 +207,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: ./.github/actions/setup-toolchain
 
@@ -255,7 +255,7 @@ jobs:
           merge-multiple: true
 
       - name: Create Release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           files: artifacts/*
           generate_release_notes: true
@@ -294,7 +294,7 @@ jobs:
             echo "template=vibe.rb" >> $GITHUB_OUTPUT
           fi
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: vibe-source
 
@@ -380,104 +380,3 @@ jobs:
 
           git commit -m "Update ${FORMULA_NAME} to $VERSION"
           git push --quiet https://x-access-token:${GH_TOKEN}@github.com/kexi/homebrew-tap.git HEAD:main
-
-  update-nix:
-    if: github.event.action == 'released'
-    needs: release
-    runs-on: ubuntu-latest
-    concurrency:
-      group: update-nix
-      cancel-in-progress: false
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          ref: develop
-          # PAT (not GITHUB_TOKEN) so gh pr create is not blocked by the
-          # repo-level "Allow GitHub Actions to create pull requests" setting.
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-
-      - name: Download artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          path: artifacts
-          merge-multiple: true
-
-      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
-
-      - name: Calculate SRI hashes
-        id: hashes
-        run: |
-          for file in darwin-arm64 darwin-x64 linux-arm64 linux-x64; do
-            raw=$(sha256sum "artifacts/vibe-${file}" | cut -d ' ' -f 1)
-            sri=$(nix hash convert --hash-algo sha256 --to sri "$raw")
-
-            # Validate SRI hash format
-            if ! echo "$sri" | grep -qE '^sha256-[A-Za-z0-9+/=]{43,44}$'; then
-              echo "Error: Invalid SRI hash format for vibe-${file}: $sri"
-              exit 1
-            fi
-
-            key=$(echo "$file" | tr '-' '_')
-            echo "${key}=${sri}" >> "$GITHUB_OUTPUT"
-          done
-
-      - name: Update flake.nix binary hashes
-        id: version
-        run: |
-          VERSION="${GITHUB_REF_NAME#v}"
-
-          # Validate version format (bash built-in to prevent newline bypass)
-          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
-            echo "Error: Invalid version format: $VERSION"
-            exit 1
-          fi
-          echo "value=$VERSION" >> "$GITHUB_OUTPUT"
-
-          # flake.nix derives `version` from package.json, so there is no version
-          # line to bump here. Only the prebuilt-binary SRI hashes need updating,
-          # and they are unknowable until the release assets exist (post-tag) —
-          # that is why this job runs after release rather than in the release PR.
-          # Anchor each replace on its artifact name so the pnpm/native version
-          # pins are never touched (a blanket s/version = ".*"/ once clobbered all
-          # three and broke the source build).
-          sed -i '/vibe-linux-x64/,/};/s|hash = ".*"|hash = "${{ steps.hashes.outputs.linux_x64 }}"|' flake.nix
-          sed -i '/vibe-linux-arm64/,/};/s|hash = ".*"|hash = "${{ steps.hashes.outputs.linux_arm64 }}"|' flake.nix
-          sed -i '/vibe-darwin-x64/,/};/s|hash = ".*"|hash = "${{ steps.hashes.outputs.darwin_x64 }}"|' flake.nix
-          sed -i '/vibe-darwin-arm64/,/};/s|hash = ".*"|hash = "${{ steps.hashes.outputs.darwin_arm64 }}"|' flake.nix
-
-      - name: Update flake.lock
-        run: nix flake lock --update-input nixpkgs --update-input flake-utils
-
-      - name: Verify build
-        run: nix build && ./result/bin/vibe --help
-
-      - name: Open PR and merge
-        env:
-          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-        run: |
-          VERSION="${{ steps.version.outputs.value }}"
-          # Suffix with run_id and run_attempt so re-runs and concurrent releases
-          # never collide on an existing remote branch.
-          BRANCH="chore/update-nix-flake-${VERSION}-${{ github.run_id }}-${{ github.run_attempt }}"
-
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git checkout -b "$BRANCH"
-          git add flake.nix flake.lock
-          git commit -m "chore: update Nix flake to ${VERSION}"
-          git push --quiet origin "$BRANCH"
-
-          gh pr create \
-            --base develop \
-            --head "$BRANCH" \
-            --title "chore: update Nix flake to ${VERSION}" \
-            --body "Automated update of \`flake.nix\` and \`flake.lock\` for v${VERSION}."
-
-          # --admin bypasses develop's branch-protection policy, which otherwise
-          # rejects this bot merge ("base branch policy prohibits the merge").
-          gh pr merge "$BRANCH" --merge --admin --delete-branch

CONTRIBUTING.md

@@ -138,6 +138,39 @@ See [AGENTS.md](./AGENTS.md) for detailed branching workflow.
    gh release create vX.X.X --generate-notes
    ```
 
+5. **Update Nix binary hashes, if needed:**
+
+   The default Nix package builds from source. The prebuilt binary fast path
+   (`#binary`) needs `flake.nix` hashes that match the final GitHub Release
+   assets, so update those hashes only after the release workflow uploads the
+   assets.
+
+   ```fish
+   set -l version X.X.X
+   mkdir -p artifacts
+   gh release download "v$version" --pattern 'vibe-*' --dir artifacts
+
+   for file in darwin-arm64 darwin-x64 linux-arm64 linux-x64
+     set -l sri (nix hash file --type sha256 --sri "artifacts/vibe-$file")
+     printf "%s %s\n" "$file" "$sri"
+   end
+   ```
+
+   Copy the SRI hashes into the matching `platforms.*.hash` entries in
+   `flake.nix`, then verify and open a PR against `develop`:
+
+   ```fish
+   nix build .#binary; and ./result/bin/vibe --help
+   git checkout -b chore/update-nix-binary-hashes-vX.X.X
+   git add flake.nix
+   git commit -m "chore: update Nix binary hashes for X.X.X"
+   git push -u origin chore/update-nix-binary-hashes-vX.X.X
+   gh pr create --base develop --title "chore: update Nix binary hashes for X.X.X" --body "Updates flake.nix binary hashes for vX.X.X release assets."
+   ```
+
+   Do not update `flake.lock` as part of the release. Update `nixpkgs` and
+   `flake-utils` in a separate maintenance PR when needed.
+
 ### Automated Release Tasks
 
 When a release is created, GitHub Actions automatically:

docs/architecture.ja.md

@@ -8,7 +8,7 @@
 
 ## ランタイム抽象化レイヤー
 
-Vibe はランタイム抽象化レイヤーを通じて、複数の JavaScript ランタイム（Deno と Node.js）をサポートしています。
+TypeScript 時代の実装では、Vibe はランタイム抽象化レイヤーを通じて、複数の JavaScript ランタイム（Deno と Node.js）をサポートしていました。現在の実装は単一の Rust バイナリであり、Deno はサポートしていません。
 
 ```mermaid
 flowchart TD
@@ -76,7 +76,7 @@ Vibe はゴミ箱サポート付きの高速ディレクトリ削除を提供し
 
 ```mermaid
 flowchart TD
-    A[fastRemoveDirectory] --> B{Native Trash Available?}
+    A[fast_remove_directory] --> B{Native Trash Available?}
     B -->|Yes| C[Native Trash Module]
     B -->|No| D{macOS?}
 
@@ -98,8 +98,8 @@ flowchart TD
 
 | 方法                    | プラットフォーム              | 説明                                                       |
 | ----------------------- | ----------------------------- | ---------------------------------------------------------- |
-| Native Trash            | Node.js（全プラットフォーム） | trash crate を使用した @kexi/vibe-native                   |
-| AppleScript             | Deno on macOS                 | osascript 経由の Finder フォールバック                     |
+| Native Trash            | Rust バイナリ                | trash crate を使用                                          |
+| AppleScript             | macOS の Rust バイナリ        | osascript 経由の Finder フォールバック                     |
 | /tmp + Background       | Linux（デスクトップなし）     | /tmp に移動後、バックグラウンドで削除                      |
 | Parent Dir + Background | クロスデバイス                | ネットワークマウント用の同一ファイルシステムフォールバック |