Fix Windows release archive validation

.github/workflows/quality.yml

@@ -105,6 +105,12 @@ jobs:
       - name: Run Windows Clippy
         run: cargo clippy --locked --all-targets -- -D warnings
 
+      - name: Check reproducible CLI packages on Windows
+        shell: bash
+        env:
+          PYTHON_BIN: python
+        run: bash tests/package_cli_reproducibility.sh
+
       - name: Test Windows development installation
         shell: bash
         run: bash tests/dev_install_windows_smoke.sh

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "chat2db"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2024"
 rust-version = "1.88"
 description = "Official command-line interface for Chat2DB Community, Pro, and Local"

scripts/package-cli.sh

@@ -207,28 +207,26 @@ else:
     raise SystemExit(f"error: unsupported archive type: {archive_type}")
 PY
 
-archive_contents="$("$PYTHON_BIN" - "$REPO_ROOT/dist/$ARCHIVE_NAME" "$ARCHIVE_TYPE" <<'PY'
+"$PYTHON_BIN" - "$REPO_ROOT/dist/$ARCHIVE_NAME" "$ARCHIVE_TYPE" "$BINARY_NAME" <<'PY'
 import sys
 import tarfile
 import zipfile
 
-path, archive_type = sys.argv[1], sys.argv[2]
+path, archive_type, binary_name = sys.argv[1:]
 if archive_type == "zip":
     with zipfile.ZipFile(path) as archive:
-        for name in archive.namelist():
-            print(name)
+        archive_contents = archive.namelist()
 else:
     with tarfile.open(path, "r:gz") as archive:
-        for member in archive.getmembers():
-            print(member.name)
+        archive_contents = [member.name for member in archive.getmembers()]
+
+expected_archive_contents = ["LICENSE", "THIRD_PARTY_LICENSES.txt", binary_name]
+if archive_contents != expected_archive_contents:
+    print("error: non-sanitized archive contents:", file=sys.stderr)
+    for name in archive_contents:
+        print(f"  {name!r}", file=sys.stderr)
+    raise SystemExit(1)
 PY
-)"
-expected_archive_contents="$(printf '%s\n' LICENSE THIRD_PARTY_LICENSES.txt "$BINARY_NAME")"
-if [ "$archive_contents" != "$expected_archive_contents" ]; then
-  echo "error: non-sanitized archive contents:" >&2
-  printf '%s\n' "$archive_contents" >&2
-  exit 1
-fi
 
 # --- compute sha256 ---------------------------------------------------------
 if command -v shasum >/dev/null 2>&1; then

skill/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Skill Changelog
 
+## [0.2.1] - 2026-07-23
+
+- Fixed Windows release archive validation and added native Windows packaging
+  coverage.
+
 ## [0.2.0] - 2026-07-23
 
 - Moved the Chat2DB CLI Skill into the Chat2DB-CLI repository.

skill/SKILL.md

@@ -2,7 +2,7 @@
 name: chat2db-cli
 description: "Operate Chat2DB Community, Pro, and Local through the chat2db CLI: inspect status, manage the app and headless runtime, work with datasources and SQL, configure MCP, manage the Skill, and update the CLI. Use for CLI-driven Chat2DB workflows, not GUI interaction."
 metadata:
-  version: "0.2.0"
+  version: "0.2.1"
   compatible-cli-versions: ">=0.2, <0.3"
 ---
 

skill/references/installation.md

@@ -2,7 +2,7 @@
 
 This file is for installing, updating, and removing the `chat2db` CLI binary and the skill bundle.
 
-The bundled Skill version is `0.2.0` and supports CLI versions
+The bundled Skill version is `0.2.1` and supports CLI versions
 `>=0.2, <0.3`.
 
 ## CLI Binary

tests/dev_install_scripts.sh

@@ -86,7 +86,7 @@ cat > "$CARGO_TARGET_DIR/release/chat2db$suffix" <<SCRIPT
 #!/usr/bin/env bash
 # build-marker: ${CHAT2DB_TEST_BUILD_MARKER:-initial}
 case "\${1:-}" in
-  version) echo "chat2db 0.2.0" ;;
+  version) echo "chat2db 0.2.1" ;;
   completions) exit 0 ;;
   *) exit 0 ;;
 esac
@@ -272,7 +272,7 @@ mkdir -p "$fixture/target/release"
 cat > "$fixture/target/release/chat2db" <<EOF
 #!/usr/bin/env bash
 : > "$stale_build_sentinel"
-echo "chat2db 0.2.0"
+echo "chat2db 0.2.1"
 EOF
 chmod 0755 "$fixture/target/release/chat2db"
 run_combined "$fixture" "$home" "$home/bin" "$home/skill" "$TEST_ROOT/stale-build.log"
@@ -288,7 +288,7 @@ mkdir -p "$fixture/target/dev-install/release"
 cat > "$fixture/target/dev-install/release/chat2db" <<EOF
 #!/usr/bin/env bash
 : > "$stale_dev_sentinel"
-echo "chat2db 0.2.0"
+echo "chat2db 0.2.1"
 EOF
 chmod 0755 "$fixture/target/dev-install/release/chat2db"
 if CHAT2DB_TEST_CARGO_NO_OUTPUT=1 run_combined \
@@ -329,7 +329,7 @@ mkdir -p "$bin_dir"
 cat > "$bin_dir/chat2db" <<EOF
 #!/usr/bin/env bash
 : > "$execution_sentinel"
-echo "chat2db 0.2.0"
+echo "chat2db 0.2.1"
 EOF
 chmod 0755 "$bin_dir/chat2db"
 if run_combined "$fixture" "$home" "$bin_dir" "$skill_target" "$TEST_ROOT/unknown-cli.log"; then
@@ -394,7 +394,7 @@ if run_skill "$fixture" "$home" "$skill_target" "$TEST_ROOT/wrong-skill-provenan
 fi
 assert_contains "$TEST_ROOT/wrong-skill-provenance-version.log" "pass --force"
 run_skill "$fixture" "$home" "$skill_target" "$TEST_ROOT/wrong-skill-provenance-version-force.log" --force
-assert_contains "$skill_sidecar" "version=0.2.0"
+assert_contains "$skill_sidecar" "version=0.2.1"
 
 # Client defaults resolve to the documented Codex and Claude Code locations.
 fixture="$(new_fixture clients)"
@@ -776,7 +776,7 @@ assert_absent "$guard"
 fixture="$(new_fixture version-mismatch)"
 home="$TEST_ROOT/home-version"
 mkdir -p "$home"
-sed -i.bak 's/^version = "0.2.0"$/version = "0.2.1"/' "$fixture/Cargo.toml"
+sed -i.bak 's/^version = "0.2.1"$/version = "0.2.2"/' "$fixture/Cargo.toml"
 rm -f "$fixture/Cargo.toml.bak"
 if run_skill "$fixture" "$home" "$home/skill" "$TEST_ROOT/version-mismatch.log"; then
   fail "Cargo and Skill version mismatch was accepted"