@vantaloom/runtime-linux-x64 0.1.24 → 0.3.6

package/VERSION

@@ -1 +1 @@
-5ce4bec
+532507a

package/cli/config.json

@@ -1,8 +1,9 @@
 {
-  "remote": "https://github.com/Timefiles404/Vantaloom-next",
+  "sourceRoot": "D:\\Projects\\Vantaloom-ui",
+  "remote": "git@github-vantaloom:Timefiles404/Vantaloom-next.git",
   "repo": "Timefiles404/Vantaloom-next",
   "releaseTag": "runtime-latest",
-  "runtimePackage": "@vantaloom/runtime-linux-x64",
+  "runtimePackage": "@vantaloom/runtime-win32-x64",
   "runtimeVersion": "latest",
   "npmRegistry": "https://registry.npmjs.org"
 }

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantaloom/cli",
-  "version": "0.1.24",
+  "version": "0.3.6",
   "private": false,
   "type": "module",
   "description": "Vantaloom local runtime manager.",

package/cli/src/cli.mjs

@@ -1,5 +1,6 @@
 import { execFileSync, spawnSync } from "node:child_process"
 import {
+  appendFileSync,
   chmodSync,
   existsSync,
   mkdirSync,
@@ -20,11 +21,45 @@ const installedConfigPath = path.join(cliRoot, "config.json")
 const defaultReleaseTag = "runtime-latest"
 const defaultRepo = "Timefiles404/Vantaloom-next"
 const defaultNpmRegistry = "https://registry.npmjs.org"
+const fallbackNpmRegistries = [
+  "https://registry.npmmirror.com",
+]
+
+// Inherit strict-ssl=false from npm/npx config, or respect NODE_TLS_REJECT_UNAUTHORIZED.
+// When npm runs us via npx with strict-ssl disabled, it sets npm_config_strict_ssl="false".
+// Also check user .npmrc for strict-ssl=false (common in China behind proxies).
+function shouldDisableTLS() {
+  if (process.env.NODE_TLS_REJECT_UNAUTHORIZED === "0") return true
+  if (process.env.npm_config_strict_ssl === "false") return true
+  if (process.env.npm_config_strict_ssl === "") return true
+  try {
+    const npmrcPath = path.join(os.homedir(), ".npmrc")
+    if (existsSync(npmrcPath)) {
+      const content = readFileSync(npmrcPath, "utf8")
+      if (/^\s*strict-ssl\s*=\s*false/m.test(content)) return true
+    }
+  } catch {}
+  return false
+}
+if (shouldDisableTLS()) {
+  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"
+}
+
+const cliVersion = readJSONIfExists(path.join(cliRoot, "package.json")).version ?? "unknown"
 
 export async function main(argv) {
   const command = argv[0] ?? "help"
   const options = parseOptions(argv.slice(1))
 
+  // --no-strict-ssl flag disables TLS certificate verification for fetch calls
+  if (options.noStrictSsl) {
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"
+  }
+
+  if (command === "install" || command === "update") {
+    console.log(`vantaloom-cli v${cliVersion} (${platformId()})`)
+  }
+
   switch (command) {
     case "install":
       if (options.package) {
@@ -91,6 +126,7 @@ async function installFromSource(options) {
 
   console.log(`${options.update ? "updated" : "installed"} Vantaloom: ${prefix}`)
   console.log(`version: ${version}`)
+  ensureInPath(prefix)
   console.log(`run: ${displayCommand(prefix)} status`)
 }
 
@@ -104,16 +140,19 @@ async function installFromPackage(options) {
 
   console.log(`${options.update ? "updated" : "installed"} Vantaloom: ${prefix}`)
   console.log(`version: ${version}`)
+  ensureInPath(prefix)
   console.log(`run: ${displayCommand(prefix)} status`)
 }
 
 async function packageRuntime(options) {
   const sourceRoot = findSourceRoot(options.source)
+  const targetPlatform = options.target ?? platformId()
   const packageRoot = safeDirectory(
-    options.output ?? path.join(sourceRoot, "artifacts", "packages", `vantaloom-${platformId()}`)
+    options.output ?? path.join(sourceRoot, "artifacts", "packages", `vantaloom-${targetPlatform}`)
   )
   const { platform: builtPlatform, version } = await buildRuntimePackage(sourceRoot, packageRoot, {
     buildWeb: options.buildWeb,
+    target: targetPlatform,
   })
 
   if (options.npmPackage) {
@@ -140,16 +179,22 @@ async function packageRuntime(options) {
 
 async function buildRuntimePackage(sourceRoot, packageRoot, options) {
   const version = gitVersion(sourceRoot)
-  const platform = platformId()
+  const platform = options.target ?? platformId()
   const buildBin = path.join(packageRoot, "bin")
   const buildWeb = path.join(packageRoot, "web")
 
   removeKnownPath(packageRoot, path.dirname(packageRoot))
   mkdirSync(buildBin, { recursive: true })
 
-  buildGo(sourceRoot, buildBin, "vantaloom-api")
-  buildGo(sourceRoot, buildBin, "vantaloom-agent")
-  buildGo(sourceRoot, buildBin, "vantaloomctl")
+  buildGo(sourceRoot, buildBin, "vantaloom-api", platform)
+  buildGo(sourceRoot, buildBin, "vantaloom-agent", platform)
+  buildGo(sourceRoot, buildBin, "vantaloomctl", platform)
+  // Tray app requires CGO (systray), only buildable natively on Windows.
+  if (platform.startsWith("win32") && process.platform === "win32") {
+    try {
+      buildGo(sourceRoot, buildBin, "vantaloom-tray", platform)
+    } catch { /* optional: skip if systray build fails */ }
+  }
 
   if (options.buildWeb) {
     runPnpm(["--filter", "vantaloom-app", "build"], { cwd: sourceRoot })
@@ -178,15 +223,49 @@ async function applyPackage(packageRoot, prefix, options) {
     spawnSync(existingCtl, ["stop", "--prefix", prefix], { stdio: "inherit" })
   }
 
+  // Kill lingering tray process that may hold locks on bin/ (older versions
+  // don't write tray.pid, so vantaloomctl stop won't find them).
+  killTrayProcess(prefix)
+
+  // Copy package contents to install prefix
   for (const name of ["bin", "web", "cli"]) {
-    removeKnownPath(path.join(prefix, name), prefix)
-    await cp(path.join(packageRoot, name), path.join(prefix, name), {
+    const src = path.join(packageRoot, name)
+    const dst = path.join(prefix, name)
+    if (!existsSync(src)) {
+      console.error(`  warning: package missing ${name}/ directory`)
+      continue
+    }
+    removeKnownPath(dst, prefix)
+    await cp(src, dst, {
       recursive: true,
       force: true,
       dereference: false,
     })
   }
 
+  // Ensure binaries are executable on Unix (cross-compiled from Windows they lose +x)
+  const binDir = path.join(prefix, "bin")
+  if (process.platform !== "win32" && existsSync(binDir)) {
+    for (const entry of readdirSync(binDir)) {
+      const binPath = path.join(binDir, entry)
+      try { chmodSync(binPath, 0o755) } catch {}
+    }
+  }
+
+  // Verify vantaloomctl binary exists before trying to run it
+  const ctlBin = path.join(prefix, "bin", binaryName("vantaloomctl"))
+  if (!existsSync(ctlBin)) {
+    const binContents = existsSync(binDir) ? readdirSync(binDir) : []
+    const srcBinContents = existsSync(path.join(packageRoot, "bin")) ? readdirSync(path.join(packageRoot, "bin")) : []
+    throw new Error(
+      `vantaloomctl binary not found at ${ctlBin}\n` +
+      `  installed bin/: [${binContents.join(", ")}]\n` +
+      `  package bin/:   [${srcBinContents.join(", ")}]\n` +
+      `  platform: ${platformId()}\n` +
+      `  This may indicate a corrupt download. Try again or install from source.`
+    )
+  }
+
   await writeLauncher(prefix)
   await writeText(path.join(prefix, "cli", "config.json"), `${JSON.stringify(mergedConfig, null, 2)}\n`)
   await writeText(path.join(prefix, "VERSION"), `${version}\n`)
@@ -194,7 +273,7 @@ async function applyPackage(packageRoot, prefix, options) {
     force: true,
   })
 
-  run(path.join(prefix, "bin", binaryName("vantaloomctl")), [
+  run(ctlBin, [
     "install",
     "--prefix",
     prefix,
@@ -203,7 +282,7 @@ async function applyPackage(packageRoot, prefix, options) {
   ])
 
   if (!options.noStart) {
-    run(path.join(prefix, "bin", binaryName("vantaloomctl")), [
+    run(ctlBin, [
       "start",
       "--prefix",
       prefix,
@@ -216,9 +295,13 @@ async function applyPackage(packageRoot, prefix, options) {
 async function syncFromNpmRegistry(options, action) {
   const prefix = safeDirectory(options.prefix ?? defaultPrefix())
   const installedConfig = readInstalledConfig(prefix)
-  const runtimePackage = options.runtimePackage || installedConfig.runtimePackage || runtimePackageName(platformId())
+  // Always derive runtimePackage from current platform — never trust stale config
+  // from a different platform (e.g. win32 config baked into a darwin package).
+  // Only explicit --runtime-package flag can override.
+  const runtimePackage = options.runtimePackage || runtimePackageName(platformId())
   const runtimeVersion = options.runtimeVersion || installedConfig.runtimeVersion || "latest"
-  const registry = normalizeRegistry(options.npmRegistry || installedConfig.npmRegistry || defaultNpmRegistry)
+  const explicitRegistry = options.npmRegistry || installedConfig.npmRegistry
+  const registry = normalizeRegistry(explicitRegistry || detectNpmRegistry() || defaultNpmRegistry)
   const tempRoot = mkdtempSync(path.join(os.tmpdir(), "vantaloom-npm-"))
 
   try {
@@ -226,7 +309,11 @@ async function syncFromNpmRegistry(options, action) {
     const archive = path.join(tempRoot, `${packageBasename(runtimePackage)}-${runtimeVersion}.tgz`)
     mkdirSync(extractRoot, { recursive: true })
 
-    const resolved = await resolveNpmPackage({ registry, name: runtimePackage, version: runtimeVersion })
+    const resolved = await resolveNpmPackageWithFallback({
+      registries: explicitRegistry ? [registry] : [registry, ...fallbackNpmRegistries.map(normalizeRegistry)],
+      name: runtimePackage,
+      version: runtimeVersion,
+    })
     await downloadNpmTarball({
       tarballUrl: resolved.tarball,
       target: archive,
@@ -240,13 +327,15 @@ async function syncFromNpmRegistry(options, action) {
       noStart: options.noStart,
       runtimePackage,
       runtimeVersion: options.runtimeVersion ? resolved.version : "latest",
-      npmRegistry: registry,
+      npmRegistry: resolved.registry,
       update: action === "update",
     })
 
     console.log(`${action === "update" ? "updated" : "installed"} Vantaloom: ${prefix}`)
     console.log(`version: ${version}`)
     console.log(`source: ${runtimePackage}@${resolved.version}`)
+    console.log(`registry: ${resolved.registry}`)
+    ensureInPath(prefix)
     console.log(`run: ${displayCommand(prefix)} status`)
   } finally {
     removeKnownPath(tempRoot, os.tmpdir())
@@ -288,6 +377,7 @@ async function syncFromRelease(options, action) {
     console.log(`${action === "update" ? "updated" : "installed"} Vantaloom: ${prefix}`)
     console.log(`version: ${version}`)
     console.log(`source: ${repo}@${releaseTag}`)
+    ensureInPath(prefix)
     console.log(`run: ${displayCommand(prefix)} status`)
   } finally {
     removeKnownPath(tempRoot, os.tmpdir())
@@ -338,14 +428,114 @@ async function downloadReleaseAsset({ repo, releaseTag, assetName, target, token
   await writeFile(target, buffer)
 }
 
+function detectNpmRegistry() {
+  // 1. NPM_CONFIG_REGISTRY env var (highest priority, set by npm/npx when running)
+  if (process.env.NPM_CONFIG_REGISTRY) {
+    return process.env.npm_config_registry || process.env.NPM_CONFIG_REGISTRY
+  }
+  // npm also sets the lowercase variant
+  if (process.env.npm_config_registry) {
+    return process.env.npm_config_registry
+  }
+
+  // 2. Read user .npmrc
+  try {
+    const npmrcPaths = [
+      path.join(os.homedir(), ".npmrc"),
+    ]
+    // Also check project-level .npmrc
+    const localNpmrc = path.resolve(".npmrc")
+    if (localNpmrc !== npmrcPaths[0]) {
+      npmrcPaths.unshift(localNpmrc)
+    }
+    for (const npmrcPath of npmrcPaths) {
+      if (existsSync(npmrcPath)) {
+        const content = readFileSync(npmrcPath, "utf8")
+        const match = content.match(/^\s*registry\s*=\s*(.+)/m)
+        if (match) {
+          return match[1].trim()
+        }
+      }
+    }
+  } catch {
+    // Ignore .npmrc read errors
+  }
+
+  return ""
+}
+
+async function resolveNpmPackageWithFallback({ registries, name, version }) {
+  const errors = []
+  for (const registry of registries) {
+    try {
+      const result = await resolveNpmPackage({ registry, name, version })
+      return { ...result, registry }
+    } catch (error) {
+      const causeCode = error?.cause?.code || ""
+      const isNetworkError = causeCode === "ECONNREFUSED"
+        || causeCode === "ENOTFOUND"
+        || causeCode === "ETIMEDOUT"
+        || causeCode === "ECONNRESET"
+        || causeCode === "UND_ERR_CONNECT_TIMEOUT"
+        || (error instanceof TypeError && error.message === "fetch failed")
+      const isSslError = causeCode === "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"
+        || causeCode === "CERT_HAS_EXPIRED"
+        || causeCode === "DEPTH_ZERO_SELF_SIGNED_CERT"
+        || causeCode === "SELF_SIGNED_CERT_IN_CHAIN"
+        || causeCode === "ERR_TLS_CERT_ALTNAME_INVALID"
+      const isRetryable = isNetworkError || isSslError
+      errors.push({ registry, error, isRetryable, isSslError })
+
+      if (isRetryable && registries.length > 1) {
+        const hint = isSslError ? " (SSL certificate error)" : ""
+        console.error(`vantaloom: ${registry} unreachable${hint}, trying next registry...`)
+        continue
+      }
+      if (isSslError) {
+        throw new Error(
+          `SSL certificate error connecting to ${registry}: ${causeCode}\n` +
+          `  Fix: run with --no-strict-ssl, or set npm config: npm config set strict-ssl false`
+        )
+      }
+      // Non-network error (404, parse error, etc.) — don't try fallbacks
+      throw error
+    }
+  }
+
+  // All registries failed
+  const hasSslError = errors.some((e) => e.isSslError)
+  const tried = errors.map((e) => e.registry).join(", ")
+  const sslHint = hasSslError
+    ? `\n  SSL fix: run with --no-strict-ssl, or set npm config: npm config set strict-ssl false`
+    : ""
+  throw new Error(
+    `all registries unreachable (tried: ${tried}). ` +
+    `Check your network or specify --npm-registry <url>${sslHint}`
+  )
+}
+
 async function resolveNpmPackage({ registry, name, version }) {
   const metadataUrl = `${registry}/${encodeURIComponent(name).replace("%2F", "%2f")}`
-  const response = await fetch(metadataUrl, {
-    headers: {
-      Accept: "application/vnd.npm.install-v1+json",
-      "User-Agent": "vantaloom-cli",
-    },
-  })
+  let response
+  try {
+    response = await fetch(metadataUrl, {
+      headers: {
+        Accept: "application/vnd.npm.install-v1+json",
+        "User-Agent": "vantaloom-cli",
+      },
+      signal: AbortSignal.timeout(15000),
+    })
+  } catch (error) {
+    if (error instanceof TypeError && error.message === "fetch failed") {
+      const causeCode = error.cause?.code || ""
+      const causeMsg = causeCode || error.cause?.message || String(error.cause || "")
+      throw Object.assign(
+        new Error(`cannot reach registry ${registry} (${causeMsg})`),
+        { cause: error.cause }
+      )
+    }
+    throw error
+  }
   if (!response.ok) {
     const detail = await response.text().catch(() => "")
     throw new Error(`failed to inspect npm package ${name}: HTTP ${response.status}${detail ? ` ${detail.slice(0, 200)}` : ""}`)
@@ -365,11 +555,22 @@ async function resolveNpmPackage({ registry, name, version }) {
 }
 
 async function downloadNpmTarball({ tarballUrl, target, packageName, version }) {
-  const response = await fetch(tarballUrl, {
-    headers: {
-      "User-Agent": "vantaloom-cli",
-    },
-  })
+  console.log(`  downloading ${packageName}@${version}...`)
+  let response
+  try {
+    response = await fetch(tarballUrl, {
+      headers: {
+        "User-Agent": "vantaloom-cli",
+      },
+      signal: AbortSignal.timeout(120000),
+    })
+  } catch (error) {
+    const causeCode = error?.cause?.code || ""
+    const causeMsg = causeCode || error?.cause?.message || error.message || ""
+    const isSsl = causeCode.includes("CERT") || causeCode === "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"
+    const hint = isSsl ? `\n  Fix: run with --no-strict-ssl` : ""
+    throw new Error(`failed to download ${packageName}@${version} from ${tarballUrl}: ${causeMsg}${hint}`)
+  }
   if (!response.ok) {
     const detail = await response.text().catch(() => "")
     throw new Error(`failed to download ${packageName}@${version}: HTTP ${response.status}${detail ? ` ${detail.slice(0, 200)}` : ""}`)
@@ -377,6 +578,7 @@ async function downloadNpmTarball({ tarballUrl, target, packageName, version })
 
   const buffer = Buffer.from(await response.arrayBuffer())
   await writeFile(target, buffer)
+  console.log(`  downloaded ${(buffer.length / 1024 / 1024).toFixed(1)} MB`)
 }
 
 function shouldUseSourceInstall(options) {
@@ -440,9 +642,9 @@ function mergeRuntimeConfig(packageConfig, existingConfig, overrides) {
   if (!merged.releaseTag) {
     merged.releaseTag = defaultReleaseTag
   }
-  if (!merged.runtimePackage) {
-    merged.runtimePackage = runtimePackageName(platformId())
-  }
+  // Always force runtimePackage to match the running platform — a cross-compiled
+  // package may carry a config for a different platform (e.g. win32 inside darwin).
+  merged.runtimePackage = runtimePackageName(platformId())
   if (!merged.runtimeVersion) {
     merged.runtimeVersion = "latest"
   }
@@ -462,7 +664,7 @@ function runtimeConfigFromSource(sourceRoot) {
     releaseTag: defaultReleaseTag,
     runtimePackage: runtimePackageName(platformId()),
     runtimeVersion: "latest",
-    npmRegistry: defaultNpmRegistry,
+    npmRegistry: detectNpmRegistry() || defaultNpmRegistry,
   }
 }
 
@@ -598,13 +800,20 @@ function printPaths(options) {
   console.log(JSON.stringify({ sourceRoot, prefix }, null, 2))
 }
 
-function buildGo(sourceRoot, buildBin, name) {
+function buildGo(sourceRoot, buildBin, name, targetPlatform) {
+  const goEnv = targetPlatform ? platformToGoEnv(targetPlatform) : {}
+  const isWindowsTarget = targetPlatform
+    ? targetPlatform.startsWith("win32")
+    : process.platform === "win32"
+  const ext = isWindowsTarget ? ".exe" : ""
+  const ldflags = name === "vantaloom-tray" ? "-s -w -H windowsgui" : "-s -w"
   run("go", [
     "build",
+    "-ldflags", ldflags,
     "-o",
-    path.join(buildBin, binaryName(name)),
+    path.join(buildBin, `${name}${ext}`),
     `./apps/api/cmd/${name}`,
-  ], { cwd: sourceRoot })
+  ], { cwd: sourceRoot, env: { ...process.env, ...goEnv } })
 }
 
 async function copyDir(source, destination, options = {}) {
@@ -621,6 +830,10 @@ async function copyDir(source, destination, options = {}) {
 }
 
 function writeBuildManifest(buildRoot, version, platform) {
+  const components = ["api", "agent", "web", "ctl"]
+  if (platform.startsWith("win32")) {
+    components.push("tray")
+  }
   writeFileSync(path.join(buildRoot, "VERSION"), `${version}\n`)
   writeFileSync(
     path.join(buildRoot, "manifest.json"),
@@ -630,7 +843,7 @@ function writeBuildManifest(buildRoot, version, platform) {
         version,
         platform,
         updatedAt: new Date().toISOString(),
-        components: ["api", "agent", "web", "ctl"],
+        components,
       },
       null,
       2
@@ -748,9 +961,18 @@ function parseOptions(args) {
       case "npm-package":
         options.npmPackage = true
         break
+      case "target":
+        options.target = inlineValue ?? args[++index]
+        if (!options.target) {
+          throw new Error("missing value for --target")
+        }
+        break
       case "local":
         options.local = true
         break
+      case "no-strict-ssl":
+        options.noStrictSsl = true
+        break
       default:
         throw new Error(`unknown option --${key}`)
     }
@@ -799,8 +1021,22 @@ function runPnpm(args, options = {}) {
   run("pnpm", args, options)
 }
 
-function binaryName(name) {
-  return process.platform === "win32" ? `${name}.exe` : name
+function binaryName(name, targetPlatform) {
+  const isWindows = targetPlatform
+    ? targetPlatform.startsWith("win32")
+    : process.platform === "win32"
+  return isWindows ? `${name}.exe` : name
+}
+
+function platformToGoEnv(platform) {
+  const { os: runtimeOS, cpu } = parsePlatformId(platform)
+  const goosMap = { win32: "windows", linux: "linux", darwin: "darwin" }
+  const goarchMap = { x64: "amd64", arm64: "arm64" }
+  return {
+    GOOS: goosMap[runtimeOS] ?? runtimeOS,
+    GOARCH: goarchMap[cpu] ?? cpu,
+    CGO_ENABLED: "0",
+  }
 }
 
 function platformId() {
@@ -858,6 +1094,92 @@ async function writeText(filePath, content) {
   await writeFile(filePath, content)
 }
 
+// ensureInPath adds the Vantaloom install directory to the user's shell PATH
+// on macOS and Linux, so `vantaloom` can be run directly after install.
+// On Windows this is not needed (vantaloom.cmd is run by full path or added via installer).
+function ensureInPath(prefix) {
+  if (process.platform === "win32") return
+
+  // Check if already in PATH
+  const pathDirs = (process.env.PATH || "").split(":")
+  if (pathDirs.includes(prefix)) return
+
+  // Determine shell profile file
+  const home = os.homedir()
+  const shell = process.env.SHELL || ""
+  let profilePath
+  if (shell.endsWith("/zsh") || existsSync(path.join(home, ".zshrc"))) {
+    profilePath = path.join(home, ".zshrc")
+  } else if (shell.endsWith("/bash")) {
+    // On macOS, bash uses .bash_profile; on Linux, .bashrc
+    profilePath = process.platform === "darwin"
+      ? path.join(home, ".bash_profile")
+      : path.join(home, ".bashrc")
+  } else if (existsSync(path.join(home, ".profile"))) {
+    profilePath = path.join(home, ".profile")
+  } else {
+    profilePath = path.join(home, ".profile")
+  }
+
+  // Use $HOME-relative path for portability
+  const homeRelative = prefix.startsWith(home)
+    ? `$HOME${prefix.slice(home.length)}`
+    : prefix
+  const exportLine = `export PATH="${homeRelative}:$PATH"`
+  const marker = "# vantaloom"
+
+  // Check if already added to profile
+  try {
+    if (existsSync(profilePath)) {
+      const content = readFileSync(profilePath, "utf8")
+      if (content.includes("vantaloom") && content.includes("PATH")) return
+    }
+  } catch {}
+
+  // Append to profile
+  try {
+    const entry = `\n${marker}\n${exportLine}\n`
+    appendFileSync(profilePath, entry)
+    console.log(`PATH: added ${prefix} to ${profilePath}`)
+    console.log(`  run: source ${profilePath}  (or open a new terminal)`)
+  } catch (error) {
+    console.log(`PATH: could not update ${profilePath}: ${error.message}`)
+    console.log(`  add manually: ${exportLine}`)
+  }
+}
+
+function killTrayProcess(prefix) {
+  if (process.platform === "win32") {
+    // Try PID file first (new tray versions write runtime/tray.pid).
+    const pidFile = path.join(prefix, "runtime", "tray.pid")
+    if (existsSync(pidFile)) {
+      const pid = readFileSync(pidFile, "utf8").trim()
+      if (pid) {
+        spawnSync("taskkill", ["/PID", pid, "/F"], { stdio: "ignore" })
+        try { rmSync(pidFile, { force: true }) } catch {}
+      }
+    }
+    // Fallback: kill by image name if the binary is inside our prefix.
+    const result = spawnSync("tasklist", ["/FI", "IMAGENAME eq vantaloom-tray.exe", "/FO", "CSV", "/NH"], {
+      encoding: "utf8",
+      windowsHide: true,
+    })
+    if (result.stdout) {
+      for (const line of result.stdout.split("\n")) {
+        const match = line.match(/"vantaloom-tray\.exe","(\d+)"/)
+        if (match) {
+          spawnSync("taskkill", ["/PID", match[1], "/F"], { stdio: "ignore" })
+        }
+      }
+    }
+    // Brief pause to let file handles release.
+    spawnSync("timeout", ["/t", "1", "/nobreak"], { stdio: "ignore", windowsHide: true })
+  } else {
+    // Unix: pkill by name (best-effort).
+    spawnSync("pkill", ["-f", "vantaloom-tray"], { stdio: "ignore" })
+  }
+}
+
 function printHelp() {
   console.log(`Vantaloom CLI
 
@@ -866,7 +1188,7 @@ Usage:
   vantaloom install  --local [--prefix <dir>] [--source <repo>] [--build-web] [--no-start]
   vantaloom update   [--prefix <dir>] [--runtime-version <version>] [--npm-registry <url>] [--no-start]
   vantaloom update   --local [--prefix <dir>] [--source <repo>] [--build-web] [--no-start]
-  vantaloom package  [--source <repo>] [--output <dir>] [--build-web] [--archive] [--npm-package]
+  vantaloom package  [--source <repo>] [--output <dir>] [--build-web] [--archive] [--npm-package] [--target <platform>]
   vantaloom start    [--prefix <dir>] [--component all|api|agent|web]
   vantaloom stop     [--prefix <dir>] [--component all|api|agent|web]
   vantaloom restart  [--prefix <dir>] [--component all|api|agent|web]

package/manifest.json

@@ -1,8 +1,8 @@
 {
   "name": "Vantaloom Local Runtime",
-  "version": "5ce4bec",
+  "version": "532507a",
   "platform": "linux-x64",
-  "updatedAt": "2026-05-28T16:04:31.021Z",
+  "updatedAt": "2026-05-30T15:43:12.245Z",
   "components": [
     "api",
     "agent",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantaloom/runtime-linux-x64",
-  "version": "0.1.24",
+  "version": "0.3.6",
   "private": false,
   "description": "Vantaloom local runtime for linux-x64.",
   "type": "module",