RunanywhereAI · sanchitmonga22 · Sep 4, 2026 · Aug 21, 2026 · Aug 21, 2026 · Aug 21, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -17,6 +17,19 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  distribution:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate distribution tooling
+        run: |
+          set -euo pipefail
+          python3 tests/test_release_assets.py
+          python3 -m py_compile scripts/verify-release-assets.py scripts/stamp-formula.py
+          bash -n install.sh scripts/package-rcli.sh scripts/update-tap.sh
+          ruby -c Formula/rcli.rb
+
   macos:
     # SDK Package.swift is swift-tools-version 6.2 (Xcode 26). macos-15 is
     # Xcode 16.4 / Swift 6.1; macos-14 is Xcode 15 / Swift 5.10.
@@ -65,6 +78,47 @@ jobs:
           RCLI_SDK_KIT: ${{ github.workspace }}/kit
         run: bash scripts/e2e.sh ./build/rcli
 
+  windows-arm64:
+    # Native ARM64 runner, free for public repos. Cross-compiling from the x64
+    # host would build but never execute, and Windows-on-ARM is exactly where
+    # the emulated x64 build needs a native alternative.
+    runs-on: windows-11-arm
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: ilammy/msvc-dev-cmd@v1
+        with:
+          arch: arm64
+      - uses: seanmiddleditch/gha-setup-ninja@master
+      - name: Download C++ desktop kit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          kit="${GITHUB_WORKSPACE}/kit"
+          bash scripts/fetch-kit.sh windows-arm64 "$kit"
+          test -f "$kit/include/runanywhere/proto/model_types.pb.h"
+      - name: Configure
+        shell: bash
+        run: |
+          prefix="${GITHUB_WORKSPACE}/kit"
+          if command -v cygpath >/dev/null 2>&1; then
+            prefix="$(cygpath -m "$prefix")"
+          fi
+          cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_PREFIX_PATH="$prefix"
+      - name: Build
+        run: cmake --build build --config Release
+      - name: Unit tests
+        run: ctest --test-dir build --output-on-failure -C Release
+      - name: Smoke
+        shell: bash
+        env:
+          RCLI_SDK_KIT: ${{ github.workspace }}/kit
+        run: bash scripts/e2e.sh ./build/rcli.exe
+
   windows:
     runs-on: windows-2022
     timeout-minutes: 45

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -57,11 +57,67 @@ jobs:
           VERSION="${RCLI_VERSION#v}"
           RCLI_VERSION="${VERSION}" RCLI_SDK_KIT="${GITHUB_WORKSPACE}/kit" \
             bash scripts/package-rcli.sh build macos-arm64
+          python3 scripts/verify-release-assets.py \
+            "dist/rcli-${VERSION}-macos-arm64.tar.gz" \
+            "dist/rcli-${VERSION}-macos-arm64.tar.gz.sha256"
       - uses: actions/upload-artifact@v4
         with:
           name: rcli-macos-arm64
           path: dist/rcli-*-macos-arm64.tar.gz*
 
+  windows-arm64:
+    # install.ps1 already prefers rcli-<ver>-windows-arm64.zip and warns when it
+    # is absent; until this job existed the preferred path could never be taken
+    # and every Windows-on-ARM user silently got the emulated x64 build.
+    runs-on: windows-11-arm
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: ilammy/msvc-dev-cmd@v1
+        with:
+          arch: arm64
+      - uses: seanmiddleditch/gha-setup-ninja@master
+      - name: Download C++ desktop kit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          bash scripts/fetch-kit.sh windows-arm64 "${GITHUB_WORKSPACE}/kit"
+      - name: Configure + build
+        shell: bash
+        run: |
+          prefix="${GITHUB_WORKSPACE}/kit"
+          if command -v cygpath >/dev/null 2>&1; then
+            prefix="$(cygpath -m "$prefix")"
+          fi
+          cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_PREFIX_PATH="$prefix"
+          cmake --build build --config Release
+      - name: Product e2e
+        shell: bash
+        env:
+          RCLI_SDK_KIT: ${{ github.workspace }}/kit
+        run: bash scripts/e2e.sh ./build/rcli.exe
+      - name: Package
+        shell: pwsh
+        run: |
+          $ver = $env:RCLI_VERSION.TrimStart('v')
+          $kit = Join-Path $env:GITHUB_WORKSPACE "kit"
+          $env:RCLI_SDK_KIT = $kit
+          & powershell -File scripts/package-rcli-windows.ps1 -BuildDir build -Version $ver -KitDir $kit -Platform windows-arm64
+          python scripts/verify-release-assets.py `
+            "dist/rcli-$ver-windows-arm64.zip" `
+            "dist/rcli-$ver-windows-arm64.zip.sha256"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: rcli-windows-arm64
+          path: |
+            dist/*.zip
+            dist/*.zip.sha256
+          if-no-files-found: error
+
   windows:
     runs-on: windows-2022
     timeout-minutes: 60
@@ -99,6 +155,9 @@ jobs:
           $kit = Join-Path $env:GITHUB_WORKSPACE "kit"
           $env:RCLI_SDK_KIT = $kit
           & powershell -File scripts/package-rcli-windows.ps1 -BuildDir build -Version $ver -KitDir $kit
+          python scripts/verify-release-assets.py `
+            "dist/rcli-$ver-windows-x86_64.zip" `
+            "dist/rcli-$ver-windows-x86_64.zip.sha256"
       # Zip only. onnxruntime.dll lives next to rcli.exe *inside* the archive;
       # uploading the loose DLL/exe made them look like first-class release assets.
       - uses: actions/upload-artifact@v4
@@ -110,7 +169,7 @@ jobs:
           if-no-files-found: error
 
   publish:
-    needs: [macos, windows]
+    needs: [macos, windows, windows-arm64]
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
@@ -120,15 +179,35 @@ jobs:
         with:
           path: artifacts
           merge-multiple: true
-      - name: Stamp formula (best effort)
+      - name: Verify release archives
         run: |
           set -euo pipefail
           VERSION="${RCLI_VERSION#v}"
-          mac=$(ls artifacts/rcli-${VERSION}-macos-arm64.tar.gz.sha256 2>/dev/null || true)
-          if [[ -n "$mac" && -f scripts/stamp-formula.py ]]; then
-            digest=$(awk '{print $1}' "$mac")
-            python3 scripts/stamp-formula.py "$VERSION" "macos-arm64=${digest}" || true
-          fi
+          python3 scripts/verify-release-assets.py \
+            "artifacts/rcli-${VERSION}-macos-arm64.tar.gz" \
+            "artifacts/rcli-${VERSION}-macos-arm64.tar.gz.sha256"
+          python3 scripts/verify-release-assets.py \
+            "artifacts/rcli-${VERSION}-windows-x86_64.zip" \
+            "artifacts/rcli-${VERSION}-windows-x86_64.zip.sha256"
+          python3 scripts/verify-release-assets.py \
+            "artifacts/rcli-${VERSION}-windows-arm64.zip" \
+            "artifacts/rcli-${VERSION}-windows-arm64.zip.sha256"
+      - name: Generate Homebrew formula update
+        run: |
+          set -euo pipefail
+          VERSION="${RCLI_VERSION#v}"
+          sidecar="artifacts/rcli-${VERSION}-macos-arm64.tar.gz.sha256"
+          digest=$(awk 'NF == 2 { print $1 }' "$sidecar")
+          [[ "$digest" =~ ^[0-9a-f]{64}$ ]]
+          python3 scripts/stamp-formula.py "$VERSION" "macos-arm64=${digest}"
+          ruby -c Formula/rcli.rb
+          mkdir -p release-metadata
+          cp Formula/rcli.rb release-metadata/rcli.rb
+      - uses: actions/upload-artifact@v4
+        with:
+          name: rcli-homebrew-formula
+          path: release-metadata/rcli.rb
+          if-no-files-found: error
       - name: Create the release
         uses: softprops/action-gh-release@v2
         with:

diff --git a/AGENTS.md b/AGENTS.md
@@ -63,6 +63,44 @@ aliases (`run`, `pull`, `stt`). One `configure_*` wires both. See
 Do not reintroduce FetchContent of the SDK, a second inference backend tree,
 or a retired MetalRT / hardcoded catalog.
 
+## Signing in to a console
+
+`rcli login` is a device flow, the same shape `gh auth login` uses. The terminal
+asks for a code, a browser the person already trusts approves it, and the
+terminal collects a key. No password ever reaches the CLI.
+
+The four endpoints it calls are **not ours to rename**: an installed binary
+talks to whatever the console deploys, so a field or path change breaks every
+copy in the wild. They are `POST /auth/cli/start`, `/auth/cli/poll`,
+`/auth/cli/refresh`, and `GET /v1/me`. The console side has a test that reads
+`src/account/console.cpp` directly and fails if the two drift.
+
+Two secrets do different jobs. `request_code` is public and names the attempt;
+`poll_secret` proves the process collecting the grant is the one that started
+it. The console stores only a hash of the second.
+
+`RCLI_CONSOLE_URL` points at the console; it defaults to `http://localhost:8080`,
+which is nothing, so a local run needs it set. `RCLI_PROFILE_DIR` moves the
+credential file, which is what lets several accounts share one machine.
+
+The credential is a normal API key with the customer's credit behind it. Treat
+it as one: it goes in the profile file at `0600` and nowhere else, and it is
+never logged.
+
+## Building against the SDK
+
+`RCLI_SDK_KIT` points at a built kit, not at SDK source. `cmake/sdk-pin.cmake`
+pins the IDL version and its hash; a mismatch is a hard error and the fix is to
+consume a matching kit or bump the pin, **never to run protoc**.
+
+Two binaries come out of a build. `rcli-cxx` is the CLI. `rcli` is the same
+thing plus the MLX backend, and it only builds when `RCLI_SDK_SWIFT_PATH` names
+an SDK checkout with the Swift tree. Ship `rcli`.
+
+MLX resolves its Metal shaders from `mlx-swift_Cmlx.bundle` beside the
+executable. Copy the binary somewhere on its own and MLX silently fails to
+register, so an install puts both together and points a wrapper at them.
+
 ## Configuration and secrets
 
 - Read environment in one place (`GlobalOptions` / `bootstrap()`).

diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -47,6 +47,19 @@ set(RCLI_SOURCES
     src/commands/cmd_voice.cpp
     src/commands/cmd_rag.cpp
     src/commands/cmd_bench.cpp
+    src/commands/cmd_editors.cpp
+    src/commands/cmd_harness.cpp
+    src/commands/cmd_account.cpp
+    src/account/console.cpp
+    src/account/credentials.cpp
+    src/anthropic/messages.cpp
+    src/anthropic/translate.cpp
+    src/desktop/claude_profile.cpp
+    src/harness/harness.cpp
+    src/harness/opencode.cpp
+    src/harness/local_models.cpp
+    src/ide/jetbrains_profile.cpp
+    src/ide/openai_proxy.cpp
     src/commands/engine_options.cpp
     src/commands/model_setup.cpp
     src/config/cli_paths.cpp
@@ -79,12 +92,43 @@ endif()
 target_include_directories(rcli_core PUBLIC
     "${CMAKE_CURRENT_SOURCE_DIR}/include"
     "${CMAKE_CURRENT_SOURCE_DIR}/src"
+    "${CMAKE_CURRENT_SOURCE_DIR}/third_party"
     "${CMAKE_CURRENT_SOURCE_DIR}/third_party/CLI11"
     "${CMAKE_CURRENT_SOURCE_DIR}/third_party/linenoise"
 )
 
+# The Anthropic translator and the JetBrains proxy need an HTTP client and a
+# JSON reader. Both used to arrive from the SDK's own source build; a kit
+# consumer never configures that build, so they are fetched here.
+#
+# Fetched rather than vendored on purpose. Checking cpp-httplib in would drop
+# thirty thousand lines of somebody else's code into this repo, where the
+# security scanner reads it as ours and flags the http:// URLs an HTTP client
+# is obliged to construct.
+include(FetchContent)
+set(HTTPLIB_REQUIRE_OPENSSL OFF CACHE BOOL "" FORCE)
+set(JSON_BuildTests OFF CACHE BOOL "" FORCE)
+FetchContent_Declare(cpp_httplib
+    GIT_REPOSITORY https://github.com/yhirose/cpp-httplib.git
+    GIT_TAG v0.46.1
+    GIT_SHALLOW TRUE)
+FetchContent_Declare(nlohmann_json
+    GIT_REPOSITORY https://github.com/nlohmann/json.git
+    GIT_TAG v3.11.3
+    GIT_SHALLOW TRUE)
+FetchContent_MakeAvailable(cpp_httplib nlohmann_json)
+
 find_package(Threads REQUIRED)
 target_link_libraries(rcli_core PUBLIC rac_commons Threads::Threads)
+target_link_libraries(rcli_core PRIVATE httplib::httplib nlohmann_json::nlohmann_json)
+if(WIN32)
+    # The console client uses the Windows system HTTP stack so source builds and
+    # release archives do not need curl/OpenSSL DLLs beside rcli.exe.
+    target_link_libraries(rcli_core PRIVATE winhttp)
+else()
+    find_package(CURL REQUIRED)
+    target_link_libraries(rcli_core PRIVATE CURL::libcurl)
+endif()
 target_compile_definitions(rcli_core PUBLIC
     RCLI_VERSION="${PROJECT_VERSION}"
     RCLI_PINNED_SDK_VERSION="${RCLI_PINNED_SDK_VERSION}"
@@ -112,6 +156,8 @@ endif()
 # Include path + google=runanywhere_internal come from RunAnywhere::commons.
 
 if(APPLE)
+    # SecItem, for the credential a JetBrains IDE reads its provider key from.
+    target_link_libraries(rcli_core PRIVATE "-framework Security" "-framework CoreFoundation")
     target_link_libraries(rcli_core PUBLIC "-framework IOKit" "-framework CoreFoundation")
 endif()
 

diff --git a/Formula/rcli.rb b/Formula/rcli.rb
@@ -1,15 +1,17 @@
+# frozen_string_literal: true
+
 class Rcli < Formula
   desc "Run language, speech and image models on your own machine"
   homepage "https://github.com/RunanywhereAI/RCLI"
+  version "0.5.2"
   license "MIT"
-  version "0.5.1"
 
-    # 0.5.1 is the kit-consumer CMake bottle. macOS arm64 ships the Swift MLX host
+  # macOS arm64 ships the Swift MLX host
   # (llama.cpp + ONNX + Sherpa + MLX). Linux is not in this cut.
   on_macos do
     on_arm do
-      url "https://github.com/RunanywhereAI/RCLI/releases/download/v0.5.0/rcli-0.5.0-macos-arm64.tar.gz"
-      sha256 "aa524eef31405d99c1fda4b90c3b1f3e8f74302fe209ba7fe81b343a1f92a266"
+      url "https://github.com/RunanywhereAI/RCLI/releases/download/v0.5.2/rcli-0.5.2-macos-arm64.tar.gz"
+      sha256 "fc16e5e3fdef1e62b7d05d569ce8a69cc86cdd2b880d5983c495a5e240384430"
     end
   end