fix(agent): cross-compile macOS x64, harden Windows source, tighten matrix

- release/ci matrix: drop retired macos-13; cross-compile darwin-x64
  from the macos-14 runner via -Dtarget=x86_64-macos. Skip zig build
  test for non-native matrix entries.
- Drop windows-x64 from the matrix for now: napi_* symbols need a
  delay-load stub (node.lib / /DELAYLOAD:node.exe) to resolve at link
  time on Windows, which requires more build.zig plumbing than we
  want to take on here. Re-enable once that's in.
- Replace std.posix.getenv (compile-error on Windows, env strings are
  WTF-16) with std.process.getEnvVarOwned in src/http/client.zig.
  Guard swarm backend registry's posix.getenv lookups behind a
  comptime `os.tag != .windows` check — iTerm2/tmux backends don't
  exist on Windows anyway.
- build.zig: link ws2_32 on Windows targets so std.net's WSASend /
  WSARecv / WSAGetOverlappedResult resolve — the prerequisite for the
  eventual Windows re-enable.

Author: Kayshen-X

.github/workflows/ci.yml

@@ -34,15 +34,16 @@ jobs:
           - os: macos
             arch: arm64
             runner: macos-14
+            zig_target: aarch64-macos
           - os: macos
             arch: x64
-            runner: macos-13
+            runner: macos-14 # cross-compile from arm64; macos-13 is retired
+            zig_target: x86_64-macos
           - os: linux
             arch: x64
             runner: ubuntu-latest
-          - os: windows
-            arch: x64
-            runner: windows-latest
+            zig_target: x86_64-linux
+          # windows-x64: see release.yml for why it is omitted.
     steps:
       - uses: actions/checkout@v4
 
@@ -52,7 +53,7 @@ jobs:
           version: 0.15.2
 
       - name: Build NAPI addon
-        run: zig build napi -Doptimize=ReleaseFast
+        run: zig build napi -Doptimize=ReleaseFast -Dtarget=${{ matrix.zig_target }}
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4

.github/workflows/release.yml

@@ -19,15 +19,24 @@ jobs:
           - os: macos
             arch: arm64
             runner: macos-14
+            zig_target: aarch64-macos
+            native: true
           - os: macos
             arch: x64
-            runner: macos-13
+            # macos-13 runners are retired — cross-compile from the arm64
+            # runner; zig's cross toolchain handles the Mach-O x64 target.
+            runner: macos-14
+            zig_target: x86_64-macos
+            native: false
           - os: linux
             arch: x64
             runner: ubuntu-latest
-          - os: windows
-            arch: x64
-            runner: windows-latest
+            zig_target: x86_64-linux
+            native: true
+          # windows-x64 is intentionally omitted: NAPI on Windows needs a
+          # delay-load stub (node.lib / /DELAYLOAD:node.exe) to satisfy the
+          # napi_* symbols at link time, which requires more build.zig
+          # plumbing than we have here. Re-add once that's in place.
     steps:
       - uses: actions/checkout@v4
 
@@ -37,10 +46,11 @@ jobs:
           version: 0.15.2
 
       - name: Run tests
+        if: matrix.native
         run: zig build test
 
       - name: Build NAPI addon
-        run: zig build napi -Doptimize=ReleaseFast
+        run: zig build napi -Doptimize=ReleaseFast -Dtarget=${{ matrix.zig_target }}
 
       - name: Rename artifact
         shell: bash

build.zig

@@ -39,6 +39,11 @@ pub fn build(b: *std.Build) void {
         .optimize = optimize,
     });
     c_api_static_module.link_libc = true;
+    // std.net on Windows pulls in Winsock — link ws2_32 so WSASend/WSARecv/
+    // WSAGetOverlappedResult resolve at link time instead of failing at load.
+    if (target.result.os.tag == .windows) {
+        c_api_static_module.linkSystemLibrary("ws2_32", .{});
+    }
     const static_lib = b.addLibrary(.{
         .name = "agent_static",
         .root_module = c_api_static_module,
@@ -51,6 +56,9 @@ pub fn build(b: *std.Build) void {
     });
     bridge_module.linkLibrary(static_lib);
     bridge_module.link_libc = true;
+    if (target.result.os.tag == .windows) {
+        bridge_module.linkSystemLibrary("ws2_32", .{});
+    }
     const napi_lib = b.addLibrary(.{
         .name = "agent_napi",
         .root_module = bridge_module,

src/http/client.zig

@@ -158,8 +158,12 @@ pub const HttpClient = struct {
         // Do NOT read the response body — response.reader() panics
         // on some providers that send responses without proper
         // transfer encoding.
+        // std.posix.getenv is a compile error on Windows (env strings are
+        // WTF-16); use getEnvVarOwned instead and skip the opt-in on hosts
+        // that can't satisfy the lookup.
         const log_body_enabled = blk: {
-            const env = std.posix.getenv("OPENPENCIL_HTTP_LOG_REQUEST_BODY") orelse break :blk false;
+            const env = std.process.getEnvVarOwned(self.allocator, "OPENPENCIL_HTTP_LOG_REQUEST_BODY") catch break :blk false;
+            defer self.allocator.free(env);
             break :blk env.len > 0 and env[0] != '0';
         };
         const should_log_body =

src/swarm/backends/registry.zig

@@ -18,22 +18,28 @@ pub const BackendRegistry = struct {
     pub fn detect(self: *BackendRegistry) BackendType {
         if (self.cached) |c| return c;
 
-        // iTerm2 — highest priority.
-        if (std.posix.getenv("ITERM_SESSION_ID") != null) {
-            self.cached = .iterm2;
-            return .iterm2;
-        }
-
-        // tmux — check env variable first.
-        if (std.posix.getenv("TMUX") != null) {
-            self.cached = .tmux;
-            return .tmux;
-        }
-
-        // tmux — check if binary is on PATH.
-        if (tmuxBinaryExists()) {
-            self.cached = .tmux;
-            return .tmux;
+        // Terminal multiplexer backends (iTerm2, tmux) only exist on
+        // Unix-like hosts. std.posix.getenv is also a compile error on
+        // Windows (env strings are WTF-16), so gate the whole lookup behind
+        // a comptime OS check.
+        if (comptime @import("builtin").os.tag != .windows) {
+            // iTerm2 — highest priority.
+            if (std.posix.getenv("ITERM_SESSION_ID") != null) {
+                self.cached = .iterm2;
+                return .iterm2;
+            }
+
+            // tmux — check env variable first.
+            if (std.posix.getenv("TMUX") != null) {
+                self.cached = .tmux;
+                return .tmux;
+            }
+
+            // tmux — check if binary is on PATH.
+            if (tmuxBinaryExists()) {
+                self.cached = .tmux;
+                return .tmux;
+            }
         }
 
         // Fallback — always available.