diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 8a96635..588180f 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -11,13 +11,11 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  linux:
+  # Verification: TinyCC builds and tests everything in seconds. tcc warns on
+  # `#pragma GCC`, so no -Werror here; the gcc release builds below carry it.
+  tcc-check:
     runs-on: ubuntu-latest
     timeout-minutes: 30
-    strategy:
-      fail-fast: false
-      matrix:
-        cc: [gcc, clang]
     steps:
       - name: Checkout
         env:
@@ -34,21 +32,14 @@ jobs:
           $SUDO bash scripts/ci_pkg_mirror.sh
           $SUDO apt-get update
           $SUDO apt-get install -y --no-install-recommends \
-            build-essential clang cmake pkg-config python3 \
+            build-essential pkg-config python3 curl ca-certificates \
             libcurl4-openssl-dev libncurses-dev
-      - name: Build (warnings are errors)
-        run: make CC=${{ matrix.cc }} CFLAGS="-std=c11 -Wall -Wextra -O2 -g -Werror" -j"$(nproc)"
+      - name: Build TinyCC
+        run: bash scripts/ci_tcc.sh
+      - name: Build
+        run: make CC=tcc AR=ar CFLAGS="-std=c11 -Wall -O2 -g" -j"$(nproc)"
       - name: Unit tests
-        run: |
-          # Same -Werror as the build step so undeclared libc helpers cannot
-          # silently return int and truncate pointers (see test_subagent).
-          make CC=${{ matrix.cc }} \
-            CFLAGS="-std=c11 -Wall -Wextra -O2 -g -Werror" check
-      - name: CMake build + ctest
-        run: |
-          cmake -B build -DCMAKE_C_COMPILER=${{ matrix.cc }} -DCST_BUILD_TUI=ON
-          cmake --build build -j"$(nproc)"
-          ctest --test-dir build --output-on-failure
+        run: make CC=tcc AR=ar CFLAGS="-std=c11 -Wall -O2 -g" check
       - name: Smoke test
         run: |
           ./cst-agent --help
@@ -57,39 +48,22 @@ jobs:
       - name: WebUI end-to-end (recorded stream, no API key)
         run: sh scripts/e2e_webui.sh
 
-  musl:
+  # Release: static musl binaries, gcc with -Werror.
+  # dist/cst-agent-VERSION-linux-ARCH.tar.gz
+  linux:
+    needs: tcc-check
     runs-on: ubuntu-latest
-    timeout-minutes: 30
-    container: alpine:3.20
-    steps:
-      - name: Install tools + mirror
-        run: |
-          sed -i 's#https\?://dl-cdn.alpinelinux.org/alpine#https://mirrors.tuna.tsinghua.edu.cn/alpine#g' \
-            /etc/apk/repositories
-          apk add --no-cache curl git bash
-      - name: Checkout
-        env:
-          GITHUB_SERVER_URL: ${{ github.server_url }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
-          GITHUB_SHA: ${{ github.sha }}
-        run: |
-          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
-            -o /tmp/ci_checkout.sh
-          bash /tmp/ci_checkout.sh
-      - name: Install build dependencies
-        run: |
-          # linux-headers provides linux/audit.h for the seccomp probe path
-          apk add --no-cache build-base pkgconf curl-dev ncurses-dev \
-            linux-headers git nodejs bash python3
-      - name: Build + unit tests
-        run: |
-          make CFLAGS="-std=c11 -Wall -Wextra -O2 -Werror" -j"$(nproc)"
-          make check
-
-  # MinGW-w64 UCRT cross build → dist/cst-agent-*-windows-x86_64.zip
-  windows-cross:
-    runs-on: ubuntu-latest
-    timeout-minutes: 120
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86_64
+            check: 1
+          - arch: x86
+            check: 1
+          - arch: aarch64
+            check: 0
     steps:
       - name: Checkout
         env:
@@ -105,20 +79,29 @@ jobs:
           SUDO=$(command -v sudo || true)
           $SUDO bash scripts/ci_pkg_mirror.sh
           $SUDO apt-get update
+          # ncurses-bin/-term: tic, infocmp and the fallback terminal entries
           $SUDO apt-get install -y --no-install-recommends \
-            ca-certificates curl git cmake ninja-build make pkg-config \
-            python3 zip unzip perl xz-utils
-      - name: Cross-build Windows zip
-        run: bash scripts/ci_windows_cross.sh
-      - name: Verify zip
+            build-essential cmake ninja-build pkg-config python3 perl \
+            curl ca-certificates xz-utils bzip2 file ncurses-bin ncurses-term
+          if [ "${{ matrix.arch }}" = aarch64 ]; then
+            $SUDO apt-get install -y --no-install-recommends qemu-user-static
+          fi
+      - name: Build (static, -Werror)
+        env:
+          CST_LINUX_CHECK: ${{ matrix.check }}
+        run: bash scripts/package_linux.sh ${{ matrix.arch }}
+      - name: Smoke test
         run: |
-          ls -lah dist/windows-x86_64/
-          ls -lah dist/cst-agent-*-windows-x86_64.zip
-          cat dist/cst-agent-*-windows-x86_64.zip.sha256
-          unzip -l dist/cst-agent-*-windows-x86_64.zip | head -20
-      # Auto-publish to Gitea Releases (v$CST_VERSION from include/cst_version.h).
-      # Prefer repo secret RELEASE_TOKEN (write:repository); fall back to the
-      # job token. Skipped on pull_request and when no token is available.
+          d=$(ls -d dist/cst-agent-*-linux-${{ matrix.arch }})
+          file "$d/cst-agent"
+          run=""
+          [ "${{ matrix.arch }}" = aarch64 ] && run=qemu-aarch64-static
+          $run "$d/cst-agent" --version
+          $run "$d/cst-agent" --help >/dev/null
+          $run "$d/cst-agent" --workspace "$PWD" --list-sessions
+          cat dist/cst-agent-*-linux-${{ matrix.arch }}.tar.gz.sha256
+      # Release vVERSION (from include/cst_version.h) on Gitea. Prefer repo
+      # secret RELEASE_TOKEN (write:repository); fall back to the job token.
       - name: Publish Gitea Release
         if: github.event_name == 'push'
         env:
@@ -134,4 +117,59 @@ jobs:
             echo "::warning::no RELEASE_TOKEN / GITHUB_TOKEN; skip auto-release"
             exit 0
           fi
-          bash scripts/release_windows.sh
+          bash scripts/release.sh dist/cst-agent-*-linux-${{ matrix.arch }}.tar.gz
+
+  # Release: mingw-w64 UCRT gcc (Debian trixie) with -Werror.
+  # dist/cst-agent-VERSION-windows-x86_64.zip and -setup.exe (NSIS)
+  windows:
+    needs: tcc-check
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    container: debian:trixie
+    steps:
+      - name: Install tools
+        run: |
+          # No CA certificates in the image yet, so the mirror is plain http.
+          sed -i 's#https\?://deb.debian.org#http://mirrors.tuna.tsinghua.edu.cn#g' \
+            /etc/apt/sources.list.d/debian.sources
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            ca-certificates curl git build-essential cmake ninja-build make \
+            pkg-config python3 perl zip unzip xz-utils patch file \
+            gcc-mingw-w64-ucrt64 binutils-mingw-w64-ucrt64 nsis
+      - name: Checkout
+        env:
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_SHA: ${{ github.sha }}
+        run: |
+          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
+            -o /tmp/ci_checkout.sh
+          bash /tmp/ci_checkout.sh
+      - name: Cross-build zip and installer
+        env:
+          CST_WIN_CFLAGS: -Wall -Wextra -Werror
+        run: bash scripts/ci_windows_cross.sh
+      - name: Verify
+        run: |
+          ls -lah dist/windows-x86_64/
+          file dist/windows-x86_64/cst-agent.exe dist/cst-agent-*-windows-x86_64-setup.exe
+          cat dist/cst-agent-*-windows-x86_64.zip.sha256 dist/cst-agent-*-windows-x86_64-setup.exe.sha256
+          unzip -l dist/cst-agent-*-windows-x86_64.zip
+      - name: Publish Gitea Release
+        if: github.event_name == 'push'
+        env:
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CST_GITEA: ${{ github.server_url }}
+          CST_REPO: ${{ github.repository }}
+          GITHUB_REF: ${{ github.ref }}
+          CI: "true"
+        run: |
+          export GITEA_TOKEN="${RELEASE_TOKEN:-${GITHUB_TOKEN:-}}"
+          if [[ -z "${GITEA_TOKEN}" ]]; then
+            echo "::warning::no RELEASE_TOKEN / GITHUB_TOKEN; skip auto-release"
+            exit 0
+          fi
+          bash scripts/release.sh dist/cst-agent-*-windows-x86_64.zip \
+            dist/cst-agent-*-windows-x86_64-setup.exe
diff --git a/.gitignore b/.gitignore
index 684e0d9..3e2fb55 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,6 +26,9 @@ third_party/ncurses-*.tar.gz
 third_party/busybox-w32/
 third_party/busybox-src/
 third_party/prefix-mingw/
+third_party/prefix-linux-*/
+third_party/build-linux-*/
+third_party/src/
 vendor/sashidown/*.o
 vendor/sashidown/src/*.o
 vendor/sashidown/libsashidown.a
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 17e57de..ee6bc3f 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -172,9 +172,12 @@ endif()
 if(WIN32)
   # MinGW has no <regex.h>: musl's TRE engine, UTF-8 aware (vendor/tre-regex)
   include_directories(vendor/tre-regex)
-  list(APPEND CST_CORE_SOURCES
+  set(_CST_TRE_SOURCES
     vendor/tre-regex/regcomp.c vendor/tre-regex/regexec.c
     vendor/tre-regex/regerror.c vendor/tre-regex/tre-mem.c)
+  list(APPEND CST_CORE_SOURCES ${_CST_TRE_SOURCES})
+  # Upstream code, kept as is: CST_WIN_CFLAGS=-Werror must not apply to it.
+  set_source_files_properties(${_CST_TRE_SOURCES} PROPERTIES COMPILE_OPTIONS "-w")
 endif()
 
 set(CST_SOURCES ${CST_CORE_SOURCES} src/main.c)
@@ -307,7 +310,7 @@ foreach(t ${_CST_SMALL_TESTS})
   target_include_directories(${t} PRIVATE include "${CJSON_DIR}")
   target_compile_definitions(${t} PRIVATE _GNU_SOURCE)
   if(NOT WIN32)
-    target_link_libraries(${t} PRIVATE m)
+    target_link_libraries(${t} PRIVATE m Threads::Threads)
   endif()
   cst_win_exe(${t})
   add_test(NAME ${t} COMMAND ${t} WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}")
diff --git a/Makefile b/Makefile
index d280c1b..6718306 100644
--- a/Makefile
+++ b/Makefile
@@ -7,6 +7,7 @@ PREFIX ?= /usr/local
 DESTDIR ?=
 UNAME_S := $(shell uname -s 2>/dev/null)
 UNAME_O := $(shell uname -o 2>/dev/null)
+comma := ,
 
 # Android (Termux): pthreads live in libc.
 PTHREAD_LIBS := -lpthread
@@ -26,6 +27,15 @@ CPPFLAGS += -D_DARWIN_C_SOURCE
 endif
 PKGC = $(PKG_ENV) $(PKG_CONFIG)
 
+# STATIC=1: fully static link (the musl release builds).
+STATIC ?= 0
+LINK_STATIC :=
+ifeq ($(STATIC),1)
+PKGC += --static
+LINK_STATIC := -static
+endif
+LDFLAGS += $(LINK_STATIC)
+
 # Wide-character curses: ncursesw, else ncurses (macOS/BSD build it wide).
 CURSES_PC := $(shell for p in ncursesw ncurses; do $(PKGC) --exists $$p 2>/dev/null && { echo $$p; exit 0; }; done)
 ifneq ($(CURSES_PC),)
@@ -50,9 +60,19 @@ CST_WEBUI ?= 1
 PKG_CFLAGS := $(CURL_CFLAGS) $(CURSES_CFLAGS)
 PKG_LIBS := $(CURL_LIBS) $(CURSES_LIBS)
 
-CPPFLAGS += -Iinclude -I.gen -I$(SD_DIR)/include -I$(CJSON_DIR) -D_XOPEN_SOURCE_EXTENDED $(PKG_CFLAGS)
+# tcc writes no rpath of its own, so shared libs found via pkg-config -L
+# (Nix store, /opt prefixes) would not load at run time.
+RPATH_LIBS :=
+ifneq ($(findstring tcc,$(notdir $(CC))),)
+ifneq ($(STATIC),1)
+RPATH_LIBS := $(patsubst -L%,-Wl$(comma)-rpath$(comma)%,$(filter -L%,$(PKG_LIBS)))
+endif
+endif
+
+# Keep POSIX declarations visible for shared test helpers (notably symlink()).
+CPPFLAGS += -Iinclude -I.gen -I$(SD_DIR)/include -I$(CJSON_DIR) -D_POSIX_C_SOURCE=200809L -D_XOPEN_SOURCE_EXTENDED $(PKG_CFLAGS)
 LDFLAGS += -L$(SD_DIR)
-LDLIBS += -lsashidown -lm $(PKG_LIBS) $(PTHREAD_LIBS)
+LDLIBS += -lsashidown -lm $(PKG_LIBS) $(PTHREAD_LIBS) $(RPATH_LIBS)
 
 WEB_DIR := web
 WEB_ASSETS := $(wildcard $(WEB_DIR)/*.html) $(wildcard $(WEB_DIR)/*.js) \
@@ -141,7 +161,11 @@ ifneq ($(CST_WEBUI),0)
 TESTS += tests/test_webui
 endif
 
-TEST_LIBS = -L$(SD_DIR) -lsashidown -lm $(CURL_LIBS) $(PTHREAD_LIBS)
+TEST_SYS_LIBS = -lm $(PTHREAD_LIBS) $(LINK_STATIC)
+TEST_LIBS = -L$(SD_DIR) -lsashidown $(CURL_LIBS) $(RPATH_LIBS) $(TEST_SYS_LIBS)
+# cst_test_util.h has static os_* helpers; gcc drops them when unused, tcc
+# keeps them, so the small tests link the OS layer too.
+TEST_OS_SRC = src/os_compat.c src/os_win.c src/util.c
 
 .PHONY: all clean check demo sashidown-lib FORCE cmake-gcc cmake-clang asan install uninstall
 
@@ -184,26 +208,26 @@ cst-agent: $(OBJ) $(SD_DIR)/libsashidown.a
 src/tui.o: src/tui.c $(HDRS) $(SD_DIR)/include/sashidown.h
 	$(CC) $(CFLAGS) $(CPPFLAGS) -c -o $@ $<
 
-tests/test_ctl_frontier: tests/test_ctl_frontier.c src/ctl_parse.c include/ctl.h
-	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_ctl_frontier.c src/ctl_parse.c
+tests/test_ctl_frontier: tests/test_ctl_frontier.c src/ctl_parse.c include/ctl.h $(TEST_OS_SRC)
+	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_ctl_frontier.c src/ctl_parse.c $(TEST_OS_SRC) $(TEST_SYS_LIBS)
 
-tests/test_ctl_heredoc: tests/test_ctl_heredoc.c src/ctl_parse.c include/ctl.h
-	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_ctl_heredoc.c src/ctl_parse.c
+tests/test_ctl_heredoc: tests/test_ctl_heredoc.c src/ctl_parse.c include/ctl.h $(TEST_OS_SRC)
+	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_ctl_heredoc.c src/ctl_parse.c $(TEST_OS_SRC) $(TEST_SYS_LIBS)
 
-tests/test_json_baseline: tests/test_json_baseline.c src/json_baseline.c $(CJSON_DIR)/cJSON.c $(HDRS)
-	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_json_baseline.c src/json_baseline.c $(CJSON_DIR)/cJSON.c -lm
+tests/test_json_baseline: tests/test_json_baseline.c src/json_baseline.c $(CJSON_DIR)/cJSON.c $(HDRS) $(TEST_OS_SRC)
+	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_json_baseline.c src/json_baseline.c $(CJSON_DIR)/cJSON.c $(TEST_OS_SRC) $(TEST_SYS_LIBS)
 
-tests/test_replay_starvation: tests/test_replay_starvation.c src/ctl_parse.c src/json_baseline.c $(CJSON_DIR)/cJSON.c
-	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_replay_starvation.c src/ctl_parse.c src/json_baseline.c $(CJSON_DIR)/cJSON.c -lm
+tests/test_replay_starvation: tests/test_replay_starvation.c src/ctl_parse.c src/json_baseline.c $(CJSON_DIR)/cJSON.c $(TEST_OS_SRC)
+	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_replay_starvation.c src/ctl_parse.c src/json_baseline.c $(CJSON_DIR)/cJSON.c $(TEST_OS_SRC) $(TEST_SYS_LIBS)
 
-tests/test_replay_real: tests/test_replay_real.c src/ctl_parse.c src/json_baseline.c $(CJSON_DIR)/cJSON.c
-	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_replay_real.c src/ctl_parse.c src/json_baseline.c $(CJSON_DIR)/cJSON.c -lm
+tests/test_replay_real: tests/test_replay_real.c src/ctl_parse.c src/json_baseline.c $(CJSON_DIR)/cJSON.c $(TEST_OS_SRC)
+	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_replay_real.c src/ctl_parse.c src/json_baseline.c $(CJSON_DIR)/cJSON.c $(TEST_OS_SRC) $(TEST_SYS_LIBS)
 
-tests/test_mm_tool: tests/test_mm_tool.c src/mm_tool.c include/mm_tool.h
-	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_mm_tool.c src/mm_tool.c
+tests/test_mm_tool: tests/test_mm_tool.c src/mm_tool.c include/mm_tool.h $(TEST_OS_SRC)
+	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_mm_tool.c src/mm_tool.c $(TEST_OS_SRC) $(TEST_SYS_LIBS)
 
-tests/test_textsel: tests/test_textsel.c src/textsel.c src/os_compat.c src/os_win.c src/util.c include/cst_textsel.h
-	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_textsel.c src/textsel.c src/os_compat.c src/os_win.c src/util.c
+tests/test_textsel: tests/test_textsel.c src/textsel.c $(TEST_OS_SRC) include/cst_textsel.h
+	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_textsel.c src/textsel.c $(TEST_OS_SRC) $(TEST_SYS_LIBS)
 
 tests/test_markdown: tests/test_markdown.c $(SD_DIR)/libsashidown.a
 	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ tests/test_markdown.c $(LDFLAGS) -lsashidown -lm
diff --git a/README.md b/README.md
index d48265a..179b8a6 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,10 @@ cst-agent --version
 cd ~/my-project && cst-agent
 ```
 
+不想编译：[Release](https://git.whcself.xyz/WHC/CST-agent/releases) 里有静态链接的 Linux 单文件
+（`cst-agent-VERSION-linux-{x86_64,x86,aarch64}.tar.gz`，musl，任何发行版都能直接跑），解压后把 `cst-agent`
+放进 `PATH` 即可；每个文件旁边有 `.sha256`。
+
 Windows 10 1903+（PowerShell，不需要管理员）：
 
 ```powershell
@@ -34,7 +38,8 @@ irm https://git.whcself.xyz/WHC/CST-agent/raw/branch/main/scripts/install_window
 # 新开终端后：cd 到项目目录运行 cst-agent；升级用 cst-agent-update
 ```
 
-详见 [docs/README-windows.md](docs/README-windows.md)。
+也可以下载 Release 里的安装包 `cst-agent-VERSION-windows-x86_64-setup.exe`（按用户安装、自动加 PATH、
+开始菜单有 WebUI 入口），或便携版 zip。详见 [docs/README-windows.md](docs/README-windows.md)。
 
 一键脚本可以重复运行：已有仓库会 `git pull --ff-only`，代码有更新时干净重编，然后重新安装；
 同时装一个 `cst-agent-update` 命令（等同重跑脚本）。NixOS 上会自动进 `nix-shell` 编译。
@@ -49,7 +54,8 @@ irm https://git.whcself.xyz/WHC/CST-agent/raw/branch/main/scripts/install_window
 | Linux | [`scripts/bootstrap_linux.sh`](scripts/bootstrap_linux.sh) |
 | Termux | [`scripts/bootstrap_termux.sh`](scripts/bootstrap_termux.sh) |
 | Windows 安装 / 升级 | [`scripts/install_windows.ps1`](scripts/install_windows.ps1)（从 Release 安装），之后 `cst-agent-update` |
-| Windows 交叉构建（在 Linux 上） | [`scripts/bootstrap_windows.sh`](scripts/bootstrap_windows.sh) → `dist/windows-x86_64/` |
+| Linux 静态发行包（musl 交叉） | [`scripts/package_linux.sh`](scripts/package_linux.sh) `x86_64\|x86\|aarch64` → `dist/*.tar.gz` |
+| Windows 交叉构建（在 Linux 上） | [`scripts/bootstrap_windows.sh`](scripts/bootstrap_windows.sh) → `dist/windows-x86_64/`、zip 和安装包 |
 | Windows 原生构建（MSYS2 UCRT64） | [`scripts/bootstrap_msys2.sh`](scripts/bootstrap_msys2.sh) → `dist/windows-x86_64/` |
 
 ### 迷你验收工程（论文案例）
@@ -86,6 +92,7 @@ cd CST-agent
 make            # 依赖 pkg-config 找 libcurl / ncursesw（找不到时退回 ncurses）
 make check      # 单元测试 + 截断实验（含真实录制流）
 make asan       # AddressSanitizer + UBSan 构建并跑全部测试
+make CC=tcc AR=ar check   # TinyCC：整套构建 + 测试十几秒（CI 的校验就是这条）
 make install PREFIX=$HOME/.local   # 或 sudo make install（默认 /usr/local）
 ```
 
@@ -111,7 +118,7 @@ cmake -B build-hd -DCST_BUILD_TUI=OFF && cmake --build build-hd
 ./scripts/bootstrap_windows.sh
 ```
 
-依赖：`gcc` 或 `clang`、`libcurl`、TUI 需 `ncursesw`（Windows 版用打过补丁的 ncurses 6.6，脚本自动编译）。
+依赖：`gcc`、`clang` 或 `tcc`（0.9.27 mob 以上）、`libcurl`、TUI 需 `ncursesw`（Windows 版用打过补丁的 ncurses 6.6，脚本自动编译）。
 Sashidown（`vendor/sashidown`）与 cJSON（`vendor/cjson`，MIT）已随仓库提供。  
 API Key：TUI 里输入并按 provider 保存到配置目录的 `credentials`（权限 0600）；`/key` 更换，`--ask-key` 在命令行输入。
 `--api-key` 只用于本次进程、不落盘；`DEEPSEEK_API_KEY` 等环境变量和 `CST_API_KEY` 仅作为没有保存 key 时的兜底（方便 CI）。
@@ -120,7 +127,7 @@ API Key：TUI 里输入并按 provider 保存到配置目录的 `credentials`（
 
 | OS | Arch | 编译器 | Headless | TUI | Shell |
 |---|---|---|---|---|---|
-| Linux（glibc / musl） | x86_64 / aarch64 | GCC, Clang | yes | ncursesw | `/bin/sh` 或旁路 `busybox` |
+| Linux（glibc / musl） | x86_64 / x86 / aarch64 | GCC, Clang, TinyCC | yes | ncursesw | `/bin/sh` 或旁路 `busybox` |
 | WSL2 | x86_64 | 同 Linux | yes | ncursesw | `/bin/sh`（工作区建议放在 Linux 文件系统内） |
 | macOS | arm64 / x86_64 | Apple Clang | yes | ncurses（Homebrew） | `/bin/sh` |
 | Android Termux | aarch64 / … | Clang (Termux) | yes | ncurses（Termux 包） | `$PREFIX/bin/sh`；可旁路 busybox |
@@ -164,6 +171,18 @@ make && make install      # 装到 Termux 的 $PREFIX/bin，之后任意目录
 临时目录：依次试 `$TMPDIR`、`$PREFIX/tmp`、`/tmp`、`/var/tmp`、`~/.cache/cst-agent/tmp`，用第一个真能建文件的，
 并写回 `TMPDIR` 给 shell 子进程和沙箱用（Termux 的 `/tmp` 常常不存在或被 SELinux 拒绝）。
 
+### Linux 静态发行包
+
+```bash
+scripts/package_linux.sh x86_64     # 或 x86 / aarch64；CST_LINUX_CHECK=1 顺便跑 make check
+```
+
+用 Bootlin 的 musl 交叉 gcc（固定版本、校验 sha256）静态编译 mbedTLS、curl 8.22（只开 HTTP/HTTPS）和宽字符 ncurses，
+再以 `STATIC=1` 和 `-Werror` 编出 `cst-agent`，产物是 `dist/cst-agent-VERSION-linux-ARCH.tar.gz`（+ `.sha256`）。
+宿主需要 `cmake ninja make perl` 以及 `tic`/`infocmp` 和终端条目（Debian：`ncurses-bin ncurses-term`）。
+ncurses 会去常见目录找 terminfo，找不到时用编进去的 `xterm-256color`、`xterm`、`screen-256color`、`tmux-256color`、`linux`、`vt100`。
+CA 证书：`CST_CA_BUNDLE` → `SSL_CERT_FILE` → 各发行版的常见位置（Debian/Ubuntu、Fedora/RHEL、openSUSE、Alpine）。
+
 ### Windows 发行包
 
 见 [docs/README-windows.md](docs/README-windows.md)（安装、编码、沙箱、构建、已知限制）。
@@ -172,10 +191,17 @@ make && make install      # 装到 Termux 的 $PREFIX/bin，之后任意目录
 ./scripts/bootstrap_windows.sh   # Linux 交叉编译；Windows 上在 MSYS2 UCRT64 里用 scripts/bootstrap_msys2.sh
 ```
 
-产物：`dist/windows-x86_64/`（静态链接的 `cst-agent.exe` + `busybox.exe`，无其他 DLL）和
-`dist/cst-agent-VERSION-windows-x86_64.zip`。CI 在 `main` / `v*` tag 推送且交叉构建成功后会自动上传到
-Gitea Release `vVERSION`（同名资源会被替换）；仓库可设 `RELEASE_TOKEN`（`write:repository`），否则用任务自带 token。
-本地：`GITEA_TOKEN=... scripts/release_windows.sh`。
+产物：`dist/windows-x86_64/`（静态链接的 `cst-agent.exe` + `busybox.exe`，无其他 DLL）、
+`dist/cst-agent-VERSION-windows-x86_64.zip`，以及装了 `makensis` 时的安装包 `dist/cst-agent-VERSION-windows-x86_64-setup.exe`。
+
+### CI 与 Release
+
+CI 用 TinyCC 校验（构建、`make check`、WebUI 端到端），通过后用 gcc（`-Werror`）出发行包：
+Linux x86_64 / x86 / aarch64 静态包（x86 两种跑 `make check`，aarch64 用 qemu 冒烟），
+Windows x86_64 的 zip 和安装包（Debian 的 mingw-w64 UCRT gcc + NSIS）。
+推送到 `main` 或 `v*` tag 时每个任务把自己的产物上传到 Gitea Release `vVERSION`（同名资源会被替换）；
+仓库可设 `RELEASE_TOKEN`（`write:repository`），否则用任务自带 token。
+本地：`GITEA_TOKEN=... scripts/release.sh dist/cst-agent-*.tar.gz dist/cst-agent-*.zip dist/cst-agent-*-setup.exe`。
 
 环境变量：`CST_SHELL`、`CST_EXE_DIR`、`CST_AUTO_APPROVE` 等。
 
@@ -219,6 +245,7 @@ Gitea Release `vVERSION`（同名资源会被替换）；仓库可设 `RELEASE_T
 | `CST_METRICS=0` / `CST_METRICS_PATH` | 关闭 / 指定计时埋点 JSONL（默认 `.agent/metrics/<session>.jsonl`） |
 | `CST_RECORD_SSE=DIR` / `CST_REPLAY_SSE=DIR` | 录制 / 回放原始 SSE 流（`NNNN.sse` + `NNNN.req.json`） |
 | `CST_APPROVAL=ask\|auto\|yolo` / `CST_SANDBOX=off\|landlock\|seccomp` | 审批模式 / 关闭沙箱（回落到只读白名单规则）或只用指定沙箱 |
+| `CST_CA_BUNDLE` | HTTPS 用的 CA 证书文件（默认：`SSL_CERT_FILE`、libcurl 自带路径、常见发行版位置；Windows 用系统证书库） |
 | `CST_MODELS`、`CST_AUTO_APPROVE=1`、`CST_SHELL`、`CST_EXE_DIR` | 模型列表、自动批准（= yolo）、shell、旁路 busybox |
 
 ## Run
diff --git a/cmake/mingw-w64-x86_64.cmake b/cmake/mingw-w64-x86_64.cmake
index c0263eb..a8573bf 100644
--- a/cmake/mingw-w64-x86_64.cmake
+++ b/cmake/mingw-w64-x86_64.cmake
@@ -2,17 +2,25 @@
 #   ./scripts/build_third_party_mingw.sh curl
 #   cmake -B build-win -DCMAKE_TOOLCHAIN_FILE=cmake/mingw-w64-x86_64.cmake \
 #     -DCST_BUILD_TUI=OFF
+# $MINGW_HOST picks the tool prefix (default x86_64-w64-mingw32; Debian's UCRT
+# cross gcc is x86_64-w64-mingw32ucrt).
 set(CMAKE_SYSTEM_NAME Windows)
 set(CMAKE_SYSTEM_PROCESSOR x86_64)
 
-set(CMAKE_C_COMPILER x86_64-w64-mingw32-gcc)
-set(CMAKE_CXX_COMPILER x86_64-w64-mingw32-g++)
-set(CMAKE_RC_COMPILER x86_64-w64-mingw32-windres)
+if(DEFINED ENV{MINGW_HOST} AND NOT "$ENV{MINGW_HOST}" STREQUAL "")
+  set(_MINGW_HOST "$ENV{MINGW_HOST}")
+else()
+  set(_MINGW_HOST x86_64-w64-mingw32)
+endif()
+
+set(CMAKE_C_COMPILER ${_MINGW_HOST}-gcc)
+set(CMAKE_CXX_COMPILER ${_MINGW_HOST}-g++)
+set(CMAKE_RC_COMPILER ${_MINGW_HOST}-windres)
 
 get_filename_component(_AGENT_ROOT "${CMAKE_CURRENT_LIST_DIR}/.." ABSOLUTE)
 set(_MINGW_PREFIX "${_AGENT_ROOT}/third_party/prefix-mingw")
 list(APPEND CMAKE_PREFIX_PATH "${_MINGW_PREFIX}")
-set(CMAKE_FIND_ROOT_PATH "/usr/x86_64-w64-mingw32" "${_MINGW_PREFIX}")
+set(CMAKE_FIND_ROOT_PATH "/usr/${_MINGW_HOST}" "${_MINGW_PREFIX}")
 set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
 set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY BOTH)
 set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE BOTH)
diff --git a/docs/README-windows.md b/docs/README-windows.md
index 7b1067f..2634546 100644
--- a/docs/README-windows.md
+++ b/docs/README-windows.md
@@ -5,6 +5,20 @@
 
 ## 安装
 
+### 安装包
+
+从 [Release](https://git.whcself.xyz/WHC/CST-agent/releases) 下载
+`cst-agent-VERSION-windows-x86_64-setup.exe` 运行即可：按当前用户安装到
+`%LOCALAPPDATA%\Programs\cst-agent`（不需要管理员），把这个目录加进**用户** PATH，
+开始菜单里放一个“CST-Agent WebUI”（在用户目录启动 `cst-agent --web --web-open`）。
+系统低于 Windows 10 1903 时安装包会直接拒绝。
+
+卸载：设置 → 应用 → CST-Agent，或运行安装目录里的 `uninstall.exe`；会去掉 PATH 里的这一项。
+API key 和设置在 `%APPDATA%\cst-agent`，卸载时保留。
+安装包装的文件和 zip 一样，所以之后也能用 `cst-agent-update` 升级，或者重新运行新版安装包覆盖。
+
+### PowerShell 脚本
+
 在 PowerShell 里（Windows PowerShell 5.1 或 PowerShell 7 都行）：
 
 ```powershell
@@ -123,7 +137,9 @@ windows-x86_64/
 
 ## 从源码构建
 
-两种方式产物一样：`dist/windows-x86_64/` 和 `dist/cst-agent-VERSION-windows-x86_64.zip`。
+两种方式产物一样：`dist/windows-x86_64/` 和 `dist/cst-agent-VERSION-windows-x86_64.zip`；
+装了 `makensis`（NSIS）时还有安装包 `dist/cst-agent-VERSION-windows-x86_64-setup.exe`
+（脚本在 `scripts/windows/cst-agent.nsi`）。
 第三方依赖（curl、ncurses、busybox-w32）都按固定版本从源码编译、静态链接。
 
 ### 在 Linux 上交叉编译
@@ -134,8 +150,16 @@ cd CST-agent
 scripts/bootstrap_windows.sh
 ```
 
-NixOS / 有 Nix 时自动进 `shell-win.nix`（`pkgsCross.ucrt64`）；否则需要 UCRT 版的
-`x86_64-w64-mingw32-gcc`（带 winpthreads）、cmake、ninja、git、perl。
+NixOS / 有 Nix 时自动进 `shell-win.nix`（`pkgsCross.ucrt64`，带 NSIS）；否则需要 UCRT 版的
+mingw-w64 gcc（带 winpthreads）、cmake、ninja、git、perl。工具前缀由 `MINGW_HOST` 指定，默认
+`x86_64-w64-mingw32`；Debian trixie 起的 `gcc-mingw-w64-ucrt64` 是 `x86_64-w64-mingw32ucrt`：
+
+```bash
+sudo apt install gcc-mingw-w64-ucrt64 binutils-mingw-w64-ucrt64 nsis cmake ninja-build perl
+MINGW_HOST=x86_64-w64-mingw32ucrt scripts/bootstrap_windows.sh
+```
+
+`CST_WIN_CFLAGS` 给 `cst-agent.exe` 追加编译选项（CI 用 `-Wall -Wextra -Werror`）。
 
 ### 在 Windows 上用 MSYS2 原生编译
 
@@ -159,17 +183,18 @@ scripts/bootstrap_msys2.sh
 
 ### 发布
 
-CI：推 `main` 或 `v*` tag 且 `windows-cross` 成功后，自动把 zip / `.sha256` 发到
+CI：推 `main` 或 `v*` tag 且 `windows` 任务成功后，自动把 zip、安装包和各自的 `.sha256` 发到
 Gitea Release `vVERSION`（版本来自 `include/cst_version.h`；同名资源替换）。仓库 Secrets
 可设 `RELEASE_TOKEN`（`write:repository`），没有则用 Actions 自带 token。
 
 本地：
 
 ```bash
-GITEA_TOKEN=... scripts/release_windows.sh --build
+scripts/bootstrap_windows.sh
+GITEA_TOKEN=... scripts/release.sh dist/cst-agent-*-windows-x86_64.zip dist/cst-agent-*-windows-x86_64-setup.exe
 ```
 
-创建（或复用）`vVERSION` Release，上传 zip 和 `.sha256`。token 只从环境变量读取，经 stdin
+创建（或复用）`vVERSION` Release，上传给出的文件和旁边的 `.sha256`。token 只从环境变量读取，经 stdin
 交给 curl，不会出现在命令行参数、磁盘或输出里。发版前先 bump `cst_version.h`；推
 `vX.Y.Z` tag 时必须与头文件一致。
 
diff --git a/docs/compat.md b/docs/compat.md
index e331012..6ea54a9 100644
--- a/docs/compat.md
+++ b/docs/compat.md
@@ -21,11 +21,11 @@ The Makefile picks `ncursesw`, then `ncurses`, through pkg-config. On macOS it
 adds Homebrew's keg-only `ncurses`/`curl` to `PKG_CONFIG_PATH`; without
 Homebrew it falls back to the system `-lncurses` (wide-character capable).
 
-Verified so far: NixOS x86_64 with gcc and clang (`-Werror`, `make check`,
-`make asan`, ctest), and every source compiled `-fsyntax-only` with
-`x86_64-unknown-linux-musl-gcc` without warnings. Full musl, macOS and WSL
-builds run in CI (`.gitea/workflows/ci.yml`; the macOS job needs a runner and
-the `HAVE_MACOS_RUNNER` variable) or by hand with the checklist below.
+Verified so far: NixOS x86_64 with gcc, clang and TinyCC (`-Werror` except
+tcc, `make check`, `make asan`, ctest). CI (`.gitea/workflows/ci.yml`) checks
+with TinyCC on Debian and builds the static musl releases for x86_64, x86 and
+aarch64 with gcc `-Werror` (`make check` on both x86 targets, a qemu smoke
+test on aarch64). macOS and WSL are checked by hand with the list below.
 
 ## Files
 
diff --git a/include/cst_agent.h b/include/cst_agent.h
index c2da4be..429c83f 100644
--- a/include/cst_agent.h
+++ b/include/cst_agent.h
@@ -278,6 +278,8 @@ int cst_llm_list_models(const char *api_base, const char *api_key,
 char *cst_llm_build_body(const cst_llm_request_t *req);
 /* Reset the CST_RECORD_SSE / CST_REPLAY_SSE sequence counter. */
 void cst_llm_trace_reset(void);
+/* Set CURLOPT_CAINFO on a CURL * when a CA bundle file is known. */
+void cst_curl_apply_ca(void *curl);
 
 /* on_permission answers */
 #define CST_PERM_DENY 0
diff --git a/scripts/bootstrap_windows.sh b/scripts/bootstrap_windows.sh
index 6d92ce2..2a7763a 100755
--- a/scripts/bootstrap_windows.sh
+++ b/scripts/bootstrap_windows.sh
@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 # Linux host: cross-build the Windows x86_64 release (mingw-w64, UCRT, static).
 #   scripts/bootstrap_windows.sh [repo-dir]
-# With Nix the toolchain comes from shell-win.nix; otherwise x86_64-w64-mingw32-gcc
-# (UCRT flavour, with winpthreads), cmake, ninja, git and perl must be installed.
+# With Nix the toolchain comes from shell-win.nix; otherwise $MINGW_HOST-gcc
+# (default x86_64-w64-mingw32; UCRT flavour, with winpthreads), cmake, ninja,
+# git and perl must be installed. CST_WIN_CFLAGS adds C flags (CI: -Werror).
 # Output: dist/windows-x86_64/ and dist/cst-agent-VERSION-windows-x86_64.zip
 set -euo pipefail
 
@@ -21,15 +22,17 @@ if [[ ! -f "$DIR/CMakeLists.txt" ]]; then
 fi
 cd "$DIR"
 
-if ! command -v x86_64-w64-mingw32-gcc >/dev/null && [[ -z "${IN_NIX_SHELL:-}" ]] &&
+H="${MINGW_HOST:-x86_64-w64-mingw32}"
+if ! command -v "$H-gcc" >/dev/null && [[ -z "${IN_NIX_SHELL:-}" ]] &&
   command -v nix-shell >/dev/null; then
   exec nix-shell shell-win.nix --run "$(printf '%q ' "$0" "$PWD")"
 fi
 
 need() { command -v "$1" >/dev/null || { echo "missing $1 (mingw-w64 UCRT gcc, cmake, ninja, git, perl)" >&2; exit 1; }; }
-need git; need cmake; need ninja; need perl; need x86_64-w64-mingw32-gcc
-if ! printf '#include <stdio.h>\n' | x86_64-w64-mingw32-gcc -dM -E - | grep -qw _UCRT; then
-  echo "x86_64-w64-mingw32-gcc targets msvcrt; the UTF-8 manifest needs a UCRT toolchain" >&2
+export MINGW_HOST="$H"
+need git; need cmake; need ninja; need perl; need "$H-gcc"
+if ! printf '#include <stdio.h>\n' | "$H-gcc" -dM -E - | grep -qw _UCRT; then
+  echo "$H-gcc targets msvcrt; the UTF-8 manifest needs a UCRT toolchain" >&2
   exit 1
 fi
 
@@ -40,7 +43,8 @@ fi
 echo "==> cmake (Windows, TUI)"
 cmake -S . -B build-win-tui -G Ninja \
   -DCMAKE_TOOLCHAIN_FILE=cmake/mingw-w64-x86_64.cmake \
-  -DCMAKE_BUILD_TYPE=Release -DCST_BUILD_TUI=ON
+  -DCMAKE_BUILD_TYPE=Release -DCST_BUILD_TUI=ON \
+  -DCMAKE_C_FLAGS="${CST_WIN_CFLAGS:-}"
 # Package only needs the agent binary; skip host-unrunnable Win32 tests.
 cmake --build build-win-tui --target cst-agent
 
diff --git a/scripts/build_third_party_linux.sh b/scripts/build_third_party_linux.sh
new file mode 100755
index 0000000..a943ce6
--- /dev/null
+++ b/scripts/build_third_party_linux.sh
@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+# Build pinned static deps for a Linux release into third_party/prefix-linux-ARCH:
+# mbedTLS, libcurl (HTTP(S) only, mbedTLS) and wide ncurses.
+#   scripts/build_third_party_linux.sh x86_64|x86|aarch64 [all|mbedtls|curl|ncurses]
+# Uses LINUX_HOST-gcc from PATH, else fetches it via ci_linux_toolchain.sh.
+# Host tools: cmake ninja make perl, and tic/infocmp with the fallback
+# terminal entries (Debian: ncurses-bin ncurses-term).
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+ARCH="${1:?usage: $0 x86_64|x86|aarch64 [all|mbedtls|curl|ncurses]}"
+TP="$ROOT/third_party"
+PREFIX="$TP/prefix-linux-$ARCH"
+SRC="$TP/src"
+WORK="$TP/build-linux-$ARCH"
+JOBS="${JOBS:-$(nproc 2>/dev/null || echo 4)}"
+
+MBEDTLS_VER=3.6.7
+MBEDTLS_SHA=a7e8bcbec0e6f761b4af24f25677626b35f762f68eef79c08677a363212d11f6
+CURL_VER=8.22.0
+CURL_SHA=f7ef3ae8a22e521f289803fe93543eb64c329b58aa73a9e224dfd915a2a5f4f7
+NCURSES_VER=6.6
+NCURSES_SHA=355b4cbbed880b0381a04c46617b7656e362585d52e9cf84a67e2009b749ff11
+# Compiled in, so the TUI starts even where no terminfo database is found.
+NCURSES_FALLBACKS=xterm-256color,xterm,screen-256color,tmux-256color,linux,vt100
+
+if [[ -z "${LINUX_HOST:-}" ]] || ! command -v "$LINUX_HOST-gcc" >/dev/null; then
+  read -r LINUX_HOST bindir < <(bash "$ROOT/scripts/ci_linux_toolchain.sh" "$ARCH")
+  export PATH="$bindir:$PATH"
+fi
+T="$LINUX_HOST-"
+need() { command -v "$1" >/dev/null || { echo "missing: $1" >&2; exit 1; }; }
+need "${T}gcc"
+need cmake
+need ninja
+need make
+need tic
+need infocmp
+mkdir -p "$PREFIX" "$SRC" "$WORK"
+
+fetch() { # file sha url...
+  local file="$1" sha="$2" u
+  shift 2
+  if [[ -f "$SRC/$file" ]] && echo "$sha  $SRC/$file" | sha256sum -c --quiet - 2>/dev/null; then
+    return 0
+  fi
+  for u in "$@"; do
+    echo "  try $u"
+    if curl -fsSL --retry 2 --connect-timeout 15 --max-time 600 -o "$SRC/$file.part" "$u" &&
+        echo "$sha  $SRC/$file.part" | sha256sum -c --quiet -; then
+      mv "$SRC/$file.part" "$SRC/$file"
+      return 0
+    fi
+  done
+  rm -f "$SRC/$file.part"
+  echo "download failed: $file" >&2
+  exit 1
+}
+
+unpack() { # file dir
+  rm -rf "${WORK:?}/$2"
+  tar -C "$WORK" -xf "$SRC/$1"
+}
+
+gh() { # path -> GitHub URL candidates (CN proxies first)
+  printf '%s\n' "https://ghfast.top/https://github.com/$1" \
+    "https://ghproxy.net/https://github.com/$1" "https://github.com/$1"
+}
+
+cmake_cross() { # src build args...
+  local s="$1" b="$2"
+  shift 2
+  cmake -S "$s" -B "$b" -G Ninja \
+    -DCMAKE_SYSTEM_NAME=Linux \
+    -DCMAKE_C_COMPILER="${T}gcc" -DCMAKE_AR="$(command -v "${T}ar")" \
+    -DCMAKE_RANLIB="$(command -v "${T}ranlib")" \
+    -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX="$PREFIX" \
+    -DCMAKE_INSTALL_LIBDIR=lib -DCMAKE_PREFIX_PATH="$PREFIX" \
+    -DCMAKE_FIND_ROOT_PATH="$PREFIX" \
+    -DCMAKE_FIND_ROOT_PATH_MODE_PROGRAM=NEVER \
+    -DCMAKE_FIND_ROOT_PATH_MODE_LIBRARY=ONLY \
+    -DCMAKE_FIND_ROOT_PATH_MODE_INCLUDE=ONLY \
+    -DCMAKE_POSITION_INDEPENDENT_CODE=OFF \
+    "$@"
+  cmake --build "$b" -j"$JOBS"
+  cmake --install "$b"
+}
+
+build_mbedtls() {
+  local f="mbedtls-$MBEDTLS_VER.tar.bz2"
+  mapfile -t urls < <(gh "Mbed-TLS/mbedtls/releases/download/mbedtls-$MBEDTLS_VER/$f")
+  fetch "$f" "$MBEDTLS_SHA" "${urls[@]}"
+  unpack "$f" "mbedtls-$MBEDTLS_VER"
+  cmake_cross "$WORK/mbedtls-$MBEDTLS_VER" "$WORK/mbedtls-$MBEDTLS_VER/build" \
+    -DENABLE_TESTING=OFF -DENABLE_PROGRAMS=OFF -DGEN_FILES=OFF \
+    -DUSE_STATIC_MBEDTLS_LIBRARY=ON -DUSE_SHARED_MBEDTLS_LIBRARY=OFF \
+    -DMBEDTLS_FATAL_WARNINGS=OFF
+  echo "mbedTLS $MBEDTLS_VER -> $PREFIX"
+}
+
+build_curl() {
+  local f="curl-$CURL_VER.tar.xz"
+  mapfile -t urls < <(gh "curl/curl/releases/download/curl-${CURL_VER//./_}/$f")
+  fetch "$f" "$CURL_SHA" "https://curl.se/download/$f" "${urls[@]}"
+  unpack "$f" "curl-$CURL_VER"
+  # Cross builds skip CA detection; this is only libcurl's default, the
+  # program probes the usual distro paths when it is missing.
+  cmake_cross "$WORK/curl-$CURL_VER" "$WORK/curl-$CURL_VER/build" \
+    -DBUILD_SHARED_LIBS=OFF -DBUILD_STATIC_LIBS=ON \
+    -DCURL_USE_MBEDTLS=ON -DCURL_USE_OPENSSL=OFF \
+    -DMBEDTLS_INCLUDE_DIR="$PREFIX/include" \
+    -DMBEDTLS_LIBRARY="$PREFIX/lib/libmbedtls.a" \
+    -DMBEDX509_LIBRARY="$PREFIX/lib/libmbedx509.a" \
+    -DMBEDCRYPTO_LIBRARY="$PREFIX/lib/libmbedcrypto.a" \
+    -DCURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt -DCURL_CA_PATH=none \
+    -DHTTP_ONLY=ON -DCURL_DISABLE_LDAP=ON -DCURL_USE_LIBPSL=OFF \
+    -DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF -DUSE_LIBIDN2=OFF \
+    -DUSE_NGHTTP2=OFF -DCURL_ZLIB=OFF -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF \
+    -DCURL_USE_GSSAPI=OFF -DENABLE_THREADED_RESOLVER=ON \
+    -DBUILD_CURL_EXE=OFF -DBUILD_TESTING=OFF -DBUILD_EXAMPLES=OFF \
+    -DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF
+  echo "curl $CURL_VER -> $PREFIX"
+}
+
+build_ncurses() {
+  local f="ncurses-$NCURSES_VER.tar.gz"
+  fetch "$f" "$NCURSES_SHA" \
+    "https://invisible-island.net/archives/ncurses/$f" \
+    "https://mirrors.tuna.tsinghua.edu.cn/gnu/ncurses/$f" \
+    "https://ftp.gnu.org/gnu/ncurses/$f"
+  unpack "$f" "ncurses-$NCURSES_VER"
+  local b="$WORK/ncurses-$NCURSES_VER/build"
+  mkdir -p "$b"
+  cd "$b"
+  CC="${T}gcc" AR="${T}ar" RANLIB="${T}ranlib" STRIP="${T}strip" \
+    ../configure --host="$LINUX_HOST" --prefix="$PREFIX" \
+    --without-ada --without-cxx --without-cxx-binding --without-manpages \
+    --without-progs --without-tests --without-debug --without-shared \
+    --with-normal --enable-widec --disable-db-install \
+    --with-default-terminfo-dir=/usr/share/terminfo \
+    --with-terminfo-dirs=/etc/terminfo:/lib/terminfo:/usr/share/terminfo:/usr/lib/terminfo \
+    --with-fallbacks="$NCURSES_FALLBACKS" \
+    --with-tic-path="$(command -v tic)" --with-infocmp-path="$(command -v infocmp)" \
+    --enable-pc-files --with-pkg-config-libdir="$PREFIX/lib/pkgconfig" \
+    --with-build-cc="${BUILD_CC:-cc}" >/dev/null
+  make -j"$JOBS" libs >/dev/null
+  make install.libs >/dev/null
+  echo "ncurses $NCURSES_VER -> $PREFIX"
+}
+
+case "${2:-all}" in
+mbedtls) build_mbedtls ;;
+curl) build_curl ;;
+ncurses) build_ncurses ;;
+all)
+  build_mbedtls
+  build_curl
+  build_ncurses
+  ;;
+*)
+  echo "usage: $0 ARCH [all|mbedtls|curl|ncurses]" >&2
+  exit 1
+  ;;
+esac
+echo "DONE $ARCH"
diff --git a/scripts/build_third_party_mingw.sh b/scripts/build_third_party_mingw.sh
index 66a2142..d97900b 100755
--- a/scripts/build_third_party_mingw.sh
+++ b/scripts/build_third_party_mingw.sh
@@ -106,7 +106,10 @@ build_ncurses() {
   rm -rf "$src/build-mingw"
   mkdir -p "$src/build-mingw"
   cd "$src/build-mingw"
-  ../configure --host="${HOST:-x86_64-w64-mingw32}" --prefix="$PREFIX" \
+  # --host stays canonical (config.sub may not know Debian's "mingw32ucrt");
+  # the tools themselves come from $HOST.
+  CC="${T}gcc" AR="${T}ar" RANLIB="${T}ranlib" STRIP="${T}strip" WINDRES="${T}windres" \
+    ../configure --host=x86_64-w64-mingw32 --prefix="$PREFIX" \
     --without-ada --without-cxx --without-cxx-binding --without-manpages \
     --without-progs --without-tests --without-debug --without-shared \
     --enable-widec --enable-sp-funcs --enable-term-driver \
diff --git a/scripts/ci_linux_toolchain.sh b/scripts/ci_linux_toolchain.sh
new file mode 100755
index 0000000..fa1bdf9
--- /dev/null
+++ b/scripts/ci_linux_toolchain.sh
@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# Fetch a musl cross gcc for a static Linux release build.
+#   scripts/ci_linux_toolchain.sh x86_64|x86|aarch64
+# Prints "HOST BINDIR" on stdout (e.g. "x86_64-buildroot-linux-musl
+# /opt/x86-64--musl--stable-2025.08-1/bin"); progress goes to stderr.
+# Bootlin's pinned stable release first, musl.cc as a fallback.
+set -euo pipefail
+
+ARCH="${1:?usage: $0 x86_64|x86|aarch64}"
+BOOTLIN_VER="${CST_BOOTLIN_VER:-2025.08-1}"
+case "$ARCH" in
+x86_64)
+  bl=x86-64 bl_host=x86_64-buildroot-linux-musl mc=x86_64-linux-musl
+  sha=09fca3aa89540f1b01b5f4210d488cbeb00f522044c53e9989b1dd8a38076912
+  ;;
+x86)
+  bl=x86-i686 bl_host=i686-buildroot-linux-musl mc=i686-linux-musl
+  sha=3a340ebc386a057f5ddb24d8f4bbde07d2c013c99cebc02ac38565e2849bfda0
+  ;;
+aarch64)
+  bl=aarch64 bl_host=aarch64-buildroot-linux-musl mc=aarch64-linux-musl
+  sha=defba831ffa1175236f137069333e21ed46d4d19feb5080a90cf248b6fc2cb08
+  ;;
+*)
+  echo "unknown arch: $ARCH" >&2
+  exit 1
+  ;;
+esac
+[[ "$BOOTLIN_VER" == 2025.08-1 ]] || sha="" # other releases: no pinned hash
+
+if [[ -n "${CST_TOOLCHAIN_ROOT:-}" ]]; then
+  ROOT_DIR="$CST_TOOLCHAIN_ROOT"
+elif [[ -w /opt || "$(id -u)" -eq 0 ]]; then
+  ROOT_DIR=/opt
+else
+  ROOT_DIR="$HOME/.local/toolchains"
+fi
+mkdir -p "$ROOT_DIR"
+
+fetch() { # out url...
+  local out="$1" u
+  shift
+  for u in "$@"; do
+    echo "  try $u" >&2
+    if curl -fsSL --retry 2 --connect-timeout 15 --max-time 900 -o "$out" "$u"; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+emit() { # host bindir
+  "$2/$1-gcc" -dumpmachine >&2
+  [[ -n "${GITHUB_PATH:-}" ]] && echo "$2" >>"$GITHUB_PATH"
+  echo "$1 $2"
+}
+
+name="$bl--musl--stable-$BOOTLIN_VER"
+dir="$ROOT_DIR/$name"
+if [[ -x "$dir/bin/$bl_host-gcc" ]]; then
+  emit "$bl_host" "$dir/bin"
+  exit 0
+fi
+
+echo "==> toolchain $name" >&2
+tmp="$ROOT_DIR/$name.tar.xz"
+if fetch "$tmp" "https://toolchains.bootlin.com/downloads/releases/toolchains/$bl/tarballs/$name.tar.xz" &&
+    { [[ -z "$sha" ]] || echo "$sha  $tmp" | sha256sum -c --quiet - >&2; }; then
+  tar -C "$ROOT_DIR" -xJf "$tmp"
+  rm -f "$tmp"
+  # Bootlin toolchains are relocatable but must be told once where they are.
+  [[ -x "$dir/relocate-sdk.sh" ]] && "$dir/relocate-sdk.sh" >&2
+  emit "$bl_host" "$dir/bin"
+  exit 0
+fi
+rm -f "$tmp"
+
+echo "==> bootlin unavailable, falling back to musl.cc" >&2
+mdir="$ROOT_DIR/$mc-cross"
+if [[ ! -x "$mdir/bin/$mc-gcc" ]]; then
+  tgz="$ROOT_DIR/$mc-cross.tgz"
+  fetch "$tgz" "https://musl.cc/$mc-cross.tgz" "https://more.musl.cc/x86_64-linux-musl/$mc-cross.tgz" ||
+    { echo "no musl toolchain for $ARCH" >&2; exit 1; }
+  tar -C "$ROOT_DIR" -xzf "$tgz"
+  rm -f "$tgz"
+fi
+emit "$mc" "$mdir/bin"
diff --git a/scripts/ci_tcc.sh b/scripts/ci_tcc.sh
new file mode 100755
index 0000000..34eb2e8
--- /dev/null
+++ b/scripts/ci_tcc.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# CI helper: build the pinned TinyCC used for the verification job.
+# Distro tcc packages are too old (no <stdatomic.h>), so this builds the same
+# mob snapshot nixpkgs ships. Installs to $CST_TCC_PREFIX (default ~/.local/tcc)
+# and, under Actions, puts its bin/ on $GITHUB_PATH.
+set -euo pipefail
+
+COMMIT="${CST_TCC_COMMIT:-f6385c05308f715bdd2c06336801193a21d69b50}"
+PREFIX="${CST_TCC_PREFIX:-$HOME/.local/tcc}"
+WORK="${TMPDIR:-/tmp}/tcc-build"
+
+if [[ -x "$PREFIX/bin/tcc" ]]; then
+  echo "==> tcc already at $PREFIX"
+else
+  rm -rf "$WORK"
+  mkdir -p "$WORK"
+  TGZ="$WORK/tinycc.tar.gz"
+  # repo.or.cz is upstream but often unreachable from CN runners; the GitHub
+  # mirror carries the same commits.
+  urls=(
+    "https://ghfast.top/https://github.com/TinyCC/tinycc/archive/${COMMIT}.tar.gz"
+    "https://ghproxy.net/https://github.com/TinyCC/tinycc/archive/${COMMIT}.tar.gz"
+    "https://github.com/TinyCC/tinycc/archive/${COMMIT}.tar.gz"
+    "https://repo.or.cz/tinycc.git/snapshot/${COMMIT}.tar.gz"
+  )
+  ok=0
+  for u in "${urls[@]}"; do
+    echo "  try $u"
+    if curl -fsSL --retry 2 --connect-timeout 15 --max-time 300 -o "$TGZ" "$u" &&
+        tar -tzf "$TGZ" 2>/dev/null | sed -n 1p | grep -q "${COMMIT:0:7}"; then
+      ok=1
+      break
+    fi
+  done
+  [[ $ok -eq 1 ]] || { echo "failed to download tinycc $COMMIT" >&2; exit 1; }
+  tar -C "$WORK" -xzf "$TGZ"
+  src=$(find "$WORK" -mindepth 1 -maxdepth 1 -type d -name 'tinycc*' | head -1)
+  cd "$src"
+  ./configure --prefix="$PREFIX" --cc="${BUILD_CC:-cc}"
+  make -j"$(nproc)"
+  make install
+fi
+
+"$PREFIX/bin/tcc" -v
+if [[ -n "${GITHUB_PATH:-}" ]]; then
+  echo "$PREFIX/bin" >>"$GITHUB_PATH"
+fi
diff --git a/scripts/ci_windows_cross.sh b/scripts/ci_windows_cross.sh
index 2c120ab..045fe83 100755
--- a/scripts/ci_windows_cross.sh
+++ b/scripts/ci_windows_cross.sh
@@ -1,64 +1,26 @@
 #!/usr/bin/env bash
-# CI helper: MinGW-w64 UCRT toolchain via llvm-mingw (no Nix / no /nix).
-# Downloads a pinned release, puts it on PATH, then runs bootstrap_windows.sh.
+# CI helper: Windows x86_64 release with Debian's mingw-w64 UCRT gcc.
+#   apt-get install gcc-mingw-w64-ucrt64 binutils-mingw-w64-ucrt64 nsis   (trixie+)
+# Checks the toolchain, then runs bootstrap_windows.sh, which builds the
+# third-party libs, cst-agent.exe, the zip and the NSIS installer.
 set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$ROOT"
 
-VER="${CST_LLVM_MINGW_VER:-20241030}"
-NAME="llvm-mingw-${VER}-ucrt-ubuntu-20.04-x86_64"
-TGZ="/tmp/${NAME}.tar.xz"
-# Prefer /opt when writable (root CI); else unpack under $HOME.
-if [[ -w /opt || "$(id -u)" -eq 0 ]]; then
-  DIR="/opt/${NAME}"
-  PARENT=/opt
-else
-  DIR="${HOME}/${NAME}"
-  PARENT="$HOME"
-fi
-
-if [[ ! -x "$DIR/bin/x86_64-w64-mingw32-gcc" ]]; then
-  echo "==> download $NAME"
-  # Prefer CN-reachable GitHub proxies; raw github.com is often unreachable.
-  urls=(
-    "https://ghfast.top/https://github.com/mstorsjo/llvm-mingw/releases/download/${VER}/${NAME}.tar.xz"
-    "https://ghproxy.net/https://github.com/mstorsjo/llvm-mingw/releases/download/${VER}/${NAME}.tar.xz"
-    "https://gitclone.com/github.com/mstorsjo/llvm-mingw/releases/download/${VER}/${NAME}.tar.xz"
-    "https://github.com/mstorsjo/llvm-mingw/releases/download/${VER}/${NAME}.tar.xz"
-  )
-  ok=0
-  for u in "${urls[@]}"; do
-    echo "  try $u"
-    if curl -fL --retry 2 --connect-timeout 15 --max-time 600 \
-        --retry-delay 2 -o "$TGZ" "$u"; then
-      # Reject tiny error pages that some proxies return with HTTP 200.
-      sz=$(wc -c <"$TGZ")
-      if [[ "$sz" -gt 10000000 ]]; then
-        ok=1
-        break
-      fi
-      echo "  too small ($sz bytes), next mirror"
-    fi
-  done
-  [[ $ok -eq 1 ]] || { echo "failed to download llvm-mingw" >&2; exit 1; }
-  rm -rf "$DIR"
-  mkdir -p "$PARENT"
-  tar -C "$PARENT" -xf "$TGZ"
-fi
-
-export PATH="$DIR/bin:$PATH"
-export MINGW_HOST=x86_64-w64-mingw32
+export MINGW_HOST="${MINGW_HOST:-x86_64-w64-mingw32ucrt}"
 export BUILD_CC="${BUILD_CC:-cc}"
+export CST_REQUIRE_NSIS=1
 
 need() { command -v "$1" >/dev/null || { echo "missing $1" >&2; exit 1; }; }
-need x86_64-w64-mingw32-gcc
-need x86_64-w64-mingw32-windres
-need cmake; need ninja; need perl; need zip; need git; need make
+need "$MINGW_HOST-gcc"
+need "$MINGW_HOST-windres"
+need cmake; need ninja; need perl; need zip; need git; need make; need makensis
 
-if ! printf '#include <stdio.h>\n' | x86_64-w64-mingw32-gcc -dM -E - | grep -qw _UCRT; then
-  echo "toolchain is not UCRT" >&2
+if ! printf '#include <stdio.h>\n' | "$MINGW_HOST-gcc" -dM -E - | grep -qw _UCRT; then
+  echo "$MINGW_HOST-gcc is not UCRT" >&2
   exit 1
 fi
+"$MINGW_HOST-gcc" --version | head -1
 
 # Do not set a global insteadOf: a single broken proxy (e.g. gitclone 502)
 # would take down every third_party clone. build_third_party_mingw.sh tries
diff --git a/scripts/package_linux.sh b/scripts/package_linux.sh
new file mode 100755
index 0000000..544c5f1
--- /dev/null
+++ b/scripts/package_linux.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Static musl build of cst-agent for one architecture, packed as
+# dist/cst-agent-VERSION-linux-ARCH.tar.gz (+ .sha256).
+#   scripts/package_linux.sh x86_64|x86|aarch64
+# CST_LINUX_CHECK=1 also runs `make check` (only where the binaries can run).
+# Builds in the source tree, so the tree is cleaned first.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+ARCH="${1:?usage: $0 x86_64|x86|aarch64}"
+PREFIX="$ROOT/third_party/prefix-linux-$ARCH"
+cd "$ROOT"
+
+read -r LINUX_HOST bindir < <(bash scripts/ci_linux_toolchain.sh "$ARCH")
+export PATH="$bindir:$PATH" LINUX_HOST
+T="$LINUX_HOST-"
+
+if [[ ! -f "$PREFIX/lib/libcurl.a" || ! -f "$PREFIX/lib/libncursesw.a" ]]; then
+  bash scripts/build_third_party_linux.sh "$ARCH"
+fi
+
+# Only the static prefix: no host .pc file may leak into the link.
+export PKG_CONFIG_LIBDIR="$PREFIX/lib/pkgconfig"
+unset PKG_CONFIG_PATH CC CFLAGS LDFLAGS
+mk=(make CC="${T}gcc" AR="${T}ar" STATIC=1
+  CFLAGS="-std=c11 -Wall -Wextra -O2 -g -Werror")
+
+make clean >/dev/null
+make -C vendor/sashidown clean >/dev/null 2>&1 || true
+"${mk[@]}" -j"$(nproc)" cst-agent
+if "${T}readelf" -l cst-agent | grep -q 'Requesting program interpreter'; then
+  echo "cst-agent is dynamically linked" >&2
+  exit 1
+fi
+if [[ "${CST_LINUX_CHECK:-0}" == 1 ]]; then
+  "${mk[@]}" check
+fi
+
+ver="$(sed -n 's/^#define CST_VERSION_\(MAJOR\|MINOR\|PATCH\) \([0-9]*\)$/\2/p' include/cst_version.h | paste -sd.)"
+name="cst-agent-$ver-linux-$ARCH"
+rel="dist/$name"
+rm -rf "$rel"
+mkdir -p "$rel"
+cp -f cst-agent "$rel/cst-agent"
+"${T}strip" "$rel/cst-agent"
+cp -f README.md "$rel/README.md"
+echo "$ver" >"$rel/VERSION"
+tgz="dist/$name.tar.gz"
+tar -C dist -czf "$tgz" "$name"
+(cd dist && sha256sum "$name.tar.gz" >"$name.tar.gz.sha256")
+ls -la "$rel"
+echo "$ROOT/$tgz"
diff --git a/scripts/package_windows.sh b/scripts/package_windows.sh
index ee7a39b..aa072d2 100755
--- a/scripts/package_windows.sh
+++ b/scripts/package_windows.sh
@@ -36,3 +36,18 @@ rm -f "$zip"
 (cd "$ROOT/dist" && sha256sum "$(basename "$zip")" >"$(basename "$zip").sha256")
 ls -la "$REL"
 echo "$zip"
+
+# NSIS installer from the same folder (CST_REQUIRE_NSIS=1: fail without makensis).
+setup="$ROOT/dist/cst-agent-$ver-windows-x86_64-setup.exe"
+if command -v makensis >/dev/null; then
+  rm -f "$setup"
+  makensis -V2 -WX -INPUTCHARSET UTF8 -DVERSION="$ver" -DSRCDIR="$REL" \
+    -DOUTFILE="$setup" "$ROOT/scripts/windows/cst-agent.nsi"
+  (cd "$ROOT/dist" && sha256sum "$(basename "$setup")" >"$(basename "$setup").sha256")
+  echo "$setup"
+elif [[ "${CST_REQUIRE_NSIS:-0}" == 1 ]]; then
+  echo "makensis not found" >&2
+  exit 1
+else
+  echo "makensis not found; skipping the installer" >&2
+fi
diff --git a/scripts/release_windows.sh b/scripts/release.sh
similarity index 58%
rename from scripts/release_windows.sh
rename to scripts/release.sh
index 0f258d8..4f68e73 100755
--- a/scripts/release_windows.sh
+++ b/scripts/release.sh
@@ -1,10 +1,12 @@
 #!/usr/bin/env bash
-# Publish dist/cst-agent-VERSION-windows-x86_64.zip (+ .sha256) to the Gitea
-# release vVERSION, creating the release (and its tag at HEAD) when missing.
-#   GITEA_TOKEN=... scripts/release_windows.sh [--build]
-# --build runs scripts/bootstrap_windows.sh first. The token is only read from
-# the environment and handed to curl on stdin: it never appears in argv, on
-# disk or in the output. Assets of the same name are replaced.
+# Upload release files to the Gitea release vVERSION, creating the release
+# (and its tag at HEAD) when missing.
+#   GITEA_TOKEN=... scripts/release.sh FILE...
+# Each FILE's FILE.sha256 is uploaded too when it exists; assets of the same
+# name are replaced. Several CI jobs may call this at once: the first creates
+# the release, the others find it. The token is only read from the
+# environment and handed to curl on stdin: it never appears in argv, on disk
+# or in the output.
 #
 # CI: set GITEA_TOKEN (or GITHUB_TOKEN), CST_GITEA, CST_REPO. The remote-branch
 # check is skipped under GITEA_ACTIONS / GITHUB_ACTIONS / CI.
@@ -19,16 +21,20 @@ TOKEN="${GITEA_TOKEN:-${GITHUB_TOKEN:-}}"
   echo "set GITEA_TOKEN (a Gitea token with write:repository)" >&2
   exit 1
 }
+[[ $# -gt 0 ]] || { echo "usage: $0 FILE..." >&2; exit 1; }
 command -v python3 >/dev/null || { echo "missing python3" >&2; exit 1; }
+
+files=()
+for f in "$@"; do
+  [[ -f "$f" ]] || { echo "missing $f" >&2; exit 1; }
+  f="$(cd "$(dirname "$f")" && pwd)/$(basename "$f")"
+  files+=("$f")
+  [[ "$f" != *.sha256 && -f "$f.sha256" ]] && files+=("$f.sha256")
+done
 cd "$ROOT"
-[[ "${1:-}" == --build ]] && scripts/bootstrap_windows.sh "$ROOT"
 
 ver="$(sed -n 's/^#define CST_VERSION_\(MAJOR\|MINOR\|PATCH\) \([0-9]*\)$/\2/p' include/cst_version.h | paste -sd.)"
 tag="v$ver"
-zip="dist/cst-agent-$ver-windows-x86_64.zip"
-for f in "$zip" "$zip.sha256"; do
-  [[ -f "$f" ]] || { echo "missing $f (scripts/package_windows.sh, or --build)" >&2; exit 1; }
-done
 
 # If this job was triggered by a version tag, it must match cst_version.h.
 if [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
@@ -51,6 +57,12 @@ json() { # CODE [ARGS...]: d = the JSON on stdin, ARGS in sys.argv[1:]
   python3 -c "import json,sys; d=json.load(sys.stdin); $code" "$@"
 }
 
+BODY="Linux (static, musl, any distro): cst-agent-$ver-linux-{x86_64,x86,aarch64}.tar.gz -- extract and run ./cst-agent, or copy it onto PATH.
+
+Windows x86_64: cst-agent-$ver-windows-x86_64-setup.exe installs per user (no admin rights) and adds PATH; cst-agent-$ver-windows-x86_64.zip is the portable build (install_windows.ps1 inside).
+
+Every file has a .sha256 next to it."
+
 if rel="$(api GET "/releases/tags/$tag" 2>/dev/null)"; then
   echo "==> release $tag exists"
 else
@@ -62,12 +74,22 @@ else
     fi
   fi
   echo "==> creating release $tag at $head"
-  body="$(python3 -c 'import json,sys; print(json.dumps({"tag_name": sys.argv[1], "target_commitish": sys.argv[2], "name": "CST-Agent " + sys.argv[1], "body": "Windows x86_64: unzip, or install with install_windows.ps1 from the zip.\\n\\nArtifacts: `cst-agent-VERSION-windows-x86_64.zip` + `.sha256`."}))' "$tag" "$head")"
-  rel="$(api POST /releases -H 'Content-Type: application/json' -d "$body")"
+  body="$(python3 -c 'import json,sys; print(json.dumps({"tag_name": sys.argv[1], "target_commitish": sys.argv[2], "name": "CST-Agent " + sys.argv[1], "body": sys.argv[3]}))' "$tag" "$head" "$BODY")"
+  if ! rel="$(api POST /releases -H 'Content-Type: application/json' -d "$body" 2>/dev/null)"; then
+    # Another job created it first (409).
+    rel=""
+    for _ in 1 2 3 4 5 6; do
+      sleep 5
+      rel="$(api GET "/releases/tags/$tag" 2>/dev/null)" && break
+      rel=""
+    done
+    [[ -n "$rel" ]] || { echo "could not create or find release $tag" >&2; exit 1; }
+    echo "==> release $tag created by another job"
+  fi
 fi
 id="$(json 'print(d["id"])' <<<"$rel")"
 
-for f in "$zip" "$zip.sha256"; do
+for f in "${files[@]}"; do
   name="$(basename "$f")"
   old="$(json "print(' '.join(str(a['id']) for a in d.get('assets') or [] if a['name'] == sys.argv[1]))" "$name" <<<"$rel")"
   for aid in $old; do
diff --git a/scripts/windows/cst-agent.nsi b/scripts/windows/cst-agent.nsi
new file mode 100644
index 0000000..4673237
--- /dev/null
+++ b/scripts/windows/cst-agent.nsi
@@ -0,0 +1,151 @@
+; CST-Agent per-user installer (no admin rights).
+;   makensis -INPUTCHARSET UTF8 -DVERSION=0.8.5 -DSRCDIR=dist/windows-x86_64 -DOUTFILE=setup.exe cst-agent.nsi
+; Installs the same files as the zip into %LOCALAPPDATA%\Programs\cst-agent,
+; adds that folder to the user PATH and registers an uninstaller under HKCU.
+Unicode true
+SetCompressor /SOLID lzma
+RequestExecutionLevel user
+
+!ifndef VERSION
+  !error "pass -DVERSION=x.y.z"
+!endif
+!ifndef SRCDIR
+  !error "pass -DSRCDIR=<dist/windows-x86_64>"
+!endif
+!ifndef OUTFILE
+  !define OUTFILE "cst-agent-${VERSION}-windows-x86_64-setup.exe"
+!endif
+
+!define APP "CST-Agent"
+!define UNINST_KEY "Software\Microsoft\Windows\CurrentVersion\Uninstall\cst-agent"
+
+!include "MUI2.nsh"
+!include "LogicLib.nsh"
+!include "x64.nsh"
+
+Name "${APP} ${VERSION}"
+OutFile "${OUTFILE}"
+InstallDir "$LOCALAPPDATA\Programs\cst-agent"
+InstallDirRegKey HKCU "${UNINST_KEY}" "InstallLocation"
+BrandingText "${APP} ${VERSION}"
+
+VIProductVersion "${VERSION}.0"
+VIAddVersionKey /LANG=1033 "ProductName" "${APP}"
+VIAddVersionKey /LANG=1033 "ProductVersion" "${VERSION}"
+VIAddVersionKey /LANG=1033 "FileVersion" "${VERSION}"
+VIAddVersionKey /LANG=1033 "FileDescription" "${APP} installer"
+VIAddVersionKey /LANG=1033 "LegalCopyright" "WHC"
+
+!define MUI_ABORTWARNING
+!define MUI_FINISHPAGE_RUN
+!define MUI_FINISHPAGE_RUN_TEXT "$(RunWebUI)"
+!define MUI_FINISHPAGE_RUN_FUNCTION LaunchWebUI
+
+!insertmacro MUI_PAGE_DIRECTORY
+!insertmacro MUI_PAGE_INSTFILES
+!insertmacro MUI_PAGE_FINISH
+!insertmacro MUI_UNPAGE_CONFIRM
+!insertmacro MUI_UNPAGE_INSTFILES
+
+!insertmacro MUI_LANGUAGE "English"
+!insertmacro MUI_LANGUAGE "SimpChinese"
+
+LangString NeedX64 ${LANG_ENGLISH} "${APP} needs 64-bit Windows."
+LangString NeedX64 ${LANG_SIMPCHINESE} "${APP} 需要 64 位 Windows。"
+LangString NeedBuild ${LANG_ENGLISH} "${APP} needs Windows 10 1903 (build 18362) or newer; this is build $0."
+LangString NeedBuild ${LANG_SIMPCHINESE} "${APP} 需要 Windows 10 1903（内部版本 18362）或更新版本，当前为 $0。"
+LangString RunWebUI ${LANG_ENGLISH} "Open the ${APP} WebUI"
+LangString RunWebUI ${LANG_SIMPCHINESE} "打开 ${APP} WebUI"
+LangString PathFail ${LANG_ENGLISH} "Could not add $INSTDIR to the user PATH; add it by hand."
+LangString PathFail ${LANG_SIMPCHINESE} "未能把 $INSTDIR 加入用户 PATH，请手动添加。"
+
+; PowerShell edits the user PATH: NSIS strings are capped at 1024 chars, and
+; .NET broadcasts the change so new terminals see it. The folder is passed in
+; the environment, so quotes in it cannot break the command.
+!macro EditUserPath ACTION
+  System::Call 'Kernel32::SetEnvironmentVariable(t "CST_INSTDIR", t "$INSTDIR")'
+  nsExec::ExecToLog `powershell -NoProfile -ExecutionPolicy Bypass -Command "$$d = $$env:CST_INSTDIR.TrimEnd('\'); $$p = [Environment]::GetEnvironmentVariable('Path', 'User'); $$parts = @([string]$$p -split ';' | Where-Object { $$_ -and $$_.TrimEnd('\') -ine $$d }); if ('${ACTION}' -eq 'add') { $$parts += $$d }; [Environment]::SetEnvironmentVariable('Path', ($$parts -join ';'), 'User')"`
+  Pop $0
+!macroend
+
+; A running exe cannot be overwritten but can be renamed out of the way.
+!macro MoveAside NAME
+  Delete "$INSTDIR\${NAME}.old"
+  ClearErrors
+  Delete "$INSTDIR\${NAME}"
+  ${If} ${Errors}
+    Rename "$INSTDIR\${NAME}" "$INSTDIR\${NAME}.old"
+  ${EndIf}
+!macroend
+
+Function .onInit
+  ${IfNot} ${RunningX64}
+    MessageBox MB_ICONSTOP "$(NeedX64)"
+    Abort
+  ${EndIf}
+  SetRegView 64
+  ReadRegStr $0 HKLM "SOFTWARE\Microsoft\Windows NT\CurrentVersion" "CurrentBuildNumber"
+  ${If} $0 < 18362
+    MessageBox MB_ICONSTOP "$(NeedBuild)"
+    Abort
+  ${EndIf}
+FunctionEnd
+
+Function LaunchWebUI
+  SetOutPath "$PROFILE"
+  Exec '"$INSTDIR\cst-agent.exe" --web --web-open'
+FunctionEnd
+
+Section "Install"
+  SetShellVarContext current
+  SetOutPath "$INSTDIR"
+  !insertmacro MoveAside "cst-agent.exe"
+  !insertmacro MoveAside "busybox.exe"
+  File "${SRCDIR}/cst-agent.exe"
+  File "${SRCDIR}/busybox.exe"
+  File "${SRCDIR}/LICENSE.busybox"
+  File "${SRCDIR}/README.md"
+  File "${SRCDIR}/cst-agent-update.cmd"
+  File "${SRCDIR}/install_windows.ps1"
+  File "${SRCDIR}/VERSION"
+  WriteUninstaller "$INSTDIR\uninstall.exe"
+
+  !insertmacro EditUserPath "add"
+  ${If} $0 != 0
+    DetailPrint "$(PathFail)"
+  ${EndIf}
+
+  ; The WebUI's workspace is the shortcut's start folder.
+  SetOutPath "$PROFILE"
+  CreateShortCut "$SMPROGRAMS\${APP} WebUI.lnk" "$INSTDIR\cst-agent.exe" "--web --web-open" "$INSTDIR\cst-agent.exe" 0
+  SetOutPath "$INSTDIR"
+
+  WriteRegStr HKCU "${UNINST_KEY}" "DisplayName" "${APP}"
+  WriteRegStr HKCU "${UNINST_KEY}" "DisplayVersion" "${VERSION}"
+  WriteRegStr HKCU "${UNINST_KEY}" "Publisher" "WHC"
+  WriteRegStr HKCU "${UNINST_KEY}" "DisplayIcon" "$INSTDIR\cst-agent.exe"
+  WriteRegStr HKCU "${UNINST_KEY}" "InstallLocation" "$INSTDIR"
+  WriteRegStr HKCU "${UNINST_KEY}" "UninstallString" '"$INSTDIR\uninstall.exe"'
+  WriteRegStr HKCU "${UNINST_KEY}" "QuietUninstallString" '"$INSTDIR\uninstall.exe" /S'
+  WriteRegStr HKCU "${UNINST_KEY}" "URLInfoAbout" "https://git.whcself.xyz/WHC/CST-agent"
+  WriteRegDWORD HKCU "${UNINST_KEY}" "NoModify" 1
+  WriteRegDWORD HKCU "${UNINST_KEY}" "NoRepair" 1
+SectionEnd
+
+Section "Uninstall"
+  SetShellVarContext current
+  !insertmacro EditUserPath "remove"
+  Delete "$SMPROGRAMS\${APP} WebUI.lnk"
+  Delete "$INSTDIR\cst-agent.exe"
+  Delete "$INSTDIR\cst-agent.exe.old"
+  Delete "$INSTDIR\busybox.exe"
+  Delete "$INSTDIR\busybox.exe.old"
+  Delete "$INSTDIR\LICENSE.busybox"
+  Delete "$INSTDIR\README.md"
+  Delete "$INSTDIR\cst-agent-update.cmd"
+  Delete "$INSTDIR\install_windows.ps1"
+  Delete "$INSTDIR\VERSION"
+  Delete "$INSTDIR\uninstall.exe"
+  RMDir "$INSTDIR"
+  DeleteRegKey HKCU "${UNINST_KEY}"
+SectionEnd
diff --git a/shell-win.nix b/shell-win.nix
index 44d09b1..5338871 100644
--- a/shell-win.nix
+++ b/shell-win.nix
@@ -15,6 +15,7 @@ win.mkShell {
     pkg-config
     zip
     curl
+    nsis
   ];
   buildInputs = [ win.windows.pthreads ];
   # mkShell exports CC/AR for the target; the build scripts call the prefixed tools directly.
diff --git a/src/llm_openai.c b/src/llm_openai.c
index 5dc7c0d..0561efd 100644
--- a/src/llm_openai.c
+++ b/src/llm_openai.c
@@ -22,43 +22,75 @@
 #define ERRBODY_MAX 4096
 #define LLM_MAX_RETRIES 3
 
-/* Point libcurl at a CA bundle on Windows.
+static int ca_file_ok(const char *path) {
+  if (!path || !path[0])
+    return 0;
+  FILE *f = fopen(path, "rb");
+  if (!f)
+    return 0;
+  fclose(f);
+  return 1;
+}
+
+/* Point libcurl at a CA bundle.
  *
- * An OpenSSL-based libcurl keeps the path it was built with -- MSYS2's is
- * "/mingw64/etc/ssl/certs/ca-bundle.crt", which resolves to nothing once the
- * binary runs outside an MSYS2 shell, and that build ignores CURL_CA_BUNDLE.
- * Every HTTPS request then dies with CURLE_SSL_CACERT_BADFILE (77).
+ * libcurl keeps the bundle path it was built with. On Windows an OpenSSL
+ * build carries MSYS2's "/mingw64/etc/ssl/certs/ca-bundle.crt"; the static
+ * Linux release is built on one distro and runs on all of them, whose bundles
+ * live in different places. A path that does not exist fails every HTTPS
+ * request with CURLE_SSL_CACERT_BADFILE (77).
  *
- * Order: $CST_CA_BUNDLE, then ca-bundle.crt beside the executable. If neither
- * exists nothing is set, so a libcurl linked against Schannel (the Windows
- * certificate store) behaves exactly as before. */
-static void llm_apply_ca_bundle(CURL *curl) {
-#if defined(_WIN32)
+ * Order: $CST_CA_BUNDLE; on Windows ca-bundle.crt beside the executable (if
+ * absent nothing is set, so Schannel uses the certificate store); elsewhere
+ * $SSL_CERT_FILE, libcurl's own default if that file exists, then the usual
+ * distro locations. Decided once per process. */
+void cst_curl_apply_ca(void *curl) {
   static char ca[OS_PATH_MAX];
-  static int checked;
-  if (!checked) {
-    checked = 1;
+  static atomic_int state; /* 0 unchecked, 1 checking, 2 done */
+  int expect = 0;
+  if (atomic_compare_exchange_strong(&state, &expect, 1)) {
     const char *env = getenv("CST_CA_BUNDLE");
-    if (env && env[0]) {
+    if (ca_file_ok(env)) {
       snprintf(ca, sizeof(ca), "%s", env);
     } else {
-      char dir[OS_PATH_MAX];
-      if (os_exe_dir(dir, sizeof(dir)) == 0)
-        os_path_join(ca, sizeof(ca), dir, "ca-bundle.crt");
-    }
-    if (ca[0]) {
-      FILE *f = fopen(ca, "rb");
-      if (f)
-        fclose(f);
+#if defined(_WIN32)
+      char dir[OS_PATH_MAX], p[OS_PATH_MAX];
+      if (os_exe_dir(dir, sizeof(dir)) == 0 &&
+          os_path_join(p, sizeof(p), dir, "ca-bundle.crt") == 0 &&
+          ca_file_ok(p))
+        snprintf(ca, sizeof(ca), "%s", p);
+#else
+      static const char *const known[] = {
+          "/etc/ssl/certs/ca-certificates.crt", /* Debian, Ubuntu, Arch, Alpine */
+          "/etc/pki/tls/certs/ca-bundle.crt",   /* Fedora, RHEL */
+          "/etc/ssl/cert.pem",                  /* macOS, BSD, Alpine */
+          "/etc/ssl/ca-bundle.pem",             /* openSUSE */
+          "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem",
+      };
+      const char *pick = NULL;
+      const char *sslenv = getenv("SSL_CERT_FILE");
+      const curl_version_info_data *vi = curl_version_info(CURLVERSION_NOW);
+      if (ca_file_ok(sslenv))
+        pick = sslenv;
+      else if (vi && ca_file_ok(vi->cainfo))
+        pick = NULL; /* libcurl's built-in default already works */
       else
-        ca[0] = '\0';
+        for (size_t i = 0; i < sizeof(known) / sizeof(known[0]); i++)
+          if (ca_file_ok(known[i])) {
+            pick = known[i];
+            break;
+          }
+      if (pick)
+        snprintf(ca, sizeof(ca), "%s", pick);
+#endif
     }
+    atomic_store(&state, 2);
+  } else {
+    while (atomic_load(&state) != 2)
+      ;
   }
   if (ca[0])
-    curl_easy_setopt(curl, CURLOPT_CAINFO, ca);
-#else
-  (void)curl;
-#endif
+    curl_easy_setopt((CURL *)curl, CURLOPT_CAINFO, ca);
 }
 
 #include "cst_attach.h"
@@ -988,7 +1020,7 @@ int cst_llm_chat_stream(const cst_llm_request_t *req, char *err,
       ret = -1;
       break;
     }
-    llm_apply_ca_bundle(curl);
+    cst_curl_apply_ca(curl);
     sse_reset(&s);
     s.curl = curl;
     if (rec_dir && rec_dir[0]) {
@@ -1233,7 +1265,7 @@ int cst_llm_list_models_meta(const char *api_base, const char *api_key,
     snprintf(err, err_sz, "curl init failed");
     return -1;
   }
-  llm_apply_ca_bundle(curl);
+  cst_curl_apply_ca(curl);
   char url[1024];
   size_t bl = strlen(api_base);
   while (bl && api_base[bl - 1] == '/')
diff --git a/src/net.c b/src/net.c
index a904118..2b4e2a0 100644
--- a/src/net.c
+++ b/src/net.c
@@ -37,11 +37,6 @@
 
 #define NET_SEND_TIMEOUT_MS 20000
 
-static void set_err(char *err, size_t err_sz, const char *what) {
-  if (err && err_sz)
-    snprintf(err, err_sz, "%s", what);
-}
-
 #ifdef _WIN32
 static void set_err_win(char *err, size_t err_sz, const char *what) {
   if (err && err_sz)
@@ -59,6 +54,10 @@ static int net_last_conn_reset(void) {
   return e == WSAECONNRESET || e == WSAECONNABORTED || e == WSAENOTSOCK;
 }
 #else
+static void set_err(char *err, size_t err_sz, const char *what) {
+  if (err && err_sz)
+    snprintf(err, err_sz, "%s", what);
+}
 #define SET_ERR(e, n, w) set_err(e, n, w)
 #define NET_FD(s) ((int)(s))
 static void net_close_raw(os_socket_t s) { close(s); }
diff --git a/src/os_compat.c b/src/os_compat.c
index 66814a7..b66fdbf 100644
--- a/src/os_compat.c
+++ b/src/os_compat.c
@@ -13,6 +13,7 @@
 #include "os_internal.h"
 
 #include <errno.h>
+#include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -503,19 +504,74 @@ int os_resolve_shell(char *out, size_t out_sz) {
 #endif
 }
 
-/* Per thread: parallel tool runs and sub-agents each watch their own flag. */
-static _Thread_local volatile int *g_run_cancel;
-static _Thread_local int g_run_timeout_s;
+/* Per thread: parallel tool runs and sub-agents each watch their own flag.
+ * Thread keys rather than _Thread_local, which tcc does not implement; each
+ * value fits in the key's pointer slot, so nothing is allocated. */
+#ifdef _WIN32
+static INIT_ONCE g_run_once = INIT_ONCE_STATIC_INIT;
+static DWORD g_key_cancel = TLS_OUT_OF_INDEXES, g_key_timeout = TLS_OUT_OF_INDEXES;
+static BOOL CALLBACK run_keys_init(PINIT_ONCE once, PVOID param, PVOID *ctx) {
+  (void)once;
+  (void)param;
+  (void)ctx;
+  g_key_cancel = TlsAlloc();
+  g_key_timeout = TlsAlloc();
+  return TRUE;
+}
+static void *run_key_get(DWORD *key) {
+  InitOnceExecuteOnce(&g_run_once, run_keys_init, NULL, NULL);
+  if (*key == TLS_OUT_OF_INDEXES)
+    return NULL;
+  DWORD err = GetLastError(); /* TlsGetValue clears it */
+  void *v = TlsGetValue(*key);
+  SetLastError(err);
+  return v;
+}
+static void run_key_set(DWORD *key, void *v) {
+  InitOnceExecuteOnce(&g_run_once, run_keys_init, NULL, NULL);
+  if (*key != TLS_OUT_OF_INDEXES)
+    TlsSetValue(*key, v);
+}
+#else
+static pthread_once_t g_run_once = PTHREAD_ONCE_INIT;
+static pthread_key_t g_key_cancel, g_key_timeout;
+static int g_run_keys_ok;
+static void run_keys_init(void) {
+  g_run_keys_ok = pthread_key_create(&g_key_cancel, NULL) == 0 &&
+                  pthread_key_create(&g_key_timeout, NULL) == 0;
+}
+static void *run_key_get(pthread_key_t *key) {
+  pthread_once(&g_run_once, run_keys_init);
+  return g_run_keys_ok ? pthread_getspecific(*key) : NULL;
+}
+static void run_key_set(pthread_key_t *key, void *v) {
+  pthread_once(&g_run_once, run_keys_init);
+  if (g_run_keys_ok)
+    pthread_setspecific(*key, v);
+}
+#endif
 
-void os_set_cancel_flag(volatile int *flag) { g_run_cancel = flag; }
+static volatile int *run_cancel(void) {
+  return (volatile int *)run_key_get(&g_key_cancel);
+}
+static int run_timeout(void) {
+  return (int)(intptr_t)run_key_get(&g_key_timeout);
+}
 
-void os_set_run_timeout(int seconds) { g_run_timeout_s = seconds; }
+void os_set_cancel_flag(volatile int *flag) {
+  run_key_set(&g_key_cancel, (void *)(uintptr_t)flag);
+}
 
-int os_get_run_timeout(void) { return g_run_timeout_s; }
+void os_set_run_timeout(int seconds) {
+  run_key_set(&g_key_timeout, (void *)(intptr_t)seconds);
+}
+
+int os_get_run_timeout(void) { return run_timeout(); }
 
 int os_run_timeout_effective(void) {
-  if (g_run_timeout_s > 0)
-    return g_run_timeout_s;
+  int t = run_timeout();
+  if (t > 0)
+    return t;
   const char *e = getenv("CST_SHELL_TIMEOUT");
   if (e && atoi(e) > 0)
     return atoi(e);
@@ -693,8 +749,8 @@ int os_run_capture_ex(const char *cwd, const char *const argv[],
     }
     /* Checked on every pass, so a chatty command still stops promptly. */
     if (!reaped && !killed &&
-        ((g_run_cancel && *g_run_cancel) || (deadline > 0 && now > deadline))) {
-      killed = (g_run_cancel && *g_run_cancel) ? 2 : 1;
+        (os_cancel_requested() || (deadline > 0 && now > deadline))) {
+      killed = os_cancel_requested() ? 2 : 1;
       killed_at = now;
       kill(-pid, SIGTERM);
     }
@@ -900,9 +956,12 @@ void os_run_parallel(os_task_fn fn, void *const args[], int n) {
   free(tasks);
 }
 
-int os_cancel_requested(void) { return g_run_cancel && *g_run_cancel; }
+int os_cancel_requested(void) {
+  volatile int *c = run_cancel();
+  return c && *c;
+}
 
-volatile int *os_get_cancel_flag(void) { return g_run_cancel; }
+volatile int *os_get_cancel_flag(void) { return run_cancel(); }
 
 #ifndef _WIN32
 int os_proc_spawn(const char *cwd, const char *const argv[],
diff --git a/src/settings.c b/src/settings.c
index c3ae64c..fa49efb 100644
--- a/src/settings.c
+++ b/src/settings.c
@@ -28,11 +28,17 @@ int cst_settings_load(cst_settings_t *s) {
   FILE *fp = fopen(path, "rb");
   if (!fp)
     return -1;
-  static _Thread_local char buf[65536];
-  size_t n = fread(buf, 1, sizeof(buf) - 1, fp);
+  enum { SETTINGS_MAX = 65536 };
+  char *buf = malloc(SETTINGS_MAX);
+  if (!buf) {
+    fclose(fp);
+    return -1;
+  }
+  size_t n = fread(buf, 1, SETTINGS_MAX - 1, fp);
   fclose(fp);
   buf[n] = 0;
   cJSON *root = cJSON_Parse(buf + cst_bom_len(buf, n));
+  free(buf);
   if (!cJSON_IsObject(root)) {
     cJSON_Delete(root);
     return -1;
diff --git a/src/tools/tools.c b/src/tools/tools.c
index 383817a..9b65e9b 100644
--- a/src/tools/tools.c
+++ b/src/tools/tools.c
@@ -659,9 +659,10 @@ static int plan_patch(const char *ws, const char *patch, patch_plan_t *pl,
     pl->full[i] = malloc(OS_PATH_MAX);
     if (!pl->full[i] ||
         cst_sandbox_resolve(ws, target, pl->full[i], OS_PATH_MAX) != 0) {
-      if (dry && pl->full[i] && !pl->del[i] && is_new) {
+      if (dry && pl->full[i] && !pl->del[i] && is_new &&
+          strlen(target) < OS_PATH_MAX) {
         /* parent dirs do not exist yet; the write would create them */
-        snprintf(pl->full[i], OS_PATH_MAX, "%s", target);
+        memcpy(pl->full[i], target, strlen(target) + 1);
       } else {
         snprintf(err, err_sz, "error: path outside workspace: %.200s",
                  target);
diff --git a/src/tools/web.c b/src/tools/web.c
index c4304c1..e8cfa1c 100644
--- a/src/tools/web.c
+++ b/src/tools/web.c
@@ -215,6 +215,7 @@ int cst_tool_web_fetch(const cst_tool_ctx_t *ctx, const ctl_tool_call_t *c,
   memset(&f, 0, sizeof(f));
   char errbuf[CURL_ERROR_SIZE];
   errbuf[0] = 0;
+  cst_curl_apply_ca(curl);
   curl_easy_setopt(curl, CURLOPT_URL, url);
   curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
   curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 5L);
diff --git a/src/tui.c b/src/tui.c
index 53c332e..3aeb412 100644
--- a/src/tui.c
+++ b/src/tui.c
@@ -152,6 +152,7 @@ static int cst_clock_gettime_mono(struct timespec *ts) {
 #ifdef NCURSES_VERSION
 static int g_kitty_on;
 
+#ifndef _WIN32
 /* Bind the reports and ask whether the terminal speaks the protocol; the
  * flags are pushed once the reply arrives (see tui_wget_wch). */
 static void kitty_init(void) {
@@ -182,6 +183,7 @@ static void kitty_restore(void) {
     g_kitty_on = 0;
   }
 }
+#endif /* !_WIN32 */
 #endif
 
 /* wget_wch() that turns kitty key reports back into legacy input. */
diff --git a/tests/test_model_registry.c b/tests/test_model_registry.c
index 016a07a..6cd6788 100644
--- a/tests/test_model_registry.c
+++ b/tests/test_model_registry.c
@@ -8,6 +8,7 @@
 #include "cst_test_util.h"
 #include "os_compat.h"
 
+#include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -49,7 +50,9 @@ static void test_builtin(void) {
   cst_model_info("deepseek", "deepseek-chat", &mi);
   EXPECT(mi.vision == 1, "deepseek-chat is deepseek-flash");
   cst_model_info(NULL, "gpt-4o-mini-2024", &mi);
-  EXPECT(mi.price.miss == 0.15 && mi.context == 128000 && mi.vision == 1,
+  /* x87 (i686) compares the literal at long double precision: no == here */
+  EXPECT(fabs(mi.price.miss - 0.15) < 1e-12 && mi.context == 128000 &&
+             mi.vision == 1,
          "gpt-4o-mini over gpt-4o");
   cst_model_info(NULL, "Qwen/Qwen2.5-VL-72B-Instruct", &mi);
   EXPECT(mi.vision == 1 && mi.context == 131072, "glob *-vl* + qwen prefix");
diff --git a/vendor/cjson/cJSON.c b/vendor/cjson/cJSON.c
index c94d7a7..15fa1d7 100644
--- a/vendor/cjson/cJSON.c
+++ b/vendor/cjson/cJSON.c
@@ -89,8 +89,11 @@ typedef struct {
     const unsigned char *json;
     size_t position;
 } error;
-/* cst-agent: per thread, parses run concurrently (sub-agents, MCP) */
-#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
+/* cst-agent: per thread, parses run concurrently (sub-agents, MCP).
+ * tcc has no thread-local storage; cst-agent never reads cJSON_GetErrorPtr. */
+#if defined(__TINYC__)
+static error global_error = { NULL, 0 };
+#elif defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
 static _Thread_local error global_error = { NULL, 0 };
 #elif defined(__GNUC__)
 static __thread error global_error = { NULL, 0 };