Remove the connect feature and the private nanostore dependency

What changed:
- Drops the nanostore path dependency from build.zig.zon and build.zig,
  along with the kuri-connect-broker target.
- Deletes src/connect_broker.zig, src/connect_cdp.zig, and
  src/storage/connect_store.zig; removes the /connect/save|load|list|delete
  routes (enum, table, switch, handlers), kuri-agent connect, relay-fetch
  mode (KURI_RELAY), and the vault_passphrase config (KURI_VAULT_PASSPHRASE).
- Removes the NANOSTORE_PAT checkout/verify/symlink steps from ci.yml and
  release.yml.

Why:
- nanostore is a private sibling repo, so every kuri build, local and CI,
  needed a second checkout plus a PAT secret. That is what made main
  unbuildable for anyone without access, and it forced the 0.5.1 release
  branch to diverge in the first place.
- The pinned nanostore commit does not compile on the Zig 0.17.0-dev
  toolchain (the ** repeat operator no longer lexes), so keeping the pin
  meant carrying local patches on a repo we no longer want as a dependency.
- Trade-off: v0.5.1 shipped these routes, so this is a feature removal
  after release; noted in the changelog under Unreleased.

Verified: zig build and zig build test pass with no ../nanostore present.

Co-Authored-By: Codegraff <blackfloofie@codegraff.com>

Author: justrach

.github/workflows/ci.yml

@@ -14,26 +14,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Verify private nanostore access
-        env:
-          NANOSTORE_PAT: ${{ secrets.NANOSTORE_PAT }}
-        run: |
-          test -n "$NANOSTORE_PAT" || {
-            echo "::error::Set the NANOSTORE_PAT repository secret to build kuri. nanostore is a private dependency."
-            exit 1
-          }
-
-      - name: Checkout private nanostore dependency
-        uses: actions/checkout@v4
-        with:
-          repository: justrach/nanostore
-          ref: e242f7f8cf75ca6c636c15482a83f7833291b53b
-          token: ${{ secrets.NANOSTORE_PAT }}
-          path: nanostore
-
-      - name: Link nanostore at the path expected by build.zig.zon
-        run: ln -s "$GITHUB_WORKSPACE/nanostore" "$GITHUB_WORKSPACE/../nanostore"
-
       - name: Install Zig 0.16.0
         uses: mlugg/setup-zig@v2
         with:
@@ -192,26 +172,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Verify private nanostore access
-        env:
-          NANOSTORE_PAT: ${{ secrets.NANOSTORE_PAT }}
-        run: |
-          test -n "$NANOSTORE_PAT" || {
-            echo "::error::Set the NANOSTORE_PAT repository secret to build kuri. nanostore is a private dependency."
-            exit 1
-          }
-
-      - name: Checkout private nanostore dependency
-        uses: actions/checkout@v4
-        with:
-          repository: justrach/nanostore
-          ref: e242f7f8cf75ca6c636c15482a83f7833291b53b
-          token: ${{ secrets.NANOSTORE_PAT }}
-          path: nanostore
-
-      - name: Link nanostore at the path expected by build.zig.zon
-        run: ln -s "$GITHUB_WORKSPACE/nanostore" "$GITHUB_WORKSPACE/../nanostore"
-
       - name: Install Zig 0.16.0
         uses: mlugg/setup-zig@v2
         with:
@@ -277,26 +237,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Verify private nanostore access
-        env:
-          NANOSTORE_PAT: ${{ secrets.NANOSTORE_PAT }}
-        run: |
-          test -n "$NANOSTORE_PAT" || {
-            echo "::error::Set the NANOSTORE_PAT repository secret to build kuri. nanostore is a private dependency."
-            exit 1
-          }
-
-      - name: Checkout private nanostore dependency
-        uses: actions/checkout@v4
-        with:
-          repository: justrach/nanostore
-          ref: e242f7f8cf75ca6c636c15482a83f7833291b53b
-          token: ${{ secrets.NANOSTORE_PAT }}
-          path: nanostore
-
-      - name: Link nanostore at the path expected by build.zig.zon
-        run: ln -s "$GITHUB_WORKSPACE/nanostore" "$GITHUB_WORKSPACE/../nanostore"
-
       - name: Install Zig 0.16.0
         uses: mlugg/setup-zig@v2
         with:

.github/workflows/release.yml

@@ -19,23 +19,6 @@ jobs:
         target: [x86_64-linux, aarch64-linux]
     steps:
       - uses: actions/checkout@v4
-      - name: Verify private nanostore access
-        env:
-          NANOSTORE_PAT: ${{ secrets.NANOSTORE_PAT }}
-        run: |
-          test -n "$NANOSTORE_PAT" || {
-            echo "::error::Set the NANOSTORE_PAT repository secret to build kuri. nanostore is a private dependency."
-            exit 1
-          }
-      - name: Checkout private nanostore dependency
-        uses: actions/checkout@v4
-        with:
-          repository: justrach/nanostore
-          ref: e242f7f8cf75ca6c636c15482a83f7833291b53b
-          token: ${{ secrets.NANOSTORE_PAT }}
-          path: nanostore
-      - name: Link nanostore at the path expected by build.zig.zon
-        run: ln -s "$GITHUB_WORKSPACE/nanostore" "$GITHUB_WORKSPACE/../nanostore"
       - uses: mlugg/setup-zig@v2
         with:
           version: 0.17.0-dev.813+2153f8143
@@ -76,23 +59,6 @@ jobs:
       APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
     steps:
       - uses: actions/checkout@v4
-      - name: Verify private nanostore access
-        env:
-          NANOSTORE_PAT: ${{ secrets.NANOSTORE_PAT }}
-        run: |
-          test -n "$NANOSTORE_PAT" || {
-            echo "::error::Set the NANOSTORE_PAT repository secret to build kuri. nanostore is a private dependency."
-            exit 1
-          }
-      - name: Checkout private nanostore dependency
-        uses: actions/checkout@v4
-        with:
-          repository: justrach/nanostore
-          ref: e242f7f8cf75ca6c636c15482a83f7833291b53b
-          token: ${{ secrets.NANOSTORE_PAT }}
-          path: nanostore
-      - name: Link nanostore at the path expected by build.zig.zon
-        run: ln -s "$GITHUB_WORKSPACE/nanostore" "$GITHUB_WORKSPACE/../nanostore"
       - uses: mlugg/setup-zig@v2
         with:
           version: 0.17.0-dev.813+2153f8143

CHANGELOG.md

@@ -4,6 +4,9 @@ All notable changes to kuri are documented here.
 
 ## [Unreleased]
 
+### Removed
+- **`connect` feature and nanostore dependency** — the `/connect/*` routes, `kuri-agent connect`, `kuri-connect-broker`, and relay-fetch mode shipped in v0.5.1 are removed from main. They depended on the private `justrach/nanostore` sibling library, which made every build of kuri require a private checkout plus a `NANOSTORE_PAT` secret in CI, and its pinned commit did not compile on the project's Zig 0.17.0-dev toolchain. Building kuri now needs only this repo. `KURI_VAULT_PASSPHRASE`, `KURI_RELAY`, and `KURI_BROKER*` no longer have any effect.
+
 ## [0.5.1] — 2026-07-31
 
 ### Features

build.zig

@@ -11,14 +11,6 @@ pub fn build(b: *std.Build) void {
     const build_options = b.addOptions();
     build_options.addOption([]const u8, "version", version);
 
-    // nanostore: encrypted secret/connection vault (sibling library), used by
-    // the `kuri connect` feature for persisted, encrypted browser logins.
-    const nanostore_dep = b.dependency("nanostore", .{
-        .target = target,
-        .optimize = optimize,
-    });
-    const nanostore_mod = nanostore_dep.module("nanostore");
-
     // Main executable
     const exe = b.addExecutable(.{
         .name = "kuri",
@@ -30,7 +22,6 @@ pub fn build(b: *std.Build) void {
         }),
     });
     exe.root_module.addOptions("build_options", build_options);
-    exe.root_module.addImport("nanostore", nanostore_mod);
 
     b.installArtifact(exe);
 
@@ -51,7 +42,6 @@ pub fn build(b: *std.Build) void {
         }),
     });
     unit_tests.root_module.addOptions("build_options", build_options);
-    unit_tests.root_module.addImport("nanostore", nanostore_mod);
     const test_step = b.step("test", "Run unit tests");
     test_step.dependOn(&b.addRunArtifact(unit_tests).step);
 
@@ -179,7 +169,6 @@ pub fn build(b: *std.Build) void {
         }),
     });
     agent_exe.root_module.addOptions("build_options", build_options);
-    agent_exe.root_module.addImport("nanostore", nanostore_mod);
     b.installArtifact(agent_exe);
     const run_agent = b.addRunArtifact(agent_exe);
     run_agent.step.dependOn(b.getInstallStep());
@@ -217,27 +206,6 @@ pub fn build(b: *std.Build) void {
     const mcp_step = b.step("mcp", "Run kuri-mcp MCP server");
     mcp_step.dependOn(&run_mcp.step);
 
-    // kuri-connect-broker: key-holding broker daemon for the `connect` feature.
-    // Holds KURI_VAULT_PASSPHRASE so the agent never does, and exposes only
-    // inject/list/save/delete over a token-gated loopback API.
-    const broker_exe = b.addExecutable(.{
-        .name = "kuri-connect-broker",
-        .root_module = b.createModule(.{
-            .root_source_file = b.path("src/connect_broker.zig"),
-            .target = target,
-            .optimize = optimize,
-            .link_libc = true,
-        }),
-    });
-    broker_exe.root_module.addOptions("build_options", build_options);
-    broker_exe.root_module.addImport("nanostore", nanostore_mod);
-    b.installArtifact(broker_exe);
-    const run_broker = b.addRunArtifact(broker_exe);
-    run_broker.step.dependOn(b.getInstallStep());
-    run_broker.addPassthruArgs();
-    const broker_step = b.step("broker", "Run kuri-connect-broker daemon");
-    broker_step.dependOn(&run_broker.step);
-
     // kuri-gateway: managed-service control plane (Track 1). Spawns/leases one
     // `kuri` worker (its own Chrome) per session, exposes an async task API, and
     // reverse-proxies the data plane scoped by session_id. Pulls in build_options

build.zig.zon

@@ -7,9 +7,6 @@
             .hash = "quickjs_ng-0.0.0-0cZnA8XHAwCc95T1GAebWrw-SGEwp1Y0fUAmilP8xGuS",
         },
         .kuri_mobile = .{ .path = "kuri-mobile" },
-        // Local sibling library: encrypted secret/connection vault used by the
-        // `kuri connect` feature for persisted, encrypted browser logins.
-        .nanostore = .{ .path = "../nanostore" },
     },
     .fingerprint = 0xb63ec72d77641494,
     .minimum_zig_version = "0.17.0-dev.813+2153f8143",