@pellux/goodvibes-tui 0.18.4 → 0.18.9

package/CHANGELOG.md

@@ -4,8 +4,192 @@ All notable changes to GoodVibes TUI.
 
 ---
 
+## [0.18.9] — 2026-04-15
+
+### SDK `0.18.24` Host-Boundary Cutover
+
+- Updated `goodvibes-tui` to consume the published canonical SDK line at `@pellux/goodvibes-sdk@0.18.24`
+- Fixed the TUI host/runtime boundary so SDK-owned services receive explicit TUI configuration instead of inheriting shared defaults
+- Passed TUI-owned ecosystem catalog roots into SDK marketplace, skills, integration, and product surfaces so curated catalogs and receipts stay under `.goodvibes/tui/ecosystem/...`
+- Passed `surfaceRoot: 'tui'` into the daemon service manager and `defaultSurfaceKind: 'tui'` into automation runtime setup so service files and automation target semantics stay product-owned
+- Allowed the TUI runtime host to inject its own `localUserAuthManager` instead of letting the SDK bootstrap local auth storage implicitly
+
+### Removed Remaining Local Ecosystem Duplication
+
+- Removed the dead local `src/runtime/ecosystem/catalog.ts` implementation from the TUI
+- Kept the TUI on package imports for ecosystem catalog/recommendation behavior instead of carrying a second local implementation beside the SDK
+- Fixed the marketplace panel test and the built-in marketplace panel factory so they both use the same explicit TUI catalog-root wiring as the command/runtime host
+
+### Foundation And Release-Path Corrections
+
+- Regenerated checked-in foundation artifacts after the SDK `0.18.24` control-plane and contract updates so the TUI release gates stay aligned with the canonical runtime builders
+- Cleared the remaining temp-root failure in the marketplace panel test by moving it onto the repo-local `.tmp-tests` path
+- Revalidated the TUI end to end after the SDK boundary fixes instead of shipping on targeted checks alone
+
+### Verification
+
+- Full typecheck passes: `bun x tsc --noEmit --pretty false`
+- Full test runner passes: `bun run test`
+- Architecture gate passes: `bun run architecture:check`
+- Performance gate passes: `bun run perf:check`
+- Eval gate passes: `bun run eval:gate`
+- Foundation artifacts export passes: `bun run foundation:artifacts`
+- Build passes: `bun run build`
+- Publish packaging check passes: `bun run publish:check`
+- Staged npm package rehearsal passes: `bun run publish:dry-run`
+- Staged GitHub Packages rehearsal passes: `bun run publish:dry-run:github`
+- Diff hygiene passes: `git diff --check`
+
+## [0.18.8] — 2026-04-15
+
+### Canonical SDK Cutover Completion
+
+- Switched the TUI to the canonical published SDK line at `@pellux/goodvibes-sdk@0.18.21`
+- Removed the remaining local REPL and sandbox runtime implementations from the TUI and routed those flows through SDK-owned package imports instead
+- Rewired command, MCP, panel, and runtime call sites that were still holding local platform copies so the TUI now consumes the shared SDK surface instead of carrying duplicate implementations
+
+### TUI-Owned Configuration Boundary Fixes
+
+- Kept product-owned storage and runtime identity at `.goodvibes/tui/...` by making the TUI pass explicit host configuration into SDK-owned services instead of inheriting SDK defaults
+- Wired cross-session task graphs to the TUI-owned path under `.goodvibes/tui/sessions/task-graph.json`
+- Instantiated the team and worklist tools with explicit `surfaceRoot: 'tui'` host configuration instead of relying on SDK defaults
+- Aligned language-override and secret-store tests with the real TUI-owned configuration boundary
+
+### Release-Path And Test Hardening
+
+- Added per-file repo-local temp roots in `scripts/run-tests.ts` so the full TUI test suite no longer collides on shared temp filesystems
+- Reworked tests that still wrote to `/tmp` or shared temp roots so they now use the active temp root or an explicit external directory when validating escape behavior
+- Fixed the intelligence test helper to lazily initialize its runtime singletons, eliminating the module-init cycle that surfaced after the SDK cutover
+- Improved the Skills panel detail path rendering so long skill origins keep the useful suffix visible instead of clipping away the selected file
+
+### Verification
+
+- Full typecheck passes: `bun x tsc --noEmit --pretty false`
+- Full test runner passes locally: `bun run test`
+- Architecture gate passes: `bun run architecture:check`
+- Performance gate passes: `bun run perf:check`
+- Eval gate passes: `bun run eval:gate`
+- Foundation artifacts export passes: `bun run foundation:artifacts`
+- Build passes: `bun run build`
+- Publish packaging check passes: `bun run publish:check`
+- Staged npm package rehearsal passes: `bun run publish:dry-run`
+- Staged GitHub Packages rehearsal passes: `bun run publish:dry-run:github`
+- Local package install smoke passes through `postinstall` with staged release artifacts
+- Diff hygiene passes: `git diff --check`
+
+## [0.18.7] — 2026-04-14
+
+Superseded before successful public registry release. The release workflow got past the package-install fix, but the REPL tool and REPL test harness were still allocating temp state under constrained temp filesystems, which failed the test phase before publish. The corrected release shipped in `0.18.8`.
+
+### Release Workflow Install Fix
+
+- Fixed the TUI package postinstall path so source checkouts no longer try to download release binaries during `bun install`
+- This unblocks CI and release validation jobs, which install repo dependencies before the GitHub Release assets exist
+- Kept the actual packaged install behavior unchanged: published npm and GitHub Packages installs still download the matching TUI and standalone daemon binaries during `postinstall`
+
+### Verification
+
+- Full typecheck passes: `bun x tsc --noEmit --pretty false`
+- Publish packaging check passes: `bun run publish:check`
+- Staged npm package rehearsal passes: `bun run publish:dry-run`
+- Staged GitHub Packages rehearsal passes: `bun run publish:dry-run:github`
+- Local package install smoke passes through `postinstall` with staged release artifacts
+- Diff hygiene passes: `git diff --check`
+
+## [0.18.6] — 2026-04-14
+
+Superseded before successful public registry release. The repo checkout still ran the binary-download `postinstall` during CI `bun install`, which blocked the tagged release before publish. The corrected release shipped in `0.18.7`.
+
+### Public Package Delivery Fix
+
+- Replaced the oversized bundled-binary npm package model with a smaller package that installs the matching TUI and standalone daemon binaries during `postinstall`
+- Kept the package identities as `@pellux/goodvibes-tui` on npmjs and `@mgd34msu/goodvibes-tui` on GitHub Packages while keeping the installed CLI surface as `goodvibes` and `goodvibes-daemon`
+- Kept the runtime fallback path so installs can still run from Bun + source if a platform binary is unavailable, but made the intended install path the version-matched release binaries
+
+### Release Workflow Correction
+
+- Reordered the release workflow so the GitHub Release and binary assets are created before npmjs and GitHub Packages publishing, ensuring package installs can fetch release assets immediately after publish
+- Reworked install-smoke validation so the packed npm tarball is tested through the real `postinstall` path that installs both the TUI and daemon binaries for the current platform
+- Hardened publish validation so registry tarballs fail if they accidentally include vendored binaries again or exceed the package-size guardrail
+
+### Verification
+
+- Full typecheck passes: `bun x tsc --noEmit --pretty false`
+- Publish packaging check passes: `bun run publish:check`
+- Staged npm package rehearsal passes: `bun run publish:dry-run`
+- Staged GitHub Packages rehearsal passes: `bun run publish:dry-run:github`
+- Local package install smoke passes through `postinstall` with staged release artifacts
+- Diff hygiene passes: `git diff --check`
+
+## [0.18.5] — 2026-04-14
+
+Superseded before successful public registry release. The bundled-binary tarball for this version exceeded npmjs and GitHub Packages size limits, and the corrected public package model shipped in `0.18.6`.
+
+### Public Package And Release Correction
+
+- Corrected the public packaged release path after the initial `0.18.4` cutover so the shipped npm distribution now matches the actual intended install model
+- Published the TUI on npm as `@pellux/goodvibes-tui` and mirrored the same release to GitHub Packages as `@mgd34msu/goodvibes-tui`
+- Kept the installed CLI surface as `goodvibes` and `goodvibes-daemon` while moving the package identity to the scoped release names
+- Added both launcher bins to the packaged distribution so global installs expose the interactive TUI and the standalone daemon directly on the user path
+
+### Bundled Binary Delivery
+
+- Bundled the compiled TUI binaries directly into the npm package for:
+  - Linux x64
+  - Linux arm64
+  - macOS x64
+  - macOS arm64
+- Bundled the standalone daemon binaries directly into the npm package for:
+  - Linux x64
+  - Linux arm64
+  - macOS x64
+  - macOS arm64
+- Removed the prior install-time binary download behavior so npm installs now use the packaged binaries already present in `vendor/`
+- Added packaged release checksums through `vendor/SHA256SUMS.txt` and release-asset `SHA256SUMS.txt`
+
+### Release Automation And Publish Path Hardening
+
+- Added staged vendor-binary packaging so npm and GitHub Packages publishes are built from the same explicit bundled-binary package shape
+- Added a dedicated publish-packaging path for registry release publishing instead of depending on raw repo copies during publish
+- Added a GitHub Packages publish job alongside the npmjs publish job in the release workflow
+- Fixed staged publish rehearsal so local dry-runs validate the real publishable package shape without tripping registry version conflicts or temporary-filesystem quota failures
+- Extended release validation and install smoke coverage to require both launcher bins and both bundled binary families
+
+### Verification
+
+- Full typecheck passes: `bun x tsc --noEmit --pretty false`
+- Architecture gate passes: `bun run architecture:check`
+- Performance gate passes: `bun run perf:check`
+- Eval gate passes: `bun run eval:gate`
+- Full test runner passes: `bun run test`
+- Build passes: `bun run build`
+- Foundation artifact export passes: `bun run foundation:artifacts`
+- Vendored binary staging passes: `bun run vendor:stage --clean`
+- Publish packaging check passes: `bun run publish:check`
+- Staged npm package rehearsal passes: `bun run publish:dry-run`
+- Staged GitHub Packages rehearsal passes: `bun run publish:dry-run:github`
+- Diff hygiene passes: `git diff --check`
+
 ## [0.18.4] — 2026-04-14
 
+### First Public Distribution And Delivery
+
+- Published the TUI under the Pellux scope as `@pellux/goodvibes-tui` while keeping the installed CLI commands as `goodvibes` and `goodvibes-daemon`
+- Added a GitHub Packages mirror as `@mgd34msu/goodvibes-tui`
+- Bundled the compiled TUI and standalone daemon binaries directly into the npm package instead of relying on install-time downloads
+- Added both `goodvibes` and `goodvibes-daemon` launcher bins to the package so global npm installs expose both commands on the user path
+- Expanded the release asset set to ship compiled binaries for:
+  - Linux x64
+  - Linux arm64
+  - macOS x64
+  - macOS arm64
+- Expanded the release asset set to ship standalone daemon binaries for:
+  - Linux x64
+  - Linux arm64
+  - macOS x64
+  - macOS arm64
+- Added `SHA256SUMS.txt` checksums for the published release binaries
+
 ### Canonical SDK Cutover
 
 - Switched `goodvibes-tui` from the temporary beta line to the canonical `@pellux/goodvibes-sdk@0.18.14` package and rewired imports to the canonical SDK entrypoints
@@ -17,6 +201,9 @@ All notable changes to GoodVibes TUI.
 - Fixed the TUI eval gate to use the SDK-backed eval baseline, formatting, and scorecard exports after the platform extraction removed the old local files
 - Fixed the TUI performance gate to build CI snapshots against the SDK-backed `surfacePerf` domain shape instead of the pre-extraction local `uiPerf` shape
 - Fixed the architecture check so it tolerates removed migration targets on clean checkouts instead of crashing when extracted directories no longer exist
+- Fixed the package publish path so release packaging stages vendored binaries deterministically instead of depending on install-time binary download behavior
+- Fixed the release workflow to publish both npmjs and GitHub Packages distributions from the same bundled-binary package shape
+- Fixed the staged publish rehearsal so it packs the final publishable package locally without tripping registry version conflicts or `/tmp` quota issues
 
 ### Verification
 
@@ -27,7 +214,10 @@ All notable changes to GoodVibes TUI.
 - Full test runner passes: `bun run test`
 - Build passes: `bun run build`
 - Foundation artifact export passes: `bun run foundation:artifacts`
+- Vendored binary staging passes: `bun run vendor:stage --clean`
 - Publish packaging check passes: `bun run publish:check`
+- Staged npm package rehearsal passes: `bun run publish:dry-run`
+- Staged GitHub Packages rehearsal passes: `bun run publish:dry-run:github`
 - Diff hygiene passes: `git diff --check`
 
 ## [0.18.3] — 2026-04-14

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-0.18.4-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
+[![Version](https://img.shields.io/badge/version-0.18.9-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
 
 A terminal-native AI coding, operations, automation, knowledge, and integration console with a typed runtime, omnichannel surfaces, structured memory/knowledge, and a raw ANSI renderer.
 
@@ -39,7 +39,7 @@ Common entrypoints:
 Release distribution:
 
 - GitHub Releases are the primary distribution path for compiled binaries
-- `npm install -g @pellux/goodvibes-tui` is supported on Linux, macOS, and WSL by downloading the matching prebuilt release binary during install
+- `npm install -g @pellux/goodvibes-tui` is supported on Linux, macOS, and WSL; the install script downloads the matching TUI and daemon binaries for the current platform
 - native Windows is not supported; use WSL on Windows
 
 Common paths:

package/bin/goodvibes

@@ -62,5 +62,5 @@ console.error(`platform: ${process.platform}-${process.arch}`);
 console.error(`supported prebuilt targets: ${supported}`);
 console.error('Either:');
 console.error('  1. install Bun and re-run the command, or');
-console.error('  2. reinstall after a matching GitHub release asset exists for this version.');
+console.error('  2. rerun the package postinstall step so the matching release binary is downloaded.');
 process.exit(1);

package/bin/goodvibes-daemon

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+import { accessSync, constants } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const packageRoot = join(__dirname, '..');
+
+if (process.platform === 'win32') {
+  console.error('goodvibes-daemon: native Windows is not supported.');
+  console.error('Use WSL so the Linux release binary path applies.');
+  process.exit(1);
+}
+
+function resolveArtifactName(platform, arch) {
+  if (platform === 'linux' && arch === 'x64') return 'goodvibes-daemon-linux-x64';
+  if (platform === 'linux' && arch === 'arm64') return 'goodvibes-daemon-linux-arm64';
+  if (platform === 'darwin' && arch === 'x64') return 'goodvibes-daemon-macos-x64';
+  if (platform === 'darwin' && arch === 'arm64') return 'goodvibes-daemon-macos-arm64';
+  return null;
+}
+
+function isExecutable(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function run(command, args) {
+  const child = spawnSync(command, args, { stdio: 'inherit' });
+  if (child.error) {
+    throw child.error;
+  }
+  process.exit(child.status ?? 1);
+}
+
+const artifactName = resolveArtifactName(process.platform, process.arch);
+const vendoredBinary = artifactName ? join(packageRoot, 'vendor', artifactName) : null;
+
+if (vendoredBinary && isExecutable(vendoredBinary)) {
+  run(vendoredBinary, process.argv.slice(2));
+}
+
+const bunProbe = spawnSync('bun', ['--version'], { stdio: 'ignore' });
+if (bunProbe.status === 0) {
+  run('bun', [join(packageRoot, 'src', 'daemon', 'cli.ts'), ...process.argv.slice(2)]);
+}
+
+const supported = [
+  'linux-x64',
+  'linux-arm64',
+  'darwin-x64',
+  'darwin-arm64',
+].join(', ');
+
+console.error('goodvibes-daemon: no runnable binary is available.');
+console.error(`platform: ${process.platform}-${process.arch}`);
+console.error(`supported prebuilt targets: ${supported}`);
+console.error('Either:');
+console.error('  1. install Bun and re-run the command, or');
+console.error('  2. rerun the package postinstall step so the matching daemon binary is downloaded.');
+process.exit(1);

package/docs/foundation-artifacts/operator-contract.json

@@ -3,7 +3,7 @@
   "product": {
     "id": "goodvibes",
     "surface": "operator",
-    "version": "0.18.4"
+    "version": "0.18.14"
   },
   "auth": {
     "modes": [

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "0.18.4",
+  "version": "0.18.9",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
   "bin": {
-    "goodvibes": "./bin/goodvibes"
+    "goodvibes": "bin/goodvibes",
+    "goodvibes-daemon": "bin/goodvibes-daemon"
   },
   "files": [
     "bin",
@@ -15,7 +16,7 @@
     "src",
     "!src/test",
     "!src/**/*.test.ts",
-    "scripts/postinstall.mjs",
+    "scripts/postinstall.js",
     "README.md",
     "CHANGELOG.md",
     "docs/foundation-artifacts"
@@ -30,15 +31,21 @@
     "build:linux-arm64": "bun build src/main.ts --compile --target=bun-linux-arm64 --outfile dist/goodvibes-linux-arm64",
     "build:macos-x64": "bun build src/main.ts --compile --target=bun-darwin-x64 --outfile dist/goodvibes-macos-x64",
     "build:macos-arm64": "bun build src/main.ts --compile --target=bun-darwin-arm64 --outfile dist/goodvibes-macos-arm64",
+    "build:daemon:linux-x64": "bun build src/daemon/cli.ts --compile --target=bun-linux-x64 --outfile dist/goodvibes-daemon-linux-x64",
+    "build:daemon:linux-arm64": "bun build src/daemon/cli.ts --compile --target=bun-linux-arm64 --outfile dist/goodvibes-daemon-linux-arm64",
+    "build:daemon:macos-x64": "bun build src/daemon/cli.ts --compile --target=bun-darwin-x64 --outfile dist/goodvibes-daemon-macos-x64",
+    "build:daemon:macos-arm64": "bun build src/daemon/cli.ts --compile --target=bun-darwin-arm64 --outfile dist/goodvibes-daemon-macos-arm64",
     "build:windows": "bun build src/main.ts --compile --target=bun-windows-x64 --outfile dist/goodvibes-windows.exe",
     "build:all-shell": "bun run build:linux-x64 && bun run build:linux-arm64 && bun run build:macos-x64 && bun run build:macos-arm64 && bun run build:windows",
     "test": "bun run scripts/run-tests.ts",
     "version": "bun run scripts/prebuild.ts",
-    "postinstall": "node scripts/postinstall.mjs",
-    "postbuild": "node scripts/postinstall.mjs --no-download",
+    "postinstall": "node scripts/postinstall.js",
+    "postbuild": "node scripts/postinstall.js --no-download",
     "release": "bun run scripts/release.ts",
     "release:dry": "bun run scripts/release.ts --dry-run",
-    "publish:dry-run": "npm pack --dry-run",
+    "publish:package": "bun run scripts/publish-package.ts",
+    "publish:dry-run": "bun run scripts/publish-package.ts --dry-run",
+    "publish:dry-run:github": "GOODVIBES_PUBLIC_PACKAGE_NAME=@mgd34msu/goodvibes-tui GOODVIBES_PUBLISH_REGISTRY=https://npm.pkg.github.com bun run scripts/publish-package.ts --dry-run",
     "publish:check": "bun run scripts/publish-check.ts",
     "build:prod": "bun run scripts/build.ts",
     "build:all": "bun run scripts/build.ts --all",
@@ -81,7 +88,7 @@
     "@anthropic-ai/vertex-sdk": "^0.16.0",
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
-    "@pellux/goodvibes-sdk": "0.18.14",
+    "@pellux/goodvibes-sdk": "0.18.24",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",

package/scripts/postinstall.js

@@ -0,0 +1,220 @@
+#!/usr/bin/env node
+import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { basename, dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const projectRoot = join(__dirname, '..');
+const home = homedir();
+const pkg = JSON.parse(readFileSync(join(projectRoot, 'package.json'), 'utf8'));
+const noDownload = process.argv.includes('--no-download') || process.env.GOODVIBES_SKIP_BINARY_DOWNLOAD === '1';
+
+function isSourceCheckout() {
+  return existsSync(join(projectRoot, '.git')) || existsSync(join(projectRoot, 'bun.lock'));
+}
+
+function resolveArtifactNames(platform, arch) {
+  if (platform === 'linux' && arch === 'x64') {
+    return {
+      app: 'goodvibes-linux-x64',
+      daemon: 'goodvibes-daemon-linux-x64',
+    };
+  }
+  if (platform === 'linux' && arch === 'arm64') {
+    return {
+      app: 'goodvibes-linux-arm64',
+      daemon: 'goodvibes-daemon-linux-arm64',
+    };
+  }
+  if (platform === 'darwin' && arch === 'x64') {
+    return {
+      app: 'goodvibes-macos-x64',
+      daemon: 'goodvibes-daemon-macos-x64',
+    };
+  }
+  if (platform === 'darwin' && arch === 'arm64') {
+    return {
+      app: 'goodvibes-macos-arm64',
+      daemon: 'goodvibes-daemon-macos-arm64',
+    };
+  }
+  return null;
+}
+
+function prepareBinary(path) {
+  if (process.platform !== 'win32') {
+    chmodSync(path, 0o755);
+  }
+}
+
+function sha256(buffer) {
+  return createHash('sha256').update(buffer).digest('hex');
+}
+
+function parseChecksumFile(contents) {
+  const checksums = new Map();
+  for (const rawLine of contents.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line) continue;
+    const match = line.match(/^([a-f0-9]{64})\s+\*?(.+)$/i);
+    if (!match) continue;
+    checksums.set(match[2], match[1].toLowerCase());
+  }
+  return checksums;
+}
+
+function resolveRepositoryBaseUrl() {
+  const repositoryUrl = typeof pkg.repository?.url === 'string' ? pkg.repository.url : '';
+  const normalized = repositoryUrl
+    .replace(/^git\+/, '')
+    .replace(/\.git$/, '')
+    .replace(/^git@github\.com:/, 'https://github.com/');
+  if (!normalized.startsWith('https://github.com/')) {
+    throw new Error(`unsupported repository URL for binary downloads: ${repositoryUrl || '(missing)'}`);
+  }
+  return normalized;
+}
+
+async function downloadFile(url, destination) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`download failed (${response.status}) for ${url}`);
+  }
+  writeFileSync(destination, Buffer.from(await response.arrayBuffer()));
+}
+
+async function downloadText(url) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`download failed (${response.status}) for ${url}`);
+  }
+  return await response.text();
+}
+
+async function installPlatformBinaries() {
+  const artifacts = resolveArtifactNames(process.platform, process.arch);
+  if (!artifacts) {
+    console.log(`postinstall: no prebuilt binaries for ${process.platform}-${process.arch}; skipping binary install`);
+    return;
+  }
+
+  if (noDownload) {
+    console.log('postinstall: skipping binary install (--no-download)');
+    return;
+  }
+
+  if (isSourceCheckout()) {
+    console.log('postinstall: source checkout detected; skipping release-binary install');
+    return;
+  }
+
+  const vendorDir = join(projectRoot, 'vendor');
+  mkdirSync(vendorDir, { recursive: true });
+
+  const localSourceDir = process.env.GOODVIBES_ASSET_SOURCE_DIR?.trim();
+  if (localSourceDir) {
+    for (const artifactName of [artifacts.app, artifacts.daemon]) {
+      const sourcePath = join(localSourceDir, artifactName);
+      if (!existsSync(sourcePath)) {
+        throw new Error(`missing local release artifact for postinstall smoke: ${sourcePath}`);
+      }
+      const destination = join(vendorDir, artifactName);
+      copyFileSync(sourcePath, destination);
+      prepareBinary(destination);
+    }
+    console.log(`postinstall: installed local smoke-test binaries for ${process.platform}-${process.arch}`);
+    return;
+  }
+
+  const releaseBaseUrl =
+    process.env.GOODVIBES_RELEASE_BASE_URL?.trim() ||
+    `${resolveRepositoryBaseUrl()}/releases/download/v${pkg.version}`;
+
+  const checksumUrl = `${releaseBaseUrl}/SHA256SUMS.txt`;
+  const checksumText = await downloadText(checksumUrl);
+  writeFileSync(join(vendorDir, 'SHA256SUMS.txt'), checksumText);
+  const checksums = parseChecksumFile(checksumText);
+
+  for (const artifactName of [artifacts.app, artifacts.daemon]) {
+    const destination = join(vendorDir, artifactName);
+    const tempDestination = `${destination}.download`;
+    rmSync(tempDestination, { force: true });
+    await downloadFile(`${releaseBaseUrl}/${artifactName}`, tempDestination);
+    const actual = sha256(readFileSync(tempDestination));
+    const expected = checksums.get(artifactName);
+    if (expected && expected !== actual) {
+      rmSync(tempDestination, { force: true });
+      throw new Error(`checksum mismatch for ${artifactName}: expected ${expected}, got ${actual}`);
+    }
+    rmSync(destination, { force: true });
+    copyFileSync(tempDestination, destination);
+    rmSync(tempDestination, { force: true });
+    prepareBinary(destination);
+  }
+
+  console.log(`postinstall: installed release binaries for ${process.platform}-${process.arch}`);
+}
+
+function deployBundledFiles() {
+  const targets = [
+    { src: join(projectRoot, '.goodvibes', 'skills'), dest: join(home, '.goodvibes', 'tui', 'skills') },
+    { src: join(projectRoot, '.goodvibes', 'agents'), dest: join(home, '.goodvibes', 'tui', 'agents') },
+  ];
+
+  let installed = 0;
+  let skipped = 0;
+
+  for (const { src, dest } of targets) {
+    if (!existsSync(src)) continue;
+
+    const entries = readdirSync(src, { withFileTypes: true });
+
+    for (const entry of entries) {
+      const srcPath = join(src, entry.name);
+      const destPath = join(dest, entry.name);
+
+      if (existsSync(destPath)) {
+        skipped++;
+        continue;
+      }
+
+      mkdirSync(dest, { recursive: true });
+
+      if (entry.isDirectory()) {
+        cpSync(srcPath, destPath, { recursive: true });
+        console.log(`  installed: ${entry.name}/`);
+        installed++;
+      } else if (entry.name.endsWith('.md')) {
+        cpSync(srcPath, destPath);
+        console.log(`  installed: ${entry.name}`);
+        installed++;
+      }
+    }
+  }
+
+  const goodvibesSrc = join(projectRoot, '.goodvibes', 'GOODVIBES.md');
+  const goodvibesDest = join(home, '.goodvibes', 'GOODVIBES.md');
+  if (existsSync(goodvibesSrc) && !existsSync(goodvibesDest)) {
+    mkdirSync(join(home, '.goodvibes'), { recursive: true });
+    copyFileSync(goodvibesSrc, goodvibesDest);
+    console.log(`  installed: ${basename(goodvibesDest)}`);
+    installed++;
+  } else if (existsSync(goodvibesDest)) {
+    skipped++;
+  }
+
+  if (installed > 0 || skipped > 0) {
+    console.log(`postinstall: ${installed} installed, ${skipped} already exist (skipped)`);
+  } else {
+    console.log('postinstall: nothing to deploy');
+  }
+}
+
+async function main() {
+  await installPlatformBinaries();
+  deployBundledFiles();
+}
+
+await main();

package/src/acp/connection.ts

@@ -15,13 +15,13 @@ import type {
   RequestPermissionResponse,
 } from '@pellux/goodvibes-sdk/platform/acp/protocol';
 import type { SubagentInfo, SubagentResult, SubagentTask } from '@pellux/goodvibes-sdk/platform/acp/protocol';
-import type { PermissionCategory } from '../permissions/manager.ts';
-import type { PermissionRequestHandler } from '../permissions/prompt.ts';
+import type { PermissionCategory } from '@pellux/goodvibes-sdk/platform/permissions/manager';
+import type { PermissionRequestHandler } from '@pellux/goodvibes-sdk/platform/permissions/prompt';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils/logger';
 import { analyzePermissionRequest } from '@pellux/goodvibes-sdk/platform/permissions/analysis';
 import { AcpError } from '@pellux/goodvibes-sdk/platform/types/errors';
 import { VERSION } from '../version.ts';
-import type { RuntimeEventBus } from '../runtime/events/index.ts';
+import type { RuntimeEventBus } from '@pellux/goodvibes-sdk/platform/runtime/events/index';
 import {
   emitAgentCancelled,
   emitAgentCompleted,
@@ -33,8 +33,8 @@ import {
   emitTransportInitializing,
   emitTransportSyncing,
   emitTransportTerminalFailure,
-} from '../runtime/emitters/index.ts';
-import type { HookDispatcher } from '../hooks/index.ts';
+} from '@pellux/goodvibes-sdk/platform/runtime/emitters/index';
+import type { HookDispatcher } from '@pellux/goodvibes-sdk/platform/hooks/index';
 import type { HookCategory, HookEventPath, HookPhase } from '@pellux/goodvibes-sdk/platform/hooks/types';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils/error-display';
 

package/src/acp/index.ts

@@ -4,4 +4,4 @@ export type {
   SubagentTask,
   SubagentStatus,
 } from '@pellux/goodvibes-sdk/platform/acp/protocol';
-export { AcpManager } from './manager.ts';
+export { AcpManager } from '@pellux/goodvibes-sdk/platform/acp/manager';