@pellux/goodvibes-tui 1.14.0 → 1.15.0

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to GoodVibes TUI.
 
 ---
 
+## [1.15.0] — 2026-07-11
+
+### Changes
+- e95c369d fix(install): treat a release without a sqlite-vec manifest entry as pre-addon
+- 86c1cd9c feat(install): ship the sqlite-vec native addon to pure-binary installs
+- b5590ef3 install.sh: install goodvibes-agent as a checksum-verified compiled binary; restart a running agent post-install
+- f0860827 install.sh: restart a running daemon after the binary swap so the curl one-liner works as an upgrade
+
 ## [1.14.0] — 2026-07-11
 
 ### Changes

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-1.14.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
+[![Version](https://img.shields.io/badge/version-1.15.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
 
 A terminal-native AI coding, operations, automation, knowledge, and integration console with a typed runtime, omnichannel surfaces, structured memory/knowledge, and a raw ANSI renderer.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
@@ -131,10 +131,10 @@
     "typescript": "^5.9.3"
   },
   "optionalDependencies": {
-    "@pellux/goodvibes-tui-linux-x64": "1.14.0",
-    "@pellux/goodvibes-tui-linux-arm64": "1.14.0",
-    "@pellux/goodvibes-tui-darwin-x64": "1.14.0",
-    "@pellux/goodvibes-tui-darwin-arm64": "1.14.0"
+    "@pellux/goodvibes-tui-linux-x64": "1.15.0",
+    "@pellux/goodvibes-tui-linux-arm64": "1.15.0",
+    "@pellux/goodvibes-tui-darwin-x64": "1.15.0",
+    "@pellux/goodvibes-tui-darwin-arm64": "1.15.0"
   },
   "trustedDependencies": [],
   "overrides": {

package/src/input/commands/update-runtime.ts

@@ -9,10 +9,12 @@
  *                                whether this build is already current.
  *   /update apply              — for a binary install (scripts/install.sh),
  *                                download + verify + atomically swap the
- *                                app and daemon binaries. For any other
- *                                install kind, prints the exact command to
- *                                run instead — it never attempts a swap it
- *                                can't do safely.
+ *                                app and daemon binaries, and refresh the
+ *                                sqlite-vec native addon in lockstep so the
+ *                                vector index never goes stale beside a new
+ *                                binary. For any other install kind, prints the
+ *                                exact command to run instead — it never
+ *                                attempts a swap it can't do safely.
  *   /update review              — install/subscription/sandbox posture,
  *                                unrelated to the update mechanics above.
  *   /update bundle export|inspect <path> — portable posture bundle, as before.
@@ -34,6 +36,7 @@ import {
   CHECKSUM_MANIFEST_NAME,
   parseChecksumFile,
   resolveArtifactNames,
+  resolveSqliteVecAsset,
   sha256,
   verifyChecksum,
 } from '../../runtime/release-artifacts.ts';
@@ -87,6 +90,24 @@ function swapBinaryAtomically(targetPath: string, buffer: Buffer): void {
   renameSync(tempPath, targetPath);
 }
 
+/**
+ * Writes the sqlite-vec native addon into place with the same temp-write +
+ * atomic-rename discipline as the binaries, so a running process never
+ * dlopen()s a half-written extension. The addon's parent directory
+ * (`<execDir>/lib/sqlite-vec-<os>-<arch>/`) is created first because a fresh
+ * install may not have a `lib/` tree yet. A shared library needs no execute
+ * bit, so this uses 0o644 rather than the binaries' 0o755.
+ */
+function writeAddonAtomically(targetPath: string, buffer: Buffer): void {
+  mkdirSync(dirname(targetPath), { recursive: true });
+  const tempPath = `${targetPath}.update-download`;
+  writeFileSync(tempPath, buffer);
+  if (process.platform !== 'win32') {
+    chmodSync(tempPath, 0o644);
+  }
+  renameSync(tempPath, targetPath);
+}
+
 export interface DaemonServiceRestartInfo {
   readonly managed: boolean;
   readonly unitName: string;
@@ -150,6 +171,8 @@ export interface ApplyUpdateOptions {
   readonly runCommand?: RunCommand;
   /** Injectable so tests can observe/skip the actual filesystem swap. */
   readonly swap?: (targetPath: string, buffer: Buffer) => void;
+  /** Injectable so tests can observe/skip writing the sqlite-vec addon. */
+  readonly writeAddon?: (targetPath: string, buffer: Buffer) => void;
   readonly fileExists?: (path: string) => boolean;
 }
 
@@ -205,12 +228,37 @@ export async function applyUpdate(options: ApplyUpdateOptions): Promise<void> {
     verifyChecksum(artifacts.daemon, sha256(daemonBuffer), checksums.get(artifacts.daemon));
   }
 
-  // Both downloads verified before either swap — an update must not apply partially.
+  // The sqlite-vec native addon travels with the binaries: refresh it in the
+  // same download-verify-swap pass so /update never leaves a new binary beside a
+  // stale addon. It lands at <execDir>/lib/sqlite-vec-<os>-<arch>/vec0.<suffix>,
+  // exactly where the SDK's loader resolves it. The manifest entry decides
+  // whether the target release ships it — an entry that IS present makes the
+  // download and checksum mandatory (a mismatch is fatal, verified before any
+  // swap), while an absent entry means the target predates the addon and is
+  // skipped rather than blocking an otherwise-valid binary update. On macOS the
+  // file is refreshed for consistency even though the platform blocks extension
+  // loading.
+  const addon = resolveSqliteVecAsset(options.platform, options.arch);
+  const addonExpected = addon ? checksums.get(addon.assetName) : undefined;
+  let addonBuffer: Buffer | null = null;
+  if (addon && addonExpected !== undefined) {
+    addonBuffer = await downloadBuffer(options.fetchImpl, `${baseUrl}/${addon.assetName}`);
+    verifyChecksum(addon.assetName, sha256(addonBuffer), addonExpected);
+  }
+
+  // All downloads verified before any write — an update must not apply partially.
   const swap = options.swap ?? swapBinaryAtomically;
   swap(appBinaryPath, appBuffer);
   if (daemonBuffer) {
     swap(daemonBinaryPath, daemonBuffer);
   }
+  const addonTargetPath = addon && addonBuffer
+    ? join(dirname(appBinaryPath), 'lib', addon.dirName, addon.fileName)
+    : null;
+  if (addonBuffer && addonTargetPath) {
+    const writeAddon = options.writeAddon ?? writeAddonAtomically;
+    writeAddon(addonTargetPath, addonBuffer);
+  }
 
   const serviceInfo = detectDaemonServiceManaged(options.platform, options.configManager, options.runCommand);
 
@@ -221,6 +269,7 @@ export async function applyUpdate(options: ApplyUpdateOptions): Promise<void> {
       daemonBinaryPresent
         ? `  daemon binary: ${daemonBinaryPath}`
         : `  daemon binary: not found at ${daemonBinaryPath} — left untouched`,
+      ...(addonTargetPath ? [`  vector addon:  ${addonTargetPath}`] : []),
       '',
       'Restart goodvibes to run the new version.',
       serviceInfo.managed

package/src/runtime/release-artifacts.ts

@@ -42,6 +42,36 @@ export function resolveArtifactNames(platform: string, arch: string): ReleaseArt
   };
 }
 
+export interface SqliteVecAsset {
+  /** Release asset filename, e.g. `sqlite-vec-linux-x64.so`. */
+  readonly assetName: string;
+  /** Directory name the SDK loader resolves, e.g. `sqlite-vec-linux-x64`. */
+  readonly dirName: string;
+  /** File the loader opens inside that directory, e.g. `vec0.so`. */
+  readonly fileName: string;
+}
+
+/**
+ * Names the sqlite-vec native addon for a platform/arch. Unlike the binaries
+ * (whose release tag maps darwin→"macos"), the addon keeps the Node-style
+ * platform tag ("linux" | "darwin") because that is exactly what the SDK's
+ * loader resolves at `<execDir>/lib/sqlite-vec-<process.platform>-<process.arch>/vec0.<suffix>`.
+ * The scripts/install.sh installer and the release workflow name the asset the
+ * same way; all three must stay in lockstep.
+ */
+export function resolveSqliteVecAsset(platform: string, arch: string): SqliteVecAsset | null {
+  if ((platform !== 'linux' && platform !== 'darwin') || (arch !== 'x64' && arch !== 'arm64')) {
+    return null;
+  }
+  const suffix = platform === 'darwin' ? 'dylib' : 'so';
+  const dirName = `sqlite-vec-${platform}-${arch}`;
+  return {
+    assetName: `${dirName}.${suffix}`,
+    dirName,
+    fileName: `vec0.${suffix}`,
+  };
+}
+
 export function sha256(buffer: Buffer | Uint8Array): string {
   return createHash('sha256').update(buffer).digest('hex');
 }

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.14.0';
+let _version = '1.15.0';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   _version = pkg.version ?? _version;