@vibesdotdev/bin 1.0.2 → 1.0.3-rc.2

package/LICENSE

@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) 2026 VIBES DEV LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,37 +1,18 @@
-# Vibes CLI
+# @vibesdotdev/bin
 
-Published npm wrapper for the public `vibes` binary.
+The `vibes` command-line interface. It starts the public plugin host with no
+setup step: the plugins it composes are this package's own `vibes.plugins`,
+installed as its dependencies.
 
-## Installation
+## Install
 
-```bash
-npm install -g @vibesdotdev/bin
-```
-
-Or with bun:
-
-```bash
+```sh
 bun add -g @vibesdotdev/bin
+vibes --help
 ```
 
-## Usage
-
-The package downloads a platform-specific `vibes` binary during `postinstall` and exposes it through the package `bin` field.
-
-Set `VIBES_BINARY_MIRROR` to override the release download base URL. The default
-mirror is `https://assets.vibes.dev/downloads/cli`. The installer verifies the
-download against `SHA256SUMS.txt` from the same mirror before completing.
-
-To inspect the exact npm tarball before release:
-
-```bash
-npm run pack:dry-run
-```
-
-To publish from this package after npm auth is configured:
+The `vibes` executable runs on [Bun](https://bun.sh).
 
-```bash
-npm run publish:npm
-```
+## License
 
-See [https://vibes.dev](https://vibes.dev) for documentation.
+MIT. See `LICENSE`.

package/checkout.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env bun
+import { realpathSync, statSync } from 'node:fs';
+import { isAbsolute, relative, sep } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+// The checkout command is the same public CLI rooted at the declared checkout:
+// it declares the published package's version, `vibes.plugins` selection and
+// `vibes.config` block, resolved in the checkout's own graph.
+import manifest from './package.json' with { type: 'json' };
+
+const declared = process.argv[2];
+if (!declared || !isAbsolute(declared)) throw new Error('A checkout CLI requires an absolute declared root.');
+const root = realpathSync(declared);
+if (!statSync(root).isDirectory()) throw new Error('The declared checkout root is not a directory.');
+// Same custody rule the host's capture applies, before loading any host
+// module: a root that does not own this script cannot own its graph.
+const location = relative(root, realpathSync(fileURLToPath(import.meta.url)));
+if (!location || location === '..' || location.startsWith(`..${sep}`) || isAbsolute(location)) {
+	throw new Error('The checkout CLI must belong to the declared root.');
+}
+
+/**
+ * Resolve a host module from the declared checkout root, so a copy nested
+ * under `node_modules/@vibesdotdev/bin` never boots a second graph. An
+ * isolated linker may keep the host beside bin instead of at the root; the
+ * fallback loads that copy and the checkout's Kernel admission still refuses
+ * a second Kernel.
+ */
+function resolveHostModule(specifier) {
+	try {
+		return pathToFileURL(Bun.resolveSync(specifier, root)).href;
+	} catch (error) {
+		if (error?.name !== 'ResolveMessage') throw error;
+		return import.meta.resolve(specifier);
+	}
+}
+
+const { captureCheckoutCliLaunch } = await import(resolveHostModule('@vibesdotdev/host-bun/cli-checkout'));
+const launch = captureCheckoutCliLaunch(import.meta.url);
+const { startHost } = await import(resolveHostModule('@vibesdotdev/plugins/host-start.mjs'));
+await startHost({
+	...launch,
+	host: { ...launch.host, version: manifest.version },
+	hostPluginSpecifiers: manifest.vibes.plugins,
+	hostConfig: manifest.vibes.config,
+	attestHostGraph: true,
+	globalPackagePlugins: false
+});

package/package.json

@@ -1,42 +1,145 @@
 {
   "name": "@vibesdotdev/bin",
-  "version": "1.0.2",
-  "description": "Vibes CLI - the command-line interface for the Vibes platform",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/vibesdotdev/monorepo.git",
-    "directory": "packages/cli-bin"
+  "version": "1.0.3-rc.2",
+  "dependencies": {
+    "@vibesdotdev/account": "^1.0.0-rc.0",
+    "@vibesdotdev/agent-execution": "^1.0.0-rc.0",
+    "@vibesdotdev/ai": "^1.0.0-rc.0",
+    "@vibesdotdev/ai-schemas": "^1.0.0-rc.0",
+    "@vibesdotdev/applets": "^1.0.0-rc.0",
+    "@vibesdotdev/auth": "^1.0.0-rc.0",
+    "@vibesdotdev/bridge": "^1.0.0-rc.0",
+    "@vibesdotdev/chat": "^1.0.0-rc.0",
+    "@vibesdotdev/cli": "^1.0.0-rc.0",
+    "@vibesdotdev/code-sessions": "^1.0.0-rc.0",
+    "@vibesdotdev/command-palette": "^1.0.0-rc.0",
+    "@vibesdotdev/control": "^1.0.0-rc.0",
+    "@vibesdotdev/execution-local": "^1.0.0-rc.0",
+    "@vibesdotdev/filesystem": "^1.0.0-rc.0",
+    "@vibesdotdev/git-operations": "^1.0.0-rc.0",
+    "@vibesdotdev/host-bun": "^1.0.0-rc.0",
+    "@vibesdotdev/hq": "^1.0.0-rc.0",
+    "@vibesdotdev/infra-core": "^1.0.0-rc.0",
+    "@vibesdotdev/infra-deploy": "^1.0.0-rc.0",
+    "@vibesdotdev/integrations": "^1.0.0-rc.0",
+    "@vibesdotdev/integrations-vibes": "^1.0.0-rc.0",
+    "@vibesdotdev/kernel": "^1.0.0-rc.0",
+    "@vibesdotdev/kernel-rpc": "^1.0.0-rc.0",
+    "@vibesdotdev/kit": "^1.0.0-rc.0",
+    "@vibesdotdev/knowledge": "^1.0.0-rc.0",
+    "@vibesdotdev/mcp": "^1.0.0-rc.0",
+    "@vibesdotdev/notifications": "^1.0.0-rc.0",
+    "@vibesdotdev/platform": "^1.0.0-rc.0",
+    "@vibesdotdev/plugins": "^1.0.0-rc.0",
+    "@vibesdotdev/pm": "^1.0.0-rc.0",
+    "@vibesdotdev/projects": "^1.0.0-rc.0",
+    "@vibesdotdev/prompts": "^1.0.0-rc.0",
+    "@vibesdotdev/registry": "^1.0.0-rc.0",
+    "@vibesdotdev/scope": "^1.0.0-rc.0",
+    "@vibesdotdev/secrets": "^1.0.0-rc.0",
+    "@vibesdotdev/session": "^1.0.0-rc.0",
+    "@vibesdotdev/storage": "^1.0.0-rc.0",
+    "@vibesdotdev/studio": "^1.0.0-rc.0",
+    "@vibesdotdev/surface-sveltekit": "^1.0.0-rc.0",
+    "@vibesdotdev/sync": "^1.0.0-rc.0",
+    "@vibesdotdev/terminal-client": "^1.0.0-rc.0",
+    "@vibesdotdev/testing": "^1.0.0-rc.0",
+    "@vibesdotdev/tui": "^1.0.0-rc.0",
+    "@vibesdotdev/vessel": "^1.0.0-rc.0",
+    "@vibesdotdev/workboard": "^1.0.0-rc.0",
+    "@vibesdotdev/workspace": "^1.0.0-rc.0"
   },
-  "homepage": "https://vibes.dev",
-  "bin": {
-    "vibes": "bin/vibes"
+  "gitHead": "54ccfb6769c79c4d35361a7d27778a9ee991b9f9",
+  "_vibes_source": {
+    "repo": "ssh://git@git.vibes.dev/vibesdotdev/cli-bin.git",
+    "sha": "54ccfb6769c79c4d35361a7d27778a9ee991b9f9",
+    "workspaceDigest": "sha256:35a9fb041381b0f77619cd27067b9d3ab20be5dc63ebb27b5ae22040d4e587c8"
   },
   "files": [
-    "bin/vibes",
-    "scripts/postinstall.js",
-    "README.md"
-  ],
-  "scripts": {
-    "postinstall": "node scripts/postinstall.js",
-    "pack:dry-run": "npm pack --dry-run --json --ignore-scripts",
-    "publish:npm": "npm publish --access public --registry=https://registry.npmjs.org",
-    "check": "bun --bun tsc -p tsconfig.json --noEmit"
-  },
-  "os": [
-    "darwin",
-    "linux",
-    "win32"
-  ],
-  "cpu": [
-    "x64",
-    "arm64"
+    "vibes.mjs",
+    "checkout.mjs",
+    "!**/.turbo/**",
+    "!**/.svelte-kit/**",
+    "!**/.vibes/**",
+    "!**/__tests__/**",
+    "!**/__stubs__/**",
+    "!**/*.test.js",
+    "!**/*.test.mjs",
+    "!**/*.test.cjs",
+    "!**/*.test.jsx",
+    "!**/*.test.ts",
+    "!**/*.test.mts",
+    "!**/*.test.cts",
+    "!**/*.test.tsx",
+    "!**/*.spec.js",
+    "!**/*.spec.mjs",
+    "!**/*.spec.cjs",
+    "!**/*.spec.jsx",
+    "!**/*.spec.ts",
+    "!**/*.spec.mts",
+    "!**/*.spec.cts",
+    "!**/*.spec.tsx",
+    "!**/SPEC.md",
+    "!**/tsconfig.json",
+    "!**/tsconfig.*.json",
+    "!**/*.tsbuildinfo",
+    "!**/.build-ok.json",
+    "!**/*.tgz"
   ],
-  "engines": {
-    "node": ">=18"
+  "repository": {
+    "type": "git",
+    "url": "ssh://git@git.vibes.dev/vibesdotdev/cli-bin.git",
+    "directory": "npm-bin"
   },
   "publishConfig": {
-    "registry": "https://registry.npmjs.org",
+    "registry": "https://packages.vibes.dev",
     "access": "public"
+  },
+  "vibes": {
+    "visibility": "public",
+    "registry": {
+      "repositoryId": "80ee5ed7-a88d-49f8-86e8-f867006d1b4d",
+      "directory": "npm-bin"
+    },
+    "tier": "public",
+    "compositionRoots": [
+      "vibes.mjs",
+      "checkout.mjs"
+    ],
+    "plugins": [
+      "@vibesdotdev/plugins/consumer.plugin",
+      "@vibesdotdev/infra-core/service",
+      "@vibesdotdev/integrations-vibes/services",
+      "@vibesdotdev/infra-core/plugin",
+      "@vibesdotdev/infra-core/generate/plugin",
+      "@vibesdotdev/infra-deploy/plugin",
+      "@vibesdotdev/infra-deploy/cli/plugin",
+      "@vibesdotdev/pm/plugin",
+      "@vibesdotdev/pm/cli/plugin",
+      "@vibesdotdev/platform/plugin",
+      "@vibesdotdev/platform/cli/plugin",
+      "@vibesdotdev/platform/fleets/cli/plugin",
+      "@vibesdotdev/workboard/marshal/cli/plugin",
+      "@vibesdotdev/sync/plugin",
+      "@vibesdotdev/sync/cli/plugin",
+      "@vibesdotdev/studio/cli/plugin",
+      "@vibesdotdev/projects/app/cli/plugin",
+      "@vibesdotdev/plugins/tui/plugin"
+    ],
+    "config": {
+      "runtime.host": {
+        "environmentTier": "local",
+        "hardware": "consumer"
+      },
+      "infra.services": {
+        "environment": "production"
+      }
+    }
+  },
+  "description": "Vibes CLI. Starts the public plugin host with no setup command.",
+  "type": "module",
+  "license": "MIT",
+  "bin": {
+    "vibes": "./vibes.mjs"
   }
 }

package/vibes.mjs

@@ -0,0 +1,22 @@
+#!/usr/bin/env bun
+import { loadedCliHostDeclaration } from '@vibesdotdev/host-bun/resolution-root';
+import { startHost } from '@vibesdotdev/plugins/host-start.mjs';
+// The published package identity is the executable's declaration: its version
+// is what `vibes --version` reports, and `vibes.plugins` is the public plugin
+// selection this package installs as `dependencies` and composes at the graph
+// it was installed into. `vibes.config` is the executable's own config block
+// (the environment tier credentials resolve under, the services environment).
+// Nothing here lists a plugin or a setting.
+import manifest from './package.json' with { type: 'json' };
+
+await startHost({
+	host: {
+		...loadedCliHostDeclaration({
+			scriptUrl: import.meta.url,
+			hostEntryUrl: import.meta.resolve('@vibesdotdev/plugins/host-start.mjs')
+		}),
+		version: manifest.version
+	},
+	hostPluginSpecifiers: manifest.vibes.plugins,
+	hostConfig: manifest.vibes.config
+});

package/bin/vibes

@@ -1,149 +0,0 @@
-#!/usr/bin/env node
-// Cross-platform launcher for the vibes CLI binary.
-//
-// npm's bin field is static, but the published package downloads a
-// platform-specific binary at install time (scripts/postinstall.js):
-//   - Unix:    overwrites THIS file (bin/vibes) with the binary itself,
-//              so subsequent invocations skip Node entirely.
-//   - Windows: writes bin/vibes.exe alongside this file. npm-on-Windows
-//              generates a vibes.cmd that does `node bin/vibes`, so this
-//              shim has to be a JS file that spawns the .exe. Without it,
-//              Windows would try to execute a shell script and fail.
-//
-// If neither artifact is present, postinstall didn't complete — surface a
-// clear error rather than silently doing nothing.
-
-'use strict';
-
-const { spawnSync } = require('child_process');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-
-const binDir = __dirname;
-const installerPath = path.join(binDir, '..', 'scripts', 'postinstall.js');
-const exePath = path.join(binDir, 'vibes.exe');
-
-function getPersistentBinDir() {
-	if (process.env.VIBES_INSTALL_DIR) return process.env.VIBES_INSTALL_DIR;
-
-	const bunGlobalBin = readCommandOutput('bun', ['pm', 'bin', '-g']);
-	if (bunGlobalBin) return bunGlobalBin;
-
-	if (process.env.BUN_INSTALL) return path.join(process.env.BUN_INSTALL, 'bin');
-
-	if (process.platform === 'win32') {
-		const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
-		return path.join(base, 'Programs', 'vibes', 'bin');
-	}
-
-	if (process.env.XDG_BIN_HOME) return process.env.XDG_BIN_HOME;
-	return path.join(os.homedir(), '.local', 'bin');
-}
-
-function readCommandOutput(command, args) {
-	const result = spawnSync(command, args, {
-		encoding: 'utf8',
-		stdio: ['ignore', 'pipe', 'ignore'],
-		windowsHide: true
-	});
-	if (result.error || result.status !== 0) return undefined;
-	const value = result.stdout.trim();
-	return value.length > 0 ? value : undefined;
-}
-
-function getPersistentBinaryPath() {
-	return path.join(getPersistentBinDir(), process.platform === 'win32' ? 'vibes.exe' : 'vibes');
-}
-
-function runInstaller() {
-	const result = spawnSync(process.execPath, [installerPath], {
-		stdio: 'inherit',
-		windowsHide: false,
-		env: { ...process.env, VIBES_INSTALL_PERSISTENT: '1' }
-	});
-	if (result.error) {
-		process.stderr.write(`Failed to run installer: ${result.error.message}\n`);
-		process.exit(1);
-	}
-	if (result.status !== 0) {
-		process.exit(result.status === null ? 1 : result.status);
-	}
-}
-
-function reportMissingBinary() {
-	process.stderr.write('Error: vibes binary not installed.\n');
-	process.stderr.write('\n');
-	process.stderr.write('The installer could not place the platform binary.\n');
-	process.stderr.write('\n');
-	process.stderr.write('If the problem persists, see https://github.com/vibesdotdev/monorepo/issues\n');
-	process.exit(1);
-}
-
-function isStillNodeShim(filePath) {
-	try {
-		const content = fs.readFileSync(filePath, 'utf8');
-		return content.includes('Cross-platform launcher for the vibes CLI binary');
-	} catch {
-		return false;
-	}
-}
-
-if (process.platform === 'win32') {
-	const persistentPath = getPersistentBinaryPath();
-	if (fs.existsSync(persistentPath)) {
-		const result = spawnSync(persistentPath, process.argv.slice(2), {
-			stdio: 'inherit',
-			windowsHide: false
-		});
-		if (result.error) {
-			process.stderr.write(`Failed to spawn ${persistentPath}: ${result.error.message}\n`);
-			process.exit(1);
-		}
-		process.exit(result.status === null ? 1 : result.status);
-	}
-	if (!fs.existsSync(exePath)) {
-		runInstaller();
-	}
-	if (!fs.existsSync(exePath)) {
-		reportMissingBinary();
-	}
-	const result = spawnSync(exePath, process.argv.slice(2), {
-		stdio: 'inherit',
-		windowsHide: false
-	});
-	if (result.error) {
-		process.stderr.write(`Failed to spawn vibes.exe: ${result.error.message}\n`);
-		process.exit(1);
-	}
-	process.exit(result.status === null ? 1 : result.status);
-}
-
-const persistentPath = getPersistentBinaryPath();
-if (fs.existsSync(persistentPath) && !isStillNodeShim(persistentPath)) {
-	const result = spawnSync(persistentPath, process.argv.slice(2), {
-		stdio: 'inherit',
-		windowsHide: false
-	});
-	if (result.error) {
-		process.stderr.write(`Failed to spawn ${persistentPath}: ${result.error.message}\n`);
-		process.exit(1);
-	}
-	process.exit(result.status === null ? 1 : result.status);
-}
-
-runInstaller();
-
-if (!fs.existsSync(persistentPath) || isStillNodeShim(persistentPath)) {
-	reportMissingBinary();
-}
-
-const result = spawnSync(persistentPath, process.argv.slice(2), {
-	stdio: 'inherit',
-	windowsHide: false
-});
-if (result.error) {
-	process.stderr.write(`Failed to spawn vibes: ${result.error.message}\n`);
-	process.exit(1);
-}
-process.exit(result.status === null ? 1 : result.status);

package/scripts/postinstall.js

@@ -1,310 +0,0 @@
-#!/usr/bin/env node
-
-const https = require('https');
-const http = require('http');
-const crypto = require('crypto');
-const { spawnSync } = require('child_process');
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-const BASE_URL = process.env.VIBES_BINARY_MIRROR || 'https://assets.vibes.dev/downloads/cli';
-
-function getPlatform() {
-  const platform = os.platform();
-  if (platform === 'win32') return 'win32';
-  if (platform === 'darwin') return 'darwin';
-  return 'linux';
-}
-
-function getArch() {
-  const arch = os.arch();
-  if (arch === 'x64') return 'x64';
-  if (arch === 'arm64') return 'arm64';
-  // Node on macOS can report 'arm' for Apple Silicon
-  if (arch === 'arm' && getPlatform() === 'darwin') return 'arm64';
-  return 'x64';
-}
-
-function getBinaryName() {
-  const platform = getPlatform();
-  const arch = getArch();
-  const baseName = `vibes-${platform}-${arch}`;
-  return platform === 'win32' ? `${baseName}.exe` : baseName;
-}
-
-function getOutputPath() {
-  const platform = getPlatform();
-  if (process.env.VIBES_INSTALL_PERSISTENT === '1') {
-    const dir = getPersistentBinDir();
-    const outputName = platform === 'win32' ? 'vibes.exe' : 'vibes';
-    return path.join(dir, outputName);
-  }
-  const dir = path.join(__dirname, '..', 'bin');
-  const outputName = platform === 'win32' ? 'vibes.exe' : 'vibes';
-  return path.join(dir, outputName);
-}
-
-function getPersistentBinDir() {
-  if (process.env.VIBES_INSTALL_DIR) return process.env.VIBES_INSTALL_DIR;
-
-  const bunGlobalBin = readCommandOutput('bun', ['pm', 'bin', '-g']);
-  if (bunGlobalBin) return bunGlobalBin;
-
-  if (process.env.BUN_INSTALL) return path.join(process.env.BUN_INSTALL, 'bin');
-
-  if (process.platform === 'win32') {
-    const base = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
-    return path.join(base, 'Programs', 'vibes', 'bin');
-  }
-
-  if (process.env.XDG_BIN_HOME) return process.env.XDG_BIN_HOME;
-
-  // POSIX fallback used by Linux distributions and many shell setups. If it is
-  // not on PATH, the installer prints a warning with the exact directory.
-  return path.join(os.homedir(), '.local', 'bin');
-}
-
-function readCommandOutput(command, args) {
-  const result = spawnSync(command, args, {
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'ignore'],
-    windowsHide: true
-  });
-  if (result.error || result.status !== 0) return undefined;
-  const value = result.stdout.trim();
-  return value.length > 0 ? value : undefined;
-}
-
-function pathHasDir(dir) {
-  const pathValue = process.env.PATH || '';
-  const resolvedDir = path.resolve(dir);
-  return pathValue
-    .split(path.delimiter)
-    .filter(Boolean)
-    .some((entry) => path.resolve(entry) === resolvedDir);
-}
-
-function showProgress(total, current) {
-  if (total > 0) {
-    const percent = Math.round((current / total) * 100);
-    const bar = '[' + '='.repeat(Math.floor(percent / 5)) + ' '.repeat(20 - Math.floor(percent / 5)) + ']';
-    process.stdout.write(`\r${bar} ${percent}%`);
-  } else {
-    process.stdout.write('.');
-  }
-}
-
-function download(url, dest, callback) {
-  const protocol = url.startsWith('https') ? https : http;
-
-  const request = protocol.get(url, { timeout: 30000 }, (response) => {
-    // Handle redirects
-    if (response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
-      download(response.headers.location, dest, callback);
-      return;
-    }
-
-    if (response.statusCode !== 200) {
-      callback(new Error(`Failed to download: HTTP ${response.statusCode}`));
-      return;
-    }
-
-    const total = parseInt(response.headers['content-length'], 10);
-    let downloaded = 0;
-
-    const fp = fs.openSync(dest, 'w');
-    response.on('data', (chunk) => {
-      downloaded += chunk.length;
-      showProgress(total, downloaded);
-      fs.writeSync(fp, chunk);
-    });
-
-    response.on('end', () => {
-      fs.closeSync(fp);
-      console.log();
-      callback(null);
-    });
-
-    response.on('error', (err) => {
-      fs.closeSync(fp);
-      callback(err);
-    });
-  });
-
-  request.on('error', (err) => {
-    callback(err);
-  });
-
-  request.on('timeout', () => {
-    request.destroy();
-    callback(new Error('Download timed out'));
-  });
-}
-
-function fetchText(url, callback) {
-  const protocol = url.startsWith('https') ? https : http;
-
-  const request = protocol.get(url, { timeout: 30000 }, (response) => {
-    if (response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
-      fetchText(response.headers.location, callback);
-      return;
-    }
-
-    if (response.statusCode !== 200) {
-      callback(new Error(`HTTP ${response.statusCode}`));
-      return;
-    }
-
-    let body = '';
-    response.setEncoding('utf8');
-    response.on('data', (chunk) => {
-      body += chunk;
-    });
-    response.on('end', () => callback(null, body));
-    response.on('error', callback);
-  });
-
-  request.on('error', callback);
-  request.on('timeout', () => {
-    request.destroy();
-    callback(new Error('Download timed out'));
-  });
-}
-
-function verifyChecksum(binaryName, filePath) {
-  return new Promise((resolve, reject) => {
-    if (process.env.VIBES_SKIP_CHECKSUM === '1') {
-      console.warn('Warning: VIBES_SKIP_CHECKSUM=1 set; skipping checksum verification.');
-      resolve();
-      return;
-    }
-
-    const checksumUrl = `${BASE_URL}/SHA256SUMS.txt`;
-    fetchText(checksumUrl, (err, text) => {
-      if (err) {
-        reject(new Error(`Could not fetch checksum file from ${checksumUrl}: ${err.message}`));
-        return;
-      }
-
-      const line = text
-        .split(/\r?\n/)
-        .find((entry) => entry.trim().endsWith(`  ${binaryName}`));
-      if (!line) {
-        reject(new Error(`No checksum entry for ${binaryName} in ${checksumUrl}`));
-        return;
-      }
-
-      const expected = line.trim().split(/\s+/)[0];
-      const actual = crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex');
-      if (actual !== expected) {
-        reject(new Error(`Checksum mismatch for ${binaryName}`));
-        return;
-      }
-
-      console.log('Verified release checksum');
-      resolve();
-    });
-  });
-}
-
-function makeExecutable(filePath) {
-  const platform = getPlatform();
-  if (platform === 'win32') return;
-
-  try {
-    fs.chmodSync(filePath, 0o755);
-  } catch (err) {
-    console.error('Warning: Could not chmod +x:', err.message);
-  }
-}
-
-function isWorkspaceInstall() {
-  // Explicit opt-out (set in CI, the monorepo's bun install, or any env that
-  // already has the binary built locally and doesn't want network on install).
-  if (process.env.VIBES_SKIP_BINARY_DOWNLOAD === '1') return true;
-
-  // When this package is installed from the npm registry, the realpath of the
-  // script location includes `/node_modules/` (the unpacked tarball path). When
-  // bun installs us via a workspace link, realpath dereferences the symlink to
-  // the monorepo source — which lives outside any `node_modules` directory. We
-  // use this asymmetry to skip downloads cleanly inside the workspace while
-  // failing loudly for real end-user installs.
-  try {
-    const real = fs.realpathSync(__dirname);
-    const sep = path.sep;
-    return !real.includes(`${sep}node_modules${sep}`);
-  } catch {
-    return false;
-  }
-}
-
-async function main() {
-  if (isWorkspaceInstall()) {
-    console.log('Vibes CLI installer: workspace install detected, skipping binary download.');
-    return;
-  }
-
-  const binaryName = getBinaryName();
-  const outputPath = getOutputPath();
-  const url = `${BASE_URL}/${binaryName}`;
-
-  console.log(`Vibes CLI installer`);
-  console.log(`Platform: ${getPlatform()}, Arch: ${getArch()}`);
-  console.log(`Downloading ${binaryName}...`);
-
-  // Ensure bin directory exists
-  const binDir = path.dirname(outputPath);
-  if (!fs.existsSync(binDir)) {
-    fs.mkdirSync(binDir, { recursive: true });
-  }
-
-  // Check if already exists and up-to-date
-  if (fs.existsSync(outputPath)) {
-    try {
-      fs.unlinkSync(outputPath);
-    } catch (err) {
-      console.error('Could not remove existing binary:', err.message);
-    }
-  }
-
-  return new Promise((resolve, reject) => {
-    download(url, outputPath, (err) => {
-      if (err) {
-        console.error();
-        console.error('Error:', err.message);
-        console.error(`Could not download binary from ${url}`);
-        console.error();
-        console.error('To resolve:');
-        console.error(`  - Confirm a release exists at ${BASE_URL}`);
-        console.error(`  - Confirm ${BASE_URL}/SHA256SUMS.txt is reachable and contains ${binaryName}`);
-        console.error('  - Or point VIBES_BINARY_MIRROR at an alternate download base URL');
-        console.error('  - Or download the binary manually and place it at:');
-        console.error(`      ${outputPath}`);
-        console.error('  - Or set VIBES_SKIP_BINARY_DOWNLOAD=1 to skip this step');
-        console.error('  - Or set VIBES_SKIP_CHECKSUM=1 only if you trust the mirror and need to bypass checksum verification');
-        reject(err);
-        return;
-      }
-
-      verifyChecksum(binaryName, outputPath)
-        .then(() => {
-          makeExecutable(outputPath);
-          console.log(`Installed to ${outputPath}`);
-          const outputDir = path.dirname(outputPath);
-          if (process.env.VIBES_INSTALL_PERSISTENT === '1' && !pathHasDir(outputDir)) {
-            console.warn(`Warning: ${outputDir} is not on PATH. Add it to run \`vibes\` directly.`);
-          }
-          resolve();
-        })
-        .catch(reject);
-    });
-  });
-}
-
-main().catch((err) => {
-  console.error('Installation failed:', err.message);
-  // End-user installs reach here when isWorkspaceInstall() was false above
-  // (i.e., the script lives under node_modules) and the download failed. Fail
-  // loud so the user sees a broken install instead of a silently empty bin/.
-  process.exit(1);
-});