vibesdev 1.0.0 → 1.0.2

package/README.md

@@ -22,9 +22,9 @@ bunx vibesdev --help
 
 ## What This Package Does
 
-This package depends on `@vibesdotdev/bin`, the canonical Vibes CLI binary
-wrapper. It exposes `vibesdev` as a short npm package name and forwards command
-execution to the `vibes` binary installed by `@vibesdotdev/bin`.
+This package installs the Vibes CLI binary from the public Vibes binary mirror.
+It exposes `vibesdev` as a short npm package name and also installs the `vibes`
+command.
 
 The installed command remains:
 

package/bin/vibesdev.js

@@ -1,37 +1,34 @@
 #!/usr/bin/env node
 'use strict';
 
-const { spawnSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
+const { spawnSync } = require('child_process');
 
 function fail(message) {
   process.stderr.write(`${message}\n`);
   process.exit(1);
 }
 
-function resolveCanonicalPackageDir() {
-  try {
-    return path.dirname(require.resolve('@vibesdotdev/bin/package.json', {
-      paths: [__dirname]
-    }));
-  } catch {
-    fail([
-      'Error: @vibesdotdev/bin is not installed.',
-      '',
-      'Reinstall the alias package:',
-      '  npm install -g vibesdev',
-      '    or',
-      '  bun add -g vibesdev'
-    ].join('\n'));
-  }
-}
-
-const packageDir = resolveCanonicalPackageDir();
+const packageDir = path.resolve(__dirname, '..');
+const installerPath = path.join(packageDir, 'scripts', 'postinstall.js');
 const binPath = path.join(packageDir, 'bin', 'vibes');
 const exePath = path.join(packageDir, 'bin', 'vibes.exe');
 const args = process.argv.slice(2);
 
+function runInstaller() {
+  const result = spawnSync(process.execPath, [installerPath], {
+    stdio: 'inherit',
+    windowsHide: false
+  });
+  if (result.error) {
+    fail(`Failed to run vibes installer: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    process.exit(result.status === null ? 1 : result.status);
+  }
+}
+
 let command = binPath;
 let commandArgs = args;
 
@@ -44,14 +41,15 @@ if (process.platform === 'win32') {
   }
 }
 
+if (!fs.existsSync(binPath) && !fs.existsSync(exePath)) {
+  runInstaller();
+}
+
 if (!fs.existsSync(binPath) && !fs.existsSync(exePath)) {
   fail([
     'Error: vibes binary is not installed.',
     '',
-    'The @vibesdotdev/bin postinstall script did not complete. To fix, re-run install:',
-    '  npm rebuild -g @vibesdotdev/bin',
-    '    or',
-    '  bun pm trust @vibesdotdev/bin && bun install -g @vibesdotdev/bin'
+    'The vibesdev installer could not place the platform binary.'
   ].join('\n'));
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibesdev",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Short npm alias for the Vibes CLI",
   "license": "MIT",
   "repository": {
@@ -15,16 +15,15 @@
   },
   "files": [
     "bin/vibesdev.js",
+    "scripts/postinstall.js",
     "README.md"
   ],
   "scripts": {
+    "postinstall": "node scripts/postinstall.js",
     "pack:dry-run": "npm pack --dry-run --json --ignore-scripts",
     "publish:npm": "npm publish --access public --registry=https://registry.npmjs.org",
     "check": "node -c bin/vibesdev.js"
   },
-  "dependencies": {
-    "@vibesdotdev/bin": "1.0.0"
-  },
   "os": [
     "darwin",
     "linux",

package/scripts/postinstall.js

@@ -0,0 +1,260 @@
+#!/usr/bin/env node
+
+const https = require('https');
+const http = require('http');
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const BASE_URL = process.env.VIBES_BINARY_MIRROR || 'https://assets.vibes.dev/downloads/cli';
+
+function getPlatform() {
+  const platform = os.platform();
+  if (platform === 'win32') return 'win32';
+  if (platform === 'darwin') return 'darwin';
+  return 'linux';
+}
+
+function getArch() {
+  const arch = os.arch();
+  if (arch === 'x64') return 'x64';
+  if (arch === 'arm64') return 'arm64';
+  // Node on macOS can report 'arm' for Apple Silicon
+  if (arch === 'arm' && getPlatform() === 'darwin') return 'arm64';
+  return 'x64';
+}
+
+function getBinaryName() {
+  const platform = getPlatform();
+  const arch = getArch();
+  const baseName = `vibes-${platform}-${arch}`;
+  return platform === 'win32' ? `${baseName}.exe` : baseName;
+}
+
+function getOutputPath() {
+  const platform = getPlatform();
+  const dir = path.join(__dirname, '..', 'bin');
+  const outputName = platform === 'win32' ? 'vibes.exe' : 'vibes';
+  return path.join(dir, outputName);
+}
+
+function showProgress(total, current) {
+  if (total > 0) {
+    const percent = Math.round((current / total) * 100);
+    const bar = '[' + '='.repeat(Math.floor(percent / 5)) + ' '.repeat(20 - Math.floor(percent / 5)) + ']';
+    process.stdout.write(`\r${bar} ${percent}%`);
+  } else {
+    process.stdout.write('.');
+  }
+}
+
+function download(url, dest, callback) {
+  const protocol = url.startsWith('https') ? https : http;
+
+  const request = protocol.get(url, { timeout: 30000 }, (response) => {
+    // Handle redirects
+    if (response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
+      download(response.headers.location, dest, callback);
+      return;
+    }
+
+    if (response.statusCode !== 200) {
+      callback(new Error(`Failed to download: HTTP ${response.statusCode}`));
+      return;
+    }
+
+    const total = parseInt(response.headers['content-length'], 10);
+    let downloaded = 0;
+
+    const fp = fs.openSync(dest, 'w');
+    response.on('data', (chunk) => {
+      downloaded += chunk.length;
+      showProgress(total, downloaded);
+      fs.writeSync(fp, chunk);
+    });
+
+    response.on('end', () => {
+      fs.closeSync(fp);
+      console.log();
+      callback(null);
+    });
+
+    response.on('error', (err) => {
+      fs.closeSync(fp);
+      callback(err);
+    });
+  });
+
+  request.on('error', (err) => {
+    callback(err);
+  });
+
+  request.on('timeout', () => {
+    request.destroy();
+    callback(new Error('Download timed out'));
+  });
+}
+
+function fetchText(url, callback) {
+  const protocol = url.startsWith('https') ? https : http;
+
+  const request = protocol.get(url, { timeout: 30000 }, (response) => {
+    if (response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
+      fetchText(response.headers.location, callback);
+      return;
+    }
+
+    if (response.statusCode !== 200) {
+      callback(new Error(`HTTP ${response.statusCode}`));
+      return;
+    }
+
+    let body = '';
+    response.setEncoding('utf8');
+    response.on('data', (chunk) => {
+      body += chunk;
+    });
+    response.on('end', () => callback(null, body));
+    response.on('error', callback);
+  });
+
+  request.on('error', callback);
+  request.on('timeout', () => {
+    request.destroy();
+    callback(new Error('Download timed out'));
+  });
+}
+
+function verifyChecksum(binaryName, filePath) {
+  return new Promise((resolve, reject) => {
+    if (process.env.VIBES_SKIP_CHECKSUM === '1') {
+      console.warn('Warning: VIBES_SKIP_CHECKSUM=1 set; skipping checksum verification.');
+      resolve();
+      return;
+    }
+
+    const checksumUrl = `${BASE_URL}/SHA256SUMS.txt`;
+    fetchText(checksumUrl, (err, text) => {
+      if (err) {
+        reject(new Error(`Could not fetch checksum file from ${checksumUrl}: ${err.message}`));
+        return;
+      }
+
+      const line = text
+        .split(/\r?\n/)
+        .find((entry) => entry.trim().endsWith(`  ${binaryName}`));
+      if (!line) {
+        reject(new Error(`No checksum entry for ${binaryName} in ${checksumUrl}`));
+        return;
+      }
+
+      const expected = line.trim().split(/\s+/)[0];
+      const actual = crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex');
+      if (actual !== expected) {
+        reject(new Error(`Checksum mismatch for ${binaryName}`));
+        return;
+      }
+
+      console.log('Verified release checksum');
+      resolve();
+    });
+  });
+}
+
+function makeExecutable(filePath) {
+  const platform = getPlatform();
+  if (platform === 'win32') return;
+
+  try {
+    fs.chmodSync(filePath, 0o755);
+  } catch (err) {
+    console.error('Warning: Could not chmod +x:', err.message);
+  }
+}
+
+function isWorkspaceInstall() {
+  // Explicit opt-out (set in CI, the monorepo's bun install, or any env that
+  // already has the binary built locally and doesn't want network on install).
+  if (process.env.VIBES_SKIP_BINARY_DOWNLOAD === '1') return true;
+
+  // When this package is installed from the npm registry, the realpath of the
+  // script location includes `/node_modules/` (the unpacked tarball path). When
+  // bun installs us via a workspace link, realpath dereferences the symlink to
+  // the monorepo source — which lives outside any `node_modules` directory. We
+  // use this asymmetry to skip downloads cleanly inside the workspace while
+  // failing loudly for real end-user installs.
+  try {
+    const real = fs.realpathSync(__dirname);
+    const sep = path.sep;
+    return !real.includes(`${sep}node_modules${sep}`);
+  } catch {
+    return false;
+  }
+}
+
+async function main() {
+  if (isWorkspaceInstall()) {
+    console.log('Vibes CLI installer: workspace install detected, skipping binary download.');
+    return;
+  }
+
+  const binaryName = getBinaryName();
+  const outputPath = getOutputPath();
+  const url = `${BASE_URL}/${binaryName}`;
+
+  console.log(`Vibes CLI installer`);
+  console.log(`Platform: ${getPlatform()}, Arch: ${getArch()}`);
+  console.log(`Downloading ${binaryName}...`);
+
+  // Ensure bin directory exists
+  const binDir = path.dirname(outputPath);
+  if (!fs.existsSync(binDir)) {
+    fs.mkdirSync(binDir, { recursive: true });
+  }
+
+  // Check if already exists and up-to-date
+  if (fs.existsSync(outputPath)) {
+    try {
+      fs.unlinkSync(outputPath);
+    } catch (err) {
+      console.error('Could not remove existing binary:', err.message);
+    }
+  }
+
+  return new Promise((resolve, reject) => {
+    download(url, outputPath, (err) => {
+      if (err) {
+        console.error();
+        console.error('Error:', err.message);
+        console.error(`Could not download binary from ${url}`);
+        console.error();
+        console.error('To resolve:');
+        console.error(`  - Confirm a release exists at ${BASE_URL}`);
+        console.error(`  - Confirm ${BASE_URL}/SHA256SUMS.txt is reachable and contains ${binaryName}`);
+        console.error('  - Or point VIBES_BINARY_MIRROR at an alternate download base URL');
+        console.error('  - Or download the binary manually and place it at:');
+        console.error(`      ${outputPath}`);
+        console.error('  - Or set VIBES_SKIP_BINARY_DOWNLOAD=1 to skip this step');
+        console.error('  - Or set VIBES_SKIP_CHECKSUM=1 only if you trust the mirror and need to bypass checksum verification');
+        reject(err);
+        return;
+      }
+
+      verifyChecksum(binaryName, outputPath)
+        .then(() => {
+          makeExecutable(outputPath);
+          console.log(`Installed to ${outputPath}`);
+          resolve();
+        })
+        .catch(reject);
+    });
+  });
+}
+
+main().catch((err) => {
+  console.error('Installation failed:', err.message);
+  // End-user installs reach here when isWorkspaceInstall() was false above
+  // (i.e., the script lives under node_modules) and the download failed. Fail
+  // loud so the user sees a broken install instead of a silently empty bin/.
+  process.exit(1);
+});