Releases · cplieger/vibecli

scripts/dev-build.sh builds vibecli against the local ../vterm checkout (go.work + overlaid TS), dev-deploy.sh swaps the binary into the vibecli-dev container and restarts (no image rebuild, no CI), and cdp-verify.cjs inspects the rendered DOM via the Chromium sidecar. Used to validate the rebuild against real kiro-cli. go.work, vibecli-dev-bin, and static/vendor are gitignored build artifacts.

fix: adapt viewport to the new scroll controller; add scroll test fixture

viewport.ts no longer calls the removed scroll.suppressScroll; the settle handler's scrollToBottom already re-pins after a keyboard/resize transition, so the transient flip self-corrects. emit-fixture.sh is a deterministic PTY line emitter for live scroll testing.

feat: backfill terminal output after sleep, wake, and network changes

Wire the store-backed resume index (getHaveThrough) so on reconnect the server replays exactly the output missed while the device slept, and reconnect on the window online event alongside visibilitychange and pageshow.

Add scripts/cdp-bug2.cjs, a CDP harness that severs the WebSocket mid-stream and asserts the missed lines backfill contiguously with no duplicate rows.

feat: make touch selection, scrolling, and keyboard reliable

The terminal output is now a display-only surface (native text selection that survives redraws) instead of a contenteditable that doubled as the scroll content, caret, and keyboard proxy. A single textarea owns the keyboard, the local input buffer, and IME; every focus path targets it. Because the editable element is no longer the scroll content, the first touch-drag scrolls and a tap on a sparse screen summons the keyboard.

The context menu is now clamped inside the viewport so its copy/paste callout never opens off-screen near an edge. Desktop typing, paste bracketing, and IME continue to work through the textarea's existing input path.

feat: show a marker when earlier terminal output was trimmed

Wire the vterm resume-bounds callback so the terminal shows an 'earlier output trimmed' divider at the top when scrollback older than the buffer holds is gone, rather than a silent content jump.

feat: retain more scrollback so a chat restore survives reconnect

Raise the terminal's server-side scrollback ring to 5000 lines (from the 1000 default) to match the client's retained-line cap, so a kiro-cli /chat session restore — which dumps the whole transcript at once — isn't trimmed on a reconnect.

refactor: build the client on the @cplieger/web-terminal packages

vibecli now consumes the renamed engine (github.com/cplieger/web-terminal)
and the extracted reference UI (@cplieger/web-terminal-ui) instead of the
old @cplieger/vterm. The client shrinks to a single mount() call: the
terminal UI modules (composition, predict, viewport, status) and the CSS
moved into web-terminal-ui, so static-src is now thin kiro-cli glue.

go.mod requires github.com/cplieger/web-terminal; static-src deps are
@cplieger/web-terminal + @cplieger/web-terminal-ui; the dev-build and
Dockerfile compile both packages to static/vendor and bundle the CSS from
the UI package; the served importmap maps both. No behavior change — the
rebuild bricks already landed; this is the package reorg.

refactor: point the client at the renamed @cplieger/web-terminal-engine

The engine package/module was renamed web-terminal → web-terminal-engine.
Repoint go.mod require + routes.go import, the static-src dependency, the
served importmap + vendor slug, the dev-build overlay/compile, and the
Dockerfile engine fetch (ARG + tarball) + compile. @cplieger/web-terminal-ui
is unchanged.

chore: point dev build script at renamed ../web-terminal-engine checkout
feat: build against published web-terminal-engine 1.2.0 and web-terminal-ui 1.0.0

Pin the engine Go module to v1.2.0 and the engine+UI npm packages (engine 1.2.0, UI 1.0.0) off the pre-publish placeholders; regenerate the lockfile (stale @cplieger/vterm entries cleared, real integrity hashes recorded); bump the Dockerfile ARGs.

chore: exclude local go.work from the docker build context

Match web-terminal-server. A local-dev go.work carries a replace to ../web-terminal-engine; if copied into the build context, in-container go build follows the replace to a nonexistent path and fails. CI checks out clean so it never hit this, but a local docker build did.

sec: patch libssh2 by upgrading apt packages in the builder stage

The builder stage installed without apt-get upgrade, so it kept the base image's vulnerable libssh2-1t64 1.11.1-1 (CVE-2026-55200 critical, CVE-2026-55199 + CVE-2026-7598 high) that Trivy flagged and the code-scanning merge-protection ruleset blocked on. Add apt-get upgrade -y (matching the final stage) to pull 1.11.1-1+deb13u1. Also drop the stale xterm.js mention in the stage comment.