vibe 0.1.211

Markdown blocks, theme selector and syntax colouring in the conversation; docs moved to ADRs (#21)

Summary

What the agent hands over to be pasted (a PR description, a commit message) now arrives as something you can copy cleanly, and the conversation looks better. The branch also turns the finished plans into ADRs and does two small cleanups.

Conversation page

• Markdown blocks. A fenced block tagged markdown is drawn as the Markdown it is, and its button copies the raw source. A block that holds a code block of its own (fenced with four backticks) nests properly, and the inner block copies just its code.
• copyable-blocks base feature. Tells the agent, in every guided sandbox, to put text for the user to paste in one fenced block and say the rest outside it. Its short rule heads the instructions an agent always loads: a fresh agent ignored it when it was only in the read-when-relevant kit text.
• Theme selector at the end of the power menu: System / Dark / Light. The choice is kept in a cookie, so it is host-wide, and open pages follow a change within a few seconds.
• Syntax colouring of fenced blocks that have a language tag, through a new POST /api/highlight (token only, no repo) using the highlighter the Review tab uses. Only tagged blocks are coloured, and a block over 200 KB or 5,000 lines stays plain, with a notice saying why. Copying a block still gives plain code. Entities (&) and diff blocks are coloured too.
• Fix: New conversation stays at the right of the conversation bar when the status text beside it nearly fills the line.
• Review tab: going to a comment on a file the held diff doesn't have now says the page is behind, but only when the code really has changed since the diff was taken.

Docs and cleanup (no user-facing change)

• ADRs. Eleven built plans are now ADRs in docs/adr/ (date-stamped names, with an index). Plans only partly built were split: the built parts are in the ADR and what is left is a smaller plan (headless nice-to-have, review-tab enhancements, NuGet and npm, parallel sandbox update, sign-in next steps). Each ADR names the plan it replaced as a working git show <sha>:docs/plan-x.md. Remaining plans' status lines were corrected, and code comments that cited deleted plans now cite the ADRs.
• One wait for a sandbox to take a command (waitUntilReachable). WaitReachable and the loop at the end of Start were near-copies; they are now one, bounded by a duration the caller passes in and names (reachableToRestore 120 s, reachableToNudge 180 s, startTimeout 60 s). The times differ on purpose.
• Removed the migration of what earlier vibes kept (claude-theme, git-author, model and effort in settings.yaml): about 23 releases have passed, as the plan said to wait for. A stray old file now counts as an edit to the profile. The user-preferences file is unchanged, and the profile hash format is byte-identical.
• Test tooling: jsdom 24 to 30 for the page tests (this supersedes Dependabot #14). Master is merged in.
• A plan for getting files (screenshots, traces) out of the sandbox, not built.

Testing

• go test ./... and make pass. The jsdom page tests and the real-Firefox tests pass in CI on Linux, macOS and Windows.
• The wait unification has a test that fails if the limit stops being a duration, and the cleanup has tests that pin what is no longer read.
• Tried by hand: markdown and nested blocks with fresh agents (including a Usage example in a PR description), the theme in two tabs, Go colouring, and plain copy-out.
• Not tried by hand: the new wait on a real start of a stopped sandbox, beyond the sandbox that was rebuilt for testing; and the nested-fence rule with an agent is one run, not several.

Closes #14 (jsdom 30 supersedes it).

---

To install:

• Linux/macOS: curl -fsSL https://raw.githubusercontent.com/fluffynuts/vibe/master/install.sh | sh
• Windows: irm https://raw.githubusercontent.com/fluffynuts/vibe/master/install.ps1 | iex
• Manual: download the zip for your platform (below), unzip it anywhere, and run
  vibe --install from the folder it makes.

To upgrade, run the same command again, or vibe --upgrade once vibe is installed.

Platform	Zip
Linux (x86-64)	vibe-linux-amd64.zip
Linux (ARM)	vibe-linux-arm64.zip
macOS (Apple Silicon)	vibe-macos-arm64.zip
macOS (Intel)	vibe-macos-amd64.zip
Windows (x86-64)	vibe-windows-amd64.zip
Windows (ARM)	vibe-windows-arm64.zip

SHA256SUMS holds each zip's checksum. The install scripts and vibe --upgrade check it.

macOS: the binary isn't signed, so if it's blocked after downloading in a browser, run
xattr -dr com.apple.quarantine <folder> once.

What's Changed

• Markdown blocks, theme selector and syntax colouring in the conversation; docs moved to ADRs by @fluffynuts in #21

Full Changelog: v0.1.209...v0.1.211

vibe 0.1.209

Sandbox fixes: root's npm cache, PowerShell's ICU, page tests that don't skip; the Review tab says when the code has changed (#20)

Why

A re-composed sandbox had four problems, found while testing the last release. Each one cost real time, and one only showed up in a real build.

• npm install and npm ci failed for the agent with EACCES. The playwright and pnpm install steps run npm as root with the agent's home, so they filled ~/.npm with root's files.
• The pwsh feature installed PowerShell, found it wouldn't start (Couldn't find a valid ICU package), and removed it again. The sandbox had no pwsh.
• A full go test ./... printed ok with the real-Firefox test skipped (25 s instead of ~100 s). Nothing said so. After a branch switch, a stale node_modules also failed the page tests with virtualConsole.sendTo is not a function, which says nothing of the cause.
• After the agent answered a round of review, comments it made were placed for its changed code, on the older diff the tab still held, until Refresh.

What changed

Install steps

• Root's npm has a cache of its own, /root/.cache/npm, in the playwright and pnpm steps. ~/.npm is never touched, whatever order the steps run in. A first fix (give ~/.npm back to the agent after the Playwright step) was not enough: the pnpm step filled it again afterwards. A test now requires an own cache of every install step that runs npm.
• The pwsh step installs the newest libicu<version> the image's apt has before it runs PowerShell, and warns if it can't.
• The tests for these scripts stand in for apt and id, and run each script with a home of its own. Before this they depended on the machine running them.

Page tests

• The jsdom and real-Firefox tests fail, rather than skip, when node, jsdom or Firefox is missing, and say to run make test-deps (in the Makefile, make.sh and make.ps1: npm ci and npx playwright install firefox in uitest). A test fails if any Go test file that runs node contains t.Skip, found by glob, not listed by name.
• They also fail when what is installed isn't what uitest/package.json pins. A test requires every devDependencies pin to be a plain version, naming any that isn't.
• The node versions in the messages are read from engines in uitest/package.json, so they are right on any branch.
• CI installs Firefox on every OS, so the real-Firefox tests run on macOS and Windows too. macOS found four undo tests that pressed Ctrl+Z, which isn't undo on a Mac: they press the platform's undo now. The page leaves undo to the browser, so Mac users were never affected.

The Review tab

• Comments follow their code only when a diff is worked out, and the tab works one out on first show and on Refresh. So a comment the agent made after changing code could sit on the wrong line until Refresh.
• When the agent's turn ends, the page asks vibe whether the code is still the one its diff was of (GET /api/review/changed, a key over the files' fingerprints). The question only looks: it moves no comment and closes no review.
  • With the Review tab open and the code changed, a note beside Refresh says so. The diff is left alone, as you may be reading it. The note stays until Refresh.
  • With another tab open and the code changed, the diff is worked out afresh when the Review tab is next shown.
  • A turn that changed nothing does neither.

Testing

• go test ./... passes, 46 packages, with the Firefox tests running. CI is green on Ubuntu, macOS and Windows.
• A sandbox re-composed with ./test-clean: ~/.npm is absent after the build and root's cache is in /root/.cache/npm. pnpm, pwsh 7.6.9 (with libicu76) and Playwright all work. make test-deps works first time as the agent, with no sudo and no --cache, and the memories were restored.
• The Review note and the refresh on switching back, tried by hand with a temporary comment in app.js (since removed).
• The real pwsh install was also run against the real release and apt in a sandbox that had none.
• Each check that guards a rule was shown to fail when the rule is broken: the exact-pin test with a range, the script tests with a step cut out, the engines test with the old wording, and the stale-answer guard with the guard removed.

🤖 Generated with Claude Code

---

To install:

• Linux/macOS: curl -fsSL https://raw.githubusercontent.com/fluffynuts/vibe/master/install.sh | sh
• Windows: irm https://raw.githubusercontent.com/fluffynuts/vibe/master/install.ps1 | iex
• Manual: download the zip for your platform (below), unzip it anywhere, and run
  vibe --install from the folder it makes.

To upgrade, run the same command again, or vibe --upgrade once vibe is installed.

Platform	Zip
Linux (x86-64)	vibe-linux-amd64.zip
Linux (ARM)	vibe-linux-arm64.zip
macOS (Apple Silicon)	vibe-macos-arm64.zip
macOS (Intel)	vibe-macos-amd64.zip
Windows (x86-64)	vibe-windows-amd64.zip
Windows (ARM)	vibe-windows-arm64.zip

SHA256SUMS holds each zip's checksum. The install scripts and vibe --upgrade check it.

macOS: the binary isn't signed, so if it's blocked after downloading in a browser, run
xattr -dr com.apple.quarantine <folder> once.

What's Changed

• Sandbox fixes: root's npm cache, PowerShell's ICU, page tests that don't skip; the Review tab says when the code has changed by @fluffynuts in #20

Full Changelog: v0.1.205...v0.1.209

vibe 0.1.205

bug: an interrupted re-composition could fail to restore memories (#19)

What went wrong

A re-composition (-C, -r) saves the agent's memories to ~/.vibe/memories/<name>, removes the sandbox, then makes a new one. If making the new one failed (the kit image fetch can fail with resolve kits … EOF), the next run found no sandbox to back up, so it restored nothing. The new sandbox came up with no memories, although they were still safe on the host.

The cause was a flag, restoreAfterCreate, which only the run that made the backup could set.

What changed

• createSandbox now copies in whatever the sandbox's memory store holds whenever the agent supports memories, not only when the same run backed them up.
• If the user answers no to "Preserve agent memories?" on a rebuild, nothing is restored and vibe says so. The store is kept current by the save at the end of each session, so without this the "no" would have been overridden.
• A rebuild that saved the memories and then failed to make the sandbox now says the sandbox is gone, the memories are safe in the store, and that running vibe again restores them.
• readme updated.

Behaviour change to be aware of

A brand-new sandbox with the same name as one that left a store behind now gets those memories. vibe --delete removes the store, so this only applies to sandboxes removed some other way (sbx rm).

Testing

• New tests in src/vibe/restorememories_test.go: a store with memories and no sandbox is restored; an empty store, or an agent that can't use memories, restores nothing; a declined prompt restores nothing (watched it fail first); an accepted prompt saves and restores; plain vibe makes a sandbox whose memories are in the store and restores them; a failed make says where the memories are.
• go test ./... passes.
• By hand: made a sandbox, told the agent a number, vibe --stop, sbx rm, vibe -f: the new agent remembered it.
• Not verified: the real image-fetch failure in the middle of a rebuild. The stand-in test covers it.

🤖 Generated with Claude Code

---

To install:

• Linux/macOS: curl -fsSL https://raw.githubusercontent.com/fluffynuts/vibe/master/install.sh | sh
• Windows: irm https://raw.githubusercontent.com/fluffynuts/vibe/master/install.ps1 | iex
• Manual: download the zip for your platform (below), unzip it anywhere, and run
  vibe --install from the folder it makes.

To upgrade, run the same command again, or vibe --upgrade once vibe is installed.

Platform	Zip
Linux (x86-64)	vibe-linux-amd64.zip
Linux (ARM)	vibe-linux-arm64.zip
macOS (Apple Silicon)	vibe-macos-arm64.zip
macOS (Intel)	vibe-macos-amd64.zip
Windows (x86-64)	vibe-windows-amd64.zip
Windows (ARM)	vibe-windows-arm64.zip

SHA256SUMS holds each zip's checksum. The install scripts and vibe --upgrade check it.

macOS: the binary isn't signed, so if it's blocked after downloading in a browser, run
xattr -dr com.apple.quarantine <folder> once.

What's Changed

• bug: an interrupted re-composition could fail to restore memories by @fluffynuts in #19

Full Changelog: v0.1.201...v0.1.205

vibe 0.1.201

Assist the user when docker sbx auth token expires: detect need to login & guide the user there (#18)

When sbx is signed out of Docker, vibe now says so and offers to fix it, instead of waiting out a 3-minute start and reporting "didn't start within 3m0s" (and vibe -l printing sbx's raw error).

Changes

• Waking a sandbox reads sbx's output as it comes. With no terminal, sbx exec fails at once pointing to sbx login; on a terminal it starts a device-login flow and waits. Both are recognised (by the sbx login command it names and the docker.com user_code address, not by sbx's wording) and reported at once.
• Page: a start that can't happen says sbx is signed out and points to the Admin tab. A failed prompt, and the page being brought back into view, show the Conversation banner, whose button opens the Sign-in card. Any other failure to start shows sbx's own (shortened) words and where the log is.
• vibe --list / --info offer sbx login on the terminal when sbx is signed out, and run again once it is signed in.
• Waiting loops (session start, memory restore) give up at once when signed out. Failed wakes are noted in ~/.vibe/sbx-wake.log (the first and last of a run).
• Last resort: a failure nothing recognises asks sbx login (at most once in two minutes). Its message says it was used and asks for a report of what sbx said. The agent can cause it to run; that is documented.

Security

What a wake prints is the output of a command run in the sandbox, which the agent controls. So it is never shown as a sign-in link (a sandbox could start its own Docker device login), is read a line at a time and capped at 64 KB, and is shown short and without control characters.

Also fixed

sbxrun.Process: a process stopped while printing without end was never reaped, because its output pipe blocked. Output is now drained once nobody wants it.

Verified

• go test ./... passes; each new test was seen to fail first.
• By hand on a real sbx: vibe -l offered the login and completed it; a prompt while signed out gave the error and the banner; the Admin card signed in; the wake log shows the new wording.
• Two reviews on the Review tab, with their findings fixed.

Not verified

• The new tests on macOS and Windows CI (the stand-in scripts need yes, head and tr; they skip on Windows).
• The last-resort path against a real unrecognised failure.
• The banner on bringing the page back into view, on a real sbx (page tests pin it).

Host-side only: no sandbox rebuild (vibe -C) is needed.

---

To install:

• Linux/macOS: curl -fsSL https://raw.githubusercontent.com/fluffynuts/vibe/master/install.sh | sh
• Windows: irm https://raw.githubusercontent.com/fluffynuts/vibe/master/install.ps1 | iex
• Manual: download the zip for your platform (below), unzip it anywhere, and run
  vibe --install from the folder it makes.

To upgrade, run the same command again, or vibe --upgrade once vibe is installed.

Platform	Zip
Linux (x86-64)	vibe-linux-amd64.zip
Linux (ARM)	vibe-linux-arm64.zip
macOS (Apple Silicon)	vibe-macos-arm64.zip
macOS (Intel)	vibe-macos-amd64.zip
Windows (x86-64)	vibe-windows-amd64.zip
Windows (ARM)	vibe-windows-arm64.zip

SHA256SUMS holds each zip's checksum. The install scripts and vibe --upgrade check it.

macOS: the binary isn't signed, so if it's blocked after downloading in a browser, run
xattr -dr com.apple.quarantine <folder> once.

What's Changed

• Assist the user when docker sbx auth token expires: detect need to login & guide the user there by @fluffynuts in #18

Full Changelog: v0.1.198...v0.1.201

vibe 0.1.198

Fix: race in clipboard-bridge port allocations which can interrupt parallel sandbox creation (#17)

Fixes a possible race to claim a port for the clipboard bridge, when creating sandboxes in parallel

---

To install:

• Linux/macOS: curl -fsSL https://raw.githubusercontent.com/fluffynuts/vibe/master/install.sh | sh
• Windows: irm https://raw.githubusercontent.com/fluffynuts/vibe/master/install.ps1 | iex
• Manual: download the zip for your platform (below), unzip it anywhere, and run
  vibe --install from the folder it makes.

To upgrade, run the same command again, or vibe --upgrade once vibe is installed.

Platform	Zip
Linux (x86-64)	vibe-linux-amd64.zip
Linux (ARM)	vibe-linux-arm64.zip
macOS (Apple Silicon)	vibe-macos-arm64.zip
macOS (Intel)	vibe-macos-amd64.zip
Windows (x86-64)	vibe-windows-amd64.zip
Windows (ARM)	vibe-windows-arm64.zip

SHA256SUMS holds each zip's checksum. The install scripts and vibe --upgrade check it.

macOS: the binary isn't signed, so if it's blocked after downloading in a browser, run
xattr -dr com.apple.quarantine <folder> once.

What's Changed

• Fix: race in clipboard-bridge port allocations which can interrupt parallel sandbox creation by @fluffynuts in #17

Full Changelog: v0.1.195...v0.1.198

vibe 0.1.195

Dotnet feature: let code that resolves packages itself find the host's cache, and keep link-nuget's settings after sudo (#16)

A RazorLight template test failed in a sandbox with Cannot find compilation library location for package 'System.Security.Cryptography.Pkcs'. The package was in the host's cache, which the sandbox mounts read-only as NuGet's fallback folder. NuGet and MSBuild use fallback folders, but code that finds a package's assemblies itself does not. Microsoft.Extensions.DependencyModel, which RazorLight uses, only looks in the app's probing paths, then NUGET_PACKAGES, then ~/.nuget/packages. That only bites a package whose assemblies aren't copied to the output folder, such as a compile-only one.

Changes

1. link-nuget sets GenerateRuntimeConfigDevFile=true in fallback mode. The SDK then writes the fallback folder into bin/**/*.runtimeconfig.dev.json as a probing path, which DependencyModel reads. It is removed again in the shared and overlay modes, where the host cache is NUGET_PACKAGES. This keeps the fallback design. Pointing NUGET_PACKAGES at the read-only cache would break restores that need a package the host lacks, as docs/plan-nuget-feeds.md already notes.
2. link-nuget reads the variables the sandbox was made with from PID 1's environment when its own lacks them. The session-start nudge runs on-start under sudo, which drops SBX_HOST_NUGET_PACKAGES and the like. So every run after the first boot logged "nothing to do". start-clipboard already does the same for its own variable. A changed script still only reaches a sandbox by rebuilding it, so this fixes a misleading log and lets a failed first boot be put right at the next start. It does not make existing sandboxes pick up new settings without a rebuild.
3. Tests and readme. A new test builds a package-less project with the real SDK, using the variables link-nuget persists. It checks that runtimeconfig.dev.json names the fallback folder and that the app runs. A second part checks that no such file is written without the setting. It skips without dotnet. Other tests cover the PID 1 read, and the test harness now uses an empty PID 1 environment so results don't depend on the machine running them. The readme explains both changes and that each build leaves a runtimeconfig.dev.json in bin/.

Verified

• Reproduced under a real test host. A net8.0 xunit project with RazorLight and a compile-only Pkcs reference, with the host cache as a read-only fallback, failed. The same project passed with the variable set. It ran on the .NET 10 runtime with roll-forward, not a real runtime 8.
• The app runs with nonexistent probing paths. An app ran fine with two paths that don't exist added to its runtimeconfig.dev.json. That check was by hand.
• Go suite. go test ./... passes.

Not verified

• No re-composed sandbox on the final code. The agent in the yumbi sandbox confirmed the setting and the resulting file on an earlier build, before the PID 1 read was added.
• Host side of the new runtimeconfig.dev.json files. I haven't run a sandbox-written one on a real host.
• CI hasn't run.

Notes

• Existing sandboxes need a rebuild (vibe -C) once to get the setting.
• The df6100c commit message overstates the PID 1 read, saying a changed script reaches existing sandboxes without a rebuild. The readme is correct. I didn't rewrite history. Squash-merging avoids carrying the message.

🤖 Generated with Claude Code

---

To install:

• Linux/macOS: curl -fsSL https://raw.githubusercontent.com/fluffynuts/vibe/master/install.sh | sh
• Windows: irm https://raw.githubusercontent.com/fluffynuts/vibe/master/install.ps1 | iex
• Manual: download the zip for your platform (below), unzip it anywhere, and run
  vibe --install from the folder it makes.

To upgrade, run the same command again, or vibe --upgrade once vibe is installed.

Platform	Zip
Linux (x86-64)	vibe-linux-amd64.zip
Linux (ARM)	vibe-linux-arm64.zip
macOS (Apple Silicon)	vibe-macos-arm64.zip
macOS (Intel)	vibe-macos-amd64.zip
Windows (x86-64)	vibe-windows-amd64.zip
Windows (ARM)	vibe-windows-arm64.zip

SHA256SUMS holds each zip's checksum. The install scripts and vibe --upgrade check it.

macOS: the binary isn't signed, so if it's blocked after downloading in a browser, run
xattr -dr com.apple.quarantine <folder> once.

What's Changed

• Dotnet feature: let code that resolves packages itself find the host's cache, and keep link-nuget's settings after sudo by @fluffynuts in #16

Full Changelog: v0.1.190...v0.1.195

vibe 0.1.190

PNPM feature (#15)

• ✨ a pnpm library feature that runs the pnpm the project's packageManager names, fetched when pnpm is first run (so a changed pin is followed without a rebuild); the prerequisites feature makes sure file is there

---

To install:

• Linux/macOS: curl -fsSL https://raw.githubusercontent.com/fluffynuts/vibe/master/install.sh | sh
• Windows: irm https://raw.githubusercontent.com/fluffynuts/vibe/master/install.ps1 | iex
• Manual: download the zip for your platform (below), unzip it anywhere, and run
  vibe --install from the folder it makes.

To upgrade, run the same command again, or vibe --upgrade once vibe is installed.

Platform	Zip
Linux (x86-64)	vibe-linux-amd64.zip
Linux (ARM)	vibe-linux-arm64.zip
macOS (Apple Silicon)	vibe-macos-arm64.zip
macOS (Intel)	vibe-macos-amd64.zip
Windows (x86-64)	vibe-windows-amd64.zip
Windows (ARM)	vibe-windows-arm64.zip

SHA256SUMS holds each zip's checksum. The install scripts and vibe --upgrade check it.

macOS: the binary isn't signed, so if it's blocked after downloading in a browser, run
xattr -dr com.apple.quarantine <folder> once.

What's Changed

• PNPM feature by @fluffynuts in #15

Full Changelog: v0.1.187...v0.1.190

vibe 0.1.187

Display busy status on admin cards whilst they're loading (#13)

• ✨ the Admin tab's cards show a spinner, with their controls inert, until the first answer for what they show arrives; a card whose request fails says so and offers "Try again"
• ⬆️ the page's real-browser tests run on Playwright 1.64.1 (Firefox 1555, the one the playwright feature installs), and Dependabot proposes each newer Playwright weekly so a new Firefox is met in a PR
• 📝 vibe-review's instructions say to refer to another comment by the number the tab shows (#9), which the page links, and not by the order it was written in

---

To install:

• Linux/macOS: curl -fsSL https://raw.githubusercontent.com/fluffynuts/vibe/master/install.sh | sh
• Windows: irm https://raw.githubusercontent.com/fluffynuts/vibe/master/install.ps1 | iex
• Manual: download the zip for your platform (below), unzip it anywhere, and run
  vibe --install from the folder it makes.

To upgrade, run the same command again, or vibe --upgrade once vibe is installed.

Platform	Zip
Linux (x86-64)	vibe-linux-amd64.zip
Linux (ARM)	vibe-linux-arm64.zip
macOS (Apple Silicon)	vibe-macos-arm64.zip
macOS (Intel)	vibe-macos-amd64.zip
Windows (x86-64)	vibe-windows-amd64.zip
Windows (ARM)	vibe-windows-arm64.zip

SHA256SUMS holds each zip's checksum. The install scripts and vibe --upgrade check it.

macOS: the binary isn't signed, so if it's blocked after downloading in a browser, run
xattr -dr com.apple.quarantine <folder> once.

What's Changed

• Display busy status on admin cards whilst they're loading by @fluffynuts in #13

Full Changelog: v0.1.185...v0.1.187

vibe 0.1.185

Fixes for sbx 0.51 upgrade (#12)

Why: 0c17839 got vibe starting again on sbx 0.51. This takes the rest: features that only worked on the old Ubuntu image, a race in the generated on-start, and a few UI bugs found while testing.

Features on the Debian image

• MySQL: the old feature installed mysql-server, which Debian doesn't have, so it never worked, and start-mysql used --daemonize, which MariaDB's mysqld doesn't take. There are now two features:
  • mysql-8.4: Oracle's own 8.4.13 from its generic tarball (x86_64 minimal, aarch64 full). Both builds have a pinned SHA-256 that I checked against Oracle's published MD5. It installs the libraries the tarball needs, and runs with --no-defaults. Starts take a lock and refuse a data folder they can't read, so they can't clear existing data. The version is in the feature name so later series can sit beside it.
  • mariadb: Debian's server, the previous feature renamed honestly. Breaking: a profile that lists plain mysql must now pick one of these.
• Playwright installs Node and npm itself and no longer allows Ubuntu's apt hosts. Elasticsearch, PowerShell and the dotnet runtime step now check for the tools they use (curl, gnupg, certificates, tar, gzip) and install any that are missing.
• New base feature prerequisites: one apt run, or none, for curl, certificates, gpg, tar, gzip, xz, flock and Node. Node moves here from the clipboard feature, since vibe-review needs it too.
• tools/check-apt-packages.sh (run in a sandbox) lists the apt packages the library asks for that the image doesn't have. It would have caught mysql-server.

on-start

• The boot-time run and vibe's session-start nudge can overlap. The generated script now takes a lock (flock -o, so daemons it starts don't hold it), waits at most 90 seconds, then gives up cleanly. It runs unlocked if flock is missing.
• Its log now says how long each start script and the whole run took.

UI and restart

• Network tab: sbx 0.51 lists a built-in default-deny-all rule that matches every host, so no allow ever showed as "Unblocked". It's now recognised by its shape (a non-editable local deny of **), with its reason text as a backup.
• Review comments pane: a card's state pill is on its own line above the path. The comments button turns amber while any thread awaits your answer.
• Restart: a sandbox the page wakes after sbx idled it now runs its start-up again, so the clipboard address is rewritten for the new boot.

Testing

• Automated: go test ./..., go vet for Linux, Windows and macOS, and the formatting check all pass. Each fix has a test that fails without it, and the new tests were run repeatedly with no flakes.
• In a real sandbox built from these commits: Elasticsearch, MySQL 8.4.13, Redis, RabbitMQ, PowerShell, Playwright's launch check and a dotnet build. Two real overlapping on-start runs queued as intended.
• Not verified:
  • The macOS and Windows CI jobs.
  • The new real-Firefox test in CI. It ran locally through a throwaway runner but skips in this sandbox.
  • The aarch64 MySQL build, which is checksum-checked only.
  • The restart fix against a real idle-stop, which has unit tests only.
  • A TempDbMySql project against the 8.4 mysqld.

---

To install:

• Linux/macOS: curl -fsSL https://raw.githubusercontent.com/fluffynuts/vibe/master/install.sh | sh
• Windows: irm https://raw.githubusercontent.com/fluffynuts/vibe/master/install.ps1 | iex
• Manual: download the zip for your platform (below), unzip it anywhere, and run
  vibe --install from the folder it makes.

To upgrade, run the same command again, or vibe --upgrade once vibe is installed.

Platform	Zip
Linux (x86-64)	vibe-linux-amd64.zip
Linux (ARM)	vibe-linux-arm64.zip
macOS (Apple Silicon)	vibe-macos-arm64.zip
macOS (Intel)	vibe-macos-amd64.zip
Windows (x86-64)	vibe-windows-amd64.zip
Windows (ARM)	vibe-windows-arm64.zip

SHA256SUMS holds each zip's checksum. The install scripts and vibe --upgrade check it.

macOS: the binary isn't signed, so if it's blocked after downloading in a browser, run
xattr -dr com.apple.quarantine <folder> once.

What's Changed

• Fixes for sbx 0.51 upgrade by @fluffynuts in #12

Full Changelog: v0.1.182...v0.1.185

vibe 0.1.182

🚑 fixes for upstream docker sbx changes breaking vibe

SBX updated upstream, and the new flow uses kits for agent installations
so users (including myself) were basically locked out of being able to
use vibe - the claude kit comes down as a v3 schema, and refuses to play
alongside the v1/2 schemas that vibe created. 5 hours later, vibe is
updated to handle the changes, including:

1. installing node as part of the clipboard server base feature
2. adding a go feature
3. migrating vibe-generated kits to v3

if you've been affected, vibe --upgrade, and selecting updates for
both vibe and sbx are highly recommended.

---

To install:

• Linux/macOS: curl -fsSL https://raw.githubusercontent.com/fluffynuts/vibe/master/install.sh | sh
• Windows: irm https://raw.githubusercontent.com/fluffynuts/vibe/master/install.ps1 | iex
• Manual: download the zip for your platform (below), unzip it anywhere, and run
  vibe --install from the folder it makes.

To upgrade, run the same command again, or vibe --upgrade once vibe is installed.

Platform	Zip
Linux (x86-64)	vibe-linux-amd64.zip
Linux (ARM)	vibe-linux-arm64.zip
macOS (Apple Silicon)	vibe-macos-arm64.zip
macOS (Intel)	vibe-macos-amd64.zip
Windows (x86-64)	vibe-windows-amd64.zip
Windows (ARM)	vibe-windows-arm64.zip

SHA256SUMS holds each zip's checksum. The install scripts and vibe --upgrade check it.

macOS: the binary isn't signed, so if it's blocked after downloading in a browser, run
xattr -dr com.apple.quarantine <folder> once.

Full Changelog: v0.1.181...v0.1.182