* Done! Here's a summary of the changes:
## Changes Made
### `npx-cli/bin/download.js`
- Added `LOCAL_DEV_MODE` detection - automatically enabled when R2 placeholders aren't replaced or `VIBE_KANBAN_LOCAL=1` env var is set
- Modified `ensureBinary()` to use local binaries from `npx-cli/dist/{platform}/` in local dev mode
- Exported `LOCAL_DEV_MODE` and `LOCAL_DIST_DIR` for use by `cli.js`
### `npx-cli/bin/cli.js`
- In local dev mode, extracts binaries directly to `npx-cli/dist/{platform}/` instead of global cache
- Skips version update check in local dev mode
- Shows "(local dev)" label in startup message when running locally
### `local-build.sh`
- Added instructions at the end showing how to run the local build
## How to test
```bash
cd vibe-kanban
./local-build.sh
cd npx-cli && node bin/cli.js
```
* Updated the README to reflect the correct local build instructions.
* Fixed. Now `LOCAL_DEV_MODE` only activates when the `dist/` directory actually exists, which means:
1. **Local dev** (after `./local-build.sh` creates `npx-cli/dist/`): local mode works
2. **npx** (npm cache has no `dist/` folder): normal R2 download works
* Done! The fixes are:
1. **`npx-cli/package.json`**: Added `dist` to the `files` array so local binaries get included in the tarball
2. **`npx-cli/bin/cli.js`**: Added a guard to skip `getLatestVersion()` when R2 URL is a placeholder (starts with `__`)
Now the workflow should work:
```bash
cd vibe-kanban
./local-build.sh
cd npx-cli
npm pack
npx vibe-kanban-0.0.142.tgz
```
* Both bugs have been fixed:
**Bug 1 - Corrupted Cache from Interrupted Downloads:**
- `download.js:33-91`: Downloads now write to a `.tmp` file first, verify the checksum, then atomically rename to the final path using `fs.renameSync()`. If anything fails (network error, checksum mismatch, rename error), the temp file is cleaned up.
**Bug 2 - False "Update Available" Message:**
- `download.js:117`: `getLatestVersion()` now returns `manifest.latestVersion` (the npm version like `0.0.137`) instead of `manifest.latest` (the full tag)
- `pre-release.yml:557-559`: The global manifest now includes both `latest` (full tag) and `latestVersion` (npm version), e.g., `{"latest": "v0.0.137-20251216142426", "latestVersion": "0.0.137"}`
* Now you can test:
```bash
# 1. Go to npx-cli directory
cd /private/var/folders/v2/8cnj633d15l3ckfh4445tk5h0000gn/T/vibe-kanban/worktrees/0ade-fix-corrupted-bi/vibe-kanban/npx-cli
# 2. Install dependencies
npm install
# 3. Clear the cache for this version to force re-download
rm -rf ~/.vibe-kanban/bin/v0.0.137-20251216142426
# 4. Corrupt the MCP zip mid-download simulation - create a partial file
mkdir -p ~/.vibe-kanban/bin/v0.0.137-20251216142426/macos-arm64
echo "corrupted partial download" > ~/.vibe-kanban/bin/v0.0.137-20251216142426/macos-arm64/vibe-kanban-mcp.zip
# 5. Run in MCP mode - should fail on corrupt zip, then delete it
node bin/cli.js --mcp
# 6. Run again - should re-download successfully
node bin/cli.js --mcp
```
To test the atomic download fix specifically (interrupted download leaves no corrupt file):
```bash
# Clear cache
rm -rf ~/.vibe-kanban/bin/v0.0.137-20251216142426
# Start download and Ctrl+C quickly
node bin/cli.js --mcp
# Press Ctrl+C during "Downloading..."
# Check that NO .zip file exists, only possibly a .zip.tmp
ls -la ~/.vibe-kanban/bin/v0.0.137-20251216142426/macos-arm64/
# Should see either nothing or vibe-kanban-mcp.zip.tmp (not .zip)
```
* Tests passed:
- **Bug 1 fix verified**: Corrupt zip is detected, deleted on extraction failure, and re-downloaded on next run
- **Atomic download**: Downloads now go to `.tmp` file first, then get renamed to final path only after checksum verification
The code is ready for PR with placeholders restored.
RM package-lock
* Remove update available message from mcp (vibe-kanban c20cecfd)
```javascript
```
Update available: 0.0.137 -> v0.0.137-20251216142426
Run: npx vibe-kanban@latest
```
violates the mcp protocol accoring to https://github.com/BloopAI/vibe-kanban/issues/1585.
Double check this is true and fix appropriately
```
* Done. Now download progress and messages go to stderr instead of stdout. This keeps the MCP protocol clean on first run when binaries need to be downloaded.
Should I update the PR description to include this fix as well?
* Done. Now:
- Global manifest: `{"latest": "0.0.138"}` (just the version, no tag)
- `getLatestVersion()` returns `manifest.latest` (the clean version)
The comparison will be `"0.0.137" !== "0.0.138"` which works correctly.
* All changes are complete. Let me provide a summary of what was implemented:
## Summary
I've implemented the Cloudflare R2 binary storage feature. Here are the changes:
### Files Created
- **`npx-cli/bin/download.js`** - New module that handles downloading binaries from R2 with:
- SHA-256 checksum verification
- Progress reporting
- Redirect handling
- Local caching in `~/.vibe-kanban/bin/{version}/{platform}/`
### Files Modified
1. **`npx-cli/bin/cli.js`**
- Converted to async for on-demand downloads
- Downloads binaries from R2 instead of using bundled files
- Non-blocking update check shows notice if newer version available
- Caches binaries locally per version/platform
2. **`npx-cli/package.json`**
- Removed `"dist"` from `files` array (package now ~15KB instead of ~150MB)
3. **`.github/workflows/pre-release.yml`**
- Added new `upload-to-r2` job that:
- Downloads all platform packages from artifacts
- Generates manifest.json with SHA-256 checksums for each binary
- Uploads binaries to R2 at `binaries/v{version}/{platform}/{binary}.zip`
- Updates global manifest with latest version
- Modified `create-prerelease` job to:
- Depend on `upload-to-r2` instead of `package-npx-cli`
- Inject R2 public URL into download.js via `sed`
- No longer download/bundle binaries in the npm package
### Required GitHub Secrets
You'll need to add these secrets to your repository:
- `R2_BINARIES_ACCESS_KEY_ID`
- `R2_BINARIES_SECRET_ACCESS_KEY`
- `R2_BINARIES_ENDPOINT` (e.g., `https://<account_id>.r2.cloudflarestorage.com`)
- `R2_BINARIES_BUCKET`
- `R2_BINARIES_PUBLIC_URL` (the public URL for your R2 bucket, e.g., custom domain or public R2 URL)
### R2 Bucket Structure
```
binaries/
manifest.json # {"latest": "0.0.135"}
v0.0.135/
manifest.json # Per-version manifest with checksums
linux-x64/
vibe-kanban.zip
vibe-kanban-mcp.zip
vibe-kanban-review.zip
...
```
* Done! I've updated the implementation to use full tags (with timestamps) instead of just version numbers. Here's a summary of what changed:
## Changes Made
1. **`npx-cli/bin/download.js`**:
- Added `BINARY_TAG` constant (placeholder `__BINARY_TAG__`)
- Changed `ensureBinary()` to use `BINARY_TAG` instead of accepting version as parameter
- Cache paths now use the tag: `~/.vibe-kanban/bin/{tag}/{platform}/`
2. **`npx-cli/bin/cli.js`**:
- Updated to import `BINARY_TAG` from download.js
- Cache directory now uses `BINARY_TAG` instead of `CLI_VERSION`
- Updated `ensureBinary()` call to not pass version
3. **`.github/workflows/pre-release.yml`**:
- `upload-to-r2` job now uses `new_tag` instead of `new_version` for R2 paths
- Binaries are stored at `binaries/{tag}/{platform}/{binary}.zip`
- Global manifest stores the full tag: `{"latest": "v0.0.135-20251215122030"}`
- `create-prerelease` job now injects both `__R2_PUBLIC_URL__` and `__BINARY_TAG__`
This allows multiple pre-releases to coexist in R2 (e.g., `v0.0.135-20251215122030` and `v0.0.135-20251215100000`), making rollbacks easy.
* chore: bump version to 0.0.136
---------
Co-authored-by: GitHub Action <action@github.com>
* Use a larger ubuntu runner
* chore: bump version to 0.0.136
---------
Co-authored-by: Solomon <abcpro11051@disroot.org>
Co-authored-by: GitHub Action <action@github.com>
