GitHub Docs

Changelog

All notable changes to VibeCody are documented here. This project follows Semantic Versioning.

[Unreleased]

[0.5.7]

Release-engineering patch — restores the artifacts that didn’t build for v0.5.6.

Fixed

  • CycloneDX SBOM job (a6d670bf) — cyclonedx-py requirements accepts the requirements path positionally, not as -i FILE; the bad flag caused the tool to fall back to looking for ./requirements.txt and emit CRITICAL | CDX > Could not open requirements file. Drop the -i so vibe-rl-py.cdx.json is produced. Closes #28.
  • Mobile · iOS build (b8d95e0f) — vibemobile/ios/Runner/AppDelegate.swift referenced FlutterImplicitEngineDelegate and FlutterImplicitEngineBridge, both of which were introduced in Flutter 3.38 for the UIScene rework; the CI Flutter SDK is pinned to 3.29.3, so the swift-frontend reported Cannot find type 'FlutterImplicitEngineBridge' in scope. Rewrite to the Flutter 3.29-compatible GeneratedPluginRegistrant.register(with: self) pattern and register the relay-credentials method channel synchronously in didFinishLaunchingWithOptions. Closes #29.
  • Watch · watchOS build (014f5cce) — GoalsView.swift, JobPickerView.swift, RecapView.swift, and TaintedConfirmationView.swift were on disk and referenced by ContentView.swift / SessionPickerView.swift but never added to VibeCodyWatch.xcodeproj’s PBXSourcesBuildPhase. The Swift compiler reported four cannot find … in scope errors and the watchOS simulator app build exited 65. Register each as a PBXFileReference + PBXBuildFile, add to the group and sources phase (plutil -lint passes). Closes #30.
  • Watch · Wear OS build (6193920a) — JobRecapTileService.kt and GoalsTileService.kt import androidx.concurrent.futures.CallbackToFutureAdapter and com.google.common.util.concurrent.{Futures, ListenableFuture}, and RecapScreen.kt uses androidx.compose.ui.tooling.preview.Preview; none were declared as dependencies, so :app:compileReleaseKotlin failed. Add guava (33.4.0-android), androidx-concurrent-futures (1.2.0), and androidx-compose-ui-tooling-preview (1.7.6) to libs.versions.toml and implementation them in app/build.gradle.kts. Closes #31.
  • Docker image build (99d8adfe + f922536b) — the Dockerfile’s two-phase cargo cache (copy manifests → stub sources → prebuild deps → copy real sources) had drifted from [workspace] members. Seven members added since March (vibecli/crates/vibe-sandbox{,-native,-firecracker,-hyperlight}, vibecli/crates/vibe-broker, vibeui/crates/vibe-infer, vibe-memory) had no manifest COPY, so cargo refused to resolve the workspace. After the manifest sync, the real cargo build then failed because vibe-memory/src/ was never copied over the empty stub, leaving vibecli unable to find MemoryContextHub, ProjectMemStore, GlobalMemStore, MemoryMeta. Add the missing manifests + stubs + real-source COPY. Closes #32.

Docs

  • docs/release.md, docs/vibemobile.md, docs/watchos.md, docs/wearos.md (41f189eb) — fix the download links to match the actual Tauri/Flutter output filenames: Vibe.App_* (not VibeCLI_*), VibeCody-Mobile-vX.Y.Z-{ios,android}.*, VibeCody-WatchOS-vX.Y.Z.app.zip, VibeCody-Wear-vX.Y.Z.*. Surface the new aarch64.AppImage and arm64.deb artifacts that landed in v0.5.6.

[0.5.6]

Added

  • B2.9.daemon — Plugin hooks fire on the daemon agent path too (41c6382e) — Closes the parallel gap to B2.9 on the daemon side: every AgentLoop::new in serve.rs (/v1/agent start, ACP submit-task, timed-task path) now calls plugin_runtime::merge_with_plugin_hooks(workspace, vec![]) and attaches the resulting HookRunner before agent.run. Plugin hooks were previously silently bypassed on the most-used path (mobile, watch, VibeUI, VS Code, JetBrains all go through /v1/agent); admin policy now reaches them. User hooks remain CLI-only by design — turning on user-hook dispatch from remote clients is a separate decision.
  • B2.9 + B2.10 — Plugin hooks and rules now actually run — Two follow-up slices that close the original B2 deferrals. plugin_runtime::merge_with_plugin_hooks(workspace, user_hooks) (543255f4) opens the WorkspaceStore, fetches policy-active plugin hooks, converts each HookComponent into a vibe_ai::HookConfig with a Command handler that runs the absolute path under the plugin install dir, and appends them after the user’s hooks — first BLOCK still wins so user veto outranks plugin policy on the same event. Wired at both CLI HookRunner::new sites (run_parallel_agents orchestrator + run_agent_repl_with_context REPL). Best-effort with warn! on any store/loader failure so admin policy can extend the CLI agent path but never break it. context_assembler::collect_plugin_rules (403a53cd) does the parallel job for Markdown rules: every On / Required plugin’s rule files render under “### {plugin}/{rule}” inside a new plugin_rules ContextSection at priority 1, joining the same system-prompt lane the CLAUDE.md / VIBECLI.md / AGENTS.md project memory feeds. Both chat and agent collectors consult it, so plugin rules influence REPL chat and every agent-task path. KNOWN_SECTION_NAMES grows the new entry so /v1/capabilities advertises the shape correctly. Daemon-side AgentLoop sites in serve.rs intentionally not wired in this slice — those have never run user hooks either, and turning on hook dispatch there is a separate decision that affects user-configured hooks too.
  • VS Code Agent Hooks — protocol parity with CLI + JetBrains — vscode-extension/src/hook-executor.ts implements the same seven-event hook contract as vibecli-cli/src/hook_abort.rs and the JetBrains HookExecutor: sh -c <command> (or cmd /c on Windows), exit-code semantics (0 = allow, 2 = block, other = generic-error / non-blocking), structured-JSON-decision stdout override, 30 s per-hook timeout (timeout → BLOCK), spawn-failure ALLOW + warning, and ordered-chain short-circuit on first BLOCK. UserPromptSubmit is gated at every prompt entry point — vibecli.startAgent, vibecli.chat, vibecli.inlineEdit, vibecli.sendSelection, and the sidebar chat webview — each carrying an event-source discriminator ("source": "agent" | "chat" | "inline-edit" | "send-selection" | "chat-webview") so policies can vary by entry point. vibecli.hooks joins the configuration schema as an array<{name, event, command, enabled}> with the seven-kind event enum, surfaced inline by the VS Code Settings UI (aeae6c83).
  • JetBrains Agent Hooks — meaningful gate coverage (P3.10) — Four-commit slice (7709bc0b → 080bf920) brings the JetBrains plugin to hook-protocol parity with CLI/Tauri. HookExecutor service mirrors vibecli-cli/src/hook_abort.rs: subprocess invocation via sh -c <command>, exit-code semantics (0 = allow, 2 = block, other = generic error / non-blocking), structured-JSON-decision stdout override ({action, reason?, message?}), 30 s per-hook timeout (timeout → BLOCK), spawn-failure ALLOW + warning (matches CLI), and ordered-chain short-circuit on first BLOCK. HookConfig { name, event, command, enabled } persists via the existing PersistentStateComponent infra. Settings UI under IDE Settings → Tools → VibeCLI grows a hooks table with Add / Remove via ToolbarDecorator — Event column constrained to the seven allow-listed kinds matching plugin_manifest::ALLOWED_HOOK_EVENTS. Both user-driven prompt-submission paths now run through the chain: AgentPanel.startAgent and InlineEditAction.actionPerformed fire UserPromptSubmit before any prompt reaches the daemon. Payload carries an event-source discriminator ("source": "inline-edit") so policies can vary by entry point. 14 JUnit cases cover decision semantics, structured-JSON override, chain short-circuit (sentinel-file proof), payload-on-stdin (capture via cat), and the event-kind allow-list as a drift guard. Advisory firings for SSE-arriving PreToolUse / PostToolUse / Stop deferred until a concrete audit-trail use case emerges (the daemon has already run its own pre/post chain by the time those events surface on the plugin side, so firing again would double-fire).
  • A1 — MCP Apps generic React embedding host (SEP-1865) — McpAppEmbed.tsx renders fenced mcp.app blocks inline in chat as a typed React card: title + component+version chip + collapsible Props (JSON) + CSP declarations (informational) + action buttons. Components are an allow-list (react@18, react@19, json-view, list, card); unknown component refs render a clear “unsupported” warning with props still inspectable — the host never executes arbitrary JSX. Action clicks dispatch vibeui:mcp-app-action window events for the chat layer to consume. New mcp_apps_parse Tauri command bridges the daemon-side parser (mcp_apps_payload.rs, shipped earlier as 647b58de) to the webview as defence in depth. Fence regex in AIChat.tsx relaxed from \w* to [\w.+/@-]* so the full MIME-like tag application/vnd.mcp.app+json matches without truncation. Malformed payloads fall back to a plain CodeBlock so the raw bytes stay visible (39e95b17). Closes the last open Phase 53 P0 item — all of A1–A11 now shipped.
  • B2.8 + B2.12 — Plugin governance follow-ups — ConfigPortability::register_plugin_servers registers MCP-server components from policy-active plugins under namespaced ids plugin:<plugin>:<component>, disjoint from the flat user-configured id space (16da6354). plugin_install::install_from_url adds HTTPS-only URL fetch (60 s timeout, 50 MB cap, scheme guard) so vibecli plugin install <https://…> works alongside the local-file path; new plugin_install_from_url Tauri command and a Local file | HTTPS URL toggle in the governance panel (b7e7f988).
  • B2 — Plugin bundle format with admin install policies — Phase 54 P0 shipped end-to-end across 7 slices. Inner vibecli-plugin.toml manifest schema + validator (B2.1, cea41606); detached per-publisher P-256 ECDSA signing via sibling vibecli-plugin.sig (B2.2, 6275cf06); WorkspaceStore plugin_policies table with Off / On / Required tiers and an admin-only Required-pin guard (B2.3, eb7dcbfe); atomic install (stage → swap with RAII cleanup) preserving Required pins across force re-install (B2.4, 2d52bb4e); runtime view plugin_runtime::enabled_* returning only components from plugins with policy ≠ Off (B2.5, 82d4a00b); PluginGovernancePanel.tsx + 5 Tauri commands (plugin_install_from_file, plugin_list_installed, plugin_uninstall, plugin_get_policy, plugin_set_policy), all sensitive-path-gated (B2.6, fb9b80b6); first per-loader activation — MCP list_skills / get_skill now serve built-in + enabled-plugin skills tagged with {"kind": "builtin" \| "plugin", "plugin": "<name>"} provenance (B2.7, 9c0ac982 + 32793d4d). All four patent-distance §18 principles anchored: no telemetry-driven personalization (#1), client-side admin-authored policy (#2), open MCPB lineage (#3, reuses mcpb_bundle.rs from A2), per-publisher P-256 trust roots (#4, reuses signed_agent_card.rs JWK from B6). See §23 in FEATURE-REFERENCE.
  • /goal — durable execution intent — A new cross-session primitive: each goal is a persistent record of intent (title + statement + success criteria + status: Active / Paused / Done / Abandoned) that decomposes into an ExecutionPlan on demand and gathers a link graph of contributing sessions / jobs / recaps. Shipped end-to-end across 7 slices: types + schema in ~/.vibecli/sessions.db (G1.1), daemon /v1/goals CRUD + plan/link/start routes (G1.2 / G1.3), REPL /goal new|list|show|status|link|start|delete (G1.4), VibeUI Goals panel with slash-palette opener (G1.5), curated /watch/goals for mobile + Apple Watch + Wear OS (G1.6), and VS Code + Agent SDK + design docs (G1.7). See docs/design/goal/README.md. Tauri commands use the exec_goal_* prefix to avoid conflict with the existing CompanyGoalsPanel surface.
  • /goal — hardening round (G4) — GET /v1/goals/:id/tree?depth=N recursive subtree walk (depth clamped 1..10, default 3, cycle-safe, truncation flag) and GET/PUT/DELETE /v1/goals/current for per-workspace “current pin” with pinned_goals cascading on goal delete. CLI gains /goal pin|unpin|current subcommands; aggregate /v1/goals/:id/recap honors { provider, model } for LLM synthesis with heuristic fallback (response carries recap_synthesizer). Apple Watch routes its “Start session” through the new curated /watch/goals/:id/start wrapper, and the VS Code extension grows a vibecli.goalsView tree-view in the sidebar with refresh + per-row context-menu actions.
  • /goal — fan-out round (G5) — Wear OS GoalDetailScreen gains a “Start session” chip backed by WearNetworkManager.startGoal() (curated /watch/goals/:id/start). /agent auto-links new sessions to the pinned goal for the daemon’s workspace (or the global slot) — silent best-effort, never blocks session creation. The TypeScript Agent SDK goals.* namespace adds tree(id, depth?), pin(id, ws?), unpin(ws?), current(ws?), and recap(id, { provider, model }); the Flutter ApiClient gains parallel getGoalTree, getCurrentGoal, pinGoal, unpinGoal. The VibeUI GoalPanel adds a tree-view toggle (indents children under parents) and an “Aggregate recap” section that routes through selectedProvider + selectedModel from the toolbar (heuristic fallback when either is empty).
  • /goal — pin UX round (G6) — Pin/unpin chips in VibeUI GoalPanel and the mobile detail sheet, with a ★ marker on whichever goal is pinned in the list. The agent stream emits a system event (AgentEventPayload::system) on every auto-link so SDK / VibeUI / CLI consumers see “Auto-linked to pinned goal {id_prefix}: {title}” before the model’s first token. auto_link_to_pinned_goal now returns the linked (goal_id, title) so callers can wire attribution UI. End-to-end tests confirm the helper inserts a goal_links row through the real SessionStore::open_default() path (HOME-redirect pattern from G4.1).
  • /goal — goal-aware agent context (G7) — When /agent auto-links a session to a pinned goal, the daemon now synthesizes a model-readable preamble from the goal’s title, statement, success criteria, and current_plan and injects it into AgentContext.approved_plan (only when that field is empty — the Phase 7 S3 context_request path is untouched). auto_link_to_pinned_goal returns the full Goal struct rather than just (id, title) so callers don’t re-fetch. Result: agents now run goal-aware, not just goal-attributed. 5 unit tests cover preamble shape (bare title, statement, criteria, plan steps, empty-plan edge).
  • /goal — client surfacing round (G8) — VS Code extension renders the daemon’s system auto-link event with a distinct [goal] prefix in the agent output channel (0b64f6b4); the SDK AgentEventType is extended so programmatic consumers also see the new kind. Flutter mobile gains a “+ New Goal” flow — AppBar + action + empty-state button → modal with machine picker (only shown when ≥2 paired), 120-char title field, optional statement, and a 409-aware “already exists” snackbar (d2e1b236). VibeUI main chat intentionally not touched — it runs the agent in-process via Tauri commands instead of consuming the daemon’s SSE stream, so the system event has no rendering surface there without a larger refactor.
  • /goal — “Working toward” banner (G9) — Pinned goal now surfaces above the VibeUI chat tabs as a compact banner (PinnedGoalBanner.tsx), making the auto-link target visible from the surface users spend the most time on. Polls exec_goal_current every 15 s for external pin changes (CLI / mobile) and also listens for vibeui:pin-changed window events so a pin/unpin from the Goals panel updates the banner instantly. Click the ✕ to unpin. Zero chrome when nothing is pinned (43e7f697).
  • /goal — search + tag chips (G10) — GET /v1/goals accepts ?q=<text> for case-insensitive substring search across title + statement, AND-ed with the existing status / workspace / tag / limit filters. VibeUI GoalPanel gains a 200 ms-debounced search input in the left header. Tags (schema since G1.1, previously read-only) are now inline-editable in the detail-header chip list — × per chip to remove, in-line input to add (Enter or blur to submit), both routing through exec_goal_update. 2 new daemon tests cover the q-filter; frontend npx tsc --noEmit clean (b755926b).
  • /goal — TUI tree + Watch ★ marker (G11) — TUI Goals screen gains a t key that toggles between flat list and tree layout: children indent under parents via a client-side BFS over parent_goal_id, mirroring VibeUI’s tree mode. Title-bar advertises the new key and current view mode. The curated /watch/goals payload gains a pinned: bool field (one global-pin lookup plus one workspace-pin lookup per distinct workspace in the list — bounded at the 25-row Watch cap); Apple Watch + Wear OS goal rows render a ★ on whichever goal matches. Older daemons that lack the field decode cleanly (pinned: Bool? on Swift, optBoolean(..., false) on Kotlin). 3 new TUI tests cover tree ordering, orphan-as-root, and view-mode toggle.
  • /goal — Watch ★ everywhere (G12) — Curated /watch/goals/:id envelope gains an envelope-level pinned: bool (workspace-specific OR global slot, computed by the same logic the list uses) so the watch detail screen can render the ★ without a second /v1/goals/current round-trip — the watch never hits /v1/* directly. Apple Watch GoalDetailView and Wear OS GoalDetailScreen show the ★ on the title; Wear OS GoalsTileService now prefers the pinned goal over the freshest-updated row (“what am I working on” beats “what did I touch last”) and prefixes the tile body with ★ when pinned.
  • /goal — VS Code ★ pin parity (G13) — VS Code goals tree closes the cross-surface ★ loop on the editor side: GoalTreeItem prefixes the title with ★ for pinned rows and pinned roots sort above the rest so “what am I working on now” lands at the top of the sidebar. New VibeCLIClient.getPinnedGoalIds(workspace?) unions the daemon’s global pin with the workspace pin (union of two /v1/goals/current calls) so a goal pinned from any surface — mobile, watch, VibeUI, CLI — surfaces in the editor.
  • /goal — TUI ★ pin parity (G13 cont.) — TUI Goals screen catches up to the rest: every row whose id appears in pinned_goals (any workspace, including the global slot) renders with a yellow bold ★ in front of the title — same glyph the other surfaces use. New p key toggles the pin on the selected row, advertised in the screen’s title bar alongside f, t, r. Unpin walks every workspace slot pointing at the goal (covers the rare both-workspace-and-global case); pin writes to the goal’s own workspace (or globally if the goal is workspace-less), mirroring how the watch / mobile pin flows scope their writes. SessionStore gains two helpers: list_all_pinned_goal_ids() (one SELECT DISTINCT per refresh) and list_pin_workspaces_for_goal(id) (used by the unpin-everywhere walk).
  • TurboQuant-compressed OpenMemory index — CompressedMemoryIndex replaces the legacy f32 HNSW with a ~3 bits/dim PolarQuant + QJL backing store (≥ 8× smaller on disk, same insert/query API). Ships behind no feature flag — every memory write benefits.
  • /memory/stats exposes index telemetry — response now includes embedding_dim, embedding_compression_ratio, and embedding_backend (always "turboquant" today; treat as opaque). Surfaced in the VibeUI OpenMemory panel, the openmemory_index_stats Tauri command, and the MCP memory_stats tool.
  • vibe-infer crate — pure-Rust local inference traits (Embedder, TextGenerator) with a stub backend by default and an opt-in candle feature that loads sentence-transformers/all-MiniLM-L6-v2 (384-dim, mean-pooled + L2-normalized) via candle 0.10 + hf-hub. candle-metal adds Apple GPU acceleration. Default workspace builds pull no ML deps.
  • Linux arm64 Tauri builds — VibeUI and VibeCLI App now ship .deb / .AppImage for aarch64 Linux via the GitHub-hosted ubuntu-22.04-arm runner (free for public repos). Matrix coverage now matches VibeCLI (which already had Linux arm64 via cross).
  • Ubuntu 24.04 forward-compat smoke job — new smoke-linux-next CI job runs cargo check --release on vibeui/src-tauri and vibeapp/src-tauri against webkit2gtk-4.1 on Ubuntu 24.04. continue-on-error: true and excluded from release.needs[], so distro-drift regressions surface early but never block a tag. Foundation for the Ubuntu 26.04 LTS roll-forward (2026-04-23).

Changed

  • Explicit macOS 12.0 floor — both vibeui/src-tauri/tauri.conf.json and vibeapp/src-tauri/tauri.conf.json now set bundle.macOS.minimumSystemVersion = "12.0" (was the Tauri 2 default of 10.13). Matches Apple’s current supported-OS cutoff.

Security

  • Bump rand 0.8 → 0.9 across vibecli/vibecli-cli, vibeui/src-tauri, vibeui/crates/vibe-core, and vibeui/crates/vibe-collab to pick up GHSA-cq8v-f236-94qc (low severity; unsound interaction between rand::rng() and custom log implementations invoking RNG during reseed). Call sites updated to the 0.9 API (thread_rng → rng, .gen::<T>() → .random::<T>(), .gen_range(…) → .random_range(…)). p256 0.13 SigningKey::random call-sites now use p256::elliptic_curve::rand_core::OsRng to pin the rand_core 0.6 RNG the crate’s signature bound requires.

Added (inference)

  • Mistral.rs backend in vibe-infer (Phase 1 of the Rust-inference runtime plan). New vibe-infer::mistral::MistralGenerator implements TextGenerator on top of the mistralrs 0.8.1 crate (PagedAttention, ISQ, LoRA, OpenAI-compat types, candle 0.10.x transitively). Feature-gated behind mistralrs (CPU) / mistralrs-cuda / mistralrs-metal / mistralrs-flash-attn; defaults unchanged so baseline builds stay fast. Smoke example at examples/generate.rs exercises Qwen/Qwen2.5-0.5B-Instruct end-to-end. The dep is pinned to the TuringWorks fork (TuringWorks/mistral.rs@3d422fde, branch vibe/kv-cache-codec, upstream base v0.8.1) via git + rev so we can iterate on the KvCacheCodec hook without waiting on upstream review. Explicit SHA pin keeps local / CI / release builds reproducible — bump the rev in vibe-infer/Cargo.toml as the fork advances.
  • KvCacheCodec trait landed on the fork (Phase 3 follow-up). TuringWorks/mistral.rs@vibe/kv-cache-codec adds a pub trait KvCacheCodec { fn encode/decode/name } in mistralrs-core::kv_cache with a PassthroughCodec default, threaded through SingleCache / RotatingCache as Option<Arc<dyn KvCacheCodec>>. None (the default) short-circuits to the existing bit-exact append / current_data paths; installing a codec runs encode on every write and decode on every read. Shape + dtype must be preserved by the codec, so the underlying slice_set / narrow buffers stay uniform — true packed-storage codecs need a richer interface and are out of scope for this landing. Round-trip tests on both cache types prove the dispatch path. The cache types (KvCache, SingleCache, RotatingCache) are now re-exported at mistralrs-core crate root so downstream crates can install codecs without plumbing through private modules.
  • CandleTurboQuantCodec bridge in vibe-infer::kv_cache_codec — candle-backed implementation of the fork’s KvCacheCodec trait that reuses the pure-Rust KvCacheTurboQuant from the Phase 3 spike. Encode shuttles the tensor to host-f32, quantizes + reconstructs each head_dim vector via PolarQuant + QJL, and returns a same-shape same-dtype tensor; decode is identity (the reconstruction already happened in encode). Shape contract: head_dim is the last axis. Six unit tests cover shape/dtype preservation, determinism across codec instances, wrong-axis rejection, uniform-random cosine floor matching the spike, and an end-to-end install into SingleCache proving the trait dispatch works. Gated behind the mistralrs feature so default builds stay thin.
  • Install-all codec fan-out + discovery helpers on the fork (Phase 3 wiring). TuringWorks/mistral.rs@3d422fde adds KvCache::set_codec (fans out to both K and V sub-caches; no-op on Shared), EitherCache::set_kv_cache_codec(codec) -> usize (walks every attention layer of a Normal or Hybrid cache, skipping recurrent layers, and returns the install count for logging), plus two async accessors on MistralRs / Model: set_kv_cache_codec(codec, model_id) — locks the pipeline behind the engine’s RebootState and installs in one shot — and kv_head_dims(model_id) — returns (k_head_dim, v_head_dim) from GeneralMetadata::model_metadata so callers can size a codec from the loaded model instead of hard-coding. 8 fork-side tests; lockout is held only for the duration of a pointer-clone per layer, so it’s safe to await mid-runtime even with other engines busy.
  • MistralGenerator::load installs KV codec on demand (Phase 3 completion). New KvCacheMode { Fp16, TurboQuant { seed, qjl_proj_dim } } + KvCacheMode::from_env() resolver reads VIBE_INFER_KV_CACHE / VIBE_INFER_KV_CACHE_SEED / VIBE_INFER_KV_CACHE_QJL_DIM. MistralGenerator::load / load_isq call install_codec_after_load, which queries head-dim from the fork, builds a CandleTurboQuantCodec, and fans it out via Model::set_kv_cache_codec. Layer count is logged at info for observability. MLA-style models (k_head_dim ≠ v_head_dim) warn and pick the larger; pipelines without ModelConfigLike metadata (speech / diffusion) error out loudly instead of silently booting with a broken codec.
  • InferencePanel KV-cache dropdown (Phase 3 UX). When Backend = Mistral.rs is selected, a new “KV Cache” dropdown appears with options FP16 (default) and TurboQuant (experimental). Picking turboquant prepends VIBE_INFER_KV_CACHE=turboquant to the generated cargo run invocation so the daemon picks it up at load time — no recompile required. Hidden for sidecar backends (where the codec has nowhere to install).
  • Mistral.rs wired into InferencePanel + inference_server (Phase 1.4). InferenceBackend::MistralRs is now a first-class variant alongside vLLM / TGI / Triton / llama.cpp / Ollama, marked is_in_process() so callers can skip sidecar provisioning. build_mistralrs_command() emits the VIBE_INFER_MODEL=… cargo run -p vibe-infer --features {mistralrs | -cuda | -metal | -flash-attn} --example generate … invocation; generate_k8s_inference_deployment uses the vibecody/vibecli-daemon:latest image for the in-process path. The VibeUI Deploy tab adds an “Accelerator” dropdown (CPU / Metal / CUDA / FlashAttn-2) that replaces Port when Mistral.rs is selected, and hides the GPU-count / tensor-parallel / quantization / batch / VRAM-slider / Docker-Compose controls — they don’t apply to an in-process backend that picks its device at compile time.
  • KvCacheBackend trait + KvCacheMethod enum in vibe-infer::kv_cache (Phase 2 — experimentation harness). Declarative surface for swapping attention KV-storage strategies: Fp16 | Fp8 | Int8 | TurboQuant | Custom(name). Each variant carries a CLI-flag name and a bytes-per-element estimate so pod-sizing heuristics agree across backends. KvCacheReport is the harness record — tokens/sec prefill + decode, resident bytes, optional perplexity / recall@k. No runtime effect yet; the actual KV-cache kernel work lands in Phase 3 as a mistralrs-quant contribution.
  • Phase 3 KV-cache TurboQuant spike (vibe-infer::kv_cache_tq + examples/kv_cache_bench) — pure-Rust PolarQuant+QJL prototype over [num_heads, seq_len, head_dim] tensors, with a bench that compares against simulated Fp8 (E4M3) and symmetric Int8. Run with cargo run -p vibe-infer --release --example kv_cache_bench [num_heads seq_len head_dim]. Findings at head_dim=128 against realistic spiked-attention data: 4.57× memory savings vs fp16 (measured 0.4375 B/el — the theoretical ≥5× asymptotic is not reached at typical head_dim because the per-vector 8 B scalar overhead (radius + residual_norm) amortises to +0.0625 B/el), mean reconstructed-K cosine 0.92, softmax attention MAE 0.0000 (below printable precision), and 100% top-1 attention-argmax agreement with fp16 — zero misrouted tokens. On uniform-random stress data, top1_agree drops sharply, but that is a data-shape artifact (flat softmax has arbitrary argmax) rather than a codec fault; judge viability by attn_mae which stays ~0.0002 even there. The KvCacheMethod::TurboQuant.bytes_per_element() estimate is updated 0.375 → 0.4375 to reflect the real number; downstream pod-sizing numbers follow. Spike conclusion: viable for a mistralrs-quant kernel PR — TurboQuant delivers 2.3× more compression than Fp8 without costing attention quality on realistic distributions.
  • TurboQuant-backed semantic scoring in context_streaming (Phase 4 — runtime-agnostic). New SemanticScorer owns a TurboQuantIndex from vibe-core and a caller-supplied EmbedFn; each add_segment embeds + compresses the content, and ContextStreamingEngine::query prefers approximate cosine similarity over the old keyword-overlap scorer when a scorer is attached. refocus(query) rewrites relevance_score across every segment so the RelevanceScore / Hybrid eviction strategies drop segments least relevant to the current task — a prerequisite for 10M–100M-token workflows that outgrow working memory. Optional construction via ContextStreamingEngine::with_semantic(config, scorer); engines built with new(config) behave identically to before. Runtime-agnostic — works with Mistral.rs, vLLM sidecar, or the Claude API; the scorer doesn’t care where embeddings come from.

[0.5.5] — 2026-04-17

Added

  • Apple Watch client (SwiftUI, watchOS 10+) and Wear OS client (Kotlin / Compose, Wear OS 3+) — native VibeCodyWatch / VibeCodyWear apps with pairing, session list, live transcript, and dictated reply; share a single /watch/* backend.
  • /watch/* Axum routes — /watch/pair/challenge, /watch/pair/confirm, /watch/sessions, /watch/sessions/{id}/stream, /watch/sessions/{id}/reply. New modules: watch_auth, watch_bridge, watch_session_relay.
  • P-256 ECDSA (secp256r1) pairing — replaces Ed25519 for Apple Secure Enclave compatibility; 64-byte raw public key, signature over SHA-256(nonce ‖ device_id ‖ issued_at_be).
  • URL-only / Bearer pairing everywhere — no QR code or JSON clipboard required; emulator-friendly.
  • Zero-config connectivity — mDNS advertising (_vibecli._tcp.local.), Tailscale Funnel auto-detection, ngrok auto-detect + opt-in auto-start. Clients race all reachable paths.
  • Apple-Handoff-style session continuity — paired devices see live sessions in real time; VibeUI auto-switches to the Sandbox tab when a watch joins.
  • Google-Docs-style real-time sync — ID-based message reconciliation with content-window dedup; no more 80/512-char truncation.
  • Watch Devices panel in VibeUI (Governance → Watch Devices) to approve / rename / revoke devices.
  • CI release artifacts — VibeCodyWatch-watchOS.app.zip + VibeCodyWear-wearos.apk / .aab alongside existing binaries.
  • Makefile targets — build-watch, watch-ios, watch-wear, watch-wear-bundle, build-all.

Fixed

  • 80 / 512-char message truncation — the legacy ring-buffer fallback was replaced with full-content sync.
  • DMG bundling race on macOS 15 — hardened fallback against transient hdiutil attach failures under concurrent DiskImages2 load.
  • Emulator pairing — pairing now works with a pasted URL + Bearer token on Android emulators and watchOS simulators.

Changed

  • Pairing algorithm: Ed25519 → P-256 ECDSA. Previously-paired devices must re-pair once on v0.5.5.
  • Watch / phone auth — JWT (HS256), 32-byte secret in ProfileStore, 30-day default TTL.
  • Version bumped to 0.5.5 across all manifests.

[0.5.4] — 2026-04-03

Added

  • Claude Code System Prompts — integrated 254 prompts from TuringWorks/claude-code-system-prompts: core behavioral guidelines baked into TOOL_SYSTEM_PROMPT; all prompts stored as reference skills in skills/claude-code-prompts/.
  • Auto-mode guidance — when FullAuto approval policy is active, agent receives autonomous execution rules.
  • Error Boundary — React ErrorBoundary catches render crashes with error + stack trace display.
  • 5 dynamic skill files — git-commit, pr-creation, security-review, debugging, simplify.
  • WebView DevTools — auto-open in debug builds for crash diagnosis.

Fixed

  • GLM/Qwen tool call parsing — normalize <|tag|> delimiters so XML tool calls are correctly executed.
  • Incremental file saves during streaming — <write_file> blocks flushed to disk as closing tag streams in.
  • Leading newline in generated files — strip \n after <write_file path="...">.
  • <build> and <run> tag variants — recognize block form in addition to self-closing.
  • Apply crash — DiffReviewPanel overlays editor with deferred unmount; removed React.StrictMode.
  • Terminal buffer cleared on tab switch — Terminal stays mounted with display toggle.
  • Duplicate provider keys — 14 providers now return unique "Provider (model)" names.
  • LSP invoke params — fixed snake_case to camelCase field names for hover, completion, goto-definition.
  • Diff review toolbar — thinner, outlined ghost buttons, visible text with ellipsis.
  • Tool call card icons — replaced emoji with thin-line SVG icons using CSS variables.

Changed

  • Agent context window: 80K → 200K tokens; max_steps: 30 → 50.
  • Claude max_tokens: 4,096 → 16,384; Ollama num_predict: 2,048 → 16,384.
  • Retry attempts: 4 → 2 (500ms initial, 5s max backoff).
  • Ollama HTTP timeout: 90s → 300s.

[0.5.3] — 2026-04-02

Added

  • Document & Media Viewers — DocumentViewer, ImageViewer, HtmlPreview, DrawioPreview for VibeUI.
  • Per-Provider Model Lists — provider-appropriate models with auto-selection; Ollama uses live-discovered models.
  • RL-OS Core Modules — 8 modules (EnvOS, TrainOS, EvalOS, OptiOS, ModelHub, ServeOS, RLHF, MultiAgent) with 660 tests, 10 panels, 20 Tauri commands.
  • Sketch Canvas — drawing with Move tool, inline text, SVG/PNG export, shape recognition, code generation.
  • Training Run Wizard — step-by-step RL training setup wizard.

Fixed

  • Vibe App: Empty AI Responses — SSE parser read ev["text"] but daemon sends ev["content"].
  • Vibe App: Duplicate Streaming Text — guarded against React StrictMode double-mount race.
  • Vibe App: Response Never Completing — fallback completion event on agent exit.
  • Vibe App: Stale Model/Token — useCallback dependencies updated.
  • Vibe App: Window Icon — replaced default Tauri icon with VibeUI icon.
  • Ollama Model List Slow/Missing — removed per-model chat probe; instant name-based filter.
  • Monaco Crash on Apply All — editor kept always mounted.
  • VibeUI Panel Bugs — TLS Inspector, Design Mode, Screenshot to App, file explorer, Fast Context, SemanticIndexPanel.

Changed

  • Agent Identity — renamed from “VibeCLI” to “Vibe Agent” across all system prompts.
  • RL-OS composite panels registered in panel host, tab groups, and search.

[0.5.2] — 2026-03-30

Added

  • RL-OS: Unified Reinforcement Learning Lifecycle Platform — exhaustive fit-gap analysis against 40+ RL competitors (Ray RLlib, Stable Baselines3, Isaac Lab, TRL, d3rlpy, PettingZoo, SageMaker RL, etc.) identifying 52 gaps across 8 categories and 12 unique capabilities no existing tool provides.
  • RL-OS Architecture Specification — production-grade architecture for 7 core modules (EnvOS, TrainOS, EvalOS, OptiOS, ModelHub, ServeOS, RLHF) with Rust crate structure (vibe-rl/), declarative YAML DSL, RL-aware quantization, and 8-phase roadmap.
  • 12-Stage RL Lifecycle Scorecard — comprehensive lifecycle coverage model; closest competitor scores 5/12 vs. RL-OS target of 12/12.

[0.5.1] — 2026-03-29

Added

  • AI Code Review (ai_code_review.rs, 97 tests) — Qodo/CodeRabbit/Bito parity: 7 detectors, 8-linter aggregation, quality gates, learning loop, PR summary + Mermaid diagrams; /aireview REPL.
  • Architecture Spec Engine (architecture_spec.rs, 108 tests) — TOGAF ADM, Zachman, C4 Model, ADRs, governance engine; /archspec REPL.
  • Policy Engine (policy_engine.rs, 91 tests) — Cerbos-style RBAC/ABAC, 14 condition operators, derived roles, policy testing, YAML, audit trail; /policy REPL.
  • Health Score (health_score.rs, 92 tests) — multi-dimensional codebase health scoring.
  • Intent Refactor (intent_refactor.rs, 89 tests) — natural-language-driven refactoring.
  • Review Protocol (review_protocol.rs, 50 tests) — structured code review workflow.
  • Skill Distillation (skill_distillation.rs, 82 tests) — extract reusable skills from agent traces.
  • Phase 32 P0 — context_protocol, code_review_agent, diff_review, code_replay, speculative_exec, explainable_agent.
  • TurboQuant KV-Cache — PolarQuant + QJL (~3 bits/dim) for vector DB integration.
  • Phase 32 — Advanced Agent Intelligence (6 new modules):
    • context_protocol.rs — Streaming context protocol for long-running agent sessions.
    • code_review_agent.rs — Automated code review with configurable rulesets.
    • diff_review.rs — Change-aware review focused on diff hunks.
    • code_replay.rs — Reproduce past interactions for debugging and auditing.
    • speculative_exec.rs — Predictive code path execution.
    • explainable_agent.rs — Interpretable reasoning chain for agent decisions.
  • FIT-GAP v7 — All 22 Gaps Closed (Phases 23-31):
    • Phase 23: a2a_protocol.rs (A2A protocol), agent_skills_compat.rs (cross-tool skills standard).
    • Phase 24: worktree_pool.rs (parallel worktree agents), agent_host.rs (multi-agent terminal host).
    • Phase 25: proactive_agent.rs (background intelligence scanner), issue_triage.rs (autonomous issue classification).
    • Phase 26: web_grounding.rs (5-provider web search grounding), semantic_index.rs (AST-level codebase understanding).
    • Phase 27: mcp_streamable.rs (Streamable HTTP + OAuth 2.1).
    • Phase 28: mcts_repair.rs (MCTS code repair), cost_router.rs (cost-optimized agent routing).
    • Phase 29: visual_verify.rs (UI screenshot verification), next_task.rs (workflow-level prediction), voice_local.rs (offline whisper.cpp voice), doc_sync.rs (bidirectional spec-code sync).
    • Phase 30: native_connectors.rs (20 service connectors), agent_analytics.rs (enterprise metrics), agent_trust.rs (trust scoring), smart_deps.rs (agentic package manager).
    • Phase 31: rlcef_loop.rs (execution-based learning), langgraph_bridge.rs (LangGraph compatibility), sketch_canvas.rs (sketch-to-code).
  • File Attachments — [file.ext] bracket syntax in VibeCLI REPL and VibeUI chat for attaching documents, code, and images.
  • Image Lightbox — Click image attachments in chat to view full size with download button.
  • System Theme Detection — ThemeToggle now respects prefers-color-scheme on first visit.
  • Data Analysis Panel Backend — 9 new da_* Tauri commands.
  • Counsel — Multi-LLM Deliberation (counsel.rs, 534 lines, 20+ tests).
  • SuperBrain — Multi-Provider Query Routing (superbrain.rs, 424 lines, 14+ tests).
  • Web Client (web_client.rs, 1,048 lines) — zero CDN dependencies (air-gap safe).
  • FIT-GAP Code Review Architecture comparison across 12+ competitors.
  • VibeCody vs OpenClaw whitepaper.
  • Demo guides 36-60.
  • 3 VibeUI composite panels, 7 skill files, 10 new Tauri commands.

Changed

  • Zero Demo Panels — All 23 previously demo-only panels wired to real Tauri backends (34 new commands, 17 new AppState fields). Panel status: 196+ total.
  • Theme Variable Migration — Converted 85+ hardcoded colors to CSS variables.
  • Tests: ~10,535 (0 failures). REPL commands: 106+. Rust modules: 196+. Skill files: ~550. Tauri commands: 360+.
  • Documentation: FIT-GAP through v7, ROADMAP through v5.
  • Provider count: 23 direct + OpenRouter (300+).

Fixed

  • Production Hardening — Zero compiler warnings. Safe unwraps, flush-on-exit, configurable A2A server, poison recovery for Mutex locks.
  • Clippy Clean — All lints resolved across workspace.
  • Tokio Mutex Fix — 45 instances corrected.
  • Crate Metadata — Added description field to 6 Cargo.toml files.
  • Ollama Streaming — Status check fix + streaming hot path optimization.
  • Suppressed warnings in ai_code_review, architecture_spec, diff_review modules.
  • Duplicate REPL handlers removed; missing module stubs created.

[0.5.0] - 2026-03-24

Added

  • 9 Quantum Computing Tools:
    • Statevector Simulator — pure Rust simulator supporting up to 16 qubits with all 14 quantum gates (H, X, Y, Z, S, T, Rx, Ry, Rz, CNOT, CZ, SWAP, Toffoli, Measure). Complex number arithmetic, probability extraction, amplitude readout, and shot-based sampling.
    • Visual Circuit Builder — SVG-based editor with categorized gate palette, click-to-place on qubit wires, multi-qubit gate workflow (control then target), click-to-delete, and live metrics bar (gate count, depth, 2Q gates, circuit volume).
    • Circuit Optimizer — multi-pass optimization: identity cancellation (HH, XX, YY, ZZ, CNOT pairs), gate merging (SS to Z, TT to S), rotation merging (adjacent Rx/Ry/Rz on same qubit), with savings percentage reporting.
    • Bloch Sphere Visualizer — SVG rendering of single-qubit states with oblique projection, axis labels, state arrow, and theta/phi readout.
    • Cost Estimator — pricing comparison for IBM Quantum ($1.60/sec), Amazon Braket ($0.30/task + per-shot), and IonQ (per-gate) with itemized breakdowns.
    • Project Scaffolding — complete project generation for Qiskit, Cirq, PennyLane, and Q# with source, tests, requirements, CI config, and README.
    • Algorithm Templates — 8 pre-built circuits: Bell State, GHZ(n), QFT(n), Grover 2-qubit, Deutsch-Jozsa, Bernstein-Vazirani, VQE ansatz, QAOA.
    • Hardware Topology Viewer — SVG connectivity maps for IBM Eagle (127q), Google Sycamore (53q), IonQ Aria (25q), Rigetti Ankaa-2 (84q), Quantinuum H2 (32q).
    • Multi-language Code Examples — 11 algorithms with implementations in Qiskit, Cirq, and PennyLane (Grover, Shor, VQE, QAOA, QPE, Deutsch-Jozsa, BV, HHL, Quantum Walk, QSVM, QNN).
  • Panel Consolidation (137 tabs to 36):
    • 33 composite panels replacing 137 individual tabs, organized into 9 renamed groups (AI, Project, Code Quality, Source Control, Infrastructure, Data & APIs, Developer Tools, Toolkit, Settings).
    • Reusable TabbedPanel component with keep-alive behavior for sub-tabs.
    • createComposite() factory for one-liner composite panel definitions.
    • Alias-based search — typing old panel names (e.g., “docker”) still finds the consolidated tab (“Containers”).
  • Full-stack Resilience:
    • ResilientProvider wrapper — automatic retry with exponential backoff and jitter on all 21 AI providers.
    • retry_async() generic utility for any async operation with configurable max attempts, backoff, and error classification.
    • is_retryable() classifier covering 20+ transient error patterns (429, 503, timeouts, connection resets, decode errors).
    • Agent loop: stream-level retry (5 attempts, 1-60s backoff), RetryableError event, frontend Retry button preserving completed work.
    • Streaming chat: full retry loop with mid-stream error recovery.
    • 30+ HTTP API calls wrapped with retry: JIRA, GitHub, Linear, Groq Whisper, ElevenLabs, Telegram, Discord, Slack, Signal, Matrix, Twilio, WhatsApp, Teams, OpenSandbox (all operations), BugBot.
  • 11 new Tauri commands for quantum operations (add/remove gate, simulate, optimize, cost estimate, templates, scaffold, circuit detail/delete/clear).
  • 105 quantum computing tests (32 new for simulator, optimizer, templates, cost, scaffold).

Fixed

  • Quantum circuit lookup uses index field instead of array position (circuits remained accessible after deletions).
  • Missing gates array in circuit detail for pre-existing circuits (defaults to empty).
  • Quantum simulator returns tuple arrays matching frontend TypeScript types.
  • TabbedPanel display:contents breaking child panel height.
  • LazyPanels props aligned with refactored createComposite pattern.

Changed

  • Quantum panel expanded from 6 tabs to 11 (Circuit Builder, Simulator, Optimizer, Cost, Templates, Scaffold, Topology, Languages, Quantum OS, Projects, Algorithms).
  • Version bumped to 0.5.0 across all manifests (Cargo.toml, package.json, tauri.conf.json).
  • VibeCLI crate now also builds as a library (vibecli_cli) for Tauri backend integration.
  • Canvas workflow panel properties sidebar added.
  • Tab labels corrected for Red Team, Blue Team, Purple Team.
  • AI/ML Workflow and Model Wizard added to tab groups.

[0.4.0] - 2026-03-21

Added

  • Warp terminal-style features (warp_features.rs, 55 tests):
    • # natural language command — type # find large files to generate shell commands via AI with explanation and confirmation.
    • Command corrections (thefuck-style) — 13 built-in rules for typos (gti to git), missing sudo, git push upstream, permission denied, wrong Python version, etc.
    • Secret redaction — auto-detects and masks API keys (sk-****), AWS keys (AKIA****), GitHub tokens (ghp_****), Bearer tokens, passwords, and private keys in command output.
    • Next command suggestions — proactive hints after successful commands (git add to git commit, cargo build to cargo test, etc.).
    • Block-style output — shell command output formatted with colored left border (green=success, red=failure), command header, and duration display.
    • Desktop notifications — macOS/Linux notifications for commands taking longer than 30 seconds.
    • Output filtering and AI error explanation prompts.
  • Auth scaffolding expanded to 85+ frameworks across 17 languages — Go (Gin, Fiber, Echo, Chi, Hertz), Java (Spring Boot, Quarkus, Micronaut, Vert.x, Helidon, Javalin), Kotlin (Ktor, http4k), C# (ASP.NET Core, FastEndpoints), TypeScript (Next.js, Fastify, NestJS, Hono, Elysia), Python (FastAPI, Django, Flask, Starlette, Litestar), Rust (Axum, Actix, Rocket), Ruby (Rails, Sinatra), PHP (Laravel, Symfony), Elixir (Phoenix), Scala, Swift, Dart, Clojure, Haskell, Crystal, Nim, Zig. Auth providers expanded to 40+ including SAML, LDAP, OIDC, Passkey, TOTP, and 10 BaaS platforms. UI: searchable grid with language filter.
  • Best-in-class documentation (20 new files, ~5,500 lines):
    • llms.txt and llms-full.txt — AI-agent-optimized project docs following the llms.txt standard. First AI coding tool to support this.
    • quickstart.md — zero-to-productive in 5 minutes.
    • 3 tutorials: first-provider setup, agent workflow, AI code review.
    • api-reference.md — complete HTTP daemon API reference with curl examples for all endpoints.
    • Per-provider setup guides: Ollama, Claude, OpenAI, DeepSeek, Gemini.
    • troubleshooting.md (24 issues), faq.md (22 questions), glossary.md (50+ terms), security.md (13 sections), CHANGELOG.md.
    • Jekyll nav reorganized: quickstart-first user journey ordering.
  • Full ANSI markdown rendering in VibeCLI REPL:
    • Headers (H1-H4) in bold green/cyan/magenta/blue.
    • Bold, italic, bold+italic text styling.
    • Inline code with gray background and cyan text.
    • Unordered and ordered lists with styled bullets/numbers.
    • Blockquotes with green pipe and italic text.
    • Task lists with checkbox symbols.
    • Horizontal rules, links with underlined text and dim URLs.
    • Code blocks with line numbers, language labels, dark background, and syntect syntax highlighting.
  • Claude Code-style tool call rendering — dark background boxes with terminal-width padding, green checkmark or red cross, tool output displayed below (capped at 30 lines).
  • MCP panels consolidated — merged MCP, MCP Lazy, and MCP Directory into a single unified panel with 4 tabs (Servers, Tools, Directory, Metrics).
  • Model name in REPL prompt — [vibecli ollama (deepseek-chat)] > shows both provider and model.

Fixed

  • All GitHub URLs corrected from vibecody/vibecody, AceCana662/vibecody, AiChefDev/vibecody to TuringWorks/vibecody across 18 files (docs, GitHub Actions, package.json, config).
  • DeepSeek default model: deepseek-coder to deepseek-chat (V3 current).
  • Gemini default model: gemini-2.0-flash to gemini-2.5-flash (latest).
  • Streaming chat response rendering — replaced flawed stream-then-clear-then-rerender with direct rendering, eliminating blank line artifacts.
  • Rustyline prompt double-bracket and cursor offset — switched to plain text prompt for reliable cursor positioning.
  • Tool output now displayed in agent REPL (was captured but not shown).
  • REPL args trimming — extra spaces after commands removed.
  • All decorative emojis removed from REPL output (70+) and documentation (1,138 replacements across 14 files).
  • Build warnings resolved (zero warnings, zero errors).
  • .vibecli/ added to .gitignore (auto-generated local data).

Changed

  • 23 direct AI providers (was 17): added MiniMax, Perplexity, Together AI, Fireworks AI, SambaNova, plus Gemini provider upgrade.
  • Cost estimation expanded to cover all 23 providers with per-model pricing (was only Claude + OpenAI).
  • Doctor command checks all 14 cloud provider API keys (was 4).
  • Help text reorganized by popularity with all 23 providers listed.
  • 55 new unit tests (warp_features), 130 new provider tests, 812 gap-closure tests.
  • Documentation icons replaced with plain text (Yes/No/Warning instead of emoji checkmarks).

[0.3.3] - 2026-03-20

Added

  • 5 new AI providers: MiniMax, Perplexity, Together AI, Fireworks AI, SambaNova — bringing the total to 23 supported providers.
  • FIT-GAP v6: 19 new competitive gaps identified and closed across agent capabilities, context management, and cloud integrations.
  • 17 new Rust modules:
    • channel_daemon.rs — Always-on background listener for multi-platform integration.
    • vm_orchestrator.rs — Virtual machine lifecycle management for cloud sandboxes.
    • spec_pipeline.rs — Spec-driven development pipeline with EARS syntax support.
    • branch_agent.rs — Autonomous branch management with PR creation workflows.
    • design_import.rs — Figma/Sketch design-to-code import pipeline.
    • audio_output.rs — Text-to-speech for agent responses and accessibility.
    • org_context.rs — Organization-wide context sharing across teams.
    • session_sharing.rs — Share agent sessions with teammates via link or export.
    • ci_gates.rs — Quality gates for CI pipelines with configurable thresholds.
    • data_analysis.rs — Tabular data analysis with chart generation.
    • managed_deploy.rs — One-click deploy to Vercel, Netlify, Railway, Fly.io.
    • context_streaming.rs — Streaming context injection for long-running sessions.
    • extension_compat.rs — Extension compatibility verification and migration.
    • model_marketplace.rs — Browse and install models from community marketplace.
    • agentic_cicd.rs — AI-driven CI/CD pipeline generation and optimization.
    • cross_surface_routing.rs — Route agent actions across CLI, UI, and API surfaces.
    • soul.rs — Project philosophy document management with agent integration.
  • 10 new VibeUI panels: Soul, McpLazy, ContextBundle, CloudProvider, ACP, McpDirectory, UsageMetering, SweBench, SessionMemory, IDP.
  • Gemini provider upgraded to native implementation (previously OpenRouter-only).
  • Best-in-class support documentation: troubleshooting guide, FAQ, glossary, security practices, and this changelog.
  • llms.txt for AI-friendly project context.
  • Tutorial guides for getting started, provider configuration, and skill development.

Fixed

  • DeepSeek default model updated from deprecated deepseek-coder to deepseek-chat (V3).
  • Gemini default model updated to gemini-2.5-flash.
  • Cost estimation now covers all 23 providers (previously only Claude and OpenAI).
  • Doctor command checks all 14 cloud provider API keys (previously only 4).
  • Session resume stability improved for cross-version session files.
  • Monaco editor performance with files over 1 MB (disabled minimap by default for large files).

Changed

  • Provider help text reorganized by popularity tier (Local, Major Cloud, Specialized, Meta).
  • 812 new unit tests across 17 modules, bringing the workspace total to approximately 6,050.
  • All production unwrap() calls replaced with expect() with descriptive messages.
  • Release profile optimized: LTO enabled, symbols stripped, panic set to abort, opt-level=s for workspace with opt-level=2 for vibecli.

[0.3.2] - 2026-03-14

Added

  • Blue Team module (blue_team.rs, 49 tests) — Defensive security operations: incident management with P1-P4 severity, IOC tracking across 9 indicator types, SIEM integration for 8 platforms (Splunk, Sentinel, Elastic, QRadar, CrowdStrike, Wazuh, Datadog, SumoLogic), forensic case management, detection rules with platform-specific query generation, playbooks with 8 action types, and threat hunting workflows.
  • Purple Team module (purple_team.rs, 38 tests) — ATT&CK-aligned security exercises: 14 tactics, 20 pre-loaded techniques, attack simulation with outcome tracking, detection validation, coverage gap analysis, heatmap generation, and cross-exercise comparison.
  • IDP module (idp.rs, 80 tests) — Internal Developer Platform support for 12 platforms: Backstage, Cycloid, Humanitec, Port, Qovery, Mia Platform, OpsLevel, Roadie, Cortex, Morpheus Data, CloudBolt, Harness. Includes service catalogs, golden paths, DORA-metric scorecards, self-service infrastructure provisioning, and team onboarding.
  • 3 new VibeUI panels: BlueTeamPanel (7 tabs), PurpleTeamPanel (5 tabs), IdpPanel (7 tabs).
  • 3 new REPL commands: /blueteam, /purpleteam, /idp with full subcommand sets.
  • Workspace total: approximately 5,912 tests with 0 failures.

[0.3.1] - 2026-03-13

Added

  • Futureproofing Phases 10-14: 10 new Rust modules implementing 12 FIT-GAP v5 gaps (419 tests total):
    • MCP lazy loading with tool search and LRU eviction.
    • Context bundles (Spaces) with priority ordering and TOML serialization.
    • AWS/GCP/Azure deep integration: service detection, IAM policy generation, Terraform/CloudFormation/Pulumi templates, cost estimation.
    • ACP (Agent Client Protocol) server/client modes with capability negotiation.
    • MCP verified plugin directory with search, install, and review pipeline.
    • Usage metering credit system with per-user/project/team budgets and alerts.
    • SWE-bench benchmarking harness for run/compare/export.
    • Session memory profiling with leak detection and auto-compact.
    • SOC 2 compliance controls with audit trail, PII redaction, and retention policies.
    • Unified voice+vision+code multimodal agent.
  • 8 new VibeUI panels and 4 new REPL commands.
  • 12 v5 fit-gap competitive gaps catalogued and Phases 10–14 planned (now consolidated into Fit-Gap Analysis and Roadmap).
  • Workspace total: approximately 5,745 tests with 0 failures and 136+ panels.

[0.3.0] - 2026-03-09

Added

  • FIT-GAP v4: All 23 identified gaps closed, including automations, self-review, MCP apps, agent teams v2, semantic MCP, docgen, remote control, AST editing, CI status checks, VS Code sessions, cloud sandbox, plan documents, security scanning, sub-agent roles, and edit prediction (RL Q-learning).
  • Competitor Parity: 13 new modules closing all code-addressable “Partial” entries from competitive analysis — debug mode, three agent modes (Smart/Rush/Deep), conversational search, clarifying questions, fast context (SWE-grep), image generation agent, discussion mode, full-stack generation, enhanced agent teams, team governance, cloud autofix, GitHub Actions agent, and render optimization.
  • App Builder (app_builder.rs, 70 tests) — Template-based application scaffolding with AI enhancement.
  • Infinite Context (infinite_context.rs, 79 tests) — 5-level context hierarchy with token budget, eviction, compression, and LRU caching.
  • Blitzy Parity: Batch builder (109 tests), QA validation pipeline (99 tests), legacy migration engine supporting 18 source languages including COBOL and Fortran (101 tests), and unified git platform manager for 5 hosting services (111 tests).
  • 13 new skill files and 4 new VibeUI panels.
  • Workspace total: approximately 5,236 tests with 0 failures.

Changed

  • Security audit completed: 20 findings (P0-P3) all resolved, including path traversal prevention, cryptographic IDs, CORS hardening, and command blocklist.
  • All production unwrap() calls replaced with expect() with descriptive messages.
  • Release profile added to workspace: LTO, symbol stripping, panic=abort.

[0.2.x] - 2026-02 through 2026-03

Earlier releases established the foundation:

  • Core agent loop with tool calling, streaming, and multi-provider support.
  • VibeCLI with TUI (Ratatui) and REPL (Rustyline).
  • VibeUI with Tauri 2, React, Monaco Editor.
  • 17 AI providers including Ollama, Claude, OpenAI, Gemini, and FailoverProvider.
  • MCP client and server support.
  • Container sandbox with Docker/Podman/OpenSandbox.
  • 500+ built-in skills across 25+ categories.
  • RAG pipeline with document ingestion, web crawling, and vector database support.
  • Gateway system supporting 18 messaging platforms.
  • Voice input (Groq Whisper), pairing (QR code), and Tailscale integration.

See the Roadmap for the complete feature history.