VibeBar 1.1 Pre-release: Cursor Agent, security audit, and a toolbar that moves with you

What's in this build

This is the follow-up to the first pre-release from June. If you've been running that build, this one is worth reinstalling. VibeBar can now talk to Cursor Agent over a local MCP server, run a proper security audit, drag and snap the toolbar where you want it, and show optional live resource widgets that follow the bar. There's also a docs site, tray controls, and a safer quit flow.

---

Cursor Agent: stop copy-pasting your own context

The big addition is Cursor Agent integration.

Turn on the optional read-only MCP server on localhost (127.0.0.1:17342). When it's running, Cursor can read VibeBar state instead of you re-explaining what you were doing:

• Session pins and handoff material
• Intent contract and verify recipe
• Ready Check status and brief
• Git status, audit summary, project profile
• Tools like pack_changed, ready_check, get_intent, and more

Open the Cursor Agent button on the toolbar (plug icon). Enable the server, copy the mcp.json snippet into Cursor, restart Cursor, and you're set. The icon turns green when Cursor is actually connected.

Prepare Cursor still copies a bootstrap prompt and opens your project. With MCP on, you can often skip the paste step entirely. Paste-after-open, safety gate, auto-pin on Fix with Context, and auto-run verify all live in this panel now.

Everything stays local. No cloud relay. No API keys in VibeBar for this.

---

Security audit you can actually use

Security Audit got a full engine behind it.

Static scanning with taint-aware rules, fingerprinting, diffing (new vs resolved findings), scoring, npm audit integration, and export to SARIF or Markdown. Baselines and per-rule toggles live in .vibebar-audit.json. Findings can mirror into the Smart Terminal with fix prompts ready to paste.

---

Toolbar you can drag and trust

The toolbar drags and snaps to the left, right, or top edge on any monitor. Dragging is coordinated between the UI and the main process so the bar doesn't jump mid-drag or clip when orientation changes.

Placement is per monitor. The bar remembers where you left it on each display.

---

System resource widgets (new)

Optional floating chips for RAM, CPU, disk free space, and VibeBar memory.

Enable them in Settings → System resource usage. They float above other windows like the toolbar. By default they sync with the toolbar: a horizontal row under or above the bar that moves when you move the bar. Drag one chip away and it stays put; the rest keep following.

Pick which metrics and which monitors. Chips go amber, then red, when something looks unhealthy.

---

Tray, quit confirm, and quick launch

• System tray icon — show/hide the toolbar, open Settings, quit without hunting for the bar
• Power button — opens a "Close VibeBar?" confirm so you don't quit by accident
• Quick Launch — hide apps from the toolbar without removing them from Settings

---

Documentation

There's a docs site on GitHub Pages: install guides, first session walkthrough, feature reference, MCP setup, troubleshooting.

Docs: https://bridgeware-dynamics-business.github.io/Vibebar/

The README was updated to match how the app works today.

---

Upgrade notes

• From the June pre-release: download this build and install over the old one (or uninstall first if you prefer a clean slate).
• MCP: opt-in. Nothing listens on localhost until you enable it.
• Resource widgets: off by default. Turn them on in Settings if you want them.
• Platform: Windows 10+ only, same as before.

---

Known rough edges

• Unsigned builds may trigger SmartScreen ("unknown publisher"). Normal until we ship signed releases.
• If a build fails with EBUSY on app.asar, quit VibeBar and close any File Explorer window on the release folder before running npm run dist again.

---

Full docs: https://bridgeware-dynamics-business.github.io/Vibebar/
Report issues: https://github.com/Bridgeware-Dynamics-Business/Vibebar/issues

VibeBar v1.0.0-pr — Your AI coding co-pilot, floating right where you work

VibeBar v1.0.0-pr 🎉

The first public release of VibeBar — a floating, always-on-top toolbar that sits over
everything you do and helps you talk to your AI. Click a button, get a prompt that already
knows your project, your stack, and what could go wrong, then paste it into your AI and keep
moving.

Less staring at a blinking cursor. More clicking, getting a smart prompt, and shipping.

Pre-release note: This is an early-adopter build (-pr). It's unsigned, so Windows
SmartScreen will show an "unknown publisher" warning on first launch — that's expected.
See Install below.

---

✨ Highlights

🧭 A toolbar that floats over everything

An always-on-top bar of round, animated buttons — like a second taskbar that follows you
around. Dock it to the left, right, or top edge; drop it on top and it flips from vertical to
horizontal automatically. Multi-monitor friendly: show it on one, two, or three displays at once.

🎯 Prompts that know your project

Point VibeBar at a folder and it quietly reads the signal files (read-only — it never writes)
to detect your stack. The prompt library then adapts: the same template behaves differently for
an Electron app (picks up contextIsolation guardrails) vs. a Next.js app (CSP,
dangerouslySetInnerHTML guidance). One prompt that reshapes itself around what you actually
have — not a hundred near-identical ones.

🖥️ A Smart Terminal that watches your back

A frameless, always-on-top terminal that floats opposite the toolbar. It runs your build, test,
lint, and git commands — and reads the output. The instant it spots an error (missing module,
type error, failing test, port collision, stack trace…), it turns that error into a
ready-to-paste, project-aware fix prompt. It also hosts the full Security Audit dock right inside
it, so your audit lives next to your build output.

• Opens at a comfortable default size and is resizable from any edge or corner (drawn by
  VibeBar itself, so it works in packaged builds, not just dev).

🛡️ Security Audit for the stuff scanners miss

The piece we care about most. It targets the #1 vibe-coding risk: the behavioral and structural
holes static scanners walk right past. Read-only across JS, TS, Vue, Svelte, Astro, and Python,
it flags things like:

• Hard-coded secrets on client and server
• Missing Row-Level Security
• Endpoints prone to BOLA / IDOR
• Frontend-only validation
• Dangerous DOM / eval sinks
• SQL and OS command injection
• Insecure config (disabled TLS verification, permissive CORS, debug mode left on)
• Regressed Electron hardening
• Weak randomness for security-sensitive values
• .gitignore gaps and supply-chain drift (unpinned versions, missing lockfile)

Every finding is grouped by severity, mapped to its CWE/OWASP entry, pinned to the exact
file + line with a code frame, and comes with two copy-ready prompts: a fix prompt and a
behavioral-test prompt. There's also "Copy all as one prompt." Flip on auto-scan and it
re-runs live as you edit, mirroring findings into the Smart Terminal in real time.

📦 Context Packer

Pick files from a tree and get a clipboard-ready, prompt-shaped context block — with secrets
stripped out automatically.

🔄 Code Sync

A continuous, one-way folder mirror for keeping an AI-context copy in sync with your real
project, in its own window so the overlay stays visible. Stops cleanly the moment you hit
Stop, close the window, or quit — no background syncing surprises.

✂️ Snip to AI Context

Drag-select any region of your screen, preview it, and save it straight into your project's AI
context folder with a ready-to-paste prompt referencing the image.

🧰 Quick Launch & more

One-click launchers for your external editors/tools (Cursor, Codex, custom), an in-app error
console, and a behavioral-security prompt pack (IDOR/BOLA tests, auth-flow tests, server-side
validation, dependency audits, and a "re-audit before I ship" prompt).

---

🔒 Built to practice what it preaches

• Every window runs with contextIsolation: true, sandbox: true, nodeIntegration: false.
• Every renderer→main call goes through an IPC allowlist with Zod validation — unknown channels
  and malformed payloads are rejected outright.
• All project access is read-only (the only exception is Code Sync's explicit mirror destination).
• Secret scanning runs entirely on your machine and never transmits a finding.
• Strict Content-Security-Policy in packaged builds.

---

💾 Install (Windows 10/11)

Download one of the assets below:

• vibebar-1.0.0-portable.exe — no install; just run it. Lowest-friction way to try it.
• vibebar-1.0.0-setup.exe — NSIS installer with Start Menu + desktop shortcuts.

Because this build is unsigned, SmartScreen may warn on first run — choose More info →
Run anyway. (Signed builds are planned for a future release.)

Requirements: Windows 10 or 11. Node 20+ only needed if you're building from source.

---

🚀 Quick start

1. The toolbar appears on a screen edge — drag it to your preferred dock.
2. Click the folder button and pick a project; the header shows the folder, git branch, and
   detected stack.
3. Open the Prompt Library, grab a stack-aware prompt, and paste it into your AI.
4. Click Smart Terminal, run a command, and copy the fix prompt when something breaks.
5. Run a Security Audit and work the findings top-down.

---

📋 Notes & known limitations

• Windows-only for now (the overlay behavior and packaging target Windows 10/11).
• Unsigned build → expect a one-time SmartScreen prompt.
• Source-available, not open source — see the
  PolyForm Internal Use License. You're free to read, use it personally/internally,
  and contribute back; redistribution/resale requires written permission.

---

Thanks for trying the very first VibeBar. Found a bug or have an idea? Open an issue