VibeBar v1.0.0-pr — Your AI coding co-pilot, floating right where you work

VibeBar v1.0.0-pr 🎉

The first public release of VibeBar — a floating, always-on-top toolbar that sits over
everything you do and helps you talk to your AI. Click a button, get a prompt that already
knows your project, your stack, and what could go wrong, then paste it into your AI and keep
moving.

Less staring at a blinking cursor. More clicking, getting a smart prompt, and shipping.

Pre-release note: This is an early-adopter build (-pr). It's unsigned, so Windows
SmartScreen will show an "unknown publisher" warning on first launch — that's expected.
See Install below.

---

✨ Highlights

🧭 A toolbar that floats over everything

An always-on-top bar of round, animated buttons — like a second taskbar that follows you
around. Dock it to the left, right, or top edge; drop it on top and it flips from vertical to
horizontal automatically. Multi-monitor friendly: show it on one, two, or three displays at once.

🎯 Prompts that know your project

Point VibeBar at a folder and it quietly reads the signal files (read-only — it never writes)
to detect your stack. The prompt library then adapts: the same template behaves differently for
an Electron app (picks up contextIsolation guardrails) vs. a Next.js app (CSP,
dangerouslySetInnerHTML guidance). One prompt that reshapes itself around what you actually
have — not a hundred near-identical ones.

🖥️ A Smart Terminal that watches your back

A frameless, always-on-top terminal that floats opposite the toolbar. It runs your build, test,
lint, and git commands — and reads the output. The instant it spots an error (missing module,
type error, failing test, port collision, stack trace…), it turns that error into a
ready-to-paste, project-aware fix prompt. It also hosts the full Security Audit dock right inside
it, so your audit lives next to your build output.

• Opens at a comfortable default size and is resizable from any edge or corner (drawn by
  VibeBar itself, so it works in packaged builds, not just dev).

🛡️ Security Audit for the stuff scanners miss

The piece we care about most. It targets the #1 vibe-coding risk: the behavioral and structural
holes static scanners walk right past. Read-only across JS, TS, Vue, Svelte, Astro, and Python,
it flags things like:

• Hard-coded secrets on client and server
• Missing Row-Level Security
• Endpoints prone to BOLA / IDOR
• Frontend-only validation
• Dangerous DOM / eval sinks
• SQL and OS command injection
• Insecure config (disabled TLS verification, permissive CORS, debug mode left on)
• Regressed Electron hardening
• Weak randomness for security-sensitive values
• .gitignore gaps and supply-chain drift (unpinned versions, missing lockfile)

Every finding is grouped by severity, mapped to its CWE/OWASP entry, pinned to the exact
file + line with a code frame, and comes with two copy-ready prompts: a fix prompt and a
behavioral-test prompt. There's also "Copy all as one prompt." Flip on auto-scan and it
re-runs live as you edit, mirroring findings into the Smart Terminal in real time.

📦 Context Packer

Pick files from a tree and get a clipboard-ready, prompt-shaped context block — with secrets
stripped out automatically.

🔄 Code Sync

A continuous, one-way folder mirror for keeping an AI-context copy in sync with your real
project, in its own window so the overlay stays visible. Stops cleanly the moment you hit
Stop, close the window, or quit — no background syncing surprises.

✂️ Snip to AI Context

Drag-select any region of your screen, preview it, and save it straight into your project's AI
context folder with a ready-to-paste prompt referencing the image.

🧰 Quick Launch & more

One-click launchers for your external editors/tools (Cursor, Codex, custom), an in-app error
console, and a behavioral-security prompt pack (IDOR/BOLA tests, auth-flow tests, server-side
validation, dependency audits, and a "re-audit before I ship" prompt).

---

🔒 Built to practice what it preaches

• Every window runs with contextIsolation: true, sandbox: true, nodeIntegration: false.
• Every renderer→main call goes through an IPC allowlist with Zod validation — unknown channels
  and malformed payloads are rejected outright.
• All project access is read-only (the only exception is Code Sync's explicit mirror destination).
• Secret scanning runs entirely on your machine and never transmits a finding.
• Strict Content-Security-Policy in packaged builds.

---

💾 Install (Windows 10/11)

Download one of the assets below:

• vibebar-1.0.0-portable.exe — no install; just run it. Lowest-friction way to try it.
• vibebar-1.0.0-setup.exe — NSIS installer with Start Menu + desktop shortcuts.

Because this build is unsigned, SmartScreen may warn on first run — choose More info →
Run anyway. (Signed builds are planned for a future release.)

Requirements: Windows 10 or 11. Node 20+ only needed if you're building from source.

---

🚀 Quick start

1. The toolbar appears on a screen edge — drag it to your preferred dock.
2. Click the folder button and pick a project; the header shows the folder, git branch, and
   detected stack.
3. Open the Prompt Library, grab a stack-aware prompt, and paste it into your AI.
4. Click Smart Terminal, run a command, and copy the fix prompt when something breaks.
5. Run a Security Audit and work the findings top-down.

---

📋 Notes & known limitations

• Windows-only for now (the overlay behavior and packaging target Windows 10/11).
• Unsigned build → expect a one-time SmartScreen prompt.
• Source-available, not open source — see the
  PolyForm Internal Use License. You're free to read, use it personally/internally,
  and contribute back; redistribution/resale requires written permission.

---

Thanks for trying the very first VibeBar. Found a bug or have an idea? Open an issue