Feat/competitive parity 2026 - #261
Merged
Merged
Conversation
Bumps [axum](https://github.com/tokio-rs/axum) from 0.7.9 to 0.8.9. - [Release notes](https://github.com/tokio-rs/axum/releases) - [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md) - [Commits](tokio-rs/axum@axum-v0.7.9...axum-v0.8.9) --- updated-dependencies: - dependency-name: axum dependency-version: 0.8.9 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [tower-http](https://github.com/tower-rs/tower-http) from 0.6.11 to 0.7.0. - [Release notes](https://github.com/tower-rs/tower-http/releases) - [Commits](tower-rs/tower-http@tower-http-0.6.11...tower-http-0.7.0) --- updated-dependencies: - dependency-name: tower-http dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…0' into dependabot/cargo/axum-0.8.9
axum 0.8 breaking changes addressed:
1. Route path syntax ':param' -> '{param}'. axum 0.8 panics at router
build on any segment starting with ':' (validate_v07_paths). Migrated
all :param routes in serve.rs, watch_bridge.rs, a2a_http.rs, and
vibe-indexer/main.rs (route registrations + adjacent doc comments).
REST doc-labels in commands.rs/app_builder.rs left as ':id' (not
axum routes).
2. WebSocket Message types: Text(String)->Text(Utf8Bytes),
Binary(Vec<u8>)->Binary(Bytes). Added .into() at the 8 collab-WS
send/receive sites in serve.rs.
tower-http 0.7 (CorsLayer/SetResponseHeaderLayer/Any) API unchanged.
Verified: cargo check --workspace clean; a2a_http_bdd (3 scenarios,
12 steps) + serve_integration pass.
* chore(deps): bump axum 0.7→0.8 + tower-http 0.6→0.7 (with route-syntax + WS migration)
Migrates axum 0.7→0.8 and tower-http 0.6→0.7 (coupled — axum 0.8 requires tower-http 0.7). Includes the required source migration: route path syntax :param→{param} (axum 0.8 panics on :param segments) across serve.rs/watch_bridge.rs/a2a_http.rs/vibe-indexer, and WebSocket Message type conversions (Text→Utf8Bytes, Binary→Bytes). tower-http 0.7 CorsLayer/SetResponseHeaderLayer API unchanged. Subsumes #144 (tower-http bump carried here so the two coupled deps land together). Verified: cargo check --workspace clean; a2a_http_bdd 3 scenarios/12 steps pass.
* chore(deps): bump onnx from 1.21.0 to 1.22.0 in /vibe-rl-py (#155)
Bumps [onnx](https://github.com/onnx/onnx) from 1.21.0 to 1.22.0.
- [Release notes](https://github.com/onnx/onnx/releases)
- [Changelog](https://github.com/onnx/onnx/blob/main/docs/Changelog-ml.md)
- [Commits](onnx/onnx@v1.21.0...v1.22.0)
---
updated-dependencies:
- dependency-name: onnx
dependency-version: 1.22.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps): bump transformers from 4.57.6 to 5.3.0 in /vibe-rl-py (#150)
Bumps [transformers](https://github.com/huggingface/transformers) from 4.57.6 to 5.3.0.
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.57.6...v5.3.0)
---
updated-dependencies:
- dependency-name: transformers
dependency-version: 5.3.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps): bump org.jetbrains.kotlinx:kotlinx-coroutines-play-services (#133)
Bumps [org.jetbrains.kotlinx:kotlinx-coroutines-play-services](https://github.com/Kotlin/kotlinx.coroutines) from 1.8.1 to 1.11.0.
- [Release notes](https://github.com/Kotlin/kotlinx.coroutines/releases)
- [Changelog](https://github.com/Kotlin/kotlinx.coroutines/blob/master/CHANGES.md)
- [Commits](Kotlin/kotlinx.coroutines@1.8.1...1.11.0)
---
updated-dependencies:
- dependency-name: org.jetbrains.kotlinx:kotlinx-coroutines-play-services
dependency-version: 1.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps): bump androidx.compose.ui:ui-tooling-preview (#153)
Bumps androidx.compose.ui:ui-tooling-preview from 1.7.6 to 1.11.4.
---
updated-dependencies:
- dependency-name: androidx.compose.ui:ui-tooling-preview
dependency-version: 1.11.4
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps): bump gradle-wrapper in /vibewatch/VibeCodyWear (#147)
Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 8.10.2 to 9.6.1.
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v8.10.2...v9.6.1)
---
updated-dependencies:
- dependency-name: gradle-wrapper
dependency-version: 9.6.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Dependabot/cargo/axum 0.8.9 (#156)
* chore(deps): bump axum from 0.7.9 to 0.8.9
Bumps [axum](https://github.com/tokio-rs/axum) from 0.7.9 to 0.8.9.
- [Release notes](https://github.com/tokio-rs/axum/releases)
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md)
- [Commits](tokio-rs/axum@axum-v0.7.9...axum-v0.8.9)
---
updated-dependencies:
- dependency-name: axum
dependency-version: 0.8.9
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore(deps): bump tower-http from 0.6.11 to 0.7.0
Bumps [tower-http](https://github.com/tower-rs/tower-http) from 0.6.11 to 0.7.0.
- [Release notes](https://github.com/tower-rs/tower-http/releases)
- [Commits](tower-rs/tower-http@tower-http-0.6.11...tower-http-0.7.0)
---
updated-dependencies:
- dependency-name: tower-http
dependency-version: 0.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* Migrate axum 0.8 route syntax + WS message types
axum 0.8 breaking changes addressed:
1. Route path syntax ':param' -> '{param}'. axum 0.8 panics at router
build on any segment starting with ':' (validate_v07_paths). Migrated
all :param routes in serve.rs, watch_bridge.rs, a2a_http.rs, and
vibe-indexer/main.rs (route registrations + adjacent doc comments).
REST doc-labels in commands.rs/app_builder.rs left as ':id' (not
axum routes).
2. WebSocket Message types: Text(String)->Text(Utf8Bytes),
Binary(Vec<u8>)->Binary(Bytes). Added .into() at the 8 collab-WS
send/receive sites in serve.rs.
tower-http 0.7 (CorsLayer/SetResponseHeaderLayer/Any) API unchanged.
Verified: cargo check --workspace clean; a2a_http_bdd (3 scenarios,
12 steps) + serve_integration pass.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.jetbrains.kotlin.android](https://github.com/JetBrains/kotlin) from 2.1.0 to 2.4.10. - [Release notes](https://github.com/JetBrains/kotlin/releases) - [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md) - [Commits](JetBrains/kotlin@v2.1.0...v2.4.10) --- updated-dependencies: - dependency-name: org.jetbrains.kotlin.android dependency-version: 2.4.10 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.3.0 to 5.7.0. - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@ad2b381...b6effb0) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 5.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [jsdom](https://github.com/jsdom/jsdom) from 29.1.1 to 30.0.1. - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v29.1.1...v30.0.1) --- updated-dependencies: - dependency-name: jsdom dependency-version: 30.0.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [EmbarkStudios/cargo-deny-action](https://github.com/embarkstudios/cargo-deny-action) from 2.0.20 to 2.1.1. - [Release notes](https://github.com/embarkstudios/cargo-deny-action/releases) - [Commits](EmbarkStudios/cargo-deny-action@bb137d7...3c63498) --- updated-dependencies: - dependency-name: EmbarkStudios/cargo-deny-action dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [tree-sitter](https://github.com/tree-sitter/tree-sitter) from 0.25.10 to 0.26.11. - [Release notes](https://github.com/tree-sitter/tree-sitter/releases) - [Commits](tree-sitter/tree-sitter@v0.25.10...v0.26.11) --- updated-dependencies: - dependency-name: tree-sitter dependency-version: 0.26.11 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [sysinfo](https://github.com/GuillaumeGomez/sysinfo) from 0.36.1 to 0.39.6. - [Changelog](https://github.com/GuillaumeGomez/sysinfo/blob/main/CHANGELOG.md) - [Commits](GuillaumeGomez/sysinfo@v0.36.1...v0.39.6) --- updated-dependencies: - dependency-name: sysinfo dependency-version: 0.39.6 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [tokio-tungstenite](https://github.com/snapview/tokio-tungstenite) from 0.28.0 to 0.29.0. - [Changelog](https://github.com/snapview/tokio-tungstenite/blob/master/CHANGELOG.md) - [Commits](snapview/tokio-tungstenite@v0.28.0...v0.29.0) --- updated-dependencies: - dependency-name: tokio-tungstenite dependency-version: 0.29.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [rustyline](https://github.com/kkawakam/rustyline) from 14.0.0 to 17.0.2. - [Release notes](https://github.com/kkawakam/rustyline/releases) - [Changelog](https://github.com/kkawakam/rustyline/blob/master/History.md) - [Commits](kkawakam/rustyline@v14.0.0...v17.0.2) --- updated-dependencies: - dependency-name: rustyline dependency-version: 17.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [chacha20poly1305](https://github.com/RustCrypto/AEADs) from 0.10.1 to 0.11.0. - [Commits](RustCrypto/AEADs@chacha20poly1305-v0.10.1...chacha20poly1305-v0.11.0) --- updated-dependencies: - dependency-name: chacha20poly1305 dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.6.1 to 9.7.0. - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v9.6.1...v9.7.0) --- updated-dependencies: - dependency-name: gradle-wrapper dependency-version: 9.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [flutter_secure_storage](https://github.com/mogol/flutter_secure_storage) from 10.3.1 to 11.0.0. - [Release notes](https://github.com/mogol/flutter_secure_storage/releases) - [Commits](juliansteenbakker/flutter_secure_storage@v10.3.1...flutter_secure_storage-v11.0.0) --- updated-dependencies: - dependency-name: flutter_secure_storage dependency-version: 11.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
… updates Bumps the vibecoder-minor group with 5 updates in the /vibecoder directory: | Package | From | To | | --- | --- | --- | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.29.0` | | [y-websocket](https://github.com/yjs/y-websocket) | `3.0.0` | `3.1.0` | | [yjs](https://github.com/yjs/yjs) | `13.6.31` | `13.6.32` | | [monaco-editor](https://github.com/microsoft/monaco-editor) | `0.55.1` | `0.56.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.0` | `8.2.1` | Updates `lucide-react` from 1.28.0 to 1.29.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.29.0/packages/lucide-react) Updates `y-websocket` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/yjs/y-websocket/releases) - [Commits](yjs/y-websocket@v3.0.0...v3.1.0) Updates `yjs` from 13.6.31 to 13.6.32 - [Release notes](https://github.com/yjs/yjs/releases) - [Commits](yjs/yjs@v13.6.31...v13.6.32) Updates `monaco-editor` from 0.55.1 to 0.56.0 - [Release notes](https://github.com/microsoft/monaco-editor/releases) - [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md) - [Commits](microsoft/monaco-editor@v0.55.1...v0.56.0) Updates `vite` from 8.2.0 to 8.2.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite) --- updated-dependencies: - dependency-name: lucide-react dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: vibecoder-minor - dependency-name: y-websocket dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: vibecoder-minor - dependency-name: yjs dependency-version: 13.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: vibecoder-minor - dependency-name: monaco-editor dependency-version: 0.56.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: vibecoder-minor - dependency-name: vite dependency-version: 8.2.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: vibecoder-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.6.1 to 9.7.0. - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v9.6.1...v9.7.0) --- updated-dependencies: - dependency-name: gradle-wrapper dependency-version: 9.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.6.1 to 9.7.0. - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v9.6.1...v9.7.0) --- updated-dependencies: - dependency-name: gradle-wrapper dependency-version: 9.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the vibeaichat-minor group in /vibeaichat with 1 update: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `vite` from 8.2.0 to 8.2.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.2.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: vibeaichat-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…updates Bumps the vibedesk-minor group with 2 updates in the /vibedesk directory: [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) and [@tauri-apps/cli](https://github.com/tauri-apps/tauri). Updates `lucide-react` from 1.28.0 to 1.29.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.29.0/packages/lucide-react) Updates `@tauri-apps/cli` from 2.11.2 to 2.11.4 - [Release notes](https://github.com/tauri-apps/tauri/releases) - [Commits](https://github.com/tauri-apps/tauri/compare/@tauri-apps/cli-v2.11.2...@tauri-apps/cli-v2.11.4) --- updated-dependencies: - dependency-name: "@tauri-apps/cli" dependency-version: 2.11.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: vibedesk-minor - dependency-name: lucide-react dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: vibedesk-minor ... Signed-off-by: dependabot[bot] <support@github.com>
My previous commit replaced the single-line `run: npx tauri build` with a
multi-line POSIX-shell block that exports the Apple variables conditionally.
Windows runners default to PowerShell, so all three Windows bundles failed with
ParserError: D:\a\_temp\<id>.ps1:2
before tauri ever started. They had been green.
GitHub provides bash on Windows runners, and the rest of the workflow already
uses `shell: bash` for its cross-platform steps (see "Collect artifacts"), so
this matches the existing convention rather than introducing one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Replace rsa crate usage with ring for RS256 JWT signing in vibe-broker to avoid a timing side-channel advisory. Add pkcs8 PEM→DER helper, comprehensive unit tests that verify JWT structure and signature verification, and a test PEM fixture. Also trim syntect default features (dropping yaml-rust) and update Cargo.toml/Cargo.lock to reflect dependency changes.
Bumps [similar](https://github.com/mitsuhiko/similar) from 2.7.0 to 3.1.2. - [Changelog](https://github.com/mitsuhiko/similar/blob/main/CHANGELOG.md) - [Commits](mitsuhiko/similar@2.7.0...3.1.2) --- updated-dependencies: - dependency-name: similar dependency-version: 3.1.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 7.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…bundles v0.5.7 and v0.5.8 both went green, uploaded artifacts, and were killed by macOS on every user's machine: the signing step fell back to ad-hoc, and nothing downstream checked. build-cli had guarded against that since it was written; the three Tauri app bundles and the iOS .ipa had not. - Verify, don't trust. Each macOS bundle job (VibeCoder, VibeAIChat, VibeDesk) and the iOS packaging step now run `codesign --verify --deep --strict` and fail the job when the result is `Signature=adhoc` despite a certificate having been imported. Ad-hoc remains the intended outcome when no certificate is configured — the check only runs when one was. - Notarize the CLI binary. A Developer ID signature alone is not enough for a quarantined download; the ticket lives on Apple's servers for a bare Mach-O (stapling only works for .app/.dmg/.pkg), and `notarytool --wait` returns 0 only on Accepted. Skipped with a notice when credentials are absent. - APPLE_KEYCHAIN_PASSWORD is no longer required. The keychain is created, used and discarded inside the job, so a generated password protects the same nothing — and removes the silent failure where an empty one makes `security` behave differently than intended. - Signed iOS builds. Gated on all three of APPLE_TEAM_ID / APPLE_DIST_CERT_P12_BASE64 / APPLE_IOS_PROFILE_BASE64; the unsigned sideloadable .ipa still ships when they are absent. - watchOS gate checks every secret it needs, not just APPLE_TEAM_ID, which is shared with the desktop jobs — configuring desktop signing used to arm this job and then kill it on an empty provisioning profile. Its `if:` also referenced its own step output, so it always evaluated true. TestFlight upload is now gated separately from producing a signed IPA. - The ad-hoc notices say what actually happens (macOS kills the app; `xattr -dr com.apple.quarantine`) instead of "unidentified developer, right-click → Open", which does not reliably fix it. - scripts/setup-apple-signing.sh configures all of the above secrets from a Mac that holds the certificate. It pairs certificate and private key by public modulus — PEM export order is not guaranteed, and pairing by position yields a .p12 that imports cleanly and then cannot sign. - .cargo/audit.toml collects the RUSTSEC suppression list that had been copied into three places and drifted, which is how v0.5.8's release failed on an advisory only one copy carried. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…nsion typescript-eslint@8.57.2 peers on typescript <6.1.0. Restores ^5.3.0, the version before the Dependabot bump, and re-locks. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…/vibedesk-minor-f9c1d22261' into feat/competitive-parity-2026
…into feat/competitive-parity-2026
…5-0.11.0' into feat/competitive-parity-2026 # Conflicts: # Cargo.lock
…to feat/competitive-parity-2026 # Conflicts: # Cargo.lock
…to feat/competitive-parity-2026 # Conflicts: # Cargo.lock # Cargo.toml
…2' into feat/competitive-parity-2026
…into feat/competitive-parity-2026
… into feat/competitive-parity-2026 # Conflicts: # Cargo.lock
…te-0.29.0' into feat/competitive-parity-2026
…6.11' into feat/competitive-parity-2026
… feat/competitive-parity-2026 # Conflicts: # Cargo.lock
Resolved entirely to HEAD. The branch predates the VibeUI -> VibeCoder rename by 224 commits, so git matched vibeui/package.json onto vibecoder/package.json. Every version on its side is older than HEAD's (typescript-eslint 8.57.2 < 8.66.0, vite 8.0.16 < 8.2.1, vitest 4.1.0 < 4.1.10) and it lacks the dompurify overrides block. Its only forward change is typescript 7, which cannot resolve against typescript-eslint. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Three conflicts, all resolved deliberately: - .github/workflows/release.yml — all three hunks are additions present only on HEAD: the 'verify the bundle is not ad-hoc signed' guard. The release branch predates it. Taking its side would delete the check that exists because v0.5.7 and v0.5.8 shipped ad-hoc-signed bundles that macOS killed on every user's machine. Kept HEAD. - vibecli/crates/vibe-broker/Cargo.toml — base64 0.23 (Dependabot bump already merged here) over the branch's 0.22. - vibecli/crates/vibe-broker/src/token_mint.rs — pure rustfmt difference, no semantic change (hunk 1 differs only by closure braces). Took the formatted side, since that branch exists to fix a red 'Rust (fmt)'; cargo fmt --check is clean on the result. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Introduce an explicit-trigger "ghost text" inline completion feature. Adds /v1/ghost/complete server route and daemon->vibe_ai glue, a new vibecoder lib (ghostText.ts) with unit tests, and registers the provider + Alt+\ keybinding in the App UI (forwards provider+model). Update LSP completion context mapping to translate Monaco trigger kinds to LSP. VS Code extension: add ghostComplete command, inline provider, API client method, settings and keybinding. Gate: only responds to explicit/user trigger (no debounce or keystroke-driven requests); truncated responses are surfaced.
The Dependabot typescript ^7.0.2 bump is merged here (vibeaichat has no typescript-eslint, so unlike vibecoder and vscode-extension it can take it). TS 7 raises TS2882 on side-effect imports with no declaration, and vibeaichat had no .d.ts at all — four errors on './App.css' and the @vibe/shared stylesheets. Adds the same src/vite-env.d.ts that vibecoder already carries. tsc --noEmit is clean on TypeScript 7.0.2. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ty-2026 Contributes axum 0.8.9 in Cargo.lock; Cargo.toml's `axum = "0.8"` already covered it. Every other conflict resolved to HEAD — the branch is from PR #157 and predates several renames and fixes, so its side is uniformly older: - serve.rs / watch_bridge.rs — 'VibeX' and 'VibeUI' naming, superseded by the VibeDesk and VibeCoder renames. - vibe-rl-py/pyproject.toml — mujoco>=3.0 / gymnasium>=0.29 against HEAD's >=3.11.0 / >=1.3.0, and it reinstates the accept-rom-license extra that HEAD removed because gymnasium 1.0 dropped it. - gradle wrapper — older than the 9.7.0 already merged from dependabot/gradle/vibewatch/VibeCodyWear/gradle-wrapper-9.7.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Introduce explicit-trigger "ghost text" docs and hook up related tests and fixes. - Add docs/ghost-text.md and expose it in docs/_config.yml sidebar. - Update docs/diffcomplete.md to describe ghost-text as an explicit-trigger alternative and clarify behavior. - Add server-side tests for POST /v1/ghost/complete: unauthenticated 401 and empty-window BAD_REQUEST checks (vibecli/vibecli-cli/src/serve.rs). - Update frontend tests (DiffCompleteModal) to include the model field when sending provider so the backend preserves the host's model choice. - Add LSP mapping tests (toLspCompletionContext) to ensure Monaco trigger kinds map correctly to LSP (avoid emitting LSP's invalid 0). Rationale: document and validate the new short-form inline completion flow (explicit trigger only), and fix/test completion trigger mapping and model forwarding to avoid provider/model misrouting.
sha2 0.11 + hmac 0.13 moved to digest 0.11, which splits the traits the
old code relied on. Rather than pinning back to 0.10/0.12, migrate the
four call sites:
- `Mac` no longer provides `new_from_slice` — it moved to `KeyInit`, so
import both in mitm.rs, bedrock.rs and zhipu.rs.
- `finalize()` returns `hybrid_array::Array`, which has no `LowerHex`
impl, so `format!("{:x}", …)` no longer compiles. kodegraph's
`hash_content` folds the bytes into lowercase hex by hand.
That hash is a persisted cache key (`file_path -> content hash`), so its
encoding is on-disk format, not an implementation detail — a changed
encoding would invalidate every stored hash and read as a performance
regression rather than a format break. Pin it with a known-answer test;
the existing determinism test would not have caught the difference.
Verified: `cargo check -p vibe-ai -p vibe-broker -p kodegraph` clean,
`cargo test -p kodegraph --lib incremental` 4 passed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Same class of breakage as the previous commit, across four crates whose
majors landed as pin-only bumps with no code migration:
- hmac 0.13: `new_from_slice` moved from `Mac` to `KeyInit` — import both
in cloud_ai.rs, company_secrets.rs, github_app.rs, plugin_signing.rs,
watch_auth.rs.
- sha2 0.11: `finalize()`/`digest()` return `hybrid_array::Array`, which
has no `LowerHex`, so `format!("{:x}", …)` no longer compiles. Replaced
with `hex::encode`, which emits the same lowercase hex — these strings
are manifest digests and signature payloads compared against stored
values, so the encoding had to stay byte-identical.
- p256 0.14: `to_encoded_point` → `to_sec1_point` in signed_agent_card.rs;
its re-exported `rand_core::OsRng` is gone, so the `SigningKey::random`
calls in tests take `rand::rngs::SysRng` instead.
- rustyline: `Highlighter::highlight_char`'s `forced: bool` became
`kind: CmdKind` in repl.rs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…red boilerplate Two passes over the 1,143-file skill library. Frontmatter: every skill now carries `name` and `description` ahead of the existing `category`/`triggers`/`tools_allowed`. The description is a one-liner in "<what it is>. Use when the task involves <triggers>" form, so a skill can be selected from a catalog listing without loading its body. Deduplication: the AI-personnel and sector-operations skills repeated the same seven-step lifecycle, inputs/outputs, decision-rights, metrics, failure-modes and context-modifier prose verbatim in hundreds of files. Those blocks now point at three new shared skills — shared-ai-personnel-pattern, shared-sector-operations-pattern, shared-national-context-modifiers — plus shared-embodied-autonomy-architecture. Net -5,892 lines. Also adds skills-index.md, and drops four skills fully superseded by others (agile-project-management, ai-agent-development, ai-rag-pipeline, architecture-event-driven); no code or doc referenced them. Known issue: 204 files carry the "Inputs and outputs" shared-pattern pointer twice, where the pass replaced two adjacent paragraphs with the same line. Cosmetic, fixed separately. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ble-5 Two registry corrections, both cases of a model list stating something about the world that nobody re-checked. gemini-3.5-pro was written in during a June refresh on the strength of a projected GA date, as both a listed model and the Gemini *default*. It never GA'd — announced at I/O 2026-05-19, delayed three times, still a limited Vertex AI preview in August 2026. So every user who selected the Gemini provider got a model id the API rejects on first call. Default moves to gemini-3.6-flash, which shipped 2026-07-21. claude-fable-5 is the inverse: it was omitted with a comment calling it "not a routable production option" after the 2026-06-12 export-control suspension. That directive was lifted on 06-30 and Fable 5 returned globally on 07-01 — the comment had been stale for 40 days. Restored to both `claude` and `claude-code`. Mythos 5 stays out, but for a reason the type can express: it came back only for approved US organisations, and a flat string[] cannot say "available to some callers", so listing it would 403 for most users. It waits on per-model availability metadata. useModelRegistry.bdd.test.ts is rewritten as a registry-integrity guard: it cannot know whether a model id is real, but it does pin that no provider defaults to a model it does not also list — the exact shape the phantom took. That guard already found a second instance: `vercel_ai` offers an empty list and an empty default, and is parked in an explicit exemption roster rather than papered over with invented ids. Docs updated to match: FEATURE-MATRIX and model-comparison both listed gemini-3.5-pro as the current flagship and VibeCody's default. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`cargo check --workspace --all-targets` is green; a plain `cargo check`
was already green with these 30 errors latent, because every remaining
site lives in a `#[cfg(test)]` block or a BDD test target.
- **OsRng -> rand::rng() (16 sites).** p256 0.14 moves elliptic-curve to
rand_core 0.10, which deleted `OsRng` outright. rand_core 0.10 defines
`CryptoRng` as a blanket impl over `TryCryptoRng<Error = Infallible>`;
`SysRng` reads OS entropy and can fail, so it does not qualify, while
`ThreadRng`'s error is `Infallible`, so it does. Tried SysRng first —
the compiler rejected it, which is why this went through a build rather
than a claim.
- **to_encoded_point -> to_sec1_point (9 sites).** Same signature, same
doc, return type renamed EncodedPoint -> Sec1Point. The production site
feeds .x()/.y() into a JWK, so encoded key bytes are unchanged and
existing agent cards still verify.
- **One more {:x} digest site** in plugin_signing.rs, where sha2 0.11's
Array dropped LowerHex.
Three comments asserted the *opposite* of the truth — that p256 bundled
an older rand_core than the workspace `rand`, so rand's OsRng could not
satisfy the bound. Both are on rand_core 0.10 now and the exclusion runs
the other way, on fallibility. Rewritten; an inverted reason invites the
next person to "fix" it back.
No production code generates P-256 keys — all 16 RNG sites are test-only.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The dedup pass replaced each boilerplate paragraph with a pointer at the shared skill's *section*. Where one section had absorbed two adjacent source paragraphs, both were replaced by the same pointer, leaving it printed twice with a blank line between. Three sections were affected across 287 files — "Inputs and outputs" (204 files, from "Typical inputs:" + "Typical outputs:"), "Cognitive and control architecture (assumed)" (142), and "Adapting to any nation (context modifiers)" (27). No content is lost: each shared skill carries both source paragraphs under the one heading, using the "Variant — also seen in this position" convention. Verified before collapsing — the merged text is present in shared-ai-personnel-pattern.md, shared-embodied-autonomy-architecture.md and shared-national-context-modifiers.md. Deletion-only: 746 lines removed, zero added, and only identical pointers separated by nothing but blank lines were collapsed — two *different* pointers in a row are left alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The registry-integrity rewrite in 0ccb438 took useModelRegistry's test file from 25 cases to 5. The 5 that remain are the right guard for the phantom-model defect, but the rewrite also dropped two things that were not replaced by anything. **Hook behaviour** — every test that actually mounted the hook went away, leaving `refresh()`, the localStorage TTL cache, the dynamic Ollama merge and the `loading` flag with no coverage at all. Restored as a separate file, useModelRegistry.hook.bdd.test.ts, so the split is explicit: the integrity file asserts over the static tables and mounts nothing; this one mounts the hook and asserts what it does. **Retired-model guard** — the list of 12 ids confirmed dead on 2026-08-05 (Ollama Cloud 410s, Anthropic and Groq deprecations) went with it. That is the exact mirror of the phantom-model case the rewrite was written to prevent: a phantom is an id that is not real *yet*, a retirement is one that is no longer real, and both reach the user as a first-call failure. Folded back into the integrity file, where it belongs. Both restored files keep the original's fix of importing CACHE_KEY rather than redeclaring it — the literal went stale on the `:v2` bump and the cache assertions passed against a key nothing reads. Verified by mutation, not just by green: setting CACHE_TTL_MS to 0 fails the fresh-cache case, and truncating the dynamic Ollama list fails the refresh case. Full run: 323 tests across 14 hook files, tsc --noEmit clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The p256 0.14 bump brought ecdsa 0.17, which marks SigningKey::random
#[deprecated(since = "0.17.0", note = "use the `Generate` trait
instead")]. The OsRng migration in the previous commit was therefore
correct but landed 16 call sites on an API already scheduled for
removal — 18 of the build's 34 deprecation warnings, all self-inflicted.
Uses Generate::generate_from_rng(&mut rand::rng()) — same infallible
CryptoRng bound, no feature gate. Generate::generate() would be terser
but sits behind a `getrandom` feature I did not confirm is enabled.
VERIFICATION — partial, stated precisely:
- An isolated probe crate (p256 0.14 + rand 0.10, own target dir)
compiles AND runs this exact call form: generate_from_rng resolves
with `use p256::elliptic_curve::Generate`, to_sec1_point yields
32-byte x and y, and sign/verify round-trips.
- Static scope check: all 10 edited files have the Generate import
reachable from every call site (watch_auth.rs carries four
function-local imports covering its five calls).
- NOT yet compiled in-tree. Three attempts were SIGTERMed while queued
on the shared target lock — another agent session on this machine is
reaping cargo processes. The edits are a mechanical rename plus
imports, and the probe covers the API risk, but a green in-tree
build is still outstanding.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…/vibecody into feat/competitive-parity-2026
PR #260 squash-merged this branch into main, collapsing 96 commits into one. Git therefore saw main's squash and this branch's originals as two independent sets of edits to the same lines, and every file touched since the previous squash conflicted — 298 files. Resolved in favour of this branch throughout. That is safe here, and checked rather than assumed: the set of files differing between main and this branch is exactly the set touched by the three commits made after the squash point (a0c8951 skills-pointer dedup, 1949878 test restoration, 664bb70 ecdsa 0.17), 301 files on both sides with an empty set difference. main carries no change this branch lacks, so the merged tree must equal this branch's pre-merge tree — verified below. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.