VibeBloat

Inspiration

most people vibe code fast. they also make the same mistakes over and over. because they do not understand their codebase

Deleted work. Shell commands that shouldn't have run. The same environment mistake I'd already explained. Every warning gone the moment a new session started.

Memory tools remember. Remembering doesn't stop anything. VibeBloat turns the bad moment into a rule that fires first. Memory tools are merely a suggestion this is a hard listen type of device.

What it does

Local command-safety layer for AI coding agents.

Incident → Guard → Action → Chokepoint

Guard = the dangerous condition. Action = what happens. Chokepoint = where it plugs in (Codex, Claude Code, Hermes).

Commands get parsed with tree-sitter-bash, normalized, checked before they run. Normalization expands vars and aliases, strips absolute paths so a guard is portable between machines.

Recall is lexical by default. Optional local neural embeddings run offline in a short-lived Node sidecar, and only on destructive-shaped commands nobody wants a warning on git log.

Neural recall dies? Enforcement keeps running. It advises. It never blocks and never takes the hook down.

How we built it

TypeScript on Bun. Fast startup, built-in tests, standalone binaries for Windows/Linux/macOS.

Syntax trees, not regex. Every rule class declares its parse-error policy: Class A destructive fails closed, advisory fails open.

Guard files use atomic rename + a watcher, so enforcement never reads a half-written config.

Ingestion is local-first. Presidio-style PII detection and Gitleaks-compatible scanning run before a model sees anything. Scrubbing fails closed scrubber dies, ingestion stops, nothing leaves the machine.

Hermes integration is Python. Claude Code and Codex use native hooks. Detection reads TTY, env, parent process, flags.

Every error is three lines: what failed, why, one command that fixes it.

Challenges we ran into

Local embeddings across runtimes.

long story short

The embeddings fought back. MiniLM on short shell commands keys on the tool name. git log scored closer to git stash -u than to an actual paraphrase of itself. No fixed cosine threshold survived that, so I added real-model regression tests quality drift shows up as a failing test instead of a bad warning.

Cross-platform bugs didn't surface until the repo went public and Actions ran on Linux, Windows, and both macOS arches. Temp-directory assumptions, Windows-only tests, path handling wrong everywhere we hadn't looked.

Remembering an incident helps. Installing a guard that stops it is better.

Accomplishments that we're proud of

763 tests green across Linux, Windows, and both macOS architectures. Cross-platform was the actual work, not a checkbox.

The enforcement path never depends on a model. Guards are deterministic. The optional neural layer can fail, hang, or be missing entirely and commands still get checked that fallback is tested, not assumed.

Scrubbing fails closed. If PII detection or secret scanning breaks, ingestion stops and nothing leaves the machine. No "best effort" on the privacy path.

Local embeddings actually work on Windows under Bun, which took three dead ends to get to.

And the build itself: the semantic-recall feature shipped through ~9 parallel agents working on separate branches, merged centrally after verification. Using AI orchestration to build an AI-safety tool felt like the right kind of proof.

What we learned

Green tests can lie. One of our recall PRs passed everything and shipped completely unwired the suite only proved an injected adapter worked, never that the real CLI called it. We caught it in a central audit, then added an integration test that runs the actual binary. Now every feature has one test that goes through the real entry point.

Never trust a worker agent's self-report. Agents mark their own homework generously. Everything gets verified centrally or it doesn't merge.

Regex on shell is a trap. rm -rf $DIR and rm -rf "${DIR}" and an alias expanding to the same thing are three different strings and one identical risk. Syntax trees plus normalization, or you're shipping theater.

Embedding similarity is not intent similarity. Short commands collapse onto their tool name. Semantic recall belongs in the advisory lane, never the blocking one.

What's next for VibeBloat

Publishing to npm and cutting Sigstore-signed GitHub releases so installs are verifiable.

Replacing the stubbed local embedder with a real bundled neural model, and fixing the tool-name bias with intent-normalized embeddings instead of raw command text.

Fresh-machine integration tests — install from a clean box and prove the hooks wire themselves correctly on all three platforms.

A curated community guard library, DCO-backed, so a mistake one person hits once becomes a guard everyone gets.

Longer term: more chokepoints. Cursor, Aider, whatever ships next. The guard format is tool-agnostic on purpose.

Built With

• codex