v3.3.0 - Security, Hook Health, Marketplace

What's New

Security Fix

• Credential-deny symlink bypass (CRITICAL): Symlinks to sensitive files now correctly blocked via readlinkSync + realpathSync resolution

Hook Health Ledger

• New hook-health.ts shared module - every instrumented hook reports success/failure/duration
• 5 critical hooks instrumented: credential-deny, intent-classifier, model-router, skill-compounder, skill-curator
• vibeco doctor --runtime shows 24h execution stats with broken hook detection

CI Quality Gates

• TypeScript type check (tsc --noEmit) now runs in CI
• Dist parity check ensures committed hooks/dist/ matches source

Marketplace

• marketplace.json for plugin ecosystem discovery
• npm + marketplace badges in README

Naming Cleanup

• 50 prompt.md files renamed to SKILL.md
• 8 snake_case skill directories converted to kebab-case
• accessibility-auditor merged into a11y-expert

Numbers

138 agents, 295 skills, 73 hooks, 20 rules

Full Changelog: v3.2.0...v3.3.0

v3.2.0 - Autonomous Skill Evolution Loop

The Self-Improvement Loop Closes

vibecosystem now observes your sessions, detects procedural patterns, generates skill drafts automatically, reviews them on next session start, and promotes the best ones without any manual review.

skill-compounder Hook (Stop)

Analyzes completed sessions for:

• Repeated successful tool call sequences (pattern occurs 3+ times)
• Error recovery patterns (failure followed by successful retry)

Generates SKILL.md drafts in `~/.claude/skills-drafts/` with confidence scores.

skill-curator Hook (SessionStart)

Reviews drafts and:

• Promotes confidence >= 80 to `~/.claude/skills/`
• Archives confidence < 50 to `skills-drafts/archive/`
• Detects duplicates (name match + category+description overlap)
• Archives drafts older than 14 days

3-Depth Progressive Recall

New shared module `recall-layers.ts`:

• Depth 1: IDs only (~10 tokens/match)
• Depth 2: Summary (room, type, 80-char preview)
• Depth 3: Full content (only for confirmed matches)

10-50x token savings via fetch-on-confirmation pattern.

Pre-Research Topic Resolution

New `topic-resolver` skill: Maps vague queries to concrete entities (GitHub orgs, X handles, subreddits, docs URLs) before searching. Oracle agent now runs this as Step 0.

The Full Loop

```
Session work happens
-> skill-compounder detects patterns (Stop)
-> Drafts written to ~/.claude/skills-drafts/
-> Next session: skill-curator reviews (SessionStart)
-> Promotes high confidence, archives low quality
-> New skills loaded via 3-depth recall
-> More patterns, smarter system
-> LOOP (zero user intervention)
```

Counts

• 139 agents, 295 skills, 73 hooks, 20 rules

See CHANGELOG.md

v3.1.1 - Security Fixes + Hook Bugs + Version Sync

Comprehensive Fix Release

After a 4-agent parallel review (Explore, security-reviewer, code-reviewer, janitor) found ~90 issues, this release addresses all P0 (release blockers) and P1 (correctness) findings.

Security HIGH

• H1 Path traversal in palace hooks: Added `sanitizeProjectName()` and `getSafeProjectName()` to shared utilities. All palace hooks now verify resolved paths stay within PALACE_DIR.
• H2 Path traversal in model-router: Added whitelist regex for agent names.

Hook Bugs

• 4 hooks wrong output format: `result: 'approve'` -> proper hookSpecificOutput
• 2 hooks silent SessionStart fail: Added `event.source` field support (was reading legacy `event.type`)
• 7 hooks non-portable stdin: `/dev/stdin` -> FD 0 (Windows portability)
• 4 hooks duplicate project detection: Now use shared `getSafeProjectName()`
• bin/cli.mjs --profile flag was cosmetic: Now actually computes disabled agent/skill sets

Version/Count Consistency

• plugin.json 3.0.0 -> 3.1.1 with updated description
• package.json 3.1.0 -> 3.1.1, removed missing CLAUDE.md/hooks.json refs
• README badges/diagram/tables corrected
• vibecosystem-welcome.md v2.3 -> v3.1

CI Hardening

• claude-fix.yml: `contains()` -> exact match (prevents substring bypass)
• validate.yml: action-shellcheck@master -> @2.0.0 (no floating refs)

See CHANGELOG.md

v3.1.0 - Achievements, Experiment Loop, Self-Healing, Tamagotchi, Art Director

6 Innovative Features

Achievement System

Steam-style gamification: 25 achievements across 5 skill trees (Code Warrior, Bug Slayer, Architecture Master, Security Guardian, Team Player). XP, levels 1-50, daily streaks with multipliers. State in `~/.claude/achievements.json`.

Experiment Loop

Autonomous hypothesize/modify/test/keep-discard loop for any measurable optimization. Max 10 experiments per run, git stash safety. Results in `thoughts/EXPERIMENTS.md`.

Darwinian Skill Evolution

Self-improving skills scored on 5 dimensions. Score 90+ = crystallized (locked). Score < 30 = auto-repair attempted.

Self-Healing Codebase

4-phase pipeline: Detect > Diagnose > Fix > Validate. Confidence gate at 80%. Never auto-fixes security/DB/auth code.

Agent Tamagotchi

Terminal pet with 12 species (deterministic from username), 5 stats (DEBUGGING, PATIENCE, CHAOS, WISDOM, SPEED), 7 moods. Reacts to workflow.

Auto Art Director

AI image generation prompt system with 5-component formula (Subject, Style, Composition, Lighting, Technical).

See CHANGELOG.md

v3.0.1 - Memory Palace, Session Compression, Layered Recall

What's New

Memory Palace

Hierarchical memory organization: Wings (projects) > Rooms (domains) > Drawers (decisions). Auto-saves decisions from agent outputs.

Session Compression (ACDE)

Actions, Context, Decisions, Entities - 10-30x token reduction while preserving all actionable information. Runs automatically before context compression.

Layered Recall

4-layer progressive memory loading:

• L1: Identity (always, ~200 tokens)
• L2: Critical facts (per-project, ~500 tokens)
• L3: Room recall (on-demand)
• L4: Deep search (explicit)

New Hooks

• palace-auto-save: detects decisions/discoveries automatically
• session-compressor: ACDE compression before context fills
• palace-recall: loads Layer 1-2 memories at session start

See CHANGELOG.md

v3.0.0 - npm package, worktree isolation, model routing, knowledge graph

What's New in v3.0.0

The biggest vibecosystem release yet. Closes all critical competitive gaps identified from analysis of 20+ Claude Code ecosystem repos.

npm Package Distribution

npx vibecosystem init
npx vibecosystem init --profile frontend
npx vibecosystem doctor

No more git clone required. Install in one command with profile selection.

Official Plugin Format

• plugin.json manifest for Claude Code plugin ecosystem compatibility
• Ready for marketplace submission

Worktree Isolation (60 agents)

• isolation: worktree added to all producer agents (code writers)
• True parallel execution - each agent works in its own git worktree
• Consumer/orchestrator agents remain shared for coordination

Multi-LLM Model Routing

New model-router hook with 3-tier system:

• Tier 1 (Haiku): doc-updater, technical-writer, babel, i18n-expert
• Tier 2 (Sonnet): code-reviewer, frontend-dev, backend-dev (default)
• Tier 3 (Opus): architect, planner, kraken, sleuth

Recommends via context, never forces. 70-85% cost savings possible.

Knowledge Graph Integration

• New knowledge-graph skill with codebase-memory MCP integration
• graph-indexer hook auto-suggests indexing on session start
• 6-71x token savings vs raw file reading
• Search, architecture overview, call-path tracing

Dashboard v2

• token-tracker hook estimates per-tool token usage
• New /api/tokens and /api/costs endpoints
• Per-agent and per-tool cost breakdown
• Haiku/Sonnet/Opus cost estimates

Updated Counts

• 139 agents (60 with worktree isolation)
• 285 skills (+1 knowledge-graph)
• 66 hooks (+3 model-router, graph-indexer, token-tracker)
• 20 rules

Full Changelog

See CHANGELOG.md

v2.4.0 - Terminal HUD, Prompt Improver, Persistent Planning

What's New

Based on competitive analysis of 20+ Claude Code ecosystem repos, we identified and closed the 3 highest-ROI gaps.

Terminal HUD / Statusline

Real-time session state written to ~/.claude/statusline.json after every tool call.

Tracks: agent spawns/completions/errors, tool count, session duration, active profile, current intent.

Compatible with Claude Code's native statusLine config for always-visible terminal display.

Prompt Auto-Improver

Enriches vague/short prompts with additional context. Does NOT modify the user's prompt.

Triggers when prompt is < 10 words with vague verbs ("fix", "do", "make"). Injects:

• Recently changed files (from git)
• Last recorded error (from Canavar)
• Current intent classification

Persistent Planning System

3-file planning pattern for multi-session work (96.7% task completion rate vs 6.7% without):

• thoughts/PLAN.md - Active plan (auto-injected on session start)
• thoughts/PROGRESS.md - Auto-tracked commits with hash, message, timestamp
• thoughts/CONTEXT.md - Project context and architectural decisions

Competitive Context

• Terminal HUD: claude-hud got 17K stars for a simpler version
• Prompt improvement: 1.3K stars for the reference implementation
• Persistent planning: planning-with-files got 18K stars proving the pattern

Full Changelog

https://github.com/vibeeval/vibecosystem/blob/main/CHANGELOG.md

v2.3.1 - Tests, Search, Architecture, Community

What's New

54 Unit Tests

First test coverage for hook utilities. CI now runs tests on every push/PR.

cd hooks && npm test

 Test Files  4 passed (4)
      Tests  54 passed (54)
   Duration  149ms

Covered: plugin-check, session-id, project-identity, frontmatter parsing.

vibeco search

Find the right agent or skill instantly:

$ vibeco search database

  Agents (6 matches)
    database-reviewer    Database schema, query, security review
    vault                DBA - optimization, migration, backup
    ...

  Skills (5 matches)
    postgres-patterns    PostgreSQL query optimization, schema design
    mongodb-patterns     Document modeling, aggregation pipeline
    ...

ARCHITECTURE.md

Complete system architecture document covering:

• Component interaction (Mermaid diagrams)
• Hook lifecycle and context injection
• Agent routing and collaboration chains
• Self-learning pipeline
• Profile system
• Directory structure
• Contributor quick-start guide

Community Infrastructure

• CODE_OF_CONDUCT.md - Contributor Covenant v2.1
• Issue templates - Upgraded to YAML forms with dropdowns, component selection, version fields
• CONTRIBUTING.md - Expanded from 52 to 120+ lines with hook dev guide, skill authoring, testing
• CI - test-hooks job added to validate.yml

Full Changelog

https://github.com/vibeeval/vibecosystem/blob/main/CHANGELOG.md

v2.3.0 - vibeco CLI, Profiles, One-liner Install

What's New

vibeco CLI

Zero-dependency Node.js CLI for managing the ecosystem:

vibeco help                          # command reference
vibeco stats                         # agent/skill/hook/rule counts
vibeco list agents --search security # browse & search components
vibeco profile frontend              # switch profile (saves tokens)
vibeco doctor                        # 11-point health check
vibeco dashboard                     # start monitoring UI
vibeco update                        # pull latest & reinstall

Preset Profiles

Save tokens by loading only what you need:

Profile	Agents	Skills	Use case
minimal	~15	~40	Core only (review, test, verify)
frontend	~30	~60	React/Next.js/CSS/a11y
backend	~44	~74	API/DB/security
fullstack	~59	~96	Frontend + Backend
devops	~33	~61	CI/CD/K8s/cloud
all	139	283	Everything (default)

One-liner Install

curl -fsSL https://raw.githubusercontent.com/vibeeval/vibecosystem/main/install-remote.sh | bash

Interactive profile selection included.

Other Changes

• install.sh: --non-interactive flag for CI/scripting
• All 5 GIFs regenerated with v2.3 branding
• 12 translated READMEs updated with correct counts
• Dashboard package version bumped to 2.3.0

Full Changelog

https://github.com/vibeeval/vibecosystem/blob/main/CHANGELOG.md

v2.2.4 - Token Optimization + Content Marketing

What's New

139 agents, 283 skills, 60 hooks, 20 rules

Token Optimization (-3,400 tokens/session)

3 rules moved to on-demand skills (no longer injected every session):

• commit-trailers -- only loaded when committing
• tldr-cli -- only loaded when using TLDR
• handoff-templates -- only loaded during agent handoffs

Impact: ~3,400 fewer tokens in context per session = less rate limit pressure on Claude Max

New Skill (1)

• content-marketing -- AI slop detection (30+ regex patterns), 5-dimension content quality scoring (humanity/specificity/structure/SEO/readability), invisible watermark cleaning, copywriting formulas (AIDA/PAS/BAB), programmatic SEO templates, content cluster strategy

Full Changelog: v2.2.3...v2.2.4