vibestack

Your assistant already writes code. This teaches it how a senior engineer works.

---

What is vibestack?

Sixty commands for AI coding assistants, each one a file your agent reads and exposes by name. You type /review instead of "check my code," and a written process runs: read the diff, look for the things that actually break, report with evidence. Same for planning, debugging, security, shipping.

It also installs the standing rules those commands assume — plan before coding, never commit without being asked, write commits in the author's voice — so the assistant behaves that way between commands too.

Works in Claude Code, Cursor, Kiro and Codex CLI from one source. MIT, no telemetry, no account, no cloud service of its own. Some commands do reach out by design — /codex sends your diff to a second model, /benchmark-models queries providers, /pair-agent opens a tunnel — and each says so before it runs.

What you get	Why it matters
A command per job, not a prompt per job	The process is written down once and runs the same way every time
A second pass before you ship	/review runs an adversarial pass in a fresh context, and a genuine second model when the Codex CLI is installed — it says which one it got
Standing rules, always on	The assistant plans and asks before it commits, without being reminded
One source, four runtimes	Switch tools and keep the same commands — nothing is vendor-shaped
Plain bash, no daemon	git pull && ./install is the whole update story
Your machine by default	State lives in ~/.vibestack/. Nothing phones home; the commands that call another model say so first

---

Install

Needs bash 4+ and, for the merge step below, python3 — the full list says what happens when one is missing. Clone anywhere outside an agent's skills folder; a checkout inside one gets indexed twice and every command shows up doubled.

git clone https://github.com/timurgaleev/vibestack ~/vibestack
~/vibestack/install

That installs the commands. The standing rules are a second, opt-in step, because they write into files you may already own:

~/vibestack/install --with-config -n   # show every change, write nothing
~/vibestack/install --with-config      # apply

It never clobbers what it finds — see how below.

---

What to type first

Three commands carry most of the value. Run them in this order on real work:

/office-hours        shape a vague idea into a design doc you can act on
/review              before you merge: correctness, security, tests
/ship                tests, review, version bump, CHANGELOG, PR

/office-hours opens by asking what you are actually trying to do:

Before we dig in — what's your goal with this?

  Building a startup (or thinking about it)
  Hackathon / demo — time-boxed, need to impress
  Open source / research — building for a community
  Learning — teaching yourself to code, leveling up

Pick a mode and it asks the questions that mode needs, then writes the doc you can hand to /plan-eng-review.

In Codex CLI the same commands are $office-hours, $review, $ship — / is reserved there for Codex's own commands.

---

Commands

🔥 daily · ⭐ reach for it often · · situational

Command	What it does
/office-hours	Turn an idea into a design doc, via the questions that fit your goal	🔥
/review	Pre-merge review: correctness, security, tests, scope drift	🔥
/ship	Merge base, test, review, bump, CHANGELOG, open the PR	🔥
/investigate	Systematic debugging — no fix without a confirmed root cause	🔥
/plan-eng-review	Pressure-test a plan: architecture, data flow, edge cases, risk	⭐
/address-pr-review	Work a PR's open threads and failing checks to a close	⭐
/cso	Security audit: OWASP Top 10, threat model, live cloud posture	⭐
/spec	Turn rough intent into an executable spec, then file it as an issue	⭐
/qa	Drive a running web app, find bugs, fix them, verify	⭐
/learn	Record what this session taught, so the next one starts ahead	⭐
/unslop	Find the AI tells in prose and rewrite it in the author's voice
/aws-cost	Read-only bill review: month-over-month deltas, waste, commitments
/ai-cost-guard	Cap runaway model spend — in code and at the provider
/bedrock-guardrails	Audit Bedrock region pinning, IAM scope, guardrails, logging
/kb-review	RAG and Knowledge Base review: chunking, tenant filters, recall@5
/connect-review	Review an Amazon Connect IVR: flows, Lex, latency, cost per contact
/agent-eval	Build and run an eval harness for an agent or prompt, with a gate
/mcp-review	Audit an MCP server: tools, auth, validation, injection surface
/careful /freeze /guard	Refuse destructive commands and edits outside a boundary

The other 39 cover design, docs, retros, context handoff, browser QA and release. Every command, with what it does: docs/skills.md

---

How it writes into your files

--with-config deploys into ~/.claude, ~/.cursor, ~/.kiro and ~/.codex — directories that already hold your settings. That is the part worth understanding before you run it, so here is the whole contract.

• A marker splits each shared file. Above it is ours and gets replaced; below it is yours and is carried across untouched. rtk init's @RTK.md line and your own house rules live below it and survive every sync.
• Settings are merged, not overwritten. Keys you added stay. Permission arrays are unioned rather than replaced. Where a key exists on both sides the repo's value wins, so an edit to a key the pack also sets does not survive a sync — put anything you want kept under a key the pack does not touch.
• It refuses rather than guesses. A file it cannot parse, a merge whose result would not parse, or a missing parser all end the same way: the file is left byte-identical and the run exits non-zero saying so.
• Uninstall removes only what it recorded installing. ./uninstall --with-config deletes the files in its own manifest, strips its own marked region, and takes back the keys it merged in — each restored to the value it had before, or dropped if it had none. A value you changed since installing is kept, and the run says so. Codex's config.toml is the one exception: that merge is line-based and records nothing to undo.

What it costs you in context: the always-on part is 13 rule files plus an index — 31 KB, about 7,800 tokens, 3.9% of a 200k window. The 33 sub-agents load only when a command hands work to one. Codex gets a single self-contained AGENTS.md instead, at about 5,900 tokens.

The trust decision, stated plainly. The payload adds Bash(*) to Claude Code's allow-list and sets defaultMode: acceptEdits — together that is "run shell commands and apply edits without asking me each time". Preview it with --with-config -n before you decide, and read SECURITY.md for how to tighten it. ./uninstall --with-config revokes both again — removing the pack removes the permission it was granted.

Full reference: docs/configuration.md.

---

Requirements

	Needed for	If it is missing
One of Claude Code, Cursor, Kiro, Codex CLI	Anything at all	Undetected runtimes are skipped, not failed
bash 4+	The installer's own arrays	It refuses and tells you brew install bash — the commands themselves run on 3.2
python3	Merging settings.json and hooks.json	The merge is refused, never performed unchecked; the rest installs
python3 3.11+	Merging Codex's config.toml (needs tomllib to verify the result)	Same: refused, not written unchecked. macOS ships 3.9 as /usr/bin/python3
gh	The 23 commands that touch pull requests or issues	Those commands say so and stop

---

More

./install --target=all             # Claude Code + Cursor + Kiro + Codex, non-interactive
./install --only=config            # the standing rules alone
./install --scope=project --project-root=.   # pin the commands into this repo, for a team
./install --dry-run                # preview everything, write nothing
git pull && ./install              # update
./uninstall --with-config          # remove, including the deployed configuration
vibestack doctor                   # what is installed, where, and whether it is current

• docs/skills.md — every command, in detail
• docs/configuration.md — the standing rules, statusline, sub-agents
• ETHOS.md — the five principles behind the design
• CONTRIBUTING.md — add your own command in minutes
• docs/agent-skills-compatibility-audit.md — what each runtime actually supports
• docs/internals.md — binaries, snippets, state paths, test suites
• docs/external-tools.md — tools expected but not bundled
• docs/aws-reviews-first-run.md · docs/llm-checks-first-run.md — first run of the AWS and LLM reviews
• SECURITY.md · CHANGELOG.md · LICENSE (MIT)

Caveat worth knowing. /careful, /freeze and /guard enforce hard blocks in Claude Code. In Cursor and Kiro they degrade to a soft nudge the model can talk itself past, and on Codex CLI the hooks have never been verified. Treat them as a seatbelt there, not a lock — the compatibility audit has the per-runtime detail.