Vibezeo

A desktop workspace for the coding agents you already use. Claude Code, Codex and the other coding-agent CLIs run in real terminal panes side by side (Code mode), their sessions read as conversations (Thread mode), and teammates keep their notes between chats (Agent mode). Each engine signs in by itself, in its own folder on your disk: Vibezeo never reads, copies or proxies an AI vendor's tokens, and nothing leaves your computer unless you turn it on.

• Free. Vibezeo is free, with no paid plans. Download it from vibezeo.com/download. Linux builds are out; macOS and Windows builds aren't published yet.
• Docs: vibezeo.com/docs. Changes: CHANGELOG.md.
• Security issues: report them privately, as SECURITY.md explains.
• Anything else: [email protected].

Vibezeo is a clean-room product. It doesn't use another product's names, copy, artwork or code.

The code still uses the product's working name, Tandem: the crates are tandem-*, the app keeps its data in ~/.tandem/, and the specs say Tandem.

Licence

The source is public so that anyone can read it and see what the app does. No open-source licence has been granted, so the code is all rights reserved (© 2026 Naman Jain). The app itself is free to download and use.

How it's built

Coding agents build Vibezeo from the specs, and the repository keeps their working record:

• What and why: docs/PLAN.md (analysis, architecture, milestone plan)
• Binding specs: build-kit/ (DECISIONS, PRODUCT_SPEC, ARCHITECTURE, UI_SPEC, MILESTONES)
• Rules for the agents: CLAUDE.md. Machine setup, commands and releasing: docs/OPERATING.md
• Progress and decisions: BUILD_LOG.md. Steps only a person can do: HUMAN_TODO.md

Repository layout

Path	What
apps/desktop	Tauri 2 app: React UI in src/, Rust crate tandem-desktop (lib tandem_app, bin tandem) in src-tauri/
apps/api	Backend: Hono, Drizzle, Postgres, Redis
apps/web	Website (vibezeo.com, static export on Vercel: docs/DEPLOY_SITE.md), docs and account portal: Next.js 15
apps/site	An earlier one-page draft of the public page (not deployed)
crates/tandem-*	Rust libraries: core, store, pty, engines, git, gateway, tasks, routines, voice, host
packages/ui	React components and design tokens
packages/protocol	Wire types (generated from Rust with ts-rs) and the API client
infra/	docker compose: Postgres 16, Redis 7, Mailpit, stripe-mock

Setup

Requirements: Rust stable, Node 22, pnpm 9, Docker with compose v2. On Linux, bash scripts/bootstrap-linux.sh installs WebKitGTK and the other system packages; bash scripts/check-env.sh lists anything missing.

pnpm install
pnpm dev                 # infra + API (:8787) + web (:3000) + desktop app
pnpm dev --no-desktop    # infra + API + web
pnpm dev --api-only      # just the API

Ctrl-C stops the apps and leaves the infra running (pnpm infra:down stops it). If api.tandem.local doesn't resolve, the dev script prints the /etc/hosts line and uses 127.0.0.1 for that run.

First run:

pnpm infra:up
pnpm keys:dev       # Ed25519 dev keys → .dev-keys/, public keys → the desktop's resources/keys.json
pnpm db:migrate
pnpm db:seed

Seeded accounts (all verified, password Tandem-dev-pass-1): [email protected] (Free), [email protected] (Pro, 10,000 monthly credits), [email protected] (payment failed today), [email protected] (cancelled, period ended). Email goes to Mailpit at http://localhost:8025. Billing runs on a mock provider: Upgrade completes instantly through /billing/mock. bash scripts/stripe-fixture.sh <event> <email> posts a signed webhook fixture.

Sign in locally

With pnpm dev running (API on :8787, web on :3000):

1. Create an account at http://localhost:3000/signup (or use a seeded one, e.g. [email protected] / Tandem-dev-pass-1). The verification email lands in Mailpit at http://localhost:8025.
2. In the desktop app, click Continue with email. Your browser opens http://localhost:3000/desktop-login; sign in there.
3. The browser tab says "You can return to Tandem." and Settings › Account shows who's signed in.

The app listens for the callback on an ephemeral 127.0.0.1 port and also accepts tandem-dev://auth/callback (dev builds use the tandem-dev scheme). Point the app elsewhere with TANDEM_API_URL and TANDEM_WEB_URL. Use Tandem offline skips the account: everything local, unlimited (D-2900); sign-in needed within 14 days. Tokens are stored AES-GCM encrypted in $TANDEM_HOME/auth/credentials.enc, with the key in the OS keychain (app.tandem.dev.auth in dev builds).

Vibezeo is free (D-869): the app sells nothing, so there's no checkout to try. Hosted features follow the seeded account's entitlement ([email protected] carries them).

Tests

pnpm gate                                   # the global gate: lint, tests, desktop build, clippy, fmt, protocol drift
cargo test --workspace                      # Rust
pnpm -r test                                # TypeScript (vitest)
dbus-run-session -- xvfb-run -a -s "-screen 0 1920x1080x24" pnpm --filter desktop e2e   # desktop E2E (WebdriverIO + tauri-driver)
bash scripts/smoke-dev.sh                   # `pnpm dev` orchestration smoke test
bash scripts/check-coverage.sh              # every spec feature is owned by one milestone
pnpm tsx scripts/trace-tests.ts --milestone M0   # acceptance criteria without a test
pnpm ci:local                               # the CI jobs, locally

Tests set TANDEM_HOME to a temp directory and TANDEM_FAKE_KEYCHAIN=1. The desktop E2E runner starts the API (test routes, mock billing) and the web app if they aren't up, drives sign-in and checkout through a scripted headless Chromium (e2e/helpers/browser-signin.ts, wired as TANDEM_OPEN_URL_CMD), starts openbox for window-manager behaviour, and fails the run if the logs contain secret patterns or the network log shows analytics or crash hosts. It prints E2E_LAST_HOME (also saved in test-results/e2e-last-home). API tests and the web E2E use the compose Postgres and Redis, so run pnpm infra:up first (API tests create their own tandem_test database).

pnpm --filter web test:e2e      # Playwright; set PLAYWRIGHT_CHROMIUM to a Chromium binary if Playwright's own isn't installed
pnpm --filter api openapi       # regenerate apps/api/openapi.json

Release

Tag v* triggers .github/workflows/release.yml (added in M5): signed installers when signing secrets are present, unsigned artifacts with a summary note when they aren't.