We ship. Here’s the receipt.
VibeReady isn’t a frozen template. Since launch it’s grown a full agentic layer — memory, retrieval, safe write-actions, cost observability, and behavioral evals — across 14 releases. Every one is documented below, and lands in your copy as a free update.
- v0.9.0 Feature
Agent Evals — regression tests for what the AI actually does
Unit tests mock the model, so a prompt tweak can silently break tool selection while everything stays green. The new eval suite runs golden datasets through the real chat pipeline — production prompt, role-filtered tools, real Postgres — locally and in CI, and it caught two real bugs in this release before it shipped.
- 36 golden cases across three suites (core-agent, security, memory), graded on outcomes: DB end-states and set-semantic tool checks with pinned args, plus a binary LLM judge only where code can’t check.
- OWASP-mapped adversarial suite: prompt injection via RAG chunks and stored memories, cross-tenant probes, member→admin escalation, HITL bypass, and system-prompt extraction.
- Committed baseline with drift reporting. The PR gate runs deterministic cases only — a flaky judge can never block a merge — and forks without an API key skip green.
- Zero new dependencies: runs on the kit’s Vitest via make eval, and every run prints its own cost (full suite ≈ $0.56; a single suite from ~$0.02).
- Fixes it caught: invitations now go out as Approve / Deny proposals instead of “should I?” prose, and denied approvals stay denied.
- v0.8.2 Polish
Docs deepen — personalize the AI to how you work
A documentation release. The framework now ships a full guide to the coding assistant’s cross-session memory and how the session-post-mortem skill keeps it curated — so the AI gets more useful the longer you use it, on purpose, not by accident.
- New “AI Memory & Personalization” tutorial: what the assistant remembers between sessions, and where each lesson belongs (memory vs. scoped rule vs. AGENTS.md vs. README).
- session-post-mortem surfaced across the framework docs — it routes end-of-session lessons to their single best home instead of letting memory rot into noise.
- v0.8.1 Polish
Docs catch up to the dashboard
Documentation and framework-tooling polish shipped same-day behind v0.8.0. No application code changes.
- README surfaces the AI Usage dashboard as a first-class AI feature — the old “usage tracking” line predated v0.8.0 and undersold it.
- session-post-mortem skill scoped to memory: lessons route there by default, with rules and AGENTS.md as narrow exceptions.
- v0.8.0 Feature
AI Usage Dashboard — see what your assistant costs and does
Agent observability for a multi-tenant SaaS: a permission-gated dashboard with real per-request cost, tokens, and tool calls — and a quiet correction underneath it, because the background LLM calls (summarization, titles, memory) had been burning credits invisibly.
- KPI cards, usage-over-time by call kind, and model + tool breakdowns at /dashboard/ai-usage (owner/admin).
- Real OpenRouter per-request cost, not just token estimates — plus a sourced price map for honest totals.
- Per-conversation drill-down (metadata only — never message content) and CSV / JSON export.
- Every LLM call now records through one honest path; the model selector actually takes effect.
- v0.7.0 Feature
AI Memory & Context — the assistant remembers, and long chats stop breaking
Cross-session memory on the existing pgvector stack, plus automatic conversation compaction so a long thread never dead-ends on the model’s context limit.
- Durable, per-(org, user) memory — personal even to org owners; consolidated mem0-style so paraphrases merge and contradictions supersede.
- Self-serve AI Memory manager in Preferences: search, edit (re-embeds), delete, clear-all, on/off.
- Sliding-window + running-summary compaction, with a live context-usage meter and a calm “earlier messages summarized” divider.
- saveMemory / forgetMemory chat tools; memory content never appears in logs.
- v0.6.2 Polish
Teardown wizard hardened
One fix: the setup-cleanup wizard now matches the setup and deployment wizards in how it handles GCP failures.
- Surfaces real gcloud failure text, offers re-auth and retry on expired credentials, and requests the delete_repo GitHub scope on demand.
- v0.6.1 Security
Dependency security sweep + GCP setup hardening
Resolved every high-severity npm advisory (30 vulnerabilities down to 7 moderate, all upstream) and hardened the deployment wizards against the GCP failures that used to surface 13 minutes into terraform apply.
- Expired credentials detected before long operations; the Domain Restricted Sharing org policy is pre-empted instead of failing mid-apply.
- Migrated to the consolidated react-email package; weekly grouped Dependabot updates for npm, Actions, Docker, and Terraform.
- v0.6.0 Feature
Knowledge Base (RAG) — chat with your own documents
A per-org knowledge base with pgvector retrieval and a searchKnowledgeBase tool, so the assistant answers from your content instead of guessing.
- Upload PDF / DOCX / MD / TXT; async ingestion (parse → chunk → embed → store) runs on Inngest with an inline fallback.
- pgvector cosine retrieval, scoped by organization — cross-tenant isolation pinned by an integration test.
- Embeddings decoupled from the chat LLM (OpenAI text-embedding-3-small); a mock provider keeps tests key-free.
- Managed at /dashboard/knowledge-base behind the knowledge_base:manage permission.
- v0.5.0 Polish
Chat output UX revamp — tool calls that read like a product
The tool-result pipeline grew up: lucide icons across all tools, verb-led titles, per-tool summaries, and theme-driven semantic tokens.
- Failure cards show the error inline — no more redundant JSON dumps.
- Auto-titles source from the user’s first message only; lowercase role labels pinned by a regression test.
- Latent fix: API integration tests had been silently skipped — all 142 now run.
- v0.4.0 Feature
Write actions + Human-in-the-Loop approval
The assistant stops being read-only: it can invite, change roles, and remove members — each gated behind an inline Approve / Deny step.
- Four owner/admin-only write tools, each declared with AI SDK v6’s needsApproval.
- Inline Approve / Deny cards; the turn auto-resumes once approvals resolve.
- AI provenance on every audited action (triggered_by: ai, conversation + tool-call ids, approver).
- v0.3.1 Polish
Real model IDs + reproducible installs
Patch release: the bundled AI model list now uses identifiers each provider actually accepts (the old Anthropic and Google IDs never matched real provider strings), and an .npmrc ends the recurring lockfile drift between local installs and CI.
- Model list refreshed to current 2026 versions; legacy-peer-deps pinned so npm install and npm ci resolve identically.
- v0.3.0 Polish
AI SDK v6 migration + foundation hardening
Moved the stack to the supported major and tightened the guardrails buyers extend.
- ai → ^6, paired @ai-sdk/* providers; the official codemod made three mechanical edits.
- Output cap raised 2048 → 8192; a 2,000-message-per-conversation cap with a clean 413.
- Inline rationale at every AI-runtime magic number — the override surface a starter kit needs.
- v0.2.1 Security
Security patch — 22 advisories resolved
Resolved 22 vulnerabilities including a critical Clerk middleware route-protection bypass (CVSS 9.1) and a Next.js Server Actions CSRF bypass. Customers should upgrade promptly.
- Clerk 6.x route-protection bypass (GHSA-vqx2-fgx2-5wq9) and authorization bypass closed.
- Next.js CSRF-via-null-origin, request smuggling, and several DoS vectors resolved in the 16.x line.
- v0.2.0 Feature
Conversation memory & persistence
The assistant keeps conversations across sessions — the foundation everything agentic was built on.
- Sidebar history with auto-generated titles; rename, delete, and full resume.
- Tool calls and results round-trip on resume — replayed exactly as they ran.
- Multi-tenant scoping on every read; the groundwork for write-tools, RAG, and memory.
On the roadmap
Where the agent platform goes next. In progress — no promised dates.
- MCP Server (expose your SaaS)
- Integrations (MCP connectors)
- No-code Agent Builder
- Visual Workflow Builder
Buy once. Keep shipping.
Every release above landed in existing copies as a free update. See what’s included.
Get VibeReady — From $149