Wibe agent bridge

Dependency-light TypeScript foundations for normalizing agent hooks and sending signed event batches.

Privacy and security

• Adapters copy only explicit allow-listed metadata. Prompt text, tool input/output, file content, shell command text, messages, and transcripts are never captured by default.
• Redaction is defense in depth, not permission to send arbitrary payloads.
• Offline files are created with owner-only permissions and separated by Wibe project. Set WIBE_QUEUE_PATH to relocate the queue directory.
• Device authorization opens Wibe in the browser and stores the resulting revocable project-scoped bearer token in the operating-system keychain.
• Event batches are schema-validated, bounded, idempotent, and sent only to the configured Wibe HTTPS endpoint.

CLI

Install and authorize Wibe from any GitHub repository:

npx --yes --package @wibeco/bridge@latest wibe onboard \
  --adapter cursor \
  --url https://trywibe.com \
  --repository <owner/repository>

npx --yes --package @wibeco/bridge@latest wibe setup \
  --adapter cursor \
  --project <uuid> \
  --url https://trywibe.com \
  --repository <owner/repository>

npx --yes --package @wibeco/bridge@latest wibe get-active-work

npx --yes --package @wibeco/bridge@latest wibe check-overlap \
  --path src/example.ts

Use --adapter claude-code or --adapter codex for another supported agent. The setup command opens a one-time browser authorization and stores the project-scoped device credential in the operating-system keychain. Matching reruns reuse that credential and retry verification without creating another device. Credentials created before repository binding was available are re-authorized once so overlap checks receive the current repository and scopes. Setup verifies the connection before returning success.

For recovery, start in the affected repository with wibe status, then run wibe doctor --repository <owner/repository>. Use wibe doctor --json when a machine-readable, privacy-safe report is needed; it excludes tokens, paths, commands, source, and raw agent content. A harmless wibe check-overlap --path README.md verifies repository coordination. Rerun the project setup command with --reauthorize when doctor reports a missing repository binding or a rejected, expired, or pre-current token. MCP OAuth is a separate connection and may also need reconnecting in the coding agent.

setup keeps reviewable templates under .wibe/integrations/<adapter> and installs or refreshes Wibe commands in native project configuration. Existing user commands and unrelated agent configuration are preserved. Wibe-managed activity instructions and an existing Wibe MCP URL are refreshed to the repository's current project.

Setup also copies the running bundled CLI to an owner-only user launcher and points lifecycle hooks and fallback reporting commands at that stable copy. At session start, the launcher checks Wibe's versioned capabilities response at most once every six hours. A server-approved npm release is installed beside the current runtime, verified by npm plus package identity checks, and atomically swapped while retaining the previous runtime for rollback. Update failures never hold an agent hook: the last-known-good runtime continues and events remain durably queued.

After a compatible runtime update, Wibe automatically refreshes only its managed hook entries, MCP URL, activity section, project client metadata, and .wibe/integrations templates. Unrelated user configuration is preserved and changed files use temporary rollback snapshots during replacement. Installs created before the self-updater need one setup refresh with @wibeco/bridge@latest; later compatible releases require no pasted prompts or per-project maintenance.

WIBE_APP_URL overrides the default local Wibe URL during setup. WIBE_QUEUE_PATH optionally relocates the owner-only per-project queue directory. If a legacy file path is supplied, project queues are stored beside it under a .d suffix. CI and headless environments can inject WIBE_ACCESS_TOKEN, WIBE_PROJECT_ID, WIBE_ORGANIZATION_ID, WIBE_REPOSITORY_ID, and WIBE_DEVICE_ID; interactive developer machines should use the keychain-backed browser flow. Environment credentials are accepted only when they match that repository's .wibe/project.json.

Without a device credential, emit keeps normalized events in a repository-scoped pending queue. Setup adopts only that repository's pending events. Legacy identity-less queues are quarantined and reported by wibe doctor; they are never delivered into an arbitrary project.