Ninety days, twelve headline features

Three months ago a vibe was a front end you generated in a chat window. Since April 1, main has taken about 3,500 commits — 785 of them feature commits — and a vibe is now a synced multiplayer database, an access policy, a server, and an app you edit from inside itself. Here's the quarter in twelve headlines, each with a link to its deep dive.

1. Firefly — every vibe got a live database

The quarter opened with Firefly: per-vibe databases with React hooks and cross-client sync. Open the same app on two phones and a write on one appears on the other — no backend code, no polling. Everything else on this list stands on it.

2. access.js — the permission model is a file in your app

Who may read and write what used to be platform policy; now it's a file your app ships. access.js is parsed at push time, gates reads and writes server-side, and grant changes propagate live — open queries re-run the moment someone's access changes. Along the way we retired the account-based isOwner shortcut for handle-based grants, which took locking an owner out of their own vibe to get right. The codegen prompts learned the same lesson: apps default to author-owned, multiplayer data, not owner-gated silos.

3. backend.js — every vibe got a server

One more file next to App.jsx: export fetch to answer webhooks at your app's own /_api URL, onChange to react after any write commits, or scheduled to run on a timer. The design decision that matters: server writes go through your app's own access.js, acting as the identity that triggered them — so the permission model stays in one place. Full story: Every vibe just got a backend.

4. Editing moved into the app

We deleted the preview pane. Generation and editing now happen on the /vibe route, inside the running app — you watch the build stream into the page you're standing on, and the edit button stopped being a secret save loop. The chat route is no longer where apps live; the app is.

5. Remix, Clone, and the owner/viewer experience

Any vibe you can see, you can make yours: /remix forks an app into your account with its chat history seeded, Clone skips the chat entirely and lands you on your own /vibe route. Visitors get the same switch the owner uses — a "Make it your own…" box, suggestion chips, one-tap Home / Edit / Share. Edit a stranger's app, and it's yours.

6. The vibes-diy CLI

The vibes-diy CLI grew from a deploy script into a full round-trip: generate an app from a prompt, pull its source to disk, edit in your own editor (or your own agent), push it back live, and read or write its data from the terminal.

shnpx vibes-diy@latest generate "a shared grocery list" --app-slug groceries
cd groceries                # generate already wrote App.jsx + access.js here
# …edit in your own editor, or point your own agent at the files…
npx vibes-diy@latest push   # back to the live URL

Started in the browser instead? pull <handle>/<slug> brings that app's source to disk the same way. Web-generated apps and CLI edits share one source of truth, so you can start in the browser and finish in the terminal.

7. DMs and notifications

Vibes users can now message each other: a Messages inbox, per-thread unread counts, and direct channels built on the same Firefly substrate as app data. Around it, a real notification system — build completions, access requests, DMs — with per-user settings for each type.

8. We deleted our auth dependency

The device-id PKI, keybag, and token verifiers moved in-house from @fireproof/* into @vibes.diy/identity — proven byte-for-byte identical behind an unchanged facade before the cut, with zero call-site changes. CA-signature enforcement for device ids is now on in production. The how: We deleted our auth dependency. Nothing changed.

9. Server-side rendering for vibes

Vibes now render on the server via Cloudflare Worker Loaders — including multi-file apps with their relative-import graph resolved (#2845). Live in the preview environment as of this week: shared links paint content instead of a loading grid.

10. Env vars and secrets for apps

Apps can carry configuration now: settings-page env vars delivered as a live overlay with a useEnv() hook, and a write-only Secrets card — set, rotate, remove, never read back (#3047). The missing piece for vibes that talk to third-party APIs.

11. The generator got an eval harness

Prompt changes stopped being vibes-based (ironic, we know). The codegen system prompts are now generated from shared template parts, guarded by golden hashes, and every substantive change runs through an eval: one-shot and agentic modes, cross-model matrices, and scored side-by-sides. How we eval the generator.

12. This blog

The publishing pipeline you're reading is itself a feature of the quarter: markdown posts, generated index and feeds, branded title cards, and a workflow where every PR drops a blog seed so the stories get captured while they're true. Twenty-four posts since June 9.

And the ninety days ahead

Some of the next quarter is already visible: an iOS app that answers callAI with Apple's on-device models (shipping now), and billing groundwork running in shadow mode. And the proof that the whole stack holds up isn't a demo — it's that Pickathon adopted a fan-built vibe as its official festival planner.

If you want the meta-story of how one team ships at this rate, that's 270 PRs in 17 days.