vibecom CLI

One line to install. One question to answer. Then you just code.

██╗ ██╗██╗██████╗ ███████╗ ██████╗ ██████╗ ███╗ ███╗██║ ██║██║██╔══██╗██╔════╝██╔════╝██╔═══██╗████╗ ████║██║ ██║██║██████╔╝█████╗ ██║ ██║ ██║██╔████╔██║╚██╗ ██╔╝██║██╔══██╗██╔══╝ ██║ ██║ ██║██║╚██╔╝██║ ╚████╔╝ ██║██████╔╝███████╗╚██████╗╚██████╔╝██║ ╚═╝ ██║ ╚═══╝ ╚═╝╚═════╝ ╚══════╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝

installer — collects nothing

the community for AI builders

Your coding activity, counted — without handing over your code.

The CLI reads the session transcripts Claude Code, Codex and Kimi already write to your disk, adds up the numbers in them, and sends counters. Tokens, cost, lines, commits. Never a prompt, never a diff, never a file path. It turns work you have already done into a rank you have already earned.

$ curl -fsSL https://vibecom.build/setup.sh | bash

Read the source Read the installer Every field it sends

Requires: Node 20+
Installs: One file
Touches: Nothing else
Undo: vibecom unlink

The install, line by line

Scroll through it before you run it.

Below is the actual terminal session, printed by scroll instead of by time. Every line is what the installer and the CLI really print — the transcript is checked against their source. Stop wherever you like; the note under the terminal explains the line you are looking at.

Skip to what it collects ↓

Step 01 · the whole install

One line, and you are done typing.

This is the entire installation. It downloads a single self-contained Node script, checks it, and puts it on your PATH. There is no npm install, no package to add to a project, and nothing to configure afterwards.

What leaves your machine

Counters. That is the whole payload.

Collected at tier 1

token counts (input, output, cache read, cache creation)
cost in USD, derived on your machine from published list prices, plus how many tokens had no published rate
lines added, removed, and excluded, plus commit and detected merged-PR counts from the git history of repositories you link
git counters cover the full shipped history under your own git identity, and are counts alone — never file names, diffs, or commit messages
model names (e.g. claude-opus-5)
session count, first/last event times, active seconds by hour, and turns per session

Never collected, at any tier

source code or diffs
prompts or model responses
file paths, file names, or repository contents
shell commands or their output
environment variables, secrets, or credentials

These are structural, not policy: there is no code path that reads them. A test plants a secret string in a fixture transcript for every supported tool and fails the build if it survives parsing.

The tier is bound to the token and enforced on the server, on every request — the CLI is never trusted to send only what it promised. Two more values are attached by the server rather than claimed by the CLI: your username, from the token, and a project id, which is a machine-local salted hash. Your repository paths never leave your computer.

Where the numbers come from

Files your tools already wrote.

Claude Code

Session transcripts in ~/.claude/projects.

Codex

Rollout files in ~/.codex/sessions. Prompt text is never parsed.

Kimi

Session wire logs under ~/.kimi.

Conductor

On macOS, detects hosted Codex and Claude sessions without reading chat text.

Commit, line and pull-request counts come from git log run locally, on the repositories you track — commit metadata only, and only commits under your own git identity. Cost is computed on your machine from published list prices, so it is an API-equivalent figure rather than a bill.

If you want the wheel

Every command, and what it does.

Running vibecom with no arguments does everything. These exist for scripting, and for when you already know what you want.

vibecom: Sign in, connect, or change anything. The only one you need.
vibecom status: What is linked, what is trusted, what is reporting.
vibecom doctor: Check that tracking really works, end to end.
vibecom preview: Print the exact payload before anything is sent.
vibecom scan: Import usage from sessions since the last scan.
vibecom rescan: Re-import everything, correcting old timestamps.
vibecom demo: Play this whole flow as a simulation, changing nothing.
vibecom update: Pull the newest CLI from your server.
vibecom unlink: Stop collecting, and revoke the token server-side.
vibecom logout: Remove the stored credential from this machine.

When it does not work

Three things go wrong. All three say so.

command not found: vibecom

The binary is in ~/.local/bin, which is not on every PATH. The installer prints the line to add; it will not edit your shell profile for you.

export PATH="$HOME/.local/bin:$PATH"

Node.js 20+ is required

The CLI is one bundled Node script, so there is no npm install — but it does need a modern Node. brew install node on macOS, or nodejs.org anywhere else. The installer checks the version before it downloads anything.

Nothing is showing up on my profile

Run vibecom doctor. It checks the whole path end to end — credential, token, settings files, the server's answer — and names the step that failed rather than telling you something is wrong.

Stopping

Two commands, and it is over.

vibecom unlink: Stops collection and revokes the token server-side. The server rejects it on the next request.
vibecom logout: Removes this machine's stored credential. Linked projects keep their own tokens — unlink them too, or revoke them in Settings.

You can also revoke any project token from Settings without touching a terminal.

Do not take our word for it

Check the bundle you are about to run.

The build is byte-reproducible. Build the CLI from source and the checksum matches the one this site serves — so “the source is open” means something about the file that actually lands on your machine.

git clone https://github.com/DugboTek/vibecom-cli
cd vibecom-cli && npm install && npm test
npm run build && shasum -a 256 dist/cli.js
curl -fsSL https://vibecom.build/cli.js | shasum -a 256

npm test is the run that proves the parsers cannot leak transcript content, and that the field list in COLLECTION.md is the complete set the code can send.

The same thing, as text

The full session, start to finish.

Read the transcript— 12 steps

One line, and you are done typing.
This is the entire installation. It downloads a single self-contained Node script, checks it, and puts it on your PATH. There is no npm install, no package to add to a project, and nothing to configure afterwards.
```
$ curl -fsSL https://vibecom.build/setup.sh | bash
```

It says what it is before it does anything.

The wordmark sweeps in blue to lime, one stop per row, and the subtitle states the installer's entire job: it collects nothing. Installing the CLI turns no telemetry on anywhere.

  ██╗   ██╗██╗██████╗ ███████╗ ██████╗ ██████╗ ███╗   ███╗
  ██║   ██║██║██╔══██╗██╔════╝██╔════╝██╔═══██╗████╗ ████║
  ██║   ██║██║██████╔╝█████╗  ██║     ██║   ██║██╔████╔██║
  ╚██╗ ██╔╝██║██╔══██╗██╔══╝  ██║     ██║   ██║██║╚██╔╝██║
   ╚████╔╝ ██║██████╔╝███████╗╚██████╗╚██████╔╝██║ ╚═╝ ██║
    ╚═══╝  ╚═╝╚═════╝ ╚══════╝ ╚═════╝ ╚═════╝ ╚═╝     ╚═╝
  installer — collects nothing

Nothing is installed until all four pass.
Node 20 or newer, the download itself, then two checks on what arrived: the shebang says it is the CLI, and `node --check` parses it. Only then does the file move into place. A failure at any step exits without writing anything.
```
◆ checking prerequisites...
  ✔ node 22.14.0
◆ downloading from https://vibecom.build...
  ✔ downloaded 412K
◆ verifying...
  ✔ shebang and syntax
◆ installing...
  ✔ /Users/you/.local/bin/vibecom
```
Your machine is exactly as you left it.
An earlier installer appended OTLP exports to your shell profile, which quietly turned collection on for every repository on the machine — including employers'. That is gone. This one writes one file: the CLI itself.
```
  ✔ Nothing is being collected.
    Your shell profile, Claude Code settings, and Codex
    config were not touched.

  starting setup
  Your browser will open so you can sign in safely.
  You can change this anytime.
```

You never type a password into a terminal.

This is the OAuth device flow. The CLI asks vibecom for a short code, copies it to your clipboard, and opens your browser at a URL that already has the code filled in. You press Approve; GitHub handles the actual sign-in.

┌    welcome  
◆ contacting https://vibecom.build...
│
◇  Finish signing in in your browser

  ┌───────────────────┐
  │ K Q 7 M - P 4 T N │
  └───────────────────┘
  ✔ copied to your clipboard

  │  opened https://vibecom.build/device?code=KQ7M-P4TN
  │  the code is prefilled — just press Approve

Signing in stores a credential and nothing else.

There is a real gap between having an account and reporting activity, and the CLI holds it open on purpose. At this point vibecom knows who you are. It knows nothing about what you build.

◆ waiting for approval...
│
◇  signed in as chrismicah
│
◇  you're in ────────────────────────────────────────────────╮
│                                                            │
│  Signed in as chrismicah on https://vibecom.build.         │
│                                                            │
│  Nothing is being collected yet. Your shell profile,       │
│  Claude Code settings, and Codex config were not touched.  │
│                                                            │
├────────────────────────────────────────────────────────────╯

The scope is stated before it is granted.

Tracking is per machine, not per repository. Per-repository linking put an administrative step between you and the work you sat down to do, and forgetting it was silent — months of sessions that were simply never counted.

│
◇  ready to connect ────────────────────────────────────────────╮
│                                                               │
│  Tracking  every project on this computer                     │
│  Found     Claude Code + Codex                                │
│                                                               │
│  New projects count automatically — no setup per repository,  │
│  and worktrees are covered too.                               │
│                                                               │
│  Activity totals only. Never your code or prompts.            │
│  Exclude any project later with vibecom.                      │
│                                                               │
├───────────────────────────────────────────────────────────────╯

One yes. Nothing has been written yet.
Everything so far has been reversible by closing the terminal. This is the point where that changes, so it is a single explicit question with the consequence spelled out above it. Answer no and the CLI says so and exits, having changed nothing.
```
│
◆  Count tokens from every project on this machine?
│  ● Yes / ○ No
```
One scoped token, written to two config files.
The CLI mints an ingest token bound to a tier, then writes it where Claude Code and Codex will find it. Your repository paths never leave the machine — they are hashed against a salt generated locally, so the project id is meaningless to anyone else, including us.
```
◆ turning on tracking for this machine...
│
◇  ✔ tracking every project on this machine
```

It reads your history back, and draws you a flipbook.

Importing means every transcript on the machine off disk and a round trip per batch — real waiting. A spinner spends that time saying only “not finished”, so the CLI flips through a sketchbook of somebody building something instead.

                          .-~~~~~~~~-.
                         ,'  .-  .-  ',
                         | ( o )( o ) |
                         |    \..  /   |
                         |    '--'    |
                          '-.______.-'
                              |  |
                            __|  |__
               ,-'                             '-,
              /        .-----------------.        \
              |        |      writing    |        |
              |        |      index.ts   |        |
               \       '-----------------'       /
                \                               /
                 \                             /
                  \                           /
          ____________________________________________
          |  ,------------------------------------,  |
          |  |   _/\_                    _/\_     |  |
          |  | [][][][][][][][][][][][][][][][][] |  |
          |  '------------------------------------'  |
          |__________________________________________|
                 \______________________________/

Past sessions count. You start where you already are.

The scan reads sessions your tools recorded long before you had heard of vibecom, so the first thing the CLI shows you is a rank you already earned. Re-running it restates each session rather than adding to it — importing twice cannot inflate a total.

◆ importing your token history...
│
◇  ✔ imported 143 coding sessions
│
◇    your rank   ────────────────────────╮
│                                        │
│    ▲   Vibe Engineer  lv 6/18          │
│                                        │
│    ███████████▋············  49%       │
│    2.2M tokens to Sr Engineer          │
│                                        │
│    6.3M tokens   31 active days        │
│    🔥 12 day streak  ▁▃▂▇▅█▆█▇███      │
│                                        │
│    https://vibecom.build/u/chrismicah  │
│                                        │
├────────────────────────────────────────╯

It tells you that you are finished.

Setup used to end by dropping straight into a menu with an action preselected — nothing said the work had finished, and the highlighted row proposed more of it. Now the state comes first: what is true, where it shows up, and that there is nothing left to do.

│
◇  you're live ─────────────────────────────────────────────╮
│                                                           │
│  ✔ Signed in as chrismicah                                │
│  ✔ Collecting from every project on this computer         │
│     — new ones count automatically                        │
│  ✔ Reading Claude Code + Codex                            │
│                                                           │
│  You're set up. Just code — activity uploads on its own.  │
│  Your profile: https://vibecom.build/u/chrismicah         │
│                                                           │
│  Nothing else is required. Choose Done to exit.           │
│                                                           │
├───────────────────────────────────────────────────────────╯
│
◆  Nothing else is needed. Anything to change?
│  ● Done — start building
│  ○ Connect more projects
│  ○ See exactly what gets sent
└

Ready when you are.

Nothing is collected until you say yes, and one command undoes all of it.

$ curl -fsSL https://vibecom.build/setup.sh | bash

What is vibecom, anyway? →

Loading the next vibe…

vibecom CLI

Your coding activity, counted — without handing over your code.

Scroll through it before you run it.

One line, and you are done typing.

Counters. That is the whole payload.

Collected at tier 1

Never collected, at any tier

Files your tools already wrote.

Every command, and what it does.

Three things go wrong. All three say so.

command not found: vibecom

Node.js 20+ is required

Nothing is showing up on my profile

Two commands, and it is over.

Check the bundle you are about to run.

The full session, start to finish.

One line, and you are done typing.

It says what it is before it does anything.

Nothing is installed until all four pass.

Your machine is exactly as you left it.

You never type a password into a terminal.

Signing in stores a credential and nothing else.

The scope is stated before it is granted.

One yes. Nothing has been written yet.

One scoped token, written to two config files.

It reads your history back, and draws you a flipbook.

Past sessions count. You start where you already are.

It tells you that you are finished.

vibecom CLI

Your coding activity, counted — without handing over your code.

Scroll through it before you run it.

One line, and you are done typing.

Counters. That is the whole payload.

Collected at tier 1

Never collected, at any tier

Files your tools already wrote.

Every command, and what it does.

Three things go wrong. All three say so.

command not found: vibecom

Node.js 20+ is required

Nothing is showing up on my profile

Two commands, and it is over.

Check the bundle you are about to run.

The full session, start to finish.

One line, and you are done typing.

It says what it is before it does anything.

Nothing is installed until all four pass.

Your machine is exactly as you left it.

You never type a password into a terminal.

Signing in stores a credential and nothing else.

The scope is stated before it is granted.

One yes. Nothing has been written yet.

One scoped token, written to two config files.

It reads your history back, and draws you a flipbook.

Past sessions count. You start where you already are.

It tells you that you are finished.