skills/cooperative-vibe-coding/SKILL.md
Cooperative vibe coding across machines — real-time collaborative development with humans and AI agents. Covers current tools (Live Share, Code With Me, Zed, Cursor multiplayer, tmux), git-based async patterns, AI agent coordination, and the aspirational future of multi-human multi-agent development. Activate on: "pair programming", "vibe coding together", "collaborative coding", "mob programming", "remote pairing", "code together", "multiplayer coding", "Live Share", "Code With Me", "ensemble programming", "cooperative development". NOT for: building a real-time collaboration ENGINE (use real-time-collaboration-engine), git workflow mechanics (use git-best-practices), single-user AI coding assistance (use prompt-engineer).
npx skillsauth add curiositech/windags-skills cooperative-vibe-codingInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Cooperative vibe coding scales Andrej Karpathy's "vibe coding" to multiple humans and AI agents working on the same codebase simultaneously across machines. Choose sync vs async collaboration modes based on team constraints and coordinate multiple AI agents without conflicts.
Team Size ≤ 2, Same Timezone:
Team Size 3-5, Mixed Timezones:
Team Size >5:
Single Feature, Multiple Devs:
If feature can split cleanly:
→ Each dev gets worktree + dedicated agent
→ File-level claims prevent conflicts
If feature is intertwined:
→ One shared agent, multiple human reviewers
→ Driver controls agent, navigator reviews output
Multiple Features, Multiple Agents:
If features share interfaces:
→ Designate interface owner, others depend on them
→ Sync interface changes before implementing
If features are independent:
→ Full isolation via worktrees/branches
→ Integration branch for final merge
| Scenario | Primary Tool | Voice | Why | |----------|--------------|-------|-----| | 2 devs, Windows+Mac, <2hr session | VS Code Live Share | Discord/Zoom | Universal compatibility | | 2-4 devs, all Mac/Linux, >2hr | Zed | Built-in | Lowest latency, native voice | | Terminal-heavy workflow | tmux/SSH | External | Zero editor lag | | Cross-timezone async | Git + Loom | Async video | Time-shifted collaboration | | AI-heavy session | Cursor/Claude Code | External | AI-native editors |
Symptoms: Integration takes longer than development, constant git conflicts, agents overwriting each other
Diagnosis: No file-level coordination, sync points too infrequent (>45min), overlapping worktree scopes
Fix: Implement file claiming (Port Daddy/manual), reduce sync to 25min, use git worktree for true isolation
Symptoms: Long silences, one person passive, AI generates everything while humans watch Diagnosis: No active collaboration protocol, unclear driver/navigator roles, agents doing too much Fix: 25min rotation timer, navigator must review AI output aloud, limit agent scope to functions not features
Symptoms: 30+ minutes setting up Live Share, audio issues, extension conflicts, "it works on my machine" Diagnosis: Over-optimization for perfect setup vs. practical collaboration Fix: 5-minute setup rule - if tools don't work quickly, fall back to screen share + voice
Symptoms: Frustrated typing, cursor lag >500ms, constant "wait, what did you just do?", productivity drops Diagnosis: Too many concurrent editors, poor network conditions, wrong tool for bandwidth Fix: Check network (ping test), reduce active collaborators to 2-3, switch to screen share if lag persists
Symptoms: Frequent "wait, what are we building again?", duplicate work, misaligned implementation approaches Diagnosis: No shared mental model, insufficient sync points, parallel work without coordination Fix: Start each session with 5min goal alignment, document decisions in shared notes, 30min status checks
Setup: Alice (US West), Bob (US East), Chen (EU), David (Asia). Building JWT auth system with login/logout/refresh endpoints.
Decision Process:
Session Structure:
# Day 1: Alice + Bob (sync block, 2 hours)
# Set up auth architecture, define interfaces
git checkout -b feature/auth-system
# Create shared types and middleware stubs
# Alice: middleware/auth.ts, Bob: routes/auth.ts
# Sync every 30min, commit WIP to shared branch
# Handoff to Chen (async)
git commit -m "WIP: auth middleware scaffolded, routes stubbed
- AuthMiddleware interface defined in types/auth.ts
- validateJWT() needs implementation
- TODO: Chen implement token refresh logic in refresh.ts"
Chen's Session (4 hours later):
git pull origin feature/auth-system
# Chen works alone with Claude agent
claude "implement JWT refresh token logic, follow patterns in middleware/auth.ts"
# Chen tests, commits with detailed message for David
git commit -m "Refresh token implemented
- Added refreshJWT() to middleware/auth.ts
- Created /auth/refresh endpoint
- TODO: David add logout cleanup + session management"
Integration Issues Caught:
userId field, Bob's routes provided user_id (snake_case vs camelCase)What Novice Would Miss: No coordination protocol, each dev working in isolation, merge conflicts on shared files, interface mismatches discovered late.
What Expert Catches: Clear handoff messages, interface alignment checks, timezone-aware sync points, WIP commits that enable async collaboration.
Setup: Two devs + two AI agents hit deadlock during real-time collaboration. Both agents trying to modify same function simultaneously.
Symptoms Detected:
# Terminal output shows conflict:
[Claude-A] Modifying src/utils/validation.ts lines 23-45
[Claude-B] Modifying src/utils/validation.ts lines 30-50
[Git] error: Your local changes would be overwritten by merge
[LiveShare] Conflict in validation.ts
Expert Decision Process:
Ctrl+C in both terminals)git status and Live Share file locks - both agents claimed overlapping rangesRecovery Sequence:
# Alice (taking control)
git stash # Save Claude-A's work
# Bob
git checkout HEAD src/utils/validation.ts # Discard Claude-B's changes
# Coordination
Alice: "I'll finish validation.ts manually, can your agent work on auth.ts instead?"
Bob: "Yes, redirecting Claude to authentication logic"
# Resume with isolation
# Alice: manual coding on validation.ts
# Bob's Claude: working on src/middleware/auth.ts
# Sync point in 25min to review both changes
What Novice Would Miss: Panic, try to force-merge conflicts, restart entire session, blame tools.
What Expert Catches: Quick isolation, manual override of agents, clear communication, prevention protocol for future.
Before starting any cooperative coding session:
During the session:
After the session:
Do NOT use cooperative vibe coding for:
real-time-collaboration-enginegit-best-practicesprompt-engineercode-review-standardsWhen to delegate instead:
tools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.