@amirhosseinnateghi/vibed-mcp 0.1.2 → 0.1.3

package/dist/index.js

@@ -5986,6 +5986,18 @@ import { dirname, extname, isAbsolute, join, resolve } from "node:path";
 // ../sandbox/src/index.ts
 var import_node_html_parser = __toESM(require_dist(), 1);
 
+// ../shared/src/terms.ts
+var ITEM = {
+  /** lowercase singular — "vibe" */
+  one: "vibe",
+  /** lowercase plural — "vibes" */
+  many: "vibes",
+  /** Capitalized singular — "Vibe" */
+  One: "Vibe",
+  /** Capitalized plural — "Vibes" */
+  Many: "Vibes"
+};
+
 // ../shared/src/constants.ts
 var CATEGORIES = [
   "Game",
@@ -5998,10 +6010,13 @@ var CATEGORIES = [
   "Other"
 ];
 var VISIBILITY = ["public", "unlisted"];
+var COVER_MODES = ["image", "gif"];
 var EXPERIENCE_SOURCE = ["builder", "import", "remix"];
+var PUSH_PROVIDERS = ["webpush", "fcm", "apns"];
+var DEVICE_PLATFORMS = ["web", "ios", "android"];
 var config = {
-  ARTIFACT_MAX_BYTES: intEnv("ARTIFACT_MAX_BYTES", 3145728),
-  // 3 MB
+  ARTIFACT_MAX_BYTES: intEnv("ARTIFACT_MAX_BYTES", 8388608),
+  // 8 MB — headroom for an embedded audio track
   ARTIFACT_ALLOWED_ORIGINS: strEnv(
     "ARTIFACT_ALLOWED_ORIGINS",
     "fonts.googleapis.com,fonts.gstatic.com,cdnjs.cloudflare.com,cdn.jsdelivr.net,unpkg.com"
@@ -6024,6 +6039,19 @@ var config = {
   BUILDER_CLASSIFIER_MODEL: strEnv("BUILDER_CLASSIFIER_MODEL", "gemini-2.5-flash"),
   BUILDER_MAX_TOKENS: intEnv("BUILDER_MAX_TOKENS", 8192),
   BUILDER_MAX_MESSAGES: intEnv("BUILDER_MAX_MESSAGES", 30),
+  // Hard cap for a single build turn (across the model + one repair). The build
+  // runs detached from the request, so this — not the browser — is what stops a
+  // runaway/abandoned turn. The provider's own 90s per-stall timeout still applies.
+  // Never cut a LIVE generation — these two guards only catch dead work:
+  // stall = total silence (not even a keep-alive byte) long enough to mean the
+  // connection is dead (TCP half-open never errors on its own); the turn cap is
+  // a platform-cost safety ceiling for the whole turn incl. one repair pass.
+  BUILDER_STALL_TIMEOUT_MS: intEnv("BUILDER_STALL_TIMEOUT_MS", 3e5),
+  BUILDER_TURN_TIMEOUT_MS: intEnv("BUILDER_TURN_TIMEOUT_MS", 9e5),
+  // Once a build has run this long, the UI nudges the user to go explore, and on
+  // completion the server drops a notification (§7.1) — so a slow build never
+  // traps them staring at a spinner.
+  BUILDER_SLOW_MS: intEnv("BUILDER_SLOW_MS", 12e3),
   DEFAULT_LOCALE: strEnv("DEFAULT_LOCALE", "en")
 };
 function strEnv(key, fallback) {
@@ -6046,6 +6074,31 @@ function boolEnv(key, fallback) {
   return v === "true" || v === "1";
 }
 
+// ../shared/src/notifications.ts
+var NOTIF_VERB = {
+  like_milestone: `liked your ${ITEM.one}`,
+  comment: `commented on your ${ITEM.one}`,
+  reply: "replied to your comment",
+  follow: "started following you",
+  mention: "mentioned you",
+  remix: `remixed your ${ITEM.one}`
+};
+var SYSTEM_NOTIF = {
+  build_ready: { icon: "\u2728", text: "Your build is ready \u2014 tap to see it", tone: "info" },
+  build_failed: { icon: "\u26A0\uFE0F", text: "A build didn't finish \u2014 tap to try again", tone: "error" },
+  // Moderation reject (spec §9): the vibe never went live (or was pulled), so
+  // the inbox row must carry everything — title + reason arrive in the payload.
+  post_rejected: { icon: "\u{1F6AB}", text: `Your ${ITEM.one} didn't pass moderation`, tone: "error" }
+};
+var NOTIF_PREF_GROUPS = ["follow", "comments", "likes", "remixes", "builder"];
+var NOTIF_GROUP_LABEL = {
+  follow: { title: "New followers", hint: "when someone follows you" },
+  comments: { title: "Comments", hint: "comments, replies & mentions" },
+  likes: { title: "Likes", hint: `when your ${ITEM.many} hit like milestones` },
+  remixes: { title: "Remixes", hint: `when someone remixes your ${ITEM.one}` },
+  builder: { title: "Builder", hint: "when a build finishes or fails" }
+};
+
 // ../shared/src/policy.ts
 function boolEnv2(key, fallback) {
   const v = typeof process !== "undefined" ? process.env[key] : void 0;
@@ -10118,10 +10171,102 @@ var coerce = {
 };
 var NEVER = INVALID;
 
+// ../shared/src/storage.ts
+var STORAGE = {
+  /** Total shared bytes per post (values, serialized). */
+  SHARED_MAX_BYTES: intEnv("STORE_SHARED_MAX_BYTES", 1048576),
+  // 1 MB
+  /** Total shared records (rows) per post. */
+  SHARED_MAX_RECORDS: intEnv("STORE_SHARED_MAX_RECORDS", 5e3),
+  /** Serialized size cap for a single value. */
+  VALUE_MAX_BYTES: intEnv("STORE_VALUE_MAX_BYTES", 16384),
+  // 16 KB
+  /** Records a single author may hold in one post (anti-flood / anti-grief). */
+  AUTHOR_MAX_RECORDS: intEnv("STORE_AUTHOR_MAX_RECORDS", 100),
+  /** Distinct collections per post. */
+  MAX_COLLECTIONS: intEnv("STORE_MAX_COLLECTIONS", 32),
+  /** Local-tier budget per (post, identity) — enforced by the host broker. */
+  LOCAL_MAX_BYTES: intEnv("STORE_LOCAL_MAX_BYTES", 262144),
+  // 256 KB
+  /** Max records returnable in one query page. */
+  QUERY_MAX_LIMIT: intEnv("STORE_QUERY_MAX_LIMIT", 100),
+  /** Whether anonymous (logged-out) shared writes may be enabled per post. */
+  ANON_WRITES_AVAILABLE: boolEnv("STORE_ANON_WRITES_AVAILABLE", false)
+};
+var COLLECTION_RE = /^[a-z0-9][a-z0-9:_-]{0,63}$/;
+var collectionSchemaStore = external_exports.string().regex(COLLECTION_RE, "invalid collection name");
+var STORE_KEY_RE = /^[a-zA-Z0-9][a-zA-Z0-9:._-]{0,127}$/;
+var RESERVED_STORE_KEYS = ["submit", "rank", "increment"];
+var storeKeySchema = external_exports.string().regex(STORE_KEY_RE, "invalid key").refine((k) => !RESERVED_STORE_KEYS.includes(k), {
+  message: "reserved key"
+});
+var STORE_WRITE_POLICIES = ["anyone", "logged_in", "owner_only"];
+var STORE_SORTS = ["num", "-num", "created", "-created"];
+var storeValueSchema = external_exports.unknown().refine(
+  (v) => {
+    try {
+      const s = JSON.stringify(v);
+      return s !== void 0 && byteLength(s) <= STORAGE.VALUE_MAX_BYTES;
+    } catch {
+      return false;
+    }
+  },
+  { message: `value must be JSON-serializable and <= ${STORAGE.VALUE_MAX_BYTES} bytes` }
+);
+var storePutSchema = external_exports.object({
+  value: storeValueSchema,
+  /** Optimistic concurrency: fail with `conflict` unless current version matches. */
+  ifVersion: external_exports.number().int().positive().optional()
+});
+var storeAppendSchema = external_exports.object({
+  value: storeValueSchema,
+  /** Optional numeric field to index (sorting/leaderboards). */
+  num: external_exports.number().finite().optional()
+});
+var storeIncrementSchema = external_exports.object({
+  delta: external_exports.number().int().min(-1e6).max(1e6).default(1)
+});
+var storeSubmitSchema = external_exports.object({
+  /** The number that ranks this author (mapped into `num`). */
+  score: external_exports.number().finite(),
+  /** Conflict rule when the author already has a row. */
+  keep: external_exports.enum(["max", "min", "last"]).default("max"),
+  /** Small display payload stored alongside (same value-size gate). */
+  meta: storeValueSchema.optional()
+});
+var storeQuerySchema = external_exports.object({
+  sort: external_exports.enum(STORE_SORTS).default("-created"),
+  limit: external_exports.coerce.number().int().min(1).max(STORAGE.QUERY_MAX_LIMIT).default(30),
+  cursor: external_exports.string().max(200).optional(),
+  /** Only the caller's records. */
+  mine: external_exports.coerce.boolean().default(false)
+});
+var storeAdminSchema = external_exports.discriminatedUnion("action", [
+  external_exports.object({ action: external_exports.literal("freeze") }),
+  external_exports.object({ action: external_exports.literal("unfreeze") }),
+  external_exports.object({ action: external_exports.literal("set_policy"), writePolicy: external_exports.enum(STORE_WRITE_POLICIES) }),
+  external_exports.object({ action: external_exports.literal("set_anon_writes"), anonWrites: external_exports.boolean() }),
+  external_exports.object({ action: external_exports.literal("reset"), collection: collectionSchemaStore.optional() })
+]);
+var storageOptInSchema = external_exports.object({
+  local: external_exports.boolean().default(false),
+  shared: external_exports.boolean().default(false)
+});
+function byteLength(s) {
+  if (typeof TextEncoder !== "undefined") return new TextEncoder().encode(s).length;
+  let n = 0;
+  for (let i = 0; i < s.length; i++) {
+    const c = s.codePointAt(i);
+    n += c <= 127 ? 1 : c <= 2047 ? 2 : c <= 65535 ? 3 : (i++, 4);
+  }
+  return n;
+}
+
 // ../shared/src/schemas.ts
 var handleSchema = external_exports.string().regex(/^[a-z0-9_.]{3,24}$/, "3\u201324 chars: a\u2013z, 0\u20139, _ or .");
 var categorySchema = external_exports.enum(CATEGORIES);
 var visibilitySchema = external_exports.enum(VISIBILITY);
+var coverModeSchema = external_exports.enum(COVER_MODES);
 var sourceSchema = external_exports.enum(EXPERIENCE_SOURCE);
 var tagsSchema = external_exports.array(external_exports.string().min(1).max(40)).max(10).transform(
   (tags) => Array.from(
@@ -10135,8 +10280,12 @@ var publishSchema = external_exports.object({
   tags: tagsSchema,
   remixable: external_exports.boolean().default(true),
   visibility: visibilitySchema.default("public"),
+  coverMode: coverModeSchema.default("gif"),
   draftArtifactKey: external_exports.string().min(1),
-  buildSessionId: external_exports.string().uuid().optional()
+  buildSessionId: external_exports.string().uuid().optional(),
+  /** Storage opt-in override; when omitted, publish auto-detects from the source
+   *  (docs/post-storage.md §9 — default off, enabled only when actually used). */
+  storage: storageOptInSchema.optional()
 });
 var patchExperienceSchema = external_exports.object({
   title: external_exports.string().min(1).max(120).optional(),
@@ -10144,7 +10293,8 @@ var patchExperienceSchema = external_exports.object({
   tags: tagsSchema.optional(),
   category: categorySchema.optional(),
   remixable: external_exports.boolean().optional(),
-  visibility: visibilitySchema.optional()
+  visibility: visibilitySchema.optional(),
+  coverMode: coverModeSchema.optional()
 });
 var commentSchema = external_exports.object({
   body: external_exports.string().min(1).max(500),
@@ -10159,10 +10309,10 @@ var createBuildSchema = external_exports.object({
   remixParentId: external_exports.string().uuid().optional()
 });
 var builderAttachmentSchema = external_exports.object({
-  kind: external_exports.enum(["image", "file"]),
+  kind: external_exports.enum(["image", "file", "audio"]),
   name: external_exports.string().max(200),
-  dataUrl: external_exports.string().max(8e6).optional(),
-  // ~6MB image as base64 data URL
+  // base64 data URL for image/audio (~8.7MB raw fits, covering a short song).
+  dataUrl: external_exports.string().max(12e6).optional(),
   text: external_exports.string().max(5e4).optional()
 });
 var builderMessageSchema = external_exports.object({
@@ -10194,10 +10344,21 @@ var reportSchema = external_exports.object({
 var patchMeSchema = external_exports.object({
   displayName: external_exports.string().min(1).max(60).optional(),
   bio: external_exports.string().max(300).optional(),
-  avatar: external_exports.string().url().optional(),
+  // A stored image URL, or "" to remove the photo and fall back to the color avatar.
+  avatar: external_exports.string().url().or(external_exports.literal("")).optional(),
+  // Fallback avatar colour (used when there's no photo). Hex like #6C4CF1.
+  avatarBg: external_exports.string().regex(/^#[0-9a-fA-F]{6}$/, "hex colour, e.g. #6C4CF1").optional(),
   handle: handleSchema.optional()
   // once
 });
+var waitlistSchema = external_exports.object({
+  email: external_exports.string().trim().email().max(200),
+  note: external_exports.string().trim().max(500).optional()
+});
+var waitlistReviewSchema = external_exports.object({
+  requestId: external_exports.string().uuid(),
+  action: external_exports.enum(["approve", "reject"])
+});
 var aiConnectionSchema = external_exports.object({
   provider: external_exports.enum(AI_PROVIDERS),
   apiKey: external_exports.string().trim().min(12).max(300)
@@ -10211,28 +10372,185 @@ var feedQuerySchema = external_exports.object({
 var searchQuerySchema = external_exports.object({
   q: external_exports.string().default(""),
   tab: external_exports.enum(["experiences", "tags", "creators"]).default("experiences"),
-  remixableOnly: external_exports.coerce.boolean().default(false),
+  // Query params arrive as strings; z.coerce.boolean() is just Boolean(x), so
+  // "false"/"0" would (wrongly) become true and the filter could never be turned
+  // off. Parse the string explicitly: only "true"/"1" (or a real boolean) is true.
+  remixableOnly: external_exports.union([external_exports.boolean(), external_exports.string()]).optional().transform((v) => v === true || v === "true" || v === "1"),
   cursor: external_exports.string().optional(),
   limit: external_exports.coerce.number().int().min(1).max(30).default(15)
 });
+var registerPushDeviceSchema = external_exports.object({
+  provider: external_exports.enum(PUSH_PROVIDERS),
+  token: external_exports.string().trim().min(16).max(4096),
+  keys: external_exports.record(external_exports.string().max(512)).default({}),
+  platform: external_exports.enum(DEVICE_PLATFORMS).default("web"),
+  userAgent: external_exports.string().trim().max(400).default("")
+}).superRefine((v, ctx) => {
+  if (v.provider === "webpush" && (!v.keys.p256dh || !v.keys.auth)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["keys"],
+      message: "webpush requires keys.p256dh and keys.auth"
+    });
+  }
+});
+var unregisterPushDeviceSchema = external_exports.object({
+  token: external_exports.string().trim().min(16).max(4096)
+});
+var notificationsQuerySchema = external_exports.object({
+  filter: external_exports.enum(["all", "mentions", "remixes"]).default("all"),
+  // Keyset cursor: the `createdAt` ISO timestamp of the last item seen.
+  cursor: external_exports.string().datetime({ offset: true }).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(80).default(30)
+});
+var notifPrefsPatchSchema = external_exports.object({
+  enabled: external_exports.boolean().optional(),
+  groups: external_exports.record(external_exports.enum(NOTIF_PREF_GROUPS), external_exports.boolean()).optional()
+});
 
 // ../shared/src/models.ts
 var BUILDER_MODELS = [
-  // ── Free (selectable now) — good quality, reasonable price ─────────
-  { id: "claude-sonnet-4-20250514", label: "Claude Sonnet 4", tier: "free", note: "Best for polished HTML", vision: true },
-  { id: "gemini-2.5-flash", label: "Gemini 2.5 Flash", tier: "free", note: "Fast \xB7 great UI \xB7 cheap", vision: true },
-  { id: "gpt-4o-mini", label: "GPT-4o mini", tier: "free", note: "Cheap & reliable", vision: true },
-  { id: "gpt-5-mini", label: "GPT-5 mini", tier: "free", note: "Newer, capable", vision: true },
-  { id: "gpt-5.1-codex", label: "GPT-5.1 Codex", tier: "free", note: "Code specialist" },
+  // ── Free (selectable now) — ONLY genuinely strong builders ─────────
+  // Curated 2026-07: every id verified against GapGPT with a real full-HTML
+  // build (not a ping). Weak/cheap models were removed on purpose — a bad
+  // first build costs more in user trust than the tokens save.
+  { id: "claude-sonnet-4-5-20250929", label: "Claude Sonnet 4.5", tier: "free", note: "Best for polished vibes \xB7 fast", vision: true },
+  { id: "claude-sonnet-4-20250514", label: "Claude Sonnet 4", tier: "free", note: "Reliable all-rounder", vision: true },
+  { id: "gpt-5.2", label: "GPT-5.2", tier: "free", note: "Strong generalist", vision: true },
+  { id: "gpt-5.3-codex", label: "GPT-5.3 Codex", tier: "free", note: "Code specialist" },
+  { id: "gemini-2.5-pro", label: "Gemini 2.5 Pro", tier: "free", note: "Great UI sense", vision: true },
   { id: "deepseek-v4-pro", label: "DeepSeek V4 Pro", tier: "free", note: "Strong coder \xB7 great value" },
-  { id: "deepseek-v4-flash", label: "DeepSeek V4 Flash", tier: "free", note: "Fast \xB7 very cheap" },
-  { id: "gapgpt-qwen-3.6", label: "Qwen 3.6", tier: "free", note: "Good value" },
+  { id: "qwen3-coder-480b-a35b-instruct", label: "Qwen3 Coder 480B", tier: "free", note: "Fast, capable coder" },
   // ── Subscription (locked until billing is enabled) — premium ──────
-  { id: "claude-opus-4-8", label: "Claude Opus 4.8", tier: "subscription", note: "Top quality", vision: true },
+  // Opus 4.8 is owner-only early access: locked for everyone, live for the owner.
+  { id: "claude-opus-4-8", label: "Claude Opus 4.8", tier: "subscription", note: "Top quality", vision: true, ownerOnly: true },
   { id: "gpt-5.2-pro", label: "GPT-5.2 Pro", tier: "subscription", note: "Premium" },
   { id: "gemini-3-pro-preview", label: "Gemini 3 Pro", tier: "subscription", note: "Premium", vision: true }
 ];
 var FREE_IDS = new Set(BUILDER_MODELS.filter((m) => m.tier === "free").map((m) => m.id));
+var OWNER_MODEL_IDS = new Set(BUILDER_MODELS.filter((m) => m.ownerOnly).map((m) => m.id));
+
+// ../shared/src/i18n.ts
+var en = {
+  "nav.home": "Home",
+  "nav.search": "Search",
+  "nav.create": "Create",
+  "nav.notifications": "Notifications",
+  "nav.profile": "Profile",
+  "feed.explore": "Explore",
+  "feed.following": "Following",
+  "feed.tapToInteract": "Tap to interact",
+  "feed.loading": `Loading ${ITEM.one}`,
+  "feed.exit": "Exit",
+  "feed.remixedFrom": "Remixed from @{handle}",
+  "feed.remixedFromRemoved": `Remixed from a removed ${ITEM.one}`,
+  "feed.newVersionOf": "New version of {title}",
+  "feed.end.title": "You're all caught up",
+  "feed.end.body": `No new ${ITEM.many} right now \u2014 remix one you loved, or check back soon.`,
+  "feed.end.remix": "Find something to remix",
+  "feed.end.top": "Back to top",
+  "rail.like": "Like",
+  "rail.comment": "Comment",
+  "rail.remix": "Remix",
+  "rail.save": "Save",
+  "rail.share": "Share",
+  "comments.title": "Comments",
+  "comments.placeholder": "Add a comment\u2026",
+  "comments.reply": "Reply",
+  "comments.empty": "No comments yet \u2014 be the first.",
+  "comments.post": "Post",
+  "share.title": "Share",
+  "share.copyLink": "Copy link",
+  "share.copied": "Link copied",
+  "create.title": "Create",
+  "create.buildWithAI": "Build with AI",
+  "create.import": "Import",
+  "create.remix": "Remix something",
+  "create.prompt.placeholder": "Describe what you want to build\u2026",
+  "create.prompt.starters": "Start from a template",
+  "builder.publish": "Publish",
+  "builder.thinking": "Building\u2026",
+  "builder.updated": "Updated \u2713",
+  "builder.placeholder": "Ask for a change\u2026",
+  "builder.mockNotice": "Preview builder \u2014 AI generation is mocked for now.",
+  "import.title": "Import",
+  "import.paste": "Paste HTML, or drop an .html file",
+  "import.validate": "Validate",
+  "import.warnings": "Warnings",
+  "publish.title": "Publish",
+  "publish.postTitle": "Title",
+  "publish.caption": "Caption",
+  "publish.category": "Category",
+  "publish.remixable": "Allow remixes",
+  "publish.public": "Public",
+  "publish.unlisted": "Unlisted",
+  "publish.cta": "Publish",
+  "publish.remixCredit": "Remixing @{handle} \u2014 {title}",
+  "publish.toast.published": "Published! \u{1F389}",
+  "publish.toast.remix": "Remix published \u{1F501} @{handle} was credited",
+  "remix.confirmTitle": "Remixing @{handle}'s {title}",
+  "remix.confirmBody": `They'll be credited on your ${ITEM.one}. Attribution can't be removed.`,
+  "remix.start": "Start remixing",
+  "remix.galleryTitle": "Remixes",
+  "remix.sortPopular": "Popular",
+  "remix.sortRecent": "Recent",
+  "remix.count": "{n} remixes",
+  "remix.identicalWarn": "This looks identical to the original \u2014 publish anyway?",
+  "search.placeholder": `Search ${ITEM.many}, tags, creators`,
+  "search.tab.experiences": ITEM.Many,
+  "search.tab.tags": "Hashtags",
+  "search.tab.creators": "Creators",
+  "search.remixableOnly": "Remixable only",
+  "search.trending": "Trending",
+  "profile.tab.experiences": ITEM.Many,
+  "profile.tab.remixes": "Remixes",
+  "profile.tab.saved": "Saved",
+  "profile.followers": "followers",
+  "profile.following": "following",
+  "profile.likes": "likes",
+  "profile.follow": "Follow",
+  "profile.unfollow": "Following",
+  "profile.edit": "Edit profile",
+  "notifs.all": "All",
+  "notifs.mentions": "Mentions",
+  "notifs.remixes": "Remixes",
+  "notifs.remixedYou": `@{handle} remixed your ${ITEM.one}`,
+  "notifs.liked": `@{handle} liked your ${ITEM.one}`,
+  "notifs.commented": "@{handle} commented",
+  "notifs.followed": "@{handle} started following you",
+  "notifs.empty": "Nothing here yet.",
+  "collections.title": "Saved",
+  "collections.new": "New collection",
+  "analytics.title": "Analytics",
+  "analytics.views": "Views",
+  "analytics.plays": "Plays",
+  "analytics.playRate": "Play rate",
+  "analytics.avgTime": "Avg. time",
+  "analytics.likes": "Likes",
+  "analytics.comments": "Comments",
+  "analytics.shares": "Shares",
+  "analytics.saves": "Saves",
+  "analytics.remixes": "Remixes",
+  "post.options": `${ITEM.One} options`,
+  "post.analytics": "View analytics",
+  "post.edit": "Edit caption",
+  "post.delete": `Delete ${ITEM.one}`,
+  "post.deleteConfirm": `Delete this ${ITEM.one}? This can't be undone.`,
+  "post.captionPlaceholder": "Write a caption\u2026",
+  "auth.signIn": "Sign in",
+  "auth.google": "Continue with Google",
+  "auth.github": "Continue with GitHub",
+  "auth.dev": "Dev login",
+  "auth.needAccount": "Sign in to like, comment, and remix.",
+  "common.cancel": "Cancel",
+  "common.save": "Save",
+  "common.back": "Back",
+  "common.retry": "Retry",
+  "common.loading": "Loading\u2026",
+  "common.report": "Report",
+  "common.delete": "Delete",
+  "common.views": "{n} views"
+};
 
 // ../shared/src/tokens.ts
 var colors = {
@@ -10419,6 +10737,12 @@ function validate(html, opts) {
       }
     }
   }
+  if (/(localStorage|sessionStorage|indexedDB|document\s*\.\s*cookie)/.test(html)) {
+    warnings.push({
+      code: "BROWSER_STORAGE",
+      message: "Uses browser storage (localStorage/sessionStorage/indexedDB/cookies), which throws inside the vibed sandbox. Port persistence to window.vibed.storage (local per-viewer, shared collective)."
+    });
+  }
   const lower = html.toLowerCase();
   const hasCredField = root.querySelector('input[type="email"], input[type="text"], input[type="tel"]') != null && /(password|passcode|otp|verify|sign\s*in|log\s*in|account)/i.test(html);
   if (hasCredField) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amirhosseinnateghi/vibed-mcp",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "vibed MCP server — make it vibed from any MCP client (Codex, Cursor, Gemini, …): check, login, and publish tools",
   "license": "MIT",
   "type": "module",