@somacheck/vibecheck 0.3.0 → 0.4.0

package/README.md

@@ -9,7 +9,7 @@ Your agent has your context. It does not have your gut. This is the bridge.
 
 Fair. Here is what you need, without executing anything.
 
-**What the `link` command does.** `npx -y @somacheck/vibecheck@0.3.0 link <CODE> --client <CLIENT>`
+**What the `link` command does.** `npx -y @somacheck/vibecheck@0.4.0 link <CODE> --client <CLIENT>`
 exchanges a short-lived pairing code, generated inside the SomaCheck iOS app, for
 a bearer token. It writes that token to `~/.sensie/config.json` with mode `0600`,
 offers to configure supported agent clients found on the computer, and checks the
@@ -72,9 +72,9 @@ before the pairing code is redeemed.
 To configure or repair a client later:
 
 ```text
-npx -y @somacheck/vibecheck@0.3.0 setup codex
-npx -y @somacheck/vibecheck@0.3.0 setup claude
-npx -y @somacheck/vibecheck@0.3.0 doctor
+npx -y @somacheck/vibecheck@0.4.0 setup codex
+npx -y @somacheck/vibecheck@0.4.0 setup claude
+npx -y @somacheck/vibecheck@0.4.0 doctor
 ```
 
 Manual registration remains available:
@@ -84,13 +84,13 @@ Manual registration remains available:
      "mcpServers": {
        "vibecheck": {
          "command": "npx",
-        "args": ["-y", "@somacheck/vibecheck@0.3.0", "serve", "--client", "codex"]
+        "args": ["-y", "@somacheck/vibecheck@0.4.0", "serve", "--client", "codex"]
        }
      }
    }
    ```
 
-   For Claude Code: `claude mcp add --scope user vibecheck -- npx -y @somacheck/vibecheck@0.3.0 serve --client claude`
+   For Claude Code: `claude mcp add --scope user vibecheck -- npx -y @somacheck/vibecheck@0.4.0 serve --client claude`
 
 The link step writes only the bearer token in `~/.sensie/config.json`. The client
 setup step asks Codex or Claude to add the pinned MCP command to that client's own

package/dist/api.js

@@ -128,6 +128,75 @@ function parseStatus(row) {
         },
     };
 }
+/** Shared strict decoders used by both local stdio and hosted OAuth MCP. */
+export function decodeVibecheckStatus(value) {
+    return parseStatus(asObject(value));
+}
+export function decodeCreatedRequests(value) {
+    return allRows(value).map((row) => {
+        const presentationState = requiredString(row, "presentation_state");
+        if (presentationState !== "presented" && presentationState !== "queued") {
+            throw new Error("SomaCheck returned an incomplete response.");
+        }
+        return {
+            request_id: requiredString(row, "request_id"),
+            presentation_state: presentationState,
+            stale_at: nullableString(row, "expires_at"),
+        };
+    });
+}
+export function decodePollResponse(value) {
+    const row = asObject(value);
+    const status = row.status;
+    if (typeof status !== "string" || !STATUSES.has(status)) {
+        throw new Error("SomaCheck returned an invalid request status.");
+    }
+    const verdict = row.verdict;
+    const confidence = row.confidence;
+    const latency = row.latency_s;
+    if (verdict !== null && (typeof verdict !== "string" || !VERDICTS.has(verdict))) {
+        throw new Error("SomaCheck returned an invalid verdict.");
+    }
+    if (confidence !== null && (typeof confidence !== "number" || !Number.isFinite(confidence))) {
+        throw new Error("SomaCheck returned an invalid confidence.");
+    }
+    if (latency !== null && (typeof latency !== "number" || !Number.isFinite(latency) || latency < 0)) {
+        throw new Error("SomaCheck returned an invalid latency.");
+    }
+    if (status === "answered") {
+        if (verdict === null || confidence === null || confidence < 0 || confidence > 1 || latency === null) {
+            throw new Error("SomaCheck returned an incomplete answered result.");
+        }
+    }
+    else if (verdict !== null || confidence !== null || latency !== null) {
+        throw new Error("SomaCheck returned an inconsistent pending result.");
+    }
+    return {
+        status: status,
+        verdict: verdict,
+        confidence: confidence,
+        latency_s: latency,
+    };
+}
+export function decodeVibecheckContext(value) {
+    return allRows(value).map((row) => {
+        const verdict = requiredString(row, "verdict");
+        const confidence = requiredNumber(row, "confidence");
+        if (!VERDICTS.has(verdict)) {
+            throw new Error("SomaCheck returned an invalid verdict.");
+        }
+        if (confidence < 0 || confidence > 1) {
+            throw new Error("SomaCheck returned an invalid confidence.");
+        }
+        return {
+            request_id: requiredString(row, "request_id"),
+            statement: requiredString(row, "statement"),
+            verdict: verdict,
+            confidence,
+            answered_at: requiredTimestamp(row, "answered_at"),
+        };
+    });
+}
 function parseHandshake(row) {
     const readinessStatus = requiredString(row, "readiness_status");
     if (!HANDSHAKE_READINESS_STATUSES.has(readinessStatus)) {
@@ -165,74 +234,16 @@ export class SupabaseAgentApi {
         return requiredString(row, "token");
     }
     async createRequests(token, statements) {
-        const rows = await this.#rpcRows("agent_proposition_batch_create", { token, statements });
-        return rows.map((row) => {
-            const presentationState = requiredString(row, "presentation_state");
-            if (presentationState !== "presented" && presentationState !== "queued") {
-                throw new Error("SomaCheck returned an incomplete response.");
-            }
-            return {
-                request_id: requiredString(row, "request_id"),
-                presentation_state: presentationState,
-                stale_at: nullableString(row, "expires_at"),
-            };
-        });
+        return decodeCreatedRequests(await this.#rpcJson("agent_proposition_batch_create", { token, statements }));
     }
     async pollRequest(token, requestId) {
-        const row = await this.#rpc("agent_proposition_result", { token, proposition_id: requestId });
-        const status = row.status;
-        if (typeof status !== "string" || !STATUSES.has(status)) {
-            throw new Error("SomaCheck returned an invalid request status.");
-        }
-        const verdict = row.verdict;
-        const confidence = row.confidence;
-        const latency = row.latency_s;
-        if (verdict !== null && (typeof verdict !== "string" || !VERDICTS.has(verdict))) {
-            throw new Error("SomaCheck returned an invalid verdict.");
-        }
-        if (confidence !== null && (typeof confidence !== "number" || !Number.isFinite(confidence))) {
-            throw new Error("SomaCheck returned an invalid confidence.");
-        }
-        if (latency !== null && (typeof latency !== "number" || !Number.isFinite(latency) || latency < 0)) {
-            throw new Error("SomaCheck returned an invalid latency.");
-        }
-        if (status === "answered") {
-            if (verdict === null || confidence === null || confidence < 0 || confidence > 1 || latency === null) {
-                throw new Error("SomaCheck returned an incomplete answered result.");
-            }
-        }
-        else if (verdict !== null || confidence !== null || latency !== null) {
-            throw new Error("SomaCheck returned an inconsistent pending result.");
-        }
-        return {
-            status: status,
-            verdict: verdict,
-            confidence: confidence,
-            latency_s: latency,
-        };
+        return decodePollResponse(await this.#rpc("agent_proposition_result", { token, proposition_id: requestId }));
     }
     async statusRequest(token) {
-        return parseStatus(await this.#rpc("agent_proposition_cache_status", { token }));
+        return decodeVibecheckStatus(await this.#rpc("agent_proposition_cache_status", { token }));
     }
     async contextRequest(token, limit = 20) {
-        const rows = await this.#rpcRows("agent_proposition_context", { token, p_limit: limit });
-        return rows.map((row) => {
-            const verdict = requiredString(row, "verdict");
-            const confidence = requiredNumber(row, "confidence");
-            if (!VERDICTS.has(verdict)) {
-                throw new Error("SomaCheck returned an invalid verdict.");
-            }
-            if (confidence < 0 || confidence > 1) {
-                throw new Error("SomaCheck returned an invalid confidence.");
-            }
-            return {
-                request_id: requiredString(row, "request_id"),
-                statement: requiredString(row, "statement"),
-                verdict: verdict,
-                confidence,
-                answered_at: requiredTimestamp(row, "answered_at"),
-            };
-        });
+        return decodeVibecheckContext(await this.#rpcJson("agent_proposition_context", { token, p_limit: limit }));
     }
     async clientHandshake(token, input) {
         const row = await this.#rpc("agent_client_handshake", {

package/dist/cli.js

@@ -5,7 +5,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { SupabaseAgentApi } from "./api.js";
 import { clientDisplayName, detectInstalledClients, detectLegacyHostedRegistration, LocalCommandRunner, manualLegacyHostedRemoveCommand, manualRemoveCommand, manualSetupCommand, parseClientChoice, preflightClientPersistence, registerClient, singleNonInteractiveClientSelection, } from "./client-setup.js";
 import { readConfig } from "./config.js";
-import { SUPABASE_PUBLISHABLE_KEY, SUPABASE_URL } from "./constants.js";
+import { PACKAGE_SPEC, SUPABASE_PUBLISHABLE_KEY, SUPABASE_URL } from "./constants.js";
 import { LinkPersistenceError, NonInteractiveLinkError, linkAgent } from "./link.js";
 import { checkReadiness } from "./readiness.js";
 import { createVibecheckServer } from "./server.js";
@@ -100,6 +100,13 @@ async function preflightLinkClients(clients, interactive) {
     const selectedClients = interactive
         ? clients === "prompt" ? [] : clients
         : nonInteractiveClient === null ? [] : [nonInteractiveClient];
+    if (selectedClients.length > 1) {
+        throw new ClientPreflightError([
+            "Not linking yet: each local agent needs its own independently revocable pairing code.",
+            "Link Claude and Codex separately so one credential is never shared between them.",
+            "The pairing code has NOT been used.",
+        ].join("\n"));
+    }
     if (selectedClients.length === 0) {
         throw new ClientPreflightError([
             interactive
@@ -108,8 +115,8 @@ async function preflightLinkClients(clients, interactive) {
             "",
             "Run the command in Terminal, or paste it into the local agent with exactly one",
             "client selection, for example:",
-            "  npx -y @somacheck/vibecheck@0.3.0 link <CODE> --client claude",
-            "  npx -y @somacheck/vibecheck@0.3.0 link <CODE> --client codex",
+            `  npx -y ${PACKAGE_SPEC} link <CODE> --client claude`,
+            `  npx -y ${PACKAGE_SPEC} link <CODE> --client codex`,
             "",
             "The pairing code has NOT been used.",
         ].join("\n"));
@@ -142,7 +149,7 @@ async function preflightLinkClients(clients, interactive) {
                 ? `${clientDisplayName(client)} has an existing "vibecheck" MCP entry with a different command or version.`
                 : `${clientDisplayName(client)} configuration could not be inspected and written.`;
         const repair = preflight.status === "needs_update"
-            ? ["", `Remove the stale entry: ${manualRemoveCommand(client)}`, `Then configure 0.3: ${manualSetupCommand(client)}`]
+            ? ["", `Remove the stale entry: ${manualRemoveCommand(client)}`, `Then configure the current version: ${manualSetupCommand(client)}`]
             : [];
         throw new ClientPreflightError([
             `Not linking here: ${reason}`,
@@ -160,7 +167,7 @@ async function runDoctor() {
     return readiness.ready;
 }
 async function refreshRuntimeHealth(client) {
-    const token = (await readConfig(homedir())).token;
+    const token = (await readConfig(homedir(), client)).token;
     await api.statusRequest(token);
     await api.contextRequest(token);
     await api.clientHandshake(token, {
@@ -174,7 +181,7 @@ async function refreshRuntimeHealth(client) {
 async function startServer(runtimeClient) {
     const server = createVibecheckServer({
         api,
-        loadToken: async () => (await readConfig(homedir())).token,
+        loadToken: async () => (await readConfig(homedir(), runtimeClient ?? undefined)).token,
     });
     await server.connect(new StdioServerTransport());
     if (runtimeClient !== null) {
@@ -196,15 +203,14 @@ async function main() {
                 ? await promptForClients(await detectInstalledClients(runner))
                 : requestedClients
             : requestedClients;
+        const selectedClients = await preflightLinkClients(requestedOrPromptedClients, interactive);
         await linkAgent(args[1] ?? "", {
             home: homedir(),
             redeem: (code) => api.redeemLink(code),
             output,
             isInteractive: () => interactive,
             allowNonInteractive: !interactive || process.env.SOMACHECK_ALLOW_NON_INTERACTIVE === "1",
-            preflight: async () => {
-                await preflightLinkClients(requestedOrPromptedClients, interactive);
-            },
+            client: selectedClients[0],
         });
         return (await runDoctor()) ? 0 : 2;
     }

package/dist/client-setup.js

@@ -124,7 +124,7 @@ function isManagedSomaCheckRegistration(client, stdout) {
         return false;
     const packageArgs = args.filter((arg) => arg.startsWith("@somacheck/vibecheck@"));
     return packageArgs.length === 1
-        && /^@somacheck\/vibecheck@0\.[0-2]\.\d+$/.test(packageArgs[0])
+        && /^@somacheck\/vibecheck@0\.[0-3]\.\d+$/.test(packageArgs[0])
         && args.every((arg) => arg === "-y" || arg === "--yes" || arg === packageArgs[0]);
 }
 export async function isClientRegistered(client, runner) {

package/dist/config.js

@@ -20,7 +20,7 @@ export async function preflightConfigPersistence(home) {
         await rm(renamedProbe, { force: true });
     }
 }
-export async function readConfig(home) {
+export async function readConfig(home, client) {
     let value;
     try {
         value = JSON.parse(await readFile(configPath(home), "utf8"));
@@ -28,23 +28,41 @@ export async function readConfig(home) {
     catch {
         throw new Error("SomaCheck is not linked. Run: npx -y @somacheck/vibecheck link <CODE>");
     }
-    if (value === null || typeof value !== "object" || !("token" in value)) {
+    if (value === null || typeof value !== "object") {
         throw new Error("SomaCheck link configuration is invalid.");
     }
-    const token = value.token;
+    // 0.3.0 legacy config. Keep reading it so existing installations do not
+    // break, but every new link is written in the client-scoped v2 shape.
+    if ("token" in value) {
+        return validatedToken(value.token);
+    }
+    const stored = value;
+    if (stored.version !== 2 || stored.connections === null || typeof stored.connections !== "object") {
+        throw new Error("SomaCheck link configuration is invalid.");
+    }
+    const selected = client ?? stored.default_client;
+    if (selected !== "codex" && selected !== "claude") {
+        throw new Error("SomaCheck link configuration is invalid.");
+    }
+    return validatedToken(stored.connections[selected]?.token);
+}
+function validatedToken(token) {
     if (typeof token !== "string" || token.length === 0) {
         throw new Error("SomaCheck link configuration is invalid.");
     }
     return { token };
 }
-export async function writeConfig(home, config) {
+export async function writeConfig(home, config, client) {
     const directory = join(home, ".sensie");
     const destination = configPath(home);
     const temporary = join(directory, `.config.json.${process.pid}.${Date.now()}.tmp`);
     await mkdir(directory, { recursive: true, mode: 0o700 });
     await chmod(directory, 0o700);
     try {
-        await writeFile(temporary, `${JSON.stringify(config, null, 2)}\n`, {
+        const stored = client === undefined
+            ? config
+            : await mergedClientConfig(home, client, config);
+        await writeFile(temporary, `${JSON.stringify(stored, null, 2)}\n`, {
             encoding: "utf8",
             flag: "wx",
             mode: 0o600,
@@ -56,4 +74,27 @@ export async function writeConfig(home, config) {
         await rm(temporary, { force: true });
     }
 }
+async function mergedClientConfig(home, client, config) {
+    let connections = {};
+    try {
+        const parsed = JSON.parse(await readFile(configPath(home), "utf8"));
+        if (parsed !== null && typeof parsed === "object" && "version" in parsed && parsed.version === 2
+            && "connections" in parsed && parsed.connections !== null && typeof parsed.connections === "object") {
+            const existing = parsed.connections;
+            for (const key of ["codex", "claude"]) {
+                const candidate = existing[key]?.token;
+                if (typeof candidate === "string" && candidate.length > 0) {
+                    connections[key] = { token: candidate };
+                }
+            }
+        }
+    }
+    catch {
+        // Missing or legacy config is intentionally migrated by the new link.
+        // A legacy token cannot be attributed safely to a client, so it remains
+        // readable until the first scoped link and is then replaced.
+    }
+    connections = { ...connections, [client]: config };
+    return { version: 2, default_client: client, connections };
+}
 //# sourceMappingURL=config.js.map

package/dist/constants.js

@@ -2,7 +2,7 @@
 export const SUPABASE_URL = "https://pbldcmniommltbdwuykk.supabase.co";
 export const SUPABASE_PUBLISHABLE_KEY = "sb_publishable_af-lUNI2FqEcb-oGy-4uxQ_cnm6kY85";
 export const PACKAGE_NAME = "@somacheck/vibecheck";
-export const PACKAGE_VERSION = "0.3.0";
+export const PACKAGE_VERSION = "0.4.0";
 export const PACKAGE_SPEC = `${PACKAGE_NAME}@${PACKAGE_VERSION}`;
 export const MCP_SERVER_NAME = "vibecheck";
 export const LEGACY_HOSTED_MCP_SERVER_NAME = "somacheck";

package/dist/link.js

@@ -54,7 +54,7 @@ export async function linkAgent(code, dependencies) {
         throw new LinkPersistenceError();
     }
     const token = await dependencies.redeem(normalizedCode);
-    await writeConfig(dependencies.home, { token });
+    await writeConfig(dependencies.home, { token }, dependencies.client);
     dependencies.output("SomaCheck pairing code redeemed on this computer.");
 }
 //# sourceMappingURL=link.js.map

package/dist/server.js

@@ -2,7 +2,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { StatementPendingError } from "./vibecheck.js";
 import { SomaCheckCompatibilityError, SomaCheckHttpError } from "./api.js";
-import { PACKAGE_NAME, PACKAGE_VERSION } from "./constants.js";
+import { PACKAGE_NAME, PACKAGE_SPEC, PACKAGE_VERSION } from "./constants.js";
 const cadenceSchema = z.object({
     reason: z.string(),
     create_due_at: z.string().nullable(),
@@ -202,7 +202,7 @@ function failureMessage(operation, error) {
     return failure(operationalFailureText(operation, error));
 }
 function operationalFailureText(operation, error) {
-    const doctor = "Run: npx -y @somacheck/vibecheck@0.3.0 doctor";
+    const doctor = `Run: npx -y ${PACKAGE_SPEC} doctor`;
     if (error instanceof SomaCheckCompatibilityError) {
         return `Could not ${operation}: this MCP package and the SomaCheck backend are incompatible. ${doctor}`;
     }

package/package.json

@@ -1,7 +1,12 @@
 {
   "name": "@somacheck/vibecheck",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Ask your embodied sense for an answer through SomaCheck.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sensie-app/Somacheck.git",
+    "directory": "packages/vibecheck"
+  },
   "type": "module",
   "bin": {
     "vibecheck": "dist/cli.js"
@@ -13,8 +18,8 @@
     "dist/*.js"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "test": "npm run build && node --import tsx --test test/*.test.ts && node --test test/server.test.mjs",
+    "build": "rm -rf dist && tsc -p tsconfig.json",
+    "test": "npm run build && node --import tsx --test test/*.test.ts && node --test test/*.test.mjs",
     "test:release-artifacts": "bash ./verify-release-artifacts.sh",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "prepack": "npm run build"