@somacheck/vibecheck 0.4.0 → 0.5.0

package/README.md

@@ -9,13 +9,13 @@ Your agent has your context. It does not have your gut. This is the bridge.
 
 Fair. Here is what you need, without executing anything.
 
-**What the `link` command does.** `npx -y @somacheck/vibecheck@0.4.0 link <CODE> --client <CLIENT>`
+**What the `link` command does.** `npx -y @somacheck/vibecheck@0.5.0 link <CODE> --client <CLIENT>`
 exchanges a short-lived pairing code, generated inside the SomaCheck iOS app, for
 a bearer token. It writes that token to `~/.sensie/config.json` with mode `0600`,
 offers to configure supported agent clients found on the computer, and checks the
 connection without printing the token. Setup is not reported ready until the
 selected client has the exact pinned `vibecheck` MCP registration, the backend
-accepts protocol `3` / toolset `vibecheck-0.3`, and both status and context
+accepts protocol `4` / toolset `vibecheck-0.5`, and both status and context
 probes succeed. It contacts exactly one network host: the Supabase project below.
 
 **It will refuse unsafe sandbox linking, on purpose.** `link` checks safety
@@ -32,13 +32,17 @@ and that its persistent MCP config can be inspected and written. If that preflig
 fails, the pairing code is not used. Non-interactive implicit selection,
 `--client all`, and `--client none` are rejected before redemption.
 
-**What the server does once running.** It exposes MCP tools that create a
-statement for the user to test, read its outcome, recover recent completed
-gesture context, and keep a three-statement feed stocked. That is the whole
-surface.
-
-**What is sent.** A question string you supply, and a bearer token identifying
-the link. **What is never sent: raw sensor data.** The agent receives a verdict
+**What the server does once running.** It exposes MCP tools that share bounded,
+user-authorized context summaries, create a statement for the user to test,
+read its outcome, recover recent completed gesture context, and keep a
+three-statement feed stocked.
+
+**What is sent.** A statement string, bounded derived context observations the
+agent explicitly shares, and a bearer token identifying the link. Tool
+instructions forbid raw conversations, photos, identifiers, and diagnostic
+claims; the backend enforces the bounded capsule shape and rejects
+secret-shaped content. **What is never sent: raw sensor
+data.** The agent receives a verdict
 (`aligned` / `unaligned`) plus a confidence percentage and latency. Model
 abstention is a failed capture, never a third user-facing outcome.
 Accelerometer and gyroscope streams never leave the user's device through this
@@ -72,9 +76,9 @@ before the pairing code is redeemed.
 To configure or repair a client later:
 
 ```text
-npx -y @somacheck/vibecheck@0.4.0 setup codex
-npx -y @somacheck/vibecheck@0.4.0 setup claude
-npx -y @somacheck/vibecheck@0.4.0 doctor
+npx -y @somacheck/vibecheck@0.5.0 setup codex
+npx -y @somacheck/vibecheck@0.5.0 setup claude
+npx -y @somacheck/vibecheck@0.5.0 doctor
 ```
 
 Manual registration remains available:
@@ -84,13 +88,13 @@ Manual registration remains available:
      "mcpServers": {
        "vibecheck": {
          "command": "npx",
-        "args": ["-y", "@somacheck/vibecheck@0.4.0", "serve", "--client", "codex"]
+        "args": ["-y", "@somacheck/vibecheck@0.5.0", "serve", "--client", "codex"]
        }
      }
    }
    ```
 
-   For Claude Code: `claude mcp add --scope user vibecheck -- npx -y @somacheck/vibecheck@0.4.0 serve --client claude`
+   For Claude Code: `claude mcp add --scope user vibecheck -- npx -y @somacheck/vibecheck@0.5.0 serve --client claude`
 
 The link step writes only the bearer token in `~/.sensie/config.json`. The client
 setup step asks Codex or Claude to add the pinned MCP command to that client's own
@@ -98,7 +102,7 @@ configuration; it never copies the bearer token there. The interactive command
 completes both steps. Most clients only pick up a new server after restart.
 
 If `doctor` reports another MCP server named `somacheck`, that is the legacy
-hosted connector and is not part of this local 0.3 release. The setup command
+hosted connector and is separate from this local package. The setup command
 will explain it and leave it alone. The canonical local MCP key is `vibecheck`.
 
 ## Tools
@@ -107,6 +111,7 @@ will explain it and leave it alone. The canonical local MCP key is `vibecheck`.
 |---|---|
 | `get_vibecheck_context` | Read recent completed gestures for this exact agent link without retaining every `request_id`. |
 | `get_vibecheck_status` | Read the live three-proposition cache and how many distinct insights it needs. |
+| `share_somacheck_context` | Share 1–20 bounded, derived, user-authorized observations; raw conversations and secrets are rejected. |
 | `post_vibecheck_statement` | Add one to three personalized statements without blocking; returns a stable `request_id` for each. |
 | `get_vibecheck_result` | Read that exact proposition once by `request_id`; returns queued, pending, or its terminal result. |
 

package/dist/api.js

@@ -10,6 +10,16 @@ const HANDSHAKE_READINESS_STATUSES = new Set([
     "setup_incomplete",
     "health_check_failed",
 ]);
+const CONTEXT_CATEGORY = {
+    goal: "goals_projects", project: "goals_projects",
+    decision: "decisions_commitments", commitment: "decisions_commitments",
+    tension: "tensions_questions_blind_spots", question: "tensions_questions_blind_spots",
+    blindSpot: "tensions_questions_blind_spots",
+    relationship: "relationships_situational", situation: "relationships_situational",
+    change: "changes_deadlines_developments", deadline: "changes_deadlines_developments",
+    development: "changes_deadlines_developments", moodTheme: "emotional_mood_themes",
+    preference: "corrections_dismissals_saves_preferences",
+};
 export class SomaCheckHttpError extends Error {
     status;
     constructor(status) {
@@ -220,6 +230,24 @@ function parseHandshake(row) {
     }
     return result;
 }
+export function decodeAgentContextShare(value) {
+    const row = firstRow(value);
+    const state = requiredString(row, "state");
+    if (state !== "ready")
+        throw new Error("SomaCheck returned an invalid context state.");
+    const observationCount = requiredInteger(row, "observation_count");
+    if (observationCount < 1 || observationCount > 20) {
+        throw new Error("SomaCheck returned an invalid observation count.");
+    }
+    return {
+        source_id: requiredString(row, "source_id"),
+        entry_id: requiredString(row, "entry_id"),
+        accepted: requiredBoolean(row, "accepted"),
+        state,
+        observation_count: observationCount,
+        captured_at: requiredTimestamp(row, "captured_at"),
+    };
+}
 export class SupabaseAgentApi {
     #endpoint;
     #apiKey;
@@ -245,8 +273,27 @@ export class SupabaseAgentApi {
     async contextRequest(token, limit = 20) {
         return decodeVibecheckContext(await this.#rpcJson("agent_proposition_context", { token, p_limit: limit }));
     }
+    async shareContext(token, observations) {
+        const capturedAt = new Date().toISOString();
+        const payload = {};
+        for (const observation of observations) {
+            const category = CONTEXT_CATEGORY[observation.type];
+            (payload[category] ??= []).push({
+                type: observation.type,
+                summary: observation.summary.trim(),
+                confidence: observation.confidence,
+                evidence_count: observation.evidence_count,
+                captured_at: capturedAt,
+            });
+        }
+        return decodeAgentContextShare(await this.#rpcJson("agent_context_capsule_share", {
+            token,
+            p_payload: payload,
+            p_confidence: observations.reduce((sum, item) => sum + item.confidence, 0) / observations.length,
+        }));
+    }
     async clientHandshake(token, input) {
-        const row = await this.#rpc("agent_client_handshake", {
+        const row = await this.#rpc("agent_client_handshake_v2", {
             token,
             p_client_key: input.client_key,
             p_client_label: input.client_label,

package/dist/constants.js

@@ -2,15 +2,16 @@
 export const SUPABASE_URL = "https://pbldcmniommltbdwuykk.supabase.co";
 export const SUPABASE_PUBLISHABLE_KEY = "sb_publishable_af-lUNI2FqEcb-oGy-4uxQ_cnm6kY85";
 export const PACKAGE_NAME = "@somacheck/vibecheck";
-export const PACKAGE_VERSION = "0.4.0";
+export const PACKAGE_VERSION = "0.5.0";
 export const PACKAGE_SPEC = `${PACKAGE_NAME}@${PACKAGE_VERSION}`;
 export const MCP_SERVER_NAME = "vibecheck";
 export const LEGACY_HOSTED_MCP_SERVER_NAME = "somacheck";
-export const BACKEND_PROTOCOL_VERSION = 3;
-export const TOOLSET_VERSION = "vibecheck-0.3";
+export const BACKEND_PROTOCOL_VERSION = 4;
+export const TOOLSET_VERSION = "vibecheck-0.5";
 export const TOOL_NAMES = [
     "get_vibecheck_context",
     "get_vibecheck_status",
+    "share_somacheck_context",
     "post_vibecheck_statement",
     "get_vibecheck_result",
 ];

package/dist/readiness.js

@@ -1,6 +1,7 @@
 import { readConfig } from "./config.js";
 import { SomaCheckCompatibilityError, SomaCheckHttpError } from "./api.js";
 import { clientDisplayName, clientRegistrationState, detectLegacyHostedRegistration, isClientInstalled, manualLegacyHostedRemoveCommand, manualRemoveCommand, manualSetupCommand, } from "./client-setup.js";
+import { BACKEND_PROTOCOL_VERSION, PACKAGE_VERSION } from "./constants.js";
 export async function checkReadiness(dependencies) {
     let token;
     try {
@@ -62,7 +63,7 @@ export async function checkReadiness(dependencies) {
                 ? " It currently reports: Needs authentication."
                 : "";
             dependencies.output(`○ ${clientDisplayName(client)} also has a separate legacy server named "somacheck".${authNote}`);
-            dependencies.output('  SomaCheck MCP 0.3 uses "vibecheck"; the legacy entry was not changed.');
+            dependencies.output(`  SomaCheck MCP ${PACKAGE_VERSION} uses "vibecheck"; the legacy entry was not changed.`);
             dependencies.output(`  Optional manual cleanup: ${manualLegacyHostedRemoveCommand(client)}`);
         }
         const registration = await clientRegistrationState(client, dependencies.runner);
@@ -81,7 +82,7 @@ export async function checkReadiness(dependencies) {
         }
     }
     if (registeredClients.length === 0) {
-        dependencies.output("✗ No supported agent client has the current SomaCheck 0.3 configuration.");
+        dependencies.output(`✗ No supported agent client has the current SomaCheck ${PACKAGE_VERSION} configuration.`);
         if (installedClientCount === 0) {
             dependencies.output("  Install Codex or Claude Code, then run the matching setup command.");
         }
@@ -101,7 +102,7 @@ export async function checkReadiness(dependencies) {
                 if (handshake.readiness_status === "ready") {
                     backendCompatible = true;
                     readyClients.push(client);
-                    dependencies.output(`✓ ${clientDisplayName(client)} completed the SomaCheck protocol-3 health check.`);
+                    dependencies.output(`✓ ${clientDisplayName(client)} completed the SomaCheck protocol-${BACKEND_PROTOCOL_VERSION} health check.`);
                 }
                 else {
                     dependencies.output(`✗ ${clientDisplayName(client)} is not ready yet (${handshake.readiness_status}).`);

package/dist/server.js

@@ -48,10 +48,29 @@ const contextItemSchema = z.object({
     answered_at: z.string().datetime({ offset: true }),
 });
 const contextSchema = { checkins: z.array(contextItemSchema) };
+const agentContextTypeSchema = z.enum([
+    "goal", "project", "decision", "commitment", "tension", "question",
+    "blindSpot", "relationship", "situation", "change", "deadline",
+    "development", "moodTheme", "preference",
+]);
+const agentContextObservationSchema = z.object({
+    type: agentContextTypeSchema,
+    summary: z.string().trim().min(1).max(500)
+        .describe("A concise derived theme or fact the person authorized you to share. Never paste raw conversations."),
+    confidence: z.number().min(0).max(1).default(0.8),
+    evidence_count: z.number().int().min(1).max(100).default(1),
+});
+const contextShareSchema = {
+    source_id: z.string(), entry_id: z.string(), accepted: z.boolean(),
+    state: z.literal("ready"), observation_count: z.number().int().min(1).max(20),
+    captured_at: z.string().datetime({ offset: true }),
+};
 const SERVER_INSTRUCTIONS = [
     "SomaCheck lets you offer the person a statement to test through a quick phone check-in.",
     "Call get_vibecheck_context and get_vibecheck_status at the start of a session or background run, and call status again after a completed check-in.",
     "Treat gesture outcomes as contextual signals, never fixed facts or blanket authorization.",
+    "When you have meaningful user-authorized context, call share_somacheck_context with concise derived observations before creating propositions.",
+    "Never share raw conversation text, photos, credentials, private identifiers, or diagnostic claims.",
     "Maintain three distinct propositions drawn from your own context about this person.",
     "When propositions_needed is greater than zero, post exactly that many in one call.",
     "Offer each statement as something to test, never as a claim of fact about the user.",
@@ -111,6 +130,32 @@ export function createVibecheckServer(dependencies) {
             return failureMessage("read SomaCheck status", error);
         }
     });
+    server.registerTool("share_somacheck_context", {
+        title: "Share SomaCheck Context",
+        description: "Share 1-20 concise, user-authorized context observations so SomaCheck can prepare richer propositions. Send derived summaries only—never raw conversation text, photos, credentials, identifiers, or diagnostic claims.",
+        inputSchema: {
+            observations: z.array(agentContextObservationSchema).min(1).max(20),
+        },
+        outputSchema: contextShareSchema,
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async ({ observations }) => {
+        try {
+            const token = await dependencies.loadToken();
+            const result = await dependencies.api.shareContext(token, observations);
+            return {
+                content: [{ type: "text", text: `Shared ${result.observation_count} bounded context observation${result.observation_count === 1 ? "" : "s"}. SomaCheck can now prepare contextual propositions.` }],
+                structuredContent: { ...result },
+            };
+        }
+        catch (error) {
+            return failureMessage("share context with SomaCheck", error);
+        }
+    });
     server.registerTool("post_vibecheck_statement", {
         title: "Post Vibecheck Statement",
         description: "Fill the person's SomaCheck cache with one to three personalized statements and return immediately. Call get_vibecheck_status first and submit exactly propositions_needed statements.",
@@ -208,6 +253,9 @@ function operationalFailureText(operation, error) {
     }
     if (error instanceof SomaCheckHttpError) {
         if (error.status === 401 || error.status === 403) {
+            if (operation === "share context with SomaCheck") {
+                return `Could not ${operation}: context is not enabled for this link, or the link was rejected or revoked. Open SomaCheck → Connect context, then retry. ${doctor}`;
+            }
             return `Could not ${operation}: this SomaCheck link was rejected or revoked. Reconnect in the app. ${doctor}`;
         }
         if (error.status === 404) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@somacheck/vibecheck",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Ask your embodied sense for an answer through SomaCheck.",
   "repository": {
     "type": "git",