@somacheck/vibecheck 0.6.0 → 0.6.1

package/README.md

@@ -9,7 +9,7 @@ Your agent has your context. It does not have your gut. This is the bridge.
 
 Fair. Here is what you need, without executing anything.
 
-**What the `link` command does.** `npx -y @somacheck/vibecheck@0.6.0 link <CODE> --client <CLIENT>`
+**What the `link` command does.** `npx -y @somacheck/vibecheck@0.6.1 link <CODE> --client <CLIENT>`
 exchanges a short-lived pairing code, generated inside the SomaCheck iOS app, for
 a bearer token. It writes that token to `~/.sensie/config.json` with mode `0600`,
 offers to configure supported agent clients found on the computer, and checks the
@@ -78,9 +78,9 @@ before the pairing code is redeemed.
 To configure or repair a client later:
 
 ```text
-npx -y @somacheck/vibecheck@0.6.0 setup codex
-npx -y @somacheck/vibecheck@0.6.0 setup claude
-npx -y @somacheck/vibecheck@0.6.0 doctor
+npx -y @somacheck/vibecheck@0.6.1 setup codex
+npx -y @somacheck/vibecheck@0.6.1 setup claude
+npx -y @somacheck/vibecheck@0.6.1 doctor
 ```
 
 Manual registration remains available:
@@ -90,13 +90,13 @@ Manual registration remains available:
      "mcpServers": {
        "vibecheck": {
          "command": "npx",
-        "args": ["-y", "@somacheck/vibecheck@0.6.0", "serve", "--client", "codex"]
+        "args": ["-y", "@somacheck/vibecheck@0.6.1", "serve", "--client", "codex"]
        }
      }
    }
    ```
 
-   For Claude Code: `claude mcp add --scope user vibecheck -- npx -y @somacheck/vibecheck@0.6.0 serve --client claude`
+   For Claude Code: `claude mcp add --scope user vibecheck -- npx -y @somacheck/vibecheck@0.6.1 serve --client claude`
 
 The link step writes only the bearer token in `~/.sensie/config.json`. The client
 setup step asks Codex or Claude to add the pinned MCP command to that client's own
@@ -116,7 +116,7 @@ will explain it and leave it alone. The canonical local MCP key is `vibecheck`.
 | `share_somacheck_context` | Share 1–20 bounded, derived, user-authorized observations; raw conversations and secrets are rejected. |
 | `post_vibecheck_statement` | Add one to three personalized statements without blocking; returns a stable `request_id` for each. |
 | `get_vibecheck_result` | Read that exact proposition once by `request_id`; returns queued, pending, or its terminal result. |
-| `request_vibecheck` | After the person accepts the exact statement, send one immediate phone vibecheck with a retry-safe UUID and return an opaque `live:<uuid>` handle. |
+| `request_vibecheck` | With per-ask consent, send one immediate phone vibecheck, wait boundedly for its exact answer, and retain an opaque `live:<uuid>` fallback handle. |
 
 ## How to use it well
 
@@ -126,17 +126,29 @@ prompt is **a statement for the person to test**, not a question about facts:
 something to test, never as a claim about them. If it is wrong, their body says
 `unaligned`, and that is a useful answer rather than a failure.
 
-For a Live Ask, first show the exact statement and invite the person plainly:
+Setup and linking are not permission for future asks. If the person's current
+message explicitly asks you to use SomaCheck and includes the exact statement,
+that is consent for this one vibecheck; do not ask them to confirm twice.
+Otherwise, first show the exact statement and invite the person plainly:
 
 > Want a quick vibecheck before I continue? I'll send this statement to your
 > phone; you answer with your wrist gesture, and I'll use the result as a
 > signal—not a verdict.
 
-Call `request_vibecheck` only after they accept, with `human_confirmed: true`
-and a new UUID in `idempotency_key`. Reuse that UUID only when retrying the
-same statement. The returned `live:<uuid>` handle can be passed to
-`get_vibecheck_result` later. Each read is non-blocking; do not continuously
-poll, and do not re-ask the same decision to obtain a preferred result.
+Call `request_vibecheck` with `human_confirmed: true` and a new UUID in
+`idempotency_key` only after one of those per-ask consent paths. Reuse that UUID
+only when retrying the same statement. The tool keeps the one created request
+open for a bounded wait and returns `completed` when the exact answer arrives.
+On timeout or a result-read failure it returns the same pending `live:<uuid>`
+handle; pass that handle to `get_vibecheck_result` once later. Caller
+cancellation stops result reads and preserves the backend request and
+idempotency key, but the cancelled MCP transport may suppress that pending
+response. Do not continuously poll or re-ask the same decision to obtain a
+preferred result.
+
+The 45-second whole-call deadline also covers the one create request. If that
+network request is aborted after an ambiguous commit, retry the exact same
+statement with the same `idempotency_key`; never create a replacement ask.
 
 After a completed result, explain what the signal changes in your next action.
 Never treat it as authorization or say that the person's body made the

package/dist/api.js

@@ -334,7 +334,7 @@ export class SupabaseAgentApi {
         const row = await this.#rpc("agent_link_redeem", { code });
         return requiredString(row, "token");
     }
-    async requestVibecheck(token, identity, statement, idempotencyKey) {
+    async requestVibecheck(token, identity, statement, idempotencyKey, signal) {
         if (identity.kind !== "local")
             throw new SomaCheckLiveAskClientError();
         const clientKey = identity.client_key;
@@ -343,9 +343,9 @@ export class SupabaseAgentApi {
             statement,
             idempotency_key: idempotencyKey,
             client_key: clientKey,
-        }));
+        }, signal));
         const lifecycle = created.status === "answered"
-            ? await this.liveVibecheckResult(token, identity, created.request_id)
+            ? await this.liveVibecheckResult(token, identity, created.request_id, signal)
             : { status: created.status, verdict: null, confidence: null, latency_s: null };
         return {
             request_id: `live:${created.request_id}`,
@@ -364,14 +364,14 @@ export class SupabaseAgentApi {
     async pollRequest(token, requestId) {
         return decodePollResponse(await this.#rpc("agent_proposition_result", { token, proposition_id: requestId }));
     }
-    async liveVibecheckResult(token, identity, requestId) {
+    async liveVibecheckResult(token, identity, requestId, signal) {
         if (identity.kind !== "local")
             throw new SomaCheckLiveAskClientError();
         return decodeLiveVibecheckResult(await this.#rpcJson("agent_vibecheck_result", {
             token,
             live_ask_id: requestId,
             client_key: identity.client_key,
-        }), requestId);
+        }, signal), requestId);
     }
     async statusRequest(token) {
         return decodeVibecheckStatus(await this.#rpc("agent_proposition_cache_status", { token }));
@@ -418,7 +418,7 @@ export class SupabaseAgentApi {
     async #rpc(name, body) {
         return firstRow(await this.#rpcJson(name, body));
     }
-    async #rpcJson(name, body) {
+    async #rpcJson(name, body, signal) {
         const response = await this.#fetch(`${this.#endpoint}/rest/v1/rpc/${name}`, {
             method: "POST",
             headers: {
@@ -429,6 +429,7 @@ export class SupabaseAgentApi {
                 "accept-profile": "somacheck_engine",
             },
             body: JSON.stringify(body),
+            ...(signal === undefined ? {} : { signal }),
         });
         if (!response.ok) {
             const responseBody = await response.text().catch(() => "");

package/dist/client-setup.js

@@ -91,6 +91,8 @@ function registrationMatches(client, stdout) {
             return false;
         }
     }
+    if (/^\s*(?:Enabled|Status):\s*(?:false|disabled|off)\s*$/im.test(stdout))
+        return false;
     const command = /^\s*Command:\s*(\S+)\s*$/im.exec(stdout)?.[1];
     const rawArgs = /^\s*Args:\s*(.*?)\s*$/im.exec(stdout)?.[1] ?? "";
     const parsedArgs = rawArgs.split(/\s+/).filter(Boolean);
@@ -117,6 +119,8 @@ function isManagedSomaCheckRegistration(client, stdout) {
         }
     }
     else {
+        if (/^\s*(?:Enabled|Status):\s*(?:false|disabled|off)\s*$/im.test(stdout))
+            return false;
         command = /^\s*Command:\s*(\S+)\s*$/im.exec(stdout)?.[1];
         args = (/^\s*Args:\s*(.*?)\s*$/im.exec(stdout)?.[1] ?? "").split(/\s+/).filter(Boolean);
     }
@@ -131,10 +135,12 @@ function isManagedSomaCheckRegistration(client, stdout) {
     if (legacyWithoutClient)
         return true;
     // 0.5 introduced the exact local runtime identity required by Live Ask.
-    // It is safe to replace only the canonical command generated by that
-    // release. Custom wrappers, extra arguments, disabled entries, and a
-    // registration naming the other client remain user-owned.
-    const previousExactClient = /^@somacheck\/vibecheck@0\.5\.\d+$/.test(packageArg)
+    // It is safe to replace only the canonical command generated by 0.5 or the
+    // exact 0.6.0 release being patched. Custom wrappers, extra arguments,
+    // disabled entries, later versions, and registrations naming the other
+    // client remain user-owned.
+    const previousExactClient = (/^@somacheck\/vibecheck@0\.5\.\d+$/.test(packageArg)
+        || packageArg === "@somacheck/vibecheck@0.6.0")
         && args.length === 5
         && args[0] === "-y"
         && args[1] === packageArg

package/dist/constants.js

@@ -2,7 +2,7 @@
 export const SUPABASE_URL = "https://pbldcmniommltbdwuykk.supabase.co";
 export const SUPABASE_PUBLISHABLE_KEY = "sb_publishable_af-lUNI2FqEcb-oGy-4uxQ_cnm6kY85";
 export const PACKAGE_NAME = "@somacheck/vibecheck";
-export const PACKAGE_VERSION = "0.6.0";
+export const PACKAGE_VERSION = "0.6.1";
 export const PACKAGE_SPEC = `${PACKAGE_NAME}@${PACKAGE_VERSION}`;
 export const MCP_SERVER_NAME = "vibecheck";
 export const LEGACY_HOSTED_MCP_SERVER_NAME = "somacheck";

package/dist/server.js

@@ -3,6 +3,26 @@ import { z } from "zod";
 import { StatementPendingError, } from "./vibecheck.js";
 import { SomaCheckCompatibilityError, SomaCheckHttpError, SomaCheckLiveAskClientError, SomaCheckLiveAskConflictError, SomaCheckLiveAskPendingError, } from "./api.js";
 import { PACKAGE_NAME, PACKAGE_SPEC, PACKAGE_VERSION } from "./constants.js";
+const LIVE_ASK_WAIT_BUDGET_MS = 45_000;
+const LIVE_ASK_POLL_DELAYS_MS = [
+    1_000, 1_000, 2_000, 2_000, 3_000, 3_000,
+    4_000, 4_000, 5_000, 5_000, 5_000, 5_000,
+];
+function abortAwareSleep(milliseconds, signal) {
+    if (signal.aborted || milliseconds <= 0)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        let timer;
+        const finish = () => {
+            if (timer !== undefined)
+                clearTimeout(timer);
+            signal.removeEventListener("abort", finish);
+            resolve();
+        };
+        timer = setTimeout(finish, milliseconds);
+        signal.addEventListener("abort", finish, { once: true });
+    });
+}
 const cadenceSchema = z.object({
     reason: z.string(),
     create_due_at: z.string().nullable(),
@@ -92,10 +112,13 @@ const SERVER_INSTRUCTIONS = [
     "Call get_vibecheck_context and get_vibecheck_status at the start of a session or background run, and call status again after a completed check-in.",
     "Treat gesture outcomes as contextual signals, never fixed facts or blanket authorization.",
     "Use request_vibecheck when a current choice would benefit from the person's own felt response; never use it to evaluate someone else.",
-    "First show the exact statement and ask: Want a quick vibecheck before I continue? I'll send this statement to your phone; you answer with your wrist gesture, and I'll use the result as a signal—not a verdict. Call only after the person accepts.",
+    "A setup or link is not blanket consent for future vibechecks.",
+    "If the person's current message explicitly tells you to request a SomaCheck vibecheck and includes the exact statement, that message is consent for that one ask; set human_confirmed to true and do not ask them to confirm twice.",
+    "Otherwise, first show the exact statement and ask: Want a quick vibecheck before I continue? I'll send this statement to your phone; you answer with your wrist gesture, and I'll use the result as a signal—not a verdict. Call only after the person accepts.",
     "Use at most one vibecheck per decision. Never re-ask to obtain a preferred answer.",
     "An immediate vibecheck is separate from the asynchronous reflection feed. Do not use it to replenish cached propositions.",
     "Use a fresh idempotency_key for each new vibecheck, and reuse that exact key only when retrying the same statement.",
+    "request_vibecheck waits boundedly for the exact answer. If it returns completed, continue in the same turn and explain what changes. If it returns pending, retain that exact handle and read it once later; never create a replacement ask.",
     "After a completed result, say what the signal changes in your next action. Never say 'your body decided'; a typed human response always overrides the signal.",
     "When you have meaningful user-authorized context, call share_somacheck_context with concise derived observations before creating propositions.",
     "Never share raw conversation text, photos, credentials, private identifiers, or diagnostic claims.",
@@ -257,14 +280,14 @@ export function createVibecheckServer(dependencies) {
     });
     server.registerTool("request_vibecheck", {
         title: "Request a Vibecheck",
-        description: "Send one plain-language statement to the person's phone for a vibecheck answered with a wrist gesture. First show the exact statement and call only after the person accepts. Use this only when their own felt response would help with the current choice, not for routine feed content or to judge another person. Returns a stable request_id immediately; call get_vibecheck_result later once, without continuous polling.",
+        description: "Send one plain-language statement to the person's phone for a vibecheck answered with a wrist gesture. A current user command that explicitly requests SomaCheck and includes the exact statement counts as confirmation for that one ask; do not ask twice. Otherwise, first show the exact statement and call only after the person accepts. Setup or linking is not blanket consent. Use this only when their own felt response would help with the current choice, not for routine feed content or to judge another person. The call waits boundedly for the exact result and returns completed when available. A timeout returns the same stable pending request_id for one later read. Caller cancellation stops result reads without creating another request; the cancelled transport may suppress the pending response.",
         inputSchema: {
             statement: z.string().trim().min(1).max(1000)
                 .describe("One plain-language statement for the person to test; offer a signal, not a fact, diagnosis, or instruction."),
             idempotency_key: z.string().uuid()
                 .describe("A new UUID for this logical ask. Reuse the same UUID only to retry the exact same statement; retries will not create another phone request."),
             human_confirmed: z.literal(true)
-                .describe("Confirms the agent showed the exact statement and the person accepted this one vibecheck."),
+                .describe("Confirms the person accepted this exact vibecheck, either by explicitly requesting SomaCheck with this statement in their current message or by accepting after the agent showed it."),
         },
         outputSchema: liveAskSchema,
         annotations: {
@@ -273,30 +296,123 @@ export function createVibecheckServer(dependencies) {
             idempotentHint: true,
             openWorldHint: false,
         },
-    }, async ({ statement, idempotency_key }) => {
+    }, async ({ statement, idempotency_key }, extra) => {
+        const now = dependencies.liveAskWait?.now ?? (() => performance.now());
+        const budgetMs = dependencies.liveAskWait?.budgetMs ?? LIVE_ASK_WAIT_BUDGET_MS;
+        const deadline = now() + budgetMs;
+        const callAbort = new AbortController();
+        const forwardCallerAbort = () => callAbort.abort(extra.signal.reason);
+        if (extra.signal.aborted) {
+            forwardCallerAbort();
+        }
+        else {
+            extra.signal.addEventListener("abort", forwardCallerAbort, { once: true });
+        }
+        const callDeadline = setTimeout(() => callAbort.abort(new Error("Live Ask tool deadline reached.")), budgetMs);
         try {
             const identity = dependencies.identity ?? { kind: "legacy" };
             if (identity.kind === "legacy") {
                 return liveAskFailure(new SomaCheckLiveAskClientError());
             }
             const token = await dependencies.loadToken();
-            const result = await dependencies.api.requestVibecheck(token, identity, statement.trim(), idempotency_key);
+            const created = await dependencies.api.requestVibecheck(token, identity, statement.trim(), idempotency_key, callAbort.signal);
+            const result = await waitForLiveVibecheck(created, token, identity, dependencies, callAbort.signal, deadline, (attempt) => {
+                const progressToken = extra._meta?.progressToken;
+                if (progressToken === undefined)
+                    return;
+                void extra.sendNotification({
+                    method: "notifications/progress",
+                    params: {
+                        progressToken,
+                        progress: attempt,
+                        total: LIVE_ASK_POLL_DELAYS_MS.length,
+                        message: "Waiting for the person's vibecheck signal.",
+                    },
+                }).catch(() => {
+                    // Progress is optional. A host that does not accept it must not
+                    // prevent the exact result from completing this tool call.
+                });
+            });
             const structuredContent = { ...result, error_code: null };
             const text = result.state === "completed"
                 ? `Vibecheck completed: ${Math.round((result.confidence ?? 0) * 100)}% ${result.verdict}. Treat this as a signal, say what it changes in your next action, and defer to any typed response from the person.`
                 : result.state === "pending"
                     ? result.delivery_state === "failed" || result.delivery_state === "skipped"
                         ? `Vibecheck ${result.request_id} was stored, but phone delivery is ${result.delivery_state}. It expires at ${result.expires_at}. Do not repost it or change the idempotency_key; check the phone setup before a later decision.`
-                        : `Vibecheck requested. Keep request_id ${result.request_id} and check it later with get_vibecheck_result. It expires at ${result.expires_at}; do not poll continuously or re-ask for this decision.`
+                        : `Vibecheck ${result.request_id} is still pending after a bounded wait. Keep this exact handle and check it once later with get_vibecheck_result. It expires at ${result.expires_at}; do not poll continuously or re-ask for this decision.`
                     : `This vibecheck is ${result.state}. Do not create another ask for the same decision.`;
             return { content: [{ type: "text", text }], structuredContent };
         }
         catch (error) {
             return liveAskFailure(error);
         }
+        finally {
+            clearTimeout(callDeadline);
+            extra.signal.removeEventListener("abort", forwardCallerAbort);
+        }
     });
     return server;
 }
+async function waitForLiveVibecheck(created, token, identity, dependencies, signal, deadline, progress) {
+    if (created.state !== "pending"
+        || created.delivery_state === "failed"
+        || created.delivery_state === "skipped"
+        || signal.aborted) {
+        return created;
+    }
+    const requestId = parseLiveVibecheckHandle(created.request_id);
+    if (requestId === null)
+        return created;
+    const now = dependencies.liveAskWait?.now ?? (() => performance.now());
+    const sleep = dependencies.liveAskWait?.sleep ?? abortAwareSleep;
+    for (const [index, delay] of LIVE_ASK_POLL_DELAYS_MS.entries()) {
+        const remaining = deadline - now();
+        if (signal.aborted || remaining <= 0)
+            return created;
+        await sleep(Math.min(delay, remaining), signal);
+        if (signal.aborted || now() >= deadline)
+            return created;
+        progress(index + 1);
+        if (signal.aborted)
+            return created;
+        let lifecycle;
+        const resultAbort = new AbortController();
+        const forwardCallerAbort = () => resultAbort.abort(signal.reason);
+        signal.addEventListener("abort", forwardCallerAbort, { once: true });
+        const resultTimeout = setTimeout(() => resultAbort.abort(new Error("Live Ask result deadline reached.")), Math.max(0, deadline - now()));
+        try {
+            lifecycle = await dependencies.api.liveVibecheckResult(token, identity, requestId, resultAbort.signal);
+        }
+        catch {
+            // Creation already succeeded. Keep the exact handle so a transient,
+            // cancelled, revoked, or deadline-aborted read cannot prompt a duplicate.
+            return created;
+        }
+        finally {
+            clearTimeout(resultTimeout);
+            signal.removeEventListener("abort", forwardCallerAbort);
+        }
+        if (signal.aborted)
+            return created;
+        if (lifecycle.status === "answered") {
+            return {
+                ...created,
+                state: "completed",
+                verdict: lifecycle.verdict,
+                confidence: lifecycle.confidence,
+            };
+        }
+        if (lifecycle.status === "expired" || lifecycle.status === "cancelled") {
+            return {
+                ...created,
+                state: lifecycle.status,
+                verdict: null,
+                confidence: null,
+            };
+        }
+    }
+    return created;
+}
 function summarise(status) {
     const cadence = status.cadence;
     if (status.first_run_intro.should_offer_now) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@somacheck/vibecheck",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Send a consented vibecheck to SomaCheck and use the result as a signal.",
   "repository": {
     "type": "git",