@somacheck/vibecheck 0.6.12 → 0.6.14

package/dist/cli.js

@@ -3,7 +3,7 @@ import { homedir } from "node:os";
 import { createInterface } from "node:readline/promises";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { SupabaseAgentApi } from "./api.js";
-import { claudeChannelLaunchCommand, clientDisplayName, detectInstalledClients, detectLegacyHostedRegistration, LocalCommandRunner, manualLegacyHostedRemoveCommand, manualRemoveCommand, manualSetupCommand, parseClientChoice, preflightClientPersistence, registerClient, singleNonInteractiveClientSelection, } from "./client-setup.js";
+import { claudeChannelLaunchCommand, clientDisplayName, detectInstalledClients, detectLegacyHostedRegistration, isClientInstalled, LocalCommandRunner, manualLegacyHostedRemoveCommand, manualRemoveCommand, manualSetupCommand, migrateClaudeDirectRegistration, parseClientChoice, preflightClientPersistence, registerClient, singleNonInteractiveClientSelection, } from "./client-setup.js";
 import { configureClaudeContinuationPlugin } from "./claude-plugin-setup.js";
 import { readConfig } from "./config.js";
 import { awaitClaudeVibecheckResult } from "./claude-hook.js";
@@ -76,6 +76,32 @@ async function promptForClients(installed) {
 }
 async function configureClients(clients) {
     for (const client of clients) {
+        if (client === "claude") {
+            if (!(await isClientInstalled(client, runner))) {
+                output(`○ ${clientDisplayName(client)} is not installed; skipped.`);
+                continue;
+            }
+            const plugin = await configureClaudeContinuationPlugin(homedir(), runner);
+            if (plugin.status === "failed") {
+                throw new ClientPreflightError("Could not configure the SomaCheck Channel plugin for Claude Code.");
+            }
+            const migration = await migrateClaudeDirectRegistration(runner);
+            if (migration === "needs_update") {
+                throw new ClientPreflightError([
+                    'Claude Code has a user-owned MCP server named "vibecheck"; it was not changed.',
+                    `Remove it only if it is obsolete: ${manualRemoveCommand(client)}`,
+                ].join("\n"));
+            }
+            if (migration === "failed" || migration === "not_installed") {
+                throw new ClientPreflightError("Could not remove the superseded direct SomaCheck MCP registration.");
+            }
+            output(`✓ SomaCheck Channel plugin ${plugin.status === "installed" ? "was configured" : "is current"} for Claude Code.`);
+            output("✓ Automatic SomaCheck marketplace updates are enabled for future reviewed releases.");
+            if (migration === "removed")
+                output("✓ Removed the superseded direct MCP registration.");
+            output(`  Start Claude Code with SomaCheck Channels: ${claudeChannelLaunchCommand()}`);
+            continue;
+        }
         const result = await registerClient(client, runner);
         if (result.status === "registered") {
             output(`✓ Configured ${clientDisplayName(client)}.`);
@@ -96,14 +122,6 @@ async function configureClients(clients) {
         else {
             output(`✗ Could not configure ${clientDisplayName(client)} automatically.`);
         }
-        if (client === "claude" && ["registered", "upgraded", "already_registered"].includes(result.status)) {
-            const plugin = await configureClaudeContinuationPlugin(homedir(), runner);
-            if (plugin.status === "failed") {
-                throw new ClientPreflightError("Could not configure automatic SomaCheck results for Claude Code. No pairing code was used.");
-            }
-            output(`✓ Automatic Claude result continuation ${plugin.status === "installed" ? "was configured" : "is ready"}.`);
-            output(`  Start Claude Code with SomaCheck Channels: ${claudeChannelLaunchCommand()}`);
-        }
     }
 }
 async function preflightLinkClients(clients, interactive) {
@@ -144,6 +162,42 @@ async function preflightLinkClients(clients, interactive) {
             ].join("\n"));
         }
         output(`Checking ${clientDisplayName(client)} before redeeming the pairing code...`);
+        if (client === "claude") {
+            if (!(await isClientInstalled(client, runner))) {
+                throw new ClientPreflightError([
+                    "Not linking here: Claude Code is not installed or its CLI is unavailable.",
+                    "The pairing code has NOT been used.",
+                ].join("\n"));
+            }
+            const plugin = await configureClaudeContinuationPlugin(homedir(), runner);
+            if (plugin.status === "failed") {
+                throw new ClientPreflightError([
+                    "Not linking here: the SomaCheck Channel plugin could not be installed and verified for Claude Code.",
+                    "The pairing code has NOT been used. Repair Claude's plugin setup, then run the link command again.",
+                ].join("\n"));
+            }
+            const migration = await migrateClaudeDirectRegistration(runner);
+            if (migration === "needs_update") {
+                throw new ClientPreflightError([
+                    'Not linking here: Claude Code has a user-owned MCP entry named "vibecheck".',
+                    "It was not changed because its command does not match a SomaCheck-managed registration.",
+                    `Remove it only if it is obsolete: ${manualRemoveCommand(client)}`,
+                    "The pairing code has NOT been used.",
+                ].join("\n"));
+            }
+            if (migration === "failed" || migration === "not_installed") {
+                throw new ClientPreflightError([
+                    "Not linking here: the superseded direct SomaCheck MCP registration could not be removed safely.",
+                    "The pairing code has NOT been used.",
+                ].join("\n"));
+            }
+            output("✓ Claude Code has one exact, plugin-scoped SomaCheck Channel server.");
+            output("✓ Automatic SomaCheck marketplace updates are enabled for future reviewed releases.");
+            if (migration === "removed")
+                output("✓ Removed the superseded direct MCP registration before redeeming the pairing code.");
+            output(`  Start Claude Code with SomaCheck Channels: ${claudeChannelLaunchCommand()}`);
+            continue;
+        }
         const preflight = await preflightClientPersistence(client, runner);
         if (preflight.status === "ready") {
             output(`✓ ${clientDisplayName(client)} already has the exact SomaCheck MCP registration.`);
@@ -169,17 +223,6 @@ async function preflightLinkClients(clients, interactive) {
                 "run the link command again.",
             ].join("\n"));
         }
-        if (client === "claude") {
-            const plugin = await configureClaudeContinuationPlugin(homedir(), runner);
-            if (plugin.status === "failed") {
-                throw new ClientPreflightError([
-                    "Not linking here: automatic SomaCheck result continuation could not be configured for Claude Code.",
-                    "The pairing code has NOT been used. Repair Claude's plugin setup, then run the link command again.",
-                ].join("\n"));
-            }
-            output("✓ Automatic Claude result continuation is ready before redeeming the pairing code.");
-            output(`  Start Claude Code with SomaCheck Channels: ${claudeChannelLaunchCommand()}`);
-        }
     }
     return selectedClients;
 }

package/dist/client-setup.js

@@ -30,13 +30,13 @@ function mcpServerArgs(client) {
     return client === "claude" ? [...args, "--channel"] : args;
 }
 export function claudeChannelLaunchCommand() {
-    return `claude --dangerously-load-development-channels server:${MCP_SERVER_NAME}`;
+    return "claude --channels plugin:vibecheck@somacheck";
 }
 export function manualSetupCommand(client) {
     if (client === "codex") {
         return `codex mcp add ${MCP_SERVER_NAME} -- npx ${mcpServerArgs(client).join(" ")}`;
     }
-    return `claude mcp add --scope user ${MCP_SERVER_NAME} -- npx ${mcpServerArgs(client).join(" ")}`;
+    return `npx -y ${PACKAGE_SPEC} setup claude`;
 }
 export function manualRemoveCommand(client) {
     return client === "codex"
@@ -143,30 +143,46 @@ function isManagedSomaCheckRegistration(client, stdout) {
     // earlier exact 0.6 patch release. Custom wrappers, extra arguments,
     // disabled entries, later versions, and registrations naming the other
     // client remain user-owned.
-    const previousExactClient = (/^@somacheck\/vibecheck@0\.5\.\d+$/.test(packageArg)
-        || packageArg === "@somacheck/vibecheck@0.6.0"
-        || packageArg === "@somacheck/vibecheck@0.6.1"
-        || packageArg === "@somacheck/vibecheck@0.6.2"
-        || packageArg === "@somacheck/vibecheck@0.6.3"
-        || packageArg === "@somacheck/vibecheck@0.6.4"
-        || packageArg === "@somacheck/vibecheck@0.6.5"
-        || packageArg === "@somacheck/vibecheck@0.6.6"
-        || packageArg === "@somacheck/vibecheck@0.6.7"
-        || packageArg === "@somacheck/vibecheck@0.6.8"
-        || packageArg === "@somacheck/vibecheck@0.6.9"
-        || packageArg === "@somacheck/vibecheck@0.6.10"
-        || packageArg === "@somacheck/vibecheck@0.6.11")
-        && args.length === 5
-        && args[0] === "-y"
-        && args[1] === packageArg
-        && args[2] === "serve"
-        && args[3] === "--client"
-        && args[4] === client;
-    return previousExactClient;
+    const version = parseExactSemver(packageArg.slice("@somacheck/vibecheck@".length));
+    const currentVersion = parseExactSemver(PACKAGE_SPEC.slice("@somacheck/vibecheck@".length));
+    if (version === null || currentVersion === null
+        || compareSemver(version, [0, 5, 0]) < 0
+        || compareSemver(version, currentVersion) >= 0)
+        return false;
+    const expected = ["-y", packageArg, "serve", "--client", client];
+    if (client === "claude" && compareSemver(version, [0, 6, 12]) >= 0) {
+        expected.push("--channel");
+    }
+    return args.length === expected.length
+        && args.every((arg, index) => arg === expected[index]);
+}
+function parseExactSemver(value) {
+    const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(value);
+    return match === null ? null : [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function compareSemver(left, right) {
+    for (let index = 0; index < 3; index += 1) {
+        if (left[index] !== right[index])
+            return left[index] - right[index];
+    }
+    return 0;
 }
 export async function isClientRegistered(client, runner) {
     return (await clientRegistrationState(client, runner)) === "current";
 }
+export async function migrateClaudeDirectRegistration(runner) {
+    if (!(await isClientInstalled("claude", runner)))
+        return "not_installed";
+    const state = await clientRegistrationState("claude", runner);
+    if (state === "missing")
+        return "absent";
+    if (state === "needs_update")
+        return "needs_update";
+    const removed = await runner.run("claude", ["mcp", "remove", "--scope", "user", MCP_SERVER_NAME]);
+    if (removed.exitCode !== 0)
+        return "failed";
+    return (await clientRegistrationState("claude", runner)) === "missing" ? "removed" : "failed";
+}
 export async function detectInstalledClients(runner) {
     const clients = ["codex", "claude"];
     const installed = await Promise.all(clients.map(async (client) => ({

package/dist/constants.js

@@ -2,7 +2,7 @@
 export const SUPABASE_URL = "https://pbldcmniommltbdwuykk.supabase.co";
 export const SUPABASE_PUBLISHABLE_KEY = "sb_publishable_af-lUNI2FqEcb-oGy-4uxQ_cnm6kY85";
 export const PACKAGE_NAME = "@somacheck/vibecheck";
-export const PACKAGE_VERSION = "0.6.12";
+export const PACKAGE_VERSION = "0.6.14";
 export const PACKAGE_SPEC = `${PACKAGE_NAME}@${PACKAGE_VERSION}`;
 export const SOMACHECK_SETUP_URL = "https://testflight.apple.com/join/C4mAH3zz";
 export const MCP_SERVER_NAME = "vibecheck";

package/dist/readiness.js

@@ -1,29 +1,8 @@
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
 import { readConfig } from "./config.js";
+import { isClaudeChannelPluginConfigured, isClaudeMarketplaceAutoUpdateConfigured, } from "./claude-plugin-setup.js";
 import { SomaCheckCompatibilityError, SomaCheckHttpError } from "./api.js";
-import { clientDisplayName, clientRegistrationState, detectLegacyHostedRegistration, isClientInstalled, manualLegacyHostedRemoveCommand, manualRemoveCommand, manualSetupCommand, } from "./client-setup.js";
+import { claudeChannelLaunchCommand, clientDisplayName, clientRegistrationState, detectLegacyHostedRegistration, isClientInstalled, manualLegacyHostedRemoveCommand, manualRemoveCommand, manualSetupCommand, } from "./client-setup.js";
 import { BACKEND_PROTOCOL_VERSION, PACKAGE_VERSION, SOMACHECK_SETUP_URL } from "./constants.js";
-function vibecheckRegistrationCount(value) {
-    if (!value || typeof value !== "object")
-        return 0;
-    let count = 0;
-    for (const [key, child] of Object.entries(value)) {
-        if (key === "mcpServers" && child && typeof child === "object" && !Array.isArray(child)) {
-            count += Object.keys(child).filter((name) => name.startsWith("vibecheck")).length;
-        }
-        count += vibecheckRegistrationCount(child);
-    }
-    return count;
-}
-async function claudeVibecheckRegistrationCount(home) {
-    try {
-        return vibecheckRegistrationCount(JSON.parse(await readFile(join(home, ".claude.json"), "utf8")));
-    }
-    catch {
-        return 0;
-    }
-}
 export async function checkReadiness(dependencies) {
     let token;
     try {
@@ -71,11 +50,6 @@ export async function checkReadiness(dependencies) {
         }
     }
     const backendReachable = statusProbeOk && contextProbeOk;
-    const claudeRegistrationCount = await claudeVibecheckRegistrationCount(dependencies.home);
-    if (claudeRegistrationCount > 1) {
-        dependencies.output(`○ Multiple Claude Code registrations whose names start with "vibecheck" were found (${claudeRegistrationCount}).`);
-        dependencies.output("  Remove stale entries from ~/.claude.json so only the current user-scope vibecheck registration remains.");
-    }
     const clients = ["codex", "claude"];
     let installedClientCount = 0;
     let hasLegacyHostedRegistration = false;
@@ -95,6 +69,29 @@ export async function checkReadiness(dependencies) {
             dependencies.output(`  Optional manual cleanup: ${manualLegacyHostedRemoveCommand(client)}`);
         }
         const registration = await clientRegistrationState(client, dependencies.runner);
+        if (client === "claude") {
+            const pluginConfigured = await isClaudeChannelPluginConfigured(dependencies.runner);
+            if (!pluginConfigured) {
+                dependencies.output("✗ Claude Code does not have the exact SomaCheck Channel plugin.");
+                dependencies.output(`  Run: ${manualSetupCommand(client)}`);
+                continue;
+            }
+            if (!(await isClaudeMarketplaceAutoUpdateConfigured(dependencies.home))) {
+                dependencies.output("✗ Automatic SomaCheck plugin updates are not enabled for Claude Code.");
+                dependencies.output(`  Run: ${manualSetupCommand(client)}`);
+                continue;
+            }
+            if (registration !== "missing") {
+                dependencies.output('✗ Claude Code also has a direct MCP server named "vibecheck".');
+                dependencies.output("  The plugin is installed, but the duplicate direct tool surface must be removed.");
+                dependencies.output(`  Run: ${manualRemoveCommand(client)}`);
+                continue;
+            }
+            registeredClients.push(client);
+            dependencies.output("✓ Claude Code has one exact, plugin-scoped SomaCheck Channel server.");
+            dependencies.output("✓ Automatic SomaCheck marketplace updates are enabled.");
+            continue;
+        }
         if (registration === "current") {
             registeredClients.push(client);
             dependencies.output(`✓ ${clientDisplayName(client)} is configured.`);
@@ -156,9 +153,17 @@ export async function checkReadiness(dependencies) {
         dependencies.output('✗ Remove the legacy "somacheck" connector before this setup can be Ready.');
     }
     const ready = readyClients.length > 0;
-    dependencies.output(ready
-        ? "Ready. Restart your agent client, then ask it to check your SomaCheck status."
-        : "Setup is not complete yet. Fix the items marked ✗, then run: vibecheck doctor");
+    if (ready) {
+        dependencies.output("Setup checks pass. Restart your agent client, then ask it to check your SomaCheck status.");
+        if (readyClients.includes("claude")) {
+            dependencies.output("○ Doctor verifies Claude's installed plugin and backend compatibility, not a running Channel session.");
+            dependencies.output(`  Start Claude with: ${claudeChannelLaunchCommand()}`);
+            dependencies.output("  Team/Enterprise use also requires the administrator to allowlist this plugin.");
+        }
+    }
+    else {
+        dependencies.output("Setup is not complete yet. Fix the items marked ✗, then run: vibecheck doctor");
+    }
     return { linked: true, backendReachable, backendCompatible, registeredClients, readyClients, ready };
 }
 //# sourceMappingURL=readiness.js.map

package/dist/recipes.js

@@ -52,8 +52,8 @@ export const RECIPE_CATALOG = [
             "The product or integration owner has provisioned an organization-authorized Maze connection or partner sandbox at https://connect.maze.co/mcp; running this recipe does not ask the researcher to sign up, upgrade, administer access, or populate Maze data.",
             "The provisioned workspace supplies one named existing study with safe metadata or an aggregate summary; if it does not, the Maze half remains untested and the researcher still receives a copy-ready plan.",
         ],
-        starterPrompt: "Use Maze and SomaCheck to help me reflect on my own interpretation plan for one named Maze study. I am the researcher and I am holding the phone. The study is [STUDY NAME OR ID PROVIDED BY THE WORKSPACE OWNER]. Use only the preconfigured official hosted read-only Maze MCP at https://connect.maze.co/mcp. Read only that study's safe metadata or one aggregate summary. Do not retrieve transcripts, recordings, heatmaps, click maps, mission answers, participant identifiers, contact fields, demographic exports, free text, or row-level data. Label what Maze literally reports separately from your interpretation, then offer two defensible framings. Offer one short first-person proposition about my own interpretation plan and wait for my acceptance before any proactive SomaCheck ask. Treat Aligned or Unaligned plus confidence as context, not truth, diagnosis, authorization, or evidence about a participant. Ask what I choose in words. Keep the proposition, reading, confidence, and confirmation out of Maze. Do not create, edit, publish, delete, archive, export, share, tag, comment, or otherwise write to Maze. If the preconfigured connection or a safe runtime read is absent, label the Maze half untested, return a copy-ready interpretation plan, and tell the integration owner what capability is missing. Do not ask me to sign up, upgrade, administer access, or populate Maze data.",
-        successCondition: "The researcher receives at most one optional signal about their own proposition and states a typed choice after a real metadata or aggregate read from a preconfigured workspace; no participant data or SomaCheck output enters Maze, and the Maze workspace remains unchanged.",
+        starterPrompt: "Use Maze and SomaCheck to help me reflect on my own interpretation plan for one named Maze study. I am the researcher and I am holding the phone. The study is [STUDY NAME OR ID PROVIDED BY THE WORKSPACE OWNER]. Use only the preconfigured official hosted read-only Maze MCP at https://connect.maze.co/mcp. Read only that study's safe metadata or one aggregate summary. Do not retrieve transcripts, recordings, heatmaps, click maps, mission answers, participant identifiers, contact fields, demographic exports, free text, or row-level data. Label what Maze literally reports separately from your interpretation, then offer two defensible framings. Offer one short first-person proposition about my own interpretation plan and wait for my acceptance before any proactive SomaCheck ask. Treat Aligned or Unaligned plus confidence as context, not truth, diagnosis, authorization, or evidence about a participant. Ask what I choose and accept any explicit response available in this interface. Keep the proposition, reading, confidence, and confirmation out of Maze. Do not create, edit, publish, delete, archive, export, share, tag, comment, or otherwise write to Maze. If the preconfigured connection or a safe runtime read is absent, label the Maze half untested, return a copy-ready interpretation plan, and tell the integration owner what capability is missing. Do not ask me to sign up, upgrade, administer access, or populate Maze data.",
+        successCondition: "The researcher receives at most one optional signal about their own proposition and explicitly indicates their choice after a real metadata or aggregate read from a preconfigured workspace; no participant data or SomaCheck output enters Maze, and the Maze workspace remains unchanged.",
     },
     {
         id: "chattermill-research-reflection-v1",
@@ -66,8 +66,8 @@ export const RECIPE_CATALOG = [
             "The product or integration owner has provisioned an organization-authorized Chattermill connection or partner sandbox at https://app.chattermill.com/mcp with mcp:read; running this recipe does not ask the researcher to sign up, purchase access, administer access, or populate Chattermill data.",
             "The provisioned workspace supplies one named existing project for which get_metrics or generate_highlights is sufficient; get_feedback, search_observations, identifier-bearing attributes, and free text remain prohibited.",
         ],
-        starterPrompt: "Use Chattermill and SomaCheck to help me reflect on my own interpretation of one named project's customer-feedback insights. I am the researcher and I am holding the phone. The project is [PROJECT NAME OR ID PROVIDED BY THE WORKSPACE OWNER]. Use only the preconfigured official hosted read-only Chattermill MCP at https://app.chattermill.com/mcp. Read only aggregate metrics with get_metrics or generated highlights with generate_highlights, plus the minimum discovery metadata needed to build that query. Never call get_feedback or search_observations, enumerate identifier-bearing attributes, or surface individual feedback, source quotes, respondent identifiers, contact fields, or free text. Label what the aggregate output literally reports separately from your interpretation, then offer two defensible interpretations. Offer one short first-person proposition about my own interpretation or next step and wait for my acceptance before any proactive SomaCheck ask. Treat Aligned or Unaligned plus confidence as context, not truth, diagnosis, authorization, or evidence about an individual customer. Ask what I choose in words. Keep the proposition, reading, confidence, and confirmation out of Chattermill. Do not create, edit, publish, delete, share, export, tag, comment, or otherwise write to Chattermill. If the preconfigured connection, mcp:read, or a safe aggregate runtime tool is absent, label the Chattermill half untested, return a copy-ready interpretation, and tell the integration owner what capability is missing. Do not ask me to sign up, purchase access, administer access, or populate Chattermill data.",
-        successCondition: "The researcher receives at most one optional signal about their own proposition and states a typed choice after a real aggregate or generated-summary read from a preconfigured workspace; no individual feedback or SomaCheck output enters the cross-MCP flow, and Chattermill remains unchanged.",
+        starterPrompt: "Use Chattermill and SomaCheck to help me reflect on my own interpretation of one named project's customer-feedback insights. I am the researcher and I am holding the phone. The project is [PROJECT NAME OR ID PROVIDED BY THE WORKSPACE OWNER]. Use only the preconfigured official hosted read-only Chattermill MCP at https://app.chattermill.com/mcp. Read only aggregate metrics with get_metrics or generated highlights with generate_highlights, plus the minimum discovery metadata needed to build that query. Never call get_feedback or search_observations, enumerate identifier-bearing attributes, or surface individual feedback, source quotes, respondent identifiers, contact fields, or free text. Label what the aggregate output literally reports separately from your interpretation, then offer two defensible interpretations. Offer one short first-person proposition about my own interpretation or next step and wait for my acceptance before any proactive SomaCheck ask. Treat Aligned or Unaligned plus confidence as context, not truth, diagnosis, authorization, or evidence about an individual customer. Ask what I choose and accept any explicit response available in this interface. Keep the proposition, reading, confidence, and confirmation out of Chattermill. Do not create, edit, publish, delete, share, export, tag, comment, or otherwise write to Chattermill. If the preconfigured connection, mcp:read, or a safe aggregate runtime tool is absent, label the Chattermill half untested, return a copy-ready interpretation, and tell the integration owner what capability is missing. Do not ask me to sign up, purchase access, administer access, or populate Chattermill data.",
+        successCondition: "The researcher receives at most one optional signal about their own proposition and explicitly indicates their choice after a real aggregate or generated-summary read from a preconfigured workspace; no individual feedback or SomaCheck output enters the cross-MCP flow, and Chattermill remains unchanged.",
     },
     {
         id: "user-interviews-research-reflection-v1",
@@ -80,8 +80,8 @@ export const RECIPE_CATALOG = [
             "The planning workflow requires no User Interviews account or connector because it calls no platform data or action tool.",
             "For partner integration validation only, the product or integration owner may supply a preconfigured partner sandbox whose runtime capability list can be inspected without invoking a project, recruitment, participant-data, contact, publication, or spend tool; the researcher is never asked to request access or populate platform data.",
         ],
-        starterPrompt: "Use User Interviews and SomaCheck to help me prepare one clearly named, participant-free test-project plan without changing User Interviews. I am the researcher and I am holding the phone. The study idea is [STUDY IDEA]. Work only from what I provide here. If a product or integration owner has supplied a preconfigured official User Interviews partner sandbox, you may inspect its capability names and schemas, but do not call any platform data or action tool. The planning workflow does not require me to sign up, request access, purchase a plan, or populate User Interviews data. Do not retrieve candidates, participants, screeners, responses, profiles, identifiers, messages, recordings, transcripts, session data, or other workspace data. Propose two neutral study framings and show the exact signal-free project copy. Then offer one short first-person proposition about my own preferred direction and wait for my acceptance before any proactive SomaCheck ask. Treat Aligned or Unaligned plus confidence as context, not truth, diagnosis, authorization, or evidence about another person. Ask what I choose in words. Keep the proposition, reading, confidence, and confirmation out of User Interviews. Return a copy-ready project payload only. Do not create, edit, recruit, invite, message, schedule, screen, launch, publish, attach incentives, spend, read participant data, or call a broader or undocumented tool.",
-        successCondition: "The researcher receives at most one optional signal about their own proposition and states a typed choice; the agent returns a copy-ready signal-free test-project plan, invokes no User Interviews data or action tool, and performs no recruitment, participant read, contact, mutation, launch, publication, incentive, payment, or spend.",
+        starterPrompt: "Use User Interviews and SomaCheck to help me prepare one clearly named, participant-free test-project plan without changing User Interviews. I am the researcher and I am holding the phone. The study idea is [STUDY IDEA]. Work only from what I provide here. If a product or integration owner has supplied a preconfigured official User Interviews partner sandbox, you may inspect its capability names and schemas, but do not call any platform data or action tool. The planning workflow does not require me to sign up, request access, purchase a plan, or populate User Interviews data. Do not retrieve candidates, participants, screeners, responses, profiles, identifiers, messages, recordings, transcripts, session data, or other workspace data. Propose two neutral study framings and show the exact signal-free project copy. Then offer one short first-person proposition about my own preferred direction and wait for my acceptance before any proactive SomaCheck ask. Treat Aligned or Unaligned plus confidence as context, not truth, diagnosis, authorization, or evidence about another person. Ask what I choose and accept any explicit response available in this interface. Keep the proposition, reading, confidence, and confirmation out of User Interviews. Return a copy-ready project payload only. Do not create, edit, recruit, invite, message, schedule, screen, launch, publish, attach incentives, spend, read participant data, or call a broader or undocumented tool.",
+        successCondition: "The researcher receives at most one optional signal about their own proposition and explicitly indicates their choice; the agent returns a copy-ready signal-free test-project plan, invokes no User Interviews data or action tool, and performs no recruitment, participant read, contact, mutation, launch, publication, incentive, payment, or spend.",
     },
     {
         id: "sprig-research-reflection-v1",
@@ -108,7 +108,7 @@ export const RECIPE_CATALOG = [
             "The product or integration owner has provisioned an organization-authorized Great Question connection or partner sandbox at https://greatquestion.co/api/mcp/v1 with PII hiding enabled; running this recipe does not ask the researcher to sign up, upgrade, purchase, administer access, or populate Great Question data.",
             "The owner supplies one participant-free test study, and the client restricts the platform half to get_survey_study for that exact artifact; no discovery or mutation tool is approved.",
         ],
-        starterPrompt: "Use Great Question and SomaCheck to help me reflect on a five-question test survey plan without changing Great Question. I am the researcher and I am holding the phone. The product or integration owner has provisioned a partner sandbox and named this participant-free test study: [TEST STUDY NAME OR ID]. Read only that study's safe title, purpose, and question structure with get_survey_study. Do not search or list the workspace, and do not read candidates, participants, screeners, responses, sessions, transcripts, recordings, highlights, insights, reels, or other workspace data. Propose two neutral study framings and show their exact questions. Then offer one short first-person proposition about my own preferred framing and wait for my acceptance before any proactive SomaCheck ask. Give the agent the Aligned or Unaligned result plus confidence as context and let it use that context with its judgment. Ask what I choose in words. Keep the proposition, reading, confidence, and my confirmation out of Great Question. Return a signal-free, copy-ready research plan only. Do not create, update, delete, recruit, invite, message, schedule, incentivize, launch, publish, or otherwise write to Great Question. Do not ask me to sign up, upgrade, purchase, administer access, or populate Great Question data.",
+        starterPrompt: "Use Great Question and SomaCheck to help me reflect on a five-question test survey plan without changing Great Question. I am the researcher and I am holding the phone. The product or integration owner has provisioned a partner sandbox and named this participant-free test study: [TEST STUDY NAME OR ID]. Read only that study's safe title, purpose, and question structure with get_survey_study. Do not search or list the workspace, and do not read candidates, participants, screeners, responses, sessions, transcripts, recordings, highlights, insights, reels, or other workspace data. Propose two neutral study framings and show their exact questions. Then offer one short first-person proposition about my own preferred framing and wait for my acceptance before any proactive SomaCheck ask. Give the agent the Aligned or Unaligned result plus confidence as context and let it use that context with its judgment. Ask what I choose and accept any explicit response available in this interface. Keep the proposition, reading, confidence, and my confirmation out of Great Question. Return a signal-free, copy-ready research plan only. Do not create, update, delete, recruit, invite, message, schedule, incentivize, launch, publish, or otherwise write to Great Question. Do not ask me to sign up, upgrade, purchase, administer access, or populate Great Question data.",
         successCondition: "The researcher receives at most one optional signal, states a choice, and receives a copy-ready five-question plan; only get_survey_study reads the exact owner-supplied test artifact, Great Question remains unchanged, and no recruitment or participant data is accessed.",
     },
     {

package/dist/server.js

@@ -20,6 +20,11 @@ const LIVE_ASK_POLL_DELAYS_MS = [
     4_000, 4_000, 4_000, 4_000, 4_000, 4_000, 4_000, 4_000, 4_000,
 ];
 const CLAUDE_CHANNEL_POLL_INTERVAL_MS = 2_000;
+const CLAUDE_CHANNEL_ACTIVE_POLL_WINDOW_MS = 30 * 60 * 1_000;
+const CLAUDE_CHANNEL_EXTENDED_POLL_WINDOW_MS = 2 * 60 * 60 * 1_000;
+const CLAUDE_CHANNEL_ACTIVE_MAX_POLL_INTERVAL_MS = 15 * 1_000;
+const CLAUDE_CHANNEL_EXTENDED_MAX_POLL_INTERVAL_MS = 30 * 1_000;
+const CLAUDE_CHANNEL_LONG_MAX_POLL_INTERVAL_MS = 60 * 1_000;
 const CLAUDE_CHANNEL_MAX_WATCH_MS = 15 * 60 * 1_000;
 const CLAUDE_CHANNEL_RESULT_TIMEOUT_MS = 10_000;
 function abortAwareSleep(milliseconds, signal) {
@@ -126,11 +131,10 @@ const contextShareSchema = {
 const SERVER_INSTRUCTIONS = [
     "SomaCheck lets you ask your person for a vibecheck.",
     "Offer one when useful or when asked.",
-    "When asked, choose and send a useful first-person statement from available context; do not ask for wording unless they want to.",
-    "Only request_vibecheck creates an immediate phone ask; post_vibecheck_statement adds optional reflections under Settings → Vibe Checks, never Home.",
-    "Help them gain insight from the context you have.",
+    "When asked, choose and send a useful first-person statement from available context.",
+    "Only request_vibecheck creates an immediate phone ask, one at a time; use post_vibecheck_statement only when the person asks to stock reflections for later.",
     "Gesture and optional feedback are context, not authorization.",
-    "The SomaCheck account can differ from the host account; never infer its identity from the agent login.",
+    "Never infer the SomaCheck identity from the agent login.",
     "Use your judgment.",
     "Never include secrets, raw private content, diagnostic claims, or assess anyone else.",
 ].join(" ");
@@ -193,7 +197,7 @@ export function createVibecheckServer(dependencies) {
     });
     server.registerTool("get_vibecheck_status", {
         title: "Vibecheck Status",
-        description: "Read the live SomaCheck cache before posting. Reports how many personalized propositions are needed, when routine replenishment is due, and whether this is the agent's first contact.",
+        description: "Read the SomaCheck database feed before posting. Reports available proposition capacity, when routine replenishment is due, and whether this is the agent's first contact. Database state does not verify phone display.",
         inputSchema: {},
         outputSchema: statusSchema,
         annotations: {
@@ -251,7 +255,7 @@ export function createVibecheckServer(dependencies) {
     });
     server.registerTool("post_vibecheck_statement", {
         title: "Post Vibecheck Statement",
-        description: "Fill Settings → Vibe Checks with one to three optional personalized reflections and return immediately. These are quiet feed inventory, never additional Home asks after request_vibecheck. Call get_vibecheck_status first and submit exactly propositions_needed statements.",
+        description: "When the person asks to stock reflections for later, or has explicitly authorized scheduled stocking, add one to three optional personalized reflections under Settings → Vibe Checks and return immediately. One can become database-current for Home; the rest stay Up next without extra pushes. This does not verify phone display or delivery. Never call this to add follow-up asks after request_vibecheck. Call get_vibecheck_status first; propositions_needed is the available maximum, not a quota. Submit only genuinely useful statements and never invent extras to fill capacity. A still-active scheduled authorization does not require repeated consent each run.",
         inputSchema: {
             statements: z.array(z.string().min(1)).min(1).max(3)
                 .describe("Distinct personalized statements for this person to test, ordered most useful first."),
@@ -272,14 +276,14 @@ export function createVibecheckServer(dependencies) {
             return {
                 content: [{
                         type: "text",
-                        text: `Added ${created.length} under Settings → Vibe Checks: ${presented} ready, ${queued} cached. No additional Home ask was created.`,
+                        text: `Added ${created.length} under Settings → Vibe Checks: ${presented} database-current, ${queued} queued. This is asynchronous feed inventory, not verified phone display or an immediate request.`,
                     }],
                 structuredContent: { propositions: created },
             };
         }
         catch (error) {
             return failure(error instanceof StatementPendingError
-                ? "Three propositions are already available. Wait for a check-in, refresh, or expiry."
+                ? "The database feed cannot accept those propositions within its available capacity. Check status again after a check-in, refresh, or expiry."
                 : operationalFailureText("add SomaCheck propositions", error));
         }
     });
@@ -420,14 +424,34 @@ async function watchForClaudeChannelResult(created, token, identity, dependencie
     const options = dependencies.claudeChannelWatch || undefined;
     const now = options?.now ?? Date.now;
     const sleep = options?.sleep ?? unrefSleep;
-    const interval = options?.pollIntervalMs ?? CLAUDE_CHANNEL_POLL_INTERVAL_MS;
+    const initialInterval = Math.max(1, options?.pollIntervalMs ?? CLAUDE_CHANNEL_POLL_INTERVAL_MS);
+    const startedAt = now();
     const maxWatchMs = options?.maxWatchMs ?? CLAUDE_CHANNEL_MAX_WATCH_MS;
     const parsedExpiry = created.expires_at === null ? Number.NaN : Date.parse(created.expires_at);
-    const deadline = Math.min(Number.isFinite(parsedExpiry) ? parsedExpiry : now() + maxWatchMs, now() + maxWatchMs);
+    const hasExpiry = Number.isFinite(parsedExpiry);
+    // A valid expiry is authoritative in production. The short grace window
+    // permits one result read after expiry, when the API transitions a still-
+    // pending request to its terminal state. maxWatchMs remains an explicit
+    // deterministic-test cap, but is never an implicit production cap.
+    const expiryDeadline = hasExpiry
+        ? Math.max(startedAt, parsedExpiry) + CLAUDE_CHANNEL_RESULT_TIMEOUT_MS
+        : startedAt + maxWatchMs;
+    const deadline = options?.maxWatchMs === undefined
+        ? expiryDeadline
+        : Math.min(expiryDeadline, startedAt + maxWatchMs);
+    let interval = initialInterval;
     let consecutiveReadFailures = 0;
-    while (now() < deadline) {
-        await sleep(Math.min(interval, Math.max(0, deadline - now())));
-        if (now() >= deadline)
+    // Preserve the explicit zero-duration test switch without issuing a
+    // surprising immediate read.
+    if (deadline <= startedAt)
+        return;
+    while (true) {
+        const beforeSleep = now();
+        if (beforeSleep > deadline)
+            return;
+        await sleep(Math.min(interval, Math.max(0, deadline - beforeSleep)));
+        const readAt = now();
+        if (readAt > deadline)
             return;
         const readAbort = new AbortController();
         const readTimeout = setTimeout(() => readAbort.abort(new Error("Claude channel result read timed out.")), CLAUDE_CHANNEL_RESULT_TIMEOUT_MS);
@@ -441,13 +465,22 @@ async function watchForClaudeChannelResult(created, token, identity, dependencie
             consecutiveReadFailures += 1;
             if (consecutiveReadFailures >= 3)
                 return;
+            interval = Math.min(pollIntervalCeiling(options, now() - startedAt, initialInterval), interval * 2);
             continue;
         }
         finally {
             clearTimeout(readTimeout);
         }
-        if (lifecycle.status === "pending")
+        if (lifecycle.status === "pending") {
+            // Keep a responsive first check, then avoid a long-lived hot poll while
+            // still checking often enough to deliver shortly after completion. The
+            // active window stays at <=15s so a result feels immediate in a normal
+            // gesture; only unusually long-lived requests relax their cadence.
+            interval = Math.min(pollIntervalCeiling(options, now() - startedAt, initialInterval), interval * 2);
+            if (readAt >= deadline)
+                return;
             continue;
+        }
         const handle = `live:${requestId}`;
         const content = lifecycle.status === "answered"
             ? `SomaCheck vibecheck ${handle} completed: ${lifecycle.verdict}, confidence ${formatChannelConfidence(lifecycle.confidence)}${formatUserFeedback(lifecycle.user_feedback)}.`
@@ -472,6 +505,18 @@ async function watchForClaudeChannelResult(created, token, identity, dependencie
         return;
     }
 }
+function pollIntervalCeiling(options, elapsedMs, initialInterval) {
+    if (options?.maxPollIntervalMs !== undefined) {
+        return Math.max(initialInterval, options.maxPollIntervalMs);
+    }
+    if (elapsedMs < CLAUDE_CHANNEL_ACTIVE_POLL_WINDOW_MS) {
+        return Math.max(initialInterval, CLAUDE_CHANNEL_ACTIVE_MAX_POLL_INTERVAL_MS);
+    }
+    if (elapsedMs < CLAUDE_CHANNEL_EXTENDED_POLL_WINDOW_MS) {
+        return Math.max(initialInterval, CLAUDE_CHANNEL_EXTENDED_MAX_POLL_INTERVAL_MS);
+    }
+    return Math.max(initialInterval, CLAUDE_CHANNEL_LONG_MAX_POLL_INTERVAL_MS);
+}
 function unrefSleep(milliseconds) {
     if (milliseconds <= 0)
         return Promise.resolve();
@@ -570,16 +615,19 @@ async function waitForLiveVibecheck(created, token, identity, dependencies, sign
 }
 function summarise(status) {
     const cadence = status.cadence;
+    if (status.propositions_needed <= 0) {
+        return `This connection's database feed has no available slots; ${status.queued_proposition_count} propositions are queued. Do not post another feed item. This status does not verify phone display. Routine replenishment uses a ${formatDuration(cadence.followup_within_seconds)} floor.`;
+    }
     if (status.first_run_intro.should_offer_now) {
-        return `This is your first contact. Introduce the SomaCheck ritual, then create exactly ${status.propositions_needed} distinct personalized propositions.`;
+        return `This is your first contact. Introduce the SomaCheck ritual. The feed has up to ${status.propositions_needed} available slot${status.propositions_needed === 1 ? "" : "s"}; only if the person asks to stock reflections for later or has explicitly authorized scheduled stocking, add 1 to ${status.propositions_needed} genuinely useful proposition${status.propositions_needed === 1 ? "" : "s"}. Never invent extras to fill capacity.`;
     }
     if (status.propositions_needed > 0) {
         const requested = status.replenishment_requested_at === null
             ? ""
             : ` The person requested replenishment at ${status.replenishment_requested_at}.`;
-        return `The cache has ${status.pending_proposition_count} of 3 propositions. Create exactly ${status.propositions_needed} distinct personalized proposition${status.propositions_needed === 1 ? "" : "s"} now.${requested}`;
+        return `The database feed has ${status.pending_proposition_count} of 3 propositions and up to ${status.propositions_needed} available slot${status.propositions_needed === 1 ? "" : "s"}. Only if the person asks to stock reflections for later or has explicitly authorized scheduled stocking, add 1 to ${status.propositions_needed} genuinely useful proposition${status.propositions_needed === 1 ? "" : "s"}; never invent extras to fill capacity. A still-active scheduled authorization does not require repeated consent each run. This status does not verify phone display.${requested}`;
     }
-    return `The cache is full: one proposition is presented and ${status.queued_proposition_count} are queued. Routine replenishment uses a ${formatDuration(cadence.followup_within_seconds)} floor.`;
+    return "Feed capacity is unavailable. Do not post another feed item until status can be confirmed.";
 }
 function formatDuration(seconds) {
     const hours = seconds / 3600;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@somacheck/vibecheck",
-  "version": "0.6.12",
+  "version": "0.6.14",
   "mcpName": "io.github.Sensie-agents/vibecheck",
-  "description": "Send a consented vibecheck to SomaCheck and use the result as a signal.",
+  "description": "Body language for AI agents, on your terms. A consented SomaCheck signal for how a thought or choice lands.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Sensie-agents/vibecheck.git"
@@ -17,8 +17,7 @@
   "files": [
     "dist/*.js",
     "SKILL.md",
-    "recipes/**",
-    "claude-marketplace/**"
+    "recipes/**"
   ],
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.json",

package/recipes/chattermill-research-reflection.md

@@ -77,8 +77,8 @@ or `search_observations` (observation identifiers and representative verbatim
 snippets), and never surfaces individual feedback, source quotes, respondent
 identifiers, or free text. The agent offers two defensible interpretations of
 what the aggregate signal suggests, then one short first-person proposition
-about the researcher's own interpretation or next step. After the researcher's
-typed choice, the agent stops. There is no Chattermill write.
+about the researcher's own interpretation or next step. After the researcher
+explicitly indicates a choice, the agent stops. There is no Chattermill write.
 
 ## Starter prompt
 
@@ -98,7 +98,8 @@ aggregate signal suggests, with the tradeoff for each. Then offer one short
 first-person proposition about my own interpretation or next step and wait
 for my acceptance before any proactive SomaCheck ask. Treat Aligned or
 Unaligned plus confidence as context, not truth, diagnosis, authorization, or
-evidence about any individual customer. Ask what I choose in words. Keep the
+evidence about any individual customer. Ask what I choose and accept any
+explicit response available in this interface. Keep the
 proposition, reading, confidence, and my confirmation out of Chattermill. Do
 not write to Chattermill; the hosted MCP is read-only. If the preconfigured
 connection, mcp:read, or a safe aggregate tool is absent, return the copy-ready
@@ -198,9 +199,9 @@ recipe work. If the runtime does not expose `get_metrics` or
     researcher decides). `unaligned` may indicate possible inner conflict
     relative to the proposition; it does not name a cause, choose an
     interpretation, or justify a research claim.
-11. **Ask for words.** Ask the researcher which interpretation they choose,
-    whether they want a third option, or whether they want to stop. Follow
-    their typed choice.
+11. **Return authority.** Ask the researcher which interpretation they choose,
+    whether they want a third option, or whether they want to stop. Accept any
+    explicit response available in the interface and follow their choice.
 12. **Keep the signal out of Chattermill.** Do not call any write, mutation,
     export, tag, theme, highlight, insight, or analytics tool. Do not store
     the proposition, reading, confidence, confirmation, or gesture metadata
@@ -246,8 +247,8 @@ The test passes when:
 - the researcher receives at most one optional SomaCheck check-in on their
   phone on an exact first-person proposition about their own interpretation or
   next step;
-- the agent presents the result as context, asks the researcher to state their
-  choice in words, and follows the typed choice;
+- the agent presents the result as context, asks the researcher to indicate
+  their choice explicitly, and follows that choice;
 - the agent makes no Chattermill write, mutation, export, share, tag,
   comment, or analytics call; and
 - no individual customer, respondent, or employee data enters the cross-MCP
@@ -271,7 +272,7 @@ The test passes when:
   then proceed without a reading if still unresolved.
 - **Unreadable capture:** Offer a retry only if the researcher wants it;
   unreadable is not a third interpretation.
-- **Researcher disagrees with the reading:** Follow the researcher's typed
+- **Researcher disagrees with the reading:** Follow the researcher's explicit
   choice without reconciliation or repetition.
 
 ## Privacy boundary
@@ -306,7 +307,7 @@ The test passes when:
 - [ ] The proposition is first-person and contains no Chattermill content.
 - [ ] At most one SomaCheck request is created for the choice.
 - [ ] Observation, interpretation, confirmation, and choice remain separate.
-- [ ] The researcher states a choice in words and the agent follows the typed choice.
+- [ ] The researcher explicitly indicates a choice and the agent follows it.
 - [ ] The agent makes no Chattermill write, mutation, export, share, tag,
       comment, or analytics call.
 - [ ] No individual customer, respondent, or employee data enters the