@su-record/vibe 4.2.34 → 4.2.36

package/hooks/slice-guard.cjs

@@ -2,6 +2,15 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { sliceTargets } = require('./slice-command.cjs');
 const { readTargets, recordSlice } = require('./slice-store.cjs');
+/** Past this many lines a file only to be understood is better read by `vibe read --ask`. */
+const READ_ADVISE_LINES = 400;
+
+const SOURCE_EXTENSION = /\.(?:[cm]?[jt]sx?|py|go|rs|java|kt|c|cpp|h|cs|rb|sh|sql|md|mdx|txt|rst|json|ya?ml|toml|ini|xml|html|css|csv|tsv)$/i;
+const SOURCE_NAME = /^(?:README|Dockerfile|Makefile)(?:\..*)?$/i;
+const PROTECTED_PATH = /(?:^|\/)scenarios\.ya?ml$|(?:^|\/)specs?(?:\/|$)/i;
+const BLOCKED = 'Partial reading of a protected file is blocked.';
+const WARNED = 'Partial source/document reading can omit requirements.';
+const INTENT_FILES = ['.vibe', '.vibe/intent.md'];
 
 function within(directory, file) {
   const relative = path.relative(directory, file);
@@ -13,17 +22,20 @@ function exempt(root, file) {
 }
 function protectedFile(root, file, files) {
   const relative = path.relative(root, file).split(path.sep).join('/');
-  if (relative === '.vibe' || relative === '.vibe/intent.md' || /(?:^|\/)scenarios\.ya?ml$/i.test(relative) || /(?:^|\/)specs?(?:\/|$)/i.test(relative)) return true;
+  if (INTENT_FILES.includes(relative) || PROTECTED_PATH.test(relative)) return true;
   return files.some(protectedPath => file === protectedPath || within(file, protectedPath));
 }
 function sourceFile(file) {
-  if (/\.(?:[cm]?[jt]sx?|py|go|rs|java|kt|c|cpp|h|cs|rb|sh|sql|md|mdx|txt|rst|json|ya?ml|toml|ini|xml|html|css|csv|tsv)$/i.test(file)) return true;
-  if (/^(?:README|Dockerfile|Makefile)(?:\..*)?$/i.test(path.basename(file))) return true;
+  if (SOURCE_EXTENSION.test(file) || SOURCE_NAME.test(path.basename(file))) return true;
   try { return fs.lstatSync(file).isDirectory(); } catch { return false; }
 }
 function guidance(client) {
   const tool = client === 'codex' ? 'cat (the entire file)' : 'the Read tool (the entire file)';
-  return `Open the selected files in full with ${tool}. Read fewer files from vibe state; use grep/rg/find only to locate files or lines. For over 400 lines when not editing, use vibe read --ask.`;
+  return [
+    `Open the selected files in full with ${tool}.`,
+    'Read fewer files from vibe state; use grep/rg/find only to locate files or lines.',
+    `For over ${READ_ADVISE_LINES} lines when not editing, use vibe read --ask.`,
+  ].join(' ');
 }
 function sliceGuard(root, command, client = 'claude', cwd = root) {
   try { root = fs.realpathSync(root); cwd = fs.realpathSync(path.resolve(root, cwd)); } catch { return { decision: 'none', unavailable: true }; }
@@ -36,6 +48,8 @@ function sliceGuard(root, command, client = 'claude', cwd = root) {
   if (decision === 'none') return { decision, unavailable: !mirror.available };
   const recorded = recordSlice(root, decision);
   const unavailable = !mirror.available || !recorded;
-  return { decision, unavailable, recorded, message: `[vibe] ${decision === 'block' ? 'Partial reading of a protected file is blocked.' : 'Partial source/document reading can omit requirements.'} ${guidance(client)}${unavailable ? ' Read-target mirror or count storage unavailable.' : ''}` };
+  const headline = decision === 'block' ? BLOCKED : WARNED;
+  const storage = unavailable ? ' Read-target mirror or count storage unavailable.' : '';
+  return { decision, unavailable, recorded, message: `[vibe] ${headline} ${guidance(client)}${storage}` };
 }
-module.exports = { sliceGuard };
+module.exports = { READ_ADVISE_LINES, sliceGuard };

package/hooks/slice-store.cjs

@@ -2,8 +2,17 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { randomBytes } = require('node:crypto');
 const { privateDirectory, readPrivate, writePrivate } = require('./private-store.cjs');
-const { digest, json } = require('./session-files.cjs');
+const { STATE_FILE, INTENT_HASH, digest, json } = require('./session-files.cjs');
 
+const MAX_TARGETS = 2048;
+const MAX_PATH_CHARS = 4096;
+const TARGETS_MAX_BYTES = 128 * 1024;
+const MARKER_MAX_BYTES = 4096;
+// One tiny file per recorded slice; a directory with more than this many store files is not read.
+const MAX_STORE_FILES = 32768;
+const COUNT_MAX_BYTES = 128;
+const COUNT_SUFFIX_BYTES = 12;
+const targetsName = root => `read-targets-${digest(root)}.json`;
 const prefix = root => `slice-${digest(root)}-`;
 const markerName = root => `slice-counts-${digest(root)}.json`;
 function explicitHome(env) {
@@ -15,20 +24,24 @@ function explicitHome(env) {
 function recordReadTargets(root, input, env) {
   try {
     root = fs.realpathSync(root);
-    if (!input || !/^[a-f0-9]{16,64}$/.test(input.intentHash) || !Array.isArray(input.files) || input.files.length > 2048 || input.files.some(file => typeof file !== 'string' || file.length >= 4096)) return false;
+    if (!input || !INTENT_HASH.test(input.intentHash) || !Array.isArray(input.files) || input.files.length > MAX_TARGETS) return false;
+    if (input.files.some(file => typeof file !== 'string' || file.length >= MAX_PATH_CHARS)) return false;
     const files = [...new Set(input.files.map(file => path.resolve(root, file)))];
     const body = JSON.stringify({ schemaVersion: 1, root, intentHash: input.intentHash, files });
-    if (Buffer.byteLength(body) > 131072) return false;
-    writePrivate(root, `read-targets-${digest(root)}.json`, body, explicitHome(env));
+    if (Buffer.byteLength(body) > TARGETS_MAX_BYTES) return false;
+    writePrivate(root, targetsName(root), body, explicitHome(env));
     return true;
   } catch { return false; }
 }
 function readTargets(root) {
   try {
-    const raw = readPrivate(root, `read-targets-${digest(root)}.json`, 131072);
+    const raw = readPrivate(root, targetsName(root), TARGETS_MAX_BYTES);
     if (raw === null) return { available: false, files: [] };
-    const saved = JSON.parse(raw), state = json(path.join(root, '.vibe/state.json'));
-    if (saved.schemaVersion !== 1 || saved.root !== root || saved.intentHash !== state.intentHash || !Array.isArray(saved.files) || saved.files.length > 2048 || saved.files.some(file => typeof file !== 'string' || !path.isAbsolute(file))) return { available: false, files: [] };
+    const saved = JSON.parse(raw), state = json(path.join(root, STATE_FILE));
+    const valid = saved.schemaVersion === 1 && saved.root === root && saved.intentHash === state.intentHash
+      && Array.isArray(saved.files) && saved.files.length <= MAX_TARGETS
+      && saved.files.every(file => typeof file === 'string' && path.isAbsolute(file));
+    if (!valid) return { available: false, files: [] };
     return { available: true, files: saved.files };
   } catch { return { available: false, files: [] }; }
 }
@@ -37,7 +50,7 @@ function recordSlice(root, decision) {
     if (!['block', 'warn'].includes(decision)) return false;
     if (!initializeSliceCounts(root)) return false;
     const counts = { blocked: Number(decision === 'block'), warned: Number(decision === 'warn') };
-    writePrivate(root, `${prefix(root)}${randomBytes(12).toString('hex')}.json`, JSON.stringify(counts));
+    writePrivate(root, `${prefix(root)}${randomBytes(COUNT_SUFFIX_BYTES).toString('hex')}.json`, JSON.stringify(counts));
     return true;
   } catch { return false; }
 }
@@ -45,7 +58,7 @@ function initializeSliceCounts(root, env) {
   try {
     root = fs.realpathSync(root);
     const home = explicitHome(env);
-    const raw = readPrivate(root, markerName(root), 4096, home);
+    const raw = readPrivate(root, markerName(root), MARKER_MAX_BYTES, home);
     if (raw !== null) { const value = JSON.parse(raw); return value.schemaVersion === 1 && value.root === root; }
     writePrivate(root, markerName(root), JSON.stringify({ schemaVersion: 1, root }), home);
     return true;
@@ -55,14 +68,14 @@ function readSliceCounts(root, env) {
   try {
     root = fs.realpathSync(root);
     const home = explicitHome(env);
-    const marker = JSON.parse(readPrivate(root, markerName(root), 4096, home));
+    const marker = JSON.parse(readPrivate(root, markerName(root), MARKER_MAX_BYTES, home));
     if (!marker || marker.schemaVersion !== 1 || marker.root !== root) return null;
     const directory = privateDirectory(root, false, home);
     const files = fs.readdirSync(directory);
-    if (files.length > 32768) return null;
+    if (files.length > MAX_STORE_FILES) return null;
     const counts = { blocked: 0, warned: 0 };
     for (const file of files.filter(file => file.startsWith(prefix(root)))) {
-      const value = JSON.parse(readPrivate(root, file, 128, home));
+      const value = JSON.parse(readPrivate(root, file, COUNT_MAX_BYTES, home));
       if (!((value.blocked === 1 && value.warned === 0) || (value.blocked === 0 && value.warned === 1))) return null;
       counts.blocked += value.blocked; counts.warned += value.warned;
     }

package/internal/guides/code.md

@@ -12,6 +12,23 @@ Make the smallest change that fully solves the task. After reading the code it t
 
 Settle the data shape before the logic: when the right types and structures are chosen, the code that follows is plain. Where the language allows, make an illegal state impossible to write (a union of states instead of independent flags, a parsed type instead of a raw string), parse outside data once at the boundary where it enters, and keep the logic behind it pure and trusting. A script, migration or job that changes state reaches the same end state when run again after a partial run; check before acting rather than assuming a fresh start.
 
+The principles behind these steps, by their usual names:
+
+- YAGNI: build nothing for a future nobody asked for (step 1).
+- DRY: one fact lives in one place. A constant, a pattern or a rule used twice is defined once and imported, never copied into a second file.
+- KISS: the plainest construct that works; no cleverness a reader has to decode.
+- Single responsibility: a function does one thing, a file holds one responsibility. Name it by that responsibility; if the name needs "and", split it.
+
+Keep files and functions small. A source file stays at or under 400 lines and a function under about 50. Before adding to a file near or over 400 lines, put the new code in a new module named for its responsibility, or split the file first; never grow a file past 400 lines. The edit hook warns when an edit does, and `vibe check --all` fails on a source file the current work grew past 400 lines. A file that was already over the limit is split when the work touches its structure, not as unrelated cleanup.
+
+Write for the next reader:
+
+- Fix output where it is produced. Never patch a generated string, file or result afterwards with `.replace` or string surgery; change the code that builds it.
+- Build long text from one item per line (an array joined, or a template over several lines), not one line of hundreds of characters.
+- Keep a function at one level of detail: steps read as named calls, and the details live in the called functions.
+- Return early instead of nesting conditions; avoid boolean flags that switch a function between two jobs.
+- No hardcoding. A number, limit, timeout, path, URL, name or message that means something gets a named constant, defined once where its meaning lives, or comes from configuration when a user or environment may need another value. Never repeat a literal across files, never bury a magic number inside logic, and never hardcode a value the code can read or derive (a version, a path, a list that exists elsewhere). A literal whose meaning is plain where it stands (0, 1, an empty string) may stay.
+
 Be lazy about the solution, never about the change: finish every caller, test and fixture it breaks. Before fixing a bug, find every caller of the function (`vibe callers <name>`) and fix the root cause once in the shared code. New logic with a branch, a loop, a parser, money or security leaves one small test or assert-based self-check; trivial changes need none. Never cut validation at trust boundaries, error handling that prevents data loss, security, accessibility or anything the user asked for. End the report with what was skipped or not checked.
 
 Apply these antislop criteria while writing and revising the affected code, without waiting for a separate request:

package/mcpb/server/index.js

@@ -17,6 +17,22 @@ import readline from 'node:readline';
 const PROTOCOL = '2025-06-18';
 const VERSION = process.env.VIBE_MCPB_VERSION || '0.0.0';
 const project = process.env.VIBE_PROJECT_DIR || process.cwd();
+const VIBE_CLIENT = 'claude-app';
+const RUN_TIMEOUT_MS = 10 * 60 * 1000; // a check run may build and test the whole project
+const TOOL_PREFIX = 'vibe_';
+const INVALID_PARAMS = -32602;
+const METHOD_NOT_FOUND = -32601;
+const PARSE_ERROR = -32700;
+const INSTALL_HINT = 'npm i -g @su-record/vibe';
+const INSTRUCTIONS_TAIL = [
+  'Use the vibe tool with operation brief first; discover returns an internal operation schema.',
+  'The brief includes the personal FDE entry guidance; no extra model review by default.',
+  "Talk to the user in the user's language; write every record in English.",
+].join(' ');
+const ENTRY_DESCRIPTION = [
+  'Your personal FDE: project context, internal guidance, tools and skill extensions.',
+  'Use discover to inspect an operation before calling it.',
+].join(' ');
 
 const str = (description) => ({ type: 'string', description });
 const TOOLS = [
@@ -73,8 +89,11 @@ function findVibe() {
 const VIBE = findVibe();
 
 function runVibe(args, input) {
-  if (!VIBE) return { isError: true, text: 'the vibe CLI was not found — install it with `npm i -g @su-record/vibe`, or set its path in the extension settings (vibe executable)' };
-  const r = spawnSync(VIBE, [...args, '--json'], { cwd: project, encoding: 'utf-8', input, timeout: 600000, env: { ...process.env, VIBE_CLIENT: 'claude-app', PATH: `${path.dirname(VIBE)}${path.delimiter}${process.env.PATH || ''}` }, shell: process.platform === 'win32' });
+  if (!VIBE) {
+    return { isError: true, text: `the vibe CLI was not found — install it with \`${INSTALL_HINT}\`, or set its path in the extension settings (vibe executable)` };
+  }
+  const env = { ...process.env, VIBE_CLIENT, PATH: `${path.dirname(VIBE)}${path.delimiter}${process.env.PATH || ''}` };
+  const r = spawnSync(VIBE, [...args, '--json'], { cwd: project, encoding: 'utf-8', input, timeout: RUN_TIMEOUT_MS, env, shell: process.platform === 'win32' });
   if (r.error) return { isError: true, text: `could not run ${VIBE}: ${r.error.message}` };
   const text = (r.stdout || '').trim() || (r.stderr || '').trim() || `exit ${r.status}`;
   return { isError: r.status !== 0, text };
@@ -103,31 +122,40 @@ function handle(msg) {
   if (msg.id === undefined) return; // notification
   const { id, method, params = {} } = msg;
   if (method === 'initialize') {
-    return respond(id, { protocolVersion: params.protocolVersion || PROTOCOL, capabilities: { tools: {} }, serverInfo: { name: 'vibe', version: VERSION }, instructions: `vibe project: ${project}${fs.existsSync(`${project}/.vibe`) ? '' : ' (no .vibe yet — the first intent draft creates it)'} · CLI ${VIBE || 'not found — npm i -g @su-record/vibe'}. Use the vibe tool with operation brief first; discover returns an internal operation schema. The brief includes the personal FDE entry guidance; no extra model review by default. Talk to the user in the user's language; write every record in English.` });
+    const fresh = fs.existsSync(`${project}/.vibe`) ? '' : ' (no .vibe yet — the first intent draft creates it)';
+    const instructions = `vibe project: ${project}${fresh} · CLI ${VIBE || `not found — ${INSTALL_HINT}`}. ${INSTRUCTIONS_TAIL}`;
+    return respond(id, { protocolVersion: params.protocolVersion || PROTOCOL, capabilities: { tools: {} }, serverInfo: { name: 'vibe', version: VERSION }, instructions });
   }
   if (method === 'ping') return respond(id, {});
   if (method === 'tools/list') {
-    return respond(id, { tools: [{ name: 'vibe', description: 'Your personal FDE: project context, internal guidance, tools and skill extensions. Use discover to inspect an operation before calling it.', inputSchema: { type: 'object', properties: { operation: { type: 'string', enum: ['discover', ...TOOLS.map(t => t.name.slice(5))] }, arguments: { type: 'object', description: 'Arguments for the selected operation. discover accepts an optional operation name.' } }, required: ['operation'], additionalProperties: false } }] });
+    const operations = ['discover', ...TOOLS.map(t => t.name.slice(TOOL_PREFIX.length))];
+    const properties = {
+      operation: { type: 'string', enum: operations },
+      arguments: { type: 'object', description: 'Arguments for the selected operation. discover accepts an optional operation name.' },
+    };
+    const inputSchema = { type: 'object', properties, required: ['operation'], additionalProperties: false };
+    return respond(id, { tools: [{ name: 'vibe', description: ENTRY_DESCRIPTION, inputSchema }] });
   }
   if (method === 'tools/call') {
     const envelope = params.arguments || {};
     if (params.name === 'vibe' && envelope.operation === 'discover') {
       const selected = envelope.arguments?.operation;
-      const entries = selected ? TOOLS.filter(t => t.name === `vibe_${selected}`) : TOOLS;
-      if (!entries.length) return fail(id, -32602, `unknown operation: ${selected}`);
-      const result = entries.map(t => ({ operation: t.name.slice(5), description: t.description, ...(selected ? { inputSchema: { type: 'object', properties: t.args, required: t.required || [], additionalProperties: false } } : {}) }));
+      const entries = selected ? TOOLS.filter(t => t.name === `${TOOL_PREFIX}${selected}`) : TOOLS;
+      if (!entries.length) return fail(id, INVALID_PARAMS, `unknown operation: ${selected}`);
+      const schema = (t) => ({ type: 'object', properties: t.args, required: t.required || [], additionalProperties: false });
+      const result = entries.map(t => ({ operation: t.name.slice(TOOL_PREFIX.length), description: t.description, ...(selected ? { inputSchema: schema(t) } : {}) }));
       return respond(id, { content: [{ type: 'text', text: JSON.stringify(result) }] });
     }
-    const name = params.name === 'vibe' ? `vibe_${envelope.operation}` : params.name;
+    const name = params.name === 'vibe' ? `${TOOL_PREFIX}${envelope.operation}` : params.name;
     const tool = TOOLS.find((t) => t.name === name);
-    if (!tool) return fail(id, -32602, `unknown tool: ${params.name}`);
+    if (!tool) return fail(id, INVALID_PARAMS, `unknown tool: ${params.name}`);
     const a = params.name === 'vibe' ? envelope.arguments || {} : envelope;
     const invalid = invalidArguments(tool, a);
-    if (invalid) return fail(id, -32602, invalid);
+    if (invalid) return fail(id, INVALID_PARAMS, invalid);
     const r = runVibe(tool.cmd(a), tool.stdin ? tool.stdin(a) : undefined);
     return respond(id, { content: [{ type: 'text', text: r.text }], isError: r.isError });
   }
-  return fail(id, -32601, `method not found: ${method}`);
+  return fail(id, METHOD_NOT_FOUND, `method not found: ${method}`);
 }
 
 readline.createInterface({ input: process.stdin }).on('line', (line) => {
@@ -135,6 +163,6 @@ readline.createInterface({ input: process.stdin }).on('line', (line) => {
   try {
     handle(JSON.parse(line));
   } catch (error) {
-    fail(null, -32700, `parse error: ${error.message}`);
+    fail(null, PARSE_ERROR, `parse error: ${error.message}`);
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@su-record/vibe",
-  "version": "4.2.34",
+  "version": "4.2.36",
   "description": "Your personal FDE in Claude and Codex. Understand the work, use the right tools, deliver and retain useful context. One entry: vibe.",
   "type": "module",
   "bin": {