@vibecodetown/mcp-server 2.2.0 → 2.2.1

package/README.md

@@ -1,6 +1,6 @@
-# @vibecodetown/mcp-server
+# @vibecode/mcp-server
 
-[![npm version](https://img.shields.io/npm/v/@vibecodetown/mcp-server.svg)](https://www.npmjs.com/package/@vibecodetown/mcp-server)
+[![npm version](https://img.shields.io/npm/v/@vibecode/mcp-server.svg)](https://www.npmjs.com/package/@vibecode/mcp-server)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Tests](https://img.shields.io/badge/tests-140%20passing-brightgreen.svg)](#testing)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.0-blue.svg)](https://www.typescriptlang.org/)
@@ -28,13 +28,13 @@ curl -fsSL https://vibecode.town/install.sh | sh
 ### Manual Install
 
 ```bash
-npm install -g @vibecodetown/mcp-server
+npm install -g @vibecode/mcp-server
 ```
 
 ### Add to Claude Code
 
 ```bash
-claude mcp add vibecode npx @vibecodetown/mcp-server
+claude mcp add vibe-pm -- npx @vibecode/mcp-server
 ```
 
 ### Add to Cursor
@@ -118,8 +118,8 @@ On first tool call, the server automatically:
 
 ```bash
 # Clone and install
-git clone https://github.com/vibecode/vibecoding-helper
-cd vibecoding-helper/adapters/mcp-ts
+git clone https://github.com/yellowhama/vibe-pm
+cd vibe-pm/adapters/mcp-ts
 npm install
 
 # Build
@@ -176,7 +176,7 @@ tests/
   "mcpServers": {
     "vibecode": {
       "command": "npx",
-      "args": ["@vibecodetown/mcp-server"]
+      "args": ["@vibecode/mcp-server"]
     }
   }
 }
@@ -249,7 +249,7 @@ User (natural language)
     ↓
 AI Agent (Claude/Cursor/Codex)
     ↓ AGENTS.md rules
-MCP Server (@vibecodetown/mcp-server)
+MCP Server (@vibecode/mcp-server)
     ↓ vibe_pm.* tools
 Bootstrap Layer
     ↓ auto-download if missing
@@ -265,5 +265,5 @@ MIT
 ## Links
 
 - [Documentation](https://vibecode.town/docs)
-- [GitHub](https://github.com/vibecode/vibecoding-helper)
-- [Issues](https://github.com/vibecode/vibecoding-helper/issues)
+- [GitHub](https://github.com/yellowhama/vibe-pm)
+- [Issues](https://github.com/yellowhama/vibe-pm/issues)

package/build/auth/index.js

@@ -5,13 +5,11 @@
  * - Token caching and persistence
  * - Offline JWT verification
  * - Feature gating based on entitlements
- * - Credential storage (GitHub/NPM tokens)
  */
 export { TokenCache } from './token_cache.js';
 export { TokenVerifier } from './token_verifier.js';
 export { AuthGate } from './gate.js';
 export { PUBLIC_KEY } from './public_key.js';
-export { CredentialStore, getCredentialStore } from './credential_store.js';
 // Re-export convenience functions
 import { TokenCache } from './token_cache.js';
 import { TokenVerifier } from './token_verifier.js';

package/build/auth/public_key.js

@@ -12,11 +12,13 @@
  * 3. Release new client version
  */
 const ENV_PUBLIC_KEY = (process.env.VIBECODE_AUTH_PUBLIC_KEY || process.env.VIBE_AUTH_PUBLIC_KEY || "").trim();
-export const PUBLIC_KEY = ENV_PUBLIC_KEY ||
-    `-----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
-REPLACE_WITH_YOUR_PRODUCTION_PUBLIC_KEY
+// Development key - REPLACE WITH PRODUCTION KEY FOR RELEASE
+// Generate with: openssl ecparam -name prime256v1 -genkey -noout | openssl ec -pubout
+const DEV_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEE85F1OitXNxlIXw3/YD4EiBGmlTe
+yLIZWPhyHfOxe+01IeO/iYP9lbKXMDd0u8gN8KRfBwHel1lMddRA2Hnm9Q==
 -----END PUBLIC KEY-----`;
+export const PUBLIC_KEY = ENV_PUBLIC_KEY || DEV_PUBLIC_KEY;
 /**
  * JWT issuer for verification
  */

package/build/bootstrap/doctor.js

@@ -1,7 +1,68 @@
 // adapters/mcp-ts/src/bootstrap/doctor.ts
 // Health check tool for installation status
 import { ensureEngines, getEngineHealth, checkUpdates, validateCache } from "./installer.js";
-import { ENGINE_SPECS } from "./registry.js";
+import { ENGINE_SPECS, SKILL_SPEC } from "./registry.js";
+import { getSkillsHealth } from "./skills-installer.js";
+/**
+ * Build skill gates from skills health status
+ */
+function buildSkillGates(skillsHealth) {
+    const gates = [];
+    // Check if bundle is installed
+    if (!skillsHealth.installed) {
+        gates.push({
+            code: "SKILL_BUNDLE_MISSING",
+            severity: "FAIL",
+            message: "Skill bundle not found in package"
+        });
+        return gates;
+    }
+    // Check if index is valid
+    if (!skillsHealth.version) {
+        gates.push({
+            code: "SKILL_INDEX_INVALID",
+            severity: "FAIL",
+            message: "Skills index.json not found or invalid"
+        });
+        return gates;
+    }
+    // Check version mismatch
+    if (skillsHealth.version !== SKILL_SPEC.version) {
+        gates.push({
+            code: "SKILL_VERSION_MISMATCH",
+            severity: "WARN",
+            message: `Version mismatch: expected ${SKILL_SPEC.version}, got ${skillsHealth.version}`
+        });
+    }
+    // Check each skill
+    for (const skill of skillsHealth.skills) {
+        if (skill.status === "missing") {
+            gates.push({
+                code: "SKILL_BUNDLE_CORRUPTED",
+                severity: "FAIL",
+                message: skill.error ?? `Skill file missing: ${skill.id}`,
+                skillId: skill.id
+            });
+        }
+        else if (skill.status === "sha_mismatch") {
+            gates.push({
+                code: "SKILL_SHA_MISMATCH",
+                severity: "FAIL",
+                message: skill.error ?? `SHA256 mismatch for skill: ${skill.id}`,
+                skillId: skill.id
+            });
+        }
+        else if (skill.status === "ok") {
+            gates.push({
+                code: "SKILL_OK",
+                severity: "INFO",
+                message: `Skill OK: ${skill.id}`,
+                skillId: skill.id
+            });
+        }
+    }
+    return gates;
+}
 /**
  * Check engine installation status and return detailed health info
  * Triggers installation if engines are missing or outdated
@@ -42,9 +103,22 @@ export async function doctor() {
             missing: healthAfter.filter((h) => h.status === "missing").length,
             corrupted: healthAfter.filter((h) => h.status === "corrupted").length
         };
+        // Check skills health
+        const skillsHealth = getSkillsHealth();
+        const skillGates = buildSkillGates(skillsHealth);
+        // Determine skill status
+        let skillStatus = "OK";
+        const hasSkillFail = skillGates.some(g => g.severity === "FAIL");
+        const hasSkillWarn = skillGates.some(g => g.severity === "WARN");
+        if (hasSkillFail) {
+            skillStatus = "ERROR";
+        }
+        else if (hasSkillWarn) {
+            skillStatus = "WARN";
+        }
         // Determine overall status
         let status = "OK";
-        if (summaryAfter.missing > 0 || summaryAfter.corrupted > 0) {
+        if (summaryAfter.missing > 0 || summaryAfter.corrupted > 0 || hasSkillFail) {
             status = "ERROR";
         }
         else if (summaryAfter.needsUpdate > 0) {
@@ -53,6 +127,13 @@ export async function doctor() {
         return {
             status,
             engines,
+            skills: {
+                status: skillStatus,
+                version: skillsHealth.version,
+                bundlePath: skillsHealth.bundlePath,
+                gates: skillGates,
+                summary: skillsHealth.summary
+            },
             summary: summaryAfter
         };
     }
@@ -60,6 +141,17 @@ export async function doctor() {
         return {
             status: "ERROR",
             engines: {},
+            skills: {
+                status: "ERROR",
+                version: null,
+                bundlePath: null,
+                gates: [{
+                        code: "SKILL_BUNDLE_MISSING",
+                        severity: "FAIL",
+                        message: "Failed to check skills health"
+                    }],
+                summary: { total: 0, ok: 0, missing: 0, corrupted: 0 }
+            },
             summary: {
                 total: Object.keys(ENGINE_SPECS).length,
                 ok: 0,
@@ -76,10 +168,26 @@ export async function doctor() {
  */
 export async function healthCheck() {
     const health = await getEngineHealth();
-    const allOk = health.every((h) => h.status === "ok");
+    const skillsHealth = getSkillsHealth();
+    const engineOk = health.every((h) => h.status === "ok");
+    const skillsOk = skillsHealth.installed &&
+        skillsHealth.summary.missing === 0 &&
+        skillsHealth.summary.corrupted === 0;
+    let skillStatus = "OK";
+    if (!skillsHealth.installed || skillsHealth.summary.missing > 0 || skillsHealth.summary.corrupted > 0) {
+        skillStatus = "ERROR";
+    }
+    else if (skillsHealth.version !== SKILL_SPEC.version) {
+        skillStatus = "WARN";
+    }
     return {
-        status: allOk ? "OK" : "NEEDS_ATTENTION",
-        engines: health
+        status: (engineOk && skillsOk) ? "OK" : "NEEDS_ATTENTION",
+        engines: health,
+        skills: {
+            status: skillStatus,
+            version: skillsHealth.version,
+            summary: skillsHealth.summary
+        }
     };
 }
 /**

package/build/bootstrap/installer.js

@@ -10,13 +10,25 @@ import { promisify } from "node:util";
 import { ENGINE_SPECS } from "./registry.js";
 import { detectPlatform, exeName } from "./platform.js";
 import { withLock } from "./lock.js";
+import { isDownloadTimeoutError, isDownload404Error, isDownloadFailedError, } from "../errors.js";
 const execFileAsync = promisify(execFile);
 // ============================================================
-// Configuration
+// Configuration (P2-26: Environment variable support)
 // ============================================================
-const MAX_RETRIES = 3;
-const RETRY_DELAY_MS = 1000;
-const DOWNLOAD_TIMEOUT_MS = 60_000;
+function getEnvInt(name, defaultValue) {
+    const value = process.env[name];
+    if (!value)
+        return defaultValue;
+    const parsed = parseInt(value, 10);
+    return Number.isNaN(parsed) ? defaultValue : parsed;
+}
+// Configurable via environment variables:
+// VIBECODE_MAX_RETRIES - Maximum download retry attempts (default: 3)
+// VIBECODE_RETRY_DELAY_MS - Delay between retries in ms (default: 1000)
+// VIBECODE_DOWNLOAD_TIMEOUT_MS - Download timeout in ms (default: 60000)
+const MAX_RETRIES = getEnvInt("VIBECODE_MAX_RETRIES", 3);
+const RETRY_DELAY_MS = getEnvInt("VIBECODE_RETRY_DELAY_MS", 1000);
+const DOWNLOAD_TIMEOUT_MS = getEnvInt("VIBECODE_DOWNLOAD_TIMEOUT_MS", 60_000);
 function isTruthyEnv(value) {
     if (!value)
         return false;
@@ -29,6 +41,19 @@ function isOfflineMode() {
 function isDebugMode() {
     return isTruthyEnv(process.env.VIBECODE_DEBUG);
 }
+function getGitHubToken() {
+    return process.env.GITHUB_TOKEN?.trim() || process.env.GH_TOKEN?.trim() || null;
+}
+function getAuthHeaders() {
+    const token = getGitHubToken();
+    const headers = {
+        "User-Agent": "vibecode-installer",
+    };
+    if (token) {
+        headers["Authorization"] = `token ${token}`;
+    }
+    return headers;
+}
 // ============================================================
 // Cache Management
 // ============================================================
@@ -162,11 +187,12 @@ function makeBootstrapError(userMessage, internal) {
 }
 function userMessageForBootstrapFailure(err) {
     const msg = err instanceof Error ? err.message : String(err);
-    if (msg.includes("download_timeout") || msg.includes("AbortError")) {
+    // P1-4: Use centralized error patterns for consistent detection
+    if (isDownloadTimeoutError(msg)) {
         return "다운로드 시간이 초과되었습니다. 인터넷 연결/방화벽 설정을 확인한 뒤 다시 시도해주세요.";
     }
     // P0-2: Better 404 error handling with recovery options
-    if (msg.includes("404") || msg.includes("no_matching_asset") || msg.includes("download_failed:404")) {
+    if (isDownload404Error(msg)) {
         return `릴리스를 찾지 못했습니다.
 
 해결 방법:
@@ -174,7 +200,7 @@ function userMessageForBootstrapFailure(err) {
   2. VIBECODE_OFFLINE=1로 업데이트 스킵
   3. VIBECODE_DEBUG=1로 상세 로그 확인`;
     }
-    if (msg.startsWith("download_failed") || msg.includes("fetch")) {
+    if (isDownloadFailedError(msg)) {
         return "다운로드에 실패했습니다. 인터넷 연결/방화벽 설정을 확인한 뒤 다시 시도해주세요.";
     }
     if (msg.startsWith("sha_mismatch")) {
@@ -206,16 +232,17 @@ function sha256File(filePath) {
 async function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-async function fetchWithRetry(url, retries = MAX_RETRIES) {
+async function fetchWithRetry(url, retries = MAX_RETRIES, extraHeaders) {
     if (isOfflineMode()) {
         throw makeBootstrapError("오프라인 모드에서는 다운로드를 진행할 수 없습니다. 인터넷을 연결하거나, 사전 설치된 도구 경로(VIBECODE_BIN_PATH)를 지정해주세요.");
     }
     let lastError = null;
+    const headers = { ...getAuthHeaders(), ...extraHeaders };
     for (let attempt = 1; attempt <= retries; attempt++) {
         try {
             const controller = new AbortController();
             const timeoutId = setTimeout(() => controller.abort(), DOWNLOAD_TIMEOUT_MS);
-            const res = await fetch(url, { signal: controller.signal });
+            const res = await fetch(url, { signal: controller.signal, headers });
             clearTimeout(timeoutId);
             if (res.ok) {
                 return res;
@@ -276,8 +303,8 @@ async function discoverRelease(repo, version) {
             const res = await fetch(`${apiBase}/tags/${encodeURIComponent(tag)}`, {
                 signal: controller.signal,
                 headers: {
+                    ...getAuthHeaders(),
                     "Accept": "application/vnd.github+json",
-                    "User-Agent": "vibecode-installer",
                 },
             });
             clearTimeout(timeoutId);
@@ -300,8 +327,8 @@ async function discoverRelease(repo, version) {
         const res = await fetch(`${apiBase}/latest`, {
             signal: controller.signal,
             headers: {
+                ...getAuthHeaders(),
                 "Accept": "application/vnd.github+json",
-                "User-Agent": "vibecode-installer",
             },
         });
         clearTimeout(timeoutId);
@@ -321,6 +348,24 @@ async function discoverRelease(repo, version) {
 function findAsset(release, name) {
     return release.assets.find(a => a.name === name);
 }
+/**
+ * Download asset from GitHub release (supports private repos with GITHUB_TOKEN)
+ */
+async function downloadAsset(asset, outPath) {
+    const token = getGitHubToken();
+    // For private repos, use API URL with Accept: application/octet-stream
+    if (token) {
+        const res = await fetchWithRetry(asset.url, MAX_RETRIES, {
+            "Accept": "application/octet-stream",
+        });
+        await fs.promises.mkdir(path.dirname(outPath), { recursive: true });
+        const buf = Buffer.from(await res.arrayBuffer());
+        await fs.promises.writeFile(outPath, buf);
+        return;
+    }
+    // For public repos, use browser_download_url
+    await download(asset.browser_download_url, outPath);
+}
 async function readShaSumsFromUrl(url) {
     const res = await fetchWithRetry(url);
     const text = await res.text();
@@ -533,15 +578,35 @@ async function ensureOne(name, platform) {
         // P0-2: Try GitHub API discovery first for better 404 tolerance
         let assetUrl;
         let shaMap;
+        let assetInfo;
         const release = await discoverRelease(spec.repo, spec.version);
         if (release) {
-            const assetInfo = findAsset(release, asset);
+            assetInfo = findAsset(release, asset);
             const shaInfo = findAsset(release, spec.shaSumsAsset);
             if (assetInfo) {
                 assetUrl = assetInfo.browser_download_url;
                 // Read SHA from discovered release if available
                 if (shaInfo) {
-                    shaMap = await readShaSumsFromUrl(shaInfo.browser_download_url);
+                    // Use API URL for SHA file too (for private repos)
+                    const token = getGitHubToken();
+                    if (token) {
+                        const res = await fetchWithRetry(shaInfo.url, MAX_RETRIES, {
+                            "Accept": "application/octet-stream",
+                        });
+                        const text = await res.text();
+                        shaMap = new Map();
+                        for (const line of text.split("\n")) {
+                            const t = line.trim();
+                            if (!t)
+                                continue;
+                            const m = t.match(/^([a-fA-F0-9]{64})\s+(.+)$/);
+                            if (m)
+                                shaMap.set(m[2].trim(), m[1].toLowerCase());
+                        }
+                    }
+                    else {
+                        shaMap = await readShaSumsFromUrl(shaInfo.browser_download_url);
+                    }
                 }
                 else {
                     // Fallback to legacy URL for SHA
@@ -566,8 +631,13 @@ async function ensureOne(name, platform) {
         // Clean and prepare directory
         await fs.promises.rm(dir, { recursive: true, force: true }).catch(() => { });
         await fs.promises.mkdir(dir, { recursive: true });
-        // Download archive (with retry)
-        await download(assetUrl, archivePath);
+        // Download archive (with retry) - use API URL for private repos
+        if (assetInfo && getGitHubToken()) {
+            await downloadAsset(assetInfo, archivePath);
+        }
+        else {
+            await download(assetUrl, archivePath);
+        }
         // Verify SHA256
         const got = (await sha256File(archivePath)).toLowerCase();
         if (got !== expected)

package/build/bootstrap/registry.js

@@ -14,11 +14,11 @@ export const ENGINE_SPECS = {
         assetPrefix: "spec-high",
         shaSumsAsset: "SHA256SUMS.txt"
     },
-    "vibecoding-helper": {
-        name: "vibecoding-helper",
+    "vibe-execution-engine": {
+        name: "vibe-execution-engine",
         version: "1.0.0",
         repo: "yellowhama/vibe-pm",
-        assetPrefix: "vibecoding-helper",
+        assetPrefix: "vibe-execution-engine",
         shaSumsAsset: "SHA256SUMS.txt"
     },
     "clinic": {
@@ -30,8 +30,13 @@ export const ENGINE_SPECS = {
     }
 };
 /**
- * Asset naming convention:
- * {assetPrefix}_{version}_{platform}.tar.gz
+ * Skill Bundle Specification (SSOT)
  *
- * Example: spec-high_1.0.0_linux_x64.tar.gz
+ * 스킬 파일은 npm 패키지의 skills/ 디렉토리에 prebundled로 포함됨.
+ * - 오프라인 지원
+ * - CLI 버전과 스킬 버전 동기화 자동 보장
  */
+export const SKILL_SPEC = {
+    version: "1.0.0",
+    bundlePath: "skills" // adapters/mcp-ts/skills/ (패키지 루트 기준)
+};