@vibingview/cli 0.1.1 → 0.1.4

package/README.md

@@ -31,7 +31,7 @@ vibingview logout           # revokes the token on the server and forgets it loc
 ## Deploy
 
 ```bash
-vibingview deploy [dir] [--workspace <id|name>] [--name <app>] [--port <n>] [--domain <suffix|hostname>] [--force] [--yes]
+vibingview deploy [dir] [--workspace <id|name>] [--name <app>] [--port <n>] [--domain <suffix|hostname>] [--technique 1|2|3|4|5] [--force] [--yes]
 vibingview status [app]
 vibingview logs [app] [--build|--runtime] [--limit <n>] [--ai]
 vibingview restart [app]
@@ -40,7 +40,9 @@ vibingview workspaces
 vibingview apps
 ```
 
-`deploy` packages the directory in memory, excluding `.git`, `node_modules`, build output, virtualenvs, caches, `.env*` files, credentials, private keys, archives, binaries, local databases and large media, and refusing symlinks that escape the project. It skips an unchanged project unless `--force`, uploads it, follows the build until it succeeds or fails, and links the directory in `.vibingview/config.json` (added to `.gitignore`; it never contains your token).
+`deploy` packages the directory in memory, excluding `.git`, `node_modules`, build output, virtualenvs, caches, `.env*` files, credentials, private keys, archives, binaries, local databases and design source files (`.psd`, `.ai`, `.sketch`), and refusing symlinks that escape the project. Folders starting with a dot are skipped except `.well-known`; video and audio files are uploaded only from a folder the site serves files from (`public/`, `static/`, `assets/`, `media/`, `images/`…). Skipped files the site may need (stray media, unknown hidden folders, `.env` files) are listed by name after packaging. It skips an unchanged project unless `--force`, uploads it, follows the build until it succeeds or fails, and links the directory in `.vibingview/config.json` (added to `.gitignore`; it never contains your token).
+
+`--technique` picks how a new app is built (default 5, "Smart": detects npm/pnpm/yarn/bun and the Node version, reuses installed packages between builds, ships the smallest safe image; other languages use technique 1). Changing environment variables or linking a database restarts a running app on its current build instead of rebuilding.
 
 ## Environment variables, ports, databases and catalog apps
 

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@vibingview/cli",
-  "version": "0.1.1",
+  "version": "0.1.4",
   "description": "VibingView command-line interface and stdio MCP bridge: pair with browser approval, deploy apps, read logs, manage env vars and databases, and connect AI editors.",
   "license": "MIT",
   "type": "module",
   "bin": {
-    "cli": "./bin/vibingview.mjs",
-    "vibingview": "./bin/vibingview.mjs",
-    "vibingview-mcp": "./bin/vibingview-mcp.mjs"
+    "cli": "bin/vibingview.mjs",
+    "vibingview": "bin/vibingview.mjs",
+    "vibingview-mcp": "bin/vibingview-mcp.mjs"
   },
   "exports": {
     ".": "./src/cli.mjs",

package/src/cli.mjs

@@ -10,7 +10,7 @@ import { fileURLToPath } from "node:url";
 import { ensureGitignore, inferAppName, isIdenticalDeploy, packageProject, readProjectConfig, writeProjectConfig } from "./lib/project.mjs";
 import { defaultTransport, installMcpConfig, maskToken, maskedEntry, mcpConfigPath, MCP_CLIENTS, NPM_PACKAGE } from "./lib/mcp-install.mjs";
 
-export const VERSION = "0.1.1";
+export const VERSION = "0.1.4";
 /** Production control plane used when no --url, VIBINGVIEW_URL or saved login selects another. */
 export const DEFAULT_URL = "https://vibingview.com";
 const USAGE = `VibingView CLI ${VERSION}
@@ -25,7 +25,7 @@ Account
   vibingview mcp                                     Run the stdio MCP bridge (used by AI clients)
 
 Deploy
-  vibingview deploy [dir] [--workspace <id|name>] [--name <app>] [--port <n>] [--domain <suffix|hostname>] [--force] [--yes] [--no-wait] [--timeout <s>]
+  vibingview deploy [dir] [--workspace <id|name>] [--name <app>] [--port <n>] [--domain <suffix|hostname>] [--technique 1|2|3|4|5] [--force] [--yes] [--no-wait] [--timeout <s>]
   vibingview status [app]                            Application status and recent deployments
   vibingview logs [app] [--build|--runtime] [--limit <n>] [--ai]
   vibingview restart|rebuild [app]
@@ -54,7 +54,7 @@ Control plane: --url <origin> on any command, else VIBINGVIEW_URL, else the inst
 else ${DEFAULT_URL}. VIBINGVIEW_TOKEN overrides the saved token.`;
 
 const BOOLEAN_FLAGS = new Set(["force", "yes", "reveal", "show", "ai", "build", "runtime", "no-wait", "no-browser", "dry-run", "json", "help", "stdin", "local-bridge"]);
-const VALUE_FLAGS = new Set(["workspace", "name", "port", "domain", "app", "limit", "engine", "client", "transport", "timeout", "url", "token"]);
+const VALUE_FLAGS = new Set(["workspace", "name", "port", "domain", "app", "limit", "engine", "client", "transport", "timeout", "url", "token", "technique", "builder"]);
 
 export function parseArgs(argv) {
   const positional = [];
@@ -81,6 +81,8 @@ export function parseArgs(argv) {
 // ---------------------------------------------------------------------------
 // Credentials
 // ---------------------------------------------------------------------------
+// The control plane restarts on the current image when only runtime settings changed (rebuild: false).
+const queuedNote = result => result.rebuild === false ? `Restarting on the current build, no rebuild needed (deployment ${result.deploymentId}).` : `Redeploy queued (deployment ${result.deploymentId}).`;
 const home = () => os.homedir();
 const configDir = () => path.join(home(), ".vibingview");
 const configFile = () => path.join(configDir(), "config.json");
@@ -120,11 +122,17 @@ function createClient(base, token) {
       response = await fetch(`${base}${route}`, { ...init, redirect: "error", signal: AbortSignal.timeout(init.timeout ?? 120000), headers: { ...(token ? { Authorization: `Bearer ${token}` } : {}), ...init.headers } });
     } catch (error) { throw new CliError(redact(`Could not reach ${base}: ${error.cause?.message ?? error.message}`)); }
     if (response.status === 204) return {};
-    const body = await response.json().catch(() => ({}));
+    let body = {}, unreadable = false;
+    const text = await response.text().catch(() => { unreadable = true; return ""; });
+    if (text) { try { body = JSON.parse(text); } catch { unreadable = true; } }
+    // A success whose body was cut off (e.g. the connection dropped) must not read as "empty": callers would treat an
+    // unread app list as "no apps" and create a duplicate.
+    if (response.ok && unreadable)
+      throw new CliError(`Could not read the server's answer to ${route.split("?")[0]}. Nothing was assumed; try again (after a deploy, check vibingview status first).`);
     if (!response.ok) {
       let message = typeof body.error === "string" ? body.error : body.error?.message ?? `HTTP ${response.status}`;
       if (response.status === 401 && token) message += " — the token may be expired or revoked, or lacks the permission this command needs (database create/reveal need a token with the 'manage' permission). Run vibingview login or use an appropriately scoped VIBINGVIEW_TOKEN.";
-      throw Object.assign(new CliError(redact(message)), { status: response.status });
+      throw Object.assign(new CliError(redact(message)), { status: response.status, code: typeof body.code === "string" ? body.code : undefined });
     }
     return body;
   };
@@ -135,6 +143,8 @@ const json = (method, body) => ({ method, headers: { "Content-Type": "applicatio
 // Output helpers
 // ---------------------------------------------------------------------------
 const out = text => process.stdout.write(`${text}\n`);
+// Log lines are third-party program output: strip ANSI/OSC escapes and C0 controls (except tab) before they reach the terminal.
+const clean = text => String(text ?? "").replace(/\x1b\[[0-9;?]*[ -\/]*[@-~]/g, "").replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, "").replace(/[\x00-\x08\x0b-\x1f\x7f]/g, "");
 const warn = text => process.stderr.write(`${text}\n`);
 function table(rows, columns) {
   if (!rows.length) return out("(none)");
@@ -311,7 +321,7 @@ export async function main(argv = process.argv.slice(2)) {
   // ----- lookups -------------------------------------------------------------
   const cwd = process.cwd();
   const project = await readProjectConfig(cwd);
-  const workspacesList = async () => (await call("/api/workspaces")).workspaces ?? [];
+  const workspacesList = async () => { const { workspaces } = await call("/api/workspaces"); if (!Array.isArray(workspaces)) throw new CliError("The server did not send the list of workspaces. Nothing was changed; try again."); return workspaces; };
   const isRunning = workspace => String(workspace.status).toUpperCase() === "RUNNING";
   async function resolveWorkspace(reference, { running = true } = {}) {
     const all = await workspacesList();
@@ -364,11 +374,25 @@ export async function main(argv = process.argv.slice(2)) {
     const pkg = await packageProject(directory);
     out(`Packaged ${pkg.files.length} files (${(pkg.archive.length / 1024).toFixed(1)} KB, sha256 ${pkg.sha256.slice(0, 12)}…); excluded ${pkg.skipped.length} paths.`);
     for (const message of pkg.warnings) warn(message);
+    reportNotableSkips(pkg.notable ?? []);
     if (isIdenticalDeploy(linked, pkg.sha256, flags.force)) { out("No changes since the last deploy. Use --force to redeploy anyway."); return 0; }
 
-    const { applications = [] } = await call("/api/apps");
-    let app = linked.applicationId && (!flags.name || flags.name === linked.name) ? applications.find(item => item.id === linked.applicationId) : undefined;
-    if (linked.applicationId && !app && !flags.name) warn("The linked application no longer exists; creating a new one.");
+    if (linked.controlPlane && linked.controlPlane !== base) warn(`This folder was deployed to ${linked.controlPlane}; you are now using ${base}.`);
+    const appList = async () => { const { applications } = await call("/api/apps"); if (!Array.isArray(applications)) throw new CliError("The server did not send the list of applications. Nothing was changed; try again."); return applications; };
+    if (linked.applicationId && flags.name && flags.name !== linked.name && !flags.force) throw new CliError(`This folder is linked to the application "${linked.name}", but --name says "${flags.name}". Drop --name to redeploy it, use --force to create another app, or remove .vibingview/config.json.`);
+    const useLinked = linked.applicationId && (!flags.name || flags.name === linked.name);
+    let app = useLinked ? (await appList()).find(item => item.id === linked.applicationId) : undefined;
+    if (useLinked && !app) {
+      // One answer without the app must never create a duplicate: ask for the app itself before assuming it was deleted.
+      const deleted = await call(`/api/apps/${encodeURIComponent(linked.applicationId)}/settings`).then(() => false, error => {
+        if (error.status === 404 || error.code === "apps.not_found") return true;
+        throw new CliError(`Could not confirm that the linked application ${linked.name ?? linked.applicationId} was deleted (${error.message}). Nothing was created; try again.`);
+      });
+      if (!deleted) {
+        app = (await appList()).find(item => item.id === linked.applicationId);
+        if (!app) throw new CliError(`The linked application ${linked.name ?? linked.applicationId} exists but was missing from the server's list. Nothing was created; try again in a moment.`);
+      } else warn("The linked application was deleted; creating a new one.");
+    }
     const catalog = await call("/api/catalog");
     const suffixes = catalog.domains ?? [];
     let suffix = linked.domainSuffix;
@@ -381,6 +405,11 @@ export async function main(argv = process.argv.slice(2)) {
     }
     if (!suffix || !suffixes.includes(suffix)) suffix = suffixes[0];
     const port = flags.port === undefined ? undefined : Number(flags.port);
+    // --technique 1|2 (or --builder auto|classic|railpack|technique-2) chooses how a new app is built.
+    const builderFlags = { "1": "auto", "2": "technique-2", "3": "technique-3", "4": "technique-4", "5": "technique-5", "technique-1": "auto", "technique-2": "technique-2", "technique-3": "technique-3", "technique-4": "technique-4", "technique-5": "technique-5", auto: "auto", classic: "classic", railpack: "railpack" };
+    const builderFlag = flags.technique ?? flags.builder;
+    const builder = builderFlag === undefined ? undefined : builderFlags[String(builderFlag).toLowerCase()];
+    if (builderFlag !== undefined && !builder) throw new CliError("--technique must be 1, 2, 3, 4 or 5 (or --builder auto|classic|railpack|technique-2|technique-3|technique-4|technique-5)");
     if (port !== undefined && (!Number.isInteger(port) || port < 1 || port > 65535)) throw new CliError("--port must be 1-65535");
 
     let deploymentId;
@@ -388,6 +417,7 @@ export async function main(argv = process.argv.slice(2)) {
     if (app) {
       workspaceId = app.workspaceId;
       if (port !== undefined && port !== app.internalPort) warn(`The port is unchanged by redeploys; run vibingview port set ${port} to change it.`);
+      if (builder) warn("--technique applies when an app is created; change an existing app's build technique in its build settings on the dashboard.");
       if (!(await confirm(`Redeploy ${app.name} (${app.url ?? app.id}) with this source?`, flags))) return 1;
       const form = new FormData();
       form.set("file", new Blob([pkg.archive], { type: "application/zip" }), `${app.name}.zip`);
@@ -403,8 +433,10 @@ export async function main(argv = process.argv.slice(2)) {
       form.set("name", name);
       if (suffix) form.set("domainSuffix", suffix);
       if (port !== undefined) form.set("port", String(port));
+      if (builder) form.set("builder", builder);
       form.set("file", new Blob([pkg.archive], { type: "application/zip" }), `${name}.zip`);
-      app = (await call("/api/apps", { method: "POST", body: form })).application;
+      // A large upload must not time out client-side while the server finishes creating the app (that made a second app on retry).
+      app = (await call("/api/apps", { method: "POST", body: form, timeout: 120000 + Math.ceil(pkg.archive.length / 1_000_000) * 4000 })).application;
       deploymentId = app.lastDeploymentId;
     }
     const state = { controlPlane: base, workspaceId, applicationId: app.id, name: app.name, url: app.url, domainSuffix: suffix, customDomain: customDomain ?? linked.customDomain, lastHash: linked.lastHash, deployedAt: new Date().toISOString() };
@@ -414,7 +446,9 @@ export async function main(argv = process.argv.slice(2)) {
     if (customDomain && customDomain !== linked.customDomain) {
       try {
         const result = await call(`/api/apps/${encodeURIComponent(app.id)}/domains`, json("POST", { hostname: customDomain }));
-        out(`Custom domain ${customDomain} added. Prove ownership and route traffic with DNS:\n  CNAME ${result.instructions.cname.name} → ${result.instructions.cname.value}\n  or TXT ${result.instructions.txt.name} = ${result.instructions.txt.value}\nThen verify it in the dashboard. HTTPS is issued only after verification.`);
+        // The server returns the records to add for each hostname it added (the main domain also adds www).
+        const lines = (result.domains ?? []).flatMap((d) => (d.records ?? []).map((r) => `  ${d.hostname}: ${r.type} ${r.name} → ${r.value}`));
+        out(`Custom domain ${customDomain} added. Add ${lines.length === 1 ? "this record" : "these records"} where you bought the domain:\n${lines.join("\n")}\nVibingView checks every few minutes and connects it with HTTPS by itself.`);
       } catch (error) { warn(`Could not add custom domain: ${error.message}`); }
     }
 
@@ -448,9 +482,9 @@ export async function main(argv = process.argv.slice(2)) {
     const { logs = [] } = await call(`/api/apps/${encodeURIComponent(app.id)}/logs?kind=${kind}&limit=${max}`);
     if (flags.ai) {
       out(`## VibingView ${kind} logs: ${app.name}\n\n- Application: ${app.name} (${app.id})\n- Status: ${app.status}\n- URL: ${app.url ?? "private"}\n- Lines: last ${logs.length}\n\n\`\`\`text`);
-      for (const line of logs) out(`${line.recorded_at ? new Date(line.recorded_at).toISOString() + " " : ""}${line.stream ? `[${line.stream}] ` : ""}${line.message}`);
+      for (const line of logs) out(`${line.recorded_at ? new Date(line.recorded_at).toISOString() + " " : ""}${line.stream ? `[${line.stream}] ` : ""}${clean(line.message)}`);
       out("```\n\nSecrets are redacted by the workspace agent before storage, but review the output before sharing it.");
-    } else for (const line of logs) out(line.message);
+    } else for (const line of logs) out(clean(line.message));
     if (!logs.length) warn(`No ${kind} logs yet.`);
     return 0;
   }
@@ -472,7 +506,7 @@ export async function main(argv = process.argv.slice(2)) {
       if (!id || !name || value === undefined) throw new CliError("Usage: vibingview env get|set|remove … (see vibingview help)");
       warn("Deprecated: use vibingview env set NAME=value --app <app>. Values passed as arguments may be kept in shell history.");
       const result = await call(`/api/apps/${encodeURIComponent(id)}/environment`, json("POST", { name, value }));
-      out(`Set ${name}. Redeploy queued (deployment ${result.deploymentId}).`);
+      out(`Set ${name}. ${queuedNote(result)}`);
       return 0;
     }
     const app = await resolveApp();
@@ -501,8 +535,20 @@ export async function main(argv = process.argv.slice(2)) {
       const environment = {};
       const pairs = args.slice(1);
       if (flags.stdin) {
-        if (pairs.length !== 1) throw new CliError("Usage: vibingview env set NAME --stdin");
-        environment[pairs[0]] = await readStdin();
+        // One name: the whole input is its value. No name: one NAME=value per line (.env style), so secrets never sit in argv.
+        if (pairs.length > 1) throw new CliError("Usage: vibingview env set NAME --stdin, or env set --stdin with NAME=value lines on stdin");
+        const input = await readStdin();
+        if (pairs.length === 1) environment[pairs[0]] = input;
+        else for (const line of input.split(/\r?\n/)) {
+          const text = line.trim();
+          if (!text || text.startsWith("#")) continue;
+          const match = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(text);
+          if (!match) throw new CliError(`Not a NAME=value line: ${text.slice(0, 40)}`);
+          let value = match[2];
+          if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
+          environment[match[1]] = value;
+        }
+        if (!Object.keys(environment).length) throw new CliError("No NAME=value lines were read from stdin.");
       } else {
         if (!pairs.length) throw new CliError("Usage: vibingview env set NAME=value [NAME=value…] or NAME --stdin");
         for (const pair of pairs) {
@@ -513,13 +559,13 @@ export async function main(argv = process.argv.slice(2)) {
       }
       for (const name of Object.keys(environment)) if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(name)) throw new CliError(`Invalid variable name ${name}`);
       const result = await call(`/api/apps/${encodeURIComponent(app.id)}/settings`, json("PATCH", { environment }));
-      out(`Set ${Object.keys(environment).join(", ")} on ${app.name}. Values stored encrypted. Redeploy queued (deployment ${result.deploymentId}).`);
+      out(`Set ${Object.keys(environment).join(", ")} on ${app.name}. Values stored encrypted. ${queuedNote(result)}`);
       return 0;
     }
     const names = args.slice(1);
     if (!names.length) throw new CliError("Usage: vibingview env remove NAME [NAME…]");
     const result = await call(`/api/apps/${encodeURIComponent(app.id)}/settings`, json("PATCH", { deleteVariables: names }));
-    out(`Removed ${names.join(", ")} from ${app.name}. Redeploy queued (deployment ${result.deploymentId}).`);
+    out(`Removed ${names.join(", ")} from ${app.name}. ${queuedNote(result)}`);
     return 0;
   }
 
@@ -530,7 +576,7 @@ export async function main(argv = process.argv.slice(2)) {
     const app = await resolveApp();
     const current = await call(`/api/apps/${encodeURIComponent(app.id)}/settings`);
     const result = await call(`/api/apps/${encodeURIComponent(app.id)}/settings`, json("PATCH", { settings: { ...(current.application?.build_settings ?? {}), port } }));
-    out(`${app.name} now expects port ${port}. Redeploy queued (deployment ${result.deploymentId}).`);
+    out(`${app.name} now expects port ${port}. ${queuedNote(result)}`);
     return 0;
   }
 
@@ -576,7 +622,7 @@ export async function main(argv = process.argv.slice(2)) {
         databaseId = found.id;
       } else if (!(await confirm(`Unlink the database from ${app.name}? DATABASE_URL will be removed and the app redeployed.`, flags))) return 1;
       const result = await call(`/api/apps/${encodeURIComponent(app.id)}/settings`, json("PATCH", { databaseId }));
-      out(`${sub === "link" ? `Linked database to ${app.name} as DATABASE_URL` : `Unlinked database from ${app.name}`}. Redeploy queued (deployment ${result.deploymentId}).`);
+      out(`${sub === "link" ? `Linked database to ${app.name} as DATABASE_URL` : `Unlinked database from ${app.name}`}. ${queuedNote(result)}`);
       return 0;
     }
     throw new CliError("Usage: vibingview db list|create|link|unlink");
@@ -624,6 +670,14 @@ async function legacyDeploy(call, [workspaceId, name, file]) {
   return 0;
 }
 
+/** Names the skipped files a website may need, so nothing disappears without a word. */
+function reportNotableSkips(notable) {
+  const show = (items, text) => { if (!items.length) return; warn(`${text}\n${items.slice(0, 10).map(item => `  ${item.name}`).join("\n")}${items.length > 10 ? `\n  …and ${items.length - 10} more` : ""}`); };
+  show(notable.filter(item => item.reason === "media"), "Not uploaded: video and audio files are only uploaded from a folder your site serves files from (public/, static/ or assets/). Move these there if the site uses them:");
+  show(notable.filter(item => item.reason === "hidden-folder"), "Not uploaded: folders whose names start with a dot (only .well-known is uploaded). If the site needs these files, move them to a normal folder:");
+  show(notable.filter(item => item.reason === "env"), "Not uploaded: .env files (they can hold secrets). Set the values the app needs with vibingview env set NAME1=value1 NAME2=value2 --app <app> after the first deploy:");
+}
+
 async function waitForDeployment(call, applicationId, deploymentId, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   let printed = 0;
@@ -635,7 +689,7 @@ async function waitForDeployment(call, applicationId, deploymentId, timeoutMs) {
     ]);
     const deployment = deployments.find(item => item.id === deploymentId) ?? deployments[0];
     if (deployment && deployment.id === deploymentId) {
-      for (const line of logs.slice(printed)) out(`  ${line.message}`);
+      for (const line of logs.slice(printed)) out(`  ${clean(line.message)}`);
       printed = Math.max(printed, logs.length);
     }
     const status = deployment?.status ?? "queued";

package/src/lib/project.mjs

@@ -27,21 +27,39 @@ const EXCLUDED_EXTENSIONS = new Set([
   ".exe", ".dll", ".so", ".dylib", ".bin", ".o", ".a", ".obj", ".class", ".jar", ".war", ".pyc", ".pyo", ".dmg", ".iso", ".img", ".msi", ".deb", ".rpm", ".apk",
   // local databases
   ".sqlite", ".sqlite3", ".db",
-  // large media
-  ".mp4", ".mov", ".avi", ".mkv", ".webm", ".m4v", ".wmv", ".flv", ".mp3", ".wav", ".flac", ".aac", ".ogg", ".psd", ".ai", ".sketch",
+  // design source files
+  ".psd", ".ai", ".sketch",
   // logs
   ".log",
 ]);
+// Video and audio are uploaded when they sit in a folder a website serves files from (public/hero.mp4,
+// src/assets/intro.webm); elsewhere they are usually raw footage and only make the upload bigger.
+const MEDIA_EXTENSIONS = new Set([".mp4", ".mov", ".avi", ".mkv", ".webm", ".m4v", ".wmv", ".flv", ".mp3", ".wav", ".flac", ".aac", ".ogg", ".oga", ".opus", ".m4a"]);
+const ASSET_FOLDERS = new Set(["public", "static", "assets", "media", "images", "img", "video", "videos", "audio", "sounds", "fonts", "www", "wwwroot", "htdocs"]);
+// Hidden folders a website really serves (domain checks, app links, payment-provider verification).
+const ALLOWED_DOT_DIRECTORIES = new Set([".well-known"]);
+// Hidden folders that are tools, caches or editor settings: skipped without a warning.
+const TOOL_DOT_DIRECTORIES = new Set([".git", ".next", ".nuxt", ".svelte-kit", ".vercel", ".netlify", ".output", ".turbo", ".cache", ".parcel-cache", ".idea", ".vscode", ".fleet", ".zed", ".github", ".gitlab", ".husky", ".devcontainer", ".expo", ".angular", ".yarn", ".pnpm-store", ".venv", ".pytest_cache", ".mypy_cache", ".ruff_cache", ".tox", ".terraform", ".serverless", ".docusaurus", ".astro", ".vite", ".wrangler", ".firebase", ".aws-sam", ".claude", ".cursor", ".windsurf", ".vibingview", ".vibed"]);
 const ALLOWED_DOTFILES = new Set([".dockerignore", ".nvmrc", ".node-version", ".python-version", ".tool-versions", ".gitignore", ".htaccess", ".babelrc", ".browserslistrc", ".prettierrc", ".editorconfig", ".npmignore", ".eslintrc", ".eslintrc.json", ".eslintrc.js", ".eslintrc.cjs", ".env.example", ".env.sample", ".env.template"]);
 
 /** Whether a directory name must never be uploaded. */
 export function isExcludedDirectory(name) {
+  if (ALLOWED_DOT_DIRECTORIES.has(name.toLowerCase())) return false;
   return name.startsWith(".") || EXCLUDED_DIRECTORIES.has(name) || /^\.?venv[\w.-]*$/i.test(name);
 }
 
-/** Whether a file name must never be uploaded (secrets, archives, binaries, large media). */
-export function isExcludedFile(name) {
+/** True when a project path sits in a folder a website serves files from (public/, static/, assets/…). */
+export function inAssetFolder(relativePath) {
+  return relativePath.split("/").slice(0, -1).some(part => ASSET_FOLDERS.has(part.toLowerCase()));
+}
+
+/**
+ * Whether a file must never be uploaded (secrets, archives, binaries, local databases, logs). Video and audio are
+ * uploaded only from asset folders, so pass the project-relative path to allow them there.
+ */
+export function isExcludedFile(name, relativePath = name) {
   const lower = name.toLowerCase();
+  if (MEDIA_EXTENSIONS.has(path.extname(lower))) return !inAssetFolder(relativePath);
   if (SECRET_FILE_NAMES.has(lower)) return true;
   if (lower.startsWith(".env")) return !ALLOWED_DOTFILES.has(lower);
   if (lower.startsWith(".") && !ALLOWED_DOTFILES.has(lower)) return true;
@@ -60,7 +78,9 @@ function inside(root, candidate) {
  * Recursively list uploadable files. Symlinks that resolve outside the project
  * root abort the scan; symlinks to files inside the root are followed and
  * symlinked directories are skipped to avoid loops.
- * @returns {Promise<{files:{name:string,absolute:string,size:number}[],skipped:string[],warnings:string[]}>}
+ * `notable` lists skipped paths the site may really need (media outside asset folders, unknown hidden folders)
+ * and .env files whose settings must be set on the server instead; the CLI prints them by name.
+ * @returns {Promise<{files:{name:string,absolute:string,size:number}[],skipped:string[],warnings:string[],notable:{name:string,reason:string}[]}>}
  */
 export async function scanProject(directory) {
   const root = await realpath(path.resolve(directory));
@@ -69,6 +89,12 @@ export async function scanProject(directory) {
   const files = [];
   const skipped = [];
   const warnings = [];
+  const notable = [];
+  const note = (relative, base) => {
+    const lower = base.toLowerCase();
+    if (MEDIA_EXTENSIONS.has(path.extname(lower))) notable.push({ name: relative, reason: "media" });
+    else if (lower.startsWith(".env") && !ALLOWED_DOTFILES.has(lower)) notable.push({ name: relative, reason: "env" });
+  };
   let total = 0;
   async function walk(current, prefix) {
     const entries = (await readdir(current, { withFileTypes: true })).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
@@ -84,14 +110,14 @@ export async function scanProject(directory) {
         const targetInfo = await stat(target);
         if (targetInfo.isDirectory()) { warnings.push(`Skipped symlinked directory ${name}`); continue; }
         if (!targetInfo.isFile()) continue;
-        if (isExcludedFile(entry.name) || isExcludedFile(path.basename(target))) { skipped.push(name); continue; }
+        if (isExcludedFile(entry.name, name) || isExcludedFile(path.basename(target), name)) { skipped.push(name); note(name, entry.name); continue; }
         total += targetInfo.size;
         files.push({ name, absolute: target, size: targetInfo.size, mode: targetInfo.mode });
       } else if (info.isDirectory()) {
-        if (isExcludedDirectory(entry.name)) { skipped.push(`${name}/`); continue; }
+        if (isExcludedDirectory(entry.name)) { skipped.push(`${name}/`); if (entry.name.startsWith(".") && !TOOL_DOT_DIRECTORIES.has(entry.name.toLowerCase()) && !/^\.?venv/i.test(entry.name)) notable.push({ name: `${name}/`, reason: "hidden-folder" }); continue; }
         await walk(absolute, name);
       } else if (info.isFile()) {
-        if (isExcludedFile(entry.name)) { skipped.push(name); continue; }
+        if (isExcludedFile(entry.name, name)) { skipped.push(name); note(name, entry.name); continue; }
         total += info.size;
         files.push({ name, absolute, size: info.size, mode: info.mode });
       }
@@ -101,7 +127,7 @@ export async function scanProject(directory) {
   }
   await walk(root, "");
   if (!files.length) throw new Error("No deployable files found after exclusions");
-  return { root, files, skipped, warnings };
+  return { root, files, skipped, warnings, notable };
 }
 
 /** Package a project directory into an in-memory ZIP and hash it. */

package/src/mcp.mjs

@@ -46,7 +46,7 @@ async function handle(message) {
   const params = message.params && typeof message.params === "object" && !Array.isArray(message.params) ? message.params : {};
   if (message.method === "initialize") {
     const protocolVersion = SUPPORTED_VERSIONS.includes(params.protocolVersion) ? params.protocolVersion : SUPPORTED_VERSIONS[0];
-    return { protocolVersion, capabilities: { tools: { listChanged: false } }, serverInfo: { name: "vibingview", version: "0.1.1" }, instructions: INSTRUCTIONS };
+    return { protocolVersion, capabilities: { tools: { listChanged: false } }, serverInfo: { name: "vibingview", version: "0.1.4" }, instructions: INSTRUCTIONS };
   }
   if (message.method === "ping") return {};
   if (message.method === "tools/list") {