slashvibe-mcp 0.5.0 → 0.5.2

package/auto-update.js

@@ -6,10 +6,25 @@
 const { exec } = require('child_process');
 const { promisify } = require('util');
 const fs = require('fs').promises;
+const fsSync = require('fs');
 const path = require('path');
 
 const execAsync = promisify(exec);
 
+/**
+ * How was this copy of /vibe installed?
+ *  - 'git'  → a dev checkout / git-based install (the repo has a .git dir one level up)
+ *  - 'npm'  → installed via `npx` or a global `npm i -g` (the common case; no .git)
+ * The published npm package ships only the mcp-server/ directory, so the absence of
+ * a .git at the package root reliably means an npx/global install.
+ */
+function detectInstallType() {
+  try {
+    if (fsSync.existsSync(path.join(__dirname, '..', '.git'))) return 'git';
+  } catch {}
+  return 'npm';
+}
+
 async function checkForUpdates() {
   try {
     // Read local version
@@ -112,11 +127,23 @@ function formatUpdateNotification(update) {
     message += `\n`;
   }
 
-  message += `Update now:\n`;
-  message += `  vibe update\n`;
-  message += `\n`;
-  message += `Or manually:\n`;
-  message += `  cd ~/.vibe/vibe-repo && git pull origin main\n`;
+  // Install-type-aware guidance. The npx/global path is the one that bites people:
+  // `npx slashvibe-mcp` silently prefers an existing GLOBAL install over fetching
+  // the latest, so a stale global keeps running old (sometimes broken) code. The fix
+  // is to remove the global so npx resolves fresh — NOT a git pull.
+  if (detectInstallType() === 'git') {
+    message += `Update now:\n`;
+    message += `  vibe update\n`;
+    message += `\n`;
+    message += `Or manually:\n`;
+    message += `  cd ~/.vibe/vibe-repo && git pull origin main\n`;
+  } else {
+    message += `You're on an npx/global install. To get the latest:\n\n`;
+    message += `  npm rm -g slashvibe-mcp      # clear any stale global that shadows npx\n`;
+    message += `  # then restart Claude Code (npx will fetch the latest automatically)\n\n`;
+    message += `Heads up: \`npx slashvibe-mcp\` reuses an existing global if present,\n`;
+    message += `so removing the global is what actually pulls the new version.\n`;
+  }
   message += `${'='.repeat(60)}\n`;
 
   return message;
@@ -126,5 +153,6 @@ module.exports = {
   checkForUpdates,
   performUpdate,
   compareVersions,
-  formatUpdateNotification
+  formatUpdateNotification,
+  detectInstallType
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "mcpName": "io.github.vibecodinginc/vibe",
   "description": "Social layer for Claude Code - DMs, presence, Matrix multiplayer rooms, and connection between AI-assisted developers",
   "main": "index.js",

package/store/api.js

@@ -463,10 +463,19 @@ async function sendMessage(from, to, body, type = 'dm', payload = null, options
       return { error: 'auth_failed', message: 'Authentication failed. Try `vibe init` to re-register.' };
     }
 
-    // Handle expired token
+    // Handle 401 — distinguish "never signed in" from "session expired".
+    // Sending a DM requires GitHub OAuth; reads (presence/inbox) are open.
+    // A misleading "expired" message here is a first-session papercut for the pilot.
     if (result.statusCode === 401) {
-      console.error('[vibe] Auth expired. Run browser auth to refresh token.');
-      return { error: 'auth_expired', message: 'Auth expired. Run `vibe init` to refresh token.' };
+      if (!config.hasOAuth()) {
+        console.error('[vibe] DM requires sign-in. Run `vibe init` (GitHub OAuth).');
+        return {
+          error: 'not_signed_in',
+          message: "You're not signed in yet — sending a DM needs a /vibe identity. Run `vibe init` to sign in with GitHub (opens a browser, no input needed), then try again.",
+        };
+      }
+      console.error('[vibe] Auth expired. Run `vibe init` to reconnect.');
+      return { error: 'auth_expired', message: 'Your /vibe session expired. Run `vibe init` to reconnect.' };
     }
 
     // Handle storage errors (KV write failed)

package/tools/update.js

@@ -44,14 +44,16 @@ async function handler(args) {
   const isGitInstall = fs.existsSync(gitDir);
 
   if (!isGitInstall) {
-    // Old-style install (curl downloads)
-    display += `⚠️ **Manual update required**\n\n`;
-    display += `Your install doesn't support automatic updates.\n\n`;
-    display += `To update, re-run the installer:\n`;
+    // npx / global install (the common case). npx prefers a stale global over
+    // fetching latest, so removing the global is what actually pulls the update.
+    display += `You're on an **npx/global install**.\n\n`;
+    display += `To get the latest:\n`;
     display += `\`\`\`\n`;
-    display += `curl -fsSL https://raw.githubusercontent.com/VibeCodingInc/vibe-mcp/main/install.sh | bash\n`;
-    display += `\`\`\`\n\n`;
-    display += `This will migrate you to the git-based installer for future updates.\n\n`;
+    display += `npm rm -g slashvibe-mcp\n`;
+    display += `\`\`\`\n`;
+    display += `Then **restart Claude Code** — npx will fetch the latest automatically.\n\n`;
+    display += `> Heads up: \`npx slashvibe-mcp\` reuses an existing global if one is\n`;
+    display += `> installed, so clearing the global is what pulls the new version.\n\n`;
     display += `---\n`;
     display += `⚠️ **After updating: restart Claude Code**`;
     return { display };

package/version.json

@@ -1,15 +1,14 @@
 {
-  "version": "0.5.0",
-  "updated": "2026-02-19",
-  "changelog": "Matrix multiplayer rooms: tools promoted to first-class, pair/guest/call deprecated",
+  "version": "0.5.2",
+  "updated": "2026-06-27",
+  "changelog": "Boot-time version guard with install-aware update guidance. If you're stuck on an old version: npx prefers a stale GLOBAL install over fetching latest — run `npm rm -g slashvibe-mcp`, then restart Claude Code.",
   "features": [
+    "Update notice now detects npx/global vs git installs and prints the correct fix",
+    "npx/global users told to `npm rm -g slashvibe-mcp` + restart (the real footgun fix)",
+    "First-contact DM 401 distinguishes never-signed-in from expired session",
     "Matrix multiplayer rooms",
     "Matrix tools promoted: vibe_matrix_rooms, vibe_matrix_read, vibe_matrix_send",
-    "Configurable bot port via MATRIX_BOT_PORT env var",
-    "PostToolUse hook polls Matrix bot for ambient message injection",
-    "Multi-agent collaboration: Claude + Codex + any model in shared rooms",
-    "Planned: matrix-image tool (Nano Banana Pro inline visuals)",
-    "Deprecated: pair, guest, call tools (replaced by Matrix rooms)"
+    "PostToolUse hook polls Matrix bot for ambient message injection"
   ],
   "deprecated": [
     "vibe_pair — use Matrix room invites",