slashvibe-mcp 0.5.24 → 0.5.25

package/README.md

@@ -116,31 +116,20 @@ This enables visual collaboration (diagrams, mockups, debug screenshots) directl
 
 ---
 
-## Deprecated: Pair/Guest/Call APIs
-
-The following tools and APIs are **deprecated** in favor of Matrix rooms. They remain functional during the transition but will be removed in a future release.
-
-### Deprecated MCP Tools
-
-| Tool | Replacement |
-|------|-------------|
-| `vibe_pair` | Use Matrix rooms -- invite collaborators to a shared room |
-| `vibe_guest` | Use `vibe_matrix_send` / `vibe_matrix_read` |
-| `vibe_call` | Use Matrix rooms + Jitsi for voice (Jigasi bridge for transcription) |
-
-### Deprecated APIs (7 endpoints)
-
-| API | Status |
-|-----|--------|
-| `/api/pair/request` | Deprecated -- use Matrix room invites |
-| `/api/pair/accept` | Deprecated -- use Matrix room invites |
-| `/api/call/signal` | Deprecated -- use Element/Jitsi |
-| `/api/call/status` | Deprecated -- use Element/Jitsi |
-| `/api/call/ice-servers` | Deprecated -- use Element/Jitsi |
-| `/api/session/guest` | Deprecated -- use Matrix messages |
-| `/api/session/live` | Deprecated -- use Matrix rooms |
-
-**Why the change:** Matrix rooms provide persistent history, support N participants (not just pairs), work across models (Claude + Codex + any), and federate with the broader Matrix ecosystem. The pair/guest/call system was limited to 2-player KV-backed sessions with short TTLs.
+## Pair/Guest/Call Transport
+
+Pairing, live sessions, guest turns, and WebRTC signaling use the supported
+REST/KV transport. Matrix rooms are an optional collaboration surface, not a
+replacement or migration target for these APIs.
+
+| Surface | Contract |
+|---------|----------|
+| `vibe_pair` | Authenticated request plus explicit acceptance |
+| `vibe_guest` | Target opt-in plus accepted pair for human sessions |
+| `vibe_call` | Transcript delivery through the consented guest-session path |
+| `/api/pair`, `/api/pair/request`, `/api/pair/accept` | Supported pairing handshakes |
+| `/api/session/live`, `/api/session/guest` | Supported live collaboration transport |
+| `/api/call/*` | Supported WebRTC signaling and lifecycle transport |
 
 ---
 

package/api-auth.js

@@ -0,0 +1,11 @@
+const config = require('./config');
+
+function apiHeaders(extra = {}) {
+  const token = config.getAuthToken();
+  return {
+    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+    ...extra,
+  };
+}
+
+module.exports = { apiHeaders };

package/hooks/check-guest-messages.js

@@ -17,6 +17,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { apiHeaders } = require('../api-auth');
 
 const VIBE_DIR = path.join(process.env.HOME, '.vibe');
 const VIBECODINGS_DIR = path.join(process.env.HOME, '.vibecodings');
@@ -41,7 +42,10 @@ process.stdin.on('end', () => {});
 
     // Fetch guest messages (with ack to clear after reading)
     const url = `${API_BASE}/api/session/guest?handle=${encodeURIComponent(handle)}&ack=true`;
-    const resp = await fetch(url, { signal: AbortSignal.timeout(3000) });
+    const resp = await fetch(url, {
+      headers: apiHeaders(),
+      signal: AbortSignal.timeout(3000),
+    });
     if (!resp.ok) process.exit(0);
 
     const data = await resp.json();

package/hooks/check-guest-messages.sh

@@ -50,6 +50,23 @@ get_handle() {
   echo "$handle"
 }
 
+get_token() {
+  if ! command -v jq &>/dev/null; then
+    return 1
+  fi
+  local token=""
+  if [ -f "$VIBE_DIR/config.json" ]; then
+    token=$(jq -r '.authToken // .privyToken // empty' "$VIBE_DIR/config.json" 2>/dev/null)
+  fi
+  if [ -z "$token" ] && [ -f "$VIBE_DIR/auth.json" ]; then
+    token=$(jq -r '.token // empty' "$VIBE_DIR/auth.json" 2>/dev/null)
+  fi
+  if [ -z "$token" ] && [ -f "$VIBECODINGS_DIR/config.json" ]; then
+    token=$(jq -r '.authToken // .privyToken // empty' "$VIBECODINGS_DIR/config.json" 2>/dev/null)
+  fi
+  echo "$token"
+}
+
 # ─── Cooldown check ──────────────────────────────────────────────
 # Prevents hammering the API on rapid successive tool calls
 check_cooldown() {
@@ -84,6 +101,10 @@ HANDLE=$(get_handle)
 if [ -z "$HANDLE" ]; then
   exit 0  # Not authenticated, nothing to check
 fi
+TOKEN=$(get_token || true)
+if [ -z "$TOKEN" ]; then
+  exit 0
+fi
 
 # Cooldown: skip if we checked recently
 if ! check_cooldown; then
@@ -95,6 +116,7 @@ update_cooldown
 
 # Fetch guest messages (with ack=true to clear after reading)
 RESPONSE=$(curl -s --max-time 3 \
+  -H "Authorization: Bearer $TOKEN" \
   "${API_BASE}/api/session/guest?handle=$(printf '%s' "$HANDLE" | jq -sRr @uri 2>/dev/null || echo "$HANDLE")&ack=true" \
   2>/dev/null || echo '{"success":false}')
 

package/index.js

@@ -16,6 +16,7 @@ const store = require('./store');
 const prompts = require('./prompts');
 const NotificationEmitter = require('./notification-emitter');
 const authStore = require('./auth-store');
+const { apiHeaders } = require('./api-auth');
 
 // Tools that shouldn't show presence footer (would be redundant/noisy)
 const SKIP_FOOTER_TOOLS = ['vibe_init', 'vibe_doctor', 'vibe_test', 'vibe_update', 'vibe_settings', 'vibe_notifications'];
@@ -116,7 +117,9 @@ async function fetchGuestMessages(handle) {
   const apiUrl = config.getApiUrl?.() || 'https://www.slashvibe.dev';
   try {
     // Fetch with ack=true to clear after reading (prevents re-injection)
-    const resp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(handle)}&ack=true`);
+    const resp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(handle)}&ack=true`, {
+      headers: apiHeaders(),
+    });
     if (!resp.ok) return [];
     const data = await resp.json();
     if (data.success && Array.isArray(data.messages) && data.messages.length > 0) {
@@ -626,4 +629,4 @@ class VibeMCPServer {
 
 // Start
 const server = new VibeMCPServer();
-server.start();
+server.start();

package/notify.js

@@ -15,6 +15,7 @@ const os = require('os');
 const fs = require('fs');
 const path = require('path');
 const config = require('./config');
+const { apiHeaders } = require('./api-auth');
 
 // Track what we've already notified about
 const NOTIFY_STATE_FILE = path.join(config.VIBE_DIR, '.notify_state.json');
@@ -397,7 +398,9 @@ async function checkAll(store) {
     // Check for guest session messages (multiplayer)
     try {
       const apiUrl = config.getApiUrl();
-      const guestResp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(myHandle)}`);
+      const guestResp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(myHandle)}`, {
+        headers: apiHeaders(),
+      });
       const guestData = await guestResp.json();
       if (guestData.success && guestData.messages && guestData.messages.length > 0) {
         checkGuestMessages(guestData.messages);

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.5.24",
+  "version": "0.5.25",
   "mcpName": "io.github.vibecodinginc/vibe",
-  "description": "Social layer for Claude Code - DMs, presence, Matrix multiplayer rooms, and connection between AI-assisted developers",
+  "description": "Social layer for Claude Code - identity, presence, messaging, and consented live collaboration",
   "main": "index.js",
   "bin": {
     "slashvibe-mcp": "./cli.js",
@@ -46,6 +46,7 @@
     "index.js",
     "setup.js",
     "auth-store.js",
+    "api-auth.js",
     "auto-update.js",
     "config.js",
     "crypto.js",
@@ -73,4 +74,4 @@
     "crossword-layout-generator": "^0.1.1",
     "node-fetch": "^2.7.0"
   }
-}
+}

package/presence.js

@@ -15,6 +15,7 @@
 const config = require('./config');
 const store = require('./store');
 const notify = require('./notify');
+const { apiHeaders } = require('./api-auth');
 
 let heartbeatInterval = null;
 let guestPollInterval = null;
@@ -99,7 +100,9 @@ async function pollGuestMessages() {
     if (!handle) return;
 
     const apiUrl = config.getApiUrl?.() || 'https://www.slashvibe.dev';
-    const resp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(handle)}`);
+    const resp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(handle)}`, {
+      headers: apiHeaders(),
+    });
     if (!resp.ok) return;
 
     const data = await resp.json();

package/tools/call.js

@@ -1,11 +1,6 @@
 /**
  * vibe call — Inject call transcripts into paired sessions
  *
- * DEPRECATED: Use Matrix rooms with Jitsi for voice calls. The Jigasi bridge
- * can pipe call transcription (via Whisper/Deepgram) as an ambient API endpoint.
- * Matrix rooms provide persistent transcript history for all participants.
- * 
- *
  * When on a call with your pair partner, paste or pipe in the
  * transcript and it gets sent to both Claude Code sessions.
  *
@@ -15,12 +10,13 @@
  */
 
 const config = require('../config');
+const { apiHeaders } = require('../api-auth');
 
 const API_URL = process.env.VIBE_API_URL || 'https://www.slashvibe.dev';
 
 const definition = {
   name: 'vibe_call',
-  description: '[DEPRECATED — use Matrix rooms + Jitsi] Inject call transcripts into your paired partner\'s Claude Code session.',
+  description: 'Inject call transcripts into an accepted pair partner\'s Claude Code session.',
   inputSchema: {
     type: 'object',
     properties: {
@@ -67,7 +63,9 @@ async function handler(args) {
     let partner = overridePartner;
     if (!partner) {
       try {
-        const resp = await fetch(`${API_URL}/api/pair?handle=${encodeURIComponent(handle)}`);
+        const resp = await fetch(`${API_URL}/api/pair?handle=${encodeURIComponent(handle)}`, {
+          headers: apiHeaders(),
+        });
         const data = await resp.json();
         if (data.paired) {
           partner = data.partner;
@@ -92,7 +90,9 @@ async function handler(args) {
 
 async function callStatus(handle) {
   try {
-    const resp = await fetch(`${API_URL}/api/pair?handle=${encodeURIComponent(handle)}`);
+    const resp = await fetch(`${API_URL}/api/pair?handle=${encodeURIComponent(handle)}`, {
+      headers: apiHeaders(),
+    });
     const data = await resp.json();
 
     if (!data.paired) {
@@ -127,7 +127,7 @@ async function injectTranscript(from, to, transcript) {
     try {
       const resp = await fetch(`${API_URL}/api/session/guest`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: apiHeaders({ 'Content-Type': 'application/json' }),
         body: JSON.stringify({ from, to, message: chunk }),
       });
       const data = await resp.json();

package/tools/guest-session.js

@@ -1,11 +1,6 @@
 /**
  * vibe guest — Multiplayer session messaging
  *
- * DEPRECATED: Use Matrix rooms instead. The Matrix bot + PostToolUse hook
- * provides the same ambient message injection with persistent history and
- * support for N participants. See vibe_matrix_read, vibe_matrix_send.
- * 
- *
  * Check for guest messages from people watching your session,
  * or send a message into someone else's Claude Code session.
  *
@@ -14,12 +9,13 @@
  */
 
 const config = require('../config');
+const { apiHeaders } = require('../api-auth');
 
 const API_URL = process.env.VIBE_API_URL || 'https://www.slashvibe.dev';
 
 const definition = {
   name: 'vibe_guest',
-  description: '[DEPRECATED — use Matrix rooms] Check for guest messages in your session, or send a message into someone else\'s Claude Code session.',
+  description: 'Check for consented guest messages in your session, or send a message into an accepted partner\'s Claude Code session.',
   inputSchema: {
     type: 'object',
     properties: {
@@ -69,7 +65,7 @@ async function handler(args) {
 async function checkMessages(handle, ack = false) {
   try {
     const url = `${API_URL}/api/session/guest?handle=${encodeURIComponent(handle)}${ack ? '&ack=true' : ''}`;
-    const resp = await fetch(url);
+    const resp = await fetch(url, { headers: apiHeaders() });
     const data = await resp.json();
 
     if (!data.success || !data.messages || data.messages.length === 0) {
@@ -100,7 +96,7 @@ async function sendMessage(from, to, message) {
   try {
     const resp = await fetch(`${API_URL}/api/session/guest`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: apiHeaders({ 'Content-Type': 'application/json' }),
       body: JSON.stringify({ from, to, message }),
     });
     const data = await resp.json();

package/tools/inbox.js

@@ -3,6 +3,7 @@
  */
 
 const config = require('../config');
+const { apiHeaders } = require('../api-auth');
 const store = require('../store');
 const notify = require('../notify');
 const patterns = require('../intelligence/patterns');
@@ -139,7 +140,9 @@ async function handler(args) {
   let guestMessages = [];
   try {
     const apiUrl = config.getApiUrl ? config.getApiUrl() : 'https://www.slashvibe.dev';
-    const guestResp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(myHandle)}`);
+    const guestResp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(myHandle)}`, {
+      headers: apiHeaders(),
+    });
     const guestData = await guestResp.json();
     if (guestData.success && guestData.messages && guestData.messages.length > 0) {
       guestMessages = guestData.messages;

package/tools/pair.js

@@ -1,11 +1,6 @@
 /**
  * vibe pair — Link up with another user for collaborative coding
  *
- * DEPRECATED: Use Matrix rooms instead. Matrix rooms support N participants,
- * persistent history, and cross-model collaboration (Claude + Codex + any).
- * See vibe_matrix_rooms, vibe_matrix_read, vibe_matrix_send.
- * 
- *
  * When paired:
  * - Your presence shows "paired with @partner"
  * - You can send guest messages into each other's sessions
@@ -13,19 +8,20 @@
  */
 
 const config = require('../config');
+const { apiHeaders } = require('../api-auth');
 
 const API_URL = process.env.VIBE_API_URL || 'https://www.slashvibe.dev';
 
 const definition = {
   name: 'vibe_pair',
-  description: '[DEPRECATED — use Matrix rooms] Pair up with another /vibe user for collaborative coding. Start a pair session, check status, or disconnect.',
+  description: 'Pair with another /vibe user for collaborative coding. Pairing requires the other actor to accept.',
   inputSchema: {
     type: 'object',
     properties: {
       action: {
         type: 'string',
-        description: 'Action: "start" (pair with someone), "stop" (end pair), "status" (check current pair)',
-        enum: ['start', 'stop', 'status'],
+        description: 'Action: "start", "accept", "decline", "stop", or "status"',
+        enum: ['start', 'accept', 'decline', 'stop', 'status'],
       },
       partner: {
         type: 'string',
@@ -61,6 +57,11 @@ async function handler(args) {
     return await startPair(handle, partner, mode || 'coding');
   }
 
+  if (action === 'accept' || action === 'decline') {
+    if (!partner) return { content: [{ type: 'text', text: `Missing partner for ${action}.` }] };
+    return await respondToPair(handle, partner, action);
+  }
+
   if (action === 'stop') {
     return await stopPair(handle);
   }
@@ -70,10 +71,22 @@ async function handler(args) {
 
 async function checkStatus(handle) {
   try {
-    const resp = await fetch(`${API_URL}/api/pair?handle=${encodeURIComponent(handle)}`);
+    const resp = await fetch(`${API_URL}/api/pair?handle=${encodeURIComponent(handle)}`, {
+      headers: apiHeaders(),
+    });
     const data = await resp.json();
 
     if (!data.paired) {
+      const incoming = data.incomingRequests || [];
+      if (incoming.length > 0) {
+        const request = incoming[0];
+        return {
+          content: [{
+            type: 'text',
+            text: `@${request.from} wants to pair (${request.mode || 'coding'}). Use action "accept" or "decline" with partner "${request.from}".`,
+          }],
+        };
+      }
       return { content: [{ type: 'text', text: 'Not paired with anyone. Use action "start" with a partner handle.' }] };
     }
 
@@ -89,11 +102,33 @@ async function checkStatus(handle) {
   }
 }
 
+async function respondToPair(handle, partner, action) {
+  try {
+    const resp = await fetch(`${API_URL}/api/pair`, {
+      method: 'POST',
+      headers: apiHeaders({ 'Content-Type': 'application/json' }),
+      body: JSON.stringify({ handle, partner, action }),
+    });
+    const data = await resp.json();
+    if (!resp.ok || data.success === false) {
+      return { content: [{ type: 'text', text: `Could not ${action} pair request: ${data.message || data.error}` }] };
+    }
+    return {
+      content: [{
+        type: 'text',
+        text: action === 'accept' ? `Paired with @${partner}.` : `Declined @${partner}'s pair request.`,
+      }],
+    };
+  } catch (err) {
+    return { content: [{ type: 'text', text: `Error: ${err.message}` }] };
+  }
+}
+
 async function startPair(handle, partner, mode) {
   try {
     const resp = await fetch(`${API_URL}/api/pair`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: apiHeaders({ 'Content-Type': 'application/json' }),
       body: JSON.stringify({ handle, partner, action: 'start', mode }),
     });
     const data = await resp.json();
@@ -107,6 +142,15 @@ async function startPair(handle, partner, mode) {
       };
     }
 
+    if (data.pending) {
+      return {
+        content: [{
+          type: 'text',
+          text: `Pair request sent to @${partner}. Session sharing starts only after they accept.`,
+        }],
+      };
+    }
+
     return { content: [{ type: 'text', text: `Failed to pair: ${JSON.stringify(data)}` }] };
   } catch (err) {
     return { content: [{ type: 'text', text: `Error: ${err.message}` }] };
@@ -117,7 +161,7 @@ async function stopPair(handle) {
   try {
     await fetch(`${API_URL}/api/pair`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: apiHeaders({ 'Content-Type': 'application/json' }),
       body: JSON.stringify({ handle, action: 'stop' }),
     });
     return { content: [{ type: 'text', text: 'Pair ended.' }] };

package/tools/start.js

@@ -12,6 +12,7 @@ const fs = require('fs');
 const path = require('path');
 const { execSync } = require('child_process');
 const config = require('../config');
+const { apiHeaders } = require('../api-auth');
 const store = require('../store');
 const memory = require('../memory');
 const notify = require('../notify');
@@ -274,9 +275,10 @@ async function handler(args) {
   let pairStatus = null;
   try {
     const apiUrl = config.getApiUrl();
+    const headers = apiHeaders();
     const [guestResp, pairResp] = await Promise.all([
-      fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(myHandle)}`),
-      fetch(`${apiUrl}/api/pair?handle=${encodeURIComponent(myHandle)}`),
+      fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(myHandle)}`, { headers }),
+      fetch(`${apiUrl}/api/pair?handle=${encodeURIComponent(myHandle)}`, { headers }),
     ]);
     const guestData = await guestResp.json();
     if (guestData.success && guestData.messages && guestData.messages.length > 0) {

package/version.json

@@ -1,17 +1,15 @@
 {
-  "version": "0.5.19",
-  "updated": "2026-07-08",
-  "changelog": "Your terminal is now a first-class citizen of the conversation. DMs sent from any surface \u2014 the iPhone app, Vibe Buddy, the web \u2014 now land inside your live Claude Code session within seconds, surfaced once with the sender and a preview. And reading a message in the terminal finally counts: vibe inbox / open / reply clear the unread badge on your phone and desktop too, not just here.",
+  "version": "0.5.25",
+  "updated": "2026-07-10",
+  "changelog": "Live collaboration now has a real actor boundary. Pairing requires acceptance, private session reads use the signed-in actor instead of a viewer string, and messages enter a human session only after the owner opts in. All MCP pair and guest calls now carry the OAuth token.",
   "features": [
-    "DMs reach your live session \u2014 a message from ANY surface (iOS, Buddy, web, another terminal) is injected into your session's ambient footer within one 15s poll cycle, once per message, with clear external-input guardrails. Previously only Buddy's guest channel could reach a session; ordinary DMs sat behind an unread counter",
-    "Terminal reads sync everywhere \u2014 vibe_inbox / vibe_open / vibe_reply now advance the shared per-handle read cursor (they were silently no-oping), so reading in Claude Code clears the badge on iOS and Buddy",
-    "Injected DMs never double-fire \u2014 each message body enters context exactly once; read state only advances when you actually open or reply to the thread, so badges stay honest about what you've engaged with"
+    "Pair requests are two-party: the target accepts or declines before session context is shared",
+    "Paired and private session reads derive the viewer from a signed token; query-string handle spoofing no longer grants access",
+    "Guest messages and handle/claude DMs require target opt-in plus an accepted pair for human sessions",
+    "Public house-agent sessions retain their explicit open-door policy",
+    "The MCP version manifest, package, and lockfile now report the same release"
   ],
-  "deprecated": [
-    "vibe_pair \u2014 use Matrix room invites",
-    "vibe_guest \u2014 use vibe_matrix_send / vibe_matrix_read",
-    "vibe_call \u2014 use Matrix rooms + Jitsi"
-  ],
-  "breaking": false,
+  "deprecated": [],
+  "breaking": true,
   "updateUrl": "https://www.slashvibe.dev/api/version"
-}
+}