slashvibe-mcp 0.5.24 → 0.6.0

package/README.md

@@ -116,31 +116,20 @@ This enables visual collaboration (diagrams, mockups, debug screenshots) directl
 
 ---
 
-## Deprecated: Pair/Guest/Call APIs
-
-The following tools and APIs are **deprecated** in favor of Matrix rooms. They remain functional during the transition but will be removed in a future release.
-
-### Deprecated MCP Tools
-
-| Tool | Replacement |
-|------|-------------|
-| `vibe_pair` | Use Matrix rooms -- invite collaborators to a shared room |
-| `vibe_guest` | Use `vibe_matrix_send` / `vibe_matrix_read` |
-| `vibe_call` | Use Matrix rooms + Jitsi for voice (Jigasi bridge for transcription) |
-
-### Deprecated APIs (7 endpoints)
-
-| API | Status |
-|-----|--------|
-| `/api/pair/request` | Deprecated -- use Matrix room invites |
-| `/api/pair/accept` | Deprecated -- use Matrix room invites |
-| `/api/call/signal` | Deprecated -- use Element/Jitsi |
-| `/api/call/status` | Deprecated -- use Element/Jitsi |
-| `/api/call/ice-servers` | Deprecated -- use Element/Jitsi |
-| `/api/session/guest` | Deprecated -- use Matrix messages |
-| `/api/session/live` | Deprecated -- use Matrix rooms |
-
-**Why the change:** Matrix rooms provide persistent history, support N participants (not just pairs), work across models (Claude + Codex + any), and federate with the broader Matrix ecosystem. The pair/guest/call system was limited to 2-player KV-backed sessions with short TTLs.
+## Pair/Guest/Call Transport
+
+Pairing, live sessions, guest turns, and WebRTC signaling use the supported
+REST/KV transport. Matrix rooms are an optional collaboration surface, not a
+replacement or migration target for these APIs.
+
+| Surface | Contract |
+|---------|----------|
+| `vibe_pair` | Authenticated request plus explicit acceptance |
+| `vibe_guest` | Target opt-in plus accepted pair for human sessions |
+| `vibe_call` | Transcript delivery through the consented guest-session path |
+| `/api/pair`, `/api/pair/request`, `/api/pair/accept` | Supported pairing handshakes |
+| `/api/session/live`, `/api/session/guest` | Supported live collaboration transport |
+| `/api/call/*` | Supported WebRTC signaling and lifecycle transport |
 
 ---
 

package/api-auth.js

@@ -0,0 +1,11 @@
+const config = require('./config');
+
+function apiHeaders(extra = {}) {
+  const token = config.getAuthToken();
+  return {
+    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+    ...extra,
+  };
+}
+
+module.exports = { apiHeaders };

package/hooks/check-guest-messages.js

@@ -17,6 +17,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { apiHeaders } = require('../api-auth');
 
 const VIBE_DIR = path.join(process.env.HOME, '.vibe');
 const VIBECODINGS_DIR = path.join(process.env.HOME, '.vibecodings');
@@ -41,7 +42,10 @@ process.stdin.on('end', () => {});
 
     // Fetch guest messages (with ack to clear after reading)
     const url = `${API_BASE}/api/session/guest?handle=${encodeURIComponent(handle)}&ack=true`;
-    const resp = await fetch(url, { signal: AbortSignal.timeout(3000) });
+    const resp = await fetch(url, {
+      headers: apiHeaders(),
+      signal: AbortSignal.timeout(3000),
+    });
     if (!resp.ok) process.exit(0);
 
     const data = await resp.json();

package/hooks/check-guest-messages.sh

@@ -50,6 +50,23 @@ get_handle() {
   echo "$handle"
 }
 
+get_token() {
+  if ! command -v jq &>/dev/null; then
+    return 1
+  fi
+  local token=""
+  if [ -f "$VIBE_DIR/config.json" ]; then
+    token=$(jq -r '.authToken // .privyToken // empty' "$VIBE_DIR/config.json" 2>/dev/null)
+  fi
+  if [ -z "$token" ] && [ -f "$VIBE_DIR/auth.json" ]; then
+    token=$(jq -r '.token // empty' "$VIBE_DIR/auth.json" 2>/dev/null)
+  fi
+  if [ -z "$token" ] && [ -f "$VIBECODINGS_DIR/config.json" ]; then
+    token=$(jq -r '.authToken // .privyToken // empty' "$VIBECODINGS_DIR/config.json" 2>/dev/null)
+  fi
+  echo "$token"
+}
+
 # ─── Cooldown check ──────────────────────────────────────────────
 # Prevents hammering the API on rapid successive tool calls
 check_cooldown() {
@@ -84,6 +101,10 @@ HANDLE=$(get_handle)
 if [ -z "$HANDLE" ]; then
   exit 0  # Not authenticated, nothing to check
 fi
+TOKEN=$(get_token || true)
+if [ -z "$TOKEN" ]; then
+  exit 0
+fi
 
 # Cooldown: skip if we checked recently
 if ! check_cooldown; then
@@ -95,6 +116,7 @@ update_cooldown
 
 # Fetch guest messages (with ack=true to clear after reading)
 RESPONSE=$(curl -s --max-time 3 \
+  -H "Authorization: Bearer $TOKEN" \
   "${API_BASE}/api/session/guest?handle=$(printf '%s' "$HANDLE" | jq -sRr @uri 2>/dev/null || echo "$HANDLE")&ack=true" \
   2>/dev/null || echo '{"success":false}')
 

package/index.js

@@ -16,6 +16,7 @@ const store = require('./store');
 const prompts = require('./prompts');
 const NotificationEmitter = require('./notification-emitter');
 const authStore = require('./auth-store');
+const { apiHeaders } = require('./api-auth');
 
 // Tools that shouldn't show presence footer (would be redundant/noisy)
 const SKIP_FOOTER_TOOLS = ['vibe_init', 'vibe_doctor', 'vibe_test', 'vibe_update', 'vibe_settings', 'vibe_notifications'];
@@ -116,7 +117,9 @@ async function fetchGuestMessages(handle) {
   const apiUrl = config.getApiUrl?.() || 'https://www.slashvibe.dev';
   try {
     // Fetch with ack=true to clear after reading (prevents re-injection)
-    const resp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(handle)}&ack=true`);
+    const resp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(handle)}&ack=true`, {
+      headers: apiHeaders(),
+    });
     if (!resp.ok) return [];
     const data = await resp.json();
     if (data.success && Array.isArray(data.messages) && data.messages.length > 0) {
@@ -626,4 +629,4 @@ class VibeMCPServer {
 
 // Start
 const server = new VibeMCPServer();
-server.start();
+server.start();

package/notify.js

@@ -15,6 +15,7 @@ const os = require('os');
 const fs = require('fs');
 const path = require('path');
 const config = require('./config');
+const { apiHeaders } = require('./api-auth');
 
 // Track what we've already notified about
 const NOTIFY_STATE_FILE = path.join(config.VIBE_DIR, '.notify_state.json');
@@ -397,7 +398,9 @@ async function checkAll(store) {
     // Check for guest session messages (multiplayer)
     try {
       const apiUrl = config.getApiUrl();
-      const guestResp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(myHandle)}`);
+      const guestResp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(myHandle)}`, {
+        headers: apiHeaders(),
+      });
       const guestData = await guestResp.json();
       if (guestData.success && guestData.messages && guestData.messages.length > 0) {
         checkGuestMessages(guestData.messages);

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.5.24",
+  "version": "0.6.0",
   "mcpName": "io.github.vibecodinginc/vibe",
-  "description": "Social layer for Claude Code - DMs, presence, Matrix multiplayer rooms, and connection between AI-assisted developers",
+  "description": "Social layer for Claude Code - identity, presence, messaging, and consented live collaboration",
   "main": "index.js",
   "bin": {
     "slashvibe-mcp": "./cli.js",
@@ -46,6 +46,7 @@
     "index.js",
     "setup.js",
     "auth-store.js",
+    "api-auth.js",
     "auto-update.js",
     "config.js",
     "crypto.js",
@@ -59,7 +60,41 @@
     "prompts.js",
     "twitter.js",
     "version.json",
-    "tools/",
+    "tools/_actions.js",
+    "tools/_discovery.js",
+    "tools/_shared.js",
+    "tools/_work-context.js",
+    "tools/admin-inbox.js",
+    "tools/artifact-view.js",
+    "tools/bye.js",
+    "tools/corpse.js",
+    "tools/dm.js",
+    "tools/doctor.js",
+    "tools/echo.js",
+    "tools/email.js",
+    "tools/fable.js",
+    "tools/feed.js",
+    "tools/game.js",
+    "tools/help.js",
+    "tools/inbox.js",
+    "tools/init.js",
+    "tools/intro.js",
+    "tools/matrix-read.js",
+    "tools/matrix-rooms.js",
+    "tools/matrix-send.js",
+    "tools/patterns.js",
+    "tools/play.js",
+    "tools/poem.js",
+    "tools/reply.js",
+    "tools/ship.js",
+    "tools/start.js",
+    "tools/status.js",
+    "tools/summarize.js",
+    "tools/test.js",
+    "tools/token.js",
+    "tools/update.js",
+    "tools/weave.js",
+    "tools/who.js",
     "hooks/",
     "store/",
     "protocol/",
@@ -73,4 +108,4 @@
     "crossword-layout-generator": "^0.1.1",
     "node-fetch": "^2.7.0"
   }
-}
+}

package/presence.js

@@ -15,6 +15,7 @@
 const config = require('./config');
 const store = require('./store');
 const notify = require('./notify');
+const { apiHeaders } = require('./api-auth');
 
 let heartbeatInterval = null;
 let guestPollInterval = null;
@@ -99,7 +100,9 @@ async function pollGuestMessages() {
     if (!handle) return;
 
     const apiUrl = config.getApiUrl?.() || 'https://www.slashvibe.dev';
-    const resp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(handle)}`);
+    const resp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(handle)}`, {
+      headers: apiHeaders(),
+    });
     if (!resp.ok) return;
 
     const data = await resp.json();

package/tools/inbox.js

@@ -3,6 +3,7 @@
  */
 
 const config = require('../config');
+const { apiHeaders } = require('../api-auth');
 const store = require('../store');
 const notify = require('../notify');
 const patterns = require('../intelligence/patterns');
@@ -139,7 +140,9 @@ async function handler(args) {
   let guestMessages = [];
   try {
     const apiUrl = config.getApiUrl ? config.getApiUrl() : 'https://www.slashvibe.dev';
-    const guestResp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(myHandle)}`);
+    const guestResp = await fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(myHandle)}`, {
+      headers: apiHeaders(),
+    });
     const guestData = await guestResp.json();
     if (guestData.success && guestData.messages && guestData.messages.length > 0) {
       guestMessages = guestData.messages;

package/tools/start.js

@@ -12,6 +12,7 @@ const fs = require('fs');
 const path = require('path');
 const { execSync } = require('child_process');
 const config = require('../config');
+const { apiHeaders } = require('../api-auth');
 const store = require('../store');
 const memory = require('../memory');
 const notify = require('../notify');
@@ -274,9 +275,10 @@ async function handler(args) {
   let pairStatus = null;
   try {
     const apiUrl = config.getApiUrl();
+    const headers = apiHeaders();
     const [guestResp, pairResp] = await Promise.all([
-      fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(myHandle)}`),
-      fetch(`${apiUrl}/api/pair?handle=${encodeURIComponent(myHandle)}`),
+      fetch(`${apiUrl}/api/session/guest?handle=${encodeURIComponent(myHandle)}`, { headers }),
+      fetch(`${apiUrl}/api/pair?handle=${encodeURIComponent(myHandle)}`, { headers }),
     ]);
     const guestData = await guestResp.json();
     if (guestData.success && guestData.messages && guestData.messages.length > 0) {

package/version.json

@@ -1,17 +1,13 @@
 {
-  "version": "0.5.19",
-  "updated": "2026-07-08",
-  "changelog": "Your terminal is now a first-class citizen of the conversation. DMs sent from any surface \u2014 the iPhone app, Vibe Buddy, the web \u2014 now land inside your live Claude Code session within seconds, surfaced once with the sender and a preview. And reading a message in the terminal finally counts: vibe inbox / open / reply clear the unread badge on your phone and desktop too, not just here.",
+  "version": "0.6.0",
+  "updated": "2026-07-25",
+  "changelog": "Lean release: the npm tarball now ships only the tool files the server actually loads. 90+ unreachable experiment files (wallet, l2, mint, games graveyard, deprecated) no longer ride along in every npx download. Zero behavior change: same 23-tool surface, same registration, same auth flow.",
   "features": [
-    "DMs reach your live session \u2014 a message from ANY surface (iOS, Buddy, web, another terminal) is injected into your session's ambient footer within one 15s poll cycle, once per message, with clear external-input guardrails. Previously only Buddy's guest channel could reach a session; ordinary DMs sat behind an unread counter",
-    "Terminal reads sync everywhere \u2014 vibe_inbox / vibe_open / vibe_reply now advance the shared per-handle read cursor (they were silently no-oping), so reading in Claude Code clears the badge on iOS and Buddy",
-    "Injected DMs never double-fire \u2014 each message body enters context exactly once; read state only advances when you actually open or reply to the thread, so badges stay honest about what you've engaged with"
-  ],
-  "deprecated": [
-    "vibe_pair \u2014 use Matrix room invites",
-    "vibe_guest \u2014 use vibe_matrix_send / vibe_matrix_read",
-    "vibe_call \u2014 use Matrix rooms + Jitsi"
+    "Tarball pruned to the require-closure of index.js/cli.js/setup.js (static analysis, no dynamic requires in codebase)",
+    "Package size and npx cold-start reduced",
+    "No tool added or removed from the live surface"
   ],
+  "deprecated": [],
   "breaking": false,
   "updateUrl": "https://www.slashvibe.dev/api/version"
-}
+}

package/tools/_connection-queue.js

@@ -1,257 +0,0 @@
-/**
- * Connection Queue Management — Smart queuing for connection suggestions
- *
- * Prevents suggestion spam and optimizes timing:
- * - Tracks recent suggestions to avoid repeats
- * - Queues suggestions for optimal timing
- * - Rates limits to prevent overwhelming users
- * - Prioritizes high-quality matches
- */
-
-const fs = require('fs');
-const path = require('path');
-const config = require('../config');
-
-const QUEUE_FILE = path.join(config.VIBE_DIR, 'connection-queue.json');
-const SUGGESTION_COOLDOWN = 24 * 60 * 60 * 1000; // 24 hours
-const MAX_SUGGESTIONS_PER_DAY = 3;
-
-// Load queue data from disk
-function loadQueue() {
-  try {
-    if (fs.existsSync(QUEUE_FILE)) {
-      const data = fs.readFileSync(QUEUE_FILE, 'utf8');
-      return JSON.parse(data);
-    }
-  } catch (e) {
-    console.warn('Failed to load connection queue:', e.message);
-  }
-  return {
-    recent_suggestions: [],
-    queued_suggestions: [],
-    user_limits: {}
-  };
-}
-
-// Save queue data to disk
-function saveQueue(queueData) {
-  try {
-    fs.writeFileSync(QUEUE_FILE, JSON.stringify(queueData, null, 2));
-  } catch (e) {
-    console.error('Failed to save connection queue:', e.message);
-  }
-}
-
-// Check if suggestion was made recently
-function isRecentSuggestion(from, to) {
-  const queue = loadQueue();
-  const now = Date.now();
-  const cutoff = now - SUGGESTION_COOLDOWN;
-  
-  return queue.recent_suggestions.some(s => 
-    s.from === from && 
-    s.to === to && 
-    s.timestamp > cutoff
-  );
-}
-
-// Check if user has reached daily suggestion limit
-function hasReachedDailyLimit(userHandle) {
-  const queue = loadQueue();
-  const now = Date.now();
-  const dayStart = now - (24 * 60 * 60 * 1000);
-  
-  if (!queue.user_limits[userHandle]) {
-    return false;
-  }
-  
-  const todaysSuggestions = queue.user_limits[userHandle].filter(
-    timestamp => timestamp > dayStart
-  );
-  
-  return todaysSuggestions.length >= MAX_SUGGESTIONS_PER_DAY;
-}
-
-// Record a new suggestion
-function recordSuggestion(from, to, reason, priority = 'medium') {
-  const queue = loadQueue();
-  const now = Date.now();
-  
-  // Add to recent suggestions
-  queue.recent_suggestions.push({
-    from,
-    to,
-    reason,
-    timestamp: now,
-    priority
-  });
-  
-  // Track user limit
-  if (!queue.user_limits[from]) {
-    queue.user_limits[from] = [];
-  }
-  queue.user_limits[from].push(now);
-  
-  // Clean up old data
-  const cutoff = now - SUGGESTION_COOLDOWN;
-  queue.recent_suggestions = queue.recent_suggestions.filter(s => s.timestamp > cutoff);
-  
-  // Clean up user limits (keep last 7 days)
-  const weekCutoff = now - (7 * 24 * 60 * 60 * 1000);
-  for (const [user, timestamps] of Object.entries(queue.user_limits)) {
-    queue.user_limits[user] = timestamps.filter(t => t > weekCutoff);
-    if (queue.user_limits[user].length === 0) {
-      delete queue.user_limits[user];
-    }
-  }
-  
-  saveQueue(queue);
-}
-
-// Queue a suggestion for later delivery
-function queueSuggestion(from, to, reason, priority = 'medium', idealTiming = null) {
-  const queue = loadQueue();
-  const now = Date.now();
-  
-  queue.queued_suggestions.push({
-    from,
-    to,
-    reason,
-    priority,
-    queued_at: now,
-    ideal_timing: idealTiming,
-    status: 'pending'
-  });
-  
-  saveQueue(queue);
-}
-
-// Get next suggestions to process
-function getNextSuggestions(limit = 5) {
-  const queue = loadQueue();
-  const now = Date.now();
-  
-  return queue.queued_suggestions
-    .filter(s => s.status === 'pending')
-    .filter(s => {
-      // Check timing constraint if specified
-      if (s.ideal_timing && now < s.ideal_timing) {
-        return false;
-      }
-      
-      // Check rate limits
-      if (hasReachedDailyLimit(s.from)) {
-        return false;
-      }
-      
-      // Check recent suggestion cooldown
-      if (isRecentSuggestion(s.from, s.to)) {
-        return false;
-      }
-      
-      return true;
-    })
-    .sort((a, b) => {
-      // Priority sorting: high -> medium -> low
-      const priorityOrder = { high: 3, medium: 2, low: 1 };
-      const priorityDiff = (priorityOrder[b.priority] || 2) - (priorityOrder[a.priority] || 2);
-      if (priorityDiff !== 0) return priorityDiff;
-      
-      // Then by queue time (older first)
-      return a.queued_at - b.queued_at;
-    })
-    .slice(0, limit);
-}
-
-// Mark suggestion as processed
-function markSuggestionProcessed(from, to, status = 'sent') {
-  const queue = loadQueue();
-  
-  const suggestion = queue.queued_suggestions.find(s => 
-    s.from === from && s.to === to && s.status === 'pending'
-  );
-  
-  if (suggestion) {
-    suggestion.status = status;
-    suggestion.processed_at = Date.now();
-    saveQueue(queue);
-    
-    // Also record in recent suggestions if sent
-    if (status === 'sent') {
-      recordSuggestion(from, to, suggestion.reason, suggestion.priority);
-    }
-  }
-}
-
-// Get user's suggestion history
-function getUserSuggestionHistory(userHandle, days = 7) {
-  const queue = loadQueue();
-  const cutoff = Date.now() - (days * 24 * 60 * 60 * 1000);
-  
-  const recent = queue.recent_suggestions.filter(s => 
-    s.from === userHandle && s.timestamp > cutoff
-  );
-  
-  const queued = queue.queued_suggestions.filter(s => 
-    s.from === userHandle
-  );
-  
-  return { recent, queued };
-}
-
-// Get queue statistics
-function getQueueStats() {
-  const queue = loadQueue();
-  const now = Date.now();
-  
-  const pending = queue.queued_suggestions.filter(s => s.status === 'pending').length;
-  const processed = queue.queued_suggestions.filter(s => s.status !== 'pending').length;
-  
-  const today = now - (24 * 60 * 60 * 1000);
-  const recentSuggestions = queue.recent_suggestions.filter(s => s.timestamp > today).length;
-  
-  const priorityCounts = {};
-  for (const suggestion of queue.queued_suggestions) {
-    if (suggestion.status === 'pending') {
-      priorityCounts[suggestion.priority] = (priorityCounts[suggestion.priority] || 0) + 1;
-    }
-  }
-  
-  return {
-    pending,
-    processed,
-    recentSuggestions,
-    priorityCounts,
-    totalUsers: Object.keys(queue.user_limits).length
-  };
-}
-
-// Clean up old queue data
-function cleanupQueue() {
-  const queue = loadQueue();
-  const now = Date.now();
-  const cutoff = now - (7 * 24 * 60 * 60 * 1000); // 7 days
-  
-  // Remove old processed suggestions
-  queue.queued_suggestions = queue.queued_suggestions.filter(s => 
-    s.status === 'pending' || (s.processed_at && s.processed_at > cutoff)
-  );
-  
-  // Remove old recent suggestions (already handled in recordSuggestion)
-  
-  saveQueue(queue);
-}
-
-module.exports = {
-  isRecentSuggestion,
-  hasReachedDailyLimit,
-  recordSuggestion,
-  queueSuggestion,
-  getNextSuggestions,
-  markSuggestionProcessed,
-  getUserSuggestionHistory,
-  getQueueStats,
-  cleanupQueue,
-  SUGGESTION_COOLDOWN,
-  MAX_SUGGESTIONS_PER_DAY
-};