slashvibe-mcp 0.5.5 → 0.5.7

package/notify.js

@@ -10,7 +10,7 @@
  * This is escalation, not baseline.
  */
 
-const { exec } = require('child_process');
+const { execFile } = require('child_process');
 const os = require('os');
 const fs = require('fs');
 const path = require('path');
@@ -56,16 +56,18 @@ function showNotification(title, message, sound = false, bell = true) {
     ringBell();
   }
 
-  // Escape quotes for osascript
-  const safeTitle = title.replace(/"/g, '\\"');
-  const safeMessage = message.replace(/"/g, '\\"');
+  // Escape double quotes so title/message stay inside their AppleScript string
+  // literals. Everything is passed to osascript via execFile (no shell), so
+  // sender-controlled single quotes can no longer break out into a shell command.
+  const safeTitle = String(title).replace(/"/g, '\\"');
+  const safeMessage = String(message).replace(/"/g, '\\"');
 
   let script = `display notification "${safeMessage}" with title "${safeTitle}"`;
   if (sound) {
     script += ` sound name "Ping"`;
   }
 
-  exec(`osascript -e '${script}'`, (err) => {
+  execFile('osascript', ['-e', script], (err) => {
     if (err) {
       // Silently fail - notifications are best-effort
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "mcpName": "io.github.vibecodinginc/vibe",
   "description": "Social layer for Claude Code - DMs, presence, Matrix multiplayer rooms, and connection between AI-assisted developers",
   "main": "index.js",

package/tools/init.js

@@ -641,12 +641,45 @@ async function handler(args) {
   if (config.hasOAuth()) {
     const existingHandle = config.getHandle();
     if (existingHandle) {
+      // Enrich the returning-user surface — this fires on every `vibe` for an
+      // already-authed user, so it's our highest-frequency touchpoint. Surface
+      // unread (the reason to come back) and, if we have no email on file, nudge
+      // the return loop right at the teachable moment. Both are best-effort with
+      // tight timeouts — never hold up the response; degrade to the plain message.
+      let unreadCount = 0;
+      let hasEmail = null;
+      try {
+        [unreadCount, hasEmail] = await Promise.all([
+          Promise.race([
+            store.getUnreadCount(existingHandle),
+            new Promise(resolve => setTimeout(() => resolve(0), 1500))
+          ]).catch(() => 0),
+          Promise.race([
+            fetchHasEmail(config.getAuthToken()),
+            new Promise(resolve => setTimeout(() => resolve(null), 1500))
+          ]).catch(() => null)
+        ]);
+      } catch (e) {}
+
+      const unreadLine = unreadCount > 0
+        ? `\n\n📬 **${unreadCount} unread** — say \`vibe inbox\` to read ${unreadCount > 1 ? 'them' : 'it'}.`
+        : '';
+
+      // Only nudge when we genuinely can't reach them out-of-band. If they have
+      // unread right now, the value is concrete: "these landed while you were
+      // away — next time we'll email you." Otherwise it's a gentle one-liner.
+      const emailNudge = hasEmail === false
+        ? (unreadCount > 0
+            ? `\n\n📧 These landed while you were away. Add an email and /vibe pings you next time — say **"vibe email you@example.com"** _(offline only · one-click unsubscribe)_.`
+            : `\n\n📧 **Don't miss a DM** — add an email and /vibe pings you when someone messages you while you're away: **"vibe email you@example.com"** _(offline only · one-click unsubscribe)_.`)
+        : '';
+
       return {
-        display: `## Already signed in as @${existingHandle}
+        display: `## Already signed in as @${existingHandle}${unreadLine}
 
 To sign out and re-authenticate: \`vibe logout\`
 To see who's online: \`vibe who\`
-To check messages: \`vibe inbox\``
+To check messages: \`vibe inbox\`${emailNudge}`
       };
     }
   }

package/version.json

@@ -1,11 +1,11 @@
 {
-  "version": "0.5.5",
-  "updated": "2026-06-29",
-  "changelog": "Presence now tells the truth: builders and agents are counted separately, so the green dot means something. Onboarding only promises a room full of people when real humans are actually online.",
+  "version": "0.5.6",
+  "updated": "2026-06-30",
+  "changelog": "Come back to what you missed. Returning to /vibe now shows your unread count right away, and if we don't have an email to reach you at, we offer to arm the return-loop ping at the moment it matters — when a DM just landed while you were away.",
   "features": [
-    "Presence banner shows the human/agent split (e.g. '2 builders · 7 agents') instead of one blended count",
-    "First-60s 'vibe who' nudge promises a crowd only when 2+ humans are online; agents still appear in vibe who",
-    "Honest empty-room copy when you're the first one in"
+    "Returning 'already signed in' surface now shows your unread count instead of a static line",
+    "Contextual email nudge on return: if a DM landed while you were away and we can't reach you, we offer 'vibe email' right then",
+    "One-line, offline-only, one-click unsubscribe — the return loop only pings when you're actually gone"
   ],
   "deprecated": [
     "vibe_pair — use Matrix room invites",