slashvibe-mcp 0.7.1 → 0.8.0

package/cli.js

@@ -24,7 +24,7 @@ if (args.includes('setup')) {
     require('./setup.js');
   } else {
     // Already set up — show status
-    console.log('/vibe is configured. Restart Claude Code to connect.');
+    console.log('/vibe is configured. Restart your coding agent (Claude Code / Codex / Cursor) to connect.');
     console.log('');
     console.log('Commands:');
     console.log('  npx slashvibe-mcp setup   — re-run setup wizard');

package/host.js

@@ -0,0 +1,76 @@
+/**
+ * Host — which coding agent is this MCP server living inside?
+ *
+ * /vibe presence should say not just "someone is here via mcp" but WHICH
+ * terminal agent their session runs in (Claude Code, Codex, Cursor, …).
+ * That's the proof of the heterogeneous claim: distinct agent types on the
+ * buddy list, one MCP server serving all of them.
+ *
+ * Detection, in priority order:
+ *   1. MCP `initialize` clientInfo.name — the host names itself; index.js
+ *      calls setClientInfo() when the handshake arrives.
+ *   2. Environment fingerprints — fallback for hosts whose clientInfo is
+ *      missing or generic.
+ * The raw name is preserved alongside the normalized slug so unknown hosts
+ * still show up honestly instead of as "unknown".
+ */
+
+let clientInfo = null; // { name, version } from the MCP initialize handshake
+
+function setClientInfo(info) {
+  if (info && typeof info.name === 'string') {
+    clientInfo = { name: info.name, version: info.version || null };
+  }
+}
+
+// Map a client-reported name to a KNOWN host slug, or null if unrecognized.
+// Word-boundary matching so e.g. "customized-client" doesn't hit the zed rule.
+const KNOWN_HOSTS = [
+  [/\bclaude\b/, 'claude-code'],
+  [/\bcodex\b/, 'codex'],
+  [/\bcursor\b/, 'cursor'],
+  [/\bwindsurf\b/, 'windsurf'],
+  [/\bcline\b/, 'cline'],
+  [/\bzed\b/, 'zed'],
+  [/\bgemini\b/, 'gemini-cli'],
+];
+
+function knownHost(name) {
+  const n = (name || '').toLowerCase();
+  if (!n) return null;
+  for (const [re, slug] of KNOWN_HOSTS) {
+    if (re.test(n)) return slug;
+  }
+  return null;
+}
+
+// Slug an unknown host name so it still shows up honestly in presence.
+function slugify(name) {
+  const n = (name || '').toLowerCase();
+  return n.replace(/[^a-z0-9.-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 32) || null;
+}
+
+function envFingerprint() {
+  if (process.env.CLAUDECODE || process.env.CLAUDE_CODE_ENTRYPOINT) return 'claude-code';
+  if (process.env.CODEX_SANDBOX || process.env.CODEX_HOME) return 'codex';
+  if (process.env.CURSOR_TRACE_ID || process.env.CURSOR_CHANNEL) return 'cursor';
+  return null;
+}
+
+/**
+ * The host agent this server is running inside.
+ * Precedence: recognized clientInfo name → env fingerprint → slug of whatever
+ * the client called itself → 'terminal'. A generic/unknown clientInfo name
+ * (e.g. "mcp-client") must NOT defeat a definitive env fingerprint.
+ * @returns {{ agent: string, version: string|null }}
+ */
+function getHost() {
+  const agent =
+    knownHost(clientInfo?.name) ||
+    envFingerprint() ||
+    slugify(clientInfo?.name) ||
+    'terminal';
+  return { agent, version: clientInfo?.version || null };
+}
+
+module.exports = { setClientInfo, getHost };

package/index.js

@@ -17,9 +17,35 @@ const prompts = require('./prompts');
 const NotificationEmitter = require('./notification-emitter');
 const authStore = require('./auth-store');
 const { apiHeaders } = require('./api-auth');
+const presenceBoard = require('./resources/presence-board');
+const pkg = require('./package.json');
+
+// ─── MCP protocol identity (spec 2026-07-28, dual-era) ──────────────────
+// Modern clients (2026-07-28+) declare io.modelcontextprotocol/protocolVersion
+// in each request's _meta and get stateless semantics: server/discover,
+// resultType on results, serverInfo echoed in result _meta. Legacy clients
+// (2025-11-25 and earlier) still open with `initialize`; both eras are served
+// from this one process. Known gap: list_changed notifications are pushed
+// unsolicited (legacy style) — modern subscriptions/listen is not implemented.
+const MODERN_PROTOCOL_VERSION = '2026-07-28';
+const LEGACY_PROTOCOL_VERSIONS = ['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05'];
+const META_PROTOCOL_VERSION = 'io.modelcontextprotocol/protocolVersion';
+const META_SERVER_INFO = 'io.modelcontextprotocol/serverInfo';
+const SERVER_INFO = {
+  name: 'vibe',
+  version: pkg.version,
+  description: 'Presence + messaging for terminal coding agents'
+};
+const SERVER_CAPABILITIES = {
+  tools: { listChanged: true },
+  resources: {},
+  // MCP Apps: ui:// resources the host renders in-conversation.
+  // See resources/presence-board.js (declared on vibe_who).
+  extensions: { 'io.modelcontextprotocol/ui': { mimeTypes: ['text/html;profile=mcp-app'] } }
+};
 
 // Tools that shouldn't show presence footer (would be redundant/noisy)
-const SKIP_FOOTER_TOOLS = ['vibe_init', 'vibe_doctor', 'vibe_test', 'vibe_update', 'vibe_settings', 'vibe_notifications'];
+const SKIP_FOOTER_TOOLS = ['vibe_init', 'vibe_doctor', 'vibe_test', 'vibe_update'];
 
 // Progressive disclosure: only these tools are visible before authentication
 // After auth, the full toolset is revealed via tools/list_changed notification
@@ -39,52 +65,25 @@ const NO_AUTH_REQUIRED = new Set([
   'vibe_start', 'vibe_init', 'vibe_token', 'vibe_who', 'vibe_help'
 ]);
 
-// Infer user prompt from tool arguments (for pattern logging)
+// Single source of truth for "is this session signed in" — token or OAuth.
+const isAuthed = () => authStore.isAuthenticated() || config.hasOAuth();
+
+// Infer user prompt from tool arguments (for pattern logging).
+// Cases exist only for registered tools whose args improve on the default.
 function inferPromptFromArgs(toolName, args) {
   const action = toolName.replace('vibe_', '');
   const handle = args.handle ? `@${args.handle.replace('@', '')}` : '';
   const message = args.message ? `"${args.message.slice(0, 50)}..."` : '';
-  const note = args.note || '';
-  const mood = args.mood || '';
-  const reaction = args.reaction || '';
 
   switch (action) {
     case 'start': return 'start vibing';
     case 'who': return 'who is online';
-    case 'ping': return `ping ${handle} ${note}`.trim();
-    case 'react': return `react ${reaction} to ${handle}`.trim();
     case 'dm': return `message ${handle} ${message}`.trim();
     case 'inbox': return 'check inbox';
-    case 'open': return `open thread with ${handle}`;
-    case 'status': return `set status to ${mood}`;
-    case 'context': return 'share context';
-    case 'summarize': return 'summarize session';
-    case 'bye': return 'end session';
-    case 'board': return args.content ? 'post to board' : 'view board';
-    case 'observe': return args.content ? 'record observation' : 'view observations';
-    case 'invite': return 'generate invite';
-    case 'echo': return 'send feedback';
-    case 'x_mentions': return 'check x mentions';
-    case 'x_reply': return 'reply on x';
-    case 'handoff': return `handoff task to ${handle}`;
-    case 'reserve': return args.paths ? `reserve ${args.paths.join(', ')}` : 'reserve files';
-    case 'release': return `release ${args.reservation_id || 'reservation'}`;
-    case 'reservations': return 'list reservations';
-    case 'solo_game': return `play ${args.game || 'game'}`;
-    case 'game': return `play ${args.game || 'game'} with ${handle}`;
+    case 'status': return `set status to ${args.mood || ''}`.trim();
+    case 'game': return `play ${args.game || 'game'} with ${handle}`.trim();
     case 'poem': return args.line ? `add a line to poem with ${handle}` : `emoji poem with ${handle}`;
-    case 'multiplayer_game': return `multiplayer ${args.game || 'game'}`;
-    case 'drawing': return args.action ? `drawing ${args.action}` : 'collaborative drawing';
-    case 'crossword': return `crossword ${args.action || 'daily'}`;
-    case 'discover': return `discover ${args.command || 'suggest'}`;
-    case 'suggest_tags': return `suggest tags ${args.command || 'suggest'}`;
-    case 'settings': return args.mute ? `mute for ${args.mute}` : 'view settings';
-    case 'create_artifact': return `create ${args.template || 'artifact'}: ${args.title || 'untitled'}`;
-    case 'view_artifact': return args.slug ? `view artifact ${args.slug}` : `list ${args.list || 'artifacts'}`;
-    case 'broadcast': return args.action ? `broadcast ${args.action}` : 'broadcast status';
-    case 'watch': return args.target ? `watch ${args.target}` : 'list live broadcasts';
-    case 'session': return args.action ? `session ${args.action}` : 'list sessions';
-    case 'chat': return args.message ? `chat "${args.message.slice(0, 30)}..."` : 'view chat';
+    case 'bye': return 'end session';
     default: return `${action} ${handle}`.trim() || null;
   }
 }
@@ -165,17 +164,49 @@ async function fetchNewUnreadDms(handle) {
   }
 }
 
+// Ambient presence data cache. getPresenceFooter runs after EVERY tool call,
+// and presence/unread/live counts don't change sub-10s — so three of its five
+// network calls can ride a short TTL. The guest-message and DM injection
+// fetches are deliberately NOT cached: each delivers content at most once
+// (ack=true / injectedDmIds), so caching would replay or delay injections.
+const AMBIENT_CACHE_TTL_MS = 10000;
+let ambientCache = { at: 0, handle: null, data: null };
+const bustAmbientCache = () => { ambientCache = { at: 0, handle: null, data: null }; };
+
+// Tools whose effects change what the ambient footer shows (unread counts,
+// presence, own status, session identity) — they get a fresh fetch instead of
+// the cache. vibe_token is here because it can swap the signed-in account.
+const AMBIENT_CACHE_BUSTERS = new Set([
+  'vibe_start', 'vibe_init', 'vibe_token', 'vibe_dm', 'vibe_reply', 'vibe_inbox',
+  'vibe_status', 'vibe_ship', 'vibe_play', 'vibe_game', 'vibe_bye'
+]);
+
+async function getAmbientPresence(handle) {
+  const now = Date.now();
+  // Keyed by handle: an in-process identity switch must never serve the
+  // previous account's counts, even if the buster list misses a path.
+  if (ambientCache.data && ambientCache.handle === handle &&
+      now - ambientCache.at < AMBIENT_CACHE_TTL_MS) {
+    return ambientCache.data;
+  }
+  const [users, unreadCount, liveCount] = await Promise.all([
+    store.getActiveUsers().catch(() => []),
+    store.getUnreadCount(handle).catch(() => 0),
+    store.getLiveBroadcastCount().catch(() => 0)
+  ]);
+  ambientCache = { at: now, handle, data: { users, unreadCount, liveCount } };
+  return ambientCache.data;
+}
+
 // Generate ambient presence footer - the room leaks into every response
 async function getPresenceFooter() {
   try {
     const handle = config.getHandle();
     if (!handle) return '';
 
-    // Fetch presence, unread, live broadcasts, guest messages, and new DMs in parallel
-    const [users, unreadCount, liveCount, guestMessages, newDms] = await Promise.all([
-      store.getActiveUsers().catch(() => []),
-      store.getUnreadCount(handle).catch(() => 0),
-      store.getLiveBroadcastCount().catch(() => 0),
+    // Ambient data (cached) + injection channels (always fresh) in parallel
+    const [{ users, unreadCount, liveCount }, guestMessages, newDms] = await Promise.all([
+      getAmbientPresence(handle),
       fetchGuestMessages(handle).catch(() => []),
       fetchNewUnreadDms(handle).catch(() => [])
     ]);
@@ -307,7 +338,11 @@ async function getPresenceFooter() {
 // Minimal set: auth + presence + messaging + status + ship.
 // Less is more. 95 tools → 15. Claude gets confused with too many options.
 // Removed tools still exist in ./tools/ and can be re-added if needed.
-const coreTools = {
+// ─── Kernel ──────────────────────────────────────────────────────────────
+// The minimum viable social surface (0.8 "core mode"): identity + presence +
+// messaging, plus auth plumbing, help, and the sign-off. An agent that sees a
+// handful of tools uses them correctly; one that sees twenty wanders.
+const kernelTools = {
   // Auth & onboarding
   vibe_start: require('./tools/start'),
   vibe_init: require('./tools/init'),
@@ -322,6 +357,17 @@ const coreTools = {
   vibe_inbox: require('./tools/inbox'),
   vibe_reply: require('./tools/reply'),
 
+  // Utility
+  vibe_help: require('./tools/help'),
+  vibe_bye: require('./tools/bye'),
+};
+
+// ─── Extras ──────────────────────────────────────────────────────────────
+// The culture layer. Real /vibe, but not kernel — opt in with VIBE_EXTRAS=1
+// in the MCP server env. Handlers (and their files) ship regardless; only the
+// default registration shrinks.
+const EXTRAS_ENABLED = ['1', 'true'].includes(String(process.env.VIBE_EXTRAS || '').toLowerCase());
+const extraTools = {
   // Received collaboration — land the newcomer mid-conversation with a topical match
   vibe_intro: require('./tools/intro'),
 
@@ -350,10 +396,6 @@ const coreTools = {
   vibe_game: require('./tools/game'),
   vibe_poem: require('./tools/poem'),
   vibe_corpse: require('./tools/corpse'),
-
-  // Utility
-  vibe_help: require('./tools/help'),
-  vibe_bye: require('./tools/bye'),
 };
 
 // Admin tools (only loaded when VIBE_ADMIN=true)
@@ -365,8 +407,8 @@ const adminTools = process.env.VIBE_ADMIN === 'true' ? {
   vibe_patterns: require('./tools/patterns'),
 } : {};
 
-// Combine tools
-const tools = { ...coreTools, ...adminTools };
+// Combine tools — kernel always; extras only when opted in
+const tools = { ...kernelTools, ...(EXTRAS_ENABLED ? extraTools : {}), ...adminTools };
 
 /**
  * MCP Protocol Handler
@@ -403,35 +445,132 @@ class VibeMCPServer {
   async handleRequest(request) {
     const { method, params, id } = request;
 
+    // Modern era: any request carrying a _meta protocol version is served
+    // statelessly. The gate applies to server/discover too — an unsupported
+    // version gets -32022 whose `supported` list drives the retry; answering
+    // with a success the client didn't ask for breaks future negotiation.
+    // (Probes WITHOUT _meta still get a DiscoverResult, so the legacy-era
+    // backward-compat probe keeps working.)
+    const requestedVersion = params?._meta?.[META_PROTOCOL_VERSION];
+    const isModern = requestedVersion !== undefined;
+    if (isModern && requestedVersion !== MODERN_PROTOCOL_VERSION) {
+      return {
+        jsonrpc: '2.0',
+        id,
+        error: {
+          code: -32022,
+          message: 'Unsupported protocol version',
+          data: { supported: [MODERN_PROTOCOL_VERSION], requested: requestedVersion }
+        }
+      };
+    }
+
+    const response = await this.dispatch(request);
+    if (isModern && response?.result) {
+      response.result.resultType = response.result.resultType || 'complete';
+      response.result._meta = { [META_SERVER_INFO]: SERVER_INFO, ...(response.result._meta || {}) };
+    }
+    return response;
+  }
+
+  async dispatch(request) {
+    const { method, params, id } = request;
+
     switch (method) {
-      case 'initialize':
+      case 'server/discover':
+        // MUST-implement under 2026-07-28; also answers _meta-less probes
+        // (the version gate in handleRequest rejects unsupported versions
+        // before dispatch reaches here). Modern clients may name themselves
+        // here; env fingerprints (host.js) cover the ones that don't.
+        require('./host').setClientInfo(params?.clientInfo);
         return {
           jsonrpc: '2.0',
           id,
           result: {
-            protocolVersion: '2024-11-05',
-            capabilities: { tools: {} },
-            serverInfo: {
-              name: 'vibe',
-              version: '1.0.0',
-              description: 'Communication layer for Claude Code'
-            }
+            resultType: 'complete',
+            supportedVersions: [MODERN_PROTOCOL_VERSION, ...LEGACY_PROTOCOL_VERSIONS],
+            capabilities: SERVER_CAPABILITIES,
+            instructions: 'Social layer for terminal coding agents — identity, presence, and DMs between builders, from Claude Code, Codex, or Cursor. Start with vibe_start (sign in) or vibe_who (see who is online).',
+            ttlMs: 3600000,
+            cacheScope: 'public',
+            _meta: { [META_SERVER_INFO]: SERVER_INFO }
           }
         };
 
+      case 'initialize': {
+        // Legacy handshake (2025-11-25 and earlier). Echo the client's version
+        // when we know it — the previous hardcoded 2024-11-05 forced every
+        // client down to the oldest revision; unknown versions get our latest
+        // legacy revision per the legacy negotiation rule.
+        // The host names itself here (claude-code, codex, cursor, …) —
+        // captured so the presence heartbeat can say WHICH agent this
+        // session lives in. See host.js.
+        require('./host').setClientInfo(params?.clientInfo);
+        const requested = params?.protocolVersion;
+        return {
+          jsonrpc: '2.0',
+          id,
+          result: {
+            protocolVersion: LEGACY_PROTOCOL_VERSIONS.includes(requested)
+              ? requested
+              : LEGACY_PROTOCOL_VERSIONS[0],
+            capabilities: SERVER_CAPABILITIES,
+            serverInfo: SERVER_INFO
+          }
+        };
+      }
+
       case 'tools/list':
-        // Progressive disclosure: show only core tools until authenticated
+        // Progressive disclosure: show only core tools until authenticated.
+        // Registration-object order is stable across calls and processes, so
+        // the deterministic-order SHOULD (2026-07-28) is met without sorting.
         const allToolDefs = Object.values(tools).map(t => t.definition);
-        const isListAuthed = authStore.isAuthenticated() || config.hasOAuth();
         return {
           jsonrpc: '2.0',
           id,
           result: {
-            tools: isListAuthed
+            tools: isAuthed()
               ? allToolDefs
-              : allToolDefs.filter(t => PRE_AUTH_TOOLS.has(t.name))
+              : allToolDefs.filter(t => PRE_AUTH_TOOLS.has(t.name)),
+            // CacheableResult: private (varies with auth state). Pre-auth gets
+            // ZERO ttl — sign-in swaps the toolset and modern clients have no
+            // subscriptions/listen stream to invalidate through; only the
+            // legacy unsolicited list_changed exists. Post-auth may cache.
+            ttlMs: isAuthed() ? 60000 : 0,
+            cacheScope: 'private'
+          }
+        };
+
+      case 'resources/list':
+        return {
+          jsonrpc: '2.0',
+          id,
+          result: {
+            resources: [presenceBoard.definition],
+            ttlMs: 3600000,
+            cacheScope: 'public'
+          }
+        };
+
+      case 'resources/read': {
+        if (params?.uri !== presenceBoard.RESOURCE_URI) {
+          // -32602 per 2026-07-28 (was -32002; realigned with JSON-RPC).
+          return {
+            jsonrpc: '2.0',
+            id,
+            error: { code: -32602, message: `Resource not found: ${params?.uri}` }
+          };
+        }
+        return {
+          jsonrpc: '2.0',
+          id,
+          result: {
+            contents: [presenceBoard.content],
+            ttlMs: 3600000,
+            cacheScope: 'public'
           }
         };
+      }
 
       case 'tools/call':
         const tool = tools[params.name];
@@ -444,8 +583,7 @@ class VibeMCPServer {
         }
 
         // Auth gate: auto-detect unauthenticated state and trigger auth flow
-        const isCallAuthed = authStore.isAuthenticated() || config.hasOAuth();
-        if (!isCallAuthed && !NO_AUTH_REQUIRED.has(params.name)) {
+        if (!isAuthed() && !NO_AUTH_REQUIRED.has(params.name)) {
           // Auto-trigger init flow — user never needs to know about "vibe init"
           const actionName = params.name.replace('vibe_', '');
           const initTool = tools['vibe_init'];
@@ -458,7 +596,7 @@ class VibeMCPServer {
             const initDisplay = initResult.display || JSON.stringify(initResult, null, 2);
 
             // After auth, emit tools/list_changed so Claude sees full toolset
-            if (authStore.isAuthenticated() || config.hasOAuth()) {
+            if (isAuthed()) {
               global.vibeNotifier?.emitImmediate();
             }
 
@@ -514,27 +652,31 @@ class VibeMCPServer {
 
           // After init/start completes auth, emit tools/list_changed
           // so Claude sees the full toolset (progressive disclosure unlock)
-          if ((params.name === 'vibe_init' || params.name === 'vibe_start') &&
-              (authStore.isAuthenticated() || config.hasOAuth())) {
+          if ((params.name === 'vibe_init' || params.name === 'vibe_start') && isAuthed()) {
             global.vibeNotifier?.emitImmediate();
           }
 
-          // Add ambient presence footer (unless tool is in skip list)
+          // Add ambient presence footer (unless tool is in skip list).
+          // State-changing tools bust the cache first so the footer reflects
+          // what they just did (e.g. inbox read clears the unread badge).
           let footer = '';
           if (!SKIP_FOOTER_TOOLS.includes(params.name)) {
+            if (AMBIENT_CACHE_BUSTERS.has(params.name)) bustAmbientCache();
             footer = await getPresenceFooter();
           }
 
-          return {
-            jsonrpc: '2.0',
-            id,
-            result: {
-              content: [{
-                type: 'text',
-                text: (result.display || JSON.stringify(result, null, 2)) + footer
-              }]
-            }
+          const callResult = {
+            content: [{
+              type: 'text',
+              text: (result.display || JSON.stringify(result, null, 2)) + footer
+            }]
           };
+          // Structured mirror for MCP Apps (the presence board reads this) and
+          // modern clients; text-only hosts ignore it.
+          if (result.structured) {
+            callResult.structuredContent = result.structured;
+          }
+          return { jsonrpc: '2.0', id, result: callResult };
         } catch (e) {
           return {
             jsonrpc: '2.0',

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "mcpName": "io.github.vibecodinginc/vibe",
-  "description": "Social layer for Claude Code - identity, presence, messaging, and consented live collaboration",
+  "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) — the /vibe kernel",
   "main": "index.js",
   "bin": {
     "slashvibe-mcp": "./cli.js",
@@ -13,7 +13,8 @@
     "test": "node --test tools/*.test.js",
     "test:context": "node --test tools/_work-context.test.js",
     "pack:check": "node scripts/check-pack-closure.js",
-    "prepack": "node scripts/check-pack-closure.js",
+    "prepack": "node scripts/sync-versions.js && node scripts/check-pack-closure.js",
+    "version": "node scripts/sync-versions.js && git add server.json",
     "lint": "eslint . --ext .js",
     "lint:fix": "eslint . --ext .js --fix",
     "test:pack": "node --test test/pack-artifact.test.mjs"
@@ -53,6 +54,7 @@
     "crypto.js",
     "discord.js",
     "games/chess.js",
+    "host.js",
     "index.js",
     "intelligence/infer.js",
     "intelligence/patterns.js",
@@ -64,6 +66,7 @@
     "presence.js",
     "prompts.js",
     "protocol/index.js",
+    "resources/presence-board.js",
     "setup.js",
     "store/api.js",
     "store/index.js",
@@ -103,8 +106,5 @@
     "tools/who.js",
     "version.json"
   ],
-  "dependencies": {
-    "crossword-layout-generator": "^0.1.1",
-    "node-fetch": "^2.7.0"
-  }
+  "dependencies": {}
 }