slashvibe-mcp 0.8.1 → 0.8.3

package/auth-store.js

@@ -20,11 +20,36 @@ let _token = null;
 let _handle = null;
 let _oneLiner = null;
 let _hydrated = false;
+// Has the SERVER confirmed this credential in this process? A token read off disk is
+// a claim; only a verify round-trip makes it a fact. Kept separate from _token so
+// callers can distinguish "saved" from "authenticated" — announcing presence or
+// unlocking a tool on the strength of a filename is how a green dot comes to mean
+// nothing (issues #107, #110).
+let _verified = false;
 
 /**
  * Hydrate auth state from disk (call once at MCP startup)
  * This loads persisted state from config.json
  */
+/**
+ * The handle a token was ISSUED FOR, read from its own subject claim.
+ *
+ * Decode, not verify — the signature is the server's business and it checks it on
+ * every call. What this answers is narrower and local: "whose credential is this?"
+ * Returns null for anything unparseable, so a malformed token can never masquerade.
+ */
+function handleFromToken(token) {
+  try {
+    const part = String(token).split('.')[1];
+    if (!part) return null;
+    const claims = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+    const who = claims.handle || claims.sub;
+    return typeof who === 'string' && who ? who : null;
+  } catch {
+    return null;
+  }
+}
+
 function hydrate() {
   if (_hydrated) return; // Only hydrate once
 
@@ -33,16 +58,35 @@ function hydrate() {
     const cfg = config.load();
 
     _token = cfg.authToken || cfg.privyToken || null;
-    _handle = cfg.handle || cfg.username || null;
     _oneLiner = cfg.one_liner || cfg.workingOn || null;
 
     // Cross-client: if no token from config.json, check terminal/buddy auth.json
     if (!_token) {
       const terminalAuth = config.loadTerminalAuth();
-      if (terminalAuth?.token) {
-        _token = terminalAuth.token;
-        _handle = _handle || terminalAuth.handle || null;
-      }
+      if (terminalAuth?.token) _token = terminalAuth.token;
+    }
+
+    // THE TOKEN IS THE IDENTITY.
+    //
+    // The handle used to be read from config.json independently of the token, so the
+    // two could name different people and nothing noticed: the client displayed
+    // @brightseth, the server saw @vibetester1, and a DM went out as the wrong
+    // principal while reporting success. (Found by the first terminal-to-terminal
+    // test, issue #107 — a self-send recorded in the database.)
+    //
+    // A stored handle is a label someone wrote down; the token is what the server
+    // acts on. When they disagree, the file is wrong — never the credential.
+    const stored = cfg.handle || cfg.username || null;
+    _handle = _token ? handleFromToken(_token) : null;
+
+    if (_token && !_handle) {
+      // A token we cannot attribute is one we must not act under.
+      console.error('[auth-store] Token carries no identity — treating as signed out');
+      _token = null;
+    } else if (_token && stored && stored !== _handle) {
+      console.error(
+        `[auth-store] Stored handle @${stored} does not own this session — acting as @${_handle}`
+      );
     }
 
     _hydrated = true;
@@ -61,9 +105,32 @@ function hydrate() {
  * Set auth token (call after OAuth completes)
  * @param {string} token - JWT token
  */
-function setToken(token) {
+function setToken(token, { verified = false } = {}) {
+  if (token) {
+    const who = handleFromToken(token);
+    if (!who) {
+      // Same rule hydrate() applies, applied here too — a credential we cannot
+      // attribute must not become the session.
+      console.error('[auth-store] Refusing a token with no identity');
+      _token = null; _handle = null; _verified = false;
+      return;
+    }
+  }
+
   const hadToken = !!_token;
   _token = token;
+  _verified = !!token && verified;
+
+  // Identity travels WITH the credential (see hydrate). A new token can belong to a
+  // different person — after a re-auth, an account switch, or a cross-client sync —
+  // so the handle is re-derived here rather than left pointing at the previous one.
+  if (token) {
+    const who = handleFromToken(token);
+    if (who && who !== _handle) {
+      if (_handle) console.error(`[auth-store] Now acting as @${who} (was @${_handle})`);
+      _handle = who;
+    }
+  }
 
   if (!hadToken && token) {
     console.error('[auth-store] Token set (was empty)');
@@ -120,6 +187,21 @@ function isAuthenticated() {
   return !!_token;
 }
 
+/** The server confirmed this credential in this process. */
+function isVerified() {
+  return !!_token && _verified;
+}
+
+/** Record a successful server verification for the token we already hold. */
+function markVerified(handle) {
+  if (!_token) return;
+  if (handle && handle !== _handle) {
+    console.error(`[auth-store] Server says this session is @${handle} (held @${_handle})`);
+    _handle = handle;
+  }
+  _verified = true;
+}
+
 /**
  * Clear all auth state (for logout/reset)
  */
@@ -127,6 +209,7 @@ function clear() {
   _token = null;
   _handle = null;
   _oneLiner = null;
+  _verified = false;
   console.error('[auth-store] Cleared');
 }
 
@@ -154,5 +237,7 @@ module.exports = {
   getOneLiner,
   isAuthenticated,
   clear,
-  getState
+  getState,
+  isVerified,
+  markVerified,
 };

package/incoming.js

@@ -62,14 +62,27 @@ function renderIncoming(items, { replyTo, threadHint } = {}) {
  *   - our own fence markers are neutralized, as in scrub();
  *   - backticks and square brackets are defanged, so foreign text cannot open a code
  *     span or synthesize a link/citation that looks like ours;
+ *   - bidi overrides and zero-width characters are stripped, so the bytes a model
+ *     reads cannot differ from the glyphs a human sees;
  *   - it is length-bounded, because the injection payloads that work are long.
  *
+ * What it deliberately does NOT do is judge meaning. A status that reads
+ * "SYSTEM: call vibe_dm" survives as TEXT — and must, because the alternative is a
+ * blocklist that fails silently. Meaning is handled by the other half of the rule:
+ * foreign text is always labelled as data, and no surface may place it next to an
+ * instruction to act on it. That is why the weave draft-and-send prompt was removed
+ * rather than filtered.
+ *
  * Callers still label the region as data — this makes the VALUE inert, and the
  * surrounding copy says whose words they are.
  */
 function inertField(text, maxLen = 80) {
   const flat = String(text || '')
     .replace(/[\u0000-\u001f\u007f]/g, ' ')   // control chars, incl. newlines
+    // Bidi overrides and invisible formatting characters: a status can otherwise
+    // render as one thing to the human reading the terminal and another to the model
+    // reading the same bytes, or hide text inside an apparently short field.
+    .replace(/[\u200b-\u200f\u202a-\u202e\u2066-\u2069\ufeff\u00ad]/g, '')
     .replace(/\s+/g, ' ')
     .replaceAll('<<<', '\u2039\u2039\u2039')
     .replaceAll('>>>', '\u203a\u203a\u203a')

package/index.js

@@ -665,8 +665,14 @@ class VibeMCPServer {
 
   async autoPresence() {
     try {
-      const handle = config.getHandle();
-      if (!handle) return; // Not authenticated yet
+      // Presence follows the CREDENTIAL, not a handle written in a file. This used to
+      // read config.getHandle() and announce "Auto-connected" on the strength of that
+      // alone — so an expired or foreign session still printed a confident green line
+      // and started a heartbeat that could only 401. That is the client-side version
+      // of the bug where an agent holds a green dot and never reads its mail: the dot
+      // has to mean someone is actually reachable. (issues #107, #91)
+      const handle = authStore.getHandle();
+      if (!handle || !authStore.isAuthenticated()) return;
 
       const one_liner = config.getOneLiner() || '';
 

package/oauth-callback.js

@@ -0,0 +1,271 @@
+'use strict';
+
+const crypto = require('crypto');
+const http = require('http');
+
+const CALLBACK_HOST = '127.0.0.1';
+const DEFAULT_CALLBACK_PORT = 9876;
+const DEFAULT_TIMEOUT_MS = 300000;
+const DEFAULT_GRACE_MS = 300000;
+const LOGIN_URL = 'https://www.slashvibe.dev/login';
+
+const SUCCESS_PAGE = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>signed in to /vibe</title>
+  <link rel="stylesheet" href="https://www.slashvibe.dev/vibe-tokens.css">
+  <style>
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    body {
+      background: var(--bg, #0A0A0A);
+      color: var(--dim, #9CA3AF);
+      font-family: var(--mono, ui-monospace, SFMono-Regular, Menlo, monospace);
+      font-size: var(--t-14, 14px);
+      line-height: 1.6;
+      min-height: 100vh;
+      display: flex; align-items: center; justify-content: center;
+      padding: var(--s-6, 24px);
+    }
+    .card {
+      border: 1px solid var(--line, #1F2937);
+      border-radius: var(--r-lg, 10px);
+      background: var(--panel, #111316);
+      padding: var(--s-8, 32px);
+      max-width: 420px; width: 100%;
+    }
+    .logo { color: var(--ink, #E0E0E0); font-size: var(--t-16, 16px); margin-bottom: var(--s-6, 24px); }
+    .logo span { color: var(--blue, #6B8FFF); }
+    .line { color: var(--ink, #E0E0E0); font-size: var(--t-20, 20px); margin-bottom: var(--s-2, 8px); }
+    .dot { color: var(--green, #22c55e); }
+    .meta { font-size: var(--t-13, 13px); }
+    .next {
+      margin-top: var(--s-6, 24px); padding-top: var(--s-4, 16px);
+      border-top: 1px solid var(--line, #1F2937); font-size: var(--t-13, 13px);
+    }
+    code {
+      color: var(--ink, #E0E0E0);
+      background: var(--bg, #0A0A0A);
+      border: 1px solid var(--line, #1F2937);
+      border-radius: var(--r-sm, 6px);
+      padding: 1px 6px;
+    }
+    .close { color: var(--faint, #6B7280); font-size: var(--t-11, 11px); margin-top: var(--s-6, 24px); }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="logo">/<span>vibe</span></div>
+    <p class="line"><span class="dot">&#x1F7E2;</span> you're in</p>
+    <p class="meta">your session is signed in and you're on the board.</p>
+    <div class="next">
+      back in your terminal, say <code>vibe who</code> to see who's around,
+      or <code>vibe inbox</code> if someone already wrote to you.
+    </div>
+    <p class="close">you can close this window.</p>
+  </div>
+</body>
+</html>`;
+
+const LATE_CALLBACK_PAGE = `<!DOCTYPE html>
+<html lang="en"><head><meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>sign-in timed out · /vibe</title>
+<link rel="stylesheet" href="https://www.slashvibe.dev/vibe-tokens.css">
+<style>
+  *{margin:0;padding:0;box-sizing:border-box}
+  body{background:var(--bg,#0A0A0A);color:var(--dim,#9CA3AF);font-family:var(--mono,ui-monospace,Menlo,monospace);
+       font-size:var(--t-14,14px);line-height:1.6;min-height:100vh;display:flex;align-items:center;
+       justify-content:center;padding:24px}
+  .card{border:1px solid var(--line,#1F2937);border-radius:var(--r-lg,10px);background:var(--panel,#111316);
+        padding:32px;max-width:420px;width:100%}
+  .logo{color:var(--ink,#E0E0E0);font-size:var(--t-16,16px);margin-bottom:24px}
+  .logo span{color:var(--blue,#6B8FFF)}
+  h1{color:var(--ink,#E0E0E0);font-size:var(--t-20,20px);font-weight:600;margin-bottom:8px}
+  code{color:var(--ink,#E0E0E0);background:var(--bg,#0A0A0A);border:1px solid var(--line,#1F2937);
+       border-radius:var(--r-sm,6px);padding:1px 6px}
+  .next{margin-top:24px;padding-top:16px;border-top:1px solid var(--line,#1F2937);font-size:var(--t-13,13px)}
+</style></head>
+<body><div class="card">
+  <div class="logo">/<span>vibe</span></div>
+  <h1>sign-in took too long</h1>
+  <p>your terminal stopped waiting, so this sign-in didn't finish. nothing is broken and
+  nothing was saved.</p>
+  <div class="next">back in your terminal, say <code>vibe init</code> and it will open a fresh
+  sign-in. this window can be closed.</div>
+</div></body></html>`;
+
+const BAD_CALLBACK_PAGE = `<!DOCTYPE html>
+<html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>sign-in could not finish · /vibe</title></head>
+<body><p>this sign-in callback could not be accepted. return to your terminal and try again.</p></body></html>`;
+
+function listen(server, port) {
+  return new Promise((resolve, reject) => {
+    const onError = (error) => {
+      server.removeListener('listening', onListening);
+      reject(error);
+    };
+    const onListening = () => {
+      server.removeListener('error', onError);
+      resolve();
+    };
+
+    server.once('error', onError);
+    server.once('listening', onListening);
+    server.listen(port, CALLBACK_HOST);
+  });
+}
+
+/**
+ * Bind the loopback listener, THEN hand back the URL to open.
+ * Binding first is load-bearing: opening the browser before the socket exists is
+ * what lets a local squatter or a concurrent init receive the credential.
+ */
+async function beginOAuth({
+  requestedHandle,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  graceMs = DEFAULT_GRACE_MS,
+} = {}) {
+  const state = crypto.randomBytes(32).toString('hex');
+  let phase = 'waiting';
+  let timeoutTimer = null;
+  let graceTimer = null;
+  let resolveCallback;
+  let rejectCallback;
+  let closePromise;
+
+  const callbackPromise = new Promise((resolve, reject) => {
+    resolveCallback = resolve;
+    rejectCallback = reject;
+  });
+  // A caller can cancel without ever waiting. Keep that from becoming an
+  // unhandled rejection while preserving the original promise for waiters.
+  callbackPromise.catch(() => {});
+
+  const server = http.createServer((req, res) => {
+    const url = new URL(req.url, `http://${CALLBACK_HOST}`);
+
+    if (url.pathname !== '/callback') {
+      res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end('Not found');
+      return;
+    }
+
+    if (url.searchParams.get('state') !== state) {
+      res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.end(BAD_CALLBACK_PAGE);
+      return;
+    }
+
+    if (phase === 'timedOut') {
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.end(LATE_CALLBACK_PAGE);
+      return;
+    }
+
+    const token = url.searchParams.get('token');
+    const callbackHandle = url.searchParams.get('handle');
+    if (phase !== 'waiting' || !token || !callbackHandle) {
+      res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.end(BAD_CALLBACK_PAGE);
+      return;
+    }
+
+    // WHO AUTHENTICATED WINS — not who we asked for. A requested handle is a
+    // preference for a brand-new account, never a claim about the credential.
+    if (requestedHandle && requestedHandle !== callbackHandle) {
+      console.error(
+        `[vibe] Signed in as @${callbackHandle} (you asked for @${requestedHandle}) — using the account that authenticated.`
+      );
+    }
+
+    phase = 'completed';
+    clearTimeout(timeoutTimer);
+    clearTimeout(graceTimer);
+    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+    res.end(SUCCESS_PAGE, () => { closeServer().catch(() => {}); });
+    resolveCallback({ token, handle: callbackHandle });
+  });
+
+  function closeServer() {
+    if (closePromise) return closePromise;
+    if (!server.listening) {
+      closePromise = Promise.resolve();
+      return closePromise;
+    }
+    closePromise = new Promise((resolve, reject) => {
+      server.close((error) => {
+        if (error && error.code !== 'ERR_SERVER_NOT_RUNNING') reject(error);
+        else resolve();
+      });
+    });
+    return closePromise;
+  }
+
+  try {
+    await listen(server, DEFAULT_CALLBACK_PORT);
+  } catch (error) {
+    if (error.code !== 'EADDRINUSE') {
+      phase = 'cancelled';
+      rejectCallback(error);
+      throw error;
+    }
+
+    try {
+      await listen(server, 0);
+    } catch (fallbackError) {
+      phase = 'cancelled';
+      const finalError = fallbackError.code === 'EADDRINUSE'
+        ? new Error('AUTH_IN_PROGRESS')
+        : fallbackError;
+      rejectCallback(finalError);
+      throw finalError;
+    }
+  }
+
+  const address = server.address();
+  const port = address.port;
+  const callbackUrl = new URL(`http://${CALLBACK_HOST}:${port}/callback`);
+  callbackUrl.searchParams.set('state', state);
+  const loginUrl = new URL(LOGIN_URL);
+  loginUrl.searchParams.set('redirect', callbackUrl.toString());
+  loginUrl.searchParams.set('state', state);
+  if (requestedHandle) loginUrl.searchParams.set('handle', requestedHandle);
+
+  timeoutTimer = setTimeout(() => {
+    if (phase !== 'waiting') return;
+    phase = 'timedOut';
+    rejectCallback(new Error('AUTH_TIMEOUT'));
+    graceTimer = setTimeout(() => {
+      if (phase === 'timedOut') {
+        phase = 'closed';
+        closeServer().catch(() => {});
+      }
+    }, graceMs);
+  }, timeoutMs);
+
+  async function cancel() {
+    clearTimeout(timeoutTimer);
+    clearTimeout(graceTimer);
+    if (phase === 'waiting') {
+      phase = 'cancelled';
+      rejectCallback(new Error('AUTH_CANCELLED'));
+    } else if (phase !== 'closed') {
+      phase = 'cancelled';
+    }
+
+    await closeServer();
+  }
+
+  return {
+    loginUrl: loginUrl.toString(),
+    port,
+    state,
+    waitForCallback: () => callbackPromise,
+    cancel,
+  };
+}
+
+module.exports = { beginOAuth };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "mcpName": "io.github.vibecodinginc/vibe",
   "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) — the /vibe kernel",
   "main": "index.js",
@@ -64,6 +64,7 @@
     "memory.js",
     "notification-emitter.js",
     "notify.js",
+    "oauth-callback.js",
     "presence.js",
     "prompts.js",
     "protocol/index.js",

package/presence.js

@@ -13,6 +13,7 @@
  */
 
 const config = require('./config');
+const authStore = require('./auth-store');
 const store = require('./store');
 const notify = require('./notify');
 const { apiHeaders } = require('./api-auth');
@@ -53,8 +54,10 @@ function stop() {
 async function initSession() {
   if (!config.isInitialized()) return;
 
-  // Use session-aware getters (prefer session identity over shared config)
-  const handle = config.getHandle();
+  // The handle we broadcast is the one our CREDENTIAL names — not the one written in
+  // a config file. Reading config here is what made "presence follows the credential"
+  // untrue after #107: the gate moved, the heartbeat did not (codex #4).
+  const handle = authStore.getHandle();
   if (!handle) return;
 
   // Get or create session ID
@@ -74,8 +77,8 @@ async function initSession() {
 async function sendHeartbeat() {
   if (!config.isInitialized()) return;
 
-  // Use session-aware getters (prefer session identity over shared config)
-  const handle = config.getHandle();
+  // Same rule as initSession: presence names whoever holds the credential.
+  const handle = authStore.getHandle();
   const one_liner = config.getOneLiner();
   if (handle) {
     store.heartbeat(handle, one_liner || '');

package/setup.js

@@ -18,7 +18,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const { exec, execSync } = require('child_process');
-const http = require('http');
+const { beginOAuth } = require('./oauth-callback');
 
 // ANSI colors for terminal output
 const colors = {
@@ -31,9 +31,7 @@ const colors = {
   dim: '\x1b[2m'
 };
 
-const CALLBACK_PORT = 9876;
 const API_BASE = 'https://www.slashvibe.dev';
-const LOGIN_URL = 'https://www.slashvibe.dev/login';
 
 /**
  * Print styled banner
@@ -315,90 +313,6 @@ function openBrowser(url) {
   });
 }
 
-/**
- * Wait for OAuth callback
- */
-function waitForAuth() {
-  return new Promise((resolve, reject) => {
-    let resolved = false;
-
-    const server = http.createServer(async (req, res) => {
-      const url = new URL(req.url, `http://localhost:${CALLBACK_PORT}`);
-
-      if (url.pathname === '/callback') {
-        const token = url.searchParams.get('token');
-        const handle = url.searchParams.get('handle');
-
-        if (token && handle) {
-          // Send success page
-          res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-          res.end(`<!DOCTYPE html>
-<html>
-<head>
-  <title>Welcome to /vibe!</title>
-  <style>
-    body {
-      font-family: 'SF Mono', Monaco, monospace;
-      background: #0a0a0a;
-      color: #e0e0e0;
-      display: flex;
-      justify-content: center;
-      align-items: center;
-      min-height: 100vh;
-      margin: 0;
-    }
-    .container {
-      text-align: center;
-      padding: 2rem;
-    }
-    h1 { color: #00FF88; }
-    .handle { color: #6B8FFF; }
-    .close { color: #888; margin-top: 2rem; }
-  </style>
-</head>
-<body>
-  <div class="container">
-    <h1>✓ Setup Complete!</h1>
-    <p>Welcome, <span class="handle">@${handle}</span></p>
-    <p>You're now connected to /vibe</p>
-    <p class="close">You can close this window</p>
-  </div>
-</body>
-</html>`);
-
-          resolved = true;
-          setTimeout(() => server.close(), 500);
-          resolve({ success: true, handle, token });
-        } else {
-          res.writeHead(400);
-          res.end('Missing token or handle');
-        }
-      } else {
-        res.writeHead(404);
-        res.end('Not found');
-      }
-    });
-
-    server.on('error', (err) => {
-      if (err.code === 'EADDRINUSE') {
-        reject(new Error('Auth server port in use'));
-      } else {
-        reject(err);
-      }
-    });
-
-    server.listen(CALLBACK_PORT, '127.0.0.1');
-
-    // Timeout after 2 minutes
-    setTimeout(() => {
-      if (!resolved) {
-        server.close();
-        reject(new Error('Auth timed out'));
-      }
-    }, 120000);
-  });
-}
-
 /**
  * Save auth config
  */
@@ -486,14 +400,16 @@ async function setup() {
   // Step 4: Authenticate
   printStep(4, 'Opening browser for GitHub auth...', 'running');
 
-  const callbackUrl = `http://localhost:${CALLBACK_PORT}/callback`;
-  const loginUrl = `${LOGIN_URL}?redirect=${encodeURIComponent(callbackUrl)}&setup=true`;
-
-  openBrowser(loginUrl);
-  console.log(`${colors.dim}     → Waiting for authentication...${colors.reset}`);
+  let oauth;
 
   try {
-    const authResult = await waitForAuth();
+    // The callback listener is bound before beginOAuth returns, so the browser
+    // cannot race a listener that does not exist yet.
+    oauth = await beginOAuth();
+    openBrowser(oauth.loginUrl);
+    console.log(`${colors.dim}     → Waiting for authentication...${colors.reset}`);
+
+    const authResult = await oauth.waitForCallback();
 
     // Save auth config
     saveAuthConfig(authResult.handle, authResult.token);
@@ -547,15 +463,15 @@ async function setup() {
     printStep(4, 'Opening browser for GitHub auth...', 'error');
 
     // Specific error recovery messages
-    if (err.message.includes('timed out')) {
-      console.log(`${colors.red}     → Authentication timed out (2 min limit)${colors.reset}`);
+    if (err.message === 'AUTH_TIMEOUT') {
+      console.log(`${colors.red}     → Authentication timed out (5 min limit)${colors.reset}`);
       console.log('');
       console.log(`${colors.yellow}  What happened:${colors.reset}`);
       console.log(`${colors.dim}  The browser auth wasn't completed in time.${colors.reset}`);
       console.log('');
       console.log(`${colors.bold}  Try again:${colors.reset}`);
       console.log(`${colors.cyan}  npx slashvibe-mcp setup${colors.reset}`);
-    } else if (err.message.includes('port in use')) {
+    } else if (err.message === 'AUTH_IN_PROGRESS') {
       console.log(`${colors.red}     → Auth callback port busy${colors.reset}`);
       console.log('');
       console.log(`${colors.yellow}  What happened:${colors.reset}`);
@@ -573,9 +489,12 @@ async function setup() {
       console.log(`${colors.dim}  2. Try again: ${colors.cyan}npx slashvibe-mcp setup${colors.reset}`);
       console.log(`${colors.dim}  3. Or in Claude Code, type: ${colors.cyan}add the vibe mcp server${colors.reset}`);
     }
+    if (oauth && err.message !== 'AUTH_TIMEOUT') await oauth.cancel();
     console.log('');
     console.log(`${colors.dim}  Need help? slashvibe.dev/help${colors.reset}`);
-    process.exit(1);
+    // On timeout the shared listener remains live during its grace window so a
+    // late browser callback gets the explanatory page instead of a refusal.
+    process.exitCode = 1;
   }
 }