slashvibe-mcp 0.8.19 → 0.8.20

package/index.js

@@ -586,16 +586,21 @@ class VibeMCPServer {
               global.vibeNotifier?.emitImmediate();
             }
 
-            return {
-              jsonrpc: '2.0',
-              id,
-              result: {
-                content: [{
-                  type: 'text',
-                  text: `> _You tried to **${actionName}** — signing you in first._\n\n${initDisplay}\n\n---\n💡 **You're in!** Try your \`${actionName}\` command again.`
-                }]
-              }
+            // Sign-in is non-blocking now: init returns auth_required and the
+            // person finishes in a browser. Only claim "You're in!" when the
+            // credential actually exists (review P1) — otherwise relay init's
+            // honest state and its structured mirror.
+            const signedIn = isAuthed();
+            const gateResult = {
+              content: [{
+                type: 'text',
+                text: signedIn
+                  ? `> _You tried to **${actionName}** — signing you in first._\n\n${initDisplay}\n\n---\n💡 **You're in!** Try your \`${actionName}\` command again.`
+                  : `> _You tried to **${actionName}** — sign in first._\n\n${initDisplay}\n\n---\n_Then say \`${actionName}\` again._`
+              }]
             };
+            if (initResult.structured) gateResult.structuredContent = initResult.structured;
+            return { jsonrpc: '2.0', id, result: gateResult };
           } catch (e) {
             return {
               jsonrpc: '2.0',

package/notification-emitter.js

@@ -30,7 +30,7 @@ class NotificationEmitter {
     this.debounceTimers[reason] = setTimeout(() => {
       try {
         this.server.notification({
-          method: "notifications/list_changed"
+          method: "notifications/tools/list_changed"
         });
         delete this.debounceTimers[reason];
       } catch (e) {
@@ -47,7 +47,7 @@ class NotificationEmitter {
   emitImmediate() {
     try {
       this.server.notification({
-        method: "notifications/list_changed"
+        method: "notifications/tools/list_changed"
       });
     } catch (e) {
       // Silent fail

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.8.19",
+  "version": "0.8.20",
   "mcpName": "io.github.vibecodinginc/vibe",
   "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) \u2014 the /vibe kernel",
   "main": "index.js",

package/store/api.js

@@ -654,6 +654,10 @@ async function getInboxV1(handle) {
         messages: [],
         unread: t.unread || 0,
         lastMessage: t.last_message?.body,
+        // The stable id + author of the newest message — what a reply MUST
+        // name explicitly (first-five-minutes repair: no guessed targets).
+        lastMessageId: t.last_message?.id || null,
+        lastFrom: t.last_message?.from || null,
         lastTimestamp: t.last_message?.created_at ? new Date(t.last_message.created_at).getTime() : null
       }));
     }

package/tools/help.js

@@ -45,7 +45,7 @@ The kernel: presence + messaging across terminal coding sessions
 
 ### Messaging
 - \`vibe dm @handle "message"\` — Send a direct message. Lands now if they're in a session, waits for their next turn if not
-- \`vibe reply "message"\` — Reply to your most recent unread (or a specific person)
+- \`vibe reply\` with reply_to: "#id" — Answer one specific message (ids show in \`vibe inbox\`)
 - \`vibe inbox\` — See unread messages and recent threads
 
 ### Setup

package/tools/inbox.js

@@ -374,10 +374,11 @@ async function handler(args) {
     // were rendering as the same sentence. "Recent: @a, @b, @c" also named the
     // handles without saying what they were: recent conversations, recent arrivals,
     // or a suggestion? Naming the relationship costs three words.
-    const recentHandles = sorted.slice(0, 3).map((th) => `@${th.handle}`).join(', ');
+    // ids ride inline so the summary stays one compact line (and greppable)
+    const recentLine = sorted.slice(0, 3).map((th) => `@${th.handle}${th.lastMessageId ? ` (#${th.lastMessageId})` : ''}`).join(', ');
     return {
-      display: recentHandles
-        ? `📭 nothing unread.\n\n_your recent threads:_ ${recentHandles}\n_open one with_ \`vibe inbox @handle\``
+      display: recentLine
+        ? `📭 nothing unread.\n\n_your recent threads:_ ${recentLine}\n_open one with_ \`vibe inbox @handle\` _· reply to a message exactly with its #id_`
         : '📭 nothing unread.',
       actions: formatActions(actions.recommendedConnections([]))
     };
@@ -475,12 +476,18 @@ async function handler(args) {
   // Line 3: Divider
   display += '───────────────────────────────────\n';
 
-  // Line 4+: Expanded list with counts and badges
+  // Line 4+: one line per unread thread — handle, count, and the STABLE id of
+  // its newest message so a reply can name its target exactly (first-five-
+  // minutes repair: vibe_reply never guesses). Compact: the id is a copyable
+  // suffix, not the headline.
   const expanded = unreadSenders.map(t => {
     const agent = t.isAgent ? ' 🤖' : '';
-    return `@${t.handle} (${t.unread})${agent}`;
-  }).join(' • ');
+    const idTag = t.lastMessageId ? ` · #${t.lastMessageId}` : '';
+    const who = t.lastFrom && t.lastFrom !== t.handle ? '' : '';
+    return `• @${t.handle} (${t.unread})${agent}${idTag}${who}`;
+  }).join('\n');
   display += expanded;
+  display += `\n\n_reply to one exactly:_ \`vibe reply\` with reply_to: "<id>"`;
 
   // Build response with optional hints for structured flows
   const response = { display };
@@ -491,6 +498,8 @@ async function handler(args) {
     response.unread_count = totalUnread;
     response.threads = unreadSenders.map(t => ({
       handle: t.handle,
+      thread_id: t.thread_id || null,
+      last_message_id: t.lastMessageId || null,
       unread: t.unread,
       preview: truncate(t.lastMessage || '', 40)
     }));

package/tools/init.js

@@ -267,7 +267,7 @@ async function sendWelcomeMessage(handle, one_liner) {
 
 const definition = {
   name: 'vibe_init',
-  description: `Join /vibe social network. Opens the browser for GitHub sign-in — NO INPUT NEEDED; the user's GitHub username becomes their handle automatically. This BLOCKS for up to 5 minutes waiting for the browser login to finish, so BEFORE it returns the user sees only a spinner. IMPORTANT: right when you call this, tell the user in your own words that their browser is opening to sign in with GitHub, then finish the login there and come back.`,
+  description: `Sign in to /vibe with GitHub — NO INPUT NEEDED; the GitHub username becomes the handle. Returns IMMEDIATELY with an auth_required state, the login URL, and one sentence to relay: 'Open this, sign in with GitHub, then say vibe start.' It may open a browser when one is available locally (never over SSH/headless); it never waits. Sign-in completes in the background; the next vibe start recognizes it.`,
   inputSchema: {
     type: 'object',
     properties: {
@@ -288,9 +288,14 @@ const definition = {
  * Open URL in default browser
  */
 function openBrowser(url) {
+  // Resolves to whether a browser was actually asked to open. Over SSH or in
+  // a headless/CI shell we do not try: `open` on a remote Mac would pop the
+  // window on a screen the person is not looking at, and a failed attempt
+  // must be REPORTED so the URL becomes the honest next action.
+  const remote = Boolean(process.env.SSH_CONNECTION || process.env.SSH_TTY || process.env.CI);
+  if (remote) return Promise.resolve(false);
   const platform = process.platform;
   let command;
-
   if (platform === 'darwin') {
     command = `open "${url}"`;
   } else if (platform === 'win32') {
@@ -298,14 +303,135 @@ function openBrowser(url) {
   } else {
     command = `xdg-open "${url}"`;
   }
+  return new Promise((resolve) => {
+    // A launcher still running after the cap is 'unknown' — never reported as
+    // failed while it may yet open a window (review P2).
+    const timer = setTimeout(() => resolve('unknown'), 5000);
+    exec(command, (err) => {
+      clearTimeout(timer);
+      if (err) console.error('[vibe_init] Could not open a browser:', err.message);
+      resolve(!err);
+    });
+  });
+}
 
-  exec(command, (err) => {
-    if (err) {
-      console.error('[vibe_init] Failed to open browser:', err.message);
-    }
+// ── Non-blocking sign-in (first-five-minutes repair, 2026-08-30) ─────────
+// The tool call NEVER waits for OAuth. One flow at a time lives here; the
+// callback listener stays alive after the tool returns, and completion is
+// persisted in the background so the NEXT vibe_start recognizes the
+// credential. Expired flows are replaced with a fresh one and say so.
+const AUTH_SENTENCE = 'Open this, sign in with GitHub, then say vibe start.';
+let pendingAuth = null; // { oauth, loginUrl, startedAt, browserOpened, expired }
+let pendingAuthCreation = null; // in-flight ensureAuthFlow, so concurrent starts share ONE flow (review P1)
+
+async function completeSignIn({ token, handle: finalHandle, actor }, one_liner) {
+  if (actor) await actorSession.installOAuthSession(actor);
+  else await actorSession.clearActorSession();
+  config.saveAuthToken(token);
+  config.setSessionIdentity(finalHandle, one_liner || '');
+  authStore.setToken(token);
+  authStore.setHandle(finalHandle);
+  authStore.setOneLiner(one_liner || '');
+  const authConfig = config.load();
+  authConfig.handle = finalHandle;
+  authConfig.one_liner = one_liner || '';
+  authConfig.authMethod = 'browser';
+  authConfig.pendingAuth = false;
+  config.save(authConfig);
+  // The toolset just changed — tell the host now, not on the next call.
+  global.vibeNotifier?.emitImmediate();
+  // Presence + welcome are best-effort and must never block or throw here.
+  try { await store.registerSession(config.getSessionId(), finalHandle, one_liner); } catch {}
+  try { await store.heartbeat(finalHandle, one_liner); } catch {}
+  try { discord.postJoin(finalHandle, one_liner); } catch {}
+  try { await Promise.race([sendPersonalizedWelcome(finalHandle, one_liner), new Promise((r) => setTimeout(r, 2500))]); } catch {}
+}
+
+async function ensureAuthFlow(opts) {
+  if (pendingAuth && !pendingAuth.expired) {
+    return { ...pendingAuth, reused: true };
+  }
+  // Concurrent signed-out starts must not each bind a listener: the FIRST
+  // caller's creation promise is shared until pendingAuth exists.
+  if (pendingAuthCreation) {
+    const flow = await pendingAuthCreation;
+    return { ...flow, reused: true };
+  }
+  pendingAuthCreation = createAuthFlow(opts).finally(() => { pendingAuthCreation = null; });
+  return pendingAuthCreation;
+}
+
+async function createAuthFlow({ requestedHandle, one_liner }) {
+  const replacedExpired = Boolean(pendingAuth && pendingAuth.expired);
+  if (replacedExpired) {
+    // The expired listener must not linger through its grace period beside
+    // the replacement (review P2).
+    try { await pendingAuth.oauth.cancel(); } catch {}
+    pendingAuth = null;
+  }
+  const oauth = await beginOAuth({ requestedHandle, actorAware: true });
+  // 'unknown' until the launcher actually answers: a staggered caller that
+  // finds the flow mid-launch must not report `false` for a browser that is
+  // still opening (review P2). The field is updated in place when known.
+  const flow = { oauth, loginUrl: oauth.loginUrl, startedAt: Date.now(), browserOpened: 'unknown', expired: false, reused: false, replacedExpired };
+  pendingAuth = flow;
+  // Background completion: nobody awaits this. Success persists the credential;
+  // timeout marks the flow expired so the next start issues a fresh link.
+  oauth.waitForCallback().then(
+    (result) => completeSignIn(result, one_liner).catch((e) => console.error('[vibe_init] sign-in completion failed:', e.message)).finally(() => { if (pendingAuth === flow) pendingAuth = null; }),
+    (err) => { flow.expired = true; if (err?.message !== 'AUTH_TIMEOUT') console.error('[vibe_init] sign-in flow ended:', err?.message || err); }
+  );
+  // Kick the launcher off and report only what is known within a short
+  // budget — a slow launcher yields 'unknown', never a wait and never a lie.
+  flow.browserPromise = openBrowser(oauth.loginUrl).then((result) => {
+    flow.browserOpened = result;
+    return result;
   });
+  await Promise.race([
+    flow.browserPromise,
+    new Promise((resolve) => setTimeout(resolve, 750)),
+  ]);
+  return flow;
+}
+
+function authRequiredResult(flow, presenceBanner) {
+  const lead = flow.replacedExpired
+    ? 'The earlier sign-in link expired — here is a fresh one.'
+    : flow.reused
+      ? 'Still waiting for your sign-in.'
+      : flow.browserOpened === true
+        ? 'A browser window is opening for GitHub sign-in.'
+        : flow.browserOpened === 'unknown'
+          ? 'A browser may be opening; if it did not, use the link.'
+          : 'No browser could be opened from here.';
+  const structured = {
+    state: 'auth_required',
+    login_url: flow.loginUrl,
+    browser_opened: flow.browserOpened,
+    waiting_since: flow.startedAt,
+    next: 'vibe start',
+    sentence: AUTH_SENTENCE,
+  };
+  return {
+    display: `${presenceBanner || ''}\n\n**Sign in to /vibe**\n${lead}\n${AUTH_SENTENCE}\n\n${flow.loginUrl}`,
+    data: structured,
+    structured, // the dispatcher forwards `structured` as structuredContent (review P1)
+  };
+}
+
+// Test seam: reset the one pending flow between cases.
+function _forceExpireForTest() {
+  if (pendingAuth) pendingAuth.expired = true;
+}
+
+async function _resetPendingAuth() {
+  const flow = pendingAuth;
+  pendingAuth = null;
+  pendingAuthCreation = null;
+  if (flow?.oauth) { try { await flow.oauth.cancel(); } catch {} }
 }
 
+
 async function handler(args) {
   const { handle, one_liner, auth_method } = args;
 
@@ -394,204 +520,43 @@ Heading out? \`vibe bye\` ends presence for this session — you stay @${existin
   // ===========================================
   // Show welcome banner (pre-auth)
   // ===========================================
-  const presence = await getPresenceCounts();
+  // Bounded: the pre-auth banner must never hold the sign-in response hostage
+  // to a slow presence fetch (review P1 — 'return immediately').
+  const presence = await Promise.race([
+    getPresenceCounts(),
+    new Promise((resolve) => setTimeout(() => resolve({ online: 0, humans: 0, agents: 0 }), 1500)),
+  ]);
   const welcomeBanner = generatePreAuthBanner(presence);
 
   // ===========================================
   // BROWSER AUTH (Default): GitHub OAuth
   // ===========================================
   if (auth_method === 'browser' || !auth_method) {
-    let oauth;
-
-    // Save one_liner for callback handler
+    // Save one_liner for the completion handler
     const cfg = config.load();
     if (h) cfg.handle = h;
     cfg.one_liner = one_liner || '';
     cfg.pendingAuth = true;
     config.save(cfg);
 
+    let flow;
     try {
-      // The callback listener is bound before this resolves. Only then is it
-      // safe to hand the attempt-correlated URL to the browser.
-      oauth = await beginOAuth({ requestedHandle: h, actorAware: true });
-      openBrowser(oauth.loginUrl);
-
-      // Wait for callback (blocks until auth completes or times out)
-      const { token, handle: callbackHandle, actor } = await oauth.waitForCallback();
-      const finalHandle = callbackHandle;
-
-      // Actor state is a separate credential family. Install it before claiming
-      // sign-in success; an account switch or failed shadow issuance must not leave a
-      // previous principal's Actor bundle alive beside the new legacy session.
-      if (actor) await actorSession.installOAuthSession(actor);
-      else await actorSession.clearActorSession();
-
-      // Save to config (file persistence for restarts)
-      config.saveAuthToken(token);
-      config.setSessionIdentity(finalHandle, one_liner || '');
-
-      // PUSH to in-memory auth store (immediate propagation)
-      authStore.setToken(token);
-      authStore.setHandle(finalHandle);
-      authStore.setOneLiner(one_liner || '');
-
-      // Update shared config
-      const authConfig = config.load();
-      authConfig.handle = finalHandle;
-      authConfig.one_liner = one_liner || '';
-      authConfig.authMethod = 'browser';
-      authConfig.pendingAuth = false;
-      config.save(authConfig);
-
-      // Register session with API
-      const sessionId = config.getSessionId();
-      await store.registerSession(sessionId, finalHandle, one_liner);
-
-      // Send initial heartbeat
-      await store.heartbeat(finalHandle, one_liner);
-
-      // Post to Discord
-      discord.postJoin(finalHandle, one_liner);
-
-      const result = { success: true, handle: finalHandle };
-
-      // Send personalized welcome and wait for it (2.5s timeout)
-      let welcomeResult = null;
-      try {
-        welcomeResult = await Promise.race([
-          sendPersonalizedWelcome(result.handle, one_liner),
-          new Promise(resolve => setTimeout(() => resolve(null), 2500))
-        ]);
-      } catch (e) {
-        console.error('[vibe_init] Welcome message failed:', e.message);
-      }
-
-      // Check for unread messages (includes the welcome we just sent)
-      let unreadCount = 0;
-      try {
-        unreadCount = await store.getUnreadCount(result.handle);
-      } catch (e) {}
-
-      // Fetch GitHub friends (non-blocking, 3s timeout)
-      let friendsData = null;
-      try {
-        const friendsPromise = fetchGitHubFriends(result.handle);
-        friendsData = await Promise.race([
-          friendsPromise,
-          new Promise(resolve => setTimeout(() => resolve(null), 3000))
-        ]);
-      } catch (e) {}
-
-      // Do we have an email to reach them at when a DM lands while away?
-      // (non-blocking, 2s timeout — never hold up onboarding for this)
-      let hasEmail = null;
-      try {
-        hasEmail = await Promise.race([
-          fetchHasEmail(config.getAuthToken()),
-          new Promise(resolve => setTimeout(() => resolve(null), 2000))
-        ]);
-      } catch (e) {}
-
-      // Generate authenticated banner with handle + unread (3 lines only - won't collapse)
-      const authBanner = generateAuthBanner(result.handle, unreadCount, presence);
-
-      // Build friends section if we have data
-      let friendsSection = '';
-      if (friendsData?.friendsOnVibe?.length > 0) {
-        const friendHandles = friendsData.friendsOnVibe.map(f => `@${f.vibe_handle}`).join(', ');
-        friendsSection = `\n\n🤝 **${friendsData.friendsOnVibe.length} of your GitHub friends are here!**\n${friendHandles}`;
-      } else if (friendsData?.totalContacts > 0) {
-        friendsSection = `\n\n👋 None of your GitHub friends are on /vibe yet — say **"vibe invite"** to bring them in!`;
-      }
-
-      // Build welcome section - show inline if we have the message
-      let welcomeSection = '';
-      if (welcomeResult?.messageText) {
-        welcomeSection = `\n\n---\n**📨 Welcome from @seth:**\n\n> ${welcomeResult.messageText.split('\n').join('\n> ')}`;
-      } else {
-        welcomeSection = '\n\n---\n**📨 @seth sent you a welcome message** — say **"vibe inbox"** to read it.';
-      }
-
-      // Always close on a concrete next move toward the aha: your first DM
-      // landing in someone else's terminal. Only commands that exist (who /
-      // @handle / ship). Avoid pointing the reply at a specific founder handle
-      // here — it can misroute; reading the inbox is the safe path to reply.
-      // Only promise a crowd of *humans* when there's actually one to meet —
-      // presence skews agent-heavy, and overselling an empty room is how the
-      // green dot stops meaning anything. Agents still show in `vibe who`.
-      const whoNudge = presence.humans > 1
-        ? `**"vibe who"** — see the ${presence.humans} builders online right now`
-        : `**"vibe who"** — see who's building right now`;
-      // You are here because someone you work with invited you. So the first move
-      // is answering THEM, not being matched with a stranger.
-      //
-      // This used to instruct the agent to call `vibe_intro` — auto-introduce the
-      // newcomer to whoever seemed related. That tool is RETIRED (docs/PRIVATE-FABRIC.md:
-      // cold introduction is out of scope), so the very first instruction a new
-      // invitee received pointed at the discovery model we deleted.
-      const nextSteps = unreadCount > 0
-        ? `\n\n---\n**Someone is already waiting on you.** Say **"vibe inbox"** to read it, then **"vibe reply"** to answer.\n\n`
-          + `_Stuck? Say **"vibe help"**._`
-        : `\n\n---\n**You're in.** Say **"vibe dm @<handle>"** to reach whoever invited you — they'll get it in their next session, whether or not they're online now.\n`
-          + `\n${whoNudge}.\n\n`
-          + `_Stuck? Say **"vibe help"**._`;
-
-      // One-time email nudge — only for users we can't otherwise reach (no
-      // address on file). This is the return loop: a DM that lands while you're
-      // away from Claude Code emails you so you actually come back.
-      const emailNudge = (EXTRAS_ENABLED && hasEmail === false)
-        ? `\n\n---\n📧 **Don't miss a DM** — add an email and /vibe pings you when someone messages you while you're away:\n**"vibe email you@example.com"** _(offline only · one-click unsubscribe)_`
-        : '';
-
-      return {
-        display: authBanner + friendsSection + welcomeSection + nextSteps + emailNudge,
-        onboarding: {
-          isNewUser: true,
-          handle: result.handle,
-          hint: 'show_onboarding_options',
-          hasWelcomeMessage: !!welcomeResult,
-          welcomeText: welcomeResult?.messageText || null,
-          friendsOnVibe: friendsData?.friendsOnVibe || [],
-          inviteSuggestions: friendsData?.inviteSuggestions || []
-        }
-      };
-
-    } catch (err) {
-      if (err.message === 'AUTH_IN_PROGRESS') {
-        return {
-          display: `## A login is already running
-
-Another sign-in owns the callback listener. Finish that browser sign-in, or say
-**"let's vibe"** again to start a fresh attempt.`
-        };
-      }
-
-      if (err.message === 'AUTH_TIMEOUT') {
+      flow = await ensureAuthFlow({ requestedHandle: h, one_liner });
+    } catch (error) {
+      if (error?.message === 'AUTH_IN_PROGRESS') {
         return {
-          display: `## The sign-in timed out
-
-The browser login wasn't finished within 5 minutes — no problem, just start it again.
-
-**1. Say "let's vibe"** to reopen the login.
-**2. Sign in with GitHub** in that tab, then come back here.
-
-_Tip: keep this window and the browser both visible so you can see when it finishes._`
+          display: `${welcomeBanner}\n\n**Sign in to /vibe**\nAnother /vibe session on this machine is already signing in — finish that one, then say vibe start.`,
+          data: { state: 'auth_required', login_url: null, browser_opened: false, next: 'vibe start', sentence: AUTH_SENTENCE },
+          structured: { state: 'auth_required', login_url: null, browser_opened: false, next: 'vibe start', sentence: AUTH_SENTENCE },
         };
       }
-
-      if (oauth) await oauth.cancel();
       return {
-        display: `## Couldn't finish sign-in
-
-**What happened:** ${err.message}
-
-**Try this:**
-1. Say **"let's vibe"** to open a fresh sign-in
-2. Finish the GitHub sign-in in that tab, then come back
-
-**Still stuck?** Email seth@slashvibe.dev — happy to get you in.`
+        display: `${welcomeBanner}\n\nCould not start sign-in (${error?.message || error}). Say vibe start to try again.`,
+        data: { state: 'auth_error', next: 'vibe start' },
+        structured: { state: 'auth_error', next: 'vibe start' },
       };
     }
+    return authRequiredResult(flow, welcomeBanner);
   }
 
   // ===========================================
@@ -684,4 +649,4 @@ _Say "vibe onboarding" anytime to check your progress_`
   };
 }
 
-module.exports = { definition, handler };
+module.exports = { definition, handler,  _resetPendingAuth, _forceExpireForTest, AUTH_SENTENCE };

package/tools/reply.js

@@ -1,5 +1,5 @@
 /**
- * vibe reply — Quick reply to the most recent unread message
+ * vibe reply — reply to a specific message by its visible #id (linked), or continue a named thread unlinked; never guesses the newest.
  *
  * Streamlined flow: one command instead of inbox → open → dm
  */
@@ -14,7 +14,7 @@ const { actions, formatActions } = require('./_actions');
 
 const definition = {
   name: 'vibe_reply',
-  description: 'Quick reply to your most recent unread message, or to a specific person. Streamlined: one command instead of inbox → open → dm.',
+  description: 'Reply to a specific message by its visible #id (reply_to) — the reply is linked to exactly that message. Or continue a named thread unlinked with `to`. Never guesses: with neither, it lists the visible ids instead of sending.',
   inputSchema: {
     type: 'object',
     properties: {
@@ -24,7 +24,7 @@ const definition = {
       },
       to: {
         type: 'string',
-        description: 'Optional: reply to a specific person (e.g., @alex). If not provided, replies to most recent unread.'
+        description: 'Optional: continue a named thread unlinked (e.g., @alex). With neither `to` nor `reply_to`, nothing is sent — the visible #ids are listed instead.'
       },
       reply_to: {
         type: 'string',
@@ -49,38 +49,48 @@ async function handler(args) {
   let targetHandle;
   let threadContext = null;
 
-  // If specific recipient provided, use that
+  // THE TARGET IS NAMED, NEVER GUESSED (first-five-minutes repair). A reply
+  // consumes the visible #id exactly; `to` alone continues a named thread
+  // unlinked; nothing at all is refused WITH the candidates — the old
+  // "first unread thread wins" default was the guess this verb's own schema
+  // forbids.
   if (to) {
     targetHandle = normalizeHandle(to);
-  } else {
-    // Find most recent unread thread
-    const threads = await store.getInbox(myHandle);
-
-    if (!threads || threads.length === 0) {
+  } else if (reply_to) {
+    // Resolve the thread that holds this id from the inbox (newest message
+    // per thread is served with its id); fall back to a bounded scan of the
+    // most recent threads for an older id.
+    const threads = (await store.getInbox(myHandle)) || [];
+    let owner = threads.find((t) => t.lastMessageId === reply_to);
+    if (!owner) {
+      for (const t of threads.slice(0, 5)) {
+        try {
+          const full = await store.getThread(myHandle, t.handle);
+          if ((full || []).some((m) => m.id === reply_to)) { owner = t; break; }
+        } catch {}
+      }
+    }
+    if (!owner) {
       return {
-        display: '📭 No messages to reply to.\n\nUse `vibe dm @someone "message"` to start a conversation.',
-        actions: formatActions(actions.recommendedConnections([]))
+        display: `Not sent — no message #${reply_to} in your recent threads, and I won't guess. Say \`vibe inbox\` to see the ids.`,
       };
     }
-
-    // Find first thread with unread messages
-    const unreadThread = threads.find(t => t.unread > 0);
-
-    if (!unreadThread) {
-      // No unread, show most recent thread
-      // "--to" was CLI-flag syntax for a flag that doesn't exist — the actual
-      // way to continue a read thread is a plain dm.
-      const mostRecent = threads[0];
+    targetHandle = owner.handle;
+  } else {
+    const threads = (await store.getInbox(myHandle)) || [];
+    if (threads.length === 0) {
       return {
-        display: `📭 nothing unread. Most recent thread: @${mostRecent.handle}\n\n_continue it with_ \`vibe dm @${mostRecent.handle} "your message"\``,
-        actions: formatActions(actions.afterInboxCompact([{ handle: mostRecent.handle, unread: 0 }]))
+        display: '📭 No messages to reply to.\n\nUse `vibe dm @someone "message"` to start a conversation.',
+        actions: formatActions(actions.recommendedConnections([]))
       };
     }
-
-    targetHandle = unreadThread.handle;
-    threadContext = {
-      unreadCount: unreadThread.unread,
-      preview: unreadThread.lastMessage ? truncate(unreadThread.lastMessage, 50) : null
+    const candidates = threads
+      .filter((t) => t.lastMessageId)
+      .slice(0, 6)
+      .map((t) => `  #${t.lastMessageId} — @${t.handle}${t.unread ? ` (${t.unread} unread)` : ''}: "${truncate(t.lastMessage || '', 48)}"`)
+      .join('\n');
+    return {
+      display: `Not sent — which message are you answering? I won't pick the newest for you.\n${candidates || '  (no ids in the loaded inbox)'}\n\n_reply exactly with_ reply_to: "<id>" _— or continue a thread unlinked with_ to: "@handle"`,
     };
   }
 
@@ -222,7 +232,10 @@ async function handler(args) {
     const nextHandle = stillUnread[0].handle;
     const totalUnread = stillUnread.reduce((sum, t) => sum + t.unread, 0);
     display += `\n\n📬 ${totalUnread} more unread from ${stillUnread.map(t => `@${t.handle}`).slice(0, 3).join(', ')}`;
-    display += `\n_Say \`vibe reply "message"\` to reply to @${nextHandle}_`;
+    const nextId = stillUnread[0].lastMessageId;
+    display += nextId
+      ? `\n_Reply to @${nextHandle} exactly: \`vibe reply\` with reply_to: "${nextId}"_`
+      : `\n_Open @${nextHandle}'s thread with \`vibe inbox @${nextHandle}\` to reply to a specific message_`;
   }
 
   // Build response with actions

package/tools/start.js

@@ -190,11 +190,9 @@ const definition = {
 };
 
 async function handler(args) {
-  // Step 0: Auto-update check (runs git pull if behind)
-  const updateResult = await autoUpdate();
-
-  // Step 1: Check if properly authenticated with OAuth
-  // If not, redirect to init for GitHub auth flow (shows pre-auth banner + OAuth)
+  // Step 0: signed out? Go straight to the (non-blocking) sign-in. The
+  // auto-update git work below can take tens of seconds and must never sit
+  // between a stranger and their first actionable output (review P1).
   if (!config.hasOAuth()) {
     return init.handler({
       handle: args.handle,
@@ -202,6 +200,9 @@ async function handler(args) {
     });
   }
 
+  // Step 1: Auto-update check (runs git pull if behind) — signed-in only
+  const updateResult = await autoUpdate();
+
   // Step 2: User is authenticated - show dashboard
   const myHandle = config.getHandle();
   let threads = [];

package/version.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.8.19",
-  "updated": "2026-08-29",
-  "changelog": "The runtime now answers four verbs \u2014 remember, reflect, message, call \u2014 and tells the truth about every one of them. vibe_capabilities reports each capability as granted, available, off, or unavailable with its reason (visible even before sign-in); discovery reads no private data and executes nothing. vibe_remember consults your own local memory with a grant or reports its state without one; vibe_reflect reveals your local VibeStats archetype (local-only, never published); vibe_call drafts an explicit live-room handoff that only you can send. Nothing sends, joins, or publishes on its own.",
+  "version": "0.8.20",
+  "updated": "2026-08-31",
+  "changelog": "Signing in no longer makes you wait. Say vibe start and you get the login link immediately with one sentence telling you what to do \u2014 no hung command, no blank screen, and it works over SSH or anywhere a browser cannot open. Finish in the browser whenever you like; the next vibe start picks it up. And replies now name their target: every thread in your inbox shows the id of its newest message, and vibe reply answers that exact message instead of guessing the newest one.",
   "features": [
-    "vibe_capabilities: the truthful local manifest \u2014 remember/reflect/message/call as granted/available/off/unavailable, discovery existence-only",
-    "vibe_remember: one sourced offer or silence with a Personal Mind grant; the honest capability state without (vibe_mind name retired)",
-    "vibe_reflect: your local VibeStats reveal (archetype + cadence + the provider's own provenance); reflection/no-data/provider-failure/unavailable stay distinct",
-    "vibe_call: drafts the live-room handoff line for YOU to approve and send; never sends, joins, or notifies",
-    "Local-only verbs carry no ambient footer and their inputs are never retained"
+    "vibe start signed out returns immediately with the login URL and one instruction \u2014 never blocks on the browser",
+    "Works headless: over SSH or with no browser, the link IS the next step (and it says so honestly)",
+    "Sign-in completes in the background; the next vibe start recognizes it and unlocks the full toolset",
+    "vibe inbox shows each thread's newest message id (#msg_\u2026) so a reply can name it exactly",
+    "vibe reply answers that exact message \u2014 with no target it lists the ids instead of guessing"
   ],
   "deprecated": [],
   "breaking": false,