slashvibe-mcp 0.8.3 → 0.8.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "mcpName": "io.github.vibecodinginc/vibe",
   "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) — the /vibe kernel",
   "main": "index.js",

package/setup.js

@@ -93,8 +93,17 @@ function findClaudeConfig() {
     }
   }
 
-  // Default to ~/.claude.json (will create if doesn't exist)
-  return path.join(homeDir, '.claude.json');
+  // Nothing found. Returning a path anyway made setup report "→ Claude Code" and
+  // "configured" on machines with no Claude Code at all — a success message for work
+  // that helps nobody, and the reason "no supported host" was unreachable. Callers
+  // now get null and decide honestly; the default path is only for the create case,
+  // which is signalled explicitly.
+  return null;
+}
+
+/** Where we WOULD write a Claude Code config if the user wants one created. */
+function defaultClaudeConfigPath() {
+  return path.join(os.homedir(), '.claude.json');
 }
 
 /**
@@ -140,10 +149,18 @@ function addVibeToJsonConfig(configPath) {
 }
 
 /**
- * Configure Claude Code (~/.claude.json et al). Always runs.
+ * Configure Claude Code (~/.claude.json et al).
+ *
+ * Cursor and Codex only configure when their directories exist; Claude Code used to
+ * configure unconditionally, inventing ~/.claude.json on machines that had never run
+ * it. That is what made setup announce "→ Claude Code · configured" during a walk on
+ * a clean machine with no Claude Code installed. Same rule for all three hosts now:
+ * we write where the host actually lives, and say so honestly when none is found.
  */
-function configureClaudeCode() {
-  const configPath = findClaudeConfig();
+function configureClaudeCode({ createIfMissing = false } = {}) {
+  const found = findClaudeConfig();
+  const configPath = found || (createIfMissing ? defaultClaudeConfigPath() : null);
+  if (!configPath) return null; // Claude Code not installed here
   try {
     return { host: 'Claude Code', path: configPath, status: addVibeToJsonConfig(configPath) };
   } catch (e) {
@@ -231,17 +248,38 @@ function configureCodex() {
  * Configure every detected host. Returns results for the ones present.
  */
 function configureAllHosts() {
-  return [configureClaudeCode(), configureCodex(), configureCursor()].filter(Boolean);
+  const found = [configureClaudeCode(), configureCodex(), configureCursor()].filter(Boolean);
+  // No host detected at all — someone ran this before installing a coding agent, or
+  // in a container. Rather than silently doing nothing (or, as before, inventing a
+  // Claude Code config to have something to report), create the Claude Code config so
+  // /vibe is wired the moment they install it, and let the caller say which case it is.
+  if (found.length === 0) {
+    const created = configureClaudeCode({ createIfMissing: true });
+    return created ? [{ ...created, hostWasMissing: true }] : [];
+  }
+  return found;
 }
 
 /**
  * Test API connection
  */
 async function testConnection() {
+  // Found by actually RUNNING this on a clean machine, which no amount of reading
+  // the code surfaced: /api/health answers `{"status":"healthy"}`, and this asked
+  // for `'ok'`. So every first run — on a perfectly good connection — printed
+  // "Could not reach slashvibe.dev" and three troubleshooting steps, to a person
+  // whose very first experience of /vibe was being told it was broken.
+  //
+  // The client no longer guesses at the server's vocabulary. Reachability is what
+  // HTTP already answers; the body is only allowed to veto by reporting an explicit
+  // unhealthy state.
   try {
     const response = await fetch(`${API_BASE}/api/health`);
-    const data = await response.json();
-    return data.status === 'ok' || data.success;
+    if (!response.ok) return false;
+    const data = await response.json().catch(() => ({}));
+    if (data.success === false) return false;
+    if (typeof data.status === 'string' && /unhealthy|down|error/i.test(data.status)) return false;
+    return true;
   } catch (e) {
     return false;
   }

package/version.json

@@ -1,14 +1,10 @@
 {
-  "version": "0.8.3",
+  "version": "0.8.4",
   "updated": "2026-07-31",
-  "changelog": "Security release, and the one that reaches the door people actually use. A clean install runs `npx slashvibe-mcp`, which had its own separate sign-in code \u2014 so the fixes shipped in 0.8.2 were never on that path. There is now one sign-in implementation: the listener binds before the browser opens, each attempt is tagged so another process's login can never land in yours, two sign-ins at once both work, and a slow sign-in gets a page explaining itself instead of a browser error. Identity is one thing everywhere \u2014 pasting a token no longer leaves your requests going out as the previous account, and presence announces the account your credential names rather than one read from a file. A message someone sends you is never placed next to an instruction telling your agent to reply.",
+  "changelog": "Setup told every new user the service was unreachable. The health check asked the server for one word and the server answers another, so step 3 of every first run reported 'could not reach slashvibe.dev' \u2014 with troubleshooting steps \u2014 to people whose connection was fine. Fixed by letting HTTP answer reachability instead of guessing at vocabulary. Setup also claimed to configure Claude Code on machines that had never installed it; all three coding agents are now detected the same way.",
   "features": [
-    "One sign-in path for terminal setup and vibe_init \u2014 the invite path has the fixes",
-    "Each sign-in attempt is tagged; a concurrent login cannot land in your session",
-    "Two sign-ins at once both work (port falls back instead of colliding)",
-    "vibe_token switches the whole session, not half of it",
-    "Presence names the account your credential names",
-    "Inbound messages are never seated beside an instruction to act on them"
+    "The connection test agrees with the server it is testing",
+    "Coding agents are detected, not assumed \u2014 no more configuring a host you don't have"
   ],
   "deprecated": [],
   "breaking": false,