slashvibe-mcp 0.8.3 → 0.8.5

package/config.js

@@ -104,6 +104,26 @@ function save(config) {
 }
 
 function getHandle() {
+  // THE CREDENTIAL NAMES US — the files below are only what we knew before one loaded.
+  //
+  // Twenty-eight call sites across the tools read this function, and it answered from
+  // disk independently of the token those same tools authenticate with. That is the
+  // split identity reproduced in review: a token for account A while display and
+  // self-checks said account B, so a tool could route a message to "you" that the
+  // server had authored as someone else. Fixing it at each call site would have been
+  // twenty-eight chances to miss one; fixing it here makes every reader correct at
+  // once, and leaves exactly one place that decides.
+  //
+  // Required lazily: auth-store loads config during hydration, and a top-level import
+  // here would close that circle.
+  try {
+    const authStore = require('./auth-store');
+    const fromCredential = authStore.getHandle();
+    if (fromCredential) return fromCredential;
+  } catch (e) {
+    // auth-store unavailable (early boot) — fall through to what is on disk.
+  }
+
   // Prefer session-specific handle over shared config
   const sessionHandle = getSessionHandle();
   if (sessionHandle) return sessionHandle;

package/index.js

@@ -65,8 +65,19 @@ const NO_AUTH_REQUIRED = new Set([
   'vibe_start', 'vibe_init', 'vibe_token', 'vibe_who', 'vibe_help'
 ]);
 
-// Single source of truth for "is this session signed in" — token or OAuth.
-const isAuthed = () => authStore.isAuthenticated() || config.hasOAuth();
+// "Is this session signed in" — the credential answers, not the filesystem.
+//
+// This used to OR in config.hasOAuth(), which asks a FILE. That made disk a second
+// authority: a leftover config could unlock the authenticated tool surface for a
+// session holding no usable credential. authStore already consults disk during
+// hydration and refuses anything it cannot attribute, so it is the one place that
+// should decide.
+//
+// Deliberately NOT gated on isVerified(): verification needs the network, and a
+// person on a plane should still see their tools and get a clear error from the
+// server rather than a surface that silently empties. Verification gates the things
+// that must never be a guess — the green dot and any claim about who you are.
+const isAuthed = () => authStore.isAuthenticated();
 
 // Infer user prompt from tool arguments (for pattern logging).
 // Cases exist only for registered tools whose args improve on the default.
@@ -674,13 +685,37 @@ class VibeMCPServer {
       const handle = authStore.getHandle();
       if (!handle || !authStore.isAuthenticated()) return;
 
+      // ASK THE SERVER BEFORE CLAIMING ANYTHING.
+      //
+      // I added an explicit verified-vs-saved state and then gated nothing on it, so
+      // this still announced on the strength of "a token-shaped string exists on
+      // disk". A forged JWT-shaped value in config or Buddy's auth.json produced a
+      // confident "🟢 Auto-connected as @victim" and a heartbeat against production.
+      // Holding a credential is not the same as having one that works, and the green
+      // dot is the one thing in this product that must never be a guess.
+      let verified;
+      try {
+        verified = await store.verifyAuthToken(authStore.getToken());
+      } catch (e) {
+        verified = null;
+      }
+      if (!verified || !verified.valid) {
+        // Definitive rejection means the session is dead; unreachable means unknown.
+        // Neither earns a green dot, and neither is worth shouting about at startup.
+        if (verified && verified.definitive) {
+          process.stderr.write('/vibe: saved session is no longer valid — say "vibe init" to sign in again\n');
+        }
+        return;
+      }
+      authStore.markVerified(verified.handle);
+
       const one_liner = config.getOneLiner() || '';
 
-      // Start presence heartbeat
-      presence.start(handle, one_liner);
+      // Start presence heartbeat — now, and only now, is this handle a fact.
+      presence.start(authStore.getHandle(), one_liner);
 
       // Log quietly (only to stderr, not intrusive)
-      process.stderr.write(`🟢 Auto-connected as @${handle}\n`);
+      process.stderr.write(`🟢 Auto-connected as @${authStore.getHandle()}\n`);
     } catch (error) {
       // Silent fail - don't block startup
     }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "mcpName": "io.github.vibecodinginc/vibe",
-  "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) — the /vibe kernel",
+  "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) \u2014 the /vibe kernel",
   "main": "index.js",
   "bin": {
     "slashvibe-mcp": "./cli.js",
@@ -17,7 +17,8 @@
     "version": "node scripts/sync-versions.js && git add server.json",
     "lint": "eslint . --ext .js",
     "lint:fix": "eslint . --ext .js --fix",
-    "test:pack": "node --test test/pack-artifact.test.mjs"
+    "test:pack": "node --test test/pack-artifact.test.mjs",
+    "test:release": "node scripts/release-conformance.mjs"
   },
   "keywords": [
     "mcp",

package/setup.js

@@ -93,8 +93,17 @@ function findClaudeConfig() {
     }
   }
 
-  // Default to ~/.claude.json (will create if doesn't exist)
-  return path.join(homeDir, '.claude.json');
+  // Nothing found. Returning a path anyway made setup report "→ Claude Code" and
+  // "configured" on machines with no Claude Code at all — a success message for work
+  // that helps nobody, and the reason "no supported host" was unreachable. Callers
+  // now get null and decide honestly; the default path is only for the create case,
+  // which is signalled explicitly.
+  return null;
+}
+
+/** Where we WOULD write a Claude Code config if the user wants one created. */
+function defaultClaudeConfigPath() {
+  return path.join(os.homedir(), '.claude.json');
 }
 
 /**
@@ -140,10 +149,18 @@ function addVibeToJsonConfig(configPath) {
 }
 
 /**
- * Configure Claude Code (~/.claude.json et al). Always runs.
+ * Configure Claude Code (~/.claude.json et al).
+ *
+ * Cursor and Codex only configure when their directories exist; Claude Code used to
+ * configure unconditionally, inventing ~/.claude.json on machines that had never run
+ * it. That is what made setup announce "→ Claude Code · configured" during a walk on
+ * a clean machine with no Claude Code installed. Same rule for all three hosts now:
+ * we write where the host actually lives, and say so honestly when none is found.
  */
-function configureClaudeCode() {
-  const configPath = findClaudeConfig();
+function configureClaudeCode({ createIfMissing = false } = {}) {
+  const found = findClaudeConfig();
+  const configPath = found || (createIfMissing ? defaultClaudeConfigPath() : null);
+  if (!configPath) return null; // Claude Code not installed here
   try {
     return { host: 'Claude Code', path: configPath, status: addVibeToJsonConfig(configPath) };
   } catch (e) {
@@ -231,19 +248,47 @@ function configureCodex() {
  * Configure every detected host. Returns results for the ones present.
  */
 function configureAllHosts() {
-  return [configureClaudeCode(), configureCodex(), configureCursor()].filter(Boolean);
+  const found = [configureClaudeCode(), configureCodex(), configureCursor()].filter(Boolean);
+  // No host detected at all — someone ran this before installing a coding agent, or
+  // in a container. Rather than silently doing nothing (or, as before, inventing a
+  // Claude Code config to have something to report), create the Claude Code config so
+  // /vibe is wired the moment they install it, and let the caller say which case it is.
+  if (found.length === 0) {
+    const created = configureClaudeCode({ createIfMissing: true });
+    return created ? [{ ...created, hostWasMissing: true }] : [];
+  }
+  return found;
 }
 
 /**
  * Test API connection
  */
 async function testConnection() {
+  // Found by actually RUNNING this on a clean machine, which no amount of reading
+  // the code surfaced: /api/health answers `{"status":"healthy"}`, and this asked
+  // for `'ok'`. So every first run — on a perfectly good connection — printed
+  // "Could not reach slashvibe.dev" and three troubleshooting steps, to a person
+  // whose very first experience of /vibe was being told it was broken.
+  //
+  // The client no longer guesses at the server's vocabulary. Reachability is what
+  // HTTP already answers; the body is only allowed to veto by reporting an explicit
+  // unhealthy state.
+  // Bounded: a hung connection must not leave a new user staring at a spinner with no
+  // way to know whether to wait. And "degraded" is not good enough to promise the next
+  // step will work — the very next thing setup does is an OAuth round trip.
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 8000);
   try {
-    const response = await fetch(`${API_BASE}/api/health`);
-    const data = await response.json();
-    return data.status === 'ok' || data.success;
+    const response = await fetch(`${API_BASE}/api/health`, { signal: controller.signal });
+    if (!response.ok) return false;
+    const data = await response.json().catch(() => ({}));
+    if (data.success === false) return false;
+    if (typeof data.status === 'string' && /unhealthy|degraded|down|error/i.test(data.status)) return false;
+    return true;
   } catch (e) {
     return false;
+  } finally {
+    clearTimeout(timer);
   }
 }
 
@@ -294,6 +339,13 @@ async function getOnlineUsers() {
  * Open URL in browser
  */
 function openBrowser(url) {
+  // Release conformance runs the real walk on a build machine; opening a browser there
+  // would authenticate against production as whoever that machine is signed in as.
+  // Nothing in normal use sets this.
+  if (process.env.VIBE_SETUP_STUB_BROWSER === '1') {
+    console.log(`${colors.dim}  (browser suppressed for conformance run)${colors.reset}`);
+    return;
+  }
   const platform = process.platform;
   let command;
 
@@ -348,10 +400,18 @@ async function setup() {
   // Step 1: Detect coding agents on this machine
   printStep(1, 'Detecting coding agents...', 'running');
   const homeDir = os.homedir();
-  const detected = ['Claude Code']; // always configured
+  // Detection reports what is HERE. `['Claude Code'] // always configured` was a
+  // detection step that had already decided its answer: a machine with no Claude Code
+  // was still told "→ Claude Code". #115 made the configuration honest but left this
+  // line printing the old claim, which is the difference between fixing the internals
+  // and fixing what a person actually reads.
+  const detected = [];
+  if (findClaudeConfig()) detected.push('Claude Code');
   if (fs.existsSync(codexHome())) detected.push('Codex');
   if (fs.existsSync(path.join(homeDir, '.cursor'))) detected.push('Cursor');
-  console.log(`${colors.dim}     → ${detected.join(', ')}${colors.reset}`);
+  console.log(detected.length
+    ? `${colors.dim}     → ${detected.join(', ')}${colors.reset}`
+    : `${colors.dim}     → none yet — setting up Claude Code so /vibe is ready when you install it${colors.reset}`);
   printStep(1, 'Detecting coding agents...', 'done');
 
   // Step 2: Add /vibe MCP server to every detected host
@@ -362,7 +422,8 @@ async function setup() {
       : r.status === 'exists' ? 'already configured'
       : `failed: ${r.error}`;
     const icon = r.status === 'error' ? colors.yellow + '!' : colors.green + '✓';
-    console.log(`     ${icon}${colors.reset} ${r.host} ${colors.dim}— ${note} (${r.path})${colors.reset}`);
+    const label = r.hostWasMissing ? `${r.host} ${colors.dim}(not installed yet)` : r.host;
+    console.log(`     ${icon}${colors.reset} ${label} ${colors.dim}— ${note} (${r.path})${colors.reset}`);
   }
   const configuredCount = hostResults.filter(r => r.status !== 'error').length;
   if (configuredCount === 0) {
@@ -498,8 +559,25 @@ async function setup() {
   }
 }
 
-// Run setup when this file is loaded (invoked by cli.js or npx vibe-setup)
-setup().catch(err => {
-  console.error(`${colors.red}Setup failed: ${err.message}${colors.reset}`);
-  process.exit(1);
-});
+// Run setup when this file is loaded (invoked by cli.js or npx vibe-setup).
+//
+// Requiring this module USED to be indistinguishable from running it, which is a
+// live hazard rather than a style point: it means anything that so much as inspects
+// setup.js opens a browser, writes host configs and authenticates against production.
+// It happened during a rehearsal. VIBE_SETUP_NO_AUTORUN lets a caller load the module
+// to look at it — nothing in normal use sets that variable.
+if (process.env.VIBE_SETUP_NO_AUTORUN !== '1') {
+  setup().catch(err => {
+    console.error(`${colors.red}Setup failed: ${err.message}${colors.reset}`);
+    process.exit(1);
+  });
+}
+
+// Named exports for tests and for callers that want a piece rather than the whole
+// ceremony. Deliberately narrow.
+module.exports = {
+  setup,
+  findClaudeConfig,
+  configureAllHosts,
+  testConnection,
+};

package/tools/_shared.js

@@ -6,6 +6,7 @@
  */
 
 const config = require('../config');
+const { inertField } = require('../incoming');
 const store = require('../store');
 
 // ─────────────────────────────────────────────────────────────
@@ -255,12 +256,18 @@ function pickDormantTarget(others) {
   // strip any double quotes/backslashes the ship text itself contains (ship
   // content is arbitrary) and single-quote the snippet — otherwise an embedded
   // quote closes the command early and breaks the paste.
+  // NO FOREIGN TEXT INSIDE A COMMAND WE ARE SUGGESTING SOMEONE RUN.
+  //
+  // The opener used to quote another user's ship description inside a ready-to-run
+  // `vibe dm @x "..."` line. Inerting it (collapsing newlines, defanging markup) made
+  // the injection harder but kept the wrong shape: attacker-authored words sitting in
+  // an executable-looking instruction. The fix is not better escaping — it is that
+  // the command contains only OUR words. What they shipped is shown separately, as
+  // labelled data, where it belongs.
   const rawShip = pick.lastShip && pick.lastShip.what;
-  const shipped = rawShip ? String(rawShip).replace(/["\\]/g, '').trim().slice(0, 48) : '';
-  const opener = shipped
-    ? `hey! saw you shipped '${shipped}' — what are you building?`
-    : `hey! what are you building?`;
-  return { handle: pick.handle, opener };
+  const shippedNote = rawShip ? inertField(rawShip, 48) : '';
+  const opener = 'hey! what are you building?';
+  return { handle: pick.handle, opener, shippedNote };
 }
 
 /**
@@ -278,8 +285,14 @@ function firstDmNudge(others, threads) {
   if (hasEverMessaged(threads)) return '';
   const target = pickDormantTarget(others);
   if (!target) return '';
+  // What they shipped is shown as DATA, on its own line, outside the command — the
+  // command itself contains only our words.
+  const context = target.shippedNote
+    ? `\n   _they last shipped:_ "${target.shippedNote}"`
+    : '';
   return (
     `\n\n**👋 You haven't messaged anyone yet — @${target.handle} is around right now:**` +
+    context +
     `\n   vibe dm @${target.handle} "${target.opener}"`
   );
 }

package/version.json

@@ -1,14 +1,12 @@
 {
-  "version": "0.8.3",
+  "version": "0.8.5",
   "updated": "2026-07-31",
-  "changelog": "Security release, and the one that reaches the door people actually use. A clean install runs `npx slashvibe-mcp`, which had its own separate sign-in code \u2014 so the fixes shipped in 0.8.2 were never on that path. There is now one sign-in implementation: the listener binds before the browser opens, each attempt is tagged so another process's login can never land in yours, two sign-ins at once both work, and a slow sign-in gets a page explaining itself instead of a browser error. Identity is one thing everywhere \u2014 pasting a token no longer leaves your requests going out as the previous account, and presence announces the account your credential names rather than one read from a file. A message someone sends you is never placed next to an instruction telling your agent to reply.",
+  "changelog": "Identity is one thing now. Whoever your credential says you are is who the client shows, routes and self-checks as \u2014 previously a saved handle could name one account while requests went out as another. Presence waits for the server to confirm you before it turns green, so a stale or forged session no longer announces itself. Changing your handle is turned off for now: your messages and tasks are still tied to it, and both rename paths are closed rather than one. A suggested first message no longer contains anyone else's words.",
   "features": [
-    "One sign-in path for terminal setup and vibe_init \u2014 the invite path has the fixes",
-    "Each sign-in attempt is tagged; a concurrent login cannot land in your session",
-    "Two sign-ins at once both work (port falls back instead of colliding)",
-    "vibe_token switches the whole session, not half of it",
-    "Presence names the account your credential names",
-    "Inbound messages are never seated beside an instruction to act on them"
+    "The credential names you everywhere the client asks who you are",
+    "Presence turns green only after the server confirms the session",
+    "Handle changes are off \u2014 both routes, not one \u2014 until ownership moves off handles",
+    "Suggested messages contain only our words; what someone shipped is shown as data"
   ],
   "deprecated": [],
   "breaking": false,