slashvibe-mcp 0.8.4 → 0.8.5

package/config.js

@@ -104,6 +104,26 @@ function save(config) {
 }
 
 function getHandle() {
+  // THE CREDENTIAL NAMES US — the files below are only what we knew before one loaded.
+  //
+  // Twenty-eight call sites across the tools read this function, and it answered from
+  // disk independently of the token those same tools authenticate with. That is the
+  // split identity reproduced in review: a token for account A while display and
+  // self-checks said account B, so a tool could route a message to "you" that the
+  // server had authored as someone else. Fixing it at each call site would have been
+  // twenty-eight chances to miss one; fixing it here makes every reader correct at
+  // once, and leaves exactly one place that decides.
+  //
+  // Required lazily: auth-store loads config during hydration, and a top-level import
+  // here would close that circle.
+  try {
+    const authStore = require('./auth-store');
+    const fromCredential = authStore.getHandle();
+    if (fromCredential) return fromCredential;
+  } catch (e) {
+    // auth-store unavailable (early boot) — fall through to what is on disk.
+  }
+
   // Prefer session-specific handle over shared config
   const sessionHandle = getSessionHandle();
   if (sessionHandle) return sessionHandle;

package/index.js

@@ -65,8 +65,19 @@ const NO_AUTH_REQUIRED = new Set([
   'vibe_start', 'vibe_init', 'vibe_token', 'vibe_who', 'vibe_help'
 ]);
 
-// Single source of truth for "is this session signed in" — token or OAuth.
-const isAuthed = () => authStore.isAuthenticated() || config.hasOAuth();
+// "Is this session signed in" — the credential answers, not the filesystem.
+//
+// This used to OR in config.hasOAuth(), which asks a FILE. That made disk a second
+// authority: a leftover config could unlock the authenticated tool surface for a
+// session holding no usable credential. authStore already consults disk during
+// hydration and refuses anything it cannot attribute, so it is the one place that
+// should decide.
+//
+// Deliberately NOT gated on isVerified(): verification needs the network, and a
+// person on a plane should still see their tools and get a clear error from the
+// server rather than a surface that silently empties. Verification gates the things
+// that must never be a guess — the green dot and any claim about who you are.
+const isAuthed = () => authStore.isAuthenticated();
 
 // Infer user prompt from tool arguments (for pattern logging).
 // Cases exist only for registered tools whose args improve on the default.
@@ -674,13 +685,37 @@ class VibeMCPServer {
       const handle = authStore.getHandle();
       if (!handle || !authStore.isAuthenticated()) return;
 
+      // ASK THE SERVER BEFORE CLAIMING ANYTHING.
+      //
+      // I added an explicit verified-vs-saved state and then gated nothing on it, so
+      // this still announced on the strength of "a token-shaped string exists on
+      // disk". A forged JWT-shaped value in config or Buddy's auth.json produced a
+      // confident "🟢 Auto-connected as @victim" and a heartbeat against production.
+      // Holding a credential is not the same as having one that works, and the green
+      // dot is the one thing in this product that must never be a guess.
+      let verified;
+      try {
+        verified = await store.verifyAuthToken(authStore.getToken());
+      } catch (e) {
+        verified = null;
+      }
+      if (!verified || !verified.valid) {
+        // Definitive rejection means the session is dead; unreachable means unknown.
+        // Neither earns a green dot, and neither is worth shouting about at startup.
+        if (verified && verified.definitive) {
+          process.stderr.write('/vibe: saved session is no longer valid — say "vibe init" to sign in again\n');
+        }
+        return;
+      }
+      authStore.markVerified(verified.handle);
+
       const one_liner = config.getOneLiner() || '';
 
-      // Start presence heartbeat
-      presence.start(handle, one_liner);
+      // Start presence heartbeat — now, and only now, is this handle a fact.
+      presence.start(authStore.getHandle(), one_liner);
 
       // Log quietly (only to stderr, not intrusive)
-      process.stderr.write(`🟢 Auto-connected as @${handle}\n`);
+      process.stderr.write(`🟢 Auto-connected as @${authStore.getHandle()}\n`);
     } catch (error) {
       // Silent fail - don't block startup
     }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "mcpName": "io.github.vibecodinginc/vibe",
-  "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) — the /vibe kernel",
+  "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) \u2014 the /vibe kernel",
   "main": "index.js",
   "bin": {
     "slashvibe-mcp": "./cli.js",
@@ -17,7 +17,8 @@
     "version": "node scripts/sync-versions.js && git add server.json",
     "lint": "eslint . --ext .js",
     "lint:fix": "eslint . --ext .js --fix",
-    "test:pack": "node --test test/pack-artifact.test.mjs"
+    "test:pack": "node --test test/pack-artifact.test.mjs",
+    "test:release": "node scripts/release-conformance.mjs"
   },
   "keywords": [
     "mcp",

package/setup.js

@@ -273,15 +273,22 @@ async function testConnection() {
   // The client no longer guesses at the server's vocabulary. Reachability is what
   // HTTP already answers; the body is only allowed to veto by reporting an explicit
   // unhealthy state.
+  // Bounded: a hung connection must not leave a new user staring at a spinner with no
+  // way to know whether to wait. And "degraded" is not good enough to promise the next
+  // step will work — the very next thing setup does is an OAuth round trip.
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 8000);
   try {
-    const response = await fetch(`${API_BASE}/api/health`);
+    const response = await fetch(`${API_BASE}/api/health`, { signal: controller.signal });
     if (!response.ok) return false;
     const data = await response.json().catch(() => ({}));
     if (data.success === false) return false;
-    if (typeof data.status === 'string' && /unhealthy|down|error/i.test(data.status)) return false;
+    if (typeof data.status === 'string' && /unhealthy|degraded|down|error/i.test(data.status)) return false;
     return true;
   } catch (e) {
     return false;
+  } finally {
+    clearTimeout(timer);
   }
 }
 
@@ -332,6 +339,13 @@ async function getOnlineUsers() {
  * Open URL in browser
  */
 function openBrowser(url) {
+  // Release conformance runs the real walk on a build machine; opening a browser there
+  // would authenticate against production as whoever that machine is signed in as.
+  // Nothing in normal use sets this.
+  if (process.env.VIBE_SETUP_STUB_BROWSER === '1') {
+    console.log(`${colors.dim}  (browser suppressed for conformance run)${colors.reset}`);
+    return;
+  }
   const platform = process.platform;
   let command;
 
@@ -386,10 +400,18 @@ async function setup() {
   // Step 1: Detect coding agents on this machine
   printStep(1, 'Detecting coding agents...', 'running');
   const homeDir = os.homedir();
-  const detected = ['Claude Code']; // always configured
+  // Detection reports what is HERE. `['Claude Code'] // always configured` was a
+  // detection step that had already decided its answer: a machine with no Claude Code
+  // was still told "→ Claude Code". #115 made the configuration honest but left this
+  // line printing the old claim, which is the difference between fixing the internals
+  // and fixing what a person actually reads.
+  const detected = [];
+  if (findClaudeConfig()) detected.push('Claude Code');
   if (fs.existsSync(codexHome())) detected.push('Codex');
   if (fs.existsSync(path.join(homeDir, '.cursor'))) detected.push('Cursor');
-  console.log(`${colors.dim}     → ${detected.join(', ')}${colors.reset}`);
+  console.log(detected.length
+    ? `${colors.dim}     → ${detected.join(', ')}${colors.reset}`
+    : `${colors.dim}     → none yet — setting up Claude Code so /vibe is ready when you install it${colors.reset}`);
   printStep(1, 'Detecting coding agents...', 'done');
 
   // Step 2: Add /vibe MCP server to every detected host
@@ -400,7 +422,8 @@ async function setup() {
       : r.status === 'exists' ? 'already configured'
       : `failed: ${r.error}`;
     const icon = r.status === 'error' ? colors.yellow + '!' : colors.green + '✓';
-    console.log(`     ${icon}${colors.reset} ${r.host} ${colors.dim}— ${note} (${r.path})${colors.reset}`);
+    const label = r.hostWasMissing ? `${r.host} ${colors.dim}(not installed yet)` : r.host;
+    console.log(`     ${icon}${colors.reset} ${label} ${colors.dim}— ${note} (${r.path})${colors.reset}`);
   }
   const configuredCount = hostResults.filter(r => r.status !== 'error').length;
   if (configuredCount === 0) {
@@ -536,8 +559,25 @@ async function setup() {
   }
 }
 
-// Run setup when this file is loaded (invoked by cli.js or npx vibe-setup)
-setup().catch(err => {
-  console.error(`${colors.red}Setup failed: ${err.message}${colors.reset}`);
-  process.exit(1);
-});
+// Run setup when this file is loaded (invoked by cli.js or npx vibe-setup).
+//
+// Requiring this module USED to be indistinguishable from running it, which is a
+// live hazard rather than a style point: it means anything that so much as inspects
+// setup.js opens a browser, writes host configs and authenticates against production.
+// It happened during a rehearsal. VIBE_SETUP_NO_AUTORUN lets a caller load the module
+// to look at it — nothing in normal use sets that variable.
+if (process.env.VIBE_SETUP_NO_AUTORUN !== '1') {
+  setup().catch(err => {
+    console.error(`${colors.red}Setup failed: ${err.message}${colors.reset}`);
+    process.exit(1);
+  });
+}
+
+// Named exports for tests and for callers that want a piece rather than the whole
+// ceremony. Deliberately narrow.
+module.exports = {
+  setup,
+  findClaudeConfig,
+  configureAllHosts,
+  testConnection,
+};

package/tools/_shared.js

@@ -6,6 +6,7 @@
  */
 
 const config = require('../config');
+const { inertField } = require('../incoming');
 const store = require('../store');
 
 // ─────────────────────────────────────────────────────────────
@@ -255,12 +256,18 @@ function pickDormantTarget(others) {
   // strip any double quotes/backslashes the ship text itself contains (ship
   // content is arbitrary) and single-quote the snippet — otherwise an embedded
   // quote closes the command early and breaks the paste.
+  // NO FOREIGN TEXT INSIDE A COMMAND WE ARE SUGGESTING SOMEONE RUN.
+  //
+  // The opener used to quote another user's ship description inside a ready-to-run
+  // `vibe dm @x "..."` line. Inerting it (collapsing newlines, defanging markup) made
+  // the injection harder but kept the wrong shape: attacker-authored words sitting in
+  // an executable-looking instruction. The fix is not better escaping — it is that
+  // the command contains only OUR words. What they shipped is shown separately, as
+  // labelled data, where it belongs.
   const rawShip = pick.lastShip && pick.lastShip.what;
-  const shipped = rawShip ? String(rawShip).replace(/["\\]/g, '').trim().slice(0, 48) : '';
-  const opener = shipped
-    ? `hey! saw you shipped '${shipped}' — what are you building?`
-    : `hey! what are you building?`;
-  return { handle: pick.handle, opener };
+  const shippedNote = rawShip ? inertField(rawShip, 48) : '';
+  const opener = 'hey! what are you building?';
+  return { handle: pick.handle, opener, shippedNote };
 }
 
 /**
@@ -278,8 +285,14 @@ function firstDmNudge(others, threads) {
   if (hasEverMessaged(threads)) return '';
   const target = pickDormantTarget(others);
   if (!target) return '';
+  // What they shipped is shown as DATA, on its own line, outside the command — the
+  // command itself contains only our words.
+  const context = target.shippedNote
+    ? `\n   _they last shipped:_ "${target.shippedNote}"`
+    : '';
   return (
     `\n\n**👋 You haven't messaged anyone yet — @${target.handle} is around right now:**` +
+    context +
     `\n   vibe dm @${target.handle} "${target.opener}"`
   );
 }

package/version.json

@@ -1,10 +1,12 @@
 {
-  "version": "0.8.4",
+  "version": "0.8.5",
   "updated": "2026-07-31",
-  "changelog": "Setup told every new user the service was unreachable. The health check asked the server for one word and the server answers another, so step 3 of every first run reported 'could not reach slashvibe.dev' \u2014 with troubleshooting steps \u2014 to people whose connection was fine. Fixed by letting HTTP answer reachability instead of guessing at vocabulary. Setup also claimed to configure Claude Code on machines that had never installed it; all three coding agents are now detected the same way.",
+  "changelog": "Identity is one thing now. Whoever your credential says you are is who the client shows, routes and self-checks as \u2014 previously a saved handle could name one account while requests went out as another. Presence waits for the server to confirm you before it turns green, so a stale or forged session no longer announces itself. Changing your handle is turned off for now: your messages and tasks are still tied to it, and both rename paths are closed rather than one. A suggested first message no longer contains anyone else's words.",
   "features": [
-    "The connection test agrees with the server it is testing",
-    "Coding agents are detected, not assumed \u2014 no more configuring a host you don't have"
+    "The credential names you everywhere the client asks who you are",
+    "Presence turns green only after the server confirms the session",
+    "Handle changes are off \u2014 both routes, not one \u2014 until ownership moves off handles",
+    "Suggested messages contain only our words; what someone shipped is shown as data"
   ],
   "deprecated": [],
   "breaking": false,