slashvibe-mcp 0.8.5 → 0.8.7

package/auth-store.js

@@ -26,6 +26,10 @@ let _hydrated = false;
 // unlocking a tool on the strength of a filename is how a green dot comes to mean
 // nothing (issues #107, #110).
 let _verified = false;
+// We held a credential and could not tell whose it was. Distinct from "no credential":
+// signed out is an honest state, but a rejected token means the name on disk is not
+// backed by anything, and nothing may present it as the current identity (#107/#110).
+let _rejected = false;
 
 /**
  * Hydrate auth state from disk (call once at MCP startup)
@@ -83,6 +87,7 @@ function hydrate() {
       // A token we cannot attribute is one we must not act under.
       console.error('[auth-store] Token carries no identity — treating as signed out');
       _token = null;
+      _rejected = true;
     } else if (_token && stored && stored !== _handle) {
       console.error(
         `[auth-store] Stored handle @${stored} does not own this session — acting as @${_handle}`
@@ -112,12 +117,13 @@ function setToken(token, { verified = false } = {}) {
       // Same rule hydrate() applies, applied here too — a credential we cannot
       // attribute must not become the session.
       console.error('[auth-store] Refusing a token with no identity');
-      _token = null; _handle = null; _verified = false;
+      _token = null; _handle = null; _verified = false; _rejected = true;
       return;
     }
   }
 
   const hadToken = !!_token;
+  _rejected = false;
   _token = token;
   _verified = !!token && verified;
 
@@ -152,6 +158,25 @@ function getToken() {
  * @param {string} handle - User handle (without @)
  */
 function setHandle(handle) {
+  // A handle may be REMEMBERED, never asserted over a credential.
+  //
+  // `vibe_init` called this immediately after setToken(), passing the callback's separate
+  // `handle` field — so the identity derived from the token was overwritten by a value
+  // that merely travelled alongside it. When they agree nothing happens; when they
+  // disagree the client acts as one principal and displays another, which is issue #107
+  // recreated at the exact moment a new person signs in.
+  //
+  // tests/identity-binding.test.js did not catch it: it asserts setToken() AFTER
+  // setHandle(), where the token re-anchors. The real order is the reverse.
+  if (_token) {
+    const owner = handleFromToken(_token);
+    if (owner && handle && handle !== owner) {
+      console.error(
+        `[auth-store] Ignoring handle @${handle} — this credential belongs to @${owner}`
+      );
+      return;
+    }
+  }
   _handle = handle;
 }
 
@@ -163,6 +188,52 @@ function getHandle() {
   return _handle;
 }
 
+/**
+ * Did we hold a credential we could not attribute?
+ *
+ * "Signed out" and "signed in as nobody" look identical from `getHandle()` — both null.
+ * They are not the same fact, and callers that fall back to a remembered name need to
+ * tell them apart: with no credential the name on disk is the best we have, but with a
+ * REJECTED one it is a name nothing supports (#110).
+ *
+ * @returns {boolean}
+ */
+function hasRejectedCredential() {
+  return _rejected;
+}
+
+/**
+ * Is a stored credential actually usable right now?
+ *
+ * "A token exists" and "you are signed in" are different facts, and conflating them is
+ * how `npx slashvibe-mcp` came to answer "/vibe is configured" on a machine holding a
+ * credential that had expired 23 days earlier — then advise restarting the coding agent,
+ * which cannot help. The file existed, so the check passed.
+ *
+ * Local and cheap: decodes `exp` rather than asking the server, because this runs on the
+ * recovery path where the network may be the thing that is wrong. It cannot prove a token
+ * is GOOD — only the server can — but it reliably catches the case that actually stranded
+ * someone, which is a credential that is definitively over.
+ *
+ * @returns {{ ok: boolean, reason: 'none'|'unattributable'|'expired'|'usable', handle: string|null, expiresAt: number|null }}
+ */
+function inspectToken(token) {
+  if (!token) return { ok: false, reason: 'none', handle: null, expiresAt: null };
+  const who = handleFromToken(token);
+  if (!who) return { ok: false, reason: 'unattributable', handle: null, expiresAt: null };
+  let exp = null;
+  try {
+    const part = String(token).split('.')[1];
+    exp = JSON.parse(Buffer.from(part, 'base64url').toString('utf8')).exp ?? null;
+  } catch { exp = null; }
+  // No exp claim is not a failure — legacy tokens carry none, and refusing them here
+  // would sign people out to fix a display bug.
+  if (exp && exp * 1000 <= Date.now()) {
+    return { ok: false, reason: 'expired', handle: who, expiresAt: exp * 1000 };
+  }
+  return { ok: true, reason: 'usable', handle: who, expiresAt: exp ? exp * 1000 : null };
+}
+
 /**
  * Set one-liner (what user is building)
  * @param {string} oneLiner - One-liner description
@@ -210,6 +281,16 @@ function clear() {
   _handle = null;
   _oneLiner = null;
   _verified = false;
+  _rejected = false;
+  // Clearing must also forget that we ever loaded, or `hydrate()` returns early forever
+  // and the store stays empty while disk holds a perfectly good credential. Everything
+  // that reads identity then falls through to the file — which is issue #107 reappearing
+  // by a different route, and silently, since the file usually names the right person.
+  //
+  // NOTE for whoever wires logout to this: clearing memory is not signing out. Disk is
+  // re-read on the next question, so a logout must also remove the credential from
+  // config.json — otherwise the session comes straight back.
+  _hydrated = false;
   console.error('[auth-store] Cleared');
 }
 
@@ -233,6 +314,8 @@ module.exports = {
   getToken,
   setHandle,
   getHandle,
+  hasRejectedCredential,
+  inspectToken,
   setOneLiner,
   getOneLiner,
   isAuthenticated,

package/cli.js

@@ -19,12 +19,38 @@ if (args.includes('setup')) {
 } else if (process.stdin.isTTY) {
   // Running from terminal (not as MCP server)
   const config = require('./config');
-  if (!config.isInitialized() && !config.getAuthToken()) {
-    // Not authenticated — auto-trigger setup
+  const authStore = require('./auth-store');
+
+  // A TOKEN EXISTING IS NOT BEING SIGNED IN.
+  //
+  // This used to pass on `config.getAuthToken()` being truthy, which is true of a
+  // credential that expired months ago. On a Mac Studio holding a token 23 days dead it
+  // printed "/vibe is configured" and suggested restarting the coding agent — advice that
+  // cannot help, given to someone whose only real problem was that they were signed out.
+  // The recovery path told them there was nothing to recover.
+  const cred = authStore.inspectToken(config.getAuthToken());
+
+  if (!config.isInitialized() && !cred.ok) {
+    // Never signed in — set up.
+    require('./setup.js');
+  } else if (!cred.ok && cred.reason !== 'none') {
+    // Signed in once, not any more. Say which, and fix it rather than describing it.
+    const when = cred.expiresAt
+      ? ` (it expired ${Math.max(1, Math.round((Date.now() - cred.expiresAt) / 86400000))} days ago)`
+      : '';
+    console.log(cred.handle
+      ? `Your /vibe sign-in for @${cred.handle} is no longer valid${when}.`
+      : `Your /vibe sign-in is no longer valid${when}.`);
+    console.log('Signing you back in...');
+    console.log('');
     require('./setup.js');
   } else {
-    // Already set up — show status
-    console.log('/vibe is configured. Restart your coding agent (Claude Code / Codex / Cursor) to connect.');
+    // Genuinely signed in — say WHO, because a status line that cannot name you is the
+    // one that hid this in the first place.
+    console.log(cred.handle
+      ? `/vibe is configured — signed in as @${cred.handle}.`
+      : '/vibe is configured.');
+    console.log('Restart your coding agent (Claude Code / Codex / Cursor) to connect.');
     console.log('');
     console.log('Commands:');
     console.log('  npx slashvibe-mcp setup   — re-run setup wizard');

package/config.js

@@ -116,10 +116,25 @@ function getHandle() {
   //
   // Required lazily: auth-store loads config during hydration, and a top-level import
   // here would close that circle.
+  //
+  // We hydrate here rather than assuming someone already did. The store answers from
+  // memory, so before hydration it answers null — and this function would quietly fall
+  // through to the file, which is the exact bug above. That made the fix depend on an
+  // ordering nothing enforced: correct inside the MCP server (which hydrates in its
+  // constructor) and wrong in any script, CLI path or test that reads identity first.
+  // A guarantee that holds only when called in the right order is not a guarantee.
+  // hydrate() is idempotent and reads two files it has usually already read.
   try {
     const authStore = require('./auth-store');
+    authStore.hydrate();
     const fromCredential = authStore.getHandle();
     if (fromCredential) return fromCredential;
+
+    // A credential was present and could not be attributed. The remembered name below
+    // must NOT step in: it would put a handle on screen that nothing backs, which is
+    // this bug wearing the file's clothes. No credential at all is a different and
+    // honest state, and falls through.
+    if (authStore.hasRejectedCredential()) return null;
   } catch (e) {
     // auth-store unavailable (early boot) — fall through to what is on disk.
   }

package/index.js

@@ -241,7 +241,10 @@ async function getPresenceFooter() {
 
     // The status line. Counts only — no mood inference, no nudges.
     const parts = ['vibe'];
-    if (onlineCount > 0) parts.push(`${onlineCount} online`);
+    // "2 online" under a board showing three rows — one of them you — reads as a
+    // contradiction, even though both numbers are right. The footer counts the room
+    // AROUND you, so it should say so.
+    if (onlineCount > 0) parts.push(`${onlineCount} other${onlineCount === 1 ? '' : 's'}`);
     if (unreadCount > 0) parts.push(`**${unreadCount} unread**`);
     if (liveCount > 0) parts.push(`${liveCount} live`);
     let footer = `\n\n────────────────────────\n${parts.join(' · ')}`;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.8.5",
+  "version": "0.8.7",
   "mcpName": "io.github.vibecodinginc/vibe",
-  "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) \u2014 the /vibe kernel",
+  "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) — the /vibe kernel",
   "main": "index.js",
   "bin": {
     "slashvibe-mcp": "./cli.js",

package/setup.js

@@ -39,7 +39,7 @@ const API_BASE = 'https://www.slashvibe.dev';
 function printBanner() {
   console.log(`
 ${colors.green}  █░█ █ █▄▄ █▀▀${colors.reset}
-${colors.green}  ▀▄▀ █ █▄█ ██▄${colors.reset}   ${colors.dim}ship together${colors.reset}
+${colors.green}  ▀▄▀ █ █▄█ ██▄${colors.reset}   ${colors.dim}ask here · answer there${colors.reset}
   ──────────────────────────────────────────────────
 `);
 }
@@ -274,8 +274,23 @@ async function testConnection() {
   // HTTP already answers; the body is only allowed to veto by reporting an explicit
   // unhealthy state.
   // Bounded: a hung connection must not leave a new user staring at a spinner with no
-  // way to know whether to wait. And "degraded" is not good enough to promise the next
-  // step will work — the very next thing setup does is an OAuth round trip.
+  // way to know whether to wait.
+  //
+  // "DEGRADED" IS NOT UNREACHABLE, and treating it as such blocked every new install on
+  // 2026-08-01. Upstash hit a quota wall, /api/health honestly reported `degraded`
+  // because a CACHE was down, and this returned false — so setup told people "Could not
+  // reach slashvibe.dev" and advised them to check their internet connection, about a
+  // site that was serving perfectly.
+  //
+  // The reasoning in the version that did this was mine and it was wrong: I blocked on
+  // degraded because "the next step is an OAuth round trip". OAuth does not touch the
+  // cache. A partial-capability signal about a subsystem we do not need is not a reason
+  // to refuse someone the product, and "we cannot reach the server" is not a true thing
+  // to say when we just did.
+  //
+  // Only an explicitly unhealthy service blocks. Everything else proceeds, because the
+  // OAuth round trip that follows is a better test of what setup actually needs than any
+  // status string.
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), 8000);
   try {
@@ -283,7 +298,7 @@ async function testConnection() {
     if (!response.ok) return false;
     const data = await response.json().catch(() => ({}));
     if (data.success === false) return false;
-    if (typeof data.status === 'string' && /unhealthy|degraded|down|error/i.test(data.status)) return false;
+    if (typeof data.status === 'string' && /\bunhealthy\b|\bdown\b/i.test(data.status)) return false;
     return true;
   } catch (e) {
     return false;

package/store/api.js

@@ -355,6 +355,28 @@ async function getActiveUsers() {
     const liveAgents = (result.agents || []).filter(a => a.isLive && a.broadcastRoom);
     const users = [...(result.active || []), ...(result.away || []), ...liveAgents];
 
+    // SIGNED OUT IS NOT AN EMPTY ROOM.
+    //
+    // When the caller has no valid credential the server answers `anonymous: true` with
+    // empty lists and PUBLIC COUNTS — "2 people are here, sign in to see who". This
+    // function used to return only the mapped array, so every caller saw `[]` and could
+    // not tell the two apart. `vibe_who` rendered it as "Quiet right now — you're the
+    // only one here", which is the most damaging sentence this product can say: the
+    // entire promise is that other people are there, and a signed-out user was told the
+    // room was dead. Observed on the Mac Studio 2026-08-01 with a token that had expired
+    // 23 days earlier, while four people were actually online.
+    //
+    // Attached to the array rather than changing the return type because sixteen call
+    // sites read this as a list. Callers that do not care are unaffected; callers that
+    // render a claim about the room now have what they need to be honest.
+    // Two shapes mean the same thing. v1 answers 200 with `anonymous: true` and public
+    // COUNTS; v2 answers a hard 401 and no counts at all. Both are "we cannot see who is
+    // here", and neither is "nobody is here" — so both must reach the caller as the same
+    // fact, with counts present only when the server actually supplied them. Claiming
+    // "0 people are here" because we lack a number would swap one false statement for
+    // another.
+    const unauthenticated = result?.anonymous === true || result?.statusCode === 401;
+
     // Map to normalized format (v2 uses 'handle', v1 uses 'username')
     const mappedUsers = users.map(u => ({
       handle: u.handle || u.username,
@@ -400,6 +422,14 @@ async function getActiveUsers() {
       // Non-fatal: profiles module may not be available in some contexts
     }
 
+    // On the RETURNED array, not the intermediate `users` — they are different objects
+    // and attaching to the wrong one is a silent no-op that reads as "the signal is not
+    // there" rather than as a bug.
+    Object.defineProperties(mappedUsers, {
+      anonymous: { value: unauthenticated, enumerable: false },
+      counts: { value: result?.counts || null, enumerable: false },
+    });
+
     return mappedUsers;
   } catch (e) {
     console.error('Who failed:', e.message);

package/tools/dm.js

@@ -110,10 +110,27 @@ async function handler(args) {
     origin: origin || 'composed',
   });
 
-  // Check for errors
+  // Check for errors.
+  //
+  // The generic tail — "please try again, check your connection" — used to be appended
+  // to EVERY failure, including the ones that already name their own fix. An expired
+  // session then read as: run `vibe init`, and also try again, and also check your
+  // connection. Three instructions, two of them wrong, at the moment someone's first
+  // message failed. docs/ROOM-TONE.md: an error names the fix in the same sentence as
+  // the problem — which means not adding a second, contradictory one after it.
+  //
+  // Errors carrying a specific remedy (auth_expired, not_signed_in, handle_not_found)
+  // are shown as-is. Only genuinely unknown failures get the retry hint.
   if (result && result.error) {
+    const REMEDY_CARRYING = new Set([
+      'auth_expired', 'not_signed_in', 'auth_failed',
+      'handle_not_found', 'self_dm', 'storage_error',
+    ]);
+    const detail = result.message || 'the message did not send.';
     return {
-      display: `❌ **Failed to send message**\n\n${result.message}\n\n_Please try again. If the problem persists, check your connection._`
+      display: REMEDY_CARRYING.has(result.error)
+        ? detail
+        : `${detail}\n\n_worth one retry — if it keeps failing, say_ \`vibe doctor\`_._`,
     };
   }
 

package/tools/inbox.js

@@ -183,7 +183,7 @@ async function handler(args) {
     // If there are guest messages but no DMs, show guest messages
     if (guestSection) {
       return {
-        display: guestSection + '📭 No DM threads yet. Say "dm @someone" to start.',
+        display: guestSection + '📭 no messages yet — say "dm @someone" to start one.',
         actions: formatActions(actions.recommendedConnections([]))
       };
     }
@@ -197,6 +197,9 @@ async function handler(args) {
           'All caught up!',
           'No messages yet.'
         );
+        // NOTE: reachable only with VIBE_EXTRAS — the suggestion block is off by
+        // default (private fabric: no proposing strangers). The default empty inbox
+        // is the branch below.
         return {
           display,
           actions: recommendations.actions
@@ -206,20 +209,17 @@ async function handler(args) {
       console.log('[inbox] recommendations error:', e.message);
     }
 
-    // Fallback: Check onboarding status to customize CTA
-    let cta = 'Say "dm @someone" to start';
-    try {
-      const checklist = await store.getChecklistStatus(myHandle);
-      if (checklist.success && checklist.tasks) {
-        const repliedToSeth = checklist.tasks.find(t => t.id === 'reply_seth')?.done;
-        if (!repliedToSeth) {
-          cta = 'Reply to @vibe to get started!';
-        }
-      }
-    } catch (e) {}
-
+    // THE FIRST SCREEN A NEW INVITEE SEES. Designed, not apologised for: an empty
+    // room should say what to do next in the same breath as being empty.
+    //
+    // The old copy pointed at "@vibe" — a system account — as the thing to reply to.
+    // Under docs/PRIVATE-FABRIC.md you are here because a PERSON invited you, and the
+    // useful first move is answering them, not a bot.
     return {
-      display: `📭 No messages yet. ${cta}`,
+      display:
+        '📭 no messages yet.\n\n' +
+        '_whoever invited you is the place to start:_ `dm @them`\n' +
+        "_they'll get it in their next session — neither of you has to be online._",
       actions: formatActions(actions.recommendedConnections([]))
     };
   }
@@ -284,10 +284,15 @@ async function handler(args) {
       console.log('[inbox] recommendations error:', e.message);
     }
 
-    // Fallback: show recent threads
-    const recentHandles = sorted.slice(0, 3).map(t => `@${t.handle}`).join(', ');
+    // Caught up, WITH history — a different state from "you just arrived", and they
+    // were rendering as the same sentence. "Recent: @a, @b, @c" also named the
+    // handles without saying what they were: recent conversations, recent arrivals,
+    // or a suggestion? Naming the relationship costs three words.
+    const recentHandles = sorted.slice(0, 3).map((th) => `@${th.handle}`).join(', ');
     return {
-      display: `📭 All caught up! Recent: ${recentHandles}`,
+      display: recentHandles
+        ? `📭 nothing unread.\n\n_your recent threads:_ ${recentHandles}\n_open one with_ \`vibe inbox @handle\``
+        : '📭 nothing unread.',
       actions: formatActions(actions.recommendedConnections([]))
     };
   }

package/tools/init.js

@@ -59,7 +59,7 @@ function generatePreAuthBanner(presence) {
   const label = formatPresenceLabel(presence);
   const onlineText = label ? `🟢 ${label}` : '🟢 join the crew';
   return `
-  █░█ █ █▄▄ █▀▀     🚀 ship together
+  █░█ █ █▄▄ █▀▀     ask here · answer there
   ▀▄▀ █ █▄█ ██▄     ${onlineText}
   ──────────────────────────────────────────────────
 `;
@@ -75,7 +75,7 @@ function generateAuthBanner(handle, unreadCount, presence) {
   const unreadCol = unreadCount > 0 ? `📬 ${unreadCount} unread`.padEnd(14) : `📬 0 messages`.padEnd(14);
   const onlineText = formatPresenceLabel(presence) || 'just you so far';
 
-  return `  █░█ █ █▄▄ █▀▀   ${handleCol}  🚀 ship together
+  return `  █░█ █ █▄▄ █▀▀   ${handleCol}  ask here · answer there
   ▀▄▀ █ █▄█ ██▄   ${unreadCol}  🟢 ${onlineText}
   ──────────────────────────────────────────────────`;
 }

package/tools/start.js

@@ -167,7 +167,7 @@ function generateWelcomeCard({ handle, onlineCount, unreadCount, versionInfo })
     versionSuffix = ' ⬆️';
   }
 
-  return `  █░█ █ █▄▄ █▀▀   ${handleCol}  🚀 ship together
+  return `  █░█ █ █▄▄ █▀▀   ${handleCol}  ask here · answer there
   ▀▄▀ █ █▄█ ██▄   ${unreadCol}  🟢 ${onlineCount} online${versionSuffix}
   ──────────────────────────────────────────────────`;
 }
@@ -291,23 +291,15 @@ async function handler(args) {
     }
   } catch (e) {}
 
-  // Step 4: Get connection suggestions from API
-  let suggestions = [];
-  try {
-    const apiUrl = config.getApiUrl();
-    const suggestionsResponse = await fetch(`${apiUrl}/api/suggestions?user=${myHandle}&limit=3`, {
-      headers: { 'User-Agent': 'vibe-mcp-client' }
-    });
-
-    if (suggestionsResponse.ok) {
-      const data = await suggestionsResponse.json();
-      if (data.success && data.suggestions) {
-        suggestions = data.suggestions;
-      }
-    }
-  } catch (e) {
-    // Silent fail - suggestions are nice-to-have
-  }
+  // Step 4 used to fetch /api/suggestions and render "Suggested connections" — three
+  // strangers proposed on every session start, in the DEFAULT surface rather than behind
+  // VIBE_EXTRAS. Removed 2026-08-01 (Seth) with the automated cold intros in
+  // api/lib/board-service.js.
+  //
+  // Proposing people you do not know is the retired public-network product. A private
+  // fabric shows you the people you already work with, and says nothing when there is
+  // nobody to say anything about. NOTE: `workContext.suggestions` elsewhere in this file
+  // is unrelated — that is local work context, not people.
 
   // Generate the ASCII welcome card (matches init.js format)
   const welcomeCard = generateWelcomeCard({
@@ -380,17 +372,6 @@ async function handler(args) {
     display += `\n_Session sharing active. Use vibe_guest to exchange messages._`;
   }
 
-  // Add connection suggestions (if any)
-  if (suggestions.length > 0) {
-    display += `\n\n**🤝 Suggested connections:**`;
-    suggestions.slice(0, 3).forEach(s => {
-      display += `\n• @${s.handle} — ${s.reason}`;
-      if (s.github_name) {
-        display += ` (${s.github_name})`;
-      }
-    });
-  }
-
   // Add memory context for returning users
   if (threads.length > 0) {
     const recentThreads = threads.slice(0, 3);
@@ -454,16 +435,6 @@ async function handler(args) {
     };
   }
 
-  // Include connection suggestions for smart discovery
-  if (suggestions.length > 0) {
-    response.suggestions = suggestions.map(s => ({
-      handle: s.handle,
-      reason: s.reason,
-      githubName: s.github_name || null,
-      lastActive: s.last_active || null,
-      matchScore: s.score || null
-    }));
-  }
 
   // Determine session state and suggest appropriate flow
   let suggestion = null;

package/tools/who.js

@@ -178,6 +178,30 @@ async function handler(args) {
   // Check for notifications (presence + messages)
   notify.checkAll(store);
 
+  // TWO EMPTY STATES, AND THEY ARE NOT THE SAME FACT.
+  //
+  // An empty list can mean "nobody is here" or "we cannot see" — and only one of those
+  // is about the room. A signed-out session used to get the first message while four
+  // people were online, which tells someone the product is dead at the exact moment they
+  // are deciding whether it works.
+  if (rawUsers.anonymous) {
+    // Say the number only when the server gave us one. v1 supplies public counts; v2
+    // answers 401 with nothing, and inventing "0 people" there would be the same lie in
+    // a different costume.
+    const n = rawUsers.counts?.active;
+    const line = typeof n === 'number'
+      ? `_You're signed out — ${n === 1 ? '1 person is' : `${n} people are`} here right now, but names need a sign-in._`
+      : `_You're signed out, so I can't see who's here._`;
+    return {
+      structured: { generatedAt: Date.now(), users: [], signedOut: true, counts: rawUsers.counts || null },
+      display: `## Who's Around
+
+${line}
+
+Run \`vibe init\` and you'll see who, and they'll see you.`
+    };
+  }
+
   if (users.length === 0) {
     return {
       structured: { generatedAt: Date.now(), users: [] },
@@ -312,16 +336,20 @@ say hi to **@vibe** (the platform account, always around), or send
     }
   }
 
-  // Fun quick actions - randomize suggestions
-  const quickActions = [
-    `say "message @handle" to reach someone`,
-    `"play with @handle" if you'd rather build something together`,
-    `"status shipping" so others see what you're on`,
-  ];
-  const randomAction = quickActions[Math.floor(Math.random() * quickActions.length)];
-
+  // One line, and it must name a tool that is ACTUALLY REGISTERED.
+  //
+  // This rotated three suggestions at random, one of which advertised `play` — a
+  // culture-layer tool that 0.8.0 moved behind VIBE_EXTRAS. So the default board
+  // routinely told people to use something their session does not have. That is the
+  // help-drift class we already have a guard for on `vibe_help`; the board escaped it.
+  //
+  // Randomness went too: a board that says something different every time reads as
+  // decoration. The hint now follows from state — if you have not set a status,
+  // that is the useful thing to say.
   display += `---\n`;
-  display += randomAction;
+  display += config.getOneLiner()
+    ? `say "dm @handle" to reach someone`
+    : `say "status <what you're on>" so others see what you're building`;
 
   // Check for unread to add urgency
   try {
@@ -336,17 +364,15 @@ say hi to **@vibe** (the platform account, always around), or send
     
   }
 
-  // Genesis spots remaining
-  try {
-    const stats = await store.getStats();
-    if (stats.genesis && stats.genesis.genesis_remaining > 0) {
-      display += `\n\n_${stats.genesis.genesis_remaining} genesis spots left of ${stats.genesis.genesis_cap}_`;
-    } else if (stats.genesis && stats.genesis.genesis_remaining === 0) {
-      display += `\n\n_genesis is full — ${stats.genesis.total} builders_`;
-    }
-  } catch (e) {
-    // Silent fail — genesis display is nice-to-have
-  }
+  // The scarcity line is gone.
+  //
+  // "genesis is full — 282 builders" was a growth-era artifact on two counts. It sold
+  // scarcity, which docs/PRIVATE-FABRIC.md removed from scope; and the number was a
+  // handle count, not people — 282 "builders" on a network where a handful of humans
+  // are actually active reads as a claim the room immediately contradicts. Nobody
+  // invited into a private fabric needs to be told the list is closed.
+  //
+  // What the board says about who is here is now only what it can see: the rows above.
 
   // If not initialized, append join prompt instead of actions/unread
   if (!isInit) {

package/version.json

@@ -1,12 +1,12 @@
 {
-  "version": "0.8.5",
-  "updated": "2026-07-31",
-  "changelog": "Identity is one thing now. Whoever your credential says you are is who the client shows, routes and self-checks as \u2014 previously a saved handle could name one account while requests went out as another. Presence waits for the server to confirm you before it turns green, so a stale or forged session no longer announces itself. Changing your handle is turned off for now: your messages and tasks are still tied to it, and both rename paths are closed rather than one. A suggested first message no longer contains anyone else's words.",
+  "version": "0.8.7",
+  "updated": "2026-08-01",
+  "changelog": "Three ways /vibe told you something untrue, all on the path a new person walks. Installing failed with \"Could not reach slashvibe.dev\" whenever a cache was over quota — the site was serving fine, and a subsystem setup never uses was refusing you the product. Re-running setup on a machine whose login had expired answered \"/vibe is configured\" and quit, so the one command for fixing it said there was nothing to fix. And asking who was around while signed out reported an empty room instead of saying you were signed out, which is the worst thing this product can get wrong. Logins are now 30 days everywhere; new accounts had been getting one-hour ones.",
   "features": [
-    "The credential names you everywhere the client asks who you are",
-    "Presence turns green only after the server confirms the session",
-    "Handle changes are off \u2014 both routes, not one \u2014 until ownership moves off handles",
-    "Suggested messages contain only our words; what someone shipped is shown as data"
+    "A degraded cache no longer blocks installing",
+    "An expired login says so, names the account, and signs you back in",
+    "Signed out reads as signed out, not as an empty room",
+    "One login lifetime — 30 days, including for brand-new accounts"
   ],
   "deprecated": [],
   "breaking": false,