slashvibe-mcp 0.8.7 → 0.8.8

package/config.js

@@ -160,11 +160,26 @@ function getOneLiner() {
 }
 
 function isInitialized() {
-  // Check session first, then shared config
+  // A VALID CREDENTIAL IS INITIALISATION. Asking the file was the bug.
+  //
+  // This checked only for a stored handle, so a config that held a perfectly good token
+  // and no `username` reported "not initialized" forever. Tools behind requireInit()
+  // refused with "Run `vibe init` first" while presence — which resolves identity from
+  // the credential — worked in the same response. One reply, two answers about whether
+  // you are signed in.
+  //
+  // It is reachable by accident: save() writes `username: config.handle ||
+  // config.username || existing.username`, and when all three are absent that value is
+  // `undefined`, which JSON.stringify DROPS. So the key does not go null, it disappears,
+  // and nothing puts it back. Observed on this machine 2026-08-01.
+  //
+  // The credential is the identity (#107). If one names us, we are initialised — and if
+  // one does not, no remembered string should pretend otherwise.
+  if (getHandle()) return true;
   const sessionHandle = getSessionHandle();
   if (sessionHandle) return true;
   const config = load();
-  return config.handle && config.handle.length > 0;
+  return !!(config.handle && config.handle.length > 0);
 }
 
 // Session management - unique ID per Claude Code instance
@@ -302,10 +317,21 @@ function saveAuthToken(token) {
     authMethod: 'github'  // Track that this is GitHub OAuth
   });
 
-  // Also save to shared config for persistence across MCP restarts
+  // Also save to shared config for persistence across MCP restarts.
+  //
+  // The handle rides WITH the token. Persisting a credential and no identity is how a
+  // config comes to hold a valid token under no name — and save() cannot repair it,
+  // because it writes `username: undefined` in that case and JSON.stringify drops the
+  // key rather than storing null. The state is invisible and permanent.
   const cfg = load();
   cfg.authToken = token;
   cfg.authMethod = 'github';
+  if (!cfg.handle) {
+    // Derive it from the credential itself rather than leaving the file anonymous.
+    try {
+      cfg.handle = require('./auth-store').inspectToken(token).handle || cfg.handle;
+    } catch (e) { /* auth-store unavailable at early boot — the token still saves */ }
+  }
   save(cfg);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.8.7",
+  "version": "0.8.8",
   "mcpName": "io.github.vibecodinginc/vibe",
   "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) — the /vibe kernel",
   "main": "index.js",

package/version.json

@@ -1,12 +1,11 @@
 {
-  "version": "0.8.7",
+  "version": "0.8.8",
   "updated": "2026-08-01",
-  "changelog": "Three ways /vibe told you something untrue, all on the path a new person walks. Installing failed with \"Could not reach slashvibe.dev\" whenever a cache was over quota — the site was serving fine, and a subsystem setup never uses was refusing you the product. Re-running setup on a machine whose login had expired answered \"/vibe is configured\" and quit, so the one command for fixing it said there was nothing to fix. And asking who was around while signed out reported an empty room instead of saying you were signed out, which is the worst thing this product can get wrong. Logins are now 30 days everywhere; new accounts had been getting one-hour ones.",
+  "changelog": "A credential that names you is being signed in. A config could end up holding a perfectly good token and no username — and once that happened nothing put it back — so `vibe dm` answered \"Not initialized, run vibe init\" in the same breath as the footer showing who was online. One reply, two answers. Signing in now records whose token it is, so the file can never go anonymous.",
   "features": [
-    "A degraded cache no longer blocks installing",
-    "An expired login says so, names the account, and signs you back in",
-    "Signed out reads as signed out, not as an empty room",
-    "One login lifetime — 30 days, including for brand-new accounts"
+    "A valid credential counts as being signed in, no matter what the file says",
+    "Signing in records the handle with the token, so it cannot be lost",
+    "Sign-in fails with a clear message instead of a crash page when storage is down"
   ],
   "deprecated": [],
   "breaking": false,