slashvibe-mcp 0.8.7 → 0.8.9

package/auth-store.js

@@ -61,13 +61,43 @@ function hydrate() {
     const config = require('./config');
     const cfg = config.load();
 
-    _token = cfg.authToken || cfg.privyToken || null;
     _oneLiner = cfg.one_liner || cfg.workingOn || null;
 
-    // Cross-client: if no token from config.json, check terminal/buddy auth.json
-    if (!_token) {
-      const terminalAuth = config.loadTerminalAuth();
-      if (terminalAuth?.token) _token = terminalAuth.token;
+    // ONE IDENTITY, ONE AUTHORITY — and the authority is whichever credential still WORKS.
+    //
+    // This used to take cfg.authToken unconditionally and only look at auth.json when
+    // config.json had no token at all. So a machine holding a DEAD token in config.json
+    // and a LIVE one in auth.json hydrated with the dead one and reported
+    // isAuthenticated() === true. Reproduced before this change:
+    //
+    //     hydrate chose: expired | isAuthenticated(): true
+    //
+    // Presence order is unchanged — config.json still wins when it is usable. What
+    // changed is that "present" is no longer mistaken for "usable". Falling back only on
+    // ABSENCE means the freshest credential loses to the first one on disk, which is
+    // precisely the "several credentials for one identity" failure canon law 3 exists to
+    // prevent (§4). With 30-day logins every machine eventually holds a stale one, so
+    // this is a matter of when, not whether.
+    //
+    // Deliberately local: inspectToken decodes `exp` rather than asking the server,
+    // because hydrate runs at boot where the network may be the broken thing. It cannot
+    // prove a token is GOOD — only the server can, and markVerified() records that later.
+    // It reliably rejects one that is definitively over.
+    const candidates = [
+      cfg.authToken,
+      cfg.privyToken,
+      config.loadTerminalAuth()?.token,
+    ].filter(Boolean);
+
+    _token = candidates.find((t) => inspectToken(t).ok) || null;
+
+    if (!_token && candidates.length > 0) {
+      // Every credential we hold is unusable. That is signed OUT, not signed in as the
+      // least-bad option — and it must be distinguishable from having none at all, so a
+      // remembered handle does not step in to name a session nothing backs (#110).
+      const why = inspectToken(candidates[0]).reason;
+      console.error(`[auth-store] No usable credential (${candidates.length} found, first is ${why})`);
+      _rejected = true;
     }
 
     // THE TOKEN IS THE IDENTITY.

package/config.js

@@ -160,11 +160,26 @@ function getOneLiner() {
 }
 
 function isInitialized() {
-  // Check session first, then shared config
+  // A VALID CREDENTIAL IS INITIALISATION. Asking the file was the bug.
+  //
+  // This checked only for a stored handle, so a config that held a perfectly good token
+  // and no `username` reported "not initialized" forever. Tools behind requireInit()
+  // refused with "Run `vibe init` first" while presence — which resolves identity from
+  // the credential — worked in the same response. One reply, two answers about whether
+  // you are signed in.
+  //
+  // It is reachable by accident: save() writes `username: config.handle ||
+  // config.username || existing.username`, and when all three are absent that value is
+  // `undefined`, which JSON.stringify DROPS. So the key does not go null, it disappears,
+  // and nothing puts it back. Observed on this machine 2026-08-01.
+  //
+  // The credential is the identity (#107). If one names us, we are initialised — and if
+  // one does not, no remembered string should pretend otherwise.
+  if (getHandle()) return true;
   const sessionHandle = getSessionHandle();
   if (sessionHandle) return true;
   const config = load();
-  return config.handle && config.handle.length > 0;
+  return !!(config.handle && config.handle.length > 0);
 }
 
 // Session management - unique ID per Claude Code instance
@@ -302,10 +317,21 @@ function saveAuthToken(token) {
     authMethod: 'github'  // Track that this is GitHub OAuth
   });
 
-  // Also save to shared config for persistence across MCP restarts
+  // Also save to shared config for persistence across MCP restarts.
+  //
+  // The handle rides WITH the token. Persisting a credential and no identity is how a
+  // config comes to hold a valid token under no name — and save() cannot repair it,
+  // because it writes `username: undefined` in that case and JSON.stringify drops the
+  // key rather than storing null. The state is invisible and permanent.
   const cfg = load();
   cfg.authToken = token;
   cfg.authMethod = 'github';
+  if (!cfg.handle) {
+    // Derive it from the credential itself rather than leaving the file anonymous.
+    try {
+      cfg.handle = require('./auth-store').inspectToken(token).handle || cfg.handle;
+    } catch (e) { /* auth-store unavailable at early boot — the token still saves */ }
+  }
   save(cfg);
 }
 

package/index.js

@@ -99,6 +99,24 @@ function inferPromptFromArgs(toolName, args) {
   }
 }
 
+// TERMINAL ESCAPES ARE OPT-IN, and default to OFF.
+//
+// An MCP server CANNOT know what renders its output. These OSC sequences assume an
+// iTerm-like terminal; every other client shows them as literal junk on the end of every
+// tool result:
+//
+//     ]0;vibe: 2 online · @pastelle]1337;SetBadgeFormat=4peL
+//
+// The comment that used to sit here claimed they were "invisible in the transcript".
+// They are not — they were visible throughout a full working session in Claude Code, on
+// every single vibe tool call. That is a claim about a state nobody verified, which is
+// the exact defect class this codebase keeps paying for (canon law 2), and it is worse
+// than usual here because the claim is what stopped anyone looking.
+//
+// Client-agnostic payloads are the rule. Someone on iTerm who wants a live title and
+// badge can ask for it; nobody else should pay for it.
+const TERM_ESCAPES = ['1', 'true'].includes(String(process.env.VIBE_TERM_ESCAPES || '').toLowerCase());
+
 // Generate terminal title escape sequence (OSC 0)
 function getTerminalTitle(onlineCount, unreadCount, lastActivity) {
   const parts = [];
@@ -235,9 +253,10 @@ async function getPresenceFooter() {
 
     // Terminal title + badge: ambient by nature, invisible in the transcript.
     const lastActivity = others.length > 0 ? `@${others[0].handle}` : null;
-    const escapes =
-      getTerminalTitle(onlineCount, unreadCount, lastActivity) +
-      getBadgeSequence(onlineCount, unreadCount);
+    const escapes = TERM_ESCAPES
+      ? getTerminalTitle(onlineCount, unreadCount, lastActivity) +
+        getBadgeSequence(onlineCount, unreadCount)
+      : '';
 
     // The status line. Counts only — no mood inference, no nudges.
     const parts = ['vibe'];

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.8.7",
+  "version": "0.8.9",
   "mcpName": "io.github.vibecodinginc/vibe",
   "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) — the /vibe kernel",
   "main": "index.js",
   "bin": {
-    "slashvibe-mcp": "./cli.js",
-    "vibe-setup": "./setup.js"
+    "slashvibe-mcp": "cli.js",
+    "vibe-setup": "setup.js"
   },
   "scripts": {
     "start": "node index.js",

package/version.json

@@ -1,12 +1,11 @@
 {
-  "version": "0.8.7",
-  "updated": "2026-08-01",
-  "changelog": "Three ways /vibe told you something untrue, all on the path a new person walks. Installing failed with \"Could not reach slashvibe.dev\" whenever a cache was over quota — the site was serving fine, and a subsystem setup never uses was refusing you the product. Re-running setup on a machine whose login had expired answered \"/vibe is configured\" and quit, so the one command for fixing it said there was nothing to fix. And asking who was around while signed out reported an empty room instead of saying you were signed out, which is the worst thing this product can get wrong. Logins are now 30 days everywhere; new accounts had been getting one-hour ones.",
+  "version": "0.8.9",
+  "updated": "2026-08-02",
+  "changelog": "One machine can hold more than one saved /vibe credential. Until now the first token on disk won even when it had expired, stranding a working 30-day login in the other file. /vibe now chooses a credential that is still locally usable, reports signed out when every saved credential is expired, and keeps terminal-specific title and badge escapes off unless they are explicitly enabled.",
   "features": [
-    "A degraded cache no longer blocks installing",
-    "An expired login says so, names the account, and signs you back in",
-    "Signed out reads as signed out, not as an empty room",
-    "One login lifetime — 30 days, including for brand-new accounts"
+    "A working saved credential wins over an expired credential in another config file",
+    "All expired credentials report signed out instead of impersonating a live session",
+    "Terminal title and badge escapes are opt-in with VIBE_TERM_ESCAPES=1"
   ],
   "deprecated": [],
   "breaking": false,