slashvibe-mcp 0.8.8 → 0.8.9

package/auth-store.js

@@ -61,13 +61,43 @@ function hydrate() {
     const config = require('./config');
     const cfg = config.load();
 
-    _token = cfg.authToken || cfg.privyToken || null;
     _oneLiner = cfg.one_liner || cfg.workingOn || null;
 
-    // Cross-client: if no token from config.json, check terminal/buddy auth.json
-    if (!_token) {
-      const terminalAuth = config.loadTerminalAuth();
-      if (terminalAuth?.token) _token = terminalAuth.token;
+    // ONE IDENTITY, ONE AUTHORITY — and the authority is whichever credential still WORKS.
+    //
+    // This used to take cfg.authToken unconditionally and only look at auth.json when
+    // config.json had no token at all. So a machine holding a DEAD token in config.json
+    // and a LIVE one in auth.json hydrated with the dead one and reported
+    // isAuthenticated() === true. Reproduced before this change:
+    //
+    //     hydrate chose: expired | isAuthenticated(): true
+    //
+    // Presence order is unchanged — config.json still wins when it is usable. What
+    // changed is that "present" is no longer mistaken for "usable". Falling back only on
+    // ABSENCE means the freshest credential loses to the first one on disk, which is
+    // precisely the "several credentials for one identity" failure canon law 3 exists to
+    // prevent (§4). With 30-day logins every machine eventually holds a stale one, so
+    // this is a matter of when, not whether.
+    //
+    // Deliberately local: inspectToken decodes `exp` rather than asking the server,
+    // because hydrate runs at boot where the network may be the broken thing. It cannot
+    // prove a token is GOOD — only the server can, and markVerified() records that later.
+    // It reliably rejects one that is definitively over.
+    const candidates = [
+      cfg.authToken,
+      cfg.privyToken,
+      config.loadTerminalAuth()?.token,
+    ].filter(Boolean);
+
+    _token = candidates.find((t) => inspectToken(t).ok) || null;
+
+    if (!_token && candidates.length > 0) {
+      // Every credential we hold is unusable. That is signed OUT, not signed in as the
+      // least-bad option — and it must be distinguishable from having none at all, so a
+      // remembered handle does not step in to name a session nothing backs (#110).
+      const why = inspectToken(candidates[0]).reason;
+      console.error(`[auth-store] No usable credential (${candidates.length} found, first is ${why})`);
+      _rejected = true;
     }
 
     // THE TOKEN IS THE IDENTITY.

package/index.js

@@ -99,6 +99,24 @@ function inferPromptFromArgs(toolName, args) {
   }
 }
 
+// TERMINAL ESCAPES ARE OPT-IN, and default to OFF.
+//
+// An MCP server CANNOT know what renders its output. These OSC sequences assume an
+// iTerm-like terminal; every other client shows them as literal junk on the end of every
+// tool result:
+//
+//     ]0;vibe: 2 online · @pastelle]1337;SetBadgeFormat=4peL
+//
+// The comment that used to sit here claimed they were "invisible in the transcript".
+// They are not — they were visible throughout a full working session in Claude Code, on
+// every single vibe tool call. That is a claim about a state nobody verified, which is
+// the exact defect class this codebase keeps paying for (canon law 2), and it is worse
+// than usual here because the claim is what stopped anyone looking.
+//
+// Client-agnostic payloads are the rule. Someone on iTerm who wants a live title and
+// badge can ask for it; nobody else should pay for it.
+const TERM_ESCAPES = ['1', 'true'].includes(String(process.env.VIBE_TERM_ESCAPES || '').toLowerCase());
+
 // Generate terminal title escape sequence (OSC 0)
 function getTerminalTitle(onlineCount, unreadCount, lastActivity) {
   const parts = [];
@@ -235,9 +253,10 @@ async function getPresenceFooter() {
 
     // Terminal title + badge: ambient by nature, invisible in the transcript.
     const lastActivity = others.length > 0 ? `@${others[0].handle}` : null;
-    const escapes =
-      getTerminalTitle(onlineCount, unreadCount, lastActivity) +
-      getBadgeSequence(onlineCount, unreadCount);
+    const escapes = TERM_ESCAPES
+      ? getTerminalTitle(onlineCount, unreadCount, lastActivity) +
+        getBadgeSequence(onlineCount, unreadCount)
+      : '';
 
     // The status line. Counts only — no mood inference, no nudges.
     const parts = ['vibe'];

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "slashvibe-mcp",
-  "version": "0.8.8",
+  "version": "0.8.9",
   "mcpName": "io.github.vibecodinginc/vibe",
   "description": "Presence + messaging for terminal coding agents (Claude Code, Codex, Cursor) — the /vibe kernel",
   "main": "index.js",
   "bin": {
-    "slashvibe-mcp": "./cli.js",
-    "vibe-setup": "./setup.js"
+    "slashvibe-mcp": "cli.js",
+    "vibe-setup": "setup.js"
   },
   "scripts": {
     "start": "node index.js",

package/version.json

@@ -1,11 +1,11 @@
 {
-  "version": "0.8.8",
-  "updated": "2026-08-01",
-  "changelog": "A credential that names you is being signed in. A config could end up holding a perfectly good token and no username — and once that happened nothing put it back — so `vibe dm` answered \"Not initialized, run vibe init\" in the same breath as the footer showing who was online. One reply, two answers. Signing in now records whose token it is, so the file can never go anonymous.",
+  "version": "0.8.9",
+  "updated": "2026-08-02",
+  "changelog": "One machine can hold more than one saved /vibe credential. Until now the first token on disk won even when it had expired, stranding a working 30-day login in the other file. /vibe now chooses a credential that is still locally usable, reports signed out when every saved credential is expired, and keeps terminal-specific title and badge escapes off unless they are explicitly enabled.",
   "features": [
-    "A valid credential counts as being signed in, no matter what the file says",
-    "Signing in records the handle with the token, so it cannot be lost",
-    "Sign-in fails with a clear message instead of a crash page when storage is down"
+    "A working saved credential wins over an expired credential in another config file",
+    "All expired credentials report signed out instead of impersonating a live session",
+    "Terminal title and badge escapes are opt-in with VIBE_TERM_ESCAPES=1"
   ],
   "deprecated": [],
   "breaking": false,