vibeaudio 0.16.0 → 0.16.1

package/README.md

@@ -921,10 +921,6 @@ Apart from those two, the three commands above remove everything VibeAudio write
 
 ---
 
-If VibeAudio is useful to you, consider giving it a ⭐ on [GitHub](https://github.com/kiril6/vibeaudio) — it helps others find it.
-
----
-
 ## 🤝 Contributing
 
 Contributions welcome — see [`CONTRIBUTING.md`](CONTRIBUTING.md) for the ground rules (zero runtime dependencies, no build step, pure synth modules) and the dev loop. Found a bug? [Open an issue](https://github.com/kiril6/vibeaudio/issues/new) with your **OS**, **Node version**, and which audio player you have installed.
@@ -940,5 +936,13 @@ npm test
 
 ---
 
+## 💛 Supporting the Project
+
+If VibeAudio is useful to you, consider giving it a ⭐ — it helps others find it.
+
+Support development: <a href="https://ko-fi.com/K3K2X0ERJ"><img src="https://ko-fi.com/img/githubbutton_sm.svg" alt="ko-fi" align="absmiddle" /></a>
+
+---
+
 ## 📄 License
 MIT © 2026

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibeaudio",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Procedural focus music while your AI coding tools (Claude Code, Codex, Cursor, Grok, Gemini, Copilot) think — a different arrangement per project.",
   "bin": {
     "vibeaudio": "bin/vibeaudio.js",

package/src/interactive.js

@@ -3,19 +3,15 @@
  * Zero dependencies - Pure Node.js ANSI and Readline
  */
 
-const { execSync } = require("child_process");
+const { spawnSync } = require("child_process");
 const readline = require("readline");
 
 // Windows has no `which`; without this every tool shows as missing there.
 const LOOKUP_CMD = process.platform === "win32" ? "where" : "which";
 
 function isInstalled(cmd) {
-  try {
-    execSync(`${LOOKUP_CMD} ${cmd}`, { stdio: "ignore" });
-    return true;
-  } catch (e) {
-    return false;
-  }
+  // An argument vector, not a command string: nothing in `cmd` reaches a shell.
+  return spawnSync(LOOKUP_CMD, [cmd], { stdio: "ignore" }).status === 0;
 }
 
 // Convenience only - the wrapper runs any command, and "Custom command..."

package/src/mcp.js

@@ -13,6 +13,19 @@ const pkg = require("../package.json");
 // own ceiling rather than looping forever.
 const MAX_PLAYBACK_MS = 15 * 60 * 1000;
 
+// All four hints on every tool, as the spec's ToolAnnotations defines them, so
+// a host can tell what each one does before the model calls it. None touches
+// anything beyond the local audio player and VibeAudio's own cache.
+const annotate = (title, { readOnly, idempotent }) => ({
+  title,
+  readOnlyHint: readOnly,
+  destructiveHint: false,
+  idempotentHint: idempotent,
+  openWorldHint: false
+});
+
+const OUTCOMES = ["success", "failure"];
+
 const TOOLS = [
   {
     name: "vibe_play",
@@ -22,6 +35,7 @@ const TOOLS = [
       "long file edits, repeated tool calls, anything the user will wait through. " +
       "Always pair it with vibe_stop when the task resolves. Skip it for quick " +
       "answers: music around a one-second reply is worse than silence.",
+    annotations: annotate("Start focus music", { readOnly: false, idempotent: true }),
     inputSchema: {
       type: "object",
       properties: {
@@ -46,13 +60,14 @@ const TOOLS = [
       "task resolves and you are ready to hand back a result, including when it " +
       "failed - pass outcome 'failure' so the chime says so. Never leave music " +
       "playing after a vibe_play task is done.",
+    annotations: annotate("Stop focus music", { readOnly: false, idempotent: false }),
     inputSchema: {
       type: "object",
       properties: {
         outcome: {
           type: "string",
           description: "Resolution outcome: 'success' (ascending chime) or 'failure' (soft minor tone)",
-          enum: ["success", "failure"]
+          enum: OUTCOMES
         },
         playChime: {
           type: "boolean",
@@ -67,6 +82,7 @@ const TOOLS = [
       "Check whether focus music is currently playing, and in which genre and " +
       "intensity tier. Use it to avoid starting a second track, or to confirm " +
       "nothing was left running.",
+    annotations: annotate("Check focus music", { readOnly: true, idempotent: true }),
     inputSchema: {
       type: "object",
       properties: {}
@@ -137,7 +153,10 @@ function handleMessage(player, msg) {
       // saved file here is what makes `vibe --genre jazz` mean jazz in a
       // desktop client too, rather than only in the terminal.
       const saved = loadConfig();
-      const requested = args.genre || process.env.VIBE_GENRE || saved.genre || "lofi";
+      // The argument comes from the client: only a string counts. A number or
+      // object here used to reach `.toLowerCase()` and fail the whole call.
+      const asked = typeof args.genre === "string" ? args.genre.trim() : "";
+      const requested = String(asked || process.env.VIBE_GENRE || saved.genre || "lofi");
       // An unknown genre already fell back to lofi inside the generator, but
       // player.genre kept the name nobody implements - so the model told the
       // user it was playing something that does not exist.
@@ -161,9 +180,12 @@ function handleMessage(player, msg) {
       // start() returns false for three unrelated reasons, and the model
       // relays whatever we say here to the user. Reporting a deliberate mute
       // as a missing audio player sends them debugging their sound stack.
+      // What goes back to the model is client-supplied text, so echo a short
+      // plain version of it, not whatever was sent.
+      const shown = requested.replace(/[^\w.-]/g, "").slice(0, 24);
       const fallbackNote = genre === requested
         ? ""
-        : ` (requested genre '${requested}' is not one of ${AVAILABLE_GENRES.join(", ")}, random)`;
+        : ` (requested genre '${shown}' is not one of ${AVAILABLE_GENRES.join(", ")}, random)`;
       const text = started
         ? `Started playing ${player.genre} procedural focus music at ${Math.round(volume * 100)}% volume.${fallbackNote}`
         : player.isPlaying
@@ -183,6 +205,15 @@ function handleMessage(player, msg) {
 
     if (name === "vibe_stop") {
       const outcome = args.outcome || "success";
+      // The schema's enum is a hint to the model, not a check: nothing stops a
+      // client sending anything, and this string is echoed back below.
+      if (!OUTCOMES.includes(outcome)) {
+        return {
+          jsonrpc: "2.0",
+          id,
+          result: { isError: true, content: [{ type: "text", text: `outcome must be one of: ${OUTCOMES.join(", ")}.` }] }
+        };
+      }
       const playChime = args.playChime !== false;
 
       const wasPlaying = player.stop({ playChime, outcome });

package/src/output.js

@@ -45,7 +45,9 @@ function parseDefaultOutput(json) {
 function macOutput() {
   if (process.platform !== "darwin") return null;
   const run = (cmd, args) => {
-    const r = spawnSync(cmd, args, { encoding: "utf8", timeout: 5000 });
+    // SIGKILL, not the default SIGTERM: a lookup stuck on audio hardware (a CI
+    // runner has none) can ignore TERM, and spawnSync then waits on it forever.
+    const r = spawnSync(cmd, args, { encoding: "utf8", timeout: 5000, killSignal: "SIGKILL" });
     return r.status === 0 ? r.stdout : null;
   };
   const settings = run("osascript", ["-e", "get volume settings"]);

package/src/player.js

@@ -698,7 +698,9 @@ function chimeKeyFor(genre) {
 
 function getChimePath(outcome = "success", gain = 1, key = DEFAULT_CHIME_KEY) {
   ensureCacheDir();
-  const kind = outcome === "error" ? "failure" : CHIMES[outcome] ? outcome : "success";
+  // Own keys only: `CHIMES["constructor"]` is truthy, and used to reach the
+  // generator call below as a function that is not one of ours.
+  const kind = outcome === "error" ? "failure" : Object.hasOwn(CHIMES, outcome) ? outcome : "success";
   // Only the success chime has keys, and the default keeps its original file
   // name so an upgrade does not leave a cached copy behind.
   const keyed = kind === "success" && key !== DEFAULT_CHIME_KEY && SUCCESS_CHIME_NOTES[key];
@@ -955,7 +957,7 @@ class AudioPlayer {
             .on("error", () => {})
             .unref();
         } else {
-          spawnSync(backend.cmd, backend.args(chimeFile, clamped), { stdio: "ignore", timeout: 2500 });
+          spawnSync(backend.cmd, backend.args(chimeFile, clamped), { stdio: "ignore", timeout: 2500, killSignal: "SIGKILL" });
         }
       } catch (e) {
         // Ignore timeout