vibeaudio 0.16.0 → 0.16.2

package/README.md

@@ -4,7 +4,7 @@
   <img src="docs/og.png?v=2" alt="VibeAudio — Focus music while your AI codes" width="720">
 </p>
 
-[![test](https://github.com/kiril6/vibeaudio/actions/workflows/test.yml/badge.svg)](https://github.com/kiril6/vibeaudio/actions/workflows/test.yml) [![npm](https://img.shields.io/npm/v/vibeaudio)](https://www.npmjs.com/package/vibeaudio) [![downloads](https://img.shields.io/npm/d18m/vibeaudio?label=downloads)](https://npm-stat.com/charts.html?package=vibeaudio) [![downloads/month](https://img.shields.io/npm/dm/vibeaudio)](https://npm-stat.com/charts.html?package=vibeaudio)
+[![test](https://github.com/kiril6/vibeaudio/actions/workflows/test.yml/badge.svg)](https://github.com/kiril6/vibeaudio/actions/workflows/test.yml) [![npm](https://img.shields.io/npm/v/vibeaudio)](https://www.npmjs.com/package/vibeaudio) [![license](https://img.shields.io/npm/l/vibeaudio)](LICENSE) [![node](https://img.shields.io/node/v/vibeaudio)](https://nodejs.org) [![downloads/month](https://img.shields.io/npm/dm/vibeaudio)](https://npm-stat.com/charts.html?package=vibeaudio) [![M8ven Score](https://m8ven.ai/badge/mcp/kiril6/vibeaudio)](https://m8ven.ai/mcp/kiril6/vibeaudio?s=readme)
 
 > **Procedural focus music while your AI coding tools think.**
 > Every project gets its own arrangement. Zero dependencies, zero audio files.
@@ -321,7 +321,7 @@ Every session of an agent is tracked separately, by the session id in its hook p
 
 * **More sessions, more music.** Two sessions working at once plays at least tier 2 and three or more plays tier 3 — the same piece with more layers, arriving at the next loop boundary and easing off as sessions finish. It only ever raises the tier, so it works alongside time escalation and [reactive mode](#reactive-mode-opt-in).
 * **Dialogs and Esc are per session.** A permission dialog in one terminal plays the "your turn" chime but only pauses the music once *every* session is waiting; Esc ends just that session's turn.
-* **Crashed agents can't hold it hostage.** A session that never sent `Stop` is dropped after 15 minutes, the same ceiling the background player stops at.
+* **Crashed agents can't hold it hostage.** A session that goes 15 minutes without any hook (no tool call, no `Stop`) is taken for a crashed agent and dropped. A long turn that keeps working keeps its music.
 
 Sessions with no id in their payload share a single slot, so they behave as one. VibeAudio keeps one stream: per-session genres or several streams mixed together aren't supported.
 
@@ -499,7 +499,7 @@ Changes land at the next loop boundary, so it shifts musically rather than cutti
 * **Backs up first, once.** The first install copies your file alongside as `*.vibeaudio.bak`. Later installs leave it alone — re-copying would overwrite your real pre-VibeAudio config with a copy of VibeAudio's own last install.
 * **Reinstalling updates, never duplicates.** Uninstalling sweeps every supported agent and removes only VibeAudio's own entries.
 * **Refuses rather than clobbers.** Malformed JSON aborts the write; a temporary `npx` checkout is rejected outright, since the hook records an absolute path that npm's cache eviction would later delete.
-* **Can't run away.** The background player is capped at 15 minutes, so a missed stop event can't leave music looping.
+* **Can't run away.** The background player stops once its sessions have been silent for 15 minutes (and after 4 hours at most), so a missed stop event can't leave music looping.
 
 </details>
 
@@ -921,10 +921,6 @@ Apart from those two, the three commands above remove everything VibeAudio write
 
 ---
 
-If VibeAudio is useful to you, consider giving it a ⭐ on [GitHub](https://github.com/kiril6/vibeaudio) — it helps others find it.
-
----
-
 ## 🤝 Contributing
 
 Contributions welcome — see [`CONTRIBUTING.md`](CONTRIBUTING.md) for the ground rules (zero runtime dependencies, no build step, pure synth modules) and the dev loop. Found a bug? [Open an issue](https://github.com/kiril6/vibeaudio/issues/new) with your **OS**, **Node version**, and which audio player you have installed.
@@ -940,5 +936,13 @@ npm test
 
 ---
 
+## 💛 Supporting the Project
+
+If VibeAudio is useful to you, consider giving it a ⭐ — it helps others find it.
+
+Support development: <a href="https://ko-fi.com/K3K2X0ERJ"><img src="https://ko-fi.com/img/githubbutton_sm.svg" alt="ko-fi" align="absmiddle" /></a>
+
+---
+
 ## 📄 License
 MIT © 2026

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibeaudio",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "Procedural focus music while your AI coding tools (Claude Code, Codex, Cursor, Grok, Gemini, Copilot) think — a different arrangement per project.",
   "bin": {
     "vibeaudio": "bin/vibeaudio.js",

package/src/hooks.js

@@ -143,8 +143,13 @@ function hookTool() {
   setTimeout(commit, 500).unref();
 }
 
-// A lost Stop hook must not leave music looping forever.
-const MAX_DAEMON_MS = 15 * 60 * 1000;
+// A lost Stop hook must not leave music looping forever. This is how long a
+// session may go without a hook before it is taken for a crashed agent; every
+// tool call refreshes it, so a long turn that keeps working keeps its music.
+// VIBE_MAX_DAEMON_MS is internal, for the suite.
+const MAX_DAEMON_MS = Number(process.env.VIBE_MAX_DAEMON_MS) || 15 * 60 * 1000;
+// The daemon's own ceiling, whatever the sessions say: a backstop, not the rule.
+const DAEMON_CEILING_MS = Math.max(MAX_DAEMON_MS, 4 * 60 * 60 * 1000);
 
 /**
  * The agents VibeAudio can wire itself into, and the few things that differ
@@ -519,7 +524,7 @@ function readPid() {
  * so an unverified kill would eventually SIGTERM an unrelated process.
  *
  * Failing closed is the safe direction here: a daemon we decline to kill stops
- * itself at MAX_DAEMON_MS, while killing a stranger's process has no such
+ * itself once no session is left (MAX_DAEMON_MS of silence), while killing a stranger's process has no such
  * ceiling.
  *
  * ponytail: posix only. Windows has no cheap command-line lookup, so the pid
@@ -694,8 +699,8 @@ function writeSession(id, data) {
 
 /**
  * Every session with a turn in flight. One that has not been touched for
- * MAX_DAEMON_MS is a crashed agent - it never sent Stop - and is dropped here,
- * the same ceiling the daemon itself stops at.
+ * MAX_DAEMON_MS is a crashed agent - it never sent Stop - and is dropped here;
+ * the daemon stops once none is left, with DAEMON_CEILING_MS as the backstop.
  */
 function listSessions() {
   let names;
@@ -947,7 +952,7 @@ function runDaemon(genre, volume, { reactive = false, volumeSource = null } = {}
 
   process.on("SIGTERM", shutdown);
   process.on("SIGINT", shutdown);
-  setTimeout(shutdown, MAX_DAEMON_MS);
+  setTimeout(shutdown, DAEMON_CEILING_MS);
 
   setInterval(() => {
     // The pid file names the one daemon that owns the speakers. Two prompts

package/src/interactive.js

@@ -3,19 +3,15 @@
  * Zero dependencies - Pure Node.js ANSI and Readline
  */
 
-const { execSync } = require("child_process");
+const { spawnSync } = require("child_process");
 const readline = require("readline");
 
 // Windows has no `which`; without this every tool shows as missing there.
 const LOOKUP_CMD = process.platform === "win32" ? "where" : "which";
 
 function isInstalled(cmd) {
-  try {
-    execSync(`${LOOKUP_CMD} ${cmd}`, { stdio: "ignore" });
-    return true;
-  } catch (e) {
-    return false;
-  }
+  // An argument vector, not a command string: nothing in `cmd` reaches a shell.
+  return spawnSync(LOOKUP_CMD, [cmd], { stdio: "ignore" }).status === 0;
 }
 
 // Convenience only - the wrapper runs any command, and "Custom command..."

package/src/mcp.js

@@ -13,6 +13,19 @@ const pkg = require("../package.json");
 // own ceiling rather than looping forever.
 const MAX_PLAYBACK_MS = 15 * 60 * 1000;
 
+// All four hints on every tool, as the spec's ToolAnnotations defines them, so
+// a host can tell what each one does before the model calls it. None touches
+// anything beyond the local audio player and VibeAudio's own cache.
+const annotate = (title, { readOnly, idempotent }) => ({
+  title,
+  readOnlyHint: readOnly,
+  destructiveHint: false,
+  idempotentHint: idempotent,
+  openWorldHint: false
+});
+
+const OUTCOMES = ["success", "failure"];
+
 const TOOLS = [
   {
     name: "vibe_play",
@@ -22,6 +35,7 @@ const TOOLS = [
       "long file edits, repeated tool calls, anything the user will wait through. " +
       "Always pair it with vibe_stop when the task resolves. Skip it for quick " +
       "answers: music around a one-second reply is worse than silence.",
+    annotations: annotate("Start focus music", { readOnly: false, idempotent: true }),
     inputSchema: {
       type: "object",
       properties: {
@@ -46,13 +60,14 @@ const TOOLS = [
       "task resolves and you are ready to hand back a result, including when it " +
       "failed - pass outcome 'failure' so the chime says so. Never leave music " +
       "playing after a vibe_play task is done.",
+    annotations: annotate("Stop focus music", { readOnly: false, idempotent: false }),
     inputSchema: {
       type: "object",
       properties: {
         outcome: {
           type: "string",
           description: "Resolution outcome: 'success' (ascending chime) or 'failure' (soft minor tone)",
-          enum: ["success", "failure"]
+          enum: OUTCOMES
         },
         playChime: {
           type: "boolean",
@@ -67,6 +82,7 @@ const TOOLS = [
       "Check whether focus music is currently playing, and in which genre and " +
       "intensity tier. Use it to avoid starting a second track, or to confirm " +
       "nothing was left running.",
+    annotations: annotate("Check focus music", { readOnly: true, idempotent: true }),
     inputSchema: {
       type: "object",
       properties: {}
@@ -137,7 +153,10 @@ function handleMessage(player, msg) {
       // saved file here is what makes `vibe --genre jazz` mean jazz in a
       // desktop client too, rather than only in the terminal.
       const saved = loadConfig();
-      const requested = args.genre || process.env.VIBE_GENRE || saved.genre || "lofi";
+      // The argument comes from the client: only a string counts. A number or
+      // object here used to reach `.toLowerCase()` and fail the whole call.
+      const asked = typeof args.genre === "string" ? args.genre.trim() : "";
+      const requested = String(asked || process.env.VIBE_GENRE || saved.genre || "lofi");
       // An unknown genre already fell back to lofi inside the generator, but
       // player.genre kept the name nobody implements - so the model told the
       // user it was playing something that does not exist.
@@ -161,9 +180,12 @@ function handleMessage(player, msg) {
       // start() returns false for three unrelated reasons, and the model
       // relays whatever we say here to the user. Reporting a deliberate mute
       // as a missing audio player sends them debugging their sound stack.
+      // What goes back to the model is client-supplied text, so echo a short
+      // plain version of it, not whatever was sent.
+      const shown = requested.replace(/[^\w.-]/g, "").slice(0, 24);
       const fallbackNote = genre === requested
         ? ""
-        : ` (requested genre '${requested}' is not one of ${AVAILABLE_GENRES.join(", ")}, random)`;
+        : ` (requested genre '${shown}' is not one of ${AVAILABLE_GENRES.join(", ")}, random)`;
       const text = started
         ? `Started playing ${player.genre} procedural focus music at ${Math.round(volume * 100)}% volume.${fallbackNote}`
         : player.isPlaying
@@ -183,6 +205,15 @@ function handleMessage(player, msg) {
 
     if (name === "vibe_stop") {
       const outcome = args.outcome || "success";
+      // The schema's enum is a hint to the model, not a check: nothing stops a
+      // client sending anything, and this string is echoed back below.
+      if (!OUTCOMES.includes(outcome)) {
+        return {
+          jsonrpc: "2.0",
+          id,
+          result: { isError: true, content: [{ type: "text", text: `outcome must be one of: ${OUTCOMES.join(", ")}.` }] }
+        };
+      }
       const playChime = args.playChime !== false;
 
       const wasPlaying = player.stop({ playChime, outcome });

package/src/output.js

@@ -45,7 +45,9 @@ function parseDefaultOutput(json) {
 function macOutput() {
   if (process.platform !== "darwin") return null;
   const run = (cmd, args) => {
-    const r = spawnSync(cmd, args, { encoding: "utf8", timeout: 5000 });
+    // SIGKILL, not the default SIGTERM: a lookup stuck on audio hardware (a CI
+    // runner has none) can ignore TERM, and spawnSync then waits on it forever.
+    const r = spawnSync(cmd, args, { encoding: "utf8", timeout: 5000, killSignal: "SIGKILL" });
     return r.status === 0 ? r.stdout : null;
   };
   const settings = run("osascript", ["-e", "get volume settings"]);

package/src/player.js

@@ -698,7 +698,9 @@ function chimeKeyFor(genre) {
 
 function getChimePath(outcome = "success", gain = 1, key = DEFAULT_CHIME_KEY) {
   ensureCacheDir();
-  const kind = outcome === "error" ? "failure" : CHIMES[outcome] ? outcome : "success";
+  // Own keys only: `CHIMES["constructor"]` is truthy, and used to reach the
+  // generator call below as a function that is not one of ours.
+  const kind = outcome === "error" ? "failure" : Object.hasOwn(CHIMES, outcome) ? outcome : "success";
   // Only the success chime has keys, and the default keeps its original file
   // name so an upgrade does not leave a cached copy behind.
   const keyed = kind === "success" && key !== DEFAULT_CHIME_KEY && SUCCESS_CHIME_NOTES[key];
@@ -955,7 +957,7 @@ class AudioPlayer {
             .on("error", () => {})
             .unref();
         } else {
-          spawnSync(backend.cmd, backend.args(chimeFile, clamped), { stdio: "ignore", timeout: 2500 });
+          spawnSync(backend.cmd, backend.args(chimeFile, clamped), { stdio: "ignore", timeout: 2500, killSignal: "SIGKILL" });
         }
       } catch (e) {
         // Ignore timeout