vibeostheog 0.20.3 → 0.20.4

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 0.20.4
+- fix: add alpha token invalidate switch
+- fix: prefer valid api tokens over placeholder env
+- fix: gate footer stderr by runtime
+- fix: quiet footer stderr noise
+Merge pull request #70 from DrunkkToys/codex/alpha-token-kill-switch
+
+
 ## 0.20.3
 - fix: embed valid alpha token fallback
 Merge pull request #69 from DrunkkToys/codex/alpha-token-release

package/README.md

@@ -30,6 +30,7 @@ Without a token, vibeOS keeps running in local-only mode with bundled algorithms
 ### Requires Remote API
 
 - Bootstrap token exchange (required for initial API setup)
+- Alpha seat issuance is currently uncapped in the admin tooling
 - Advanced VibeBoX decision engine with full session history tracking
 - Dynamic per-prompt delegation decisions (local fallback uses a safe "block all writes on high tier" default)
 - Learned subagent routing patterns across projects (local fallback uses a static exploratory keyword list)
@@ -111,7 +112,7 @@ The most common controls are:
 - `trinity repair-state preview|apply` - fix state fingerprint collisions
 - `trinity VibeBoX on|off|status|reset` - control the decision engine
 - `trinity guard` - refresh AGENTS.md and README.md checks
-- `trinity api-token <token>` - update the remote API token
+- `trinity api-token <token|invalidate>` - update the remote API token, or invalidate the current alpha token and disable remote API
 - `trinity api-bootstrap-token <token>` - store an alpha bootstrap token and exchange it for a normal API token on alpha builds
 
 Additional reporting commands:
@@ -138,7 +139,8 @@ Savings are persisted in `~/.claude/delegation-state.json`.
 | Variable | Default | Purpose |
 |---|---|---|
 | `VIBEOS_API_URL` | `https://api.vibetheog.com` | Remote API server URL |
-| `VIBEOS_API_TOKEN` | unset | vos_a51ffe2cdda8f52f8f3cc66064508999cc6831699309ba661a850865af07c020 |
+| `VIBEOS_API_TOKEN` | unset | vos_8d73804b13bb46711b9a47f036dba7b4d026fd9583d96960e663716e62815a69 |
+| `VIBEOS_API_DISABLED` | `false` | Set to `true` to invalidate the embedded alpha token and keep remote API off until re-enabled |
 | `VIBEOS_API_BOOTSTRAP_TOKEN` | unset | Alpha bootstrap token for initial auth exchange |
 | `VIBEOS_API_ENABLED` | `true` | Set to `false` for local-only mode |
 | `CLAUDE_CREDIT_PERCENT` | `100` | Credit override |
@@ -154,7 +156,7 @@ Without a token, vibeOS keeps running in local-only mode with bundled algorithms
 - If the model will not switch, run `trinity rebuild` and then `trinity set brain|medium|cheap`.
 - If writes or edits are blocked, that is usually delegation enforcement working as intended on the brain tier.
 - If the footer is missing, check that the plugin is enabled and that the current OpenCode session is receiving assistant completions.
-- If the remote API is down or the token is invalid, use `trinity api-token <token>` or `trinity api-bootstrap-token <token>` on alpha builds, or rely on local-only mode.
+- If the remote API is down or the token is invalid, use `trinity api-token <token>` or `trinity api-bootstrap-token <token>` on alpha builds. Use `trinity api-token invalidate` when you want to intentionally revoke the alpha token and stay local-only.
 - If the dashboard does not load, rebuild the plugin with `npm run build` and restart OpenCode.
 - If state or config looks inconsistent, run `trinity diagnose` and `trinity guard`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibeostheog",
-  "version": "0.20.3",
+  "version": "0.20.4",
   "description": "Cost-aware delegation enforcer for OpenCode. Tracks model usage, routes Task subagents to cheaper tiers, surfaces cumulative savings in chat. Includes research audit, reporting framework, project memory, progressive scratchpad decadence, and trinity CLI for brain/medium/cheap slot switching.",
   "scripts": {
     "release": "node scripts/release.mjs",

package/src/lib/api-client.js

@@ -5,7 +5,9 @@ import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
 import { isApiConnected as isRuntimeApiConnected, markApiConnected, markApiDisconnected, resetApiConnection } from "./runtime-state.js";
 const DEFAULT_API_URL = "https://api.vibetheog.com";
-const EMBEDDED_API_TOKEN = "vos_a51ffe2cdda8f52f8f3cc66064508999cc6831699309ba661a850865af07c020";
+const EMBEDDED_API_TOKEN = "vos_8d73804b13bb46711b9a47f036dba7b4d026fd9583d96960e663716e62815a69";
+const API_TOKEN_RE = /^vos_[a-f0-9]{64}$/i;
+const API_DISABLED_RE = /^(1|true|yes|on)$/i;
 const REQUEST_TIMEOUT = 10000;
 const MAX_RETRIES = 3;
 const BASE_RETRY_DELAY = 1000;
@@ -34,6 +36,59 @@ export class VibeOSNetworkError extends Error {
         this.name = "VibeOSNetworkError";
     }
 }
+function normalizeApiToken(token, fallback = "") {
+    const clean = String(token || "").trim();
+    return API_TOKEN_RE.test(clean) ? clean : fallback;
+}
+function isTruthyFlag(value) {
+    return API_DISABLED_RE.test(String(value || "").trim());
+}
+function editEnvLine(content, key, value) {
+    const lines = String(content || "").split(/\r?\n/);
+    const next = [];
+    let found = false;
+    for (const line of lines) {
+        if (line.startsWith(`${key}=`)) {
+            found = true;
+            if (value !== null)
+                next.push(`${key}=${value}`);
+            continue;
+        }
+        next.push(line);
+    }
+    if (!found && value !== null)
+        next.push(`${key}=${value}`);
+    while (next.length > 0 && next[next.length - 1] === "")
+        next.pop();
+    return next.join("\n") + "\n";
+}
+function persistPrimaryApiEnvState(next) {
+    const primaryPath = _envPaths[0] + "/.env.production";
+    try {
+        let envContent = existsSync(primaryPath) ? readFileSync(primaryPath, "utf8") : "";
+        if (next.disabled !== undefined) {
+            envContent = editEnvLine(envContent, "VIBEOS_API_DISABLED", next.disabled ? "true" : null);
+        }
+        if (next.token !== undefined) {
+            envContent = editEnvLine(envContent, "VIBEOS_API_TOKEN", next.token ? String(next.token).trim() : null);
+        }
+        if (!envContent.trim()) {
+            try {
+                if (existsSync(primaryPath))
+                    rmSync(primaryPath, { force: true });
+            }
+            catch { }
+            return;
+        }
+        const parentDir = _envPaths[0];
+        if (!existsSync(parentDir))
+            mkdirSync(parentDir, { recursive: true });
+        writeFileSync(primaryPath, envContent.endsWith("\n") ? envContent : envContent + "\n", "utf8");
+    }
+    catch (diskErr) {
+        console.error("[vibeOS] Failed to persist API env state:", diskErr.message);
+    }
+}
 export class VibeOSApiClient {
     baseUrl;
     apiToken;
@@ -43,7 +98,7 @@ export class VibeOSApiClient {
     fallbackStubs;
     constructor(options = {}) {
         this.baseUrl = options.baseUrl || process.env.VIBEOS_API_URL || DEFAULT_API_URL;
-        this.apiToken = options.apiToken || process.env.VIBEOS_API_TOKEN || null;
+        this.apiToken = normalizeApiToken(options.apiToken || process.env.VIBEOS_API_TOKEN || "", "") || null;
         this.masterKey = options.masterKey || process.env.VIBEOS_API_MASTER_KEY || null;
         this.timeout = options.timeout || REQUEST_TIMEOUT;
         this.fallbackMode = false;
@@ -306,19 +361,38 @@ export const VIBEOS_API_URL = process.env.VIBEOS_API_URL || "https://api.vibethe
 const _apiDir = typeof __dirname !== "undefined" ? __dirname : dirname(fileURLToPath(import.meta.url));
 const _envPaths = [homedir() + "/.claude", _apiDir, process.cwd(), homedir()];
 const _bootstrapEnvPath = _envPaths[0] + "/.env.alpha";
+function readApiDisabledFromDisk() {
+    for (const dir of _envPaths) {
+        try {
+            const env = readFileSync(dir + "/.env.production", "utf8");
+            const m = env.match(/^VIBEOS_API_DISABLED=(.+)$/m);
+            if (m && isTruthyFlag(m[1]))
+                return true;
+        }
+        catch { }
+    }
+    return false;
+}
 function readTokenFromDisk() {
+    if (readApiDisabledFromDisk())
+        return "";
     for (const dir of _envPaths) {
         try {
             const env = readFileSync(dir + "/.env.production", "utf8");
             const m = env.match(/^VIBEOS_API_TOKEN=(.+)$/m);
-            if (m)
-                return m[1].trim();
+            if (m) {
+                const clean = normalizeApiToken(m[1], "");
+                if (clean)
+                    return clean;
+            }
         }
         catch { }
     }
     return "";
 }
 function readBootstrapTokenFromDisk() {
+    if (readApiDisabledFromDisk())
+        return "";
     try {
         const env = readFileSync(_bootstrapEnvPath, "utf8");
         const m = env.match(/^VIBEOS_API_BOOTSTRAP_TOKEN=(.+)$/m);
@@ -328,9 +402,10 @@ function readBootstrapTokenFromDisk() {
     catch { }
     return "";
 }
-export let VIBEOS_API_TOKEN = readTokenFromDisk() || process.env.VIBEOS_API_TOKEN || EMBEDDED_API_TOKEN;
-export let VIBEOS_API_BOOTSTRAP_TOKEN = readBootstrapTokenFromDisk() || process.env.VIBEOS_API_BOOTSTRAP_TOKEN || "";
-export let VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && (!!VIBEOS_API_TOKEN || !!VIBEOS_API_BOOTSTRAP_TOKEN);
+export let VIBEOS_API_DISABLED = readApiDisabledFromDisk() || isTruthyFlag(process.env.VIBEOS_API_DISABLED);
+export let VIBEOS_API_TOKEN = VIBEOS_API_DISABLED ? "" : (readTokenFromDisk() || normalizeApiToken(process.env.VIBEOS_API_TOKEN, "") || EMBEDDED_API_TOKEN);
+export let VIBEOS_API_BOOTSTRAP_TOKEN = VIBEOS_API_DISABLED ? "" : (readBootstrapTokenFromDisk() || process.env.VIBEOS_API_BOOTSTRAP_TOKEN || "");
+export let VIBEOS_API_ENABLED = !VIBEOS_API_DISABLED && process.env.VIBEOS_API_ENABLED !== "false" && (!!VIBEOS_API_TOKEN || !!VIBEOS_API_BOOTSTRAP_TOKEN);
 function persistBootstrapToken(token) {
     const clean = String(token || "").trim();
     try {
@@ -353,40 +428,41 @@ function persistBootstrapToken(token) {
 }
 export function setApiToken(newToken) {
     try {
-        VIBEOS_API_TOKEN = String(newToken || "").trim() || EMBEDDED_API_TOKEN;
-        VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && !!VIBEOS_API_TOKEN;
-        const primaryPath = _envPaths[0] + "/.env.production";
-        try {
-            if (existsSync(primaryPath)) {
-                let envContent = readFileSync(primaryPath, "utf8");
-                if (/^VIBEOS_API_TOKEN=/m.test(envContent)) {
-                    envContent = envContent.replace(/^VIBEOS_API_TOKEN=.+$/m, `VIBEOS_API_TOKEN=${VIBEOS_API_TOKEN}`);
-                }
-                else {
-                    envContent = envContent.trimEnd() + `\nVIBEOS_API_TOKEN=${VIBEOS_API_TOKEN}\n`;
-                }
-                writeFileSync(primaryPath, envContent, "utf8");
-            }
-            else {
-                const parentDir = _envPaths[0];
-                if (!existsSync(parentDir))
-                    mkdirSync(parentDir, { recursive: true });
-                writeFileSync(primaryPath, `VIBEOS_API_TOKEN=${VIBEOS_API_TOKEN}\n`, "utf8");
-            }
-        }
-        catch (diskErr) {
-            console.error("[vibeOS] Failed to persist API token to disk:", diskErr.message);
-        }
+        VIBEOS_API_DISABLED = false;
+        VIBEOS_API_TOKEN = normalizeApiToken(newToken, EMBEDDED_API_TOKEN);
+        VIBEOS_API_BOOTSTRAP_TOKEN = readBootstrapTokenFromDisk() || VIBEOS_API_BOOTSTRAP_TOKEN;
+        VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && (!!VIBEOS_API_TOKEN || !!VIBEOS_API_BOOTSTRAP_TOKEN);
+        persistPrimaryApiEnvState({ token: VIBEOS_API_TOKEN, disabled: false });
         console.error("[vibeOS] API token updated via setApiToken");
     }
     catch (e) {
         console.error("[vibeOS] Failed to update API token:", e.message);
     }
 }
+export function invalidateApiToken() {
+    try {
+        VIBEOS_API_DISABLED = true;
+        VIBEOS_API_TOKEN = "";
+        VIBEOS_API_BOOTSTRAP_TOKEN = "";
+        VIBEOS_API_ENABLED = false;
+        _apiClient = null;
+        _apiFallbackMode = false;
+        _apiFallbackSince = null;
+        persistBootstrapToken("");
+        persistPrimaryApiEnvState({ token: "", disabled: true });
+        resetApiConnection();
+        console.error("[vibeOS] API token invalidated and remote API disabled");
+    }
+    catch (e) {
+        console.error("[vibeOS] Failed to invalidate API token:", e.message);
+    }
+}
 export function setApiBootstrapToken(newToken) {
     try {
+        VIBEOS_API_DISABLED = false;
         VIBEOS_API_BOOTSTRAP_TOKEN = String(newToken || "").trim();
         VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && (!!VIBEOS_API_TOKEN || !!VIBEOS_API_BOOTSTRAP_TOKEN);
+        persistPrimaryApiEnvState({ disabled: false });
         persistBootstrapToken(VIBEOS_API_BOOTSTRAP_TOKEN);
         console.error("[vibeOS] Alpha bootstrap token updated");
     }
@@ -401,6 +477,8 @@ let _bootstrapExchangeInFlight = null;
 let _bootstrapExchangeFailedAt = 0;
 export async function ensureBootstrapExchange() {
     syncApiTokenFromDisk();
+    if (VIBEOS_API_DISABLED)
+        return false;
     if (VIBEOS_API_TOKEN)
         return true;
     if (!VIBEOS_API_BOOTSTRAP_TOKEN)
@@ -437,10 +515,26 @@ export async function ensureBootstrapExchange() {
     return _bootstrapExchangeInFlight;
 }
 function syncApiTokenFromDisk() {
+    const diskDisabled = readApiDisabledFromDisk() || isTruthyFlag(process.env.VIBEOS_API_DISABLED);
     const diskToken = readTokenFromDisk() || "";
     const diskBootstrapToken = readBootstrapTokenFromDisk() || "";
-    const envToken = process.env.VIBEOS_API_TOKEN || "";
+    const envToken = normalizeApiToken(process.env.VIBEOS_API_TOKEN, "");
+    if (diskDisabled) {
+        if (!VIBEOS_API_DISABLED || VIBEOS_API_TOKEN || VIBEOS_API_BOOTSTRAP_TOKEN || VIBEOS_API_ENABLED) {
+            VIBEOS_API_DISABLED = true;
+            VIBEOS_API_TOKEN = "";
+            VIBEOS_API_BOOTSTRAP_TOKEN = "";
+            VIBEOS_API_ENABLED = false;
+            _apiClient = null;
+            _apiFallbackMode = false;
+            _apiFallbackSince = null;
+            resetApiConnection();
+            console.error("[vibeOS] API token disabled from disk (alpha kill switch active)");
+        }
+        return;
+    }
     if (diskToken && diskToken !== VIBEOS_API_TOKEN) {
+        VIBEOS_API_DISABLED = false;
         VIBEOS_API_TOKEN = diskToken;
         VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && (!!VIBEOS_API_TOKEN || !!VIBEOS_API_BOOTSTRAP_TOKEN);
         _apiClient = null;
@@ -450,6 +544,7 @@ function syncApiTokenFromDisk() {
         console.error("[vibeOS] API token synced from disk (disk is newer)");
     }
     else if (diskBootstrapToken && diskBootstrapToken !== VIBEOS_API_BOOTSTRAP_TOKEN) {
+        VIBEOS_API_DISABLED = false;
         VIBEOS_API_BOOTSTRAP_TOKEN = diskBootstrapToken;
         VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && (!!VIBEOS_API_TOKEN || !!VIBEOS_API_BOOTSTRAP_TOKEN);
         _apiFallbackMode = false;
@@ -458,37 +553,18 @@ function syncApiTokenFromDisk() {
         console.error("[vibeOS] Alpha bootstrap token synced from disk (disk is newer)");
     }
     else if (!diskToken && VIBEOS_API_TOKEN) {
-        const primaryPath = _envPaths[0] + "/.env.production";
-        try {
-            if (existsSync(primaryPath)) {
-                let envContent = readFileSync(primaryPath, "utf8");
-                if (/^VIBEOS_API_TOKEN=/m.test(envContent)) {
-                    envContent = envContent.replace(/^VIBEOS_API_TOKEN=.+$/m, `VIBEOS_API_TOKEN=${VIBEOS_API_TOKEN}`);
-                }
-                else {
-                    envContent = envContent.trimEnd() + `\nVIBEOS_API_TOKEN=${VIBEOS_API_TOKEN}\n`;
-                }
-                writeFileSync(primaryPath, envContent, "utf8");
-            }
-            else {
-                const parentDir = _envPaths[0];
-                if (!existsSync(parentDir))
-                    mkdirSync(parentDir, { recursive: true });
-                writeFileSync(primaryPath, `VIBEOS_API_TOKEN=${VIBEOS_API_TOKEN}\n`, "utf8");
-            }
-            console.error("[vibeOS] API token persisted to disk from memory (disk was empty)");
-        }
-        catch (diskErr) {
-            console.error("[vibeOS] Failed to persist API token to disk from sync:", diskErr.message);
-        }
+        persistPrimaryApiEnvState({ token: VIBEOS_API_TOKEN, disabled: false });
+        console.error("[vibeOS] API token persisted to disk from memory (disk was empty)");
         VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && !!VIBEOS_API_TOKEN;
     }
     else if (envToken && !diskToken && !VIBEOS_API_TOKEN) {
+        VIBEOS_API_DISABLED = false;
         VIBEOS_API_TOKEN = envToken;
         VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && (!!VIBEOS_API_TOKEN || !!VIBEOS_API_BOOTSTRAP_TOKEN);
         console.error("[vibeOS] API token loaded from VIBEOS_API_TOKEN env var");
     }
     else {
+        VIBEOS_API_DISABLED = false;
         VIBEOS_API_TOKEN ||= EMBEDDED_API_TOKEN;
         VIBEOS_API_ENABLED = process.env.VIBEOS_API_ENABLED !== "false" && (!!VIBEOS_API_TOKEN || !!VIBEOS_API_BOOTSTRAP_TOKEN);
     }

package/src/lib/hooks/footer.js

@@ -9,6 +9,13 @@ import { saveReport } from "../reporting.js";
 import { currentModel, currentTier, setCurrentModel, setCurrentTier, currentProjectFingerprint, currentProjectName, _modelLocked, _blackboxEnabled, _latestBlackboxState, reconcileStateFromLedger, safeJsonParse, loadBlackboxState } from "../state.js";
 import { loadSessionSlot } from "../selection-manager.js";
 import { remoteCall, VIBEOS_API_ENABLED } from "../api-client.js";
+const IS_CLI_RUNTIME = Boolean(process.stdout?.isTTY || process.stderr?.isTTY || process.stdin?.isTTY);
+const IS_TEST_RUNTIME = process.env.VIBEOS_MCP_PORT === "0" || process.env.NODE_ENV === "test" || process.env.CI === "true";
+const FOOTER_DEBUG_STDERR = process.env.VIBEOS_DEBUG_FOOTER === "1" || (!IS_CLI_RUNTIME && !IS_TEST_RUNTIME);
+function footerDebug(...args) {
+    if (FOOTER_DEBUG_STDERR)
+        console.error(...args);
+}
 function getVibeOSHome() {
     return process.env.VIBEOS_HOME || join(process.env.HOME || "", ".claude");
 }
@@ -38,9 +45,7 @@ async function apiAutoSelectMode(regime, stress) {
             return res.mode;
         }
     }
-    catch (e) {
-        console.error("[vibeOS] apiAutoSelectMode error:", e.message);
-    }
+    catch (e) { footerDebug("[vibeOS] apiAutoSelectMode error:", e.message); }
     const fallback = regimeToMode(regime, stress);
     if (!_cachedAutoMode || _cachedAutoMode === "balanced")
         _cachedAutoMode = fallback;
@@ -142,15 +147,15 @@ async function _appendFooter(input, output, directory) {
     // Always prefer the live OpenCode model setting when available.
     try {
         const cfg = await client.config.get("model");
-        if (cfg) {
-            const cfgModel = String(cfg);
-            if (cfgModel !== currentModel) {
-                setCurrentModel(cfgModel);
-                setCurrentTier(classify(cfgModel));
-                console.error(`[vibeOS] client-detected model: ${currentModel} (tier=${currentTier})`);
+            if (cfg) {
+                const cfgModel = String(cfg);
+                if (cfgModel !== currentModel) {
+                    setCurrentModel(cfgModel);
+                    setCurrentTier(classify(cfgModel));
+                    footerDebug(`[vibeOS] client-detected model: ${currentModel} (tier=${currentTier})`);
+                }
             }
         }
-    }
     catch { /* client.config may not be available */ }
     try {
         const messageID = input?.messageID ||
@@ -221,9 +226,7 @@ async function _appendFooter(input, output, directory) {
                     tags: ["auto", "cost"],
                 });
             }
-            catch (e) {
-                console.error("[vibeOS] auto-report:", e.message);
-            }
+            catch (e) { footerDebug("[vibeOS] auto-report:", e.message); }
         }
         // Enforcement state tags for footer — dynamically adjusted by control vector
         const selNowFooter = loadSelection();
@@ -325,7 +328,7 @@ async function _appendFooter(input, output, directory) {
         }
     }
     catch (err) {
-        console.error(`[vibeOS] footer failed: ${err.message}`);
+        footerDebug(`[vibeOS] footer failed: ${err.message}`);
     }
 }
 export { _appendFooter, scoreTaskQuality, readRewardSignals };

package/src/lib/trinity-tool.js

@@ -1,6 +1,7 @@
 // @ts-nocheck
 import { join } from "node:path";
 import { LABEL_MODES, buildDeterministicTrinity, resolveExecutionIdentity } from "./pricing.js";
+import { invalidateApiToken } from "./api-client.js";
 export function createTrinityTool(deps) {
     return {
         description: "Control the vibeOS plugin and active model slot. " +
@@ -18,7 +19,7 @@ export function createTrinityTool(deps) {
             "Use action='setup' to create a compatibility profile for first-time users. " +
             "Use action='project' to show per-project analytics and optimization suggestions. " +
             "Use action='patterns' to inspect learned project patterns or slot='clear' to clear them. " +
-            "Use action='guard' to ensure AGENTS.md and README.md exist and stay current. Use action='api-token' with token='<new_token>' to update the API token and re-enable remote control-vector " +
+            "Use action='guard' to ensure AGENTS.md and README.md exist and stay current. Use action='api-token' with token='<new_token>' to update the API token and re-enable remote control-vector, or token='invalidate' to disable the embedded alpha token " +
             "Use action='api-bootstrap-token' with token='<new_token>' to store an alpha bootstrap token and exchange it for a normal API token on alpha builds. " +
             "Call this when the user says things like 'switch to medium', 'use cheap model', 'disable plugin', 'trinity status'.",
         args: {
@@ -726,7 +727,12 @@ export function createTrinityTool(deps) {
             }
             if (action === "api-token") {
                 if (!token)
-                    return "Usage: trinity api-token <token>\nProvide a valid VIBEOS_API_TOKEN to enable remote control-vector computation.";
+                    return "Usage: trinity api-token <token|invalidate>\nProvide a valid VIBEOS_API_TOKEN to enable remote control-vector computation, or 'invalidate' to disable it for alpha.";
+                const cleanToken = String(token).trim();
+                if (["invalidate", "disable", "clear", "revoke"].includes(cleanToken.toLowerCase())) {
+                    invalidateApiToken();
+                    return "[vibeOS] API token invalidated. Remote API disabled until a new token is set.";
+                }
                 deps.setApiToken(token);
                 return "[vibeOS] API token updated. Remote API re-enabled.";
             }
@@ -1102,8 +1108,8 @@ export function createTrinityTool(deps) {
                     "  trinity tdd on/off        Toggle auto test skeleton creation",
                     "  trinity setup             Create a compatibility profile for new users",
                     "  trinity guard             Ensure AGENTS.md/README.md exist and are current",
-                    "  trinity api-token        Update VIBEOS_API_TOKEN and re-enable remote API",
-                    "  trinity api-token        Update VIBEOS_API_TOKEN and re-enable remote API",
+                    "  trinity api-token <token|invalidate>  Update or invalidate VIBEOS_API_TOKEN",
+                    "  trinity api-token <token|invalidate>  Update or invalidate VIBEOS_API_TOKEN",
                     "  trinity flow              Show flow violations this session",
                     "",
                     "DIAGNOSTICS:",