vibo-mcp 1.3.0 → 1.3.2

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Vibo (vibodj.com) — plan & manage event music, song requests, ideas, guests, and playlists via natural language",
-    "version": "1.3.0"
+    "version": "1.3.2"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Vibo",
       "source": "./",
       "description": "MCP server for Vibo — browse & manage events, timeline, songs, the DJ song ideas/questions, guests, and exports to Spotify/Apple Music",
-      "version": "1.3.0",
+      "version": "1.3.2",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "vibo-mcp",
   "displayName": "Vibo",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "MCP server for Vibo (vibodj.com) — plan & manage event music, song requests, ideas, guests, and playlists via natural language",
   "author": {
     "name": "Chris Hall",
@@ -18,6 +18,6 @@
     "music",
     "mcp"
   ],
-  "skills": "./SKILL.md",
+  "skills": "./skills/",
   "mcp": "./.mcp.json"
 }

package/README.md

@@ -48,7 +48,7 @@ confirm-gated: without `confirm: true` it returns a dry-run preview and makes no
 network call.
 
 See [docs/VIBO-API.md](docs/VIBO-API.md) for the reverse-engineered API notes
-and [SKILL.md](SKILL.md) for the full tool list.
+and [skills/vibo-mcp/SKILL.md](skills/vibo-mcp/SKILL.md) for the full tool list.
 
 ## Development
 

package/dist/bundle.js

@@ -31040,8 +31040,12 @@ var API_KEY_RE = new RegExp([
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
 var QUERY_SECRET_RE = /([?&](?:access_token|refresh_token|client_secret|api_?key|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
+var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
+var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
+var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
 function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(JWT_RE, "[REDACTED]");
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
 }
 function truncateErrorMessage(text, max = DEFAULT_ERROR_MESSAGE_MAX) {
   const str = text === null || text === void 0 ? "" : String(text);
@@ -31116,7 +31120,7 @@ function toolAnnotations(opts = {}) {
 }
 
 // src/version.ts
-var VERSION = "1.3.0";
+var VERSION = "1.3.2";
 
 // src/client.ts
 import { dirname as dirname2, join as join2 } from "path";
@@ -31124,18 +31128,162 @@ import { fileURLToPath } from "url";
 
 // src/session-store.ts
 import { homedir } from "os";
-import { dirname, join } from "path";
-import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync, chmodSync } from "fs";
-function sessionFile() {
-  return readEnvVar("VIBO_SESSION_FILE") ?? join(homedir(), ".vibo-mcp", "session.json");
+import { join } from "path";
+
+// node_modules/@chrischall/mcp-utils/dist/session/index.js
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync } from "node:fs";
+import { dirname } from "node:path";
+function normalizeOrigin(input) {
+  try {
+    return new URL(input).origin.replace(/\/$/, "");
+  } catch {
+    return input.replace(/\/$/, "");
+  }
+}
+var SessionStore = class {
+  sessions = /* @__PURE__ */ new Map();
+  mostRecentKey = null;
+  filePath;
+  keyOf;
+  normalizeKey;
+  constructor(opts) {
+    this.filePath = opts.filePath;
+    this.keyOf = opts.keyOf;
+    this.normalizeKey = opts.normalizeKey ?? normalizeOrigin;
+    this.loadFromDisk();
+  }
+  loadFromDisk() {
+    if (!existsSync(this.filePath))
+      return;
+    try {
+      this.sessions = this.deserialize(readFileSync(this.filePath, "utf8"));
+      const keys = Array.from(this.sessions.keys());
+      this.mostRecentKey = keys[keys.length - 1] ?? null;
+    } catch (err) {
+      const backupPath = this.preserveCorruptFile();
+      const detail = err instanceof Error ? err.message : String(err);
+      console.error(`[mcp-utils] SessionStore: failed to parse ${this.filePath} (${detail}); ` + (backupPath !== null ? `preserved the corrupt file at ${backupPath}; ` : "could not preserve the corrupt file; ") + "starting with an empty store.");
+      this.sessions = /* @__PURE__ */ new Map();
+      this.mostRecentKey = null;
+    }
+  }
+  /**
+   * Move a corrupt store file to `<filePath>.corrupt` (or `.corrupt-<n>` if a
+   * previous backup exists) so a subsequent save cannot overwrite the only
+   * copy of the prior credentials. Best-effort: returns the backup path, or
+   * `null` if the rename failed.
+   */
+  preserveCorruptFile() {
+    try {
+      let candidate = `${this.filePath}.corrupt`;
+      for (let n = 1; existsSync(candidate) && n <= 100; n++) {
+        candidate = `${this.filePath}.corrupt-${n}`;
+      }
+      if (existsSync(candidate))
+        return null;
+      renameSync(this.filePath, candidate);
+      return candidate;
+    } catch {
+      return null;
+    }
+  }
+  /** Serialize the store to its on-disk JSON form (array, insertion order). */
+  serialize() {
+    return JSON.stringify(Array.from(this.sessions.values()), null, 2);
+  }
+  /** Parse on-disk JSON back into a keyed `Map`; empty map on invalid input. */
+  deserialize(body) {
+    const map2 = /* @__PURE__ */ new Map();
+    const arr = JSON.parse(body);
+    if (!Array.isArray(arr))
+      return map2;
+    for (const raw of arr) {
+      if (raw && typeof raw === "object") {
+        const s = raw;
+        const key = this.normalizeKey(this.keyOf(s));
+        map2.set(key, s);
+      }
+    }
+    return map2;
+  }
+  saveToDisk() {
+    const dir = dirname(this.filePath);
+    mkdirSync(dir, { recursive: true, mode: 448 });
+    if (existsSync(this.filePath)) {
+      try {
+        chmodSync(this.filePath, 384);
+      } catch {
+      }
+    }
+    writeFileSync(this.filePath, this.serialize(), { mode: 384 });
+    try {
+      chmodSync(this.filePath, 384);
+      chmodSync(dir, 448);
+    } catch {
+    }
+  }
+  /** Insert or replace a record, normalizing its key and marking it active. */
+  add(session) {
+    const key = this.normalizeKey(this.keyOf(session));
+    this.sessions.set(key, session);
+    this.mostRecentKey = key;
+    this.saveToDisk();
+  }
+  /** Look up by key; with no key, returns the active (most-recent) session. */
+  get(key) {
+    if (key !== void 0)
+      return this.sessions.get(this.normalizeKey(key)) ?? null;
+    if (this.mostRecentKey !== null)
+      return this.sessions.get(this.mostRecentKey) ?? null;
+    return null;
+  }
+  /** The most-recently-added session, or `null`. */
+  getActiveSession() {
+    return this.get();
+  }
+  /** All sessions in insertion order. */
+  list() {
+    return Array.from(this.sessions.values());
+  }
+  /** Remove a session; fixes up the active pointer. Returns whether it existed. */
+  remove(key) {
+    const normalized = this.normalizeKey(key);
+    const had = this.sessions.delete(normalized);
+    if (had) {
+      if (this.mostRecentKey === normalized) {
+        const keys = Array.from(this.sessions.keys());
+        this.mostRecentKey = keys[keys.length - 1] ?? null;
+      }
+      this.saveToDisk();
+    }
+    return had;
+  }
+  /** Clear in-memory state without touching disk. Test helper. */
+  resetForTest() {
+    this.sessions.clear();
+    this.mostRecentKey = null;
+  }
+};
+var TOKEN_REFRESH_SKEW_MS = 5 * 60 * 1e3;
+
+// src/session-store.ts
+var SESSION_KEY = "vibo";
+function openStore() {
+  return new SessionStore({
+    filePath: readEnvVar("VIBO_SESSION_FILE") ?? join(homedir(), ".vibo-mcp", "session.json"),
+    keyOf: (s) => typeof s.key === "string" && s.key ? s.key : SESSION_KEY,
+    normalizeKey: (k) => k
+    // fixed single key — no origin normalization
+  });
 }
 function loadSession() {
   try {
-    const file2 = sessionFile();
-    if (!existsSync(file2)) return null;
-    const parsed = JSON.parse(readFileSync(file2, "utf8"));
-    if (parsed && typeof parsed.accessToken === "string" && parsed.accessToken) {
-      return { accessToken: parsed.accessToken, refreshToken: parsed.refreshToken ?? null };
+    const rec = openStore().get(SESSION_KEY);
+    if (rec && typeof rec.accessToken === "string" && rec.accessToken) {
+      return {
+        accessToken: rec.accessToken,
+        refreshToken: typeof rec.refreshToken === "string" ? rec.refreshToken : null
+      };
     }
     return null;
   } catch {
@@ -31143,14 +31291,11 @@ function loadSession() {
   }
 }
 function saveSession(session) {
-  const file2 = sessionFile();
-  mkdirSync(dirname(file2), { recursive: true, mode: 448 });
-  writeFileSync(
-    file2,
-    JSON.stringify({ accessToken: session.accessToken, refreshToken: session.refreshToken ?? null }, null, 2),
-    { mode: 384 }
-  );
-  chmodSync(file2, 384);
+  openStore().add({
+    key: SESSION_KEY,
+    accessToken: session.accessToken,
+    refreshToken: session.refreshToken ?? null
+  });
 }
 
 // src/client.ts

package/dist/session-store.js

@@ -1,21 +1,26 @@
 import { homedir } from 'os';
-import { dirname, join } from 'path';
-import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync, chmodSync } from 'fs';
+import { join } from 'path';
 import { readEnvVar } from '@chrischall/mcp-utils';
-// Where a browser-captured token pair is persisted so it survives MCP restarts.
-// Override with VIBO_SESSION_FILE (used by tests). Written 0600 in a 0700 dir.
-function sessionFile() {
-    return readEnvVar('VIBO_SESSION_FILE') ?? join(homedir(), '.vibo-mcp', 'session.json');
+import { SessionStore } from '@chrischall/mcp-utils/session';
+const SESSION_KEY = 'vibo';
+// Constructed per call (it re-reads disk) so VIBO_SESSION_FILE is honored
+// dynamically, matching the previous read-env-on-every-call behaviour.
+function openStore() {
+    return new SessionStore({
+        filePath: readEnvVar('VIBO_SESSION_FILE') ?? join(homedir(), '.vibo-mcp', 'session.json'),
+        keyOf: (s) => (typeof s.key === 'string' && s.key ? s.key : SESSION_KEY),
+        normalizeKey: (k) => k, // fixed single key — no origin normalization
+    });
 }
 /** Load a previously-captured session, or null if none / unreadable. */
 export function loadSession() {
     try {
-        const file = sessionFile();
-        if (!existsSync(file))
-            return null;
-        const parsed = JSON.parse(readFileSync(file, 'utf8'));
-        if (parsed && typeof parsed.accessToken === 'string' && parsed.accessToken) {
-            return { accessToken: parsed.accessToken, refreshToken: parsed.refreshToken ?? null };
+        const rec = openStore().get(SESSION_KEY);
+        if (rec && typeof rec.accessToken === 'string' && rec.accessToken) {
+            return {
+                accessToken: rec.accessToken,
+                refreshToken: typeof rec.refreshToken === 'string' ? rec.refreshToken : null,
+            };
         }
         return null;
     }
@@ -25,19 +30,16 @@ export function loadSession() {
 }
 /** Persist a captured/refreshed token pair (0600 file in a 0700 dir). */
 export function saveSession(session) {
-    const file = sessionFile();
-    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
-    writeFileSync(file, JSON.stringify({ accessToken: session.accessToken, refreshToken: session.refreshToken ?? null }, null, 2), { mode: 0o600 });
-    // `mode` in writeFileSync only applies when the file is *created*; enforce
-    // 0600 on overwrite too (a pre-existing file keeps its old, possibly looser perms).
-    chmodSync(file, 0o600);
+    openStore().add({
+        key: SESSION_KEY,
+        accessToken: session.accessToken,
+        refreshToken: session.refreshToken ?? null,
+    });
 }
 /** Remove any persisted session. */
 export function clearSession() {
     try {
-        const file = sessionFile();
-        if (existsSync(file))
-            rmSync(file);
+        openStore().remove(SESSION_KEY);
     }
     catch {
         // best-effort

package/dist/version.js

@@ -2,4 +2,4 @@
 // literal on the line carrying the release marker; every manifest and the MCP
 // server banner import VERSION from here, so there is exactly one place to keep
 // in sync (and one release-please extra-files entry).
-export const VERSION = '1.3.0'; // x-release-please-version
+export const VERSION = '1.3.2'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibo-mcp",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "mcpName": "io.github.chrischall/vibo-mcp",
   "description": "Vibo (vibodj.com) MCP server for Claude — host/couple event music planning & management. Developed and maintained by AI (Claude Code).",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -31,7 +31,7 @@
   "files": [
     "dist",
     ".claude-plugin",
-    "SKILL.md",
+    "skills",
     ".mcp.json",
     "server.json"
   ],
@@ -44,14 +44,14 @@
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.10.4",
+    "@chrischall/mcp-utils": "^0.12.0",
     "@fetchproxy/bootstrap": "^1.3.4",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.0",
     "zod": "^4.4.2"
   },
   "devDependencies": {
-    "@types/node": "^25.5.2",
+    "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.2",
     "esbuild": "^0.28.0",
     "typescript": "^6.0.2",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/vibo-mcp",
     "source": "github"
   },
-  "version": "1.3.0",
+  "version": "1.3.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "vibo-mcp",
-      "version": "1.3.0",
+      "version": "1.3.2",
       "transport": {
         "type": "stdio"
       },