@essentialai/cogent-bridge 3.21.1 → 3.21.3

package/CHANGELOG.md

@@ -1,5 +1,75 @@
 # Changelog
 
+## 3.21.3 — 2026-09-01
+
+### Fixed — `add_to_path` silently persisted nothing, stranding `cogent-codex` after a "successful" install
+
+A second, independent cause of the same `zsh: command not found: cogent-codex` report. The helper
+looped `.zshrc`/`.bashrc`/`.profile` and returned at the FIRST that existed:
+
+1. **Fresh macOS account: none of them exist** (macOS ships no default rc; zsh reads `/etc/zshrc`).
+   Every test failed, the loop ended, and the function returned 0 having written **nothing**. The
+   in-process `export PATH` still made `command -v cogent-codex` succeed *inside* the installer, so
+   it printed "Codex: start with cogent-codex" and "Done." — and the user's next terminal said
+   `command not found`. Completely silent.
+2. **First-match-wins ignored `$SHELL`:** a zsh user with a `~/.bashrc` (nvm, conda, pyenv and
+   rustup all create one) got the line written where zsh never reads it — plus a confident message
+   naming the wrong file, which is worse than no message.
+3. **The append was unguarded under `set -e`:** a read-only `~/.zshrc` (nix home-manager, chezmoi,
+   stow, or a root-owned dotfile) aborted the ENTIRE installer at step 1, before either agent
+   branch ran — strictly worse than the 3.21.2 bug.
+
+Now: the line goes to every rc that exists **and unconditionally to the login shell's rc** (created
+if absent), each write is guarded and idempotent, an unwritable file is a warning rather than a
+death, and if nothing could be persisted the installer says so and prints the exact line to add by
+hand. Both call sites are `|| true` so PATH persistence can never take down a good install.
+
+### Added — PATH-persistence cases in the install-matrix gate
+
+`scripts/install-matrix-test.mjs` now exercises the rendered `add_to_path` directly against fake
+homes: **no-rc-files**, **bashrc-only-zsh-user**, **readonly-zshrc**, **rerun-idempotent**.
+Mutation-proven: 3 of 4 RED against the 3.21.2 script, all GREEN after the fix. The gate also
+caught an incomplete first attempt at this very fix before it shipped.
+
+Found by an adversarial audit of the installer rather than by another user report.
+
+## 3.21.2 — 2026-09-01
+
+### Fixed — `curl https://cogent.tools/install.sh | sh` died on its FIRST step for many users
+
+If a `cogent` marketplace was already declared from the older **GitHub Git URL**, Claude Code
+refuses to redeclare the name from a different source:
+
+```
+✘ Failed to add marketplace: Cannot add marketplace "cogent": its network source differs
+  from the one declared for it in settings ...
+```
+
+install.sh runs under `set -e`, so that single failure **killed the entire installer**. Because
+Claude Code is set up *before* Codex, the **Codex branch never ran** — the user was installing to
+get `cogent-codex`, and got no Codex install, no launcher, and no explanation beyond
+`command not found`. Latent since **2026-07-28**, shipped through every release since 3.12.0.
+
+Two fixes: the marketplace add is now **idempotent** (on a source conflict it removes the stale
+declaration and re-adds), and **every agent branch is failure-tolerant** — one agent's problem can
+no longer deny the user the other agent. If nothing at all installs, the script now says so and
+exits non-zero instead of printing a cheerful "Done."
+
+### Added — `scripts/install-matrix-test.mjs`, a HARD release gate (Step 13a)
+
+The blocker survived ~5 weeks because our only install check began with
+`claude plugin marketplace remove cogent` — it **deleted the state that triggers the bug**, then
+declared the install works. It proved "install works on a machine we just cleaned", never "install
+works on a real user's machine".
+
+The new gate runs the real installer against the states users are actually in — **clean**,
+**conflict-git** (followed the older Git-URL docs), **reinstall** — each in a throwaway
+`CLAUDE_CONFIG_DIR` so it is hermetic. Per state it asserts exit 0, conflict recovery, the final
+marketplace source, that `cogent@cogent` installs, **and that the Codex branch was reached**. It
+also asserts install.sh / uninstall.sh / marketplace.json are actually SERVED and that
+marketplace.json's version matches the release. Mutation-proven: RED against the live pre-fix
+script (reproducing the user's exact error), GREEN against the fixed build.
+
 ## 3.21.1 — 2026-08-31
 
 ### Fixed — a label session with an unreachable relay delayed the MCP handshake by ~2.4s

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@essentialai/cogent-bridge",
-  "version": "3.21.1",
+  "version": "3.21.3",
   "description": "Cogent Bridge — cross-agent comms for Claude Code, OpenAI Codex and Slack. Codex users: install with `curl -fsSL https://cogent.tools/install.sh | sh`, then start with `cogent-codex` for real-time peer wake.",
   "type": "module",
   "workspaces": [

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.eaisdevelopment/cogent",
   "title": "Cogent Bridge from Essential AI Solutions (essentialai.uk)",
   "description": "MCP bridge for inter-session communication between Claude Code instances",
-  "version": "3.21.1",
+  "version": "3.21.3",
   "repository": {
     "url": "https://github.com/eaisdevelopment/cogent",
     "source": "github"
@@ -12,7 +12,7 @@
     {
       "registryType": "npm",
       "identifier": "@essentialai/cogent-bridge",
-      "version": "3.21.1",
+      "version": "3.21.3",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"