@essentialai/cogent-bridge 3.21.2 → 3.21.3

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 3.21.3 — 2026-09-01
+
+### Fixed — `add_to_path` silently persisted nothing, stranding `cogent-codex` after a "successful" install
+
+A second, independent cause of the same `zsh: command not found: cogent-codex` report. The helper
+looped `.zshrc`/`.bashrc`/`.profile` and returned at the FIRST that existed:
+
+1. **Fresh macOS account: none of them exist** (macOS ships no default rc; zsh reads `/etc/zshrc`).
+   Every test failed, the loop ended, and the function returned 0 having written **nothing**. The
+   in-process `export PATH` still made `command -v cogent-codex` succeed *inside* the installer, so
+   it printed "Codex: start with cogent-codex" and "Done." — and the user's next terminal said
+   `command not found`. Completely silent.
+2. **First-match-wins ignored `$SHELL`:** a zsh user with a `~/.bashrc` (nvm, conda, pyenv and
+   rustup all create one) got the line written where zsh never reads it — plus a confident message
+   naming the wrong file, which is worse than no message.
+3. **The append was unguarded under `set -e`:** a read-only `~/.zshrc` (nix home-manager, chezmoi,
+   stow, or a root-owned dotfile) aborted the ENTIRE installer at step 1, before either agent
+   branch ran — strictly worse than the 3.21.2 bug.
+
+Now: the line goes to every rc that exists **and unconditionally to the login shell's rc** (created
+if absent), each write is guarded and idempotent, an unwritable file is a warning rather than a
+death, and if nothing could be persisted the installer says so and prints the exact line to add by
+hand. Both call sites are `|| true` so PATH persistence can never take down a good install.
+
+### Added — PATH-persistence cases in the install-matrix gate
+
+`scripts/install-matrix-test.mjs` now exercises the rendered `add_to_path` directly against fake
+homes: **no-rc-files**, **bashrc-only-zsh-user**, **readonly-zshrc**, **rerun-idempotent**.
+Mutation-proven: 3 of 4 RED against the 3.21.2 script, all GREEN after the fix. The gate also
+caught an incomplete first attempt at this very fix before it shipped.
+
+Found by an adversarial audit of the installer rather than by another user report.
+
 ## 3.21.2 — 2026-09-01
 
 ### Fixed — `curl https://cogent.tools/install.sh | sh` died on its FIRST step for many users

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@essentialai/cogent-bridge",
-  "version": "3.21.2",
+  "version": "3.21.3",
   "description": "Cogent Bridge — cross-agent comms for Claude Code, OpenAI Codex and Slack. Codex users: install with `curl -fsSL https://cogent.tools/install.sh | sh`, then start with `cogent-codex` for real-time peer wake.",
   "type": "module",
   "workspaces": [

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.eaisdevelopment/cogent",
   "title": "Cogent Bridge from Essential AI Solutions (essentialai.uk)",
   "description": "MCP bridge for inter-session communication between Claude Code instances",
-  "version": "3.21.2",
+  "version": "3.21.3",
   "repository": {
     "url": "https://github.com/eaisdevelopment/cogent",
     "source": "github"
@@ -12,7 +12,7 @@
     {
       "registryType": "npm",
       "identifier": "@essentialai/cogent-bridge",
-      "version": "3.21.2",
+      "version": "3.21.3",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"