consult-mcp 1.0.0 → 1.0.2

package/README.md

@@ -13,7 +13,7 @@ npx -y consult-mcp@latest review --base main
 
 With [live sessions](#live-sessions) on, agents can also ask the sessions you already have running and message them, and with [task dispatch](#task-dispatch) on, hand a coding task to a Codex or Grok worker and follow its progress.
 
-[consult.n3el.dev](https://consult.n3el.dev) · [npm](https://www.npmjs.com/package/consult-mcp)
+[getconsult.dev](https://getconsult.dev) · [npm](https://www.npmjs.com/package/consult-mcp)
 
 ## Install
 
@@ -239,7 +239,7 @@ node dist/cli.js install              # register this checkout with your agents
 
 Releases: bump `version` in `package.json`, then push a matching tag (`git tag v0.3.0 && git push --tags`). The [release workflow](.github/workflows/release.yml) publishes to npm with provenance through npm trusted publishing, then creates the GitHub release. Everyone using `@latest` picks it up on their next agent session. Tags with a pre-release suffix (`v0.3.0-rc.1`) publish to the `next` dist-tag instead of `latest`.
 
-The landing page is in [`site/`](site) and deploys to [consult.n3el.dev](https://consult.n3el.dev) on Vercel.
+The landing page is in [`site/`](site) and deploys to [getconsult.dev](https://getconsult.dev) on Vercel. The old address, consult.n3el.dev, redirects there.
 
 ## License
 

package/dist/adapters/codex.js

@@ -13,13 +13,42 @@ const WORKSPACE_WRITE = [
 // Codex runs MCP tools outside its shell sandbox, so advisors and workers get none: plugins are switched off
 // (they bring their own MCP servers) and every server still enabled is disabled by name.
 // That includes consult itself, which is what stops agents from consulting each other in a loop.
+// Names are interpolated into `-c mcp_servers.<name>.enabled=false`. Codex splits that key only on ".", so a
+// name with spaces is disabled as is, but one holding ".", "=", quotes, control characters or edge whitespace
+// would not reliably name the server, and is refused. The JSON list also includes each server's env, so a parse
+// failure must not echo stdout.
+const SAFE_MCP_NAME = /^[^\s.="'\x00-\x1f](?:[^.="'\x00-\x1f]*[^\s.="'\x00-\x1f])?$/;
+const MCP_LIST_UNREADABLE = "could not parse `codex mcp list --json`; refusing to run codex with its MCP servers still enabled";
 async function listEnabledMcpServers(run, cwd, signal) {
     const res = await run("codex", ["mcp", "list", "--json", ...PLUGINS_OFF], { cwd, timeoutMs: 30_000, signal });
-    if (res.code !== 0) {
-        throw new AdvisorError(`could not list codex MCP servers to disable them: ${res.stderr.trim().slice(-500)}`);
+    if (res.stopped || res.code !== 0) {
+        const detail = res.stderr.trim().slice(-500) || res.stopped || "exited unsuccessfully";
+        throw new AdvisorError(`could not list codex MCP servers to disable them: ${detail}`);
     }
-    const servers = JSON.parse(res.stdout);
-    return servers.filter((s) => s.enabled).map((s) => s.name);
+    let parsed;
+    try {
+        parsed = JSON.parse(res.stdout);
+    }
+    catch {
+        throw new AdvisorError(MCP_LIST_UNREADABLE);
+    }
+    if (!Array.isArray(parsed))
+        throw new AdvisorError(MCP_LIST_UNREADABLE);
+    const names = [];
+    for (const entry of parsed) {
+        if (typeof entry !== "object" || entry === null || typeof entry.name !== "string") {
+            throw new AdvisorError(MCP_LIST_UNREADABLE);
+        }
+        const { name, enabled } = entry;
+        if (enabled !== true)
+            continue;
+        if (!SAFE_MCP_NAME.test(name)) {
+            const shown = name.length > 80 ? `${name.slice(0, 80)}…` : name;
+            throw new AdvisorError(`cannot safely disable codex MCP server ${JSON.stringify(shown)}; disable or rename it before consulting codex`);
+        }
+        names.push(name);
+    }
+    return names;
 }
 const prepare = async (run, cwd, signal) => {
     const names = await listEnabledMcpServers(run, cwd, signal);

package/dist/codex-config.js

@@ -56,9 +56,17 @@ function withoutConsult(config) {
     return Object.keys(otherServers).length > 0 ? { ...rest, mcp_servers: otherServers } : rest;
 }
 const hasConsult = (config) => CODEX_SERVER in (config.mcp_servers ?? {});
-/** Whether the codex config has a consult entry. A missing file means not registered. */
+/**
+ * Whether the codex config has a consult entry. A missing, unreadable, or unparseable file means not
+ * registered: `consult settings` checks this for every installed CLI, and a broken config must not abort it.
+ */
 export function isCodexRegistered(path) {
-    return existsSync(path) && hasConsult(parseConfig(readFileSync(path, "utf8"), path));
+    try {
+        return existsSync(path) && hasConsult(parseConfig(readFileSync(path, "utf8"), path));
+    }
+    catch {
+        return false;
+    }
 }
 function writeAtomically(path, text) {
     mkdirSync(dirname(path), { recursive: true });

package/dist/tui.js

@@ -68,7 +68,17 @@ export async function runSettings(io) {
     const current = await loadOrReset(io);
     if (!current)
         return cancel("Left settings unchanged.");
-    const registered = (await Promise.all(io.installed.map(async (agent) => ((await io.isRegistered(agent)) ? [agent] : [])))).flat();
+    const registered = [];
+    for (const agent of io.installed) {
+        try {
+            if (await io.isRegistered(agent))
+                registered.push(agent);
+        }
+        catch (err) {
+            // One CLI failing its probe must not abort the wizard; the user can still change the other settings.
+            log.warn(`${agent}: ${errorMessage(err)}`);
+        }
+    }
     const supported = io.sessionsSupported ?? true;
     if (!supported)
         log.info(`Note: ${SESSIONS_UNSUPPORTED}.`);

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "consult-mcp",
-  "version": "1.0.0",
-  "description": "MCP server that lets Claude Code, Codex and Grok ask each other for a second opinion through the CLIs already signed in on your machine",
+  "version": "1.0.2",
+  "mcpName": "io.github.neelsatyavolu/consult",
+  "description": "Get a second opinion on your code from every coding agent you have. Claude Code, Codex and Grok review each other's diffs and answer each other's questions, even inside a session that's already running. Uses the CLIs you're signed in to, no API keys.",
   "keywords": [
     "mcp",
     "mcp-server",
@@ -13,7 +14,7 @@
     "second-opinion",
     "code-review"
   ],
-  "homepage": "https://consult.n3el.dev",
+  "homepage": "https://getconsult.dev",
   "bugs": {
     "url": "https://github.com/neelsatyavolu/consult/issues"
   },