patchcord 0.3.46 → 0.3.47

package/bin/patchcord.mjs

@@ -24,6 +24,18 @@ function isSafeToken(t) {
   return /^[A-Za-z0-9_\-=+/.]+$/.test(t) && t.length < 200;
 }
 
+function isSafeUrl(u) {
+  try {
+    const parsed = new URL(u);
+    return parsed.protocol === "https:" || parsed.protocol === "http:";
+  } catch { return false; }
+}
+
+function isSafeId(s) {
+  return /^[A-Za-z0-9_\-]+$/.test(s) && s.length < 100;
+}
+
+
 if (cmd === "help" || cmd === "--help" || cmd === "-h") {
   console.log(`patchcord — agent messaging for AI coding agents
 
@@ -47,6 +59,16 @@ if (!cmd || cmd === "install" || cmd === "agent") {
   const fullStatusline = flags.includes("--full");
   const { readFileSync, writeFileSync } = await import("fs");
 
+  function safeReadJson(filePath) {
+    try {
+      let content = readFileSync(filePath, "utf-8");
+      // Strip JSONC comments (Zed, Gemini use JSONC)
+      content = content.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "");
+      content = content.replace(/,\s*([}\]])/g, "$1");
+      return JSON.parse(content);
+    } catch { return null; }
+  }
+
   console.log(`
   ___  ____ ___ ____ _  _ ____ ____ ____ ___
   |__] |__|  |  |    |__| |    |  | |__/ |  \\
@@ -341,7 +363,7 @@ if (!cmd || cmd === "install" || cmd === "agent") {
     const geminiPath = join(HOME, ".gemini", "settings.json");
     if (existsSync(geminiPath)) {
       try {
-        const existing = JSON.parse(readFileSync(geminiPath, "utf-8"));
+        const existing = safeReadJson(geminiPath) || {};
         if (existing.mcpServers?.patchcord) {
           console.log(`\n  ${yellow}⚠ Gemini CLI already configured${r}`);
           console.log(`  ${dim}${geminiPath}${r}`);
@@ -377,7 +399,7 @@ if (!cmd || cmd === "install" || cmd === "agent") {
       : join(HOME, ".config", "zed", "settings.json");
     if (existsSync(zedPath)) {
       try {
-        const existing = JSON.parse(readFileSync(zedPath, "utf-8"));
+        const existing = safeReadJson(zedPath) || {};
         if (existing.context_servers?.patchcord) {
           console.log(`\n  ${yellow}⚠ Zed already configured${r}`);
           console.log(`  ${dim}${zedPath}${r}`);
@@ -418,7 +440,7 @@ if (!cmd || cmd === "install" || cmd === "agent") {
         console.log(`  ${yellow}This overrides per-project config and causes conflicts.${r}`);
         const cleanGlobal = (await ask(`  ${dim}Remove patchcord from global config? (Y/n):${r} `)).trim().toLowerCase();
         if (cleanGlobal !== "n" && cleanGlobal !== "no") {
-          const cleaned = globalContent.replace(/\[mcp_servers\.patchcord\][^\[]*/s, "").replace(/\n{3,}/g, "\n\n").trim();
+          const cleaned = globalContent.replace(/\[mcp_servers\.patchcord\]\n(?:(?!\[)[^\n]*\n?)*/g, "").replace(/\n{3,}/g, "\n\n").trim();
           writeFileSync(globalCodexConfig, cleaned + "\n");
           console.log(`  ${green}✓${r} Removed from global config`);
         }
@@ -484,7 +506,14 @@ if (!cmd || cmd === "install" || cmd === "agent") {
   const customUrl = (await ask(`\n${dim}Custom server URL? (y/N):${r} `)).trim().toLowerCase();
   if (customUrl === "y" || customUrl === "yes") {
     const url = (await ask("Server URL: ")).trim();
-    if (url) serverUrl = url;
+    if (url) {
+      if (!isSafeUrl(url)) {
+        console.error("Invalid URL. Must start with https:// or http://");
+        rl.close();
+        process.exit(1);
+      }
+      serverUrl = url;
+    }
   }
 
   rl.close();
@@ -564,12 +593,7 @@ if (!cmd || cmd === "install" || cmd === "agent") {
   } else if (isGemini) {
     // Gemini CLI: global only (~/.gemini/settings.json)
     const geminiPath = join(HOME, ".gemini", "settings.json");
-    let geminiSettings = {};
-    if (existsSync(geminiPath)) {
-      try {
-        geminiSettings = JSON.parse(readFileSync(geminiPath, "utf-8"));
-      } catch {}
-    }
+    let geminiSettings = (existsSync(geminiPath) && safeReadJson(geminiPath)) || {};
     if (!geminiSettings.mcpServers) geminiSettings.mcpServers = {};
     geminiSettings.mcpServers.patchcord = {
       httpUrl: `${serverUrl}/mcp`,
@@ -592,12 +616,7 @@ if (!cmd || cmd === "install" || cmd === "agent") {
     const zedPath = process.platform === "darwin"
       ? join(HOME, "Library", "Application Support", "Zed", "settings.json")
       : join(HOME, ".config", "zed", "settings.json");
-    let zedSettings = {};
-    if (existsSync(zedPath)) {
-      try {
-        zedSettings = JSON.parse(readFileSync(zedPath, "utf-8"));
-      } catch {}
-    }
+    let zedSettings = (existsSync(zedPath) && safeReadJson(zedPath)) || {};
     if (!zedSettings.context_servers) zedSettings.context_servers = {};
     zedSettings.context_servers.patchcord = {
       url: `${serverUrl}/mcp`,
@@ -676,7 +695,7 @@ if (!cmd || cmd === "install" || cmd === "agent") {
     const configPath = join(codexDir, "config.toml");
     let existing = existsSync(configPath) ? readFileSync(configPath, "utf-8") : "";
     // Remove old patchcord config block if present
-    existing = existing.replace(/\[mcp_servers\.patchcord\][^\[]*/s, "").replace(/\n{3,}/g, "\n\n").trim();
+    existing = existing.replace(/\[mcp_servers\.patchcord\]\n(?:(?!\[)[^\n]*\n?)*/g, "").replace(/\n{3,}/g, "\n\n").trim();
     existing = existing.trimEnd() + `\n\n[mcp_servers.patchcord]\nurl = "${serverUrl}/mcp/bearer"\nhttp_headers = { "Authorization" = "Bearer ${token}", "X-Patchcord-Machine" = "${hostname}" }\n`;
     writeFileSync(configPath, existing);
     // Clean up any PATCHCORD_TOKEN we previously wrote to .env
@@ -799,7 +818,7 @@ if (cmd === "skill") {
     }
   } catch {}
 
-  if (!namespace || !agentId) {
+  if (!namespace || !agentId || !isSafeId(namespace) || !isSafeId(agentId)) {
     console.error("Cannot determine agent identity. Check your token.");
     process.exit(1);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchcord",
-  "version": "0.3.46",
+  "version": "0.3.47",
   "description": "Cross-machine agent messaging for Claude Code and Codex",
   "author": "ppravdin",
   "license": "MIT",