patchcord 0.3.46 → 0.3.48

package/bin/patchcord.mjs

@@ -24,6 +24,18 @@ function isSafeToken(t) {
   return /^[A-Za-z0-9_\-=+/.]+$/.test(t) && t.length < 200;
 }
 
+function isSafeUrl(u) {
+  try {
+    const parsed = new URL(u);
+    return parsed.protocol === "https:" || parsed.protocol === "http:";
+  } catch { return false; }
+}
+
+function isSafeId(s) {
+  return /^[A-Za-z0-9_\-]+$/.test(s) && s.length < 100;
+}
+
+
 if (cmd === "help" || cmd === "--help" || cmd === "-h") {
   console.log(`patchcord — agent messaging for AI coding agents
 
@@ -47,6 +59,16 @@ if (!cmd || cmd === "install" || cmd === "agent") {
   const fullStatusline = flags.includes("--full");
   const { readFileSync, writeFileSync } = await import("fs");
 
+  function safeReadJson(filePath) {
+    try {
+      let content = readFileSync(filePath, "utf-8");
+      // Strip JSONC comments (Zed, Gemini use JSONC)
+      content = content.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "");
+      content = content.replace(/,\s*([}\]])/g, "$1");
+      return JSON.parse(content);
+    } catch { return null; }
+  }
+
   console.log(`
   ___  ____ ___ ____ _  _ ____ ____ ____ ___
   |__] |__|  |  |    |__| |    |  | |__/ |  \\
@@ -236,38 +258,7 @@ if (!cmd || cmd === "install" || cmd === "agent") {
     const toolLabel = isZed ? "Zed" : isWindsurf ? "Windsurf" : "Gemini CLI";
     console.log(`\n  ${yellow}Note: ${toolLabel} uses global config — applies to all projects.${r}`);
   } else {
-    // Detect if this looks like a project folder
-    const isHome = cwd === HOME || cwd === HOME + "/";
-    const hasGit = existsSync(join(cwd, ".git"));
-    const hasProjectFile = [
-      "package.json", "Cargo.toml", "go.mod", "pyproject.toml", "pom.xml",
-      "build.gradle", "Makefile", "CMakeLists.txt", ".sln", "Gemfile",
-      "composer.json", "mix.exs", "Pipfile", "requirements.txt", "setup.py",
-    ].some(f => existsSync(join(cwd, f)));
-    const isRoot = cwd === "/" || cwd === "C:\\" || cwd === "C:/";
-    const isTmp = cwd.startsWith("/tmp") || cwd.includes("/temp");
-
-    if (isHome || isRoot) {
-      console.log(`\n  ${red}⚠ This is your home directory, not a project folder!${r}`);
-      console.log(`  ${yellow}The config will only work for the project folder where it's created.${r}`);
-      console.log(`  ${yellow}cd into your project first, then run npx patchcord@latest again.${r}\n`);
-      const force = (await ask(`  ${dim}Set up here anyway? (y/N):${r} `)).trim().toLowerCase();
-      if (force !== "y" && force !== "yes") {
-        rl.close();
-        process.exit(0);
-      }
-    } else if (!hasGit && !hasProjectFile && !isTmp) {
-      console.log(`\n  ${yellow}⚠ This doesn't look like a project folder${r} ${dim}(no .git or project files)${r}`);
-      console.log(`  ${dim}${cwd}${r}`);
-      console.log(`  ${dim}Make sure you're in the right folder — the agent only works here.${r}`);
-      const proceed = (await ask(`  ${dim}Continue? (y/N):${r} `)).trim().toLowerCase();
-      if (proceed !== "y" && proceed !== "yes") {
-        rl.close();
-        process.exit(0);
-      }
-    } else {
-      console.log(`\n${dim}Project:${r} ${bold}${cwd}${r}`);
-    }
+    console.log(`\n${dim}Project:${r} ${bold}${cwd}${r}`);
   }
 
 
@@ -341,7 +332,7 @@ if (!cmd || cmd === "install" || cmd === "agent") {
     const geminiPath = join(HOME, ".gemini", "settings.json");
     if (existsSync(geminiPath)) {
       try {
-        const existing = JSON.parse(readFileSync(geminiPath, "utf-8"));
+        const existing = safeReadJson(geminiPath) || {};
         if (existing.mcpServers?.patchcord) {
           console.log(`\n  ${yellow}⚠ Gemini CLI already configured${r}`);
           console.log(`  ${dim}${geminiPath}${r}`);
@@ -377,7 +368,7 @@ if (!cmd || cmd === "install" || cmd === "agent") {
       : join(HOME, ".config", "zed", "settings.json");
     if (existsSync(zedPath)) {
       try {
-        const existing = JSON.parse(readFileSync(zedPath, "utf-8"));
+        const existing = safeReadJson(zedPath) || {};
         if (existing.context_servers?.patchcord) {
           console.log(`\n  ${yellow}⚠ Zed already configured${r}`);
           console.log(`  ${dim}${zedPath}${r}`);
@@ -418,7 +409,7 @@ if (!cmd || cmd === "install" || cmd === "agent") {
         console.log(`  ${yellow}This overrides per-project config and causes conflicts.${r}`);
         const cleanGlobal = (await ask(`  ${dim}Remove patchcord from global config? (Y/n):${r} `)).trim().toLowerCase();
         if (cleanGlobal !== "n" && cleanGlobal !== "no") {
-          const cleaned = globalContent.replace(/\[mcp_servers\.patchcord\][^\[]*/s, "").replace(/\n{3,}/g, "\n\n").trim();
+          const cleaned = globalContent.replace(/\[mcp_servers\.patchcord\]\n(?:(?!\[)[^\n]*\n?)*/g, "").replace(/\n{3,}/g, "\n\n").trim();
           writeFileSync(globalCodexConfig, cleaned + "\n");
           console.log(`  ${green}✓${r} Removed from global config`);
         }
@@ -484,7 +475,14 @@ if (!cmd || cmd === "install" || cmd === "agent") {
   const customUrl = (await ask(`\n${dim}Custom server URL? (y/N):${r} `)).trim().toLowerCase();
   if (customUrl === "y" || customUrl === "yes") {
     const url = (await ask("Server URL: ")).trim();
-    if (url) serverUrl = url;
+    if (url) {
+      if (!isSafeUrl(url)) {
+        console.error("Invalid URL. Must start with https:// or http://");
+        rl.close();
+        process.exit(1);
+      }
+      serverUrl = url;
+    }
   }
 
   rl.close();
@@ -564,12 +562,7 @@ if (!cmd || cmd === "install" || cmd === "agent") {
   } else if (isGemini) {
     // Gemini CLI: global only (~/.gemini/settings.json)
     const geminiPath = join(HOME, ".gemini", "settings.json");
-    let geminiSettings = {};
-    if (existsSync(geminiPath)) {
-      try {
-        geminiSettings = JSON.parse(readFileSync(geminiPath, "utf-8"));
-      } catch {}
-    }
+    let geminiSettings = (existsSync(geminiPath) && safeReadJson(geminiPath)) || {};
     if (!geminiSettings.mcpServers) geminiSettings.mcpServers = {};
     geminiSettings.mcpServers.patchcord = {
       httpUrl: `${serverUrl}/mcp`,
@@ -592,12 +585,7 @@ if (!cmd || cmd === "install" || cmd === "agent") {
     const zedPath = process.platform === "darwin"
       ? join(HOME, "Library", "Application Support", "Zed", "settings.json")
       : join(HOME, ".config", "zed", "settings.json");
-    let zedSettings = {};
-    if (existsSync(zedPath)) {
-      try {
-        zedSettings = JSON.parse(readFileSync(zedPath, "utf-8"));
-      } catch {}
-    }
+    let zedSettings = (existsSync(zedPath) && safeReadJson(zedPath)) || {};
     if (!zedSettings.context_servers) zedSettings.context_servers = {};
     zedSettings.context_servers.patchcord = {
       url: `${serverUrl}/mcp`,
@@ -676,7 +664,7 @@ if (!cmd || cmd === "install" || cmd === "agent") {
     const configPath = join(codexDir, "config.toml");
     let existing = existsSync(configPath) ? readFileSync(configPath, "utf-8") : "";
     // Remove old patchcord config block if present
-    existing = existing.replace(/\[mcp_servers\.patchcord\][^\[]*/s, "").replace(/\n{3,}/g, "\n\n").trim();
+    existing = existing.replace(/\[mcp_servers\.patchcord\]\n(?:(?!\[)[^\n]*\n?)*/g, "").replace(/\n{3,}/g, "\n\n").trim();
     existing = existing.trimEnd() + `\n\n[mcp_servers.patchcord]\nurl = "${serverUrl}/mcp/bearer"\nhttp_headers = { "Authorization" = "Bearer ${token}", "X-Patchcord-Machine" = "${hostname}" }\n`;
     writeFileSync(configPath, existing);
     // Clean up any PATCHCORD_TOKEN we previously wrote to .env
@@ -799,7 +787,7 @@ if (cmd === "skill") {
     }
   } catch {}
 
-  if (!namespace || !agentId) {
+  if (!namespace || !agentId || !isSafeId(namespace) || !isSafeId(agentId)) {
     console.error("Cannot determine agent identity. Check your token.");
     process.exit(1);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchcord",
-  "version": "0.3.46",
+  "version": "0.3.48",
   "description": "Cross-machine agent messaging for Claude Code and Codex",
   "author": "ppravdin",
   "license": "MIT",