patchcord 0.5.123 → 0.5.124

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "patchcord",
   "description": "Cross-machine agent messaging. Messages from other agents land in the inbox and wake the agent to reply.",
-  "version": "0.5.123",
+  "version": "0.5.124",
   "author": {
     "name": "ppravdin"
   },

package/bin/patchcord.mjs

@@ -349,18 +349,19 @@ async function _resolveBearer(options = {}) {
     );
   })();
 
-  // NO global kimi/kimi-code reader. Kimi is a PER-PROJECT identity
-  // (.kimi-code/mcp.json in the worktree); a global ~/.kimi(-code)/mcp.json would
-  // make a leftover token hijack every kimi session everywhere. A kimi outside a
+  // NO global reader for PER-PROJECT tools. Kimi (.kimi-code/mcp.json) and
+  // Antigravity (.agents/mcp_config.json) are per-project identities: a leftover
+  // token in a global config (~/.kimi(-code)/mcp.json, ~/.gemini/antigravity/
+  // mcp_config.json) would hijack every session everywhere and make the agent
+  // "check inbox" in projects it has nothing to do with. Such a tool outside a
   // patchcord worktree is simply not an agent. (The tools below are global-ONLY
-  // by nature — Windsurf/Gemini/Zed/etc. store MCP config globally — so they keep
-  // their global readers.)
+  // by nature — Windsurf/Gemini CLI/Zed/etc. store MCP config globally — so they
+  // keep their global readers.)
   const defaultGlobalCandidates = [
     () => readJsonAt(join(HOME, ".codeium", "windsurf", "mcp_config.json"), ["mcpServers", "patchcord"], "windsurf"),
     () => readJsonAt(join(HOME, ".gemini", "settings.json"), ["mcpServers", "patchcord"], "gemini"),
     () => readJsonAt(zedPath, ["context_servers", "patchcord"], "zed"),
     () => readJsonAt(join(HOME, ".openclaw", "openclaw.json"), ["mcp", "servers", "patchcord"], "openclaw"),
-    () => readJsonAt(join(HOME, ".gemini", "antigravity", "mcp_config.json"), ["mcpServers", "patchcord"], "antigravity"),
     () => readHermesShape(join(HOME, ".hermes", "config.yaml")),
     ...clinePaths.map((p) => () => readJsonAt(p, ["mcpServers", "patchcord"], "cline")),
   ];
@@ -1669,13 +1670,33 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
     if (windsurfChanged) globalChanges.push("Windsurf skills installed");
   }
 
-  // Gemini CLI + Antigravity (they SHARE ~/.gemini/skills and ~/.gemini/commands).
-  // Seed the patchcord skill ONLY when patchcord MCP is actually configured for
-  // one of these surfaces. Otherwise a bare session (esp. Antigravity, which
-  // inherits this dir) reads a skill with no backing MCP tool and improvises
-  // destructively — scavenging other agents' bearer tokens off disk and curling
-  // the API. Invariant: skill present ⟺ patchcord MCP present under ~/.gemini.
+  // Gemini CLI + Antigravity SHARE ~/.gemini/skills and ~/.gemini/commands, but
+  // their MCP config is NOT shared: Gemini CLI stores patchcord globally
+  // (~/.gemini/settings.json) while Antigravity is PER-PROJECT
+  // (<project>/.agents/mcp_config.json). So the shared global skill must be
+  // seeded ONLY off Gemini CLI's global config — never off an Antigravity config.
+  // A patchcord entry in the global ~/.gemini/antigravity(-cli)/mcp_config.json is
+  // a leaked per-project token: it makes agy load the patchcord MCP (and its
+  // "check inbox first" instruction) in EVERY project, and it kept this skill
+  // seeded everywhere. We strip that leak below and gate the skill on Gemini only.
   if (existsSync(join(HOME, ".gemini"))) {
+    // Remove any leaked patchcord server from Antigravity's GLOBAL configs so a
+    // per-project token stops hijacking every agy session. Preserve other MCP
+    // servers; only drop patchcord.
+    for (const agGlobal of [
+      join(HOME, ".gemini", "antigravity", "mcp_config.json"),
+      join(HOME, ".gemini", "antigravity-cli", "mcp_config.json"),
+    ]) {
+      if (!existsSync(agGlobal)) continue;
+      try {
+        const j = JSON.parse(readFileSync(agGlobal, "utf-8"));
+        if (j?.mcpServers?.patchcord) {
+          delete j.mcpServers.patchcord;
+          writeFileSync(agGlobal, JSON.stringify(j, null, 2) + "\n");
+          globalChanges.push("Removed leaked global Antigravity patchcord MCP (agy is per-project)");
+        }
+      } catch {}
+    }
     // true = configured, false = file absent (definitely not), null = unparseable (unknown)
     const hasPatchcordMcp = (p, keyPath) => {
       if (!existsSync(p)) return false;
@@ -1684,8 +1705,6 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
     };
     const checks = [
       hasPatchcordMcp(join(HOME, ".gemini", "settings.json"), ["mcpServers", "patchcord"]),
-      hasPatchcordMcp(join(HOME, ".gemini", "antigravity", "mcp_config.json"), ["mcpServers", "patchcord"]),
-      hasPatchcordMcp(join(HOME, ".gemini", "antigravity-cli", "mcp_config.json"), ["mcpServers", "patchcord"]),
     ];
     const mcpConfigured = checks.some((c) => c === true);
     const mcpUnknown = checks.some((c) => c === null);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchcord",
-  "version": "0.5.123",
+  "version": "0.5.124",
   "description": "Cross-machine agent messaging for Claude Code and Codex",
   "scripts": {
     "version": "node scripts/sync-plugin-version.mjs && git add .claude-plugin/plugin.json"