patchcord 0.5.123 → 0.5.125

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "patchcord",
   "description": "Cross-machine agent messaging. Messages from other agents land in the inbox and wake the agent to reply.",
-  "version": "0.5.123",
+  "version": "0.5.125",
   "author": {
     "name": "ppravdin"
   },

package/bin/patchcord.mjs

@@ -349,18 +349,19 @@ async function _resolveBearer(options = {}) {
     );
   })();
 
-  // NO global kimi/kimi-code reader. Kimi is a PER-PROJECT identity
-  // (.kimi-code/mcp.json in the worktree); a global ~/.kimi(-code)/mcp.json would
-  // make a leftover token hijack every kimi session everywhere. A kimi outside a
+  // NO global reader for PER-PROJECT tools. Kimi (.kimi-code/mcp.json) and
+  // Antigravity (.agents/mcp_config.json) are per-project identities: a leftover
+  // token in a global config (~/.kimi(-code)/mcp.json, ~/.gemini/antigravity/
+  // mcp_config.json) would hijack every session everywhere and make the agent
+  // "check inbox" in projects it has nothing to do with. Such a tool outside a
   // patchcord worktree is simply not an agent. (The tools below are global-ONLY
-  // by nature — Windsurf/Gemini/Zed/etc. store MCP config globally — so they keep
-  // their global readers.)
+  // by nature — Windsurf/Gemini CLI/Zed/etc. store MCP config globally — so they
+  // keep their global readers.)
   const defaultGlobalCandidates = [
     () => readJsonAt(join(HOME, ".codeium", "windsurf", "mcp_config.json"), ["mcpServers", "patchcord"], "windsurf"),
     () => readJsonAt(join(HOME, ".gemini", "settings.json"), ["mcpServers", "patchcord"], "gemini"),
     () => readJsonAt(zedPath, ["context_servers", "patchcord"], "zed"),
     () => readJsonAt(join(HOME, ".openclaw", "openclaw.json"), ["mcp", "servers", "patchcord"], "openclaw"),
-    () => readJsonAt(join(HOME, ".gemini", "antigravity", "mcp_config.json"), ["mcpServers", "patchcord"], "antigravity"),
     () => readHermesShape(join(HOME, ".hermes", "config.yaml")),
     ...clinePaths.map((p) => () => readJsonAt(p, ["mcpServers", "patchcord"], "cline")),
   ];
@@ -1669,13 +1670,33 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
     if (windsurfChanged) globalChanges.push("Windsurf skills installed");
   }
 
-  // Gemini CLI + Antigravity (they SHARE ~/.gemini/skills and ~/.gemini/commands).
-  // Seed the patchcord skill ONLY when patchcord MCP is actually configured for
-  // one of these surfaces. Otherwise a bare session (esp. Antigravity, which
-  // inherits this dir) reads a skill with no backing MCP tool and improvises
-  // destructively — scavenging other agents' bearer tokens off disk and curling
-  // the API. Invariant: skill present ⟺ patchcord MCP present under ~/.gemini.
+  // Gemini CLI + Antigravity SHARE ~/.gemini/skills and ~/.gemini/commands, but
+  // their MCP config is NOT shared: Gemini CLI stores patchcord globally
+  // (~/.gemini/settings.json) while Antigravity is PER-PROJECT
+  // (<project>/.agents/mcp_config.json). So the shared global skill must be
+  // seeded ONLY off Gemini CLI's global config — never off an Antigravity config.
+  // A patchcord entry in the global ~/.gemini/antigravity(-cli)/mcp_config.json is
+  // a leaked per-project token: it makes agy load the patchcord MCP (and its
+  // "check inbox first" instruction) in EVERY project, and it kept this skill
+  // seeded everywhere. We strip that leak below and gate the skill on Gemini only.
   if (existsSync(join(HOME, ".gemini"))) {
+    // Remove any leaked patchcord server from Antigravity's GLOBAL configs so a
+    // per-project token stops hijacking every agy session. Preserve other MCP
+    // servers; only drop patchcord.
+    for (const agGlobal of [
+      join(HOME, ".gemini", "antigravity", "mcp_config.json"),
+      join(HOME, ".gemini", "antigravity-cli", "mcp_config.json"),
+    ]) {
+      if (!existsSync(agGlobal)) continue;
+      try {
+        const j = JSON.parse(readFileSync(agGlobal, "utf-8"));
+        if (j?.mcpServers?.patchcord) {
+          delete j.mcpServers.patchcord;
+          writeFileSync(agGlobal, JSON.stringify(j, null, 2) + "\n");
+          globalChanges.push("Removed leaked global Antigravity patchcord MCP (agy is per-project)");
+        }
+      } catch {}
+    }
     // true = configured, false = file absent (definitely not), null = unparseable (unknown)
     const hasPatchcordMcp = (p, keyPath) => {
       if (!existsSync(p)) return false;
@@ -1684,8 +1705,6 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
     };
     const checks = [
       hasPatchcordMcp(join(HOME, ".gemini", "settings.json"), ["mcpServers", "patchcord"]),
-      hasPatchcordMcp(join(HOME, ".gemini", "antigravity", "mcp_config.json"), ["mcpServers", "patchcord"]),
-      hasPatchcordMcp(join(HOME, ".gemini", "antigravity-cli", "mcp_config.json"), ["mcpServers", "patchcord"]),
     ];
     const mcpConfigured = checks.some((c) => c === true);
     const mcpUnknown = checks.some((c) => c === null);
@@ -1767,6 +1786,33 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
     // Kimi Code (Node) reads ~/.kimi-code/skills. The legacy Python kimi-cli
     // (~/.kimi) is deprecated — install only into Kimi Code's home.
     const kimiSkillRoots = [join(kimiCodeHome, "skills")];
+
+    // Remove [[hooks]] array-of-tables blocks whose body matches `predicate`,
+    // preserving everything else. A block runs from a `[[hooks]]` header line
+    // until the next TOML table / array-of-tables header (`[...]` / `[[...]]`)
+    // or EOF — so trailing sections like [providers.*] and [models.*] are NOT
+    // swallowed. (The old split("[[hooks]]")+filter approach dropped the whole
+    // segment after the patchcord hook, deleting kimi's model/provider defs and
+    // leaving "Model not configured" on every host on the next install.)
+    const removeHookBlocks = (toml, predicate) => {
+      const lines = toml.split("\n");
+      const out = [];
+      let i = 0;
+      while (i < lines.length) {
+        if (/^\s*\[\[hooks\]\]\s*$/.test(lines[i])) {
+          const block = [lines[i]];
+          let j = i + 1;
+          while (j < lines.length && !/^\s*\[/.test(lines[j])) { block.push(lines[j]); j++; }
+          if (!predicate(block.join("\n"))) out.push(...block);
+          i = j;
+        } else {
+          out.push(lines[i]); i++;
+        }
+      }
+      return out.join("\n");
+    };
+    const isPatchcordHook = (b) => /patchcord-(stop-hook|session-start|prompt-hook)/.test(b);
+
     for (const root of kimiSkillRoots) {
       for (const stale of ["patchcord", "patchcord-wait", "patchcord:inbox", "patchcord:wait", "patchcord:subscribe"]) {
         const d = join(root, stale);
@@ -1796,11 +1842,6 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
       // Remove old inline hooks = [] (conflicts with [[hooks]] array-of-tables)
       kimiConfig = kimiConfig.replace(/^hooks\s*=\s*\[\]\n?/gm, "");
 
-      // Remove existing patchcord stop hook blocks
-      const segments = kimiConfig.split("[[hooks]]");
-      const kept = segments.filter((seg, idx) => idx === 0 || !seg.includes("patchcord-stop-hook"));
-      kimiConfig = kept.join("[[hooks]]").replace(/\n{3,}/g, "\n\n").trim();
-
       // Install session-start hook
       const kimiSessionSrc = join(pluginRoot, "scripts", "kimi-session-start.sh");
       const kimiSessionDest = join(kimiCodeHome, "patchcord-session-start.sh");
@@ -1809,10 +1850,9 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
         chmodSync(kimiSessionDest, 0o755);
       }
 
-      // Remove existing patchcord session-start hook blocks
-      const segments2 = kimiConfig.split("[[hooks]]");
-      const kept2 = segments2.filter((seg, idx) => idx === 0 || !seg.includes("patchcord-session-start") && !seg.includes("patchcord-prompt-hook"));
-      kimiConfig = kept2.join("[[hooks]]").replace(/\n{3,}/g, "\n\n").trim();
+      // Remove any existing patchcord hook blocks (stop / session-start /
+      // legacy prompt) in one pass, preserving all other tables.
+      kimiConfig = removeHookBlocks(kimiConfig, isPatchcordHook).replace(/\n{3,}/g, "\n\n").trim();
 
       // Append new hooks
       kimiConfig = kimiConfig.trimEnd() + `\n\n[[hooks]]\nevent = "SessionStart"\ncommand = "${kimiSessionDest}"\ntimeout = 10\n\n[[hooks]]\nevent = "Stop"\ncommand = "${kimiHookDest}"\ntimeout = 10\n`;
@@ -1834,9 +1874,7 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
       if (existsSync(legacyConfigPath)) {
         try {
           let lc = readFileSync(legacyConfigPath, "utf-8");
-          const segs = lc.split("[[hooks]]");
-          const keptLegacy = segs.filter((seg, idx) => idx === 0 || !seg.includes("patchcord-"));
-          lc = keptLegacy.join("[[hooks]]").replace(/\n{3,}/g, "\n\n").trim();
+          lc = removeHookBlocks(lc, (b) => /patchcord-/.test(b)).replace(/\n{3,}/g, "\n\n").trim();
           writeFileSync(legacyConfigPath, lc ? lc + "\n" : "");
         } catch {}
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchcord",
-  "version": "0.5.123",
+  "version": "0.5.125",
   "description": "Cross-machine agent messaging for Claude Code and Codex",
   "scripts": {
     "version": "node scripts/sync-plugin-version.mjs && git add .claude-plugin/plugin.json"