patchcord 0.5.126 → 0.5.127

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "patchcord",
   "description": "Cross-machine agent messaging. Messages from other agents land in the inbox and wake the agent to reply.",
-  "version": "0.5.126",
+  "version": "0.5.127",
   "author": {
     "name": "ppravdin"
   },

package/bin/patchcord.mjs

@@ -934,11 +934,26 @@ if (cmd === "login" || cmd === "orchestrator" || cmd === "teamlead" || cmd === "
   const accountCall = async (method, path, body) => {
     let m = await requireAuth();
     let r = await _httpJSON(method, `${m.baseUrl}${path}`, m.token, body);
-    if (r.status === "401" || r.status === "403") {
-      // Stale/invalid account token. Forget it and fail fast — do NOT auto-relogin
-      // (would hang headless, see requireAuth). The user re-runs `patchcord login`.
-      forgetAuth();
-      console.error(`patchcord account token rejected (HTTP ${r.status}). Run \`patchcord login\` again. Cannot continue.`);
+    // NEVER delete the stored credential on a request-level failure. The account
+    // token (pcm-) does not expire, and a 401/403 is almost never proof it is bad:
+    //   - 401 can be transient (server restart / DB blip surfaces as a false
+    //     "invalid main token"). Deleting it would strand a headless agent that
+    //     cannot open a browser login.
+    //   - 403 means THIS action is forbidden (namespace/role) — it says nothing
+    //     about credential validity.
+    // Surface the error and stop. If the token is genuinely revoked, the user
+    // runs `patchcord login` — an explicit, human action, never automatic.
+    if (r.status === "401") {
+      console.error(`patchcord: account request returned HTTP 401. Your login was NOT deleted. If this keeps happening, run \`patchcord login\`.`);
+      process.exit(1);
+    }
+    if (r.status === "403") {
+      const reason = (r.json && (r.json.error || r.json.message)) || (r.body || "").slice(0, 200) || "forbidden";
+      console.error(`patchcord: request forbidden (HTTP 403): ${reason}`);
+      process.exit(1);
+    }
+    if (r.status === "503") {
+      console.error(`patchcord: server temporarily unavailable (HTTP 503). Retry in a moment.`);
       process.exit(1);
     }
     return { ...r, m };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchcord",
-  "version": "0.5.126",
+  "version": "0.5.127",
   "description": "Cross-machine agent messaging for Claude Code and Codex",
   "scripts": {
     "version": "node scripts/sync-plugin-version.mjs && git add .claude-plugin/plugin.json"