patchcord 0.5.127 → 0.5.129

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "patchcord",
   "description": "Cross-machine agent messaging. Messages from other agents land in the inbox and wake the agent to reply.",
-  "version": "0.5.127",
+  "version": "0.5.129",
   "author": {
     "name": "ppravdin"
   },

package/bin/patchcord.mjs

@@ -1690,10 +1690,15 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
   // (~/.gemini/settings.json) while Antigravity is PER-PROJECT
   // (<project>/.agents/mcp_config.json). So the shared global skill must be
   // seeded ONLY off Gemini CLI's global config — never off an Antigravity config.
-  // A patchcord entry in the global ~/.gemini/antigravity(-cli)/mcp_config.json is
-  // a leaked per-project token: it makes agy load the patchcord MCP (and its
-  // "check inbox first" instruction) in EVERY project, and it kept this skill
-  // seeded everywhere. We strip that leak below and gate the skill on Gemini only.
+  // A patchcord entry in the global ~/.gemini/antigravity(-cli)/mcp_config.json or
+  // ~/.gemini/config/mcp_config.json (Antigravity's post-migration global path —
+  // confirmed live via the sibling ~/.gemini/config/.migrated marker; the older
+  // two paths are its predecessors) is a leaked per-project token: it makes agy
+  // load the patchcord MCP (and its "check inbox first" instruction) in EVERY
+  // project, and it kept this skill seeded everywhere. We strip that leak below
+  // and gate the skill on Gemini only. Keep all three paths in sync — a prior
+  // fix (a36809c) covered only the first two and missed the migrated path,
+  // leaving leaks there uncleaned.
   if (existsSync(join(HOME, ".gemini"))) {
     // Remove any leaked patchcord server from Antigravity's GLOBAL configs so a
     // per-project token stops hijacking every agy session. Preserve other MCP
@@ -1701,6 +1706,7 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
     for (const agGlobal of [
       join(HOME, ".gemini", "antigravity", "mcp_config.json"),
       join(HOME, ".gemini", "antigravity-cli", "mcp_config.json"),
+      join(HOME, ".gemini", "config", "mcp_config.json"),
     ]) {
       if (!existsSync(agGlobal)) continue;
       try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchcord",
-  "version": "0.5.127",
+  "version": "0.5.129",
   "description": "Cross-machine agent messaging for Claude Code and Codex",
   "scripts": {
     "version": "node scripts/sync-plugin-version.mjs && git add .claude-plugin/plugin.json"

package/scripts/subscribe.mjs

@@ -426,18 +426,17 @@ function runOnce(ticket, baseUrl, token, refreshTicket) {
         try {
           const fresh = await refreshTicket();
           currentJwt = fresh.jwt;
-          // Socket-level auth update (phoenix topic) — what Supabase
-          // actually uses for the connection's own JWT expiry check.
-          // Without this, the server closes the socket at the original
-          // JWT's exp regardless of per-channel updates.
-          ws.send(
-            JSON.stringify({
-              topic: "phoenix",
-              event: "access_token",
-              payload: { access_token: currentJwt },
-              ref: String(ref++),
-            })
-          );
+          // NO socket-level "phoenix" topic update. Verified live against
+          // production Realtime: the reserved "phoenix" topic has no joined
+          // channel behind it, so any non-heartbeat event sent there —
+          // including access_token — is rejected with a phx_reply
+          // {status:"error", reason:"unmatched topic"}, every time. Per
+          // Supabase's own protocol, access_token is a per-channel-only
+          // event; there is no socket-level refresh mechanism. Sending it
+          // here previously triggered that error on every refresh cycle
+          // (~8min), which the generic phx_reply-error handler below treated
+          // as fatal and force-reconnected on — a full disconnect/rejoin
+          // cycle every ~8 minutes, forever, on every subscribe listener.
           // Channel-level updates — matches supabase-js's setAuth() pattern.
           for (const topic of fresh.topics) {
             ws.send(