patchcord 0.5.55 → 0.5.57

package/bin/patchcord.mjs

@@ -75,9 +75,7 @@ Usage:
   patchcord --full                                        Same + full statusline
   patchcord --rename <new-name> [--agent-type <type>]     Rename this agent
   patchcord whoami                                        Show your identity + project
-  patchcord whoami --propose "<text>"                     Propose an update to your whoami
-  patchcord whoami --approve <id>                         Approve a pending proposal
-  patchcord whoami --reject <id>                          Reject a pending proposal
+  patchcord whoami --propose "<text>"                     Update your whoami (two-shot: first call asks you to show human, second call applies)
   patchcord agents                                        List every agent (with whoami)
   patchcord agents <name>                                 Show one agent's whoami
   patchcord subscribe                                     Start the realtime listener
@@ -280,7 +278,8 @@ if (cmd === "whoami") {
     process.exit(1);
   }
 
-  // --propose "<text>"
+  // --propose "<text>" — two-shot gate. First call returns "show_human",
+  // second call with identical text returns "applied".
   const proposeIdx = args.indexOf("--propose");
   if (proposeIdx !== -1) {
     const text = (args[proposeIdx + 1] || "").trim();
@@ -288,8 +287,9 @@ if (cmd === "whoami") {
       console.error("Usage: patchcord whoami --propose \"<text>\"");
       process.exit(1);
     }
+    // Client-side length check — don't even round-trip if over limit.
     if (text.length > 300) {
-      console.error(`Whoami text exceeds 300 characters (got ${text.length}).`);
+      console.error(`whoami is ${text.length} characters; limit is 300. trim and retry.`);
       process.exit(1);
     }
     const { status, json, body } = await _httpJSON("POST", `${baseUrl}/api/agent/whoami/propose`, token, { text });
@@ -297,35 +297,25 @@ if (cmd === "whoami") {
       console.error(`✗ HTTP ${status}: ${(json && json.error) || body}`);
       process.exit(1);
     }
-    console.log(`proposal_id: ${json.proposal_id}`);
-    console.log(`status: ${json.status}`);
-    console.log(`awaiting human approval. another agent or the dashboard must approve.`);
-    process.exit(0);
-  }
-
-  // --approve <id> / --reject <id>
-  const approveIdx = args.indexOf("--approve");
-  const rejectIdx = args.indexOf("--reject");
-  if (approveIdx !== -1 || rejectIdx !== -1) {
-    const isApprove = approveIdx !== -1;
-    const idx = isApprove ? approveIdx : rejectIdx;
-    const id = (args[idx + 1] || "").trim();
-    if (!id) {
-      console.error(`Usage: patchcord whoami --${isApprove ? "approve" : "reject"} <proposal-id>`);
-      process.exit(1);
+    if (json.status === "applied") {
+      console.log(`✓ whoami applied.`);
+      console.log(`self: ${json.whoami}`);
+      process.exit(0);
     }
-    const { status, json, body } = await _httpJSON(
-      "POST",
-      `${baseUrl}/api/agent/whoami/approve`,
-      token,
-      { proposal_id: id, action: isApprove ? "approve" : "reject" },
-    );
-    if (status !== "200") {
-      console.error(`✗ HTTP ${status}: ${(json && json.error) || body}`);
-      process.exit(1);
+    if (json.status === "unchanged") {
+      console.log(`unchanged — current whoami already matches.`);
+      console.log(`self: ${json.whoami}`);
+      process.exit(0);
     }
-    console.log(`✓ ${json.status}: ${json.agent} (proposal ${json.proposal_id})`);
-    process.exit(0);
+    if (json.status === "show_human") {
+      console.log(`gate: show the diff to the human, get explicit yes, then run the same command again to apply.`);
+      console.log();
+      console.log(`current:  ${json.current || "(empty)"}`);
+      console.log(`proposed: ${json.proposed}`);
+      process.exit(0);
+    }
+    console.log(`unexpected response: ${body}`);
+    process.exit(1);
   }
 
   // plain whoami (no flags)
@@ -725,18 +715,32 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
     globalCliInstalled = true;
   } catch {
     try {
-      const stableDir = join(HOME, ".local", "share", "patchcord");
-      mkdirSync(stableDir, { recursive: true });
-      cpSync(pluginRoot, stableDir, { recursive: true, force: true });
+      const fbStableDir = join(HOME, ".local", "share", "patchcord");
+      mkdirSync(fbStableDir, { recursive: true });
+      cpSync(pluginRoot, fbStableDir, { recursive: true, force: true });
       const localBin = join(HOME, ".local", "bin");
       mkdirSync(localBin, { recursive: true });
       const wrapper = join(localBin, "patchcord");
-      writeFileSync(wrapper, `#!/bin/sh\nexec node "${join(stableDir, "bin", "patchcord.mjs")}" "$@"\n`);
+      writeFileSync(wrapper, `#!/bin/sh\nexec node "${join(fbStableDir, "bin", "patchcord.mjs")}" "$@"\n`);
       chmodSync(wrapper, 0o755);
       globalCliInstalled = true;
     } catch {}
   }
 
+  // ── Stable copy for Claude Code plugin marketplace ──────────
+  // Claude Code's `plugin marketplace add` stores the literal directory
+  // path in its plugin manifest. If we point it at `pluginRoot` (the
+  // npx ephemeral cache), that directory gets wiped on the next `npx`
+  // invocation of any other package, and every Claude Code session
+  // afterward errors: "Plugin directory does not exist: ...".
+  // Maintain a stable mirror at ~/.local/share/patchcord/ and point
+  // the marketplace there instead.
+  const stablePluginDir = join(HOME, ".local", "share", "patchcord");
+  try {
+    mkdirSync(stablePluginDir, { recursive: true });
+    cpSync(pluginRoot, stablePluginDir, { recursive: true, force: true });
+  } catch {}
+
   // ── Global setup (silent if nothing changed) ──
   let globalChanges = [];
   if (globalCliInstalled) globalChanges.push("Patchcord CLI installed globally");
@@ -750,10 +754,14 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
       try { rmSync(npmCachePatchcord, { recursive: true, force: true }); } catch {}
     }
 
-    // Always re-add marketplace (copies fresh files from this npx package)
-    // and install/update plugin. Claude Code's built-in plugin update
-    // doesn't detect new versions from local sources (#37252).
-    run(`claude plugin marketplace add "${pluginRoot}"`);
+    // Always re-add marketplace (point at the STABLE mirror, not pluginRoot
+    // which is the npx ephemeral cache). Claude Code stores the literal
+    // path in its plugin manifest — pointing at npx cache breaks every
+    // future session as soon as that cache dir is swept.
+    // Remove any prior marketplace registration first so the path actually
+    // updates for users who got the buggy npx-cache path on an earlier install.
+    run(`claude plugin marketplace remove patchcord-marketplace`);
+    run(`claude plugin marketplace add "${stablePluginDir}"`);
     const installed = run(`claude plugin list`)?.includes("patchcord");
     wasPluginInstalled = !!installed;
     if (installed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchcord",
-  "version": "0.5.55",
+  "version": "0.5.57",
   "description": "Cross-machine agent messaging for Claude Code and Codex",
   "author": "ppravdin",
   "license": "MIT",

package/skills/inbox/SKILL.md

@@ -120,14 +120,23 @@ Send the returned `path` to the other agent in your message so they can download
 - **Run `patchcord agents`** to see the full roster (every peer's whoami). One call, ~3KB, complete picture of the namespace.
 - **Run `patchcord agents <name>`** when an unknown agent messages you and you want to know who they are before acting on their request.
 
-### Updating your own whoami (gated)
+### Updating your own whoami
 
-300-char hard limit. Goes through a human-approval flow.
+300-char hard limit (CLI enforces client-side).
 
-- `patchcord whoami --propose "<text>"` — submits a pending proposal. Returns a `proposal_id`. The server also creates a normal patchcord message to `human` showing the diff.
-- Another agent (NOT you) or the human via dashboard must approve. Self-approval is blocked server-side — you can propose updates to your own whoami, but you cannot approve them.
-- To approve someone else's proposal: `patchcord whoami --approve <proposal-id>`. To reject: `patchcord whoami --reject <id>`.
-- The human sees your proposal in their inbox/dashboard. They will approve when ready. Do not retry — proposals are idempotent.
+Server responds with one of three statuses:
+
+- **applied** — done. Either it was your first-ever whoami (no prior value → set directly, no gate), or it was a confirmed second-shot. Print and move on.
+- **unchanged** — proposed text matches current. No-op.
+- **show_human** — current value exists and the proposed text differs. Server printed `current:` and `proposed:`. You MUST:
+  1. Show the diff to the human in conversation
+  2. Ask them to confirm
+  3. Wait for explicit "yes"
+  4. Run the **exact same** `patchcord whoami --propose "<text>"` command again. Server will then return `applied`.
+
+Pending state expires after 10 minutes. If the human says no, do not call again. If you call with different text instead, the gate resets to a fresh first-shot for that new text.
+
+Never call `--propose` a second time with the same text without showing the human between calls.
 
 ### Hard rules