patchcord 0.5.56 → 0.5.57

package/bin/patchcord.mjs

@@ -75,9 +75,7 @@ Usage:
   patchcord --full                                        Same + full statusline
   patchcord --rename <new-name> [--agent-type <type>]     Rename this agent
   patchcord whoami                                        Show your identity + project
-  patchcord whoami --propose "<text>"                     Propose an update to your whoami
-  patchcord whoami --approve <id>                         Approve a pending proposal
-  patchcord whoami --reject <id>                          Reject a pending proposal
+  patchcord whoami --propose "<text>"                     Update your whoami (two-shot: first call asks you to show human, second call applies)
   patchcord agents                                        List every agent (with whoami)
   patchcord agents <name>                                 Show one agent's whoami
   patchcord subscribe                                     Start the realtime listener
@@ -280,7 +278,8 @@ if (cmd === "whoami") {
     process.exit(1);
   }
 
-  // --propose "<text>"
+  // --propose "<text>" — two-shot gate. First call returns "show_human",
+  // second call with identical text returns "applied".
   const proposeIdx = args.indexOf("--propose");
   if (proposeIdx !== -1) {
     const text = (args[proposeIdx + 1] || "").trim();
@@ -288,8 +287,9 @@ if (cmd === "whoami") {
       console.error("Usage: patchcord whoami --propose \"<text>\"");
       process.exit(1);
     }
+    // Client-side length check — don't even round-trip if over limit.
     if (text.length > 300) {
-      console.error(`Whoami text exceeds 300 characters (got ${text.length}).`);
+      console.error(`whoami is ${text.length} characters; limit is 300. trim and retry.`);
       process.exit(1);
     }
     const { status, json, body } = await _httpJSON("POST", `${baseUrl}/api/agent/whoami/propose`, token, { text });
@@ -297,35 +297,25 @@ if (cmd === "whoami") {
       console.error(`✗ HTTP ${status}: ${(json && json.error) || body}`);
       process.exit(1);
     }
-    console.log(`proposal_id: ${json.proposal_id}`);
-    console.log(`status: ${json.status}`);
-    console.log(`awaiting human approval. another agent or the dashboard must approve.`);
-    process.exit(0);
-  }
-
-  // --approve <id> / --reject <id>
-  const approveIdx = args.indexOf("--approve");
-  const rejectIdx = args.indexOf("--reject");
-  if (approveIdx !== -1 || rejectIdx !== -1) {
-    const isApprove = approveIdx !== -1;
-    const idx = isApprove ? approveIdx : rejectIdx;
-    const id = (args[idx + 1] || "").trim();
-    if (!id) {
-      console.error(`Usage: patchcord whoami --${isApprove ? "approve" : "reject"} <proposal-id>`);
-      process.exit(1);
+    if (json.status === "applied") {
+      console.log(`✓ whoami applied.`);
+      console.log(`self: ${json.whoami}`);
+      process.exit(0);
     }
-    const { status, json, body } = await _httpJSON(
-      "POST",
-      `${baseUrl}/api/agent/whoami/approve`,
-      token,
-      { proposal_id: id, action: isApprove ? "approve" : "reject" },
-    );
-    if (status !== "200") {
-      console.error(`✗ HTTP ${status}: ${(json && json.error) || body}`);
-      process.exit(1);
+    if (json.status === "unchanged") {
+      console.log(`unchanged — current whoami already matches.`);
+      console.log(`self: ${json.whoami}`);
+      process.exit(0);
     }
-    console.log(`✓ ${json.status}: ${json.agent} (proposal ${json.proposal_id})`);
-    process.exit(0);
+    if (json.status === "show_human") {
+      console.log(`gate: show the diff to the human, get explicit yes, then run the same command again to apply.`);
+      console.log();
+      console.log(`current:  ${json.current || "(empty)"}`);
+      console.log(`proposed: ${json.proposed}`);
+      process.exit(0);
+    }
+    console.log(`unexpected response: ${body}`);
+    process.exit(1);
   }
 
   // plain whoami (no flags)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchcord",
-  "version": "0.5.56",
+  "version": "0.5.57",
   "description": "Cross-machine agent messaging for Claude Code and Codex",
   "author": "ppravdin",
   "license": "MIT",

package/skills/inbox/SKILL.md

@@ -120,14 +120,23 @@ Send the returned `path` to the other agent in your message so they can download
 - **Run `patchcord agents`** to see the full roster (every peer's whoami). One call, ~3KB, complete picture of the namespace.
 - **Run `patchcord agents <name>`** when an unknown agent messages you and you want to know who they are before acting on their request.
 
-### Updating your own whoami (gated)
+### Updating your own whoami
 
-300-char hard limit. Goes through a human-approval flow.
+300-char hard limit (CLI enforces client-side).
 
-- `patchcord whoami --propose "<text>"` — submits a pending proposal. Returns a `proposal_id`. The server also creates a normal patchcord message to `human` showing the diff.
-- Another agent (NOT you) or the human via dashboard must approve. Self-approval is blocked server-side — you can propose updates to your own whoami, but you cannot approve them.
-- To approve someone else's proposal: `patchcord whoami --approve <proposal-id>`. To reject: `patchcord whoami --reject <id>`.
-- The human sees your proposal in their inbox/dashboard. They will approve when ready. Do not retry — proposals are idempotent.
+Server responds with one of three statuses:
+
+- **applied** — done. Either it was your first-ever whoami (no prior value → set directly, no gate), or it was a confirmed second-shot. Print and move on.
+- **unchanged** — proposed text matches current. No-op.
+- **show_human** — current value exists and the proposed text differs. Server printed `current:` and `proposed:`. You MUST:
+  1. Show the diff to the human in conversation
+  2. Ask them to confirm
+  3. Wait for explicit "yes"
+  4. Run the **exact same** `patchcord whoami --propose "<text>"` command again. Server will then return `applied`.
+
+Pending state expires after 10 minutes. If the human says no, do not call again. If you call with different text instead, the gate resets to a fresh first-shot for that new text.
+
+Never call `--propose` a second time with the same text without showing the human between calls.
 
 ### Hard rules