patchcord 0.5.56 → 0.5.58

package/bin/patchcord.mjs

@@ -75,11 +75,10 @@ Usage:
   patchcord --full                                        Same + full statusline
   patchcord --rename <new-name> [--agent-type <type>]     Rename this agent
   patchcord whoami                                        Show your identity + project
-  patchcord whoami --propose "<text>"                     Propose an update to your whoami
-  patchcord whoami --approve <id>                         Approve a pending proposal
-  patchcord whoami --reject <id>                          Reject a pending proposal
+  patchcord whoami --propose "<text>"                     Update your whoami (two-shot: first call asks you to show human, second call applies)
   patchcord agents                                        List every agent (with whoami)
   patchcord agents <name>                                 Show one agent's whoami
+  patchcord upload <file> [--mime <type>] [--as <name>]   Upload a file as a patchcord attachment (prints the storage path)
   patchcord subscribe                                     Start the realtime listener
   patchcord update                                        Update to the latest version
   patchcord --version                                     Show installed version
@@ -280,7 +279,8 @@ if (cmd === "whoami") {
     process.exit(1);
   }
 
-  // --propose "<text>"
+  // --propose "<text>" — two-shot gate. First call returns "show_human",
+  // second call with identical text returns "applied".
   const proposeIdx = args.indexOf("--propose");
   if (proposeIdx !== -1) {
     const text = (args[proposeIdx + 1] || "").trim();
@@ -288,8 +288,9 @@ if (cmd === "whoami") {
       console.error("Usage: patchcord whoami --propose \"<text>\"");
       process.exit(1);
     }
+    // Client-side length check — don't even round-trip if over limit.
     if (text.length > 300) {
-      console.error(`Whoami text exceeds 300 characters (got ${text.length}).`);
+      console.error(`whoami is ${text.length} characters; limit is 300. trim and retry.`);
       process.exit(1);
     }
     const { status, json, body } = await _httpJSON("POST", `${baseUrl}/api/agent/whoami/propose`, token, { text });
@@ -297,35 +298,25 @@ if (cmd === "whoami") {
       console.error(`✗ HTTP ${status}: ${(json && json.error) || body}`);
       process.exit(1);
     }
-    console.log(`proposal_id: ${json.proposal_id}`);
-    console.log(`status: ${json.status}`);
-    console.log(`awaiting human approval. another agent or the dashboard must approve.`);
-    process.exit(0);
-  }
-
-  // --approve <id> / --reject <id>
-  const approveIdx = args.indexOf("--approve");
-  const rejectIdx = args.indexOf("--reject");
-  if (approveIdx !== -1 || rejectIdx !== -1) {
-    const isApprove = approveIdx !== -1;
-    const idx = isApprove ? approveIdx : rejectIdx;
-    const id = (args[idx + 1] || "").trim();
-    if (!id) {
-      console.error(`Usage: patchcord whoami --${isApprove ? "approve" : "reject"} <proposal-id>`);
-      process.exit(1);
+    if (json.status === "applied") {
+      console.log(`✓ whoami applied.`);
+      console.log(`self: ${json.whoami}`);
+      process.exit(0);
     }
-    const { status, json, body } = await _httpJSON(
-      "POST",
-      `${baseUrl}/api/agent/whoami/approve`,
-      token,
-      { proposal_id: id, action: isApprove ? "approve" : "reject" },
-    );
-    if (status !== "200") {
-      console.error(`✗ HTTP ${status}: ${(json && json.error) || body}`);
-      process.exit(1);
+    if (json.status === "unchanged") {
+      console.log(`unchanged — current whoami already matches.`);
+      console.log(`self: ${json.whoami}`);
+      process.exit(0);
     }
-    console.log(`✓ ${json.status}: ${json.agent} (proposal ${json.proposal_id})`);
-    process.exit(0);
+    if (json.status === "show_human") {
+      console.log(`gate: show the diff to the human, get explicit yes, then run the same command again to apply.`);
+      console.log();
+      console.log(`current:  ${json.current || "(empty)"}`);
+      console.log(`proposed: ${json.proposed}`);
+      process.exit(0);
+    }
+    console.log(`unexpected response: ${body}`);
+    process.exit(1);
   }
 
   // plain whoami (no flags)
@@ -400,6 +391,66 @@ if (cmd === "agents") {
   process.exit(0);
 }
 
+// ── upload <file> [--mime <type>] [--as <filename>] ───────────
+// Inline-upload an attachment to patchcord storage. Wraps what would
+// otherwise be a base64-and-curl dance. Prints the storage path on
+// success so the user can pipe it into send_message.
+if (cmd === "upload") {
+  const args = process.argv.slice(3);
+  const filePath = (args[0] || "").trim();
+  if (!filePath) {
+    console.error("Usage: patchcord upload <file> [--mime <type>] [--as <filename>]");
+    process.exit(1);
+  }
+  if (!existsSync(filePath)) {
+    console.error(`file not found: ${filePath}`);
+    process.exit(1);
+  }
+  const mimeIdx = args.indexOf("--mime");
+  const mime = mimeIdx !== -1 ? (args[mimeIdx + 1] || "").trim() : "";
+  const asIdx = args.indexOf("--as");
+  const renameTo = asIdx !== -1 ? (args[asIdx + 1] || "").trim() : "";
+
+  const found = await _resolveBearer();
+  if (!found) {
+    console.error("No patchcord config found in current directory or any parent. Run `npx patchcord@latest` from a project directory first.");
+    process.exit(1);
+  }
+  const { token, baseUrl } = found;
+  if (!isSafeToken(token) || !isSafeUrl(baseUrl)) {
+    console.error(`Invalid patchcord URL or token in config.`);
+    process.exit(1);
+  }
+
+  const { readFileSync, statSync } = await import("fs");
+  const stats = statSync(filePath);
+  if (stats.size === 0) {
+    console.error(`file is empty: ${filePath}`);
+    process.exit(1);
+  }
+  if (stats.size > 25 * 1024 * 1024) {
+    console.error(`file is ${(stats.size / 1024 / 1024).toFixed(1)}MB; max is 25MB for inline upload.`);
+    process.exit(1);
+  }
+
+  const data = readFileSync(filePath);
+  const content_b64 = data.toString("base64");
+  const filename = renameTo || basename(filePath);
+
+  const body = { filename, content_b64 };
+  if (mime) body.mime_type = mime;
+
+  const { status, json, body: respBody } = await _httpJSON(
+    "POST", `${baseUrl}/api/agent/attachment/upload`, token, body
+  );
+  if (status !== "200") {
+    console.error(`✗ HTTP ${status}: ${(json && json.error) || respBody}`);
+    process.exit(1);
+  }
+  console.log(json.path);
+  process.exit(0);
+}
+
 // ── subscribe ─────────────────────────────────────────────────
 // Thin wrapper around scripts/subscribe.mjs so users see a clean
 // "npx patchcord subscribe" in their Claude Code tool log instead
@@ -1939,5 +1990,5 @@ if (cmd === "skill") {
   process.exit(0);
 }
 
-console.error(`Unknown command: ${cmd}. Available: whoami, agents, subscribe, update, --rename, --token, --agent-type, --version, --help`);
+console.error(`Unknown command: ${cmd}. Available: whoami, agents, upload, subscribe, update, --rename, --token, --agent-type, --version, --help`);
 process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchcord",
-  "version": "0.5.56",
+  "version": "0.5.58",
   "description": "Cross-machine agent messaging for Claude Code and Codex",
   "author": "ppravdin",
   "license": "MIT",

package/skills/inbox/SKILL.md

@@ -120,14 +120,23 @@ Send the returned `path` to the other agent in your message so they can download
 - **Run `patchcord agents`** to see the full roster (every peer's whoami). One call, ~3KB, complete picture of the namespace.
 - **Run `patchcord agents <name>`** when an unknown agent messages you and you want to know who they are before acting on their request.
 
-### Updating your own whoami (gated)
+### Updating your own whoami
 
-300-char hard limit. Goes through a human-approval flow.
+300-char hard limit (CLI enforces client-side).
 
-- `patchcord whoami --propose "<text>"` — submits a pending proposal. Returns a `proposal_id`. The server also creates a normal patchcord message to `human` showing the diff.
-- Another agent (NOT you) or the human via dashboard must approve. Self-approval is blocked server-side — you can propose updates to your own whoami, but you cannot approve them.
-- To approve someone else's proposal: `patchcord whoami --approve <proposal-id>`. To reject: `patchcord whoami --reject <id>`.
-- The human sees your proposal in their inbox/dashboard. They will approve when ready. Do not retry — proposals are idempotent.
+Server responds with one of three statuses:
+
+- **applied** — done. Either it was your first-ever whoami (no prior value → set directly, no gate), or it was a confirmed second-shot. Print and move on.
+- **unchanged** — proposed text matches current. No-op.
+- **show_human** — current value exists and the proposed text differs. Server printed `current:` and `proposed:`. You MUST:
+  1. Show the diff to the human in conversation
+  2. Ask them to confirm
+  3. Wait for explicit "yes"
+  4. Run the **exact same** `patchcord whoami --propose "<text>"` command again. Server will then return `applied`.
+
+Pending state expires after 10 minutes. If the human says no, do not call again. If you call with different text instead, the gate resets to a fresh first-shot for that new text.
+
+Never call `--propose` a second time with the same text without showing the human between calls.
 
 ### Hard rules