patchcord 0.6.12 → 0.6.14

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "patchcord",
   "description": "Cross-machine agent messaging. Messages from other agents land in the inbox and wake the agent to reply.",
-  "version": "0.6.12",
+  "version": "0.6.14",
   "author": {
     "name": "ppravdin"
   },

package/bin/patchcord.mjs

@@ -177,16 +177,14 @@ function _purgeLegacyKimiProjectConfig(dir) {
   } catch {}
 }
 
-// Cursor indexes skills from multiple trees. Leftover Codex globals
-// (~/.agents/skills/patchcord*) and Claude colon-named plugin skills bundled
-// inside cursor-agent's node_modules/patchcord both register duplicate slash
-// commands (/patchcordinbox vs /patchcord-inbox). Keep only skills-cursor.
+// Cursor slash menu duplicates come from (a) stale combined/no-hyphen dirs under
+// skills-cursor and (b) Claude colon-named plugin skills bundled inside
+// cursor-agent's node_modules/patchcord. NEVER touch ~/.agents/skills — that tree
+// is Codex/Antigravity-owned (global + per-project); Cursor update must not
+// delete other harnesses' skills.
 function _purgeCursorSkillDuplicates() {
-  const staleNames = [
+  const staleCursorOnly = [
     "patchcord",
-    "patchcord-inbox",
-    "patchcord-wait",
-    "patchcord-subscribe",
     "patchcordinbox",
     "patchcordwait",
     "patchcordsubscribe",
@@ -194,15 +192,11 @@ function _purgeCursorSkillDuplicates() {
     "patchcord:wait",
     "patchcord:subscribe",
   ];
-  for (const root of [
-    join(HOME, ".agents", "skills"),
-    join(HOME, ".cursor", "skills-cursor"),
-  ]) {
-    for (const name of staleNames) {
-      const d = join(root, name);
-      if (!existsSync(d)) continue;
-      try { rmSync(d, { recursive: true, force: true }); } catch {}
-    }
+  const cursorSkillsRoot = join(HOME, ".cursor", "skills-cursor");
+  for (const name of staleCursorOnly) {
+    const d = join(cursorSkillsRoot, name);
+    if (!existsSync(d)) continue;
+    try { rmSync(d, { recursive: true, force: true }); } catch {}
   }
   // cursor-agent ships patchcord@* with Claude plugin skills/ — Cursor must not
   // index those; only per-project skills-cursor copies are valid for Cursor CLI.
@@ -244,6 +238,23 @@ function _purgeCursorSkillDuplicates() {
   }
 }
 
+// Codex global skills live at ~/.agents/skills/ (not Cursor). Refresh on
+// update so a mistaken Cursor-only purge cannot leave Codex without @patchcord.
+function _restoreCodexGlobalSkills() {
+  const codexConfig = join(HOME, ".codex", "config.toml");
+  if (!existsSync(codexConfig)) return;
+  const globalSkillDir = join(HOME, ".agents", "skills", "patchcord");
+  const globalWaitDir = join(HOME, ".agents", "skills", "patchcord-wait");
+  try {
+    mkdirSync(globalSkillDir, { recursive: true });
+    writeFileSync(join(globalSkillDir, "SKILL.md"),
+      readFileSync(join(pluginRoot, "per-project-skills", "codex", "SKILL.md"), "utf-8"));
+    mkdirSync(globalWaitDir, { recursive: true });
+    writeFileSync(join(globalWaitDir, "SKILL.md"),
+      readFileSync(join(pluginRoot, "skills", "wait", "SKILL.md"), "utf-8"));
+  } catch {}
+}
+
 // preserving the rest of the user's YAML. Block-style only (what Hermes writes).
 function upsertHermesConfig(existing, url, token) {
   const block = [
@@ -1161,9 +1172,13 @@ if (cmd === "login" || cmd === "orchestrator" || cmd === "teamlead" || cmd === "
     // default: claude_code. type:"http" is REQUIRED — without it Claude Code
     // defaults to stdio transport and rejects the entry ("command: expected
     // string, received undefined").
+    // Use /mcp/bearer (not /mcp): Claude Code v2.1.113+ follows RFC 9728 OAuth
+    // discovery on /mcp, drops the static bearer header, and stalls on "Needs
+    // authentication". /mcp/bearer serves bearer-only resource metadata — same
+    // path Cursor and Kimi Code already use.
     return writeJson(join(dir, ".mcp.json"), (o) => {
       o.mcpServers = o.mcpServers || {};
-      o.mcpServers.patchcord = { type: "http", url: `${baseUrl}/mcp`, headers: hdr };
+      o.mcpServers.patchcord = { type: "http", url: `${baseUrl}/mcp/bearer`, headers: hdr };
     });
   };
 
@@ -1650,6 +1665,23 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
     return out.replace(/,(\s*[}\]])/g, "$1");
   }
 
+  // Claude Code v2.1.113+ OAuth discovery on plain /mcp breaks bearer MCP.
+  // Rewrite legacy project configs to /mcp/bearer (Cursor/Kimi already use it).
+  function _migrateClaudeMcpBearerUrl(mcpPath) {
+    if (!existsSync(mcpPath)) return false;
+    try {
+      const obj = JSON.parse(readFileSync(mcpPath, "utf-8"));
+      const pt = obj?.mcpServers?.patchcord;
+      const url = pt?.url;
+      if (!url || !/\/mcp$/.test(url) || url.endsWith("/mcp/bearer")) return false;
+      pt.url = url.replace(/\/mcp$/, "/mcp/bearer");
+      writeFileSync(mcpPath, JSON.stringify(obj, null, 2) + "\n");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
   // Read+merge+write a JSON config file. If the file exists but its contents
   // can't be parsed, REFUSE to write — silently overwriting would erase
   // unrelated MCP servers, settings, or hand-edits the user has in there.
@@ -1708,6 +1740,10 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
   const bold = "\x1b[1m";
   const r = "\x1b[0m";
 
+  if (_migrateClaudeMcpBearerUrl(join(process.cwd(), ".mcp.json"))) {
+    console.log(`  ${green}✓${r} Claude Code MCP URL migrated to /mcp/bearer`);
+  }
+
   // ── Purge stale npx cache entries ────────────────────────────
   // npx never auto-updates a cached package. Users with an old `npx patchcord`
   // entry get the stale binary indefinitely. On every install we sweep
@@ -2249,6 +2285,9 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
       globalChanges.push(`Codex stop hook ${hookAlreadyExisted ? "updated" : "installed"}`);
     }
 
+    _restoreCodexGlobalSkills();
+    globalChanges.push("Codex global skills refreshed");
+
     writeFileSync(codexConfig, globalCodexContent);
   }
 
@@ -3237,7 +3276,7 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
       mcpServers: {
         patchcord: {
           type: "http",
-          url: `${serverUrl}/mcp`,
+          url: `${serverUrl}/mcp/bearer`,
           headers: {
             Authorization: `Bearer ${token}`,
             "X-Patchcord-Machine": hostname,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchcord",
-  "version": "0.6.12",
+  "version": "0.6.14",
   "description": "Cross-machine agent messaging for Claude Code and Codex",
   "scripts": {
     "version": "node scripts/sync-plugin-version.mjs && git add .claude-plugin/plugin.json"