patchcord 0.6.13 → 0.6.14

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "patchcord",
   "description": "Cross-machine agent messaging. Messages from other agents land in the inbox and wake the agent to reply.",
-  "version": "0.6.13",
+  "version": "0.6.14",
   "author": {
     "name": "ppravdin"
   },

package/bin/patchcord.mjs

@@ -1172,9 +1172,13 @@ if (cmd === "login" || cmd === "orchestrator" || cmd === "teamlead" || cmd === "
     // default: claude_code. type:"http" is REQUIRED — without it Claude Code
     // defaults to stdio transport and rejects the entry ("command: expected
     // string, received undefined").
+    // Use /mcp/bearer (not /mcp): Claude Code v2.1.113+ follows RFC 9728 OAuth
+    // discovery on /mcp, drops the static bearer header, and stalls on "Needs
+    // authentication". /mcp/bearer serves bearer-only resource metadata — same
+    // path Cursor and Kimi Code already use.
     return writeJson(join(dir, ".mcp.json"), (o) => {
       o.mcpServers = o.mcpServers || {};
-      o.mcpServers.patchcord = { type: "http", url: `${baseUrl}/mcp`, headers: hdr };
+      o.mcpServers.patchcord = { type: "http", url: `${baseUrl}/mcp/bearer`, headers: hdr };
     });
   };
 
@@ -1661,6 +1665,23 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
     return out.replace(/,(\s*[}\]])/g, "$1");
   }
 
+  // Claude Code v2.1.113+ OAuth discovery on plain /mcp breaks bearer MCP.
+  // Rewrite legacy project configs to /mcp/bearer (Cursor/Kimi already use it).
+  function _migrateClaudeMcpBearerUrl(mcpPath) {
+    if (!existsSync(mcpPath)) return false;
+    try {
+      const obj = JSON.parse(readFileSync(mcpPath, "utf-8"));
+      const pt = obj?.mcpServers?.patchcord;
+      const url = pt?.url;
+      if (!url || !/\/mcp$/.test(url) || url.endsWith("/mcp/bearer")) return false;
+      pt.url = url.replace(/\/mcp$/, "/mcp/bearer");
+      writeFileSync(mcpPath, JSON.stringify(obj, null, 2) + "\n");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
   // Read+merge+write a JSON config file. If the file exists but its contents
   // can't be parsed, REFUSE to write — silently overwriting would erase
   // unrelated MCP servers, settings, or hand-edits the user has in there.
@@ -1719,6 +1740,10 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
   const bold = "\x1b[1m";
   const r = "\x1b[0m";
 
+  if (_migrateClaudeMcpBearerUrl(join(process.cwd(), ".mcp.json"))) {
+    console.log(`  ${green}✓${r} Claude Code MCP URL migrated to /mcp/bearer`);
+  }
+
   // ── Purge stale npx cache entries ────────────────────────────
   // npx never auto-updates a cached package. Users with an old `npx patchcord`
   // entry get the stale binary indefinitely. On every install we sweep
@@ -3251,7 +3276,7 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
       mcpServers: {
         patchcord: {
           type: "http",
-          url: `${serverUrl}/mcp`,
+          url: `${serverUrl}/mcp/bearer`,
           headers: {
             Authorization: `Bearer ${token}`,
             "X-Patchcord-Machine": hostname,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchcord",
-  "version": "0.6.13",
+  "version": "0.6.14",
   "description": "Cross-machine agent messaging for Claude Code and Codex",
   "scripts": {
     "version": "node scripts/sync-plugin-version.mjs && git add .claude-plugin/plugin.json"