patchcord 0.6.14 → 0.6.16

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "patchcord",
   "description": "Cross-machine agent messaging. Messages from other agents land in the inbox and wake the agent to reply.",
-  "version": "0.6.14",
+  "version": "0.6.16",
   "author": {
     "name": "ppravdin"
   },

package/bin/patchcord.mjs

@@ -43,6 +43,59 @@ function isSafeId(s) {
   return /^[A-Za-z0-9_\-]+$/.test(s) && s.length < 100;
 }
 
+/** Undo 0.6.14 mistake: Claude Code uses /mcp (not /mcp/bearer). */
+function revertClaudeMcpBearerUrl(mcpPath) {
+  if (!existsSync(mcpPath)) return false;
+  try {
+    const obj = JSON.parse(readFileSync(mcpPath, "utf-8"));
+    const pt = obj?.mcpServers?.patchcord;
+    const url = pt?.url;
+    if (!url || !url.endsWith("/mcp/bearer")) return false;
+    pt.url = url.replace(/\/mcp\/bearer$/, "/mcp");
+    writeFileSync(mcpPath, JSON.stringify(obj, null, 2) + "\n");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Patchcord uses project .mcp.json only — drop stale local-scope duplicates. */
+function dedupeClaudePatchcordMcp(cwd) {
+  if (run("which claude")) {
+    run("claude mcp remove patchcord -s local");
+  }
+  const claudeJson = join(HOME, ".claude.json");
+  if (!existsSync(claudeJson)) return false;
+  try {
+    const obj = JSON.parse(readFileSync(claudeJson, "utf-8"));
+    let changed = false;
+    if (obj.mcpServers?.patchcord) {
+      delete obj.mcpServers.patchcord;
+      if (Object.keys(obj.mcpServers).length === 0) delete obj.mcpServers;
+      changed = true;
+    }
+    const proj = obj.projects?.[cwd];
+    if (proj?.mcpServers?.patchcord) {
+      delete proj.mcpServers.patchcord;
+      if (Object.keys(proj.mcpServers).length === 0) delete proj.mcpServers;
+      changed = true;
+    }
+    if (changed) {
+      writeFileSync(claudeJson, JSON.stringify(obj, null, 2) + "\n");
+    }
+    return changed;
+  } catch {
+    return false;
+  }
+}
+
+function fixClaudePatchcordMcp(cwd) {
+  const mcpPath = join(cwd, ".mcp.json");
+  const reverted = revertClaudeMcpBearerUrl(mcpPath);
+  const deduped = dedupeClaudePatchcordMcp(cwd);
+  return { reverted, deduped };
+}
+
 // A trailing --help/-h on ANY subcommand must show help and exit — never run the
 // command. (patchcord orchestrator --help used to PROVISION an orchestrator;
 // patchcord login --help hung on the browser login. Side-effecting --help is a
@@ -708,6 +761,8 @@ if (cmd === "subscribe") {
   const forceKimi = args.includes("--kimi");
   const intervalArg = args.find((a) => a !== "--kimi") || "30";
 
+  fixClaudePatchcordMcp(process.cwd());
+
   // Kimi Code uses polling instead of WebSocket realtime.
   // Force Kimi mode with --kimi flag, or auto-detect from bearer config.
   let isKimi = forceKimi;
@@ -1172,13 +1227,9 @@ if (cmd === "login" || cmd === "orchestrator" || cmd === "teamlead" || cmd === "
     // default: claude_code. type:"http" is REQUIRED — without it Claude Code
     // defaults to stdio transport and rejects the entry ("command: expected
     // string, received undefined").
-    // Use /mcp/bearer (not /mcp): Claude Code v2.1.113+ follows RFC 9728 OAuth
-    // discovery on /mcp, drops the static bearer header, and stalls on "Needs
-    // authentication". /mcp/bearer serves bearer-only resource metadata — same
-    // path Cursor and Kimi Code already use.
     return writeJson(join(dir, ".mcp.json"), (o) => {
       o.mcpServers = o.mcpServers || {};
-      o.mcpServers.patchcord = { type: "http", url: `${baseUrl}/mcp/bearer`, headers: hdr };
+      o.mcpServers.patchcord = { type: "http", url: `${baseUrl}/mcp`, headers: hdr };
     });
   };
 
@@ -1665,22 +1716,7 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
     return out.replace(/,(\s*[}\]])/g, "$1");
   }
 
-  // Claude Code v2.1.113+ OAuth discovery on plain /mcp breaks bearer MCP.
-  // Rewrite legacy project configs to /mcp/bearer (Cursor/Kimi already use it).
-  function _migrateClaudeMcpBearerUrl(mcpPath) {
-    if (!existsSync(mcpPath)) return false;
-    try {
-      const obj = JSON.parse(readFileSync(mcpPath, "utf-8"));
-      const pt = obj?.mcpServers?.patchcord;
-      const url = pt?.url;
-      if (!url || !/\/mcp$/.test(url) || url.endsWith("/mcp/bearer")) return false;
-      pt.url = url.replace(/\/mcp$/, "/mcp/bearer");
-      writeFileSync(mcpPath, JSON.stringify(obj, null, 2) + "\n");
-      return true;
-    } catch {
-      return false;
-    }
-  }
+  // dedupeClaudePatchcordMcp + revertClaudeMcpBearerUrl live at module scope.
 
   // Read+merge+write a JSON config file. If the file exists but its contents
   // can't be parsed, REFUSE to write — silently overwriting would erase
@@ -1740,8 +1776,13 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
   const bold = "\x1b[1m";
   const r = "\x1b[0m";
 
-  if (_migrateClaudeMcpBearerUrl(join(process.cwd(), ".mcp.json"))) {
-    console.log(`  ${green}✓${r} Claude Code MCP URL migrated to /mcp/bearer`);
+  const _installCwd = process.cwd();
+  const _mcpFix = fixClaudePatchcordMcp(_installCwd);
+  if (_mcpFix.reverted) {
+    console.log(`  ${green}✓${r} Claude Code MCP URL reverted to /mcp (0.6.14 /mcp/bearer was wrong for CC)`);
+  }
+  if (_mcpFix.deduped) {
+    console.log(`  ${green}✓${r} Removed stale local-scope patchcord MCP (use project .mcp.json only)`);
   }
 
   // ── Purge stale npx cache entries ────────────────────────────
@@ -1925,6 +1966,30 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
       } else if (allowlistChanged) {
         globalChanges.push("Cursor MCP allowlist configured");
       }
+
+      // cursor-agent v2026.07+ also reads ~/.cursor/cli-config.json permissions.allow
+      // for MCP tool approval — permissions.json alone leaves patchcord at
+      // "not loaded (needs approval)" even with --yolo.
+      const cliConfigPath = join(HOME, ".cursor", "cli-config.json");
+      let cliAllowChanged = false;
+      const cliOk = updateJsonConfig(cliConfigPath, (obj) => {
+        obj.permissions = obj.permissions || {};
+        if (!obj.permissions.allow) obj.permissions.allow = [];
+        if (!Array.isArray(obj.permissions.allow)) {
+          console.log(`\n  ${yellow}⚠${r} Skipped Cursor CLI MCP allow — ${cliConfigPath} permissions.allow is not an array.`);
+          return;
+        }
+        const pat = "Mcp(patchcord:*)";
+        if (!obj.permissions.allow.includes(pat)) {
+          obj.permissions.allow.push(pat);
+          cliAllowChanged = true;
+        }
+      });
+      if (!cliOk) {
+        globalChanges.push("✗ Cursor CLI permissions error");
+      } else if (cliAllowChanged) {
+        globalChanges.push("Cursor CLI MCP allowlist configured");
+      }
     }
   }
 
@@ -2362,6 +2427,13 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
     }
     toolSlug = toolFlag;  // preserved as-is for the URL param
   }
+  // cursor-agent --yolo runs `npx patchcord` without --tool=cursor. Without
+  // this, browser connect defaults to Claude and writes .mcp.json instead of
+  // .cursor/mcp.json — MCP never loads in cursor-agent.
+  if (!choice && process.env.CURSOR_AGENT) {
+    choice = CLIENT_TYPE_MAP.cursor;
+    toolSlug = toolSlug || "cursor";
+  }
 
   // --token bypass for power users / CI / self-hosters
   const tokenFlag = flags.find(f => f.startsWith("--token="))?.split("=")[1]
@@ -2412,12 +2484,14 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
     let existingToken = "";
     let existingConfigFile = "";
     const mcpJsonPath = join(cwd, ".mcp.json");
+    const cursorMcpPath = join(cwd, ".cursor", "mcp.json");
     const codexTomlPath = join(cwd, ".codex", "config.toml");
     const grokTomlPath = join(cwd, ".grok", "config.toml");
     const kimiJsonPath = join(cwd, ".kimi", "mcp.json");
 
-    const slugForCheck = toolSlug ? toolSlug.replace(/-/g, "_") : "";
+    const slugForCheck = toolSlug ? toolSlug.replace(/-/g, "_") : (process.env.CURSOR_AGENT ? "cursor" : "");
     const checkMcpJson = !slugForCheck || slugForCheck === "claude_code";
+    const checkCursorJson = !slugForCheck || slugForCheck === "cursor";
     const checkCodexToml = !slugForCheck || slugForCheck === "codex";
     const checkGrokToml = !slugForCheck || ["grok", "grok_cli", "grok_build"].includes(slugForCheck);
     const checkKimiJson = !slugForCheck || slugForCheck === "kimi";
@@ -2432,6 +2506,16 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
         }
       } catch {}
     }
+    if (!existingToken && checkCursorJson && existsSync(cursorMcpPath)) {
+      try {
+        const existing = JSON.parse(readFileSync(cursorMcpPath, "utf-8"));
+        const pt = existing?.mcpServers?.patchcord;
+        if (pt?.headers?.Authorization) {
+          existingToken = pt.headers.Authorization.replace(/^Bearer\s+/i, "");
+          existingConfigFile = cursorMcpPath;
+        }
+      } catch {}
+    }
     if (!existingToken && checkCodexToml && existsSync(codexTomlPath)) {
       try {
         const content = readFileSync(codexTomlPath, "utf-8");
@@ -3276,7 +3360,7 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
       mcpServers: {
         patchcord: {
           type: "http",
-          url: `${serverUrl}/mcp/bearer`,
+          url: `${serverUrl}/mcp`,
           headers: {
             Authorization: `Bearer ${token}`,
             "X-Patchcord-Machine": hostname,
@@ -3295,6 +3379,7 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
       // their JSON and re-runs.
       process.exit(1);
     }
+    dedupeClaudePatchcordMcp(cwd);
     console.log(`\n  ${green}✓${r} Claude Code configured: ${dim}${mcpPath}${r}`);
 
     // Statusline: ask whether to enable full mode (unless --full flag passed or already configured).
@@ -3410,6 +3495,9 @@ if (!cmd || cmd === "install" || cmd === "agent" || cmd?.startsWith("--")) {
     console.log(`\n  ${green}→${r} ${bold}Restart ${cyan}kimi${r}${bold} in this project (or run ${cyan}/reload${r}${bold}), then say: ${cyan}${bold}check inbox${r}`);
   } else if (isKimi) {
     console.log(`\n  ${green}→${r} ${bold}Restart your ${toolName} session with ${cyan}kimi-pc${r}${bold}, then say: ${cyan}${bold}check inbox${r}`);
+  } else if (isCursor && hasCursorAgent) {
+    console.log(`\n  ${green}→${r} ${bold}Exit and start a new ${cyan}cursor-agent${r}${bold} session${r} ${dim}(MCP loads at session start — not mid-session)${r}`);
+    console.log(`  ${dim}Then:${r} ${cyan}${bold}check inbox${r} ${dim}before${r} ${cyan}${bold}/patchcord-subscribe${r}`);
   } else {
     console.log(`\n  ${green}→${r} ${bold}Restart your ${toolName} session${r}, then say: ${cyan}${bold}check inbox${r}`);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchcord",
-  "version": "0.6.14",
+  "version": "0.6.16",
   "description": "Cross-machine agent messaging for Claude Code and Codex",
   "scripts": {
     "version": "node scripts/sync-plugin-version.mjs && git add .claude-plugin/plugin.json"

package/per-project-skills/cursor/subscribe/SKILL.md

@@ -15,12 +15,21 @@ Start the persistent listener in a background Shell.
    expose it as `mcp_patchcord_inbox`). Process every pending message according
    to the patchcord inbox skill before starting the listener.
 
+   **Just provisioned in this same session?** Cursor/`cursor-agent` loads MCP
+   servers at session start only — `inbox()` will not exist until the user
+   starts a **new** session after connect. Do not spin on missing MCP tools.
+   Skip inbox drain, start the listener (step 3), and say one line: *MCP inbox
+   needs a fresh cursor-agent session after connect; listener is running — restart
+   once, then say check inbox.*
+
 2. **Find the absolute project root.** Use the current session's git root or
    agent worktree. Do not rely on the ambient Shell cwd: the listener must read
    the `.cursor/mcp.json` for this project and therefore needs an explicit
    `cd`.
 
-3. **Spawn the background listener** with Cursor's Shell tool:
+3. **Spawn the background listener** with Cursor's Shell tool. **Always**
+   `block_until_ms: 0` — never run subscribe in the foreground (that yields
+   "Wait skipped" and no wake notifications):
 
    ```text
    Shell(