meshcode 1.8.4__tar.gz → 1.8.8__tar.gz

{meshcode-1.8.4 → meshcode-1.8.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 1.8.4
+Version: 1.8.8
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-1.8.4 → meshcode-1.8.8}/meshcode/__init__.py

@@ -1,2 +1,2 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "1.8.4"
+__version__ = "1.8.8"

{meshcode-1.8.4 → meshcode-1.8.8}/meshcode/comms_v4.py

@@ -28,6 +28,14 @@ import sys
 import time
 import subprocess
 from datetime import datetime
+
+# Force UTF-8 stdio so unicode chars (✓, →, etc.) in CLI output don't crash
+# on Windows cp1252. Safe no-op on POSIX.
+try:
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    sys.stderr.reconfigure(encoding="utf-8", errors="replace")
+except Exception:
+    pass
 from pathlib import Path
 from urllib.request import Request, urlopen
 from urllib.error import URLError, HTTPError
@@ -39,8 +47,8 @@ from urllib.parse import quote
 # Production defaults baked in. The publishable key is the anon/public key
 # (RLS-protected, safe to ship — same one the frontend at meshcode.io uses
 # in the browser). Override via env vars or ~/.meshcode/env if you self-host.
-_DEFAULT_SUPABASE_URL = "https://wwgzzmydrwrjgaebspdo.supabase.co"
-_DEFAULT_SUPABASE_KEY = "sb_publishable_0qf0U1GURopPIxLR8Vu7eQ_5grflPP4"
+_DEFAULT_SUPABASE_URL = "https://gjinagyyjttyxnaoavnz.supabase.co"
+_DEFAULT_SUPABASE_KEY = "sb_publishable_qwN9PO1L7jUXhhbhhVk2CQ_z1FXG2Qf"
 
 def _load_env_file():
     """Read SUPABASE_URL/KEY from ~/.meshcode/env if present (overrides defaults)."""
@@ -190,12 +198,61 @@ def ensure_sessions():
     SESSIONS_DIR.mkdir(parents=True, exist_ok=True)
 
 
+def _load_api_key_for_cli() -> str:
+    """Pull the user's api key from the keychain (or env fallback) so the
+    CLI can call SECURITY DEFINER RPCs that use api_key auth instead of
+    relying on the publishable anon key + RLS, which is what CLI verbs
+    used to do and which always failed because the CLI has no JWT context.
+    """
+    # 1) explicit env override
+    k = os.environ.get("MESHCODE_API_KEY", "").strip()
+    if k:
+        return k
+    # 2) keychain via secrets module
+    try:
+        import importlib
+        secrets_mod = importlib.import_module("meshcode.secrets")
+        profile = os.environ.get("MESHCODE_KEYCHAIN_PROFILE") or secrets_mod.DEFAULT_PROFILE
+        key = secrets_mod.get_api_key(profile=profile) or ""
+        if key:
+            return key
+    except Exception:
+        pass
+    return ""
+
+
 def get_project_id(project_name):
-    """Get or create project, return its UUID."""
+    """Resolve a project's UUID for the authenticated CLI user.
+
+    Resolution order:
+      1. api_key + mc_resolve_project RPC (SECURITY DEFINER, the only
+         path that actually works for an authenticated CLI session)
+      2. legacy publishable-anon SELECT (only useful for shared/public
+         projects; will fail under RLS for owned projects)
+      3. legacy publishable-anon INSERT (will fail under RLS — kept as
+         last resort for backwards compat with very old test scripts)
+    """
+    api_key = _load_api_key_for_cli()
+    if api_key:
+        try:
+            r = sb_rpc("mc_resolve_project", {
+                "p_api_key": api_key,
+                "p_project_name": project_name,
+            })
+            if isinstance(r, dict) and r.get("project_id"):
+                return r["project_id"]
+            # Some deployments return rows
+            if isinstance(r, list) and r and r[0].get("project_id"):
+                return r[0]["project_id"]
+        except Exception:
+            pass
+
     rows = sb_select("mc_projects", f"name=eq.{quote(project_name)}")
     if rows:
         return rows[0]["id"]
-    # Create project
+
+    # Last resort: try to create. Will fail under RLS for unauthenticated
+    # contexts, but kept for legacy callers + admin tooling.
     result = sb_insert("mc_projects", {"name": project_name})
     if result and len(result) > 0:
         return result[0]["id"]

{meshcode-1.8.4 → meshcode-1.8.8}/meshcode/invites.py

@@ -41,8 +41,8 @@ from urllib.request import Request, urlopen
 # Supabase RPC helpers
 # ============================================================
 
-_DEFAULT_SUPABASE_URL = "https://wwgzzmydrwrjgaebspdo.supabase.co"
-_DEFAULT_SUPABASE_KEY = "sb_publishable_0qf0U1GURopPIxLR8Vu7eQ_5grflPP4"
+_DEFAULT_SUPABASE_URL = "https://gjinagyyjttyxnaoavnz.supabase.co"
+_DEFAULT_SUPABASE_KEY = "sb_publishable_qwN9PO1L7jUXhhbhhVk2CQ_z1FXG2Qf"
 
 
 def _sb() -> Dict[str, str]:

meshcode-1.8.8/meshcode/meshcode_mcp/__main__.py

@@ -0,0 +1,39 @@
+"""Run via: python -m meshcode_mcp serve"""
+import os
+import sys
+
+# CRITICAL Windows fix: the MCP protocol uses stdio JSON-RPC. On Windows
+# stdin/stdout default to cp1252 encoding and block-buffered when piped.
+# - cp1252 → any non-ASCII char in a JSON message raises UnicodeEncodeError
+#   and corrupts the byte stream → Claude Code times out the handshake.
+# - Block-buffered → JSON-RPC bytes get stuck in the kernel buffer until
+#   the buffer fills, so Claude Code never sees the handshake response.
+# Both must be fixed BEFORE FastMCP touches stdio.
+try:
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace", newline="\n", line_buffering=True)
+    sys.stdin.reconfigure(encoding="utf-8", errors="replace", newline="\n")
+    sys.stderr.reconfigure(encoding="utf-8", errors="replace")
+except Exception:
+    pass
+# Belt and suspenders: also export PYTHONIOENCODING in case any subprocess
+# we spawn inherits this env.
+os.environ.setdefault("PYTHONIOENCODING", "utf-8")
+# Tell self_update / other modules: we are the MCP serve subprocess; do
+# NOT auto-update from inside this process.
+os.environ.setdefault("MESHCODE_MCP_SERVE", "1")
+
+from .server import run_server
+
+
+def main():
+    args = sys.argv[1:]
+    if args and args[0] == "serve":
+        run_server()
+    else:
+        print("Usage: python -m meshcode_mcp serve", file=sys.stderr)
+        print("       (env vars: MESHCODE_PROJECT, MESHCODE_AGENT, SUPABASE_URL, SUPABASE_KEY)", file=sys.stderr)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

{meshcode-1.8.4 → meshcode-1.8.8}/meshcode/meshcode_mcp/backend.py

@@ -13,8 +13,8 @@ from urllib.parse import quote
 from urllib.request import Request, urlopen
 
 # Bake in production defaults — RLS-protected publishable key, safe to ship.
-_DEFAULT_SUPABASE_URL = "https://wwgzzmydrwrjgaebspdo.supabase.co"
-_DEFAULT_SUPABASE_KEY = "sb_publishable_0qf0U1GURopPIxLR8Vu7eQ_5grflPP4"
+_DEFAULT_SUPABASE_URL = "https://gjinagyyjttyxnaoavnz.supabase.co"
+_DEFAULT_SUPABASE_KEY = "sb_publishable_qwN9PO1L7jUXhhbhhVk2CQ_z1FXG2Qf"
 
 def _load_env_file() -> Dict[str, str]:
     env_path = Path.home() / ".meshcode" / "env"
@@ -22,7 +22,7 @@ def _load_env_file() -> Dict[str, str]:
         return {}
     out: Dict[str, str] = {}
     try:
-        for line in env_path.read_text().splitlines():
+        for line in env_path.read_text(encoding="utf-8").splitlines():
             line = line.strip()
             if line.startswith("export "):
                 line = line[7:]
@@ -59,14 +59,14 @@ def _headers(*, prefer: Optional[str] = None, content_profile: bool = True) -> D
 
 def _request(method: str, path: str, *, data: Any = None, prefer: Optional[str] = None) -> Any:
     url = f"{SUPABASE_URL}/rest/v1/{path}"
-    body = json.dumps(data).encode() if data else None
+    body = json.dumps(data).encode("utf-8") if data else None
     req = Request(url, data=body, method=method, headers=_headers(prefer=prefer))
     try:
         with urlopen(req, timeout=10) as resp:
-            raw = resp.read().decode()
+            raw = resp.read().decode("utf-8")
             return json.loads(raw) if raw.strip() else None
     except HTTPError as e:
-        err = e.read().decode()
+        err = e.read().decode("utf-8", errors="replace")
         try:
             err_obj = json.loads(err)
             return {"_error": err_obj.get("message", err[:200]), "_code": e.code}
@@ -107,14 +107,14 @@ def sb_update(table: str, filters: str, updates: Dict) -> Any:
 
 def sb_rpc(fn_name: str, params: Dict) -> Any:
     url = f"{SUPABASE_URL}/rest/v1/rpc/{fn_name}"
-    body = json.dumps(params).encode()
+    body = json.dumps(params).encode("utf-8")
     req = Request(url, data=body, method="POST", headers=_headers(content_profile=False))
     try:
         with urlopen(req, timeout=10) as resp:
-            raw = resp.read().decode()
+            raw = resp.read().decode("utf-8")
             return json.loads(raw) if raw.strip() else None
     except HTTPError as e:
-        err = e.read().decode()
+        err = e.read().decode("utf-8", errors="replace")
         try:
             return {"_error": json.loads(err).get("message", err[:200])}
         except Exception:
@@ -139,6 +139,13 @@ def get_project_id(project_name: str) -> Optional[str]:
 
 def register_agent(project: str, name: str, role: str = "") -> Dict:
     project_id = get_project_id(project)
+    if not project_id:
+        # Fallback: many spawn paths (setup_clients.py) bake the project
+        # uuid into the env so we can register even when the name lookup
+        # fails (RLS, schema cache, network blip, anon-key visibility).
+        env_pid = os.environ.get("MESHCODE_PROJECT_ID", "").strip()
+        if env_pid:
+            project_id = env_pid
     if not project_id:
         return {"error": f"Project '{project}' not found"}
 

{meshcode-1.8.4 → meshcode-1.8.8}/meshcode/meshcode_mcp/realtime.py

@@ -10,9 +10,20 @@ When a new mc_message INSERT arrives for the current agent, it:
 import asyncio
 import json
 import logging
+import ssl
 from collections import deque
 from typing import Any, Awaitable, Callable, Deque, Dict, Optional
 
+try:
+    import certifi
+    _SSL_CTX = ssl.create_default_context(cafile=certifi.where())
+except Exception:
+    # Fallback to system trust store if certifi isn't available.
+    try:
+        _SSL_CTX = ssl.create_default_context()
+    except Exception:
+        _SSL_CTX = None
+
 try:
     import websockets
     WEBSOCKETS_AVAILABLE = True
@@ -42,11 +53,15 @@ class RealtimeListener:
         # Last 100 unread messages — drained by meshcode_check tool
         self.queue: Deque[Dict] = deque(maxlen=100)
         self._task: Optional[asyncio.Task] = None
-        self._stop = asyncio.Event()
+        # asyncio.Event() in Py3.10+ no longer requires a running loop, but
+        # on older Python or certain Windows event-loop policies it can
+        # raise. Defer creation to start() which is always called from
+        # inside the running event loop.
+        self._stop: Optional[asyncio.Event] = None
         self._connected = False
         # Event fired whenever a new message is appended to the queue.
-        # meshcode_wait awaits this instead of polling → zero-cost idle.
-        self.message_event = asyncio.Event()
+        # meshcode_wait awaits this instead of polling -> zero-cost idle.
+        self.message_event: Optional[asyncio.Event] = None
 
     @property
     def ws_url(self) -> str:
@@ -57,13 +72,18 @@ class RealtimeListener:
         if not WEBSOCKETS_AVAILABLE:
             log.warning("websockets package not installed — Realtime disabled")
             return
+        if self._stop is None:
+            self._stop = asyncio.Event()
+        if self.message_event is None:
+            self.message_event = asyncio.Event()
         if self._task and not self._task.done():
             return
         self._stop.clear()
         self._task = asyncio.create_task(self._run(), name="meshcode-realtime")
 
     async def stop(self) -> None:
-        self._stop.set()
+        if self._stop is not None:
+            self._stop.set()
         if self._task:
             self._task.cancel()
             try:
@@ -91,7 +111,18 @@ class RealtimeListener:
 
     async def _connect_and_listen(self) -> None:
         """Single connection lifecycle: connect, subscribe, listen."""
-        async with websockets.connect(self.ws_url, ping_interval=20, ping_timeout=10) as ws:
+        # Cap the initial TLS handshake at 10s. Without this, websockets.connect
+        # can hang indefinitely behind a corporate firewall / DNS stall, which
+        # blocks the MCP lifespan startup -> Claude Code times out the spawn
+        # -> "Failed to reconnect".
+        connect_kwargs = {"ping_interval": 20, "ping_timeout": 10}
+        if _SSL_CTX is not None and self.ws_url.startswith("wss://"):
+            connect_kwargs["ssl"] = _SSL_CTX
+        ws = await asyncio.wait_for(
+            websockets.connect(self.ws_url, **connect_kwargs),
+            timeout=10.0,
+        )
+        try:
             self._connected = True
             log.info(f"Realtime connected for agent={self.agent_name}")
 
@@ -130,6 +161,11 @@ class RealtimeListener:
             finally:
                 heartbeat_task.cancel()
                 self._connected = False
+        finally:
+            try:
+                await ws.close()
+            except Exception:
+                pass
 
     async def _heartbeat(self, ws) -> None:
         """Send phoenix heartbeats every 25s to keep the channel alive."""

{meshcode-1.8.4 → meshcode-1.8.8}/meshcode/meshcode_mcp/server.py

@@ -212,8 +212,61 @@ def _flip_status(status: str, task: str = "") -> bool:
         log.warning(f"set_status RPC threw: {e}")
         return False
 
-if not _flip_status("online", "MCP session active"):
-    print(f"[meshcode-mcp] WARNING: could not flip status to online", file=sys.stderr)
+if not _flip_status("idle", ""):
+    print(f"[meshcode-mcp] WARNING: could not flip status to idle", file=sys.stderr)
+
+
+# ============================================================
+# Working/idle status decorator for @mcp.tool() functions.
+# Fire-and-forget flips so tool execution is never blocked.
+# ============================================================
+import functools as _functools
+
+
+async def _async_flip_status(status: str, task: str = "") -> None:
+    try:
+        await asyncio.to_thread(_flip_status, status, task)
+    except Exception as e:
+        log.debug(f"flip_status({status}) failed: {e}")
+
+
+def _schedule_flip(status: str, task: str = "") -> None:
+    try:
+        loop = asyncio.get_running_loop()
+        loop.create_task(_async_flip_status(status, task))
+    except RuntimeError:
+        # No running loop (sync context) — run in a throwaway thread
+        import threading
+        threading.Thread(
+            target=_flip_status, args=(status, task), daemon=True
+        ).start()
+
+
+def with_working_status(func):
+    name = func.__name__
+    skip = (name == "meshcode_wait")
+    if asyncio.iscoroutinefunction(func):
+        @_functools.wraps(func)
+        async def awrapper(*args, **kwargs):
+            if not skip:
+                _schedule_flip("working", name)
+            try:
+                return await func(*args, **kwargs)
+            finally:
+                if not skip:
+                    _schedule_flip("idle", "")
+        return awrapper
+    else:
+        @_functools.wraps(func)
+        def swrapper(*args, **kwargs):
+            if not skip:
+                _schedule_flip("working", name)
+            try:
+                return func(*args, **kwargs)
+            finally:
+                if not skip:
+                    _schedule_flip("idle", "")
+        return swrapper
 
 
 # ============================================================
@@ -513,6 +566,7 @@ except Exception:
 # ----------------- TOOLS -----------------
 
 @mcp.tool()
+@with_working_status
 def meshcode_send(to: str, message: Any, in_reply_to: Optional[str] = None,
                   sensitive: bool = False) -> Dict[str, Any]:
     """Send a message to another agent in the meshwork.
@@ -548,6 +602,7 @@ def meshcode_send(to: str, message: Any, in_reply_to: Optional[str] = None,
 
 
 @mcp.tool()
+@with_working_status
 def meshcode_broadcast(payload: Dict[str, Any]) -> Dict[str, Any]:
     """Send a message to ALL agents in the meshwork (except yourself).
 
@@ -564,6 +619,7 @@ def meshcode_broadcast(payload: Dict[str, Any]) -> Dict[str, Any]:
 
 
 @mcp.tool()
+@with_working_status
 def meshcode_read(include_acks: bool = False) -> Dict[str, Any]:
     """Read all pending (unread) messages for this agent. Marks them as read and ACKs senders.
 
@@ -608,6 +664,7 @@ def _detect_global_done(messages: List[Dict[str, Any]]) -> Optional[Dict[str, An
 
 
 @mcp.tool()
+@with_working_status
 async def meshcode_wait(timeout_seconds: int = 120, include_acks: bool = False) -> Dict[str, Any]:
     """LONG-POLL: Block until a new message arrives for this agent (or timeout).
 
@@ -689,6 +746,7 @@ async def meshcode_wait(timeout_seconds: int = 120, include_acks: bool = False)
 
 
 @mcp.tool()
+@with_working_status
 def meshcode_done(reason: str) -> Dict[str, Any]:
     """Broadcast a GLOBAL DONE signal to every other agent in the meshwork.
 
@@ -716,6 +774,7 @@ def meshcode_done(reason: str) -> Dict[str, Any]:
 
 
 @mcp.tool()
+@with_working_status
 def meshcode_check(include_acks: bool = False) -> Dict[str, Any]:
     """Quick poll: returns pending message count + any messages buffered by the
     Realtime listener since the last check.
@@ -739,6 +798,7 @@ def meshcode_check(include_acks: bool = False) -> Dict[str, Any]:
 
 
 @mcp.tool()
+@with_working_status
 def meshcode_status() -> Dict[str, Any]:
     """Get the meshwork status board: all agents with their status, role, and current task."""
     agents = be.get_board(_PROJECT_ID)
@@ -758,6 +818,7 @@ def meshcode_status() -> Dict[str, Any]:
 
 
 @mcp.tool()
+@with_working_status
 def meshcode_register(role: str = "") -> Dict[str, Any]:
     """Re-register this agent in the meshwork. Use if you got disconnected or
     want to update your role description.
@@ -777,6 +838,7 @@ def meshcode_set_status(status: str, task: str = "") -> Dict[str, Any]:
 
 
 @mcp.tool()
+@with_working_status
 def meshcode_init(project: str, agent: str, role: str = "") -> Dict[str, Any]:
     """Re-initialize this MCP session for a different (project, agent). Use ONLY
     if you need to dynamically switch context — normally the env vars set at
@@ -795,6 +857,7 @@ def meshcode_init(project: str, agent: str, role: str = "") -> Dict[str, Any]:
 
 
 @mcp.tool()
+@with_working_status
 def meshcode_task_create(title: str, description: str = "", assignee: str = "*",
                           priority: str = "normal", parent_task_id: Optional[str] = None) -> Dict[str, Any]:
     """Create a task in the meshwork's shared backlog. Use this when you (typically
@@ -816,6 +879,7 @@ def meshcode_task_create(title: str, description: str = "", assignee: str = "*",
 
 
 @mcp.tool()
+@with_working_status
 def meshcode_tasks(status_filter: Optional[str] = None) -> Dict[str, Any]:
     """List tasks in the meshwork. Use this to discover work you can pick up.
 
@@ -829,6 +893,7 @@ def meshcode_tasks(status_filter: Optional[str] = None) -> Dict[str, Any]:
 
 
 @mcp.tool()
+@with_working_status
 def meshcode_task_claim(task_id: str) -> Dict[str, Any]:
     """Atomically claim an open task. If the task is already claimed by someone
     else (or assigned to a different agent), this returns an error and another
@@ -842,6 +907,7 @@ def meshcode_task_claim(task_id: str) -> Dict[str, Any]:
 
 
 @mcp.tool()
+@with_working_status
 def meshcode_task_complete(task_id: str, summary: str = "") -> Dict[str, Any]:
     """Mark a task as done. Only the claimer can complete it.
 

{meshcode-1.8.4 → meshcode-1.8.8}/meshcode/run_agent.py

@@ -94,7 +94,11 @@ def _detect_editor() -> Optional[str]:
             return override
         print(f"[meshcode] WARNING: MESHCODE_EDITOR='{override}' not found in PATH", file=sys.stderr)
 
-    for cmd in ("claude", "cursor", "code"):
+    # Detection order: most likely to be installed + best per-workspace MCP
+    # support first. codex is last because its MCP config is GLOBAL only —
+    # launching it doesn't take a workspace-scoped .mcp.json, so it should
+    # only be picked if nothing else is available.
+    for cmd in ("claude", "cursor", "code", "windsurf", "codex"):
         if shutil.which(cmd):
             return cmd
     return None
@@ -108,6 +112,16 @@ def run(agent: str, project: Optional[str] = None, editor_override: Optional[str
     except Exception:
         pass
 
+    # Detect: are we already inside a Claude Code session? os.execvp(claude)
+    # from inside an existing claude won't work — claude needs a fresh
+    # interactive terminal it owns. Refuse with a clear message.
+    if os.environ.get("CLAUDECODE") == "1" or os.environ.get("CLAUDE_CODE_SESSION"):
+        print("[meshcode] ERROR: meshcode run cannot bootstrap a new agent from inside an", file=sys.stderr)
+        print("[meshcode]        existing Claude Code session.", file=sys.stderr)
+        print("[meshcode]        Open a fresh Terminal / iTerm window and run the command there.", file=sys.stderr)
+        print(f"[meshcode]        (or copy this exact line into a new terminal: meshcode run {agent})", file=sys.stderr)
+        return 2
+
     found = _find_agent_workspace(agent, project)
     if not found:
         return 2
@@ -152,6 +166,19 @@ def run(agent: str, project: Optional[str] = None, editor_override: Optional[str
     elif editor == "code":
         # VS Code (Cline reads .vscode/mcp.json from workspace cwd).
         cmd = [editor, str(ws)]
+    elif editor == "windsurf":
+        # Windsurf (Codeium fork of VS Code) — reads workspace cwd the same
+        # way VS Code does; global MCP config at ~/.codeium/windsurf/mcp_config.json.
+        cmd = [editor, str(ws)]
+    elif editor == "codex":
+        # Codex CLI reads ~/.codex/config.toml globally. There's no per-
+        # workspace flag, so launching is just `codex` with cwd set to the
+        # workspace dir so any file ops the agent does land there.
+        try:
+            os.chdir(ws)
+        except Exception:
+            pass
+        cmd = [editor]
     else:
         cmd = [editor, str(ws)]
 

{meshcode-1.8.4 → meshcode-1.8.8}/meshcode/secrets.py

@@ -84,6 +84,13 @@ def _probe_keyring() -> bool:
     except ImportError:
         _KEYRING_AVAILABLE = False
         _KEYRING_BACKEND_NAME = "(keyring not installed)"
+    except Exception:
+        # Defensive: a broken Win32 Credential Manager, locked profile,
+        # or weird security policy can make even keyring.get_keyring()
+        # raise. Never let it bubble up — secrets module must always
+        # import cleanly so the MCP server can boot.
+        _KEYRING_AVAILABLE = False
+        _KEYRING_BACKEND_NAME = "(keyring probe failed)"
     return _KEYRING_AVAILABLE
 
 
@@ -113,7 +120,7 @@ def _load_index() -> Dict[str, Any]:
     if not PROFILE_INDEX.exists():
         return {"profiles": {}}
     try:
-        return json.loads(PROFILE_INDEX.read_text())
+        return json.loads(PROFILE_INDEX.read_text(encoding="utf-8"))
     except Exception:
         return {"profiles": {}}
 
@@ -121,7 +128,7 @@ def _load_index() -> Dict[str, Any]:
 def _save_index(idx: Dict[str, Any]) -> None:
     PROFILE_INDEX.parent.mkdir(parents=True, exist_ok=True)
     tmp = PROFILE_INDEX.with_suffix(".tmp")
-    tmp.write_text(json.dumps(idx, indent=2))
+    tmp.write_text(json.dumps(idx, indent=2), encoding="utf-8")
     try:
         os.chmod(tmp, 0o600)
     except Exception:
@@ -174,7 +181,7 @@ def set_api_key(api_key: str, profile: str = DEFAULT_PROFILE,
     # Fallback: mode-600 JSON file (legacy path, secured)
     fallback_path = Path.home() / ".meshcode" / f"credentials.{profile}.json"
     fallback_path.parent.mkdir(parents=True, exist_ok=True)
-    fallback_path.write_text(json.dumps({"api_key": api_key, **(meta or {})}, indent=2))
+    fallback_path.write_text(json.dumps({"api_key": api_key, **(meta or {})}, indent=2), encoding="utf-8")
     try:
         os.chmod(fallback_path, 0o600)
     except Exception:
@@ -204,7 +211,7 @@ def get_api_key(profile: str = DEFAULT_PROFILE) -> Optional[str]:
     fallback_path = Path.home() / ".meshcode" / f"credentials.{profile}.json"
     if fallback_path.exists():
         try:
-            data = json.loads(fallback_path.read_text())
+            data = json.loads(fallback_path.read_text(encoding="utf-8"))
             if isinstance(data, dict) and data.get("api_key"):
                 return data["api_key"]
         except Exception:
@@ -213,7 +220,7 @@ def get_api_key(profile: str = DEFAULT_PROFILE) -> Optional[str]:
     # Legacy pre-1.4.1 path: only valid for the default profile
     if profile == DEFAULT_PROFILE and LEGACY_CREDS_FILE.exists():
         try:
-            data = json.loads(LEGACY_CREDS_FILE.read_text())
+            data = json.loads(LEGACY_CREDS_FILE.read_text(encoding="utf-8"))
             if isinstance(data, dict) and data.get("api_key"):
                 return data["api_key"]
         except Exception:
@@ -299,13 +306,13 @@ def migrate_legacy_credentials() -> bool:
         # Nothing to migrate, but still drop the flag so we don't re-check forever
         try:
             MIGRATION_FLAG.parent.mkdir(parents=True, exist_ok=True)
-            MIGRATION_FLAG.write_text("no legacy file")
+            MIGRATION_FLAG.write_text("no legacy file", encoding="utf-8")
         except Exception:
             pass
         return False
 
     try:
-        data = json.loads(LEGACY_CREDS_FILE.read_text())
+        data = json.loads(LEGACY_CREDS_FILE.read_text(encoding="utf-8"))
     except Exception:
         return False
     api_key = (data or {}).get("api_key") if isinstance(data, dict) else None
@@ -327,7 +334,7 @@ def migrate_legacy_credentials() -> bool:
         MIGRATION_FLAG.write_text(json.dumps({
             "migrated_at_unix": int(__import__("time").time()),
             "backend": _KEYRING_BACKEND_NAME or "(unknown)",
-        }))
+        }), encoding="utf-8")
     except Exception:
         pass
 

{meshcode-1.8.4 → meshcode-1.8.8}/meshcode/setup_clients.py

@@ -93,9 +93,9 @@ def _load_supabase_env() -> Dict[str, str]:
                     elif k == "SUPABASE_KEY" and not key:
                         key = v
     if not url:
-        url = "https://wwgzzmydrwrjgaebspdo.supabase.co"
+        url = "https://gjinagyyjttyxnaoavnz.supabase.co"
     if not key:
-        key = "sb_publishable_0qf0U1GURopPIxLR8Vu7eQ_5grflPP4"
+        key = "sb_publishable_qwN9PO1L7jUXhhbhhVk2CQ_z1FXG2Qf"
     return {"SUPABASE_URL": url, "SUPABASE_KEY": key}
 
 
@@ -147,6 +147,12 @@ def _build_server_block(project: str, project_id: str, agent: str, role: str,
         "MESHCODE_KEYCHAIN_PROFILE": keychain_profile,
         "SUPABASE_URL": sb["SUPABASE_URL"],
         "SUPABASE_KEY": sb["SUPABASE_KEY"],
+        # Force UTF-8 stdio so the MCP JSON-RPC channel doesn't crash on
+        # Windows cp1252 when the server emits any non-ASCII char.
+        "PYTHONIOENCODING": "utf-8",
+        # Mark this Python process as the MCP serve subprocess so other
+        # parts of the package (e.g. self_update) skip auto-update inside it.
+        "MESHCODE_MCP_SERVE": "1",
     }
     # Belt-and-suspenders fallback: if the OS doesn't have a keychain backend
     # the MCP server can't read the key from there, so we still need to pass
@@ -172,6 +178,93 @@ def _atomic_write_json(path: Path, data: dict) -> None:
     tmp.replace(path)
 
 
+def _toml_escape(s: str) -> str:
+    """Escape a string for a TOML basic string literal."""
+    return s.replace("\\", "\\\\").replace("\"", "\\\"")
+
+
+def _render_codex_block(server_id: str, server_block: Dict[str, Any]) -> str:
+    """Render a [mcp_servers.<server_id>] section (plus [.env] subtable) for
+    Codex CLI's ~/.codex/config.toml format. Returns a text block starting
+    with a leading newline so it appends cleanly to existing files."""
+    cmd = _toml_escape(str(server_block.get("command", "")))
+    args = server_block.get("args", []) or []
+    env = server_block.get("env", {}) or {}
+    # Quote the section name only if it contains special chars. server_id is
+    # our deterministic "meshcode-<project>-<agent>" slug; hyphens require
+    # quoting in TOML bare keys, so always quote.
+    section = f'"{_toml_escape(server_id)}"'
+    lines = []
+    lines.append("")
+    lines.append(f"[mcp_servers.{section}]")
+    lines.append(f'command = "{cmd}"')
+    args_rendered = ", ".join(f'"{_toml_escape(str(a))}"' for a in args)
+    lines.append(f"args = [{args_rendered}]")
+    if env:
+        lines.append("")
+        lines.append(f"[mcp_servers.{section}.env]")
+        for k, v in env.items():
+            lines.append(f'{k} = "{_toml_escape(str(v))}"')
+    lines.append("")
+    return "\n".join(lines)
+
+
+def _atomic_write_toml_codex(path: Path, server_id: str, server_block: Dict[str, Any]) -> None:
+    """Read/replace/write ~/.codex/config.toml preserving all other sections.
+
+    Codex CLI uses TOML with [mcp_servers.<name>] tables (optionally a
+    [mcp_servers.<name>.env] subtable). We don't want to round-trip the
+    entire TOML file (stdlib can only READ TOML via tomllib, not write),
+    so we do surgical text replacement:
+
+      * If [mcp_servers."<server_id>"] already exists, find that section
+        header and delete everything from it up to (but not including) the
+        next top-level-ish section header that is NOT a sub-table of the
+        same server (i.e. next `[` that doesn't start with
+        `[mcp_servers."<server_id>".`), or EOF.
+      * Then append the freshly rendered block.
+      * If no prior section, just append to end.
+
+    Atomic via tempfile + replace.
+    """
+    path.parent.mkdir(parents=True, exist_ok=True)
+    text = path.read_text() if path.exists() else ""
+
+    quoted = f'"{_toml_escape(server_id)}"'
+    header = f"[mcp_servers.{quoted}]"
+    subheader_prefix = f"[mcp_servers.{quoted}."
+
+    lines = text.splitlines(keepends=True)
+    out: list = []
+    i = 0
+    removed = False
+    while i < len(lines):
+        stripped = lines[i].lstrip()
+        if not removed and (stripped.startswith(header) or stripped.startswith(subheader_prefix)):
+            # Skip this section and any following lines until we hit a new
+            # top-level `[` section that is NOT our server's sub-table.
+            i += 1
+            while i < len(lines):
+                s2 = lines[i].lstrip()
+                if s2.startswith("[") and not s2.startswith(subheader_prefix) and not s2.startswith(header):
+                    break
+                i += 1
+            removed = True
+            continue
+        out.append(lines[i])
+        i += 1
+
+    new_text = "".join(out)
+    # Ensure exactly one trailing newline before we append our block.
+    if new_text and not new_text.endswith("\n"):
+        new_text += "\n"
+    new_text += _render_codex_block(server_id, server_block)
+
+    tmp = path.with_suffix(path.suffix + ".tmp")
+    tmp.write_text(new_text)
+    tmp.replace(path)
+
+
 # ============================================================
 # WORKSPACE MODEL (1.3.0+) — one isolated dir per agent
 # ============================================================
@@ -325,6 +418,21 @@ CLIENT_CONFIG_PATHS = {
         "Linux":   Path.home() / ".config" / "Claude" / "claude_desktop_config.json",
         "Windows": Path.home() / "AppData" / "Roaming" / "Claude" / "claude_desktop_config.json",
     },
+    # Windsurf (Codeium): global MCP config in ~/.codeium/windsurf/mcp_config.json
+    # (JSON, same {"mcpServers": {...}} shape as Cursor/Cline). Cross-platform —
+    # Windsurf stores user config under ~/.codeium regardless of OS.
+    "windsurf": {
+        "Darwin":  Path.home() / ".codeium" / "windsurf" / "mcp_config.json",
+        "Linux":   Path.home() / ".codeium" / "windsurf" / "mcp_config.json",
+        "Windows": Path.home() / ".codeium" / "windsurf" / "mcp_config.json",
+    },
+    # OpenAI Codex CLI: ~/.codex/config.toml with [mcp_servers.<name>] tables.
+    # This is NOT JSON — handled by the custom TOML writer below.
+    "codex": {
+        "Darwin":  Path.home() / ".codex" / "config.toml",
+        "Linux":   Path.home() / ".codex" / "config.toml",
+        "Windows": Path.home() / ".codex" / "config.toml",
+    },
 }
 
 CLIENT_DISPLAY_NAMES = {
@@ -332,8 +440,13 @@ CLIENT_DISPLAY_NAMES = {
     "cursor":         "Cursor",
     "cline":          "Cline (VS Code)",
     "claude-desktop": "Claude Desktop",
+    "windsurf":       "Windsurf (Codeium)",
+    "codex":          "OpenAI Codex CLI",
 }
 
+# Clients whose config file is NOT JSON and need a custom writer.
+NON_JSON_CLIENTS = {"codex"}
+
 
 def setup_global(client: str, project: str, agent: str, role: str = "") -> int:
     """LEGACY: write to the user's GLOBAL MCP config file. All agents that
@@ -355,25 +468,35 @@ def setup_global(client: str, project: str, agent: str, role: str = "") -> int:
         print(f"[meshcode] ERROR: '{client}' is not supported on {os_name}", file=sys.stderr)
         return 2
 
-    existing: Dict[str, Any] = {}
-    if config_path.exists():
-        try:
-            existing = json.loads(config_path.read_text())
-        except json.JSONDecodeError:
-            print(f"[meshcode] WARNING: {config_path} exists but is not valid JSON.", file=sys.stderr)
-            return 2
-
-    if not isinstance(existing, dict):
-        existing = {}
+    server_id = f"meshcode-{project}-{agent}"
+    server_block = _build_server_block(project, project_id, agent, role, api_key, sb)
 
-    servers = existing.setdefault("mcpServers", {})
-    if not isinstance(servers, dict):
-        print(f"[meshcode] ERROR: 'mcpServers' in {config_path} is not an object", file=sys.stderr)
-        return 2
+    if client in NON_JSON_CLIENTS:
+        # Dispatch to per-format writers (preserves other sections).
+        if client == "codex":
+            _atomic_write_toml_codex(config_path, server_id, server_block)
+        else:
+            print(f"[meshcode] ERROR: no writer registered for non-JSON client '{client}'", file=sys.stderr)
+            return 2
+    else:
+        existing: Dict[str, Any] = {}
+        if config_path.exists():
+            try:
+                existing = json.loads(config_path.read_text())
+            except json.JSONDecodeError:
+                print(f"[meshcode] WARNING: {config_path} exists but is not valid JSON.", file=sys.stderr)
+                return 2
+
+        if not isinstance(existing, dict):
+            existing = {}
+
+        servers = existing.setdefault("mcpServers", {})
+        if not isinstance(servers, dict):
+            print(f"[meshcode] ERROR: 'mcpServers' in {config_path} is not an object", file=sys.stderr)
+            return 2
 
-    server_id = f"meshcode-{project}-{agent}"
-    servers[server_id] = _build_server_block(project, project_id, agent, role, api_key, sb)
-    _atomic_write_json(config_path, existing)
+        servers[server_id] = server_block
+        _atomic_write_json(config_path, existing)
 
     display = CLIENT_DISPLAY_NAMES[client]
     print(f"[meshcode] MCP server '{server_id}' added to {display} GLOBAL config")
@@ -404,7 +527,7 @@ def setup(*args) -> int:
         print("Usage:", file=sys.stderr)
         print("  meshcode setup <project> <agent> [role]           # workspace flow (recommended)", file=sys.stderr)
         print("  meshcode setup <client> <project> <agent> [role]  # legacy global flow", file=sys.stderr)
-        print("  Clients: claude-code, cursor, cline, claude-desktop", file=sys.stderr)
+        print("  Clients: claude-code, cursor, cline, claude-desktop, windsurf, codex", file=sys.stderr)
         return 1
 
     if args[0] in CLIENT_CONFIG_PATHS:

{meshcode-1.8.4 → meshcode-1.8.8}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 1.8.4
+Version: 1.8.8
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-1.8.4 → meshcode-1.8.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "1.8.4"
+version = "1.8.8"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}

meshcode-1.8.4/meshcode/meshcode_mcp/__main__.py

@@ -1,17 +0,0 @@
-"""Run via: python -m meshcode_mcp serve"""
-import sys
-from .server import run_server
-
-
-def main():
-    args = sys.argv[1:]
-    if args and args[0] == "serve":
-        run_server()
-    else:
-        print("Usage: python -m meshcode_mcp serve", file=sys.stderr)
-        print("       (env vars: MESHCODE_PROJECT, MESHCODE_AGENT, SUPABASE_URL, SUPABASE_KEY)", file=sys.stderr)
-        sys.exit(1)
-
-
-if __name__ == "__main__":
-    main()