meshcode 2.10.93__tar.gz → 2.10.94__tar.gz

{meshcode-2.10.93 → meshcode-2.10.94}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.10.93
+Version: 2.10.94
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT
@@ -422,6 +422,11 @@ $env:MESHCODE_PROJECT_ID="your-project-uuid"  # Windows PowerShell
 
 You can also run `meshcode doctor` (v2.10.41+) to diagnose stale paths, missing dependencies, and config issues across all your workspaces.
 
+**9b. Windows: first relaunch shows the old version after a PyPI upgrade**
+Auto-update on Unix uses `os.execv` to swap the running Python image in-place — one launch, latest code (v2.10.93+). On Windows this isn't possible: an `os.execv` replacement breaks Claude Code's stdio pipe to the MCP child (the new process has a different PID). Meshcode therefore installs the new version but defers the swap to the **next** launch on Windows. Expect: `[meshcode] note: Windows defers auto-update to next launch ...` on stderr, then close and re-open Claude Code once to get the new code. To force-load now, run `pip install --upgrade meshcode` manually before launching Claude Code.
+
+If the dashboard tags an agent as having `boot_version_drift`, that means pip wrote the new version to disk but our running process is still the old one — typically benign on Windows (next launch fixes it) and worth investigating on Unix (path-precedence regression).
+
 **10. `MCP server failed to start` in the Claude Code `/mcp` panel**
 Run `claude --debug` to see the underlying error. Nine times out of ten it's a stale or missing key — run `meshcode login mc_xxx` again.
 

{meshcode-2.10.93 → meshcode-2.10.94}/README.md

@@ -396,6 +396,11 @@ $env:MESHCODE_PROJECT_ID="your-project-uuid"  # Windows PowerShell
 
 You can also run `meshcode doctor` (v2.10.41+) to diagnose stale paths, missing dependencies, and config issues across all your workspaces.
 
+**9b. Windows: first relaunch shows the old version after a PyPI upgrade**
+Auto-update on Unix uses `os.execv` to swap the running Python image in-place — one launch, latest code (v2.10.93+). On Windows this isn't possible: an `os.execv` replacement breaks Claude Code's stdio pipe to the MCP child (the new process has a different PID). Meshcode therefore installs the new version but defers the swap to the **next** launch on Windows. Expect: `[meshcode] note: Windows defers auto-update to next launch ...` on stderr, then close and re-open Claude Code once to get the new code. To force-load now, run `pip install --upgrade meshcode` manually before launching Claude Code.
+
+If the dashboard tags an agent as having `boot_version_drift`, that means pip wrote the new version to disk but our running process is still the old one — typically benign on Windows (next launch fixes it) and worth investigating on Unix (path-precedence regression).
+
 **10. `MCP server failed to start` in the Claude Code `/mcp` panel**
 Run `claude --debug` to see the underlying error. Nine times out of ten it's a stale or missing key — run `meshcode login mc_xxx` again.
 

meshcode-2.10.94/meshcode/__init__.py

@@ -0,0 +1,82 @@
+"""MeshCode — Real-time communication between AI agents."""
+__version__ = "2.10.94"
+
+# Exception hierarchy — eagerly imported (lightweight, no deps)
+from meshcode.exceptions import (  # noqa: F401
+    MeshCodeError,
+    AuthError,
+    RPCError,
+    MeshCodeTimeoutError,
+    MeshCodeConnectionError,
+)
+
+# Public API — lazy imports to avoid heavy deps at import time
+def __getattr__(name):
+    if name == "backend":
+        from meshcode.meshcode_mcp import backend
+        return backend
+    if name in _BACKEND_EXPORTS:
+        from meshcode.meshcode_mcp import backend
+        return getattr(backend, name)
+    if name in _SECRETS_EXPORTS:
+        from meshcode import secrets
+        return getattr(secrets, name)
+    raise AttributeError(f"module 'meshcode' has no attribute {name!r}")
+
+
+# Backend: core messaging & agent management
+_BACKEND_EXPORTS = {
+    "send_message",
+    "read_inbox",
+    "count_pending",
+    "get_board",
+    "heartbeat",
+    "set_status",
+    "register_agent",
+    "get_project_id",
+    "sb_rpc",
+    "task_create",
+    "task_list",
+    "encrypt_payload",
+    "decrypt_payload",
+}
+
+# Secrets: credential management
+_SECRETS_EXPORTS = {
+    "get_api_key",
+    "set_api_key",
+    "list_profiles",
+}
+
+__all__ = [
+    "__version__",
+    "backend",
+    # Exceptions
+    "MeshCodeError",
+    "AuthError",
+    "RPCError",
+    "MeshCodeTimeoutError",
+    "MeshCodeConnectionError",
+    # Messaging
+    "send_message",
+    "read_inbox",
+    "count_pending",
+    # Agent management
+    "register_agent",
+    "get_project_id",
+    "get_board",
+    "heartbeat",
+    "set_status",
+    # Tasks
+    "task_create",
+    "task_list",
+    # Low-level
+    "sb_rpc",
+    # Encryption
+    "encrypt_payload",
+    "decrypt_payload",
+    # Credentials
+    "get_api_key",
+    "set_api_key",
+    "list_profiles",
+]

{meshcode-2.10.93 → meshcode-2.10.94}/meshcode/meshcode_mcp/server.py

@@ -1747,6 +1747,25 @@ async def lifespan(_app):
             be.set_status(_PROJECT_ID, AGENT_NAME, "idle", "MCP session active", api_key=_get_api_key())
             log.info(f"[meshcode] Agent {AGENT_NAME} online — initial heartbeat sent")
             _log_activity_bg("agent_online", f"{AGENT_NAME} came online")
+            # Soft-relay any boot_version_drift detected at startup. One-shot:
+            # consume the env-var sentinel set in run_server() so we don't
+            # spam the commander on every retry attempt or future heartbeat.
+            _drift = os.environ.pop("_MESHCODE_BOOT_DRIFT", None)
+            if _drift:
+                try:
+                    be.send_message(
+                        _PROJECT_ID, AGENT_NAME, "mesh-commander",
+                        {
+                            "type": "boot_version_drift",
+                            "drift": _drift,
+                            "agent": AGENT_NAME,
+                            "platform": sys.platform,
+                        },
+                        msg_type="report",
+                        api_key=_get_api_key(),
+                    )
+                except Exception as _drift_e:
+                    log.debug(f"boot_version_drift relay failed: {_drift_e}")
             break
         except Exception as e:
             log.warning(f"initial heartbeat attempt {_attempt+1} failed: {e}")
@@ -4305,6 +4324,12 @@ def _auto_update() -> None:
         log.debug("[meshcode] Auto-update disabled (MESHCODE_AUTO_UPDATE=0)")
         return
     if os.environ.get("MESHCODE_UPDATED") == "1":
+        # Sentinel was set by the parent process right before it execv'd
+        # into us. Clear it now — single-use per upgrade. Without this, any
+        # subprocess we spawn (or a downstream re-exec triggered by some
+        # other code path) inherits MESHCODE_UPDATED=1 and skips the next
+        # legitimate upgrade check. Per task 8d5eed7a.
+        os.environ.pop("MESHCODE_UPDATED", None)
         return
 
     import subprocess
@@ -4389,9 +4414,56 @@ def _auto_update() -> None:
         log.debug(f"[meshcode] Re-exec failed: {e}, continuing with old version")
 
 
+def _check_boot_version_drift():
+    """Compare pip-installed version (on disk) vs imported __version__.
+
+    Returns (installed, loaded) tuple if they differ, else None. Used as a
+    canary for "auto-update wrote new code to disk but our running process
+    is still the old version" — should be unreachable on Unix after the
+    2.10.93 execv fix, but the empirical check guards against:
+      - path-precedence regressions (multiple meshcode installs)
+      - Windows MCP mode (we deliberately defer there)
+      - execv failures that fall through to the old version
+    Best-effort: must not raise.
+    """
+    try:
+        from importlib.metadata import version as _md_version
+        from meshcode import __version__ as _loaded
+        _installed = _md_version("meshcode")
+        if _installed != _loaded:
+            return (_installed, _loaded)
+    except Exception:
+        pass
+    return None
+
+
 def run_server():
     """Start the MCP server on stdio (default for Claude Code)."""
     _auto_update()
+    # Telemetry canary: surface any installed/loaded version drift loudly
+    # to stderr so it shows up in Claude Code's MCP server output. The first
+    # heartbeat carries the loaded version to mc_agents; this stderr line is
+    # the human-visible signal that auto-update did NOT land cleanly.
+    _drift = _check_boot_version_drift()
+    if _drift is not None:
+        _installed, _loaded = _drift
+        print(
+            f"[meshcode] WARN boot_version_drift: installed={_installed} loaded={_loaded} "
+            f"— pip has a newer build on disk than what's running in this process. "
+            f"Restart should pick it up. If it persists, check sys.path precedence.",
+            file=sys.stderr,
+        )
+        # Stash for the heartbeat thread to relay to commander on first beat.
+        os.environ["_MESHCODE_BOOT_DRIFT"] = f"{_installed}->{_loaded}"
+    if sys.platform == "win32":
+        # Windows can't execv-preserve stdio; auto-update defers to next boot.
+        # Always announce so Windows users know why their first launch may
+        # still show an older version even with PyPI updated.
+        print(
+            "[meshcode] note: Windows defers auto-update to next launch "
+            "(execv preserves Claude Code's stdio pipe only on Unix).",
+            file=sys.stderr,
+        )
     print(
         f"[meshcode-mcp] Starting server for {AGENT_NAME}@{PROJECT_NAME}",
         file=sys.stderr,

{meshcode-2.10.93 → meshcode-2.10.94}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.10.93
+Version: 2.10.94
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT
@@ -422,6 +422,11 @@ $env:MESHCODE_PROJECT_ID="your-project-uuid"  # Windows PowerShell
 
 You can also run `meshcode doctor` (v2.10.41+) to diagnose stale paths, missing dependencies, and config issues across all your workspaces.
 
+**9b. Windows: first relaunch shows the old version after a PyPI upgrade**
+Auto-update on Unix uses `os.execv` to swap the running Python image in-place — one launch, latest code (v2.10.93+). On Windows this isn't possible: an `os.execv` replacement breaks Claude Code's stdio pipe to the MCP child (the new process has a different PID). Meshcode therefore installs the new version but defers the swap to the **next** launch on Windows. Expect: `[meshcode] note: Windows defers auto-update to next launch ...` on stderr, then close and re-open Claude Code once to get the new code. To force-load now, run `pip install --upgrade meshcode` manually before launching Claude Code.
+
+If the dashboard tags an agent as having `boot_version_drift`, that means pip wrote the new version to disk but our running process is still the old one — typically benign on Windows (next launch fixes it) and worth investigating on Unix (path-precedence regression).
+
 **10. `MCP server failed to start` in the Claude Code `/mcp` panel**
 Run `claude --debug` to see the underlying error. Nine times out of ten it's a stale or missing key — run `meshcode login mc_xxx` again.
 

{meshcode-2.10.93 → meshcode-2.10.94}/meshcode.egg-info/SOURCES.txt

@@ -183,6 +183,7 @@ meshcode/meshcode_mcp/server.py
 meshcode/meshcode_mcp/test_backend.py
 meshcode/meshcode_mcp/test_realtime.py
 meshcode/meshcode_mcp/test_server_wrapper.py
+tests/test_auto_update_hardening.py
 tests/test_core.py
 tests/test_cross_agent_messaging.py
 tests/test_esc_deaf_state.py

{meshcode-2.10.93 → meshcode-2.10.94}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.10.93"
+version = "2.10.94"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}

meshcode-2.10.94/tests/test_auto_update_hardening.py

@@ -0,0 +1,238 @@
+"""Smoke tests for the auto-update hardening landed in 5a7427f (task 8d5eed7a).
+
+The full meshcode_mcp.server module bootstraps a live project at import
+time (sys.exit on failure), which makes it inhospitable to vanilla pytest
+runs. These tests therefore re-implement the small helpers under test
+inline — the logic is intentionally a verbatim copy of the patched code
+in server.py so any drift between source and tests is caught by review.
+
+Covered:
+  1. _check_boot_version_drift — None when versions match, tuple on mismatch.
+  2. MESHCODE_UPDATED sentinel pop on consume (single-use semantics).
+  3. MESHCODE_AUTO_UPDATE=0 short-circuits before any state mutation.
+
+PyPI/relaunch-dependent matrix cells are tracked separately in the task
+runbook (Phase 3 deliverable).
+"""
+
+import os
+from importlib import metadata
+from unittest import mock
+
+
+# ---------------------------------------------------------------------------
+# Inline copies of the patched helpers (kept in lockstep with server.py).
+# ---------------------------------------------------------------------------
+
+def _check_boot_version_drift_inline():
+    try:
+        from importlib.metadata import version as _md_version
+        from meshcode import __version__ as _loaded
+        _installed = _md_version("meshcode")
+        if _installed != _loaded:
+            return (_installed, _loaded)
+    except Exception:
+        pass
+    return None
+
+
+def _auto_update_inline_skeleton():
+    """Subset of _auto_update covering the env-var gates only."""
+    if os.environ.get("MESHCODE_AUTO_UPDATE", "1").lower() in ("0", "false", "no"):
+        return "disabled"
+    if os.environ.get("MESHCODE_UPDATED") == "1":
+        os.environ.pop("MESHCODE_UPDATED", None)
+        return "post_exec_skip"
+    return "would_check_pypi"
+
+
+# ---------------------------------------------------------------------------
+# 1. Drift helper
+# ---------------------------------------------------------------------------
+
+def test_drift_none_when_versions_match():
+    """No drift on a clean install where pip and __version__ agree."""
+    assert _check_boot_version_drift_inline() is None
+
+
+def test_drift_returns_tuple_when_versions_diverge():
+    """Patching importlib.metadata.version to return a fake newer build
+    must surface (installed, loaded) so the caller can log + telemetry."""
+    fake_installed = "99.99.99"
+    with mock.patch.object(metadata, "version", return_value=fake_installed):
+        result = _check_boot_version_drift_inline()
+    assert result is not None
+    installed, loaded = result
+    assert installed == fake_installed
+    assert loaded != fake_installed
+
+
+def test_drift_swallows_metadata_exceptions():
+    """Helper must never raise — telemetry is best-effort."""
+    with mock.patch.object(metadata, "version", side_effect=metadata.PackageNotFoundError("meshcode")):
+        assert _check_boot_version_drift_inline() is None
+
+
+# ---------------------------------------------------------------------------
+# 2. Sentinel pop
+# ---------------------------------------------------------------------------
+
+def test_sentinel_pop_clears_environment(monkeypatch):
+    monkeypatch.setenv("MESHCODE_UPDATED", "1")
+    monkeypatch.delenv("MESHCODE_AUTO_UPDATE", raising=False)
+    assert _auto_update_inline_skeleton() == "post_exec_skip"
+    assert "MESHCODE_UPDATED" not in os.environ
+
+
+def test_sentinel_pop_idempotent(monkeypatch):
+    """Running twice in a row (simulating a child-of-execv that imports
+    twice) must not raise even though the sentinel is gone the second time."""
+    monkeypatch.setenv("MESHCODE_UPDATED", "1")
+    monkeypatch.delenv("MESHCODE_AUTO_UPDATE", raising=False)
+    _auto_update_inline_skeleton()
+    # Sentinel is already cleared — the second invocation should fall
+    # through to the would-check-pypi branch (or the disabled branch if
+    # MESHCODE_AUTO_UPDATE is ever set to 0). It must not raise KeyError.
+    result = _auto_update_inline_skeleton()
+    assert result in {"would_check_pypi", "disabled"}
+
+
+# ---------------------------------------------------------------------------
+# 3. Disabled short-circuit
+# ---------------------------------------------------------------------------
+
+def test_auto_update_disabled(monkeypatch):
+    monkeypatch.setenv("MESHCODE_AUTO_UPDATE", "0")
+    monkeypatch.delenv("MESHCODE_UPDATED", raising=False)
+    assert _auto_update_inline_skeleton() == "disabled"
+
+
+def test_auto_update_disabled_case_variants(monkeypatch):
+    for val in ("0", "false", "FALSE", "No", "no"):
+        monkeypatch.setenv("MESHCODE_AUTO_UPDATE", val)
+        monkeypatch.delenv("MESHCODE_UPDATED", raising=False)
+        assert _auto_update_inline_skeleton() == "disabled", f"value {val!r} failed"
+
+
+# ---------------------------------------------------------------------------
+# 4. PyPI/pip behaviour matrix (mocked — covers the cells that don't need
+#    a live relaunch). Uses an inlined version of the post-gate _auto_update
+#    body so we can drive each branch independently.
+# ---------------------------------------------------------------------------
+
+import json as _json
+import subprocess as _sp
+import urllib.request as _urlreq
+
+
+def _ver_tuple(v):
+    return tuple(int(x) for x in v.split(".") if x.isdigit())
+
+
+def _auto_update_pypi_step(current, fake_latest, raise_on_open=None,
+                           raise_on_pip=None, on_pip_call=None):
+    """Inlined copy of the post-gate _auto_update logic.
+
+    Returns one of {'no_latest', 'already_latest', 'pip_failed',
+    'timeout', 'would_execv'} so each branch is observable.
+    """
+    if raise_on_open is not None:
+        try:
+            raise raise_on_open
+        except Exception:
+            return "no_latest"
+
+    latest = fake_latest
+    if not latest:
+        return "no_latest"
+    try:
+        if _ver_tuple(latest) <= _ver_tuple(current):
+            return "already_latest"
+    except Exception:
+        return "no_latest"
+
+    # Mock pip install
+    try:
+        if raise_on_pip is _sp.TimeoutExpired:
+            raise _sp.TimeoutExpired(cmd="pip", timeout=60)
+        if raise_on_pip is not None:
+            raise raise_on_pip
+        if on_pip_call is not None:
+            on_pip_call()
+    except _sp.TimeoutExpired:
+        return "timeout"
+    except Exception:
+        return "pip_failed"
+    return "would_execv"
+
+
+def test_pypi_newer_triggers_execv():
+    pip_calls = []
+    result = _auto_update_pypi_step(
+        current="2.10.93",
+        fake_latest="99.99.99",
+        on_pip_call=lambda: pip_calls.append(1),
+    )
+    assert result == "would_execv"
+    assert len(pip_calls) == 1
+
+
+def test_pypi_same_no_op():
+    pip_calls = []
+    result = _auto_update_pypi_step(
+        current="2.10.93",
+        fake_latest="2.10.93",
+        on_pip_call=lambda: pip_calls.append(1),
+    )
+    assert result == "already_latest"
+    assert pip_calls == []
+
+
+def test_pypi_older_no_op():
+    pip_calls = []
+    result = _auto_update_pypi_step(
+        current="2.10.93",
+        fake_latest="2.10.0",
+        on_pip_call=lambda: pip_calls.append(1),
+    )
+    assert result == "already_latest"
+    assert pip_calls == []
+
+
+def test_offline_swallowed():
+    result = _auto_update_pypi_step(
+        current="2.10.93",
+        fake_latest=None,
+        raise_on_open=OSError("offline"),
+    )
+    assert result == "no_latest"
+
+
+def test_pip_timeout_returns_gracefully():
+    """Slow-net cell: pip exceeds 60s → graceful return, no execv."""
+    result = _auto_update_pypi_step(
+        current="2.10.93",
+        fake_latest="99.99.99",
+        raise_on_pip=_sp.TimeoutExpired,
+    )
+    assert result == "timeout"
+
+
+def test_pip_install_failure_swallowed():
+    result = _auto_update_pypi_step(
+        current="2.10.93",
+        fake_latest="99.99.99",
+        raise_on_pip=RuntimeError("pip exploded"),
+    )
+    assert result == "pip_failed"
+
+
+def test_version_compare_handles_non_numeric():
+    """Pre-release strings ('2.10.93rc1') must not crash the comparator."""
+    result = _auto_update_pypi_step(
+        current="2.10.93",
+        fake_latest="2.10.93rc1",
+    )
+    # _ver_tuple drops non-numeric segments — both reduce to (2,10,93),
+    # so the path is "already_latest" (<=).
+    assert result == "already_latest"

meshcode-2.10.93/meshcode/__init__.py

@@ -1,82 +0,0 @@
-"""MeshCode — Real-time communication between AI agents."""
-__version__ = "2.10.93"
-
-# Exception hierarchy — eagerly imported (lightweight, no deps)
-from meshcode.exceptions import (  # noqa: F401
-    MeshCodeError,
-    AuthError,
-    RPCError,
-    MeshCodeTimeoutError,
-    MeshCodeConnectionError,
-)
-
-# Public API — lazy imports to avoid heavy deps at import time
-def __getattr__(name):
-    if name == "backend":
-        from meshcode.meshcode_mcp import backend
-        return backend
-    if name in _BACKEND_EXPORTS:
-        from meshcode.meshcode_mcp import backend
-        return getattr(backend, name)
-    if name in _SECRETS_EXPORTS:
-        from meshcode import secrets
-        return getattr(secrets, name)
-    raise AttributeError(f"module 'meshcode' has no attribute {name!r}")
-
-
-# Backend: core messaging & agent management
-_BACKEND_EXPORTS = {
-    "send_message",
-    "read_inbox",
-    "count_pending",
-    "get_board",
-    "heartbeat",
-    "set_status",
-    "register_agent",
-    "get_project_id",
-    "sb_rpc",
-    "task_create",
-    "task_list",
-    "encrypt_payload",
-    "decrypt_payload",
-}
-
-# Secrets: credential management
-_SECRETS_EXPORTS = {
-    "get_api_key",
-    "set_api_key",
-    "list_profiles",
-}
-
-__all__ = [
-    "__version__",
-    "backend",
-    # Exceptions
-    "MeshCodeError",
-    "AuthError",
-    "RPCError",
-    "MeshCodeTimeoutError",
-    "MeshCodeConnectionError",
-    # Messaging
-    "send_message",
-    "read_inbox",
-    "count_pending",
-    # Agent management
-    "register_agent",
-    "get_project_id",
-    "get_board",
-    "heartbeat",
-    "set_status",
-    # Tasks
-    "task_create",
-    "task_list",
-    # Low-level
-    "sb_rpc",
-    # Encryption
-    "encrypt_payload",
-    "decrypt_payload",
-    # Credentials
-    "get_api_key",
-    "set_api_key",
-    "list_profiles",
-]