meshcode 2.10.94__tar.gz → 2.10.95__tar.gz

{meshcode-2.10.94 → meshcode-2.10.95}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.10.94
+Version: 2.10.95
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

meshcode-2.10.95/meshcode/__init__.py

@@ -0,0 +1,82 @@
+"""MeshCode — Real-time communication between AI agents."""
+__version__ = "2.10.95"
+
+# Exception hierarchy — eagerly imported (lightweight, no deps)
+from meshcode.exceptions import (  # noqa: F401
+    MeshCodeError,
+    AuthError,
+    RPCError,
+    MeshCodeTimeoutError,
+    MeshCodeConnectionError,
+)
+
+# Public API — lazy imports to avoid heavy deps at import time
+def __getattr__(name):
+    if name == "backend":
+        from meshcode.meshcode_mcp import backend
+        return backend
+    if name in _BACKEND_EXPORTS:
+        from meshcode.meshcode_mcp import backend
+        return getattr(backend, name)
+    if name in _SECRETS_EXPORTS:
+        from meshcode import secrets
+        return getattr(secrets, name)
+    raise AttributeError(f"module 'meshcode' has no attribute {name!r}")
+
+
+# Backend: core messaging & agent management
+_BACKEND_EXPORTS = {
+    "send_message",
+    "read_inbox",
+    "count_pending",
+    "get_board",
+    "heartbeat",
+    "set_status",
+    "register_agent",
+    "get_project_id",
+    "sb_rpc",
+    "task_create",
+    "task_list",
+    "encrypt_payload",
+    "decrypt_payload",
+}
+
+# Secrets: credential management
+_SECRETS_EXPORTS = {
+    "get_api_key",
+    "set_api_key",
+    "list_profiles",
+}
+
+__all__ = [
+    "__version__",
+    "backend",
+    # Exceptions
+    "MeshCodeError",
+    "AuthError",
+    "RPCError",
+    "MeshCodeTimeoutError",
+    "MeshCodeConnectionError",
+    # Messaging
+    "send_message",
+    "read_inbox",
+    "count_pending",
+    # Agent management
+    "register_agent",
+    "get_project_id",
+    "get_board",
+    "heartbeat",
+    "set_status",
+    # Tasks
+    "task_create",
+    "task_list",
+    # Low-level
+    "sb_rpc",
+    # Encryption
+    "encrypt_payload",
+    "decrypt_payload",
+    # Credentials
+    "get_api_key",
+    "set_api_key",
+    "list_profiles",
+]

{meshcode-2.10.94 → meshcode-2.10.95}/meshcode/meshcode_mcp/backend.py

@@ -826,14 +826,29 @@ def read_inbox(project_id: str, agent: str, mark_read: bool = True, api_key: Opt
                 for m in messages:
                     p = m.get("payload")
                     if isinstance(p, dict) and "_encrypted" in p:
-                        if mesh_key is None:
-                            mesh_key = get_mesh_key(api_key, project_id)
-                        if mesh_key:
-                            msg_aad = p.get("_aad", project_id)
-                            decrypted = decrypt_payload(p["_encrypted"], mesh_key, aad=msg_aad)
-                            if decrypted is not None:
-                                m["payload"] = decrypted
-                                m["_was_encrypted"] = True
+                        msg_aad = p.get("_aad", project_id)
+                        from_project_marker = p.get("_from_project")
+                        decrypted = None
+                        # Cross-mesh: payload tagged with sender's project.
+                        # Fetch per-link shared key (NOT local mesh key).
+                        if from_project_marker and from_project_marker != project_id:
+                            link_key = get_link_shared_key(api_key, project_id, from_project_marker)
+                            if link_key:
+                                decrypted = decrypt_payload(p["_encrypted"], link_key, aad=msg_aad)
+                                # Decrypt fail → key rotation; refetch once.
+                                if decrypted is None:
+                                    link_key = get_link_shared_key(api_key, project_id, from_project_marker, bypass_cache=True)
+                                    if link_key:
+                                        decrypted = decrypt_payload(p["_encrypted"], link_key, aad=msg_aad)
+                        # In-mesh OR no _from_project marker (legacy): local key.
+                        if decrypted is None:
+                            if mesh_key is None:
+                                mesh_key = get_mesh_key(api_key, project_id)
+                            if mesh_key:
+                                decrypted = decrypt_payload(p["_encrypted"], mesh_key, aad=msg_aad)
+                        if decrypted is not None:
+                            m["payload"] = decrypted
+                            m["_was_encrypted"] = True
                 if mark_read and messages:
                     import datetime as _dt
                     now = _dt.datetime.now(_dt.timezone.utc)
@@ -872,14 +887,25 @@ def read_inbox(project_id: str, agent: str, mark_read: bool = True, api_key: Opt
         for m in messages:
             p = m.get("payload")
             if isinstance(p, dict) and "_encrypted" in p:
-                if mesh_key is None:
-                    mesh_key = get_mesh_key(api_key, project_id)
-                if mesh_key:
-                    msg_aad = p.get("_aad", project_id)
-                    decrypted = decrypt_payload(p["_encrypted"], mesh_key, aad=msg_aad)
-                    if decrypted is not None:
-                        m["payload"] = decrypted
-                        m["_was_encrypted"] = True
+                msg_aad = p.get("_aad", project_id)
+                from_project_marker = p.get("_from_project")
+                decrypted = None
+                if from_project_marker and from_project_marker != project_id:
+                    link_key = get_link_shared_key(api_key, project_id, from_project_marker)
+                    if link_key:
+                        decrypted = decrypt_payload(p["_encrypted"], link_key, aad=msg_aad)
+                        if decrypted is None:
+                            link_key = get_link_shared_key(api_key, project_id, from_project_marker, bypass_cache=True)
+                            if link_key:
+                                decrypted = decrypt_payload(p["_encrypted"], link_key, aad=msg_aad)
+                if decrypted is None:
+                    if mesh_key is None:
+                        mesh_key = get_mesh_key(api_key, project_id)
+                    if mesh_key:
+                        decrypted = decrypt_payload(p["_encrypted"], mesh_key, aad=msg_aad)
+                if decrypted is not None:
+                    m["payload"] = decrypted
+                    m["_was_encrypted"] = True
     if mark_read and messages:
         for m in messages:
             marked = False
@@ -983,6 +1009,56 @@ def get_mesh_key(api_key: str, project_id: str) -> Optional[str]:
     return None
 
 
+# Per-link shared key cache (cross-mesh encrypted msgs). Keyed by
+# (my_project, other_project) tuple. Populated on demand when an encrypted
+# cross-mesh message arrives. Cache invalidates on decrypt failure (rotation).
+_link_key_cache: Dict[tuple, tuple] = {}  # (my_proj, other_proj) -> (hex_key, expiry_ts)
+_LINK_KEY_CACHE_TTL = 600
+_LINK_KEY_CACHE_MAX = 64
+
+
+def get_link_shared_key(api_key: str, my_project: str, other_project: str,
+                        bypass_cache: bool = False) -> Optional[str]:
+    """Retrieve the per-link symmetric encryption key (hex-encoded AES-256).
+
+    Used for cross-mesh encrypted messages — backend `mc_get_link_shared_key`
+    returns a key SHARED by both ends of the link, so encrypt-on-sender +
+    decrypt-on-recipient roundtrips cleanly. `my_project` and `other_project`
+    accept either project name OR project_id; the RPC resolves both.
+
+    Set `bypass_cache=True` after a decrypt failure to handle key rotation
+    (`mc_rotate_link_shared_key`).
+    """
+    cache_key = (my_project, other_project)
+    if not bypass_cache:
+        entry = _link_key_cache.get(cache_key)
+        if entry and entry[1] > _time.time():
+            return entry[0]
+    _link_key_cache.pop(cache_key, None)
+    result = sb_rpc("mc_get_link_shared_key", {
+        "p_api_key": api_key,
+        "p_my_project": my_project,
+        "p_other_project": other_project,
+    })
+    if isinstance(result, dict) and result.get("ok"):
+        try:
+            import base64 as _b64
+            hex_key = _b64.b64decode(result["shared_encryption_key_b64"]).hex()
+        except Exception:
+            return None
+        if len(_link_key_cache) >= _LINK_KEY_CACHE_MAX:
+            now = _time.time()
+            expired = [k for k, v in _link_key_cache.items() if v[1] <= now]
+            for k in expired:
+                del _link_key_cache[k]
+            if len(_link_key_cache) >= _LINK_KEY_CACHE_MAX:
+                oldest = min(_link_key_cache, key=lambda k: _link_key_cache[k][1])
+                del _link_key_cache[oldest]
+        _link_key_cache[cache_key] = (hex_key, _time.time() + _LINK_KEY_CACHE_TTL)
+        return hex_key
+    return None
+
+
 def encrypt_payload(payload: Dict, hex_key: str, aad: Optional[str] = None) -> str:
     """Encrypt a JSON payload using AES-256-GCM with optional AAD.
 

{meshcode-2.10.94 → meshcode-2.10.95}/meshcode/meshcode_mcp/server.py

@@ -2006,23 +2006,36 @@ def meshcode_send(to: str, message: Any, in_reply_to: Optional[str] = None,
             return {"error": "sensitive messages must use encrypted=True for cross-mesh"}
         api_key = _get_api_key()
 
-        # Bridge re-encryption: encrypt payload with the TARGET mesh key so
-        # the receiving agent decrypts normally. Uses mc_get_cross_mesh_key
-        # RPC which validates the link exists before returning the key.
+        # Cross-mesh encryption: per-link symmetric AES-256-GCM key (backend
+        # commit cc6a988 / mig 2026-05-04). Old `mc_get_cross_mesh_key`
+        # returned target's per-mesh key, which empirically failed to decrypt
+        # on recipient (incident 2026-05-04 chief@mesh-dev). New
+        # `mc_get_link_shared_key` returns a key SHARED by sender + recipient
+        # via the link record — both sides resolve to the same bytes, so
+        # encryption roundtrips cleanly. Tag payload with _from_project so the
+        # recipient knows to fetch the link key (not its local mesh key) on
+        # decrypt.
         if encrypted:
-            key_result = be.sb_rpc("mc_get_cross_mesh_key", {
+            key_result = be.sb_rpc("mc_get_link_shared_key", {
                 "p_api_key": api_key,
-                "p_source_project": PROJECT_NAME,
-                "p_target_project": target_meshwork,
-                "p_agent_name": AGENT_NAME,
+                "p_my_project": PROJECT_NAME,
+                "p_other_project": target_meshwork,
             })
             if not isinstance(key_result, dict) or not key_result.get("ok"):
-                err = key_result.get("error", "unknown") if isinstance(key_result, dict) else "RPC failed"
+                err = key_result.get("error_code") or key_result.get("error", "unknown") if isinstance(key_result, dict) else "RPC failed"
                 return {"error": f"cross-mesh encryption failed: {err}"}
-            tgt_key = key_result["key"]
+            link_key_b64 = key_result["shared_encryption_key_b64"]
+            link_id = key_result.get("link_id", "")
             tgt_project_id = key_result.get("target_project_id", "")
-            encrypted_data = be.encrypt_payload(payload, tgt_key, aad=tgt_project_id)
-            payload = {"_encrypted": encrypted_data, "_aad": tgt_project_id}
+            import base64 as _b64
+            link_key_hex = _b64.b64decode(link_key_b64).hex()
+            encrypted_data = be.encrypt_payload(payload, link_key_hex, aad=link_id or tgt_project_id)
+            payload = {
+                "_encrypted": encrypted_data,
+                "_aad": link_id or tgt_project_id,
+                "_from_project": PROJECT_NAME,
+                "_link_id": link_id,
+            }
 
         result = be.sb_rpc("mc_send_cross_mesh", {
             "p_api_key": api_key,
@@ -2688,20 +2701,40 @@ def _mark_realtime_msgs_read_in_db(messages: List[Dict[str, Any]]) -> None:
 async def _meshcode_wait_inner(actual_timeout: int, include_acks: bool) -> Dict[str, Any]:
 
     def _return_from_buffered(buffered: List[Dict[str, Any]]) -> Optional[Dict[str, Any]]:
-        # Auto-decrypt encrypted payloads
+        # Auto-decrypt encrypted payloads. Cross-mesh msgs carry _from_project
+        # marker → use per-link shared key. In-mesh → local mesh key.
         _mesh_key = None
+        _api_key = _get_api_key()
         for msg in buffered:
             p = msg.get("payload")
             if isinstance(p, dict) and "_encrypted" in p:
-                if _mesh_key is None:
+                _msg_aad = p.get("_aad", PROJECT_NAME)
+                _from_proj = p.get("_from_project")
+                _decrypted = None
+                if _from_proj and _from_proj != PROJECT_NAME:
                     try:
-                        _mesh_key = be.get_mesh_key(_get_api_key(), _PROJECT_ID) or ""
+                        _link_key = be.get_link_shared_key(_api_key, PROJECT_NAME, _from_proj)
+                        if _link_key:
+                            _decrypted = be.decrypt_payload(p["_encrypted"], _link_key, aad=_msg_aad)
+                            if _decrypted is None:
+                                _link_key = be.get_link_shared_key(_api_key, PROJECT_NAME, _from_proj, bypass_cache=True)
+                                if _link_key:
+                                    _decrypted = be.decrypt_payload(p["_encrypted"], _link_key, aad=_msg_aad)
                     except Exception:
-                        _mesh_key = ""
-                if _mesh_key:
-                    decrypted = be.decrypt_payload(p["_encrypted"], _mesh_key)
-                    if decrypted is not None:
-                        msg["payload"] = decrypted
+                        pass
+                if _decrypted is None:
+                    if _mesh_key is None:
+                        try:
+                            _mesh_key = be.get_mesh_key(_api_key, _PROJECT_ID) or ""
+                        except Exception:
+                            _mesh_key = ""
+                    if _mesh_key:
+                        try:
+                            _decrypted = be.decrypt_payload(p["_encrypted"], _mesh_key, aad=_msg_aad)
+                        except Exception:
+                            _decrypted = None
+                if _decrypted is not None:
+                    msg["payload"] = _decrypted
         deduped = _filter_and_mark(buffered)
         if not deduped:
             return None

{meshcode-2.10.94 → meshcode-2.10.95}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.10.94
+Version: 2.10.95
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT