meshcode 2.11.107__tar.gz → 2.11.108__tar.gz

{meshcode-2.11.107 → meshcode-2.11.108}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.107
+Version: 2.11.108
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.107 → meshcode-2.11.108}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.107"
+__version__ = "2.11.108"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.107 → meshcode-2.11.108}/meshcode/hostd.py

@@ -503,6 +503,48 @@ def _do_respawns(api_key: str, host_id: str) -> int:
         # only guard; for crash respawns it's a harmless backstop (the server
         # rate-limit at mig404 is stricter and trips first).
         _target = f"{proj}/{agent}"
+        # CONVERGENCE GUARD (451d33a0) — recycle fast-path ONLY. Stops the env-mismatch
+        # recycle-RESPAWN storm the version-recycle guard can't see (see _recycle_blocked).
+        # Counts consecutive recycle-respawns of this target; at _RECYREC_MAX within the
+        # window it blocks relaunch + alerts once, instead of storming terminals forever.
+        if _is_recycle:
+            _rst = _load_state()
+            _rblk = _recycle_blocked(_rst, _target)
+            if _rblk:
+                _log(f"SKIP recycle-respawn {_target}: BLOCKED ({_rblk}) — non-converging recycle; "
+                     f"holding relaunch (auto-retry after {_RECYREC_BLOCK_TTL_S}s or a manual Start).")
+                continue
+            _now = time.time()
+            _rrall = dict(_rst.get("recyrespawn") or {})
+            _rr = dict(_rrall.get(_target) or {})
+            if _rr.get("last_ts") and (_now - float(_rr["last_ts"])) <= _RECYREC_WINDOW_S:
+                _rr["count"] = int(_rr.get("count", 0)) + 1
+            else:
+                _rr = {"count": 1}  # window elapsed (converged/idle) -> fresh count, clears any stale block
+            _rr["last_ts"] = _now
+            if _rr["count"] >= _RECYREC_MAX:
+                _rr["blocked_ts"] = _now
+                _rr["reason"] = "recycle_no_converge"
+                _rrall[_target] = _rr
+                _rst["recyrespawn"] = _rrall
+                _save_state(_rst)
+                _log(f"RECYCLE-STUCK {_target}: {_rr['count']} recycle-respawns in <={_RECYREC_WINDOW_S}s "
+                     f"without converging — spawn env likely older than hostd; align it "
+                     f"(e.g. ~/meshcode-env/bin/pip install -U meshcode==<disk>). BLOCKING recycle-respawns "
+                     f"for {_RECYREC_BLOCK_TTL_S}s. [recycle_blocked_reason=recycle_no_converge]")
+                try:  # stop the dashboard's eternal 'launching…' spinner (same pattern as the breaker)
+                    _rpc("mc_resolve_launch", {
+                        "p_api_key": api_key, "p_project_id": c.get("project_id"), "p_agent": agent,
+                        "p_status": "failed", "p_reason": "recycle_no_converge",
+                        "p_detail": "recycle keeps relaunching without converging — this agent's MCP env is "
+                                    "older than the host; align it (pip install -U meshcode==<host version>), "
+                                    "then Start again"})
+                except Exception:
+                    pass
+                continue
+            _rrall[_target] = _rr
+            _rst["recyrespawn"] = _rrall
+            _save_state(_rst)
         _ok, _burst, _why = _spawn_rate_ok(_target)
         if not _ok:
             _log(f"SKIP {'recycle-' if _is_recycle else ''}respawn {_target}: rate-limited ({_why})")
@@ -591,6 +633,40 @@ def _save_state(st: dict) -> None:
         pass
 
 
+# ------------------------------------------------------------------
+# Recycle non-convergence guard (451d33a0). The env-mismatch storm is a recycle-
+# RESPAWN loop (log: "RECYCLE-RESPAWN <agent> (stale 15-37s, count=0)" every
+# ~15-37s) that the version-recycle guard in _do_version_recycles can NOT see —
+# that guard sits on the version-recycle REQUEST path and its counter only
+# advances on a successful mc_request_recycle, so when a recycle is already
+# pending (requested=False) the counter stays 0 and never trips. This guard sits
+# on the recycle fast-path itself: if a target recycle-respawns _RECYREC_MAX times
+# within _RECYREC_WINDOW_S without converging, STOP relaunching it + alert once
+# (env mismatch) instead of storming terminals forever. Self-heals — the block
+# lifts after _RECYREC_BLOCK_TTL_S (one clean retry; re-blocks if it storms again),
+# and the counter resets the moment the target stops re-qualifying (converged).
+_RECYREC_MAX = _env_int("MESHCODE_RECYREC_MAX", 3, 2)                       # recycle-respawns before non-converge
+_RECYREC_WINDOW_S = _env_int("MESHCODE_RECYREC_WINDOW_SEC", 120, 30)        # consecutive-respawn counting window
+_RECYREC_BLOCK_TTL_S = _env_int("MESHCODE_RECYREC_BLOCK_TTL_SEC", 600, 60)  # block duration before a retry
+
+
+def _recycle_blocked(st, target, now=None):
+    """Shared guard consulted by BOTH _do_respawns (skip the recycle fast-path)
+    and _do_version_recycles (don't version-recycle a non-converging target).
+    Returns a reason string while `target` is blocked, else None. The block
+    auto-expires after _RECYREC_BLOCK_TTL_S so a fixed env gets one clean retry."""
+    now = now if now is not None else time.time()
+    rec = (st.get("recyrespawn") or {}).get(target) or {}
+    bts = rec.get("blocked_ts")
+    if bts:
+        try:
+            if (now - float(bts)) < _RECYREC_BLOCK_TTL_S:
+                return rec.get("reason") or "recycle_no_converge"
+        except (TypeError, ValueError):
+            return None
+    return None
+
+
 def _spawn_rate_ok(target: str):
     """Anti-spam circuit breaker. Returns (ok, tripped_burst, reason).
 
@@ -1442,6 +1518,8 @@ def _do_version_recycles(api_key: str, host_id: str) -> int:
         proj, agent = a.get("project_name"), a.get("name")
         if not proj or not agent:
             continue
+        if _recycle_blocked(st, f"{proj}/{agent}", now):
+            continue  # 451d33a0 unify: already blocked as a non-converging recycle — don't also version-recycle it
         key = f"verrec/{a.get('project_id')}/{agent}"
         if now - float(st.get(key, 0) or 0) < 1800:
             continue  # rate-limit: <=1 version-recycle per agent / 30min (no recycle-storm)

{meshcode-2.11.107 → meshcode-2.11.108}/meshcode/meshcode_mcp/server.py

@@ -1731,6 +1731,8 @@ def _build_instructions() -> str:
 
 RULES: MCP tools only. Tasks > messages. Messages <100 tokens (long → task). No empty acks, JSON only. Thread via in_reply_to. sensitive=True for secrets. Sync vs async: for turn-based/shared-state work (chess, lock-step, "who goes first"), use meshcode_call (sync RPC, 30s) — async meshcode_send crosses ~50%/turn between same-model agents and yields-pongs.
 
+REPLY TO HUMANS VIA THE MESH, NOT THE TERMINAL (product default, Samuel 2026-06-04): when you answer a human (sammybenu/Samuel/ian/fis), you MUST meshcode_send to the mesh. The human watches the DASHBOARD — your Claude Code terminal text and your thinking are INVISIBLE to them, so a terminal-only reply reads as silence ("¿por qué no me contestas?" even while you "answered"). meshcode_send is the ONLY channel they see. To humans write plain prose in THEIR language (Spanish for Samuel), never JSON; JSON-only is for agent↔agent.
+
 CLOSE TASKS IMMEDIATELY (#2 rule, sammybenu 2026-05-22T21:06Z): every time you finish/ship/deliver work for a claimed task, call meshcode_task_complete BEFORE re-entering wait. NO "I'll close it after one more thing." NO leaving claimed tasks lingering in_progress while you do something else — that creates phantom in-progress on the dashboard and the human gets angry. If the work needs human review, set requires_approval=true at task_create OR call meshcode_task_complete (it routes to in_review if reviewer set). The mesh dashboard reflects mc_tasks.status in real-time; stale in_progress = lying to the human.
 
 WORK ASSIGNED TASKS IMMEDIATELY (#3 rule): when meshcode_wait returns pending_tasks or auto_started_task, your NEXT action MUST be to work that task. Do NOT re-enter wait, do NOT ask "what should I do" — the task description tells you. Sequence: read task description → execute the work → meshcode_task_complete → meshcode_wait (which surfaces the next task). One by one until the queue is empty.

{meshcode-2.11.107 → meshcode-2.11.108}/meshcode/protocol_handler.py

@@ -17,15 +17,125 @@ from __future__ import annotations
 import json
 import os
 import platform
+import re
 import shlex
 import shutil
 import subprocess
 import sys
+import time
 import urllib.parse
 from pathlib import Path
 from typing import Iterable, Optional
 
 
+# SECURITY (audit P1-4 RCE/DoS): agent names get interpolated into the platform
+# shell / cmd.exe launch string below. shlex.quote is POSIX-only and does NOT
+# neutralize cmd.exe metacharacters, so a name like `x" & calc & "` would break
+# out of the quoting on Windows (cmd /k) and execute arbitrary code. Real agent
+# names are always plain identifiers — hard-reject anything else at the boundary.
+# Hardened allowlist (chief@mesh-dev spec):
+#   - first char [A-Za-z0-9_]  -> NO leading dash, so `-rf` / `--version` can't be
+#     read as a flag/arg if the name ever reaches a bare positional (arg-injection)
+#   - then [A-Za-z0-9_-]{0,63} -> total length 1..64, capping the 300-char-name DoS
+#   - anchor with \Z, not $    -> in Python `$` also matches just before a trailing
+#     newline, so `name\n` would slip through `^...$`. \Z = absolute end of string.
+_VALID_AGENT_NAME = re.compile(r"^[A-Za-z0-9_][A-Za-z0-9_-]{0,63}\Z")
+
+# Launch-storm control (audit P1: each "Launch All" click spawns a terminal per
+# agent UNCONDITIONALLY; repeat clicks storm the desktop with dup terminals).
+# Two dedup layers + a hard cap:
+#   (1) heartbeat liveness  — skip agents already running (best-effort, network)
+#   (2) local cooldown file — per-agent last-spawn ts; covers the spawn->first-
+#       heartbeat gap where (1) is blind, and absorbs rapid repeat-clicks. No
+#       network, so it is the always-on backstop.
+_MAX_BATCH = 32                                   # hard cap: agents spawned / call
+_LAUNCH_COOLDOWN_S = 30                            # min seconds between same-agent spawns
+_LIVE_HEARTBEAT_S = 20                             # heartbeat age < this = agent live
+_COOLDOWN_FILE = Path.home() / ".meshcode" / "launch_cooldown.json"
+
+
+def is_valid_agent_name(name: str) -> bool:
+    """Shared allowlist gate — True iff `name` is a safe agent identifier.
+
+    Single source of truth for the launch path AND `meshcode run` (run_agent),
+    so the RCE/DoS boundary can't drift between callers.
+    """
+    return bool(name) and bool(_VALID_AGENT_NAME.match(name))
+
+
+def _read_cooldowns() -> dict:
+    try:
+        return json.loads(_COOLDOWN_FILE.read_text(encoding="utf-8")) or {}
+    except Exception:
+        return {}
+
+
+def _record_spawn(name: str, now: Optional[float] = None) -> None:
+    """Stamp `name`'s last-spawn ts in the cooldown file (best-effort, atomic)."""
+    try:
+        data = _read_cooldowns()
+        data[name] = now if now is not None else time.time()
+        _COOLDOWN_FILE.parent.mkdir(parents=True, exist_ok=True)
+        tmp = _COOLDOWN_FILE.with_suffix(".json.tmp")
+        tmp.write_text(json.dumps(data), encoding="utf-8")
+        tmp.replace(_COOLDOWN_FILE)
+    except Exception:
+        pass
+
+
+def _in_cooldown(name: str, cooldowns: dict, now: float) -> bool:
+    try:
+        return (now - float(cooldowns.get(name, 0))) < _LAUNCH_COOLDOWN_S
+    except (TypeError, ValueError):
+        return False
+
+
+def live_agent_names(names: Iterable[str], project: Optional[str] = None) -> set:
+    """Best-effort set of `names` whose mc_agents heartbeat is fresh (<20s).
+
+    Shared liveness primitive for the dedup lane (co-owned w/ chief@mesh-dev).
+    Network + creds required; ANY failure (offline, no api_key, project
+    unresolved, RPC error) returns an EMPTY set so a legitimate launch is never
+    blocked — the cooldown file is the always-on backstop. NB: the meshcode://
+    launch URL carries no project today, so resolution falls back to
+    MESHCODE_PROJECT env; pass `project` explicitly for reliable liveness.
+    """
+    wanted = {n for n in names if is_valid_agent_name(n)}
+    if not wanted:
+        return set()
+    try:
+        import importlib
+        cv = importlib.import_module("meshcode.comms_v4")
+        api_key = cv._load_api_key_for_cli()
+        proj = project or os.environ.get("MESHCODE_PROJECT")
+        if not api_key or not proj:
+            return set()
+        pid = cv.get_project_id(proj)
+        if not pid:
+            return set()
+        r = cv.sb_rpc("mc_get_agents", {"p_api_key": api_key, "p_project_id": pid,
+                                        "p_agent_name": None, "p_select": None,
+                                        "p_limit": None})
+        agents = (r or {}).get("agents") or []
+        from datetime import datetime, timezone
+        now = datetime.now(timezone.utc)
+        live = set()
+        for a in agents:
+            nm = a.get("name")
+            ts = a.get("last_heartbeat")
+            if nm not in wanted or not ts:
+                continue
+            try:
+                dt = datetime.fromisoformat(str(ts).replace("Z", "+00:00"))
+                if (now - dt).total_seconds() < _LIVE_HEARTBEAT_S:
+                    live.add(nm)
+            except Exception:
+                continue
+        return live
+    except Exception:
+        return set()
+
+
 # ============================================================
 # Per-OS terminal spawn
 # ============================================================
@@ -165,7 +275,37 @@ def cmd_launch_batch(agent_names: Iterable[str]) -> int:
     # Resolve `meshcode` binary path (CLI wrapper installed by pip).
     mc_bin = shutil.which("meshcode") or "meshcode"
 
+    # RATE LIMIT: hard-cap the batch so a crafted `agents=` list can't spawn an
+    # unbounded number of terminals (DoS). Excess is reported, never launched.
+    if len(names) > _MAX_BATCH:
+        for name in names[_MAX_BATCH:]:
+            skipped.append({"agent": name, "reason": f"batch cap {_MAX_BATCH} exceeded"})
+        names = names[:_MAX_BATCH]
+
+    # DEDUP inputs computed ONCE for the whole batch: live set (heartbeat) +
+    # cooldown snapshot. `now` is shared so all spawns in this call stamp the
+    # same instant.
+    live = live_agent_names(names)
+    cooldowns = _read_cooldowns()
+    now = time.time()
+
     for name in names:
+        # SECURITY (audit P1-4 RCE/DoS): reject any name that isn't a plain agent
+        # identifier BEFORE it reaches the shell/cmd.exe launch string below.
+        if not is_valid_agent_name(name):
+            skipped.append({"agent": name,
+                            "reason": "invalid agent name (allowlist ^[A-Za-z0-9_][A-Za-z0-9_-]{0,63}$)"})
+            continue
+        # DEDUP 1: agent already running (fresh heartbeat) -> don't double-spawn.
+        if name in live:
+            skipped.append({"agent": name, "reason": "already live (heartbeat <20s)"})
+            continue
+        # DEDUP 2: spawned within the cooldown window -> absorbs repeat-clicks and
+        # the spawn->first-heartbeat gap that layer 1 cannot see.
+        if _in_cooldown(name, cooldowns, now):
+            skipped.append({"agent": name,
+                            "reason": f"cooldown {_LAUNCH_COOLDOWN_S}s (recently launched)"})
+            continue
         # PER-PLATFORM quoting (mesh-core FIX2): cmd.exe wants double-quotes, not POSIX shlex
         # single-quotes (cmd.exe passes single-quotes through literally -> file-not-found).
         if sys.platform == "win32":
@@ -175,6 +315,7 @@ def cmd_launch_batch(agent_names: Iterable[str]) -> int:
         ok, info = _spawn_terminal(cmd)
         if ok:
             launched.append(name)
+            _record_spawn(name, now)
         else:
             skipped.append({"agent": name, "reason": info})
 

{meshcode-2.11.107 → meshcode-2.11.108}/meshcode/run_agent.py

@@ -695,6 +695,21 @@ def run(agent: str, project: Optional[str] = None, editor_override: Optional[str
     boot path flips mc_agents.autonomous_mode=true at register time.
     Task f248d98e Phase 1 (no-DDL subset).
     """
+    # SECURITY (audit P1-4): the agent name flows into workspace path lookups and
+    # a child editor/`claude` launch. Reject anything that isn't a plain agent
+    # identifier (esp. a leading dash, which a child tool could read as a flag) —
+    # belt-and-suspenders with the launch-batch allowlist (shared source of truth).
+    try:
+        from meshcode.protocol_handler import is_valid_agent_name as _ok_name
+    except Exception:
+        import re as _re
+        _ok_name = lambda n: bool(n) and bool(
+            _re.match(r"^[A-Za-z0-9_][A-Za-z0-9_-]{0,63}\Z", str(n)))
+    if not _ok_name(agent):
+        print(json.dumps({"ok": False, "error": f"invalid agent name: {agent!r}",
+                          "error_code": "invalid_agent_name"}))
+        return 1
+
     # Propagate autonomous flag to the editor + MCP child via env var.
     if autonomous:
         os.environ["MESHCODE_AUTONOMOUS"] = "1"

{meshcode-2.11.107 → meshcode-2.11.108}/meshcode/setup_clients.py

@@ -1333,6 +1333,11 @@ If `meshcode_wait()` times out, call it again with a 2× longer timeout (cap 180
 - Tasks > messages. Use `meshcode_task_create / task_claim / task_complete`
   for trackable work. Keep messages <100 tokens (signals only).
 - No empty acks. JSON reports only.
+- **Reply to humans via the mesh, NOT the terminal** (product default): when you
+  answer a human (Samuel/sammybenu/ian/fis), `meshcode_send` to the mesh. The
+  human watches the DASHBOARD — your Claude Code terminal text + thinking are
+  invisible to them, so a terminal-only reply reads as silence. Write plain prose
+  in their language (Spanish for Samuel), never JSON — JSON is for agent↔agent.
 - Threading: pass `in_reply_to`.
 - Sync vs async: for turn-based or shared-state coordination (chess, single-writer
   doc, lock-step handoffs, "who goes first" decisions), prefer

{meshcode-2.11.107 → meshcode-2.11.108}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.107
+Version: 2.11.108
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

meshcode-2.11.108/meshcode.egg-info/SOURCES.txt

@@ -0,0 +1,97 @@
+README.md
+pyproject.toml
+meshcode/__init__.py
+meshcode/__main__.py
+meshcode/_session_handoff_template 2.py
+meshcode/_session_handoff_template 3.py
+meshcode/_session_handoff_template.py
+meshcode/_stop_hook_template.py
+meshcode/ascii_art.py
+meshcode/atomic_push.py
+meshcode/claude_update 2.py
+meshcode/claude_update 3.py
+meshcode/claude_update.py
+meshcode/cli.py
+meshcode/comms_v4.py
+meshcode/compat.py
+meshcode/daemon.py
+meshcode/date_parse.py
+meshcode/doctor.py
+meshcode/error_hints.py
+meshcode/exceptions.py
+meshcode/hostd 2.py
+meshcode/hostd.py
+meshcode/invites.py
+meshcode/launcher.py
+meshcode/launcher_install.py
+meshcode/preferences.py
+meshcode/protocol_handler.py
+meshcode/protocol_v2.py
+meshcode/quickstart.py
+meshcode/rpc_allowlist.py
+meshcode/run_agent.py
+meshcode/secrets.py
+meshcode/self_update.py
+meshcode/setup_clients.py
+meshcode/supervisor.py
+meshcode/up 2.py
+meshcode/up.py
+meshcode/upload.py
+meshcode.egg-info/PKG-INFO
+meshcode.egg-info/SOURCES.txt
+meshcode.egg-info/dependency_links.txt
+meshcode.egg-info/entry_points.txt
+meshcode.egg-info/requires.txt
+meshcode.egg-info/top_level.txt
+meshcode/meshcode_mcp/__init__.py
+meshcode/meshcode_mcp/__main__.py
+meshcode/meshcode_mcp/backend.py
+meshcode/meshcode_mcp/realtime.py
+meshcode/meshcode_mcp/server.py
+meshcode/meshcode_mcp/sleep_signals.py
+meshcode/meshcode_mcp/test_backend.py
+meshcode/meshcode_mcp/test_boot_timing.py
+meshcode/meshcode_mcp/test_install_guard.py
+meshcode/meshcode_mcp/test_prefs_claude_version.py
+meshcode/meshcode_mcp/test_realtime.py
+meshcode/meshcode_mcp/test_server_wrapper.py
+meshcode/scripts/check_secrets.py
+meshcode/scripts/race_rate_harness.py
+tests/test_auto_update_hardening.py
+tests/test_autonomous_closegap_1.py
+tests/test_autonomous_closegap_2.py
+tests/test_autonomous_closegap_3.py
+tests/test_autonomous_prompt_inject 2.py
+tests/test_autonomous_prompt_inject 3.py
+tests/test_autonomous_prompt_inject.py
+tests/test_boot_bug_regression.py
+tests/test_color_truecolor.py
+tests/test_core.py
+tests/test_cross_agent_messaging.py
+tests/test_date_parse.py
+tests/test_doctor.py
+tests/test_epistemic_v1_python_sdk.py
+tests/test_epistemic_v1_stop_conditions.py
+tests/test_esc_deaf_state.py
+tests/test_exceptions.py
+tests/test_file_upload.py
+tests/test_init_device_code.py
+tests/test_install_guard.py
+tests/test_lease_sigterm_release.py
+tests/test_mark_read_batch.py
+tests/test_marketplace_ratings.py
+tests/test_migration_integrity.py
+tests/test_realtime_event_freshness.py
+tests/test_rls_cross_tenant.py
+tests/test_rpc_grants.py
+tests/test_rpc_migrations.py
+tests/test_run_agent_dry_run.py
+tests/test_run_agent_no_server_import.py
+tests/test_security_regressions.py
+tests/test_self_update_user_site.py
+tests/test_sentinel.py
+tests/test_setup_path.py
+tests/test_sleep_signals.py
+tests/test_status_enum_coverage.py
+tests/test_stay_on_loop_hook.py
+tests/test_wait_open_tasks_contradiction.py

meshcode-2.11.108/meshcode.egg-info/top_level.txt

@@ -0,0 +1 @@
+meshcode

{meshcode-2.11.107 → meshcode-2.11.108}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.107"
+version = "2.11.108"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}
@@ -47,7 +47,7 @@ testpaths = ["tests"]
 addopts = "--durations=10 --durations-min=0.5 -v --tb=short"
 
 [tool.setuptools.packages.find]
-include = ["meshcode*"]
+include = ["meshcode", "meshcode.*"]
 
 [tool.setuptools.package-data]
 meshcode = ["comms_v4.py"]

{meshcode-2.11.107 → meshcode-2.11.108}/tests/test_wait_open_tasks_contradiction.py

@@ -74,8 +74,9 @@ class TestWaitContradictionFix(unittest.TestCase):
         # Look for the count_pending check inside meshcode_wait.
         wait_def_idx = self.source.find("async def meshcode_wait")
         self.assertGreater(wait_def_idx, 0)
-        # 6000 chars covers the function body comfortably.
-        wait_body = self.source[wait_def_idx:wait_def_idx + 6000]
+        # 8000 chars covers the function body comfortably (grew after the
+        # CHAT-DELIVERY-FIX which adds an unread-priority guard before task_pull).
+        wait_body = self.source[wait_def_idx:wait_def_idx + 8000]
         self.assertIn("count_pending", wait_body,
                       "messages-block-wait path must still call count_pending")
         self.assertIn("read_inbox", wait_body,

meshcode-2.11.107/meshcode/cli.py

@@ -1,42 +0,0 @@
-#!/usr/bin/env python3
-"""MeshCode CLI entry point for pip install."""
-import sys
-import os
-
-# Force UTF-8 on stdout/stderr for Windows terminals (cp1252 default crashes
-# on emojis, em-dashes, and any non-ASCII output the CLI prints).
-# Python 3.7+ supports reconfigure(); older versions get a no-op.
-try:
-    if hasattr(sys.stdout, "reconfigure"):
-        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
-    if hasattr(sys.stderr, "reconfigure"):
-        sys.stderr.reconfigure(encoding="utf-8", errors="replace")
-except Exception:
-    pass
-
-
-def main():
-    """Entry point that delegates to comms_v4.py within the package."""
-    # Find comms_v4.py — first in package dir, then in repo root
-    pkg_dir = os.path.dirname(os.path.abspath(__file__))
-    repo_root = os.path.dirname(pkg_dir)
-
-    for candidate in [
-        os.path.join(pkg_dir, "comms_v4.py"),
-        os.path.join(repo_root, "comms_v4.py"),
-    ]:
-        if os.path.exists(candidate):
-            sys.argv[0] = candidate
-            # Set __name__ and __file__ for the script
-            globs = {"__name__": "__main__", "__file__": candidate}
-            # Force UTF-8 on Windows (cp1252 default crashes on non-ASCII)
-            with open(candidate, encoding="utf-8") as f:
-                exec(compile(f.read(), candidate, "exec"), globs)
-            return
-
-    print("[meshcode] ERROR: comms_v4.py not found. Reinstall: pip install meshcode")
-    sys.exit(1)
-
-
-if __name__ == "__main__":
-    main()