meshcode 2.11.107__tar.gz → 2.11.109__tar.gz

{meshcode-2.11.107 → meshcode-2.11.109}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.107
+Version: 2.11.109
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.107 → meshcode-2.11.109}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.107"
+__version__ = "2.11.109"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.107 → meshcode-2.11.109}/meshcode/hostd.py

@@ -503,6 +503,48 @@ def _do_respawns(api_key: str, host_id: str) -> int:
         # only guard; for crash respawns it's a harmless backstop (the server
         # rate-limit at mig404 is stricter and trips first).
         _target = f"{proj}/{agent}"
+        # CONVERGENCE GUARD (451d33a0) — recycle fast-path ONLY. Stops the env-mismatch
+        # recycle-RESPAWN storm the version-recycle guard can't see (see _recycle_blocked).
+        # Counts consecutive recycle-respawns of this target; at _RECYREC_MAX within the
+        # window it blocks relaunch + alerts once, instead of storming terminals forever.
+        if _is_recycle:
+            _rst = _load_state()
+            _rblk = _recycle_blocked(_rst, _target)
+            if _rblk:
+                _log(f"SKIP recycle-respawn {_target}: BLOCKED ({_rblk}) — non-converging recycle; "
+                     f"holding relaunch (auto-retry after {_RECYREC_BLOCK_TTL_S}s or a manual Start).")
+                continue
+            _now = time.time()
+            _rrall = dict(_rst.get("recyrespawn") or {})
+            _rr = dict(_rrall.get(_target) or {})
+            if _rr.get("last_ts") and (_now - float(_rr["last_ts"])) <= _RECYREC_WINDOW_S:
+                _rr["count"] = int(_rr.get("count", 0)) + 1
+            else:
+                _rr = {"count": 1}  # window elapsed (converged/idle) -> fresh count, clears any stale block
+            _rr["last_ts"] = _now
+            if _rr["count"] >= _RECYREC_MAX:
+                _rr["blocked_ts"] = _now
+                _rr["reason"] = "recycle_no_converge"
+                _rrall[_target] = _rr
+                _rst["recyrespawn"] = _rrall
+                _save_state(_rst)
+                _log(f"RECYCLE-STUCK {_target}: {_rr['count']} recycle-respawns in <={_RECYREC_WINDOW_S}s "
+                     f"without converging — spawn env likely older than hostd; align it "
+                     f"(e.g. ~/meshcode-env/bin/pip install -U meshcode==<disk>). BLOCKING recycle-respawns "
+                     f"for {_RECYREC_BLOCK_TTL_S}s. [recycle_blocked_reason=recycle_no_converge]")
+                try:  # stop the dashboard's eternal 'launching…' spinner (same pattern as the breaker)
+                    _rpc("mc_resolve_launch", {
+                        "p_api_key": api_key, "p_project_id": c.get("project_id"), "p_agent": agent,
+                        "p_status": "failed", "p_reason": "recycle_no_converge",
+                        "p_detail": "recycle keeps relaunching without converging — this agent's MCP env is "
+                                    "older than the host; align it (pip install -U meshcode==<host version>), "
+                                    "then Start again"})
+                except Exception:
+                    pass
+                continue
+            _rrall[_target] = _rr
+            _rst["recyrespawn"] = _rrall
+            _save_state(_rst)
         _ok, _burst, _why = _spawn_rate_ok(_target)
         if not _ok:
             _log(f"SKIP {'recycle-' if _is_recycle else ''}respawn {_target}: rate-limited ({_why})")
@@ -519,11 +561,17 @@ def _do_respawns(api_key: str, host_id: str) -> int:
                 except Exception:
                     pass
             continue
+        # Part 2 (Samuel req #2): for a VISIBLE recycle, snapshot the OLD window
+        # pid(s) BEFORE spawning the fresh one — so the new pid is never in the
+        # close set (commander q1: never touch the fresh terminal).
+        _old_vis_pids = _discover_agent_pids(_target) if (_is_recycle and _visible) else []
         _log(f"{'RECYCLE-RESPAWN' if _is_recycle else 'RESPAWN'} {proj}/{agent} "
              f"({'VISIBLE ' if _visible else ''}stale {c.get('heartbeat_age_s')}s, count={c.get('respawn_count')})")
         if _spawn_agent(proj, agent, headless=_hl):
             _record_spawn(_target)  # count the terminal we just opened, against the breaker
             if _is_recycle:
+                if _visible and _old_vis_pids:
+                    _close_old_visible_recycle(_target, _old_vis_pids)  # close old window (DRY-RUN first)
                 _rpc("mc_record_recycle",
                      {"p_api_key": api_key, "p_project_id": c.get("project_id"), "p_agent_name": agent})
                 n += 1
@@ -591,6 +639,103 @@ def _save_state(st: dict) -> None:
         pass
 
 
+# ------------------------------------------------------------------
+# Recycle non-convergence guard (451d33a0). The env-mismatch storm is a recycle-
+# RESPAWN loop (log: "RECYCLE-RESPAWN <agent> (stale 15-37s, count=0)" every
+# ~15-37s) that the version-recycle guard in _do_version_recycles can NOT see —
+# that guard sits on the version-recycle REQUEST path and its counter only
+# advances on a successful mc_request_recycle, so when a recycle is already
+# pending (requested=False) the counter stays 0 and never trips. This guard sits
+# on the recycle fast-path itself: if a target recycle-respawns _RECYREC_MAX times
+# within _RECYREC_WINDOW_S without converging, STOP relaunching it + alert once
+# (env mismatch) instead of storming terminals forever. Self-heals — the block
+# lifts after _RECYREC_BLOCK_TTL_S (one clean retry; re-blocks if it storms again),
+# and the counter resets the moment the target stops re-qualifying (converged).
+_RECYREC_MAX = _env_int("MESHCODE_RECYREC_MAX", 3, 2)                       # recycle-respawns before non-converge
+_RECYREC_WINDOW_S = _env_int("MESHCODE_RECYREC_WINDOW_SEC", 120, 30)        # consecutive-respawn counting window
+_RECYREC_BLOCK_TTL_S = _env_int("MESHCODE_RECYREC_BLOCK_TTL_SEC", 600, 60)  # block duration before a retry
+
+
+def _recycle_blocked(st, target, now=None):
+    """Shared guard consulted by BOTH _do_respawns (skip the recycle fast-path)
+    and _do_version_recycles (don't version-recycle a non-converging target).
+    Returns a reason string while `target` is blocked, else None. The block
+    auto-expires after _RECYREC_BLOCK_TTL_S so a fixed env gets one clean retry."""
+    now = now if now is not None else time.time()
+    rec = (st.get("recyrespawn") or {}).get(target) or {}
+    bts = rec.get("blocked_ts")
+    if bts:
+        try:
+            if (now - float(bts)) < _RECYREC_BLOCK_TTL_S:
+                return rec.get("reason") or "recycle_no_converge"
+        except (TypeError, ValueError):
+            return None
+    return None
+
+
+# Samuel rule 2026-06-04: never recycle a CONNECTED agent (live MCP session) except
+# the >3h uptime lifecycle. BUSY_STATUSES (working/online/busy) MISSES a connected-
+# but-idle agent (status idle/standby, window open, heartbeat fresh) — a fresh
+# heartbeat is the stronger 'live session' signal, so an idle-but-connected agent
+# was being version-recycled out from under the user (the storm he kept seeing).
+_CONNECTED_HEARTBEAT_S = _env_int("MESHCODE_CONNECTED_HEARTBEAT_SEC", 60, 10)
+
+
+def _agent_connected(a) -> bool:
+    """True if the agent has a live MCP session: an explicitly-busy status OR a
+    very-recent heartbeat (window open even when idle/standby)."""
+    if (a.get("status") or "") in BUSY_STATUSES:
+        return True
+    hb = a.get("heartbeat_age_s")
+    try:
+        return hb is not None and float(hb) < _CONNECTED_HEARTBEAT_S
+    except (TypeError, ValueError):
+        return False
+
+
+# Part 2 (Samuel req #2 2026-06-04): on a VISIBLE recycle, close the OLD window so
+# old+new don't both stay open (audit gap 6a203baa). DRY-RUN first (commander q2 +
+# reaper safe-arm pattern): log-only until the logs confirm it's ONLY the old pid.
+_CLOSE_OLD_VISIBLE_DRYRUN = True
+
+
+def _pid_alive(pid) -> bool:
+    if not pid:
+        return False
+    try:
+        os.kill(int(pid), 0)
+        return True
+    except ProcessLookupError:
+        return False
+    except PermissionError:
+        return True   # exists, owned by another uid — treat as alive (don't guess)
+    except Exception:
+        return False
+
+
+def _close_old_visible_recycle(target: str, old_pids) -> int:
+    """Close the OLD window's still-alive process on a VISIBLE recycle. `old_pids`
+    is the PRE-SPAWN snapshot, so the freshly-opened window's pid is excluded by
+    construction — we NEVER touch the fresh terminal (commander q1). Graceful
+    self-exit (the stop-hook ends the session on must_exit=recycle) is PRIMARY
+    (q3): an already-exited old pid is skipped. DRY-RUN first (q2): log the
+    would-close pid; flip _CLOSE_OLD_VISIBLE_DRYRUN=False to arm once logs show
+    it's only the old pid. Real kill reuses _kill_headless_pid's cmdline guard."""
+    n = 0
+    for pid in old_pids:
+        if not _pid_alive(pid):
+            continue  # already self-closed gracefully (q3 primary) — nothing to do
+        if _CLOSE_OLD_VISIBLE_DRYRUN:
+            _log(f"CLOSE-OLD-VISIBLE-DRYRUN {target}: WOULD close old window pid {pid} "
+                 f"(visible recycle; fresh window already spawned + excluded) — log-only. "
+                 f"Flip _CLOSE_OLD_VISIBLE_DRYRUN=False after confirming it's ONLY the old pid.")
+            continue
+        if _kill_headless_pid(target, pid):
+            _log(f"CLOSE-OLD-VISIBLE {target}: closed old window pid {pid} (visible recycle; kept fresh window)")
+            n += 1
+    return n
+
+
 def _spawn_rate_ok(target: str):
     """Anti-spam circuit breaker. Returns (ok, tripped_burst, reason).
 
@@ -978,6 +1123,9 @@ def _do_recycle_enforce(api_key: str, host_id: str) -> int:
     agent (headless_pids, with _kill_headless_pid's reuse-guard) — NEVER blind cmdline. After the
     kill it goes stale and the recycle FAST-PATH in _do_respawns relaunches it within seconds ->
     SessionStart restores the handoff. Returns number force-killed."""
+    # DEAD-FEATURE (task 222b1b02, Samuel 2026-06-04): RECYCLE disabled in prod — hard no-op
+    # (no recycles are triggered, so there is nothing to enforce). Crash-RESPAWN unaffected.
+    return 0
     res = _rpc("mc_recycle_enforce_candidates", {"p_api_key": api_key, "p_host_id": host_id})
     if not res or not res.get("ok"):
         return 0
@@ -1023,6 +1171,11 @@ def _do_recycle_enforce(api_key: str, host_id: str) -> int:
 
 def _do_recycles(api_key: str, host_id: str) -> int:
     """Uptime-based recycle at task boundary. Returns number recycled."""
+    # DEAD-FEATURE (task 222b1b02, Samuel 2026-06-04): the RECYCLE feature is disabled in
+    # prod (unreliable — kept causing version/env-mismatch storms). Hard no-op in source so
+    # it stays dead even if a schedule row reappears. Crash-RESPAWN (_do_respawns) is
+    # UNAFFECTED — only RECYCLE triggers are killed.
+    return 0
     cfg = _rpc("mc_host_config_get", {"p_api_key": api_key, "p_host_id": host_id})
     if not cfg or not cfg.get("ok"):
         return 0
@@ -1413,6 +1566,10 @@ def _do_version_recycles(api_key: str, host_id: str) -> int:
     mid-task), rate-limited (<=1 version-recycle per agent / 30min), recycle-not-kill (clean handoff via
     mc_request_recycle -> agent exits at its boundary -> _do_respawns relaunches on the new version).
     Recorded via mc_record_recycle (NEVER counts against the mig406 crash respawn cap). Owner-scoped."""
+    # DEAD-FEATURE (task 222b1b02, Samuel 2026-06-04): RECYCLE disabled in prod — hard no-op.
+    # This was the env-mismatch storm source; fixed-at-source via run_agent env-sync, but the
+    # whole recycle feature is being removed per owner. Crash-RESPAWN is unaffected.
+    return 0
     cfg = _rpc("mc_host_config_get", {"p_api_key": api_key, "p_host_id": host_id})
     if not cfg or not cfg.get("ok"):
         return 0
@@ -1437,11 +1594,15 @@ def _do_version_recycles(api_key: str, host_id: str) -> int:
                 continue  # agent already on the on-disk version (or newer) — nothing to do
         except Exception:
             continue
-        if (a.get("status") or "") in BUSY_STATUSES:
-            continue  # safe-point ONLY — never recycle a working agent mid-task
+        if _agent_connected(a):
+            continue  # Samuel rule: never version-recycle a CONNECTED agent (live MCP session,
+                      # even if idle/standby) — the >3h uptime lifecycle (_do_recycles) is the
+                      # only recycle that may touch a connected agent.
         proj, agent = a.get("project_name"), a.get("name")
         if not proj or not agent:
             continue
+        if _recycle_blocked(st, f"{proj}/{agent}", now):
+            continue  # 451d33a0 unify: already blocked as a non-converging recycle — don't also version-recycle it
         key = f"verrec/{a.get('project_id')}/{agent}"
         if now - float(st.get(key, 0) or 0) < 1800:
             continue  # rate-limit: <=1 version-recycle per agent / 30min (no recycle-storm)

{meshcode-2.11.107 → meshcode-2.11.109}/meshcode/meshcode_mcp/server.py

@@ -1731,6 +1731,8 @@ def _build_instructions() -> str:
 
 RULES: MCP tools only. Tasks > messages. Messages <100 tokens (long → task). No empty acks, JSON only. Thread via in_reply_to. sensitive=True for secrets. Sync vs async: for turn-based/shared-state work (chess, lock-step, "who goes first"), use meshcode_call (sync RPC, 30s) — async meshcode_send crosses ~50%/turn between same-model agents and yields-pongs.
 
+REPLY TO HUMANS VIA THE MESH, NOT THE TERMINAL (product default, Samuel 2026-06-04): when you answer a human (sammybenu/Samuel/ian/fis), you MUST meshcode_send to the mesh. The human watches the DASHBOARD — your Claude Code terminal text and your thinking are INVISIBLE to them, so a terminal-only reply reads as silence ("¿por qué no me contestas?" even while you "answered"). meshcode_send is the ONLY channel they see. To humans write plain prose in THEIR language (Spanish for Samuel), never JSON; JSON-only is for agent↔agent.
+
 CLOSE TASKS IMMEDIATELY (#2 rule, sammybenu 2026-05-22T21:06Z): every time you finish/ship/deliver work for a claimed task, call meshcode_task_complete BEFORE re-entering wait. NO "I'll close it after one more thing." NO leaving claimed tasks lingering in_progress while you do something else — that creates phantom in-progress on the dashboard and the human gets angry. If the work needs human review, set requires_approval=true at task_create OR call meshcode_task_complete (it routes to in_review if reviewer set). The mesh dashboard reflects mc_tasks.status in real-time; stale in_progress = lying to the human.
 
 WORK ASSIGNED TASKS IMMEDIATELY (#3 rule): when meshcode_wait returns pending_tasks or auto_started_task, your NEXT action MUST be to work that task. Do NOT re-enter wait, do NOT ask "what should I do" — the task description tells you. Sequence: read task description → execute the work → meshcode_task_complete → meshcode_wait (which surfaces the next task). One by one until the queue is empty.
@@ -6162,12 +6164,10 @@ def meshcode_recycle_agent(name: str, visible: bool = False) -> Dict[str, Any]:
         visible: True = respawn as a visible focused window; default False =
             preserve the agent's current headless/visible state.
     """
-    return be.sb_rpc("mc_recycle_as_agent", {
-        "p_api_key":    _get_api_key(),
-        "p_project_id": _PROJECT_ID,
-        "p_agent":      name,
-        "p_visible":    bool(visible),
-    })
+    # DEAD-FEATURE (task 222b1b02, Samuel 2026-06-04): recycle is disabled in prod
+    # (unreliable). No-op — do not call the RPC.
+    return {"ok": False, "error_code": "recycle_disabled",
+            "error": "recycle is disabled (feature removed — was unreliable). No action taken."}
 
 
 @mcp.tool()
@@ -6185,12 +6185,9 @@ def meshcode_recycle_fleet(visible: bool = False) -> Dict[str, Any]:
         visible: True = respawn each as a visible focused window; default False
             = preserve each agent's current headless/visible state.
     """
-    return be.sb_rpc("mc_recycle_as_agent", {
-        "p_api_key":    _get_api_key(),
-        "p_project_id": _PROJECT_ID,
-        "p_agent":      None,  # NULL = whole fleet (all running agents)
-        "p_visible":    bool(visible),
-    })
+    # DEAD-FEATURE (task 222b1b02, Samuel 2026-06-04): recycle is disabled in prod. No-op.
+    return {"ok": False, "error_code": "recycle_disabled",
+            "error": "recycle is disabled (feature removed — was unreliable). No action taken."}
 
 
 @mcp.tool()
@@ -6217,12 +6214,10 @@ def meshcode_set_recycle_schedule(interval_hours: int = 6, enabled: bool = True,
             "error_code": "not_yet_supported",
             "error": "per-agent recycle schedule is a fast-follow; pass agent=None for the mesh-global schedule.",
         }
-    return be.sb_rpc("mc_set_recycle_schedule_as_agent", {
-        "p_api_key":        _get_api_key(),
-        "p_project_id":     _PROJECT_ID,
-        "p_enabled":        bool(enabled),
-        "p_interval_hours": int(interval_hours),
-    })
+    # DEAD-FEATURE (task 222b1b02, Samuel 2026-06-04): auto-recycle scheduling is disabled
+    # in prod. No-op — never (re)enable a schedule.
+    return {"ok": False, "error_code": "recycle_disabled",
+            "error": "auto-recycle scheduling is disabled (feature removed — was unreliable). No action taken."}
 
 
 @mcp.tool()

{meshcode-2.11.107 → meshcode-2.11.109}/meshcode/protocol_handler.py

@@ -17,15 +17,125 @@ from __future__ import annotations
 import json
 import os
 import platform
+import re
 import shlex
 import shutil
 import subprocess
 import sys
+import time
 import urllib.parse
 from pathlib import Path
 from typing import Iterable, Optional
 
 
+# SECURITY (audit P1-4 RCE/DoS): agent names get interpolated into the platform
+# shell / cmd.exe launch string below. shlex.quote is POSIX-only and does NOT
+# neutralize cmd.exe metacharacters, so a name like `x" & calc & "` would break
+# out of the quoting on Windows (cmd /k) and execute arbitrary code. Real agent
+# names are always plain identifiers — hard-reject anything else at the boundary.
+# Hardened allowlist (chief@mesh-dev spec):
+#   - first char [A-Za-z0-9_]  -> NO leading dash, so `-rf` / `--version` can't be
+#     read as a flag/arg if the name ever reaches a bare positional (arg-injection)
+#   - then [A-Za-z0-9_-]{0,63} -> total length 1..64, capping the 300-char-name DoS
+#   - anchor with \Z, not $    -> in Python `$` also matches just before a trailing
+#     newline, so `name\n` would slip through `^...$`. \Z = absolute end of string.
+_VALID_AGENT_NAME = re.compile(r"^[A-Za-z0-9_][A-Za-z0-9_-]{0,63}\Z")
+
+# Launch-storm control (audit P1: each "Launch All" click spawns a terminal per
+# agent UNCONDITIONALLY; repeat clicks storm the desktop with dup terminals).
+# Two dedup layers + a hard cap:
+#   (1) heartbeat liveness  — skip agents already running (best-effort, network)
+#   (2) local cooldown file — per-agent last-spawn ts; covers the spawn->first-
+#       heartbeat gap where (1) is blind, and absorbs rapid repeat-clicks. No
+#       network, so it is the always-on backstop.
+_MAX_BATCH = 32                                   # hard cap: agents spawned / call
+_LAUNCH_COOLDOWN_S = 30                            # min seconds between same-agent spawns
+_LIVE_HEARTBEAT_S = 20                             # heartbeat age < this = agent live
+_COOLDOWN_FILE = Path.home() / ".meshcode" / "launch_cooldown.json"
+
+
+def is_valid_agent_name(name: str) -> bool:
+    """Shared allowlist gate — True iff `name` is a safe agent identifier.
+
+    Single source of truth for the launch path AND `meshcode run` (run_agent),
+    so the RCE/DoS boundary can't drift between callers.
+    """
+    return bool(name) and bool(_VALID_AGENT_NAME.match(name))
+
+
+def _read_cooldowns() -> dict:
+    try:
+        return json.loads(_COOLDOWN_FILE.read_text(encoding="utf-8")) or {}
+    except Exception:
+        return {}
+
+
+def _record_spawn(name: str, now: Optional[float] = None) -> None:
+    """Stamp `name`'s last-spawn ts in the cooldown file (best-effort, atomic)."""
+    try:
+        data = _read_cooldowns()
+        data[name] = now if now is not None else time.time()
+        _COOLDOWN_FILE.parent.mkdir(parents=True, exist_ok=True)
+        tmp = _COOLDOWN_FILE.with_suffix(".json.tmp")
+        tmp.write_text(json.dumps(data), encoding="utf-8")
+        tmp.replace(_COOLDOWN_FILE)
+    except Exception:
+        pass
+
+
+def _in_cooldown(name: str, cooldowns: dict, now: float) -> bool:
+    try:
+        return (now - float(cooldowns.get(name, 0))) < _LAUNCH_COOLDOWN_S
+    except (TypeError, ValueError):
+        return False
+
+
+def live_agent_names(names: Iterable[str], project: Optional[str] = None) -> set:
+    """Best-effort set of `names` whose mc_agents heartbeat is fresh (<20s).
+
+    Shared liveness primitive for the dedup lane (co-owned w/ chief@mesh-dev).
+    Network + creds required; ANY failure (offline, no api_key, project
+    unresolved, RPC error) returns an EMPTY set so a legitimate launch is never
+    blocked — the cooldown file is the always-on backstop. NB: the meshcode://
+    launch URL carries no project today, so resolution falls back to
+    MESHCODE_PROJECT env; pass `project` explicitly for reliable liveness.
+    """
+    wanted = {n for n in names if is_valid_agent_name(n)}
+    if not wanted:
+        return set()
+    try:
+        import importlib
+        cv = importlib.import_module("meshcode.comms_v4")
+        api_key = cv._load_api_key_for_cli()
+        proj = project or os.environ.get("MESHCODE_PROJECT")
+        if not api_key or not proj:
+            return set()
+        pid = cv.get_project_id(proj)
+        if not pid:
+            return set()
+        r = cv.sb_rpc("mc_get_agents", {"p_api_key": api_key, "p_project_id": pid,
+                                        "p_agent_name": None, "p_select": None,
+                                        "p_limit": None})
+        agents = (r or {}).get("agents") or []
+        from datetime import datetime, timezone
+        now = datetime.now(timezone.utc)
+        live = set()
+        for a in agents:
+            nm = a.get("name")
+            ts = a.get("last_heartbeat")
+            if nm not in wanted or not ts:
+                continue
+            try:
+                dt = datetime.fromisoformat(str(ts).replace("Z", "+00:00"))
+                if (now - dt).total_seconds() < _LIVE_HEARTBEAT_S:
+                    live.add(nm)
+            except Exception:
+                continue
+        return live
+    except Exception:
+        return set()
+
+
 # ============================================================
 # Per-OS terminal spawn
 # ============================================================
@@ -165,7 +275,37 @@ def cmd_launch_batch(agent_names: Iterable[str]) -> int:
     # Resolve `meshcode` binary path (CLI wrapper installed by pip).
     mc_bin = shutil.which("meshcode") or "meshcode"
 
+    # RATE LIMIT: hard-cap the batch so a crafted `agents=` list can't spawn an
+    # unbounded number of terminals (DoS). Excess is reported, never launched.
+    if len(names) > _MAX_BATCH:
+        for name in names[_MAX_BATCH:]:
+            skipped.append({"agent": name, "reason": f"batch cap {_MAX_BATCH} exceeded"})
+        names = names[:_MAX_BATCH]
+
+    # DEDUP inputs computed ONCE for the whole batch: live set (heartbeat) +
+    # cooldown snapshot. `now` is shared so all spawns in this call stamp the
+    # same instant.
+    live = live_agent_names(names)
+    cooldowns = _read_cooldowns()
+    now = time.time()
+
     for name in names:
+        # SECURITY (audit P1-4 RCE/DoS): reject any name that isn't a plain agent
+        # identifier BEFORE it reaches the shell/cmd.exe launch string below.
+        if not is_valid_agent_name(name):
+            skipped.append({"agent": name,
+                            "reason": "invalid agent name (allowlist ^[A-Za-z0-9_][A-Za-z0-9_-]{0,63}$)"})
+            continue
+        # DEDUP 1: agent already running (fresh heartbeat) -> don't double-spawn.
+        if name in live:
+            skipped.append({"agent": name, "reason": "already live (heartbeat <20s)"})
+            continue
+        # DEDUP 2: spawned within the cooldown window -> absorbs repeat-clicks and
+        # the spawn->first-heartbeat gap that layer 1 cannot see.
+        if _in_cooldown(name, cooldowns, now):
+            skipped.append({"agent": name,
+                            "reason": f"cooldown {_LAUNCH_COOLDOWN_S}s (recently launched)"})
+            continue
         # PER-PLATFORM quoting (mesh-core FIX2): cmd.exe wants double-quotes, not POSIX shlex
         # single-quotes (cmd.exe passes single-quotes through literally -> file-not-found).
         if sys.platform == "win32":
@@ -175,6 +315,7 @@ def cmd_launch_batch(agent_names: Iterable[str]) -> int:
         ok, info = _spawn_terminal(cmd)
         if ok:
             launched.append(name)
+            _record_spawn(name, now)
         else:
             skipped.append({"agent": name, "reason": info})
 

{meshcode-2.11.107 → meshcode-2.11.109}/meshcode/run_agent.py

@@ -695,6 +695,21 @@ def run(agent: str, project: Optional[str] = None, editor_override: Optional[str
     boot path flips mc_agents.autonomous_mode=true at register time.
     Task f248d98e Phase 1 (no-DDL subset).
     """
+    # SECURITY (audit P1-4): the agent name flows into workspace path lookups and
+    # a child editor/`claude` launch. Reject anything that isn't a plain agent
+    # identifier (esp. a leading dash, which a child tool could read as a flag) —
+    # belt-and-suspenders with the launch-batch allowlist (shared source of truth).
+    try:
+        from meshcode.protocol_handler import is_valid_agent_name as _ok_name
+    except Exception:
+        import re as _re
+        _ok_name = lambda n: bool(n) and bool(
+            _re.match(r"^[A-Za-z0-9_][A-Za-z0-9_-]{0,63}\Z", str(n)))
+    if not _ok_name(agent):
+        print(json.dumps({"ok": False, "error": f"invalid agent name: {agent!r}",
+                          "error_code": "invalid_agent_name"}))
+        return 1
+
     # Propagate autonomous flag to the editor + MCP child via env var.
     if autonomous:
         os.environ["MESHCODE_AUTONOMOUS"] = "1"
@@ -805,6 +820,22 @@ def run(agent: str, project: Optional[str] = None, editor_override: Optional[str
             print(f"[meshcode]        Run `meshcode setup {resolved_project} {agent}` to fix.", file=sys.stderr)
             return 2
 
+    # Env-mismatch storm fix (2.11.109): the non-blocking auto-pip above updated the
+    # LAUNCHER env (sys.executable). But THIS agent's MCP server runs from this
+    # workspace's .mcp.json `command` python — that's the env that reports
+    # cli_version. Sync IT to the launcher's installed version so hostd
+    # version-recycle CONVERGES instead of looping forever. Non-blocking, best-effort.
+    if not dry_run:
+        try:
+            _doc = json.loads(mcp_json_path.read_text(encoding="utf-8"))
+            for _srv in (_doc.get("mcpServers") or {}).values():
+                _cmd = _srv.get("command")
+                if _cmd:
+                    self_update.sync_agent_env(_cmd)
+                    break
+        except Exception:
+            pass
+
     # ── Validate stop hook exists (required for wait-loop integrity) ─
     # If the workspace was created on an old CLI that didn't install hooks
     # (or someone wiped .claude/), Claude Code has nothing blocking turn-end

{meshcode-2.11.107 → meshcode-2.11.109}/meshcode/self_update.py

@@ -275,6 +275,7 @@ state_dir.mkdir(parents=True, exist_ok=True)
 mode = sys.argv[1] if len(sys.argv) > 1 else "pip"
 target_version = sys.argv[2] if len(sys.argv) > 2 else None
 site_flag = sys.argv[3] if len(sys.argv) > 3 else "system"
+target_python = sys.argv[4] if len(sys.argv) > 4 and sys.argv[4] else None  # agent MCP-server env
 
 try:
     if mode == "pipx":
@@ -282,11 +283,12 @@ try:
     else:
         # --no-cache-dir (task 14782bb4 / urgent): never let pip serve a STALE cached wheel — always
         # fetch the true latest from PyPI (auto-update was grabbing an old cached version otherwise).
-        cmd = [sys.executable, "-m", "pip", "install", "-U", "--no-cache-dir",
+        exe = target_python or sys.executable
+        cmd = [exe, "-m", "pip", "install", "-U", "--no-cache-dir",
                "--disable-pip-version-check", "--quiet"]
-        # Keep upgrade in the same site as the current install so the
-        # user-PATH shim (~/Library/Python/X.Y/bin) doesn't get orphaned.
-        if site_flag == "user":
+        # --user only for the LAUNCHER's own user-site install; an explicit
+        # target_python (the agent's MCP env / venv) installs into ITS env.
+        if site_flag == "user" and not target_python:
             cmd.append("--user")
         cmd.append("meshcode")
     with open(log_path, "ab") as logf:
@@ -315,12 +317,13 @@ finally:
 '''
 
 
-def _spawn_background_updater(target_version: str) -> bool:
+def _spawn_background_updater(target_version: str, target_python: Optional[str] = None) -> bool:
     """Spawn a fully detached subprocess that runs the updater.
 
     The parent (current `meshcode run`) returns immediately. The child
     runs pip install in the background, writes the result to disk, and
-    exits. Next `meshcode run` consumes the result.
+    exits. Next `meshcode run` consumes the result. `target_python` (when set)
+    is the agent's MCP-server env — pip installs into IT, not the launcher.
     """
     if not _acquire_lock():
         return False
@@ -331,7 +334,7 @@ def _spawn_background_updater(target_version: str) -> bool:
     # We pass the runner code via stdin so we don't need to ship a
     # second .py file. The child reads it from sys.stdin and execs it.
     runner = f"import sys; exec(sys.stdin.read())"
-    args = [sys.executable, "-c", runner, mode, target_version, site_flag]
+    args = [sys.executable, "-c", runner, mode, target_version, site_flag, target_python or ""]
 
     try:
         if sys.platform == "win32":
@@ -418,6 +421,46 @@ def check_and_maybe_update(verbose: bool = False) -> None:
         print(f"[meshcode] downloading {latest} in background...", file=sys.stderr)
 
 
+def _env_version(python_exe: str) -> Optional[str]:
+    """meshcode.__version__ as seen by ANOTHER python env (the agent's MCP server)."""
+    try:
+        out = subprocess.run(
+            [python_exe, "-c", "import meshcode,sys; sys.stdout.write(meshcode.__version__)"],
+            capture_output=True, text=True, timeout=10).stdout.strip()
+        return out or None
+    except Exception:
+        return None
+
+
+def sync_agent_env(mcp_python: str, verbose: bool = False) -> None:
+    """Bring the agent's MCP-SERVER env (mcp_python, from the workspace .mcp.json
+    `command`) up to the LAUNCHER's installed meshcode version.
+
+    The MCP server is the env that reports cli_version. If it lags hostd's on-disk
+    version, hostd version-recycles the agent FOREVER (the env-mismatch storm),
+    because run_agent's normal auto-pip only updates the LAUNCHER env
+    (sys.executable). This syncs the env that actually matters. Non-blocking
+    (background pip). No-op if same env / already current / opted out / unreadable.
+    """
+    try:
+        if not mcp_python:
+            return
+        if os.path.realpath(mcp_python) == os.path.realpath(sys.executable):
+            return  # same env — the normal launcher update already covers it
+        if update_disabled():
+            return
+        launcher_ver = _current_version()
+        env_ver = _env_version(mcp_python)
+        if not launcher_ver or not env_ver:
+            return
+        if _is_newer(launcher_ver, env_ver):
+            if _spawn_background_updater(launcher_ver, mcp_python) and verbose:
+                print(f"[meshcode] syncing agent env {env_ver} -> {launcher_ver} in background...",
+                      file=sys.stderr)
+    except Exception:
+        pass
+
+
 # ============================================================
 # Blocking variant — used by `meshcode run` to guarantee the editor
 # subprocess inherits the latest meshcode_mcp/server.py on disk.

{meshcode-2.11.107 → meshcode-2.11.109}/meshcode/setup_clients.py

@@ -1333,6 +1333,11 @@ If `meshcode_wait()` times out, call it again with a 2× longer timeout (cap 180
 - Tasks > messages. Use `meshcode_task_create / task_claim / task_complete`
   for trackable work. Keep messages <100 tokens (signals only).
 - No empty acks. JSON reports only.
+- **Reply to humans via the mesh, NOT the terminal** (product default): when you
+  answer a human (Samuel/sammybenu/ian/fis), `meshcode_send` to the mesh. The
+  human watches the DASHBOARD — your Claude Code terminal text + thinking are
+  invisible to them, so a terminal-only reply reads as silence. Write plain prose
+  in their language (Spanish for Samuel), never JSON — JSON is for agent↔agent.
 - Threading: pass `in_reply_to`.
 - Sync vs async: for turn-based or shared-state coordination (chess, single-writer
   doc, lock-step handoffs, "who goes first" decisions), prefer

{meshcode-2.11.107 → meshcode-2.11.109}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.107
+Version: 2.11.109
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT