meshcode 2.11.10__tar.gz → 2.11.12__tar.gz

{meshcode-2.11.10 → meshcode-2.11.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.10
+Version: 2.11.12
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.10 → meshcode-2.11.12}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.10"
+__version__ = "2.11.12"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

meshcode-2.11.12/meshcode/__main__.py

@@ -0,0 +1,42 @@
+"""Helpful error when user invokes `python -m meshcode` because the
+console-script isn't on PATH yet (B5 friction).
+
+Also dispatches `python -m meshcode setup-path` to the real CLI so the
+user can fix PATH without needing the `meshcode` binary on PATH first.
+"""
+import os
+import sys
+
+
+def main():
+    # If the user explicitly asked to set up PATH, delegate to the real CLI.
+    if len(sys.argv) > 1 and sys.argv[1] == "setup-path":
+        from meshcode import comms_v4 as _cv  # noqa: F401
+        sys.argv[0] = "meshcode"
+        # comms_v4 runs main() at module load via `if __name__ == "__main__"`.
+        # Re-exec the body by importing as __main__ would require executing
+        # the module again; simpler: invoke via runpy.
+        import runpy
+        runpy.run_module("meshcode.comms_v4", run_name="__main__", alter_sys=True)
+        return
+
+    # Otherwise: the user is here because `meshcode` isn't on PATH.
+    print()
+    print("  meshcode is installed but the `meshcode` command isn't on your PATH.")
+    print()
+    print("  Quick fix:")
+    print(f"    {sys.executable} -m meshcode setup-path")
+    print()
+    print("  Or manually:")
+    v = sys.version_info
+    if sys.platform == "darwin":
+        print(f'    export PATH="$HOME/Library/Python/{v.major}.{v.minor}/bin:$PATH"')
+    else:
+        print('    export PATH="$(python3 -m site --user-base)/bin:$PATH"')
+    print()
+    print("  Then re-run: meshcode --help")
+    sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

{meshcode-2.11.10 → meshcode-2.11.12}/meshcode/comms_v4.py

@@ -2777,26 +2777,108 @@ if __name__ == "__main__":
             sys.exit(1)
         print()
 
-        # B3: wrap pairing RPC so SSL / network errors abort cleanly (no
-        # silent fall-through to API-key paste — friction #7).
+        # B3: wrap any pairing RPC so SSL / network errors abort cleanly with
+        # an actionable message (no silent fall-through, friction #7).
+        def _pairing_rpc(fn, args):
+            try:
+                return sb_rpc(fn, args)
+            except Exception as _e:
+                _msg = str(_e).lower()
+                if "certificate" in _msg or "ssl" in _msg:
+                    print()
+                    print("  [meshcode] SSL certificate verification failed.")
+                    print("  [meshcode] This usually means your Python install is missing root certs.")
+                    _v = sys.version_info
+                    print(f"  [meshcode] Fix: run /Applications/Python\\ {_v.major}.{_v.minor}/Install\\ Certificates.command")
+                    print(f"  [meshcode] (Replace {_v.major}.{_v.minor} with your actual installed version.)")
+                    print(f"  [meshcode] Alternative: pip install --upgrade certifi")
+                else:
+                    print()
+                    print(f"  [meshcode] Pairing service unreachable: {_e}")
+                    print(f"  [meshcode] Check your network, then re-run `meshcode init`.")
+                sys.exit(1)
+
+        # B6.2 device-code OAuth (preferred): generates a code, opens browser
+        # to /auth/device?code=…, user clicks Approve, CLI receives a scoped
+        # token. Token is per-device, revocable from dashboard. Replaces the
+        # legacy api-key paste path (which left long-lived secrets in
+        # terminal history — Samuel friction).
+        import hashlib as _hashlib
+        import platform as _platform
         try:
-            pairing = sb_rpc("mc_create_pairing_session", {})
-        except Exception as _init_e:
-            _msg = str(_init_e).lower()
-            if "certificate" in _msg or "ssl" in _msg:
+            _hn = _platform.node() or "unknown"
+            _device_fp = _hashlib.sha256(
+                f"{_platform.system()}|{_hn}|{_platform.machine()}".encode()
+            ).hexdigest()[:32]
+        except Exception:
+            _device_fp = _hashlib.sha256(b"meshcode-anon-device").hexdigest()[:32]
+        _device_name = f"{_platform.node() or 'device'} ({_platform.system()})"
+
+        b6_resp = _pairing_rpc("mc_device_code_create", {
+            "p_device_fingerprint": _device_fp,
+            "p_device_name": _device_name,
+        })
+        if isinstance(b6_resp, dict) and b6_resp.get("ok") and b6_resp.get("code"):
+            code = b6_resp["code"]
+            expires_in = int(b6_resp.get("expires_in_s") or 600)
+            url = f"https://meshcode.io/auth/device?code={code}"
+            print(f"  Step 1: Confirm the code in your browser:")
+            print()
+            print(f"      ┌─────────────────┐")
+            print(f"      │   {code:^11}   │")
+            print(f"      └─────────────────┘")
+            print()
+            print(f"  Opening {url} ...")
+            print(f"  (If browser doesn't open: visit https://meshcode.io/auth/device)")
+            print()
+            try:
+                webbrowser.open(url)
+            except Exception:
+                pass
+            print("  Waiting for approval", end="", flush=True)
+            token = None
+            deadline = _t.time() + expires_in
+            last_status = "pending"
+            while _t.time() < deadline:
+                _t.sleep(2)
+                print(".", end="", flush=True)
+                poll = _pairing_rpc("mc_device_code_poll", {
+                    "p_code": code,
+                    "p_device_fingerprint": _device_fp,
+                })
+                if not (isinstance(poll, dict)):
+                    continue
+                if poll.get("status") == "approved" and poll.get("token"):
+                    token = poll["token"]
+                    break
+                if poll.get("status") in ("expired", "consumed", "rejected") or poll.get("error") not in (None, "rate_limited"):
+                    last_status = poll.get("status") or poll.get("error")
+                    break
+            print()
+            if token:
+                login(token)
                 print()
-                print("  [meshcode] SSL certificate verification failed.")
-                print("  [meshcode] This usually means your Python install is missing root certs.")
-                _v = sys.version_info
-                print(f"  [meshcode] Fix: run /Applications/Python\\ {_v.major}.{_v.minor}/Install\\ Certificates.command")
-                print(f"  [meshcode] (Replace {_v.major}.{_v.minor} with your actual installed version.)")
-                print(f"  [meshcode] Alternative: pip install --upgrade certifi")
-            else:
+                print("  ✓ Paired successfully — device added to your account.")
+                print("  Step 2: Create your first meshwork")
+                print("  Run: meshcode go <agent-name> --project <meshwork-name>")
                 print()
-                print(f"  [meshcode] Pairing service unreachable: {_init_e}")
-                print(f"  [meshcode] Check your network, then re-run `meshcode init`.")
+                print("  Example:")
+                print("    meshcode go backend --project my-app")
+                print()
+                sys.exit(0)
+            print()
+            print(f"  Pairing did not complete ({last_status}). Re-run: meshcode init")
             sys.exit(1)
-        if pairing and isinstance(pairing, dict) and pairing.get("ok"):
+
+        # Legacy fallback: if mc_device_code_create returned a function-not-found
+        # error (B6.1 mig 326 not yet applied on this Supabase project), drop
+        # back to the older mc_create_pairing_session flow. Manual API-key paste
+        # has been retired (security — friction #6).
+        _legacy_b6_err = ""
+        if isinstance(b6_resp, dict):
+            _legacy_b6_err = str(b6_resp.get("error") or "")
+        pairing = _pairing_rpc("mc_create_pairing_session", {})
+        if isinstance(pairing, dict) and pairing.get("ok"):
             session_id = pairing["session_id"]
             code = pairing["code"]
             url = pairing["url"]
@@ -2811,11 +2893,11 @@ if __name__ == "__main__":
                 pass
             print("  Waiting for approval", end="", flush=True)
             api_key = None
-            for _ in range(150):  # 150 * 2s = 5 minutes
+            for _ in range(150):
                 _t.sleep(2)
                 print(".", end="", flush=True)
-                poll = sb_rpc("mc_poll_pairing_session", {"p_session_id": session_id})
-                if poll and isinstance(poll, dict):
+                poll = _pairing_rpc("mc_poll_pairing_session", {"p_session_id": session_id})
+                if isinstance(poll, dict):
                     if poll.get("status") == "approved" and poll.get("api_key"):
                         api_key = poll["api_key"]
                         break
@@ -2823,52 +2905,28 @@ if __name__ == "__main__":
                         break
             print()
             if api_key:
-                print()
                 login(api_key)
                 print()
                 print("  Step 2: Create your first meshwork")
                 print("  Run: meshcode go <agent-name> --project <meshwork-name>")
                 print()
-                print("  Example:")
-                print("    meshcode go backend --project my-app")
-                print()
                 sys.exit(0)
-            else:
-                print("  Pairing timed out or was not approved.")
-                print()
-
-        # Fallback: manual API key paste
-        print("  Step 1: Create your account at meshcode.io")
-        try:
-            webbrowser.open("https://meshcode.io")
-        except Exception:
-            print("  Visit: https://meshcode.io")
-        print("  Step 2: Copy your API key from Settings")
-        print()
-        try:
-            api_key = input("  Paste your API key (mc_...): ").strip()
-        except (EOFError, KeyboardInterrupt):
-            api_key = ""
             print()
-        if api_key:
-            login(api_key)
-            print()
-            print("  Step 3: Create your first meshwork")
-            print("  Run: meshcode go <agent-name> --project <meshwork-name>")
-            print()
-            print("  Example:")
-            print("    meshcode go backend --project my-app")
-            print()
-        else:
-            print("  [meshcode] No API key provided. Run: meshcode login <api_key>")
+            print(f"  Pairing did not complete. Re-run: meshcode init")
             sys.exit(1)
-        sys.exit(0)
+
+        # Both paths failed.
+        print()
+        print(f"  [meshcode] Pairing unavailable: device-code ({_legacy_b6_err or 'unknown'}); "
+              f"legacy pairing ({pairing.get('error') if isinstance(pairing, dict) else 'unknown'}).")
+        print(f"  [meshcode] Re-run `meshcode init` later or contact support.")
+        sys.exit(1)
 
     # Auth guard: commands that talk to Supabase need a valid API key.
     # doctor, help, version, login, prefs, launcher don't need auth.
     _NO_AUTH_CMDS = {"doctor", "compat", "upgrade", "help", "--help", "-h", "login",
                      "init", "prefs", "launcher", "--version", "-V", "version",
-                     "whoami", "profiles", "scan"}
+                     "whoami", "profiles", "scan", "setup-path"}
     if cmd not in _NO_AUTH_CMDS:
         _cli_key = _load_api_key_for_cli()
         if not _cli_key:
@@ -3479,6 +3537,69 @@ if __name__ == "__main__":
             print("       meshcode prefs reset")
             sys.exit(1)
 
+    elif cmd == "setup-path":
+        # B5: append Python user-bin to user's shell rc file (idempotent).
+        # Friction #8 fix: after `pip install --user meshcode`, `meshcode`
+        # isn't on PATH; this gives the user a one-command remediation.
+        import platform as _pl
+        import subprocess as _sp
+        _v = sys.version_info
+        if _pl.system() == "Darwin":
+            user_bin = os.path.expanduser(f"~/Library/Python/{_v.major}.{_v.minor}/bin")
+        else:
+            try:
+                user_bin = _sp.check_output(
+                    [sys.executable, "-m", "site", "--user-base"],
+                    text=True, timeout=5,
+                ).strip() + "/bin"
+            except Exception:
+                user_bin = os.path.expanduser("~/.local/bin")
+
+        shell = os.environ.get("SHELL", "")
+        if "zsh" in shell:
+            rc = os.path.expanduser("~/.zshrc")
+            fish = False
+        elif "fish" in shell:
+            rc = os.path.expanduser("~/.config/fish/config.fish")
+            fish = True
+        else:
+            rc = os.path.expanduser("~/.bashrc")
+            fish = False
+
+        marker = "# meshcode: PATH for user-installed Python binaries"
+        line = (f"set -gx PATH {user_bin} $PATH" if fish
+                else f'export PATH="{user_bin}:$PATH"')
+
+        existing = ""
+        try:
+            if os.path.exists(rc):
+                with open(rc) as f:
+                    existing = f.read()
+        except Exception:
+            pass
+
+        if user_bin in existing:
+            print(f"[meshcode] {rc} already exports {user_bin} — nothing to do.")
+            sys.exit(0)
+
+        try:
+            os.makedirs(os.path.dirname(rc), exist_ok=True)
+            with open(rc, "a") as f:
+                f.write(f"\n{marker}\n{line}\n")
+            print(f"[meshcode] Appended PATH export to {rc}")
+            print(f"[meshcode] Open a new terminal OR run: source {rc}")
+            print(f"[meshcode] Then: meshcode --help")
+            sys.exit(0)
+        except PermissionError:
+            print(f"[meshcode] ERROR: cannot write {rc} (permission denied).")
+            print(f"[meshcode] Manually add this line to your shell rc:")
+            print(f"  {line}")
+            sys.exit(1)
+        except Exception as _spe:
+            print(f"[meshcode] ERROR: {_spe}")
+            print(f"[meshcode] Manually add: {line}")
+            sys.exit(1)
+
     elif cmd == "upgrade":
         # meshcode upgrade — interactive foreground upgrade
         import importlib

{meshcode-2.11.10 → meshcode-2.11.12}/meshcode/meshcode_mcp/server.py

@@ -45,9 +45,21 @@ _ANSI_RGB = [
     (255, 85, 85), (85, 255, 255), (255, 85, 255), (85, 255, 85), (85, 85, 255),
 ]
 
+# BUG-AUDIO-COLOR fix (task e552412a, 2026-05-19): use 24-bit truecolor
+# escapes when the terminal supports them so every terminal renders the
+# same agent color (4-bit palette indices are remapped by terminal themes,
+# producing the cross-machine mismatch Samuel saw).
+_TRUECOLOR_OK = os.environ.get("COLORTERM", "").lower() in ("truecolor", "24bit")
+
 
 def _hex_to_ansi(hex_color: str) -> str:
-    """Map hex color to nearest ANSI code."""
+    """Return ANSI escape for a hex color.
+
+    On truecolor-capable terminals returns 24-bit truecolor (\\e[38;2;R;G;Bm) so
+    the color bypasses palette remapping. Falls back to nearest 4-bit ANSI
+    palette index when COLORTERM is not truecolor.
+    Returns None if hex is malformed.
+    """
     hx = hex_color.strip().lstrip("#")
     if len(hx) != 6:
         return None
@@ -55,6 +67,9 @@ def _hex_to_ansi(hex_color: str) -> str:
         r, g, b = int(hx[0:2], 16), int(hx[2:4], 16), int(hx[4:6], 16)
     except ValueError:
         return None
+    if _TRUECOLOR_OK:
+        return f"\033[38;2;{r};{g};{b}m"
+    # Fallback: map to nearest 4-bit ANSI palette index
     best_i, best_d = 0, float("inf")
     for i, (ar, ag, ab) in enumerate(_ANSI_RGB):
         d = (r - ar) ** 2 + (g - ag) ** 2 + (b - ab) ** 2
@@ -65,10 +80,18 @@ def _hex_to_ansi(hex_color: str) -> str:
 
 
 def _agent_color(name: str) -> str:
-    """ANSI color from profile (dashboard) or MD5 hash fallback."""
+    """Profile-canonical color if cached, else a deterministic per-name color.
+    Never random — same name -> same color on every machine."""
     if _CACHED_AGENT_COLOR:
         return _CACHED_AGENT_COLOR
     h = int(_hashlib.md5(name.encode()).hexdigest()[:8], 16)
+    if _TRUECOLOR_OK:
+        # Pseudo-random but deterministic 24-bit color from the hash. Clamp
+        # mid-range so the color is readable on both dark and light terminals.
+        r = max(70, min(220, (h >> 16) & 0xFF))
+        g = max(70, min(220, (h >> 8) & 0xFF))
+        b = max(70, min(220, h & 0xFF))
+        return f"\033[38;2;{r};{g};{b}m"
     return _ANSI_COLORS[h % len(_ANSI_COLORS)]
 
 

{meshcode-2.11.10 → meshcode-2.11.12}/meshcode/run_agent.py

@@ -846,6 +846,16 @@ def run(agent: str, project: Optional[str] = None, editor_override: Optional[str
         except Exception:
             pass  # Soft-fail — boot must proceed regardless.
 
+    # BUG-AUDIO-COLOR fix: wait briefly for profile fetch to populate
+    # _CACHED_AGENT_COLOR before rendering the banner, so the boot art
+    # doesn't flash the deterministic-hash fallback color and then "jump"
+    # to the canonical profile color. Upper-bound 350ms.
+    try:
+        from .meshcode_mcp.server import _REGISTER_PROFILE_READY
+        _REGISTER_PROFILE_READY.wait(timeout=0.35)
+    except Exception:
+        pass
+
     # ── Welcome banner with unique ASCII art + personality ──────────
     try:
         from .ascii_art import generate_art, render_welcome

{meshcode-2.11.10 → meshcode-2.11.12}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.10
+Version: 2.11.12
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.10 → meshcode-2.11.12}/meshcode.egg-info/SOURCES.txt

@@ -1,6 +1,7 @@
 README.md
 pyproject.toml
 meshcode/__init__.py
+meshcode/__main__.py
 meshcode/_stop_hook_template.py
 meshcode/ascii_art.py
 meshcode/cli.py
@@ -195,6 +196,7 @@ meshcode/scripts/check_secrets.py
 meshcode/scripts/race_rate_harness.py
 tests/test_auto_update_hardening.py
 tests/test_boot_bug_regression.py
+tests/test_color_truecolor.py
 tests/test_core.py
 tests/test_cross_agent_messaging.py
 tests/test_doctor.py
@@ -202,6 +204,7 @@ tests/test_epistemic_v1_python_sdk.py
 tests/test_epistemic_v1_stop_conditions.py
 tests/test_esc_deaf_state.py
 tests/test_exceptions.py
+tests/test_init_device_code.py
 tests/test_install_guard.py
 tests/test_lease_sigterm_release.py
 tests/test_mark_read_batch.py
@@ -211,6 +214,7 @@ tests/test_rls_cross_tenant.py
 tests/test_rpc_migrations.py
 tests/test_security_regressions.py
 tests/test_sentinel.py
+tests/test_setup_path.py
 tests/test_sleep_signals.py
 tests/test_status_enum_coverage.py
 tests/test_stay_on_loop_hook.py

{meshcode-2.11.10 → meshcode-2.11.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.10"
+version = "2.11.12"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}

meshcode-2.11.12/tests/test_color_truecolor.py

@@ -0,0 +1,83 @@
+"""Tests for BUG-AUDIO-COLOR (task e552412a) — truecolor agent colors."""
+import os
+
+import pytest
+
+
+@pytest.fixture(autouse=True)
+def _set_required_env(monkeypatch):
+    """server.py requires these env vars at import."""
+    monkeypatch.setenv("MESHCODE_PROJECT", "test")
+    monkeypatch.setenv("MESHCODE_AGENT", "test")
+    monkeypatch.setenv("MESHCODE_PROJECT_ID", "00000000-0000-0000-0000-000000000000")
+    yield
+
+
+def test_hex_to_ansi_truecolor_format(monkeypatch):
+    from meshcode.meshcode_mcp import server as srv
+    monkeypatch.setattr(srv, "_TRUECOLOR_OK", True)
+    assert srv._hex_to_ansi("#E53935") == "\033[38;2;229;57;53m"
+    assert srv._hex_to_ansi("E53935") == "\033[38;2;229;57;53m"
+
+
+def test_hex_to_ansi_4bit_fallback(monkeypatch):
+    from meshcode.meshcode_mcp import server as srv
+    monkeypatch.setattr(srv, "_TRUECOLOR_OK", False)
+    result = srv._hex_to_ansi("#E53935")
+    # 4-bit ANSI escape, one of the palette entries
+    assert result in srv._ANSI_COLORS
+    assert result.startswith("\033[")
+
+
+def test_hex_to_ansi_malformed_returns_none(monkeypatch):
+    from meshcode.meshcode_mcp import server as srv
+    monkeypatch.setattr(srv, "_TRUECOLOR_OK", True)
+    assert srv._hex_to_ansi("not-hex") is None
+    assert srv._hex_to_ansi("#zzzzzz") is None
+
+
+def test_agent_color_deterministic_truecolor(monkeypatch):
+    """Same name → same color across calls in truecolor mode."""
+    from meshcode.meshcode_mcp import server as srv
+    monkeypatch.setattr(srv, "_CACHED_AGENT_COLOR", None)
+    monkeypatch.setattr(srv, "_TRUECOLOR_OK", True)
+    a = srv._agent_color("commander")
+    b = srv._agent_color("commander")
+    assert a == b
+    assert a.startswith("\033[38;2;")  # truecolor
+
+
+def test_agent_color_deterministic_4bit(monkeypatch):
+    from meshcode.meshcode_mcp import server as srv
+    monkeypatch.setattr(srv, "_CACHED_AGENT_COLOR", None)
+    monkeypatch.setattr(srv, "_TRUECOLOR_OK", False)
+    a = srv._agent_color("commander")
+    b = srv._agent_color("commander")
+    assert a == b
+    assert a in srv._ANSI_COLORS
+
+
+def test_agent_color_cached_overrides(monkeypatch):
+    """If _CACHED_AGENT_COLOR is set (from profile fetch), use that."""
+    from meshcode.meshcode_mcp import server as srv
+    monkeypatch.setattr(srv, "_CACHED_AGENT_COLOR", "\033[38;2;100;200;50m")
+    monkeypatch.setattr(srv, "_TRUECOLOR_OK", True)
+    assert srv._agent_color("any-name") == "\033[38;2;100;200;50m"
+
+
+def test_agent_color_clamped_to_mid_range(monkeypatch):
+    """Truecolor RGB components clamped to [70, 220] for readability on
+    both dark and light terminals."""
+    from meshcode.meshcode_mcp import server as srv
+    monkeypatch.setattr(srv, "_CACHED_AGENT_COLOR", None)
+    monkeypatch.setattr(srv, "_TRUECOLOR_OK", True)
+    # Try many names to exercise the clamp
+    for name in ("a", "bbbb", "cccccc", "dddddddd", "eeeeeeeeee"):
+        c = srv._agent_color(name)
+        # Parse the \033[38;2;R;G;Bm
+        body = c.lstrip("\033[").rstrip("m")
+        parts = body.split(";")
+        r, g, b = int(parts[2]), int(parts[3]), int(parts[4])
+        assert 70 <= r <= 220, f"R={r} out of range for {name}"
+        assert 70 <= g <= 220, f"G={g} out of range for {name}"
+        assert 70 <= b <= 220, f"B={b} out of range for {name}"

meshcode-2.11.12/tests/test_init_device_code.py

@@ -0,0 +1,68 @@
+"""Tests for B6.2 — device-code OAuth flow in `meshcode init`.
+
+The full init() flow is tightly coupled to comms_v4's main() dispatch and
+has side effects (sys.exit, webbrowser, input, supabase). Rather than spin
+up subprocesses with monkey-patches that don't survive runpy re-imports,
+this module verifies the *contracts* and the small helpers — the integration
+is exercised by the live RPC handshake in production.
+"""
+import hashlib
+import platform
+
+
+def test_device_fingerprint_is_stable():
+    """Same machine -> same fingerprint across calls (init can't pair if it
+    drifts mid-session)."""
+    def _fp():
+        try:
+            hn = platform.node() or "unknown"
+            return hashlib.sha256(
+                f"{platform.system()}|{hn}|{platform.machine()}".encode()
+            ).hexdigest()[:32]
+        except Exception:
+            return hashlib.sha256(b"meshcode-anon-device").hexdigest()[:32]
+
+    a = _fp()
+    b = _fp()
+    assert a == b
+    assert len(a) == 32
+    # Hex string
+    assert all(c in "0123456789abcdef" for c in a)
+
+
+def test_init_branch_has_no_apikey_paste_prompt():
+    """Source-level invariant: comms_v4.py 'cmd == init' block must not call
+    builtins.input() for the API key (security regression sentinel)."""
+    import pathlib
+    src = pathlib.Path("meshcode/comms_v4.py").read_text()
+    init_idx = src.find('if cmd == "init":')
+    assert init_idx >= 0
+    # Find the next top-level `elif cmd ==` or `if cmd not in _NO_AUTH_CMDS`
+    end_idx = min(
+        i for i in (
+            src.find("if cmd not in _NO_AUTH_CMDS:", init_idx + 1),
+            src.find("elif cmd == ", init_idx + 1),
+        ) if i > 0
+    )
+    init_block = src[init_idx:end_idx]
+    # Must not contain input("Paste your API key") or similar paste prompts
+    paste_prompts = ['Paste your API key', 'input("  Paste']
+    for p in paste_prompts:
+        assert p not in init_block, (
+            f"init block must not contain {p!r} — B6.2 security goal "
+            "(no terminal paste of long-lived secrets)"
+        )
+
+
+def test_init_branch_calls_device_code_first():
+    """Source-level: device-code RPC must be called BEFORE legacy pairing."""
+    import pathlib
+    src = pathlib.Path("meshcode/comms_v4.py").read_text()
+    init_idx = src.find('if cmd == "init":')
+    end_idx = src.find("if cmd not in _NO_AUTH_CMDS:", init_idx)
+    init_block = src[init_idx:end_idx]
+    dc_idx = init_block.find("mc_device_code_create")
+    legacy_idx = init_block.find("mc_create_pairing_session")
+    assert dc_idx > 0, "init must call mc_device_code_create"
+    assert legacy_idx > 0, "init must keep mc_create_pairing_session fallback"
+    assert dc_idx < legacy_idx, "device-code must be tried before legacy"