meshcode 2.11.111rc1__tar.gz → 2.11.112__tar.gz

{meshcode-2.11.111rc1 → meshcode-2.11.112}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.111rc1
+Version: 2.11.112
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.111rc1 → meshcode-2.11.112}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.111rc1"
+__version__ = "2.11.112"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.111rc1 → meshcode-2.11.112}/meshcode/comms_v4.py

@@ -3816,6 +3816,18 @@ if __name__ == "__main__":
             print(f"  Already up to date ({cur}).")
             sys.exit(0)
         print(f"  Latest version:  {latest}")
+        # 8e4f93f9 (stability): `meshcode upgrade` is the FORCE escape hatch — it
+        # overwrites the env inline. Warn if live agents share it (the overwrite can
+        # drop their MCP sessions). Auto-update already DEFERS while agents are live.
+        try:
+            _live = _su._live_mcp_serves_excluding_self()
+        except Exception:
+            _live = 0
+        if _live:
+            print()
+            print(f"  WARNING: {_live} live agent serve(s) share this env. Upgrading OVERWRITES")
+            print(f"  it while they run and may drop their MCP sessions (8e4f93f9). Close those")
+            print(f"  agents first for a clean upgrade, or confirm below to force anyway.")
         print()
         try:
             confirm = input(f"  Upgrade to {latest}? [Y/n] ").strip().lower()

{meshcode-2.11.111rc1 → meshcode-2.11.112}/meshcode/hostd.py

@@ -358,105 +358,26 @@ def _validate_repo_path(rp) -> Optional[str]:
     return p
 
 
-def _spawn_agent(project: str, agent: str, headless: bool = False, repo_path=None) -> bool:
-    """Relaunch `meshcode run <project>/<agent>`.
+def _spawn_agent(project: str, agent: str, repo_path=None) -> bool:
+    """Relaunch `meshcode run <project>/<agent>` in a VISIBLE terminal window.
 
-    headless=False (default): VISIBLE terminal window. Samuel must SEE it — we
-    delegate to protocol_handler._spawn_terminal, the canonical visible spawner
-    (macOS: osascript-if-Automation-granted else `open` a .command wrapper, no TCC
-    needed; Linux/Windows: native terminals). On failure we WARN loudly and return
-    False — we NEVER silently fall back to headless when visible was asked.
+    Samuel must SEE it — we delegate to protocol_handler._spawn_terminal, the
+    canonical visible spawner (macOS: osascript-if-Automation-granted else `open`
+    a .command wrapper, no TCC needed; Linux/Windows: native terminals). On failure
+    we WARN loudly and return False — we NEVER silently fall back to a background
+    process when a window was asked for.
 
-    headless=True (Fleet Control mig404 per-agent flag): background process, NO
-    window — for fleet agents that don't need a terminal (like the qa launch).
+    HEADLESS REMOVED (task cba01de5, Ian 2026-06-05): the background/no-window spawn
+    mode caused too many lifecycle problems and is gone — agents now ALWAYS spawn
+    visible. Stop/recycle still enforce desired_state via the cmdline-discovery kill
+    sweeps below (a visible agent has a window the sweeps locate by command line).
 
     repo_path (task 24e3dd44 #4): optional per-agent repo. When set + valid, `--repo <path>` is
     appended so `meshcode run` opens there. NULL/invalid = unchanged. Inert until mc_agents.repo_path
     + the respawn RPC carry it.
     """
     target = f"{project}/{agent}"
-    bin_ = _meshcode_bin()
     repo = _validate_repo_path(repo_path)
-    if headless:
-        # background, NO terminal — UNIVERSAL macOS/Linux/Windows (task c1a6c6a8, mesh-dev specs).
-        # Clean env (a stale CLAUDECODE aborts `meshcode run`); keep crash logs in a per-agent logfile
-        # (NOT DEVNULL — we want to debug headless agents that die on boot).
-        # task 14782bb4: spawned agents DO auto-update (non-blocking) — strip any inherited
-        # NO_*UPDATE so the agent's launch runs the bg updater (the daemon launcher stays disabled).
-        # No hang: run_agent now uses the NON-blocking updater + we spawn via `python -m meshcode`
-        # (not the .exe shim) so a bg `pip install -U` can replace meshcode.exe on Windows.
-        env = {k: v for k, v in os.environ.items()
-               if k not in ("CLAUDECODE", "CLAUDE_CODE_SESSION",
-                            "MESHCODE_NO_UPDATE", "MESHCODE_NO_AUTO_UPDATE")}
-        # LAUNCH-NO-WINDOW (task 35bee961): tell run_agent it's headless so it spawns
-        # the Claude Code child with CREATE_NO_WINDOW. Without this, our DETACHED_PROCESS
-        # python parent (no console) spawns `cmd.exe /c claude.cmd` and Windows ALLOCATES
-        # A FRESH CONSOLE WINDOW for the child -> a terminal pops up despite "headless".
-        env["MESHCODE_HEADLESS"] = "1"
-        log_dir = STATE_DIR / "logs"
-        try:
-            log_dir.mkdir(parents=True, exist_ok=True)
-        except Exception:
-            pass
-        safe = f"{project}__{agent}".replace("/", "_").replace("\\", "_")
-        log_path = log_dir / f"{safe}.headless.log"
-        logf = None
-        try:
-            logf = open(log_path, "ab")
-        except Exception:
-            logf = None
-        kwargs = {
-            "stdin": subprocess.DEVNULL,
-            "stdout": (logf if logf is not None else subprocess.DEVNULL),
-            "stderr": subprocess.STDOUT,
-            "env": env,
-        }
-        if sys.platform == "win32":
-            # CREATE_NO_WINDOW (0x08000000) | DETACHED_PROCESS (0x08): no console window, fully
-            # detached from this daemon. NEVER pythonw (swallows stderr). Ensure venv Scripts +
-            # System32 on PATH (Windows PATH cap ~32k).
-            kwargs["creationflags"] = 0x08000000 | 0x00000008
-            try:
-                scripts = str(Path(sys.executable).resolve().parent)  # venv Scripts dir
-            except Exception:
-                scripts = ""
-            sysroot = os.environ.get("SystemRoot", r"C:\Windows")
-            base_path = os.pathsep.join(p for p in (scripts, sysroot + r"\System32", sysroot) if p)
-            env["PATH"] = (base_path + os.pathsep + env.get("PATH", ""))[:30000]
-        else:
-            # POSIX: detach into its own session so it survives the daemon + has no controlling tty.
-            kwargs["start_new_session"] = True
-            # RELIABILITY (commander field finding): a headless respawn died with "meshcode not on
-            # PATH" — the spawned `meshcode run` (and its `meshcode mcp` MCP child) needs the
-            # `meshcode` console script findable. Prepend sys.executable's bin dir (where the
-            # console script lives) to PATH, mirroring the win32 venv-Scripts injection above.
-            try:
-                bindir = str(Path(sys.executable).resolve().parent)
-                if bindir and bindir not in env.get("PATH", "").split(os.pathsep):
-                    env["PATH"] = bindir + os.pathsep + env.get("PATH", "")
-            except Exception:
-                pass
-        try:
-            # `python -m meshcode` (NOT the meshcode.exe shim) so the .exe isn't held open by the
-            # agent -> a background `pip install -U` can replace it on Windows (task 14782bb4 #4).
-            argv = [sys.executable, "-m", "meshcode", "run", target] + (["--repo", repo] if repo else [])
-            proc = subprocess.Popen(argv, **kwargs)
-            # LAUNCH-NO-WINDOW (task 35bee961): record the headless PID so the Stop sweep
-            # (_do_stops) can hard-kill it — a headless agent has NO window for Samuel to
-            # close, so desired_state='stopped' must be enforced by killing the process.
-            _record_headless_pid(target, proc.pid)
-            _log(f"spawned {target} HEADLESS (no window, {sys.platform}; pid={proc.pid}; log={log_path})")
-            return True
-        except Exception as e:
-            _log(f"WARN: headless spawn {target} failed: {e}")
-            return False
-        finally:
-            # child inherited its own fd; safe to drop the daemon's handle.
-            if logf is not None:
-                try:
-                    logf.close()
-                except Exception:
-                    pass
     # env hygiene (item1 RC): a stale CLAUDECODE aborts `meshcode run` (exit2). Build the terminal
     # command PER-PLATFORM (mesh-core FIX1, 0x80070002): cmd.exe uses & (NOT ';'), set "V=" to clear
     # (NOT bash unset/export), double-quotes (NOT shlex POSIX), no exec — else Windows Terminal splits
@@ -527,29 +448,37 @@ def _do_respawns(api_key: str, host_id: str) -> int:
             # do NOT re-record here (that would inflate the count on a mere rate-limit skip).
             _log(f"SKIP respawn {proj}/{agent}: not allowed (count={c.get('respawn_count')}, rate-limited/at-cap)")
             continue
-        # BOOT-AUTOSTART GATE (task b6da0d54): don't auto-launch an agent whose last heartbeat
-        # PREDATES this hostd start (or never heartbeated) — that's a boot-stale 'running' leftover
-        # from a prior session, NOT a live-then-crashed agent. Skip it (explicit launch required) so
-        # rebooting / hostd-restart does NOT pop terminals. An agent alive AFTER startup that died =
-        # crash -> falls through to respawn (crash-recovery preserved). MESHCODE_BOOT_AUTOSTART=1 opts out.
+        # BOOT-AUTOSTART GATE (task b6da0d54; signal fixed in task 8067e04c): don't auto-launch
+        # an agent whose desired_state='running' was set BEFORE this hostd started — that's a
+        # boot-stale 'running' leftover from a prior session (the "terminals pop at boot" bug),
+        # NOT an explicit launch. Skip it so rebooting / hostd-restart does NOT pop terminals.
+        #
+        # We key on spawned_at — stamped on EVERY desired_state->running transition by the trigger
+        # _mc_stamp_spawned_at (mig424) — surfaced here as an AGE (spawned_age_s, mig438). That is
+        # the EXPLICIT-LAUNCH signal: a Launch All / Start click stamps a fresh spawned_at. The
+        # previous heartbeat check was WRONG: a just-launched agent hasn't heartbeated yet
+        # (heartbeat_age_s=None), so it was skipped as a "leftover" and Launch All never spawned
+        # it (Windows regression, fis — task d7bbfecb). Comparing AGES (spawned_age_s vs hostd
+        # uptime), not timestamps, avoids DB/host clock skew.
+        #   spawned_age_s is None or >= uptime -> running set before this hostd start -> SKIP (leftover).
+        #   spawned_age_s <  uptime            -> explicit launch AFTER start         -> SPAWN.
+        # Crash-respawn preserved: an agent launched THIS session then crashed has spawned_age_s <
+        # uptime -> respawned. MESHCODE_BOOT_AUTOSTART=1 opts out (auto-launch everything, old behavior).
         if not _BOOT_AUTOSTART:
-            _hb_age = c.get("heartbeat_age_s")
+            _spawn_age = c.get("spawned_age_s")
             _hostd_uptime = time.time() - _HOSTD_STARTED_AT
-            if _hb_age is None or _hb_age >= _hostd_uptime:
-                _log(f"BOOT-AUTOSTART OFF: skip auto-respawn {proj}/{agent} (no heartbeat since hostd "
-                     f"start — boot-stale 'running' leftover; explicit launch required). "
+            if _spawn_age is None or _spawn_age >= _hostd_uptime:
+                _log(f"BOOT-AUTOSTART OFF: skip auto-respawn {proj}/{agent} (desired_state=running set "
+                     f"before this hostd start — boot-stale leftover; explicit launch required). "
                      f"Set MESHCODE_BOOT_AUTOSTART=1 to auto-launch at boot.")
                 continue
         # RECYCLE FAST-PATH (task c0fc5597): a recycle-exited agent (recycle_fast) is relaunched
         # PROMPTLY (the RPC returned it at a 15s stale gate, not STALE_SECONDS) and recorded as a
         # RECYCLE (mc_record_recycle), NEVER against the crash respawn cap.
         _is_recycle = bool(c.get("recycle_fast"))
-        # 798dd1bd: on-demand recycle with recycle_visible -> reopen a FRESH VISIBLE window
-        # (Samuel's "terminals reopen fresh"); else PRESERVE the agent's headless state
-        # (don't silently un-headless a headless fleet — backend2 A2). One-shot: mc_record_recycle
-        # clears recycle_visible so subsequent respawns use the normal headless flag.
-        _visible = _is_recycle and bool(c.get("recycle_visible"))
-        _hl = False if _visible else bool(c.get("headless"))
+        # HEADLESS REMOVED (task cba01de5): every spawn is now a VISIBLE window, so every
+        # recycle reopens a fresh terminal and must close the old one (handled below). The
+        # server-side recycle_visible / headless flags are ignored (visible is the only mode).
         # Circuit-breaker: bound spawns per target so a crash/recycle loop can
         # never storm the user's terminals (Samuel 2026-06-04). Applies to BOTH
         # paths — the recycle fast-path has no server-side cap, so this is its
@@ -614,16 +543,17 @@ def _do_respawns(api_key: str, host_id: str) -> int:
                 except Exception:
                     pass
             continue
-        # Part 2 (Samuel req #2): for a VISIBLE recycle, snapshot the OLD window
-        # pid(s) BEFORE spawning the fresh one — so the new pid is never in the
-        # close set (commander q1: never touch the fresh terminal).
-        _old_vis_pids = _discover_agent_pids(_target) if (_is_recycle and _visible) else []
+        # Part 2 (Samuel req #2): on a recycle, snapshot the OLD window pid(s) BEFORE
+        # spawning the fresh one — so the new pid is never in the close set (commander
+        # q1: never touch the fresh terminal). Every recycle is visible now (headless
+        # removed, task cba01de5), so this always runs for a recycle.
+        _old_vis_pids = _discover_agent_pids(_target) if _is_recycle else []
         _log(f"{'RECYCLE-RESPAWN' if _is_recycle else 'RESPAWN'} {proj}/{agent} "
-             f"({'VISIBLE ' if _visible else ''}stale {c.get('heartbeat_age_s')}s, count={c.get('respawn_count')})")
-        if _spawn_agent(proj, agent, headless=_hl, repo_path=c.get("repo_path")):
+             f"(stale {c.get('heartbeat_age_s')}s, count={c.get('respawn_count')})")
+        if _spawn_agent(proj, agent, repo_path=c.get("repo_path")):
             _record_spawn(_target)  # count the terminal we just opened, against the breaker
             if _is_recycle:
-                if _visible and _old_vis_pids:
+                if _old_vis_pids:
                     _close_old_visible_recycle(_target, _old_vis_pids)  # close old window (DRY-RUN first)
                 _rpc("mc_record_recycle",
                      {"p_api_key": api_key, "p_project_id": c.get("project_id"), "p_agent_name": agent})
@@ -830,24 +760,21 @@ def _record_spawn(target: str) -> None:
 
 
 # ------------------------------------------------------------------
-# Stop — hard-kill a HEADLESS agent (task 35bee961). A headless agent has no
-# window Samuel can close, so a Stop (desired_state='stopped') that the agent
-# doesn't honor cooperatively (must_exit) would otherwise run forever. We record
-# each headless spawn's PID (persisted across hostd restarts) and kill it when the
-# cloud says it should be stopped but it's still heartbeating.
+# Stop — hard-kill an agent the cloud marked stopped that won't exit cooperatively
+# (task 35bee961). A Stop (desired_state='stopped') the agent doesn't honor via
+# must_exit would otherwise run forever, so the sweeps below DISCOVER the agent's
+# process by command line (`meshcode run <target>`) and kill it.
+#
+# NOTE: headless (background, no-window) spawn was removed (task cba01de5, Ian
+# 2026-06-05) — nothing records into the `headless_pids` map any more, so the kill
+# sweeps now rely entirely on the cmdline-discovery fallback (which already handled
+# visible agents). The `headless_pids` map + _kill_headless_pid() are retained as
+# the generic recorded-PID kill path (also used by visible-recycle window close);
+# they stay EMPTY until a future feature repopulates them. Renaming/removing the
+# now-vestigial map belongs to the visible-lifecycle redesign (back-2), NOT here —
+# ripping it out would break the Stop/force-kill sweeps for visible agents.
 # ------------------------------------------------------------------
 
-def _record_headless_pid(target: str, pid: int) -> None:
-    try:
-        st = _load_state()
-        pids = st.get("headless_pids") or {}
-        pids[target] = pid          # overwrite any stale entry for this target (refresh on respawn)
-        st["headless_pids"] = pids
-        _save_state(st)
-    except Exception:
-        pass
-
-
 def _gc_headless_pids() -> None:
     """GC dead PIDs from headless_pids (cb90b058) so a stale entry can't mask a live agent +
     the recorded PID stays accurate for enforce. Cheap; runs once per sweep. Best-effort."""
@@ -1044,8 +971,10 @@ def _do_stops(api_key: str, host_id: str) -> int:
     return n
 
 
-# 38523a98 Gap 1: explicit human force-kill of VISIBLE agents. DRY-RUN first (same gate as the reaper).
-_FORCE_KILL_DRYRUN = True
+# 38523a98 Gap 1: explicit human force-kill of VISIBLE agents. ENABLED in 2.11.112 (task fa11ff48):
+# Samuel-blessed + 0 false-positives verified (backend2 pre-check + empty owner-scoped queue on our box).
+# _REAP_DRYRUN (autonomous reaper, below) stays True — SEPARATE gate, needs its own 0-FP + Samuel OK.
+_FORCE_KILL_DRYRUN = False
 
 
 def _do_force_kills(api_key: str, host_id: str) -> int:

{meshcode-2.11.111rc1 → meshcode-2.11.112}/meshcode/protocol_handler.py

@@ -153,49 +153,82 @@ def _detect_macos_terminal() -> str:
     return "terminal"
 
 
+def _launcher_label(cmd: str) -> str:
+    """Derive a stable, filesystem-safe launcher name from the spawn `cmd`.
+
+    Pulls the `meshcode run <target>` argument (project/agent) when present so
+    the launcher is human-recognisable (~/.meshcode/launchers/<agent>.command);
+    falls back to a short hash of the cmd otherwise. Slashes/odd chars are
+    collapsed to `_` so the result is always a single safe path component.
+    """
+    m = re.search(r"meshcode\s+run\s+(?:'([^']*)'|\"([^\"]*)\"|(\S+))", cmd)
+    raw = ((m.group(1) or m.group(2) or m.group(3)) if m else "") or ""
+    safe = re.sub(r"[^A-Za-z0-9_.-]", "_", raw.strip()).strip("_")
+    if not safe:
+        import hashlib
+        safe = "agent-" + hashlib.sha1(cmd.encode("utf-8")).hexdigest()[:10]
+    return safe[:80]
+
+
 def _spawn_terminal_macos(cmd: str) -> tuple[bool, str]:
     """Spawn `cmd` in a new VISIBLE Terminal/iTerm window (detached).
 
-    Primary: osascript ('do script') — opens a window in the running Terminal/iTerm
-    but REQUIRES the macOS Automation permission. If the user hasn't granted it,
-    osascript fails. Fallback: a temp .command file launched via `open`, which opens
-    a visible Terminal window WITHOUT Automation (it just opens the app with a
-    document). So the spawn is ALWAYS a visible terminal, never a silent headless
-    background process (LAUNCH-1 spawn-visible gap).
+    NATIVE `.command` + `open -a <App>` ONLY — deliberately NO osascript/AppleScript.
+
+    Why no AppleScript: driving the singleton Terminal.app via Apple Events from a
+    process that lacks Full Disk Access (e.g. the launchd-managed hostd) makes
+    macOS re-attribute Terminal.app's TCC "responsible process" to that no-FDA
+    caller, which silently strips ~/Desktop / ~/Documents access from ALL Terminal
+    windows — including ones the user opened by hand — mid-session. `open -a` goes
+    through LaunchServices (no Apple Events), so Terminal.app keeps its own TCC
+    identity and nothing gets poisoned. (back-2 Mac TCC fix, 2026-06-05.)
+
+    The launcher is a stable per-target `.command` under ~/.meshcode/launchers that
+    `cd "$HOME"` first (a NON-protected cwd) so the launching shell never dies on
+    getcwd() even without FDA, then runs the agent under the venv interpreter
+    (derived from sys.executable — no hardcoded venv name) so the user never has to
+    `source .../activate` by hand.
     """
     term = _detect_macos_terminal()
-    # AppleScript escaping: backslash + double-quote
-    safe = cmd.replace("\\", "\\\\").replace('"', '\\"')
-    if term == "iterm":
-        script = (
-            'tell application "iTerm"\n'
-            '  create window with default profile\n'
-            f'  tell current session of current window to write text "{safe}"\n'
-            'end tell\n'
-        )
-    else:
-        script = f'tell application "Terminal" to do script "{safe}"\n'
-    r = subprocess.run(["osascript", "-e", script],
+    app = "iTerm" if term == "iterm" else "Terminal"
+    # venv bin dir (…/<venv>/bin) derived from the live interpreter, NOT hardcoded,
+    # so `meshcode`/`python` resolve without a manual `source activate`. NB: do NOT
+    # .resolve() — a venv's bin/python symlinks back to the base interpreter (e.g.
+    # Homebrew's framework bin), so resolving would escape the venv. sys.executable
+    # is already the absolute venv python, so .parent is the venv bin.
+    try:
+        venv_bin = str(Path(sys.executable).parent)
+    except Exception:
+        venv_bin = ""
+    # Stable launcher path (debuggable, reused across spawns; not /tmp).
+    launch_dir = Path.home() / ".meshcode" / "launchers"
+    script_path = launch_dir / f"{_launcher_label(cmd)}.command"
+    lines = ["#!/bin/bash",
+             'cd "$HOME" 2>/dev/null || cd /']   # neutral, non-TCC-protected cwd
+    if venv_bin:
+        lines.append(f'export PATH={shlex.quote(venv_bin)}:"$PATH"')
+    lines.append(cmd)                            # ends in `exec … meshcode run …`
+    try:
+        launch_dir.mkdir(parents=True, exist_ok=True)
+        script_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+        os.chmod(script_path, 0o755)
+    except Exception as e:
+        return False, f"could not write launcher {script_path}: {e}"
+    # `open -a <App> <file>` activates the app + brings it to the FRONT (focused).
+    # NEVER bare `open <file>` / `-g`: those can open in the background → looks like
+    # "nothing happened" (same class of bug as the Windows `-w new` focus fix).
+    r = subprocess.run(["open", "-a", app, str(script_path)],
                        capture_output=True, text=True)
     if r.returncode == 0:
         return True, term
-    osa_err = (r.stderr or "osascript failed").strip()
-    # Fallback: a .command launcher opened via `open` — no Automation permission needed.
-    try:
-        import tempfile
-        fd, path = tempfile.mkstemp(suffix=".command", prefix="meshcode-launch-")
-        with os.fdopen(fd, "w") as f:
-            f.write("#!/bin/bash\n")
-            f.write(cmd + "\n")
-            f.write('rm -f "$0"\n')   # self-clean the temp launcher on exit
-        os.chmod(path, 0o755)
-        r2 = subprocess.run(["open", path], capture_output=True, text=True)
-        if r2.returncode == 0:
-            return True, "terminal(open-fallback)"
-        return False, (f"osascript failed ({osa_err}); "
-                       f"open fallback failed ({(r2.stderr or '').strip()})")
-    except Exception as e:
-        return False, f"osascript failed ({osa_err}); open fallback exception: {e}"
+    err = (r.stderr or "open failed").strip()
+    # Last-ditch: plain `open` lets LaunchServices pick the .command handler
+    # (still no AppleScript). A background window beats no window.
+    r2 = subprocess.run(["open", str(script_path)], capture_output=True, text=True)
+    if r2.returncode == 0:
+        return True, f"{term}(open-default)"
+    return False, (f"open -a {app} failed ({err}); "
+                   f"open fallback failed ({(r2.stderr or '').strip()})")
 
 
 def _spawn_terminal_linux(cmd: str) -> tuple[bool, str]:

{meshcode-2.11.111rc1 → meshcode-2.11.112}/meshcode/run_agent.py

@@ -1238,22 +1238,11 @@ def run(agent: str, project: Optional[str] = None, editor_override: Optional[str
             if use_shell:
                 print(f"[meshcode]   (Windows: launching via shell for .cmd wrapper)")
             launch_cwd = str(ws) if os.path.isdir(ws) else None
-            # LAUNCH-NO-WINDOW (task 35bee961): when hostd spawned us HEADLESS, our parent
-            # python has NO console (DETACHED_PROCESS|CREATE_NO_WINDOW). Spawning the Claude
-            # child here WITHOUT CREATE_NO_WINDOW makes Windows allocate a FRESH console
-            # window for it -> a terminal pops up despite "headless". Pass CREATE_NO_WINDOW so
-            # the child stays windowless too. Detect headless via the env flag hostd sets, OR
-            # by having no console of our own (GetConsoleWindow()==0) as a belt-and-suspenders.
+            # HEADLESS REMOVED (task cba01de5, Ian 2026-06-05): hostd no longer spawns us in a
+            # background/no-window mode, so the Claude child always runs inside our visible
+            # console — no CREATE_NO_WINDOW. (Previously MESHCODE_HEADLESS / GetConsoleWindow()==0
+            # forced a windowless child; that belongs to the headless feature, now gone.)
             _kwargs = {"shell": use_shell, "cwd": launch_cwd}
-            _headless = os.environ.get("MESHCODE_HEADLESS", "").lower() in ("1", "true", "yes")
-            if not _headless:
-                try:
-                    import ctypes as _ct
-                    _headless = _ct.windll.kernel32.GetConsoleWindow() == 0
-                except Exception:
-                    _headless = False
-            if _headless:
-                _kwargs["creationflags"] = 0x08000000  # CREATE_NO_WINDOW
             result = _sp.run(cmd, **_kwargs)
             sys.exit(result.returncode)
         else:

{meshcode-2.11.111rc1 → meshcode-2.11.112}/meshcode/self_update.py

@@ -325,6 +325,10 @@ def _spawn_background_updater(target_version: str, target_python: Optional[str]
     exits. Next `meshcode run` consumes the result. `target_python` (when set)
     is the agent's MCP-server env — pip installs into IT, not the launcher.
     """
+    # 8e4f93f9 (stability): never overwrite a shared site-packages while live
+    # agents import it (would clobber their MCP). Defer to a quiescent launch.
+    if _live_mcp_serves_excluding_self() != 0:
+        return False
     if not _acquire_lock():
         return False
 
@@ -371,6 +375,36 @@ def _spawn_background_updater(target_version: str, target_python: Optional[str]
         return False
 
 
+# ============================================================
+# 8e4f93f9 (Samuel #1 STABILITY): co-resident guard
+# ============================================================
+
+def _live_mcp_serves_excluding_self() -> int:
+    """Count live `meshcode_mcp serve` processes other than self/parent.
+
+    8e4f93f9 RC: an inline/background `pip install -U meshcode` OVERWRITES the
+    shared site-packages that co-resident LIVE agents are importing → clobbers
+    their MCP (the ~1h drop). Windows is immune (file-lock makes the overwrite
+    fail). We mirror that on POSIX by DEFERRING the overwrite while ANY serve is
+    live; the update applies on a future quiescent launch (`meshcode update`
+    forces it). FAIL-SAFE: on any error return 1 ("assume busy → defer") so we
+    NEVER overwrite a live env under uncertainty.
+    """
+    if sys.platform == "win32":
+        return 0  # Windows file-locks already prevent a live overwrite
+    try:
+        out = subprocess.run(
+            ["pgrep", "-f", "meshcode_mcp serve"],
+            capture_output=True, text=True, timeout=5,
+        ).stdout
+        pids = {int(x) for x in out.split() if x.strip().isdigit()}
+        pids.discard(os.getpid())
+        pids.discard(os.getppid())
+        return len(pids)
+    except Exception:
+        return 1  # fail-safe: assume busy, defer (never clobber under uncertainty)
+
+
 # ============================================================
 # Public entrypoint — called from meshcode run
 # ============================================================
@@ -466,7 +500,7 @@ def sync_agent_env(mcp_python: str, verbose: bool = False) -> None:
 # subprocess inherits the latest meshcode_mcp/server.py on disk.
 # ============================================================
 
-def check_and_maybe_update_blocking(verbose: bool = True, timeout_sec: int = 60) -> Optional[str]:
+def check_and_maybe_update_blocking(verbose: bool = True, timeout_sec: int = 60, force: bool = False) -> Optional[str]:
     """Blocking pip install -U meshcode. Returns the new version, or None.
 
     Same skip-gates as check_and_maybe_update() EXCEPT the `auto_update`
@@ -508,6 +542,24 @@ def check_and_maybe_update_blocking(verbose: bool = True, timeout_sec: int = 60)
             pass
         return None
 
+    # 8e4f93f9 (Samuel #1 STABILITY): on POSIX an inline `pip install -U` would
+    # OVERWRITE the shared site-packages that co-resident LIVE agents are importing
+    # → clobbers their MCP (the ~1h drop RC). Mirror Windows' file-lock immunity:
+    # if ANY other meshcode_mcp serve is live, DEFER — the update lands on a future
+    # QUIESCENT launch. `meshcode update` (force=True) overrides for an intentional,
+    # operator-initiated upgrade.
+    if not force:
+        _live = _live_mcp_serves_excluding_self()
+        if _live != 0:
+            if verbose:
+                print(
+                    f"[meshcode] {_live} live agent serve(s) share this env — deferring "
+                    f"update to a clean launch (run `meshcode update` to force). "
+                    f"Staying on meshcode {_current_version()}.",
+                    file=sys.stderr,
+                )
+            return None
+
     cur = _current_version()
     latest = fetch_latest_version()
     _mark_checked(latest)

{meshcode-2.11.111rc1 → meshcode-2.11.112}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.111rc1
+Version: 2.11.112
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.111rc1 → meshcode-2.11.112}/meshcode.egg-info/SOURCES.txt

@@ -2,14 +2,10 @@ README.md
 pyproject.toml
 meshcode/__init__.py
 meshcode/__main__.py
-meshcode/_session_handoff_template 2.py
-meshcode/_session_handoff_template 3.py
 meshcode/_session_handoff_template.py
 meshcode/_stop_hook_template.py
 meshcode/ascii_art.py
 meshcode/atomic_push.py
-meshcode/claude_update 2.py
-meshcode/claude_update 3.py
 meshcode/claude_update.py
 meshcode/cli.py
 meshcode/comms_v4.py
@@ -19,7 +15,6 @@ meshcode/date_parse.py
 meshcode/doctor.py
 meshcode/error_hints.py
 meshcode/exceptions.py
-meshcode/hostd 2.py
 meshcode/hostd.py
 meshcode/invites.py
 meshcode/launcher.py
@@ -34,7 +29,6 @@ meshcode/secrets.py
 meshcode/self_update.py
 meshcode/setup_clients.py
 meshcode/supervisor.py
-meshcode/up 2.py
 meshcode/up.py
 meshcode/upload.py
 meshcode.egg-info/PKG-INFO
@@ -63,8 +57,6 @@ tests/test_auto_update_hardening.py
 tests/test_autonomous_closegap_1.py
 tests/test_autonomous_closegap_2.py
 tests/test_autonomous_closegap_3.py
-tests/test_autonomous_prompt_inject 2.py
-tests/test_autonomous_prompt_inject 3.py
 tests/test_autonomous_prompt_inject.py
 tests/test_boot_bug_regression.py
 tests/test_color_truecolor.py

{meshcode-2.11.111rc1 → meshcode-2.11.112}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.111rc1"
+version = "2.11.112"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}