meshcode 2.11.112__tar.gz → 2.11.113__tar.gz

{meshcode-2.11.112 → meshcode-2.11.113}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.112
+Version: 2.11.113
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.112 → meshcode-2.11.113}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.112"
+__version__ = "2.11.113"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.112 → meshcode-2.11.113}/meshcode/protocol_handler.py

@@ -207,7 +207,40 @@ def _spawn_terminal_macos(cmd: str) -> tuple[bool, str]:
              'cd "$HOME" 2>/dev/null || cd /']   # neutral, non-TCC-protected cwd
     if venv_bin:
         lines.append(f'export PATH={shlex.quote(venv_bin)}:"$PATH"')
-    lines.append(cmd)                            # ends in `exec … meshcode run …`
+    # RECYCLE-KILL-OLD-TERMINAL (task 2094ff3d, Samuel "que se cierre la terminal
+    # pasada"). A recycle/stop ends the agent cleanly but macOS Terminal leaves the
+    # window open as "[Process completed]" — an orphan. Run the agent WITHOUT `exec`
+    # so bash survives its exit and can close THIS window. `cmd` ends in
+    # `exec … meshcode run …`; strip the leading `exec ` so the agent runs as a child
+    # (it still execvp's claude internally — that becomes the window's foreground proc).
+    lines.append('MC_TTY="$(tty 2>/dev/null)"')
+    # `cmd` is a compound line (`unset …; export PATH=…; exec <py> -m meshcode run …`),
+    # so the `exec` is NOT leading. Drop the LAST `exec ` token (the one before the
+    # interpreter) so the agent runs as a CHILD and bash survives to close the window.
+    if "exec " in cmd:
+        _head, _, _tail = cmd.rpartition("exec ")
+        _run = _head + _tail
+    else:
+        _run = cmd
+    lines.append(_run)
+    lines.append('MC_RC=$?')
+    # Close THIS Terminal window ONLY on a clean exit (recycle/stop => 0). On a CRASH
+    # (non-zero) leave it OPEN so the scrollback is available for debugging (commander
+    # condition: debugging > clean window). The own-$MC_TTY filter closes ONLY this
+    # window — never another agent's. saving no => no "close?" prompt. macOS-only path.
+    lines.append('if [ "$MC_RC" = "0" ] && [ -n "$MC_TTY" ]; then')
+    lines.append(
+        "  /usr/bin/osascript"
+        " -e 'tell application \"Terminal\"'"
+        " -e 'repeat with w in windows'"
+        " -e 'try'"
+        " -e \"if (tty of selected tab of w) is \\\"$MC_TTY\\\" then\""
+        " -e 'close w saving no'"
+        " -e 'end if'"
+        " -e 'end try'"
+        " -e 'end repeat'"
+        " -e 'end tell' >/dev/null 2>&1")
+    lines.append('fi')
     try:
         launch_dir.mkdir(parents=True, exist_ok=True)
         script_path.write_text("\n".join(lines) + "\n", encoding="utf-8")

{meshcode-2.11.112 → meshcode-2.11.113}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.112
+Version: 2.11.113
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.112 → meshcode-2.11.113}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.112"
+version = "2.11.113"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}

{meshcode-2.11.112 → meshcode-2.11.113}/tests/test_security_regressions.py

@@ -169,3 +169,60 @@ class TestRLSPoliciesExist:
     def test_mc_api_keys_has_rls(self):
         all_sql = _read_all_migrations()
         assert "mc_api_keys ENABLE ROW LEVEL SECURITY" in all_sql
+
+
+class TestP1_4_LaunchBatchAgentNameRCE:
+    """P1-4: cmd_launch_batch interpolates the agent name into the platform launch
+    string (Windows `cmd /k`, POSIX shell). The name MUST be allowlisted + hard-
+    rejected at the loop boundary BEFORE it reaches the shell, or a crafted name like
+    `x" & calc & "` breaks out of the quoting and executes arbitrary code (and a leading
+    `-` could be read as a flag / a 300-char name is a DoS). Landed v2.11.109; these
+    tests lock the allowlist + its wiring so the fix can't silently regress."""
+
+    # Real RCE / arg-injection / DoS payloads that MUST be rejected.
+    MALICIOUS = [
+        'x"&calc',            # cmd.exe quote-break + chain
+        'x" & calc & "',      # the canonical P1-4 payload
+        ';rm -rf',            # POSIX command chain
+        '$(id)',              # POSIX command substitution
+        '`id`',               # POSIX backtick substitution
+        '|nc',                # pipe to netcat
+        '&& curl evil',       # chain
+        'a b',                # whitespace (token split)
+        '-rf',                # leading dash -> flag/arg injection
+        '--version',          # leading dashes -> flag injection
+        'a' * 65,             # length cap (DoS via 300-char names)
+        '',                   # empty
+        'x\n',                # trailing newline (\Z anchor, not $)
+        '../etc',             # path traversal chars
+    ]
+    # Plain, real agent identifiers that MUST be allowed (no false-rejects).
+    LEGIT = ['back', 'qa', 'front-2', 'mesh_dev', 'commander', 'a', 'Agent_1', 'x' * 64]
+
+    def test_allowlist_blocks_malicious_names(self):
+        from meshcode.protocol_handler import is_valid_agent_name
+        for payload in self.MALICIOUS:
+            assert not is_valid_agent_name(payload), \
+                f"SECURITY: malicious agent name was NOT rejected: {payload!r}"
+
+    def test_allowlist_allows_legit_names(self):
+        from meshcode.protocol_handler import is_valid_agent_name
+        for name in self.LEGIT:
+            assert is_valid_agent_name(name), \
+                f"REGRESSION: legitimate agent name was wrongly rejected: {name!r}"
+
+    def test_cmd_launch_batch_validates_before_shell(self):
+        """Wiring guard: cmd_launch_batch MUST call is_valid_agent_name BEFORE it
+        builds the `... run "<name>"` shell string — else the allowlist exists but
+        isn't enforced. Catches a removed/moved call site, not just a missing regex."""
+        src = (Path(__file__).parent.parent / "meshcode" / "protocol_handler.py").read_text()
+        start = src.index("def cmd_launch_batch")
+        body = src[start:src.find("\ndef ", start + 1)]
+        assert "is_valid_agent_name" in body, \
+            "SECURITY: cmd_launch_batch does not call is_valid_agent_name at all"
+        # The validation must come BEFORE the name is interpolated into the launch cmd.
+        guard_pos = body.index("is_valid_agent_name")
+        sink = re.search(r'run\s+"?\{name\}|run\s+\{shlex\.quote\(name\)', body)
+        assert sink is not None, "cmd_launch_batch shell-interpolation sink not found (test stale?)"
+        assert guard_pos < sink.start(), \
+            "SECURITY: is_valid_agent_name is checked AFTER the shell interpolation — RCE boundary broken"