meshcode 2.11.11__tar.gz → 2.11.12__tar.gz

{meshcode-2.11.11 → meshcode-2.11.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.11
+Version: 2.11.12
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.11 → meshcode-2.11.12}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.11"
+__version__ = "2.11.12"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.11 → meshcode-2.11.12}/meshcode/comms_v4.py

@@ -2777,26 +2777,108 @@ if __name__ == "__main__":
             sys.exit(1)
         print()
 
-        # B3: wrap pairing RPC so SSL / network errors abort cleanly (no
-        # silent fall-through to API-key paste — friction #7).
+        # B3: wrap any pairing RPC so SSL / network errors abort cleanly with
+        # an actionable message (no silent fall-through, friction #7).
+        def _pairing_rpc(fn, args):
+            try:
+                return sb_rpc(fn, args)
+            except Exception as _e:
+                _msg = str(_e).lower()
+                if "certificate" in _msg or "ssl" in _msg:
+                    print()
+                    print("  [meshcode] SSL certificate verification failed.")
+                    print("  [meshcode] This usually means your Python install is missing root certs.")
+                    _v = sys.version_info
+                    print(f"  [meshcode] Fix: run /Applications/Python\\ {_v.major}.{_v.minor}/Install\\ Certificates.command")
+                    print(f"  [meshcode] (Replace {_v.major}.{_v.minor} with your actual installed version.)")
+                    print(f"  [meshcode] Alternative: pip install --upgrade certifi")
+                else:
+                    print()
+                    print(f"  [meshcode] Pairing service unreachable: {_e}")
+                    print(f"  [meshcode] Check your network, then re-run `meshcode init`.")
+                sys.exit(1)
+
+        # B6.2 device-code OAuth (preferred): generates a code, opens browser
+        # to /auth/device?code=…, user clicks Approve, CLI receives a scoped
+        # token. Token is per-device, revocable from dashboard. Replaces the
+        # legacy api-key paste path (which left long-lived secrets in
+        # terminal history — Samuel friction).
+        import hashlib as _hashlib
+        import platform as _platform
         try:
-            pairing = sb_rpc("mc_create_pairing_session", {})
-        except Exception as _init_e:
-            _msg = str(_init_e).lower()
-            if "certificate" in _msg or "ssl" in _msg:
+            _hn = _platform.node() or "unknown"
+            _device_fp = _hashlib.sha256(
+                f"{_platform.system()}|{_hn}|{_platform.machine()}".encode()
+            ).hexdigest()[:32]
+        except Exception:
+            _device_fp = _hashlib.sha256(b"meshcode-anon-device").hexdigest()[:32]
+        _device_name = f"{_platform.node() or 'device'} ({_platform.system()})"
+
+        b6_resp = _pairing_rpc("mc_device_code_create", {
+            "p_device_fingerprint": _device_fp,
+            "p_device_name": _device_name,
+        })
+        if isinstance(b6_resp, dict) and b6_resp.get("ok") and b6_resp.get("code"):
+            code = b6_resp["code"]
+            expires_in = int(b6_resp.get("expires_in_s") or 600)
+            url = f"https://meshcode.io/auth/device?code={code}"
+            print(f"  Step 1: Confirm the code in your browser:")
+            print()
+            print(f"      ┌─────────────────┐")
+            print(f"      │   {code:^11}   │")
+            print(f"      └─────────────────┘")
+            print()
+            print(f"  Opening {url} ...")
+            print(f"  (If browser doesn't open: visit https://meshcode.io/auth/device)")
+            print()
+            try:
+                webbrowser.open(url)
+            except Exception:
+                pass
+            print("  Waiting for approval", end="", flush=True)
+            token = None
+            deadline = _t.time() + expires_in
+            last_status = "pending"
+            while _t.time() < deadline:
+                _t.sleep(2)
+                print(".", end="", flush=True)
+                poll = _pairing_rpc("mc_device_code_poll", {
+                    "p_code": code,
+                    "p_device_fingerprint": _device_fp,
+                })
+                if not (isinstance(poll, dict)):
+                    continue
+                if poll.get("status") == "approved" and poll.get("token"):
+                    token = poll["token"]
+                    break
+                if poll.get("status") in ("expired", "consumed", "rejected") or poll.get("error") not in (None, "rate_limited"):
+                    last_status = poll.get("status") or poll.get("error")
+                    break
+            print()
+            if token:
+                login(token)
                 print()
-                print("  [meshcode] SSL certificate verification failed.")
-                print("  [meshcode] This usually means your Python install is missing root certs.")
-                _v = sys.version_info
-                print(f"  [meshcode] Fix: run /Applications/Python\\ {_v.major}.{_v.minor}/Install\\ Certificates.command")
-                print(f"  [meshcode] (Replace {_v.major}.{_v.minor} with your actual installed version.)")
-                print(f"  [meshcode] Alternative: pip install --upgrade certifi")
-            else:
+                print("  ✓ Paired successfully — device added to your account.")
+                print("  Step 2: Create your first meshwork")
+                print("  Run: meshcode go <agent-name> --project <meshwork-name>")
                 print()
-                print(f"  [meshcode] Pairing service unreachable: {_init_e}")
-                print(f"  [meshcode] Check your network, then re-run `meshcode init`.")
+                print("  Example:")
+                print("    meshcode go backend --project my-app")
+                print()
+                sys.exit(0)
+            print()
+            print(f"  Pairing did not complete ({last_status}). Re-run: meshcode init")
             sys.exit(1)
-        if pairing and isinstance(pairing, dict) and pairing.get("ok"):
+
+        # Legacy fallback: if mc_device_code_create returned a function-not-found
+        # error (B6.1 mig 326 not yet applied on this Supabase project), drop
+        # back to the older mc_create_pairing_session flow. Manual API-key paste
+        # has been retired (security — friction #6).
+        _legacy_b6_err = ""
+        if isinstance(b6_resp, dict):
+            _legacy_b6_err = str(b6_resp.get("error") or "")
+        pairing = _pairing_rpc("mc_create_pairing_session", {})
+        if isinstance(pairing, dict) and pairing.get("ok"):
             session_id = pairing["session_id"]
             code = pairing["code"]
             url = pairing["url"]
@@ -2811,11 +2893,11 @@ if __name__ == "__main__":
                 pass
             print("  Waiting for approval", end="", flush=True)
             api_key = None
-            for _ in range(150):  # 150 * 2s = 5 minutes
+            for _ in range(150):
                 _t.sleep(2)
                 print(".", end="", flush=True)
-                poll = sb_rpc("mc_poll_pairing_session", {"p_session_id": session_id})
-                if poll and isinstance(poll, dict):
+                poll = _pairing_rpc("mc_poll_pairing_session", {"p_session_id": session_id})
+                if isinstance(poll, dict):
                     if poll.get("status") == "approved" and poll.get("api_key"):
                         api_key = poll["api_key"]
                         break
@@ -2823,46 +2905,22 @@ if __name__ == "__main__":
                         break
             print()
             if api_key:
-                print()
                 login(api_key)
                 print()
                 print("  Step 2: Create your first meshwork")
                 print("  Run: meshcode go <agent-name> --project <meshwork-name>")
                 print()
-                print("  Example:")
-                print("    meshcode go backend --project my-app")
-                print()
                 sys.exit(0)
-            else:
-                print("  Pairing timed out or was not approved.")
-                print()
-
-        # Fallback: manual API key paste
-        print("  Step 1: Create your account at meshcode.io")
-        try:
-            webbrowser.open("https://meshcode.io")
-        except Exception:
-            print("  Visit: https://meshcode.io")
-        print("  Step 2: Copy your API key from Settings")
-        print()
-        try:
-            api_key = input("  Paste your API key (mc_...): ").strip()
-        except (EOFError, KeyboardInterrupt):
-            api_key = ""
-            print()
-        if api_key:
-            login(api_key)
-            print()
-            print("  Step 3: Create your first meshwork")
-            print("  Run: meshcode go <agent-name> --project <meshwork-name>")
             print()
-            print("  Example:")
-            print("    meshcode go backend --project my-app")
-            print()
-        else:
-            print("  [meshcode] No API key provided. Run: meshcode login <api_key>")
+            print(f"  Pairing did not complete. Re-run: meshcode init")
             sys.exit(1)
-        sys.exit(0)
+
+        # Both paths failed.
+        print()
+        print(f"  [meshcode] Pairing unavailable: device-code ({_legacy_b6_err or 'unknown'}); "
+              f"legacy pairing ({pairing.get('error') if isinstance(pairing, dict) else 'unknown'}).")
+        print(f"  [meshcode] Re-run `meshcode init` later or contact support.")
+        sys.exit(1)
 
     # Auth guard: commands that talk to Supabase need a valid API key.
     # doctor, help, version, login, prefs, launcher don't need auth.

{meshcode-2.11.11 → meshcode-2.11.12}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.11
+Version: 2.11.12
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.11 → meshcode-2.11.12}/meshcode.egg-info/SOURCES.txt

@@ -204,6 +204,7 @@ tests/test_epistemic_v1_python_sdk.py
 tests/test_epistemic_v1_stop_conditions.py
 tests/test_esc_deaf_state.py
 tests/test_exceptions.py
+tests/test_init_device_code.py
 tests/test_install_guard.py
 tests/test_lease_sigterm_release.py
 tests/test_mark_read_batch.py

{meshcode-2.11.11 → meshcode-2.11.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.11"
+version = "2.11.12"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}

meshcode-2.11.12/tests/test_init_device_code.py

@@ -0,0 +1,68 @@
+"""Tests for B6.2 — device-code OAuth flow in `meshcode init`.
+
+The full init() flow is tightly coupled to comms_v4's main() dispatch and
+has side effects (sys.exit, webbrowser, input, supabase). Rather than spin
+up subprocesses with monkey-patches that don't survive runpy re-imports,
+this module verifies the *contracts* and the small helpers — the integration
+is exercised by the live RPC handshake in production.
+"""
+import hashlib
+import platform
+
+
+def test_device_fingerprint_is_stable():
+    """Same machine -> same fingerprint across calls (init can't pair if it
+    drifts mid-session)."""
+    def _fp():
+        try:
+            hn = platform.node() or "unknown"
+            return hashlib.sha256(
+                f"{platform.system()}|{hn}|{platform.machine()}".encode()
+            ).hexdigest()[:32]
+        except Exception:
+            return hashlib.sha256(b"meshcode-anon-device").hexdigest()[:32]
+
+    a = _fp()
+    b = _fp()
+    assert a == b
+    assert len(a) == 32
+    # Hex string
+    assert all(c in "0123456789abcdef" for c in a)
+
+
+def test_init_branch_has_no_apikey_paste_prompt():
+    """Source-level invariant: comms_v4.py 'cmd == init' block must not call
+    builtins.input() for the API key (security regression sentinel)."""
+    import pathlib
+    src = pathlib.Path("meshcode/comms_v4.py").read_text()
+    init_idx = src.find('if cmd == "init":')
+    assert init_idx >= 0
+    # Find the next top-level `elif cmd ==` or `if cmd not in _NO_AUTH_CMDS`
+    end_idx = min(
+        i for i in (
+            src.find("if cmd not in _NO_AUTH_CMDS:", init_idx + 1),
+            src.find("elif cmd == ", init_idx + 1),
+        ) if i > 0
+    )
+    init_block = src[init_idx:end_idx]
+    # Must not contain input("Paste your API key") or similar paste prompts
+    paste_prompts = ['Paste your API key', 'input("  Paste']
+    for p in paste_prompts:
+        assert p not in init_block, (
+            f"init block must not contain {p!r} — B6.2 security goal "
+            "(no terminal paste of long-lived secrets)"
+        )
+
+
+def test_init_branch_calls_device_code_first():
+    """Source-level: device-code RPC must be called BEFORE legacy pairing."""
+    import pathlib
+    src = pathlib.Path("meshcode/comms_v4.py").read_text()
+    init_idx = src.find('if cmd == "init":')
+    end_idx = src.find("if cmd not in _NO_AUTH_CMDS:", init_idx)
+    init_block = src[init_idx:end_idx]
+    dc_idx = init_block.find("mc_device_code_create")
+    legacy_idx = init_block.find("mc_create_pairing_session")
+    assert dc_idx > 0, "init must call mc_device_code_create"
+    assert legacy_idx > 0, "init must keep mc_create_pairing_session fallback"
+    assert dc_idx < legacy_idx, "device-code must be tried before legacy"