meshcode 2.11.127__tar.gz → 2.11.128__tar.gz

{meshcode-2.11.127 → meshcode-2.11.128}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.127
+Version: 2.11.128
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.127 → meshcode-2.11.128}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.127"
+__version__ = "2.11.128"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.127 → meshcode-2.11.128}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.127
+Version: 2.11.128
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.127 → meshcode-2.11.128}/meshcode.egg-info/SOURCES.txt

@@ -74,6 +74,7 @@ tests/test_file_upload.py
 tests/test_init_device_code.py
 tests/test_install_guard.py
 tests/test_lease_sigterm_release.py
+tests/test_live_mesh_guard.py
 tests/test_mark_read_batch.py
 tests/test_marketplace_ratings.py
 tests/test_migration_integrity.py

{meshcode-2.11.127 → meshcode-2.11.128}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.127"
+version = "2.11.128"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}
@@ -45,6 +45,14 @@ Repository = "https://github.com/rf2f7f7sg4-dev/meshcode"
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 addopts = "--durations=10 --durations-min=0.5 -v --tb=short"
+markers = [
+    # live_mesh: the test talks to the REAL Supabase backend (registers agents,
+    # sends messages, reads the live roster). Opt-in via MESHCODE_TEST_PROJECT;
+    # CI/smoke must deselect with: -m "not live_mesh"
+    # (incident 2026-06-10: suite runs leaked 30 fixture agents into the live
+    # mesh-dev roster on Ian's dashboard).
+    "live_mesh: hits the real Supabase backend/live mesh; opt-in, deselect with -m 'not live_mesh'",
+]
 
 [tool.setuptools.packages.find]
 include = ["meshcode", "meshcode.*"]

{meshcode-2.11.127 → meshcode-2.11.128}/tests/test_boot_bug_regression.py

@@ -131,6 +131,7 @@ def test_module_import_rpc_allowlist():
     )
 
 
+@pytest.mark.live_mesh
 def test_register_all_valid_statuses_live():
     """RC #1 sentinel — mig 312. Catches SDK↔DDL enum drift like the
     'needs_launch' incident.

{meshcode-2.11.127 → meshcode-2.11.128}/tests/test_cross_agent_messaging.py

@@ -21,6 +21,14 @@ import time
 import unittest
 from pathlib import Path
 
+import pytest
+
+# These tests register agents and send messages on the REAL backend — every
+# run is visible on the owner's dashboard. Opt-in only (incident 2026-06-10:
+# fixture agents leaked into the live mesh-dev roster). Deselect in CI/smoke
+# with: -m "not live_mesh"
+pytestmark = pytest.mark.live_mesh
+
 # Add SDK to path
 SDK_PATH = Path(__file__).parent.parent / "meshcode" / "meshcode_mcp"
 if SDK_PATH.exists():
@@ -39,7 +47,10 @@ from meshcode.meshcode_mcp import backend as be
 # Agents are cleaned up in tearDown. No project creation needed.
 #
 
-TEST_PROJECT = os.environ.get("MESHCODE_TEST_PROJECT", "mesh-dev")
+# NEVER default to a live mesh. Unset MESHCODE_TEST_PROJECT = SKIP everything:
+# the old default ("mesh-dev") put every fixture agent and broadcast of this
+# suite straight onto the production dashboard (incident 2026-06-10).
+TEST_PROJECT = os.environ.get("MESHCODE_TEST_PROJECT")
 AGENT_A = f"e2e-alice-{int(time.time()) % 10000}"
 AGENT_B = f"e2e-bob-{int(time.time()) % 10000}"
 AGENT_C = f"e2e-carol-{int(time.time()) % 10000}"
@@ -61,6 +72,10 @@ def _get_api_key():
 API_KEY = _get_api_key()
 
 
+@unittest.skipUnless(
+    TEST_PROJECT,
+    "MESHCODE_TEST_PROJECT not set — live-mesh e2e tests are opt-in and must "
+    "point at a dedicated test meshwork, never a live one (incident 2026-06-10)")
 class CrossAgentMessagingTests(unittest.TestCase):
     """E2E tests for cross-agent message delivery."""
 
@@ -106,16 +121,25 @@ class CrossAgentMessagingTests(unittest.TestCase):
 
     @classmethod
     def tearDownClass(cls):
-        """Cleanup: unregister ephemeral test agents."""
+        """Cleanup: unregister ephemeral test agents. LOUD on failure — the old
+        except:pass (plus never checking sb_rpc's returned error dict) let a
+        404 on mc_unregister_agent leak fixture agents into the roster forever
+        (incident 2026-06-10)."""
+        failures = []
         for agent in [AGENT_A, AGENT_B, AGENT_C]:
-            try:
-                be.sb_rpc("mc_unregister_agent", {
-                    "p_api_key": API_KEY,
-                    "p_project_id": cls.project_id,
-                    "p_agent_name": agent,
-                })
-            except Exception:
-                pass
+            result = be.sb_rpc("mc_unregister_agent", {
+                "p_api_key": API_KEY,
+                "p_project_id": cls.project_id,
+                "p_agent_name": agent,
+            })
+            # sb_rpc reports errors as a return VALUE, not an exception.
+            if isinstance(result, dict) and (result.get("error") or result.get("_error")):
+                failures.append(f"{agent}: {result}")
+        if failures:
+            raise AssertionError(
+                "tearDown could not unregister test agents — they are now "
+                f"ORPHANED in '{TEST_PROJECT}' and must be removed by hand:\n  "
+                + "\n  ".join(failures))
         print(f"\n  Cleaned up test agents from {TEST_PROJECT}")
 
     # ── Basic Delivery ─────────────────────────────────────────────────────

{meshcode-2.11.127 → meshcode-2.11.128}/tests/test_epistemic_v1_stop_conditions.py

@@ -33,6 +33,7 @@ def _live_or_skip():
         pytest.skip("MESHCODE_SUPABASE_URL not set; epistemic V1 health is live-only.")
 
 
+@pytest.mark.live_mesh
 def test_epistemic_v1_health_all_conditions_healthy():
     """Live check: call mc_epistemic_v1_health() and assert each is_healthy."""
     _live_or_skip()

{meshcode-2.11.127 → meshcode-2.11.128}/tests/test_esc_deaf_state.py

@@ -20,6 +20,8 @@ import os
 import sys
 import time
 import unittest
+
+import pytest
 from pathlib import Path
 from unittest.mock import patch, MagicMock, AsyncMock
 
@@ -196,8 +198,12 @@ class TestCircuitBreakerAfterCancel(unittest.TestCase):
         # Not a hard failure — pool may recover via other means
 
 
+@pytest.mark.live_mesh
 class TestBackendOperationsAfterCancel(unittest.TestCase):
-    """Test that backend send/read work after simulated interrupt state."""
+    """Test that backend send/read work after simulated interrupt state.
+
+    live_mesh: test_06 reads count_pending against the REAL backend with the
+    keyring credential (read-only, but still a live-DB dependency)."""
 
     def test_06_send_message_after_cb_reset(self):
         """send_message should work even if circuit breaker was previously open."""

meshcode-2.11.128/tests/test_live_mesh_guard.py

@@ -0,0 +1,100 @@
+"""
+Live-Mesh Guard Regression Tests
+=================================
+Enforces the suite-wide rules from incident 2026-06-10 (30 fixture agents +
+broadcast/impersonation spam leaked into the LIVE mesh-dev roster on the
+owner's dashboard because e2e tests defaulted TEST_PROJECT to "mesh-dev" and
+their teardown swallowed a 404 on a nonexistent RPC):
+
+  1. No test may DEFAULT its target project to a live mesh — the project must
+     come from MESHCODE_TEST_PROJECT with no fallback value.
+  2. Any test file that registers agents on the real backend must carry the
+     `live_mesh` pytest marker so CI/smoke can deselect with -m "not live_mesh".
+  3. mc_unregister_agent teardowns must CHECK the sb_rpc result (errors come
+     back as a return value, not an exception) — no silent leaks.
+  4. The live_mesh marker stays registered in pyproject.toml.
+
+Source-parsing only (pattern of test_security_regressions.py) — no DB needed.
+
+Usage:
+    pytest tests/test_live_mesh_guard.py -v
+"""
+
+import re
+from pathlib import Path
+
+TESTS_DIR = Path(__file__).parent
+PYPROJECT = TESTS_DIR.parent / "pyproject.toml"
+THIS_FILE = Path(__file__).name
+
+
+def _test_sources():
+    for f in sorted(TESTS_DIR.glob("test_*.py")):
+        if f.name == THIS_FILE:
+            continue
+        yield f.name, f.read_text(errors="replace")
+
+
+def _code_lines(src: str):
+    """Lines with #-comments stripped (docstring prose is still included, so
+    the patterns below target call/assignment syntax, not bare words)."""
+    return [ln.split("#", 1)[0] for ln in src.splitlines()]
+
+
+class TestNoLiveMeshDefaults:
+    def test_no_default_value_for_test_project_env(self):
+        """os.environ.get("MESHCODE_TEST_PROJECT", <default>) is forbidden —
+        unset must mean SKIP, never a fallback mesh."""
+        rx = re.compile(r"""MESHCODE_TEST_PROJECT['"]\s*,""")
+        offenders = [name for name, src in _test_sources()
+                     for ln in _code_lines(src) if rx.search(ln)]
+        assert not offenders, (
+            f"MESHCODE_TEST_PROJECT must have NO default value (incident "
+            f"2026-06-10) — offenders: {offenders}")
+
+    def test_no_hardcoded_live_project_assignment(self):
+        """A module-level <X>PROJECT = "mesh-dev" (or any literal) hardcodes a
+        live mesh as the test target."""
+        rx = re.compile(r"""^\s*\w*PROJECT\s*=\s*['"][a-zA-Z]""")
+        offenders = [name for name, src in _test_sources()
+                     for ln in _code_lines(src) if rx.search(ln)]
+        assert not offenders, (
+            f"Test project names must come from MESHCODE_TEST_PROJECT, never "
+            f"a literal — offenders: {offenders}")
+
+
+class TestLiveMeshMarker:
+    def test_agent_registering_files_carry_marker(self):
+        """Every file that calls mc_register_agent against the real backend
+        (i.e. without mocking sb_rpc) must be deselectable via the marker."""
+        for name, src in _test_sources():
+            code = "\n".join(_code_lines(src))
+            registers = re.search(r"""sb_rpc\(\s*['"]mc_register_agent['"]""", code)
+            mocked = re.search(r"patch.*sb_rpc|sb_rpc\s*=|monkeypatch", code)
+            if registers and not mocked:
+                assert re.search(r"pytestmark\s*=\s*pytest\.mark\.live_mesh", code), (
+                    f"{name} registers agents on the live backend but has no "
+                    f"module-level `pytestmark = pytest.mark.live_mesh`")
+
+    def test_marker_registered_in_pyproject(self):
+        cfg = PYPROJECT.read_text(errors="replace")
+        assert re.search(r"live_mesh\s*:", cfg), (
+            "live_mesh marker must stay registered under "
+            "[tool.pytest.ini_options] markers in pyproject.toml")
+
+
+class TestLoudTeardown:
+    def test_unregister_results_are_checked(self):
+        """sb_rpc returns errors as a dict, not an exception — every
+        mc_unregister_agent caller must inspect the result."""
+        for name, src in _test_sources():
+            code = "\n".join(_code_lines(src))
+            if "mc_unregister_agent" not in code:
+                continue
+            # The call's result must be bound and error-checked.
+            assert re.search(r"=\s*be\.sb_rpc\(\s*['\"]mc_unregister_agent", code), (
+                f"{name}: mc_unregister_agent result is discarded — a 404 "
+                f"would silently leak fixture agents (incident 2026-06-10)")
+            assert re.search(r"""\.get\(\s*['"](_)?error['"]""", code), (
+                f"{name}: mc_unregister_agent result is never checked for an "
+                f"error key")

{meshcode-2.11.127 → meshcode-2.11.128}/tests/test_mark_read_batch.py

@@ -18,10 +18,17 @@ import time
 import unittest
 from pathlib import Path
 
+import pytest
+
 sys.path.insert(0, str(Path(__file__).parent.parent))
 
 os.environ.setdefault("SUPABASE_URL", "https://gjinagyyjttyxnaoavnz.supabase.co")
 
+# Registers agents and sends messages on the REAL backend — opt-in only
+# (incident 2026-06-10: mread-* fixtures leaked into the live mesh-dev
+# roster). Deselect in CI/smoke with: -m "not live_mesh"
+pytestmark = pytest.mark.live_mesh
+
 
 def _get_api_key():
     key = os.environ.get("MESHCODE_API_KEY")
@@ -36,9 +43,16 @@ def _get_api_key():
 
 
 API_KEY = _get_api_key()
-PROJECT = "mesh-dev"
+# NEVER default to a live mesh (the old hardcoded "mesh-dev" put mread-*
+# fixtures on the production dashboard). Unset = tests SKIP.
+PROJECT = os.environ.get("MESHCODE_TEST_PROJECT")
 PROJECT_ID = None
 
+_LIVE_GATE = unittest.skipUnless(
+    API_KEY and PROJECT,
+    "MESHCODE_TEST_PROJECT (and an API key) required — live-mesh tests are "
+    "opt-in and must point at a dedicated test meshwork (incident 2026-06-10)")
+
 
 def _resolve():
     global PROJECT_ID
@@ -57,7 +71,7 @@ AGENT_A = f"mread-a-{int(time.time()) % 10000}"
 AGENT_B = f"mread-b-{int(time.time()) % 10000}"
 
 
-@unittest.skipUnless(API_KEY, "No API key — skipping live tests")
+@_LIVE_GATE
 class TestBatchMarkRead(unittest.TestCase):
 
     @classmethod
@@ -77,16 +91,25 @@ class TestBatchMarkRead(unittest.TestCase):
 
     @classmethod
     def tearDownClass(cls):
+        # LOUD on failure — the old except:pass (plus never checking sb_rpc's
+        # returned error dict) let a 404 on mc_unregister_agent leak mread-*
+        # fixtures into the roster forever (incident 2026-06-10).
         from meshcode.meshcode_mcp import backend as be
+        failures = []
         for name in [AGENT_A, AGENT_B]:
-            try:
-                be.sb_rpc("mc_unregister_agent", {
-                    "p_api_key": API_KEY,
-                    "p_project_id": cls.pid,
-                    "p_agent_name": name,
-                })
-            except Exception:
-                pass
+            result = be.sb_rpc("mc_unregister_agent", {
+                "p_api_key": API_KEY,
+                "p_project_id": cls.pid,
+                "p_agent_name": name,
+            })
+            # sb_rpc reports errors as a return VALUE, not an exception.
+            if isinstance(result, dict) and (result.get("error") or result.get("_error")):
+                failures.append(f"{name}: {result}")
+        if failures:
+            raise AssertionError(
+                "tearDown could not unregister test agents — they are now "
+                f"ORPHANED in '{PROJECT}' and must be removed by hand:\n  "
+                + "\n  ".join(failures))
 
     def test_01_batch_mark_read(self):
         """Send 5 messages, read_inbox marks all read in one call."""
@@ -129,7 +152,7 @@ class TestBatchMarkRead(unittest.TestCase):
         self.assertEqual(count, 0, f"Pending should be 0 after mark_read, got {count}")
 
 
-@unittest.skipUnless(API_KEY, "No API key — skipping live tests")
+@_LIVE_GATE
 class TestEffectiveStatusIntegration(unittest.TestCase):
     """Live integration test for mc_agent_effective_status."""
 

{meshcode-2.11.127 → meshcode-2.11.128}/tests/test_rls_cross_tenant.py

@@ -17,10 +17,17 @@ import time
 import unittest
 from pathlib import Path
 
+import pytest
+
 sys.path.insert(0, str(Path(__file__).parent.parent))
 
 os.environ.setdefault("SUPABASE_URL", "https://gjinagyyjttyxnaoavnz.supabase.co")
 
+# Sends real messages (incl. impersonation probes a human can see on the
+# dashboard) against the REAL backend — opt-in only (incident 2026-06-10).
+# Deselect in CI/smoke with: -m "not live_mesh"
+pytestmark = pytest.mark.live_mesh
+
 
 def _get_api_key():
     key = os.environ.get("MESHCODE_API_KEY")
@@ -35,11 +42,18 @@ def _get_api_key():
 
 
 API_KEY = _get_api_key()
-# Use mesh-dev as the "own" project
-OWN_PROJECT = "mesh-dev"
+# NEVER default to a live mesh (the old hardcoded "mesh-dev" sent the
+# impersonation probes of this file to the production dashboard). Unset =
+# tests SKIP.
+OWN_PROJECT = os.environ.get("MESHCODE_TEST_PROJECT")
 OWN_PROJECT_ID = None
 FAKE_PROJECT_ID = "00000000-0000-0000-0000-000000000000"
 
+_LIVE_GATE = unittest.skipUnless(
+    API_KEY and OWN_PROJECT,
+    "MESHCODE_TEST_PROJECT (and an API key) required — live-mesh tests are "
+    "opt-in and must point at a dedicated test meshwork (incident 2026-06-10)")
+
 
 def _resolve_project():
     global OWN_PROJECT_ID
@@ -57,7 +71,7 @@ def _resolve_project():
     return OWN_PROJECT_ID
 
 
-@unittest.skipUnless(API_KEY, "No API key — skipping live RLS tests")
+@_LIVE_GATE
 class TestCrossTenantIsolation(unittest.TestCase):
     """Agent in project X cannot access project Y data."""
 
@@ -135,7 +149,7 @@ class TestCrossTenantIsolation(unittest.TestCase):
             self.assertTrue(is_safe, f"Unexpected result: {result}")
 
 
-@unittest.skipUnless(API_KEY, "No API key — skipping live RLS tests")
+@_LIVE_GATE
 class TestImpersonation(unittest.TestCase):
     """Cannot impersonate another agent or user."""
 
@@ -202,7 +216,7 @@ class TestImpersonation(unittest.TestCase):
                         f"Empty API key should be rejected: {result}")
 
 
-@unittest.skipUnless(API_KEY, "No API key — skipping live RLS tests")
+@_LIVE_GATE
 class TestRPCErrorConsistency(unittest.TestCase):
     """All RPCs should return consistent error format."""