meshcode 2.11.137__tar.gz → 2.11.139__tar.gz

{meshcode-2.11.137 → meshcode-2.11.139}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.137
+Version: 2.11.139
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT
@@ -18,8 +18,17 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
+Requires-Dist: mcp[cli]>=1.0.0
+Requires-Dist: websockets>=12.0
+Requires-Dist: realtime>=2.0.0
+Requires-Dist: keyring>=24.0
+Requires-Dist: cryptography>=41.0
 Provides-Extra: test
+Requires-Dist: pytest>=8; extra == "test"
 Provides-Extra: dev
+Requires-Dist: build>=1.0; extra == "dev"
+Requires-Dist: twine>=4; extra == "dev"
+Requires-Dist: pytest>=8; extra == "dev"
 
 # MeshCode
 

{meshcode-2.11.137 → meshcode-2.11.139}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.137"
+__version__ = "2.11.139"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.137 → meshcode-2.11.139}/meshcode/hostd.py

@@ -617,11 +617,17 @@ def _spawn_agent(project: str, agent: str, repo_path=None) -> bool:
         _repo_win = f' --repo "{repo}"' if repo else ''
         cmd = (f'set "CLAUDECODE=" & set "CLAUDE_CODE_SESSION=" & '
                f'set "MESHCODE_NO_UPDATE=" & set "MESHCODE_NO_AUTO_UPDATE=" & '
+               # task 01e2b5c1: mark hostd spawns so `meshcode run` skips the
+               # human run-intent RPC (hostd only spawns desired_state=running;
+               # re-arming would override a human Stop clicked mid-spawn).
+               f'set "MESHCODE_HOSTD_SPAWN=1" & '
                + (f'set "PATH={_bindir};%PATH%" & ' if _bindir else '')
                + f'"{sys.executable}" -m meshcode run "{target}"{_repo_win}')
     else:
         _repo_posix = f" --repo {shlex.quote(repo)}" if repo else ''
         cmd = (f"unset CLAUDECODE CLAUDE_CODE_SESSION MESHCODE_NO_UPDATE MESHCODE_NO_AUTO_UPDATE; "
+               # task 01e2b5c1: see win32 branch — hostd spawns skip run-intent.
+               + f"export MESHCODE_HOSTD_SPAWN=1; "
                + (f"export PATH={shlex.quote(_bindir)}:$PATH; " if _bindir else "")
                + f"exec {shlex.quote(sys.executable)} -m meshcode run {shlex.quote(target)}{_repo_posix}")
     try:

{meshcode-2.11.137 → meshcode-2.11.139}/meshcode/meshcode_mcp/server.py

@@ -6694,7 +6694,8 @@ def meshcode_helper_spawn(name: str, role: str = "helper",
     return _swarm.spawn_helper(_get_api_key(), _PROJECT_ID, name, role=role,
                                swarm_id=swarm_id,
                                spawned_for_task_id=spawned_for_task_id,
-                               ttl_seconds=ttl_seconds, headless=headless)
+                               ttl_seconds=ttl_seconds, headless=headless,
+                               project_name=PROJECT_NAME)
 
 
 @mcp.tool()

{meshcode-2.11.137 → meshcode-2.11.139}/meshcode/meshcode_mcp/swarm.py

@@ -72,6 +72,11 @@ log = logging.getLogger("meshcode.swarm")
 RPC_HELPER_SPAWN = "mc_helper_spawn_as_agent"
 RPC_TRAY_CLAIM = "mc_task_claim_from_tray_as_agent"
 RPC_HELPER_RETIRE = "mc_helper_retire_as_agent"
+# mig 525 (task 80f62d47): parent-only mint of the helper's agent-scoped api
+# key — closes the W6 gap (helpers booted with the host's DEFAULT unscoped
+# key, so every identity-bound *_as_agent RPC refused agent_key_required and
+# the tray_drained→retire loop was dead; helpers lived until the TTL reaper).
+RPC_HELPER_KEY_MINT = "mc_helper_key_mint_as_agent"
 RPC_AGENT_POWER = "mc_agent_power_as_agent"   # mig 416 + 471 G1b + 473 cap
 RPC_TASK_COMPLETE = "mc_task_complete"        # live, agent-callable (rpc_allowlist)
 
@@ -134,6 +139,49 @@ def _explain_spawn_refusal(error_code: Optional[str], error: str) -> str:
     return error
 
 
+def provision_helper_key(api_key: str, project_id: str, name: str,
+                         project_name: Optional[str]) -> Dict[str, Any]:
+    """Mint the helper's agent-scoped api key (mig 525, parent-only) and store
+    it in the OS keychain under profile mesh:<project_name>:<name> — the same
+    convention `meshcode join` uses, which `meshcode run`'s auto-setup now
+    prefers over 'default' (task 80f62d47). MUST complete BEFORE power-on:
+    hostd materializes the helper workspace at first launch and a workspace
+    baked with the default (unscoped) profile reproduces the dead-retire bug.
+
+    Soft-fail: returns {ok: False, ...} but never raises — a key-less helper
+    still works the tray-less degraded path and the TTL reaper backstops it.
+    """
+    if not project_name:
+        return {"ok": False, "error": "project name unknown — cannot derive keychain profile"}
+    mint = be.sb_rpc(RPC_HELPER_KEY_MINT, {
+        "p_api_key": api_key,
+        "p_project_id": project_id,
+        "p_helper_name": name,
+    })
+    err = _err(mint)
+    if err:
+        code = mint.get("error_code") if isinstance(mint, dict) else None
+        return {"ok": False, "error": err, **({"error_code": code} if code else {})}
+    helper_key = mint.get("api_key") if isinstance(mint, dict) else None
+    if not helper_key:
+        return {"ok": False, "error": "mint returned no api_key"}
+    profile = f"mesh:{project_name}:{name}"
+    try:
+        import importlib
+        secrets_mod = importlib.import_module("meshcode.secrets")
+        stored = secrets_mod.set_api_key(helper_key, profile=profile, meta={
+            "type": "scoped", "meshwork": project_name, "agent": name,
+            "helper": True, "expires_at": mint.get("expires_at"),
+        })
+    except Exception as e:
+        return {"ok": False, "error": f"keychain store failed: {e}", "profile": profile}
+    if not stored:
+        return {"ok": False, "error": "keychain store refused", "profile": profile}
+    return {"ok": True, "profile": profile,
+            "key_prefix": mint.get("key_prefix"),
+            "rotated": bool(mint.get("rotated"))}
+
+
 def spawn_helper(api_key: str, project_id: str, name: str, *,
                  role: str = "helper",
                  swarm_id: Optional[str] = None,
@@ -141,16 +189,23 @@ def spawn_helper(api_key: str, project_id: str, name: str, *,
                  ttl_seconds: int = DEFAULT_TTL_SECONDS,
                  launch: bool = True,
                  headless: Optional[bool] = None,
-                 precheck: bool = True) -> Dict[str, Any]:
+                 precheck: bool = True,
+                 project_name: Optional[str] = None) -> Dict[str, Any]:
     """Spawn an ephemeral helper. Parent = caller (server-derived, W2).
 
     swarm_id=None lets the SERVER mint the tray id and stamp it on the parent
     row too (mig 480 parent-stamp — the SDK never mints). Pass an explicit
-    swarm_id only to join an existing tray. headless=None lets the server's
-    power-on default apply (single RPC); an explicit True/False does spawn
-    with p_power_on=false and a separate mc_agent_power_as_agent call carrying
-    p_headless. The helper's workspace materializes via `meshcode run`'s
-    auto-setup when hostd spawns it (W5: row inherits repo_path/host).
+    swarm_id only to join an existing tray. The helper's workspace
+    materializes via `meshcode run`'s auto-setup when hostd spawns it (W5:
+    row inherits repo_path/host).
+
+    Flow is ALWAYS two-step when launching (task 80f62d47): register with
+    p_power_on=false → mint + keychain-store the helper's agent-scoped key
+    (mig 525) → power on. Power-on flips desired_state and hostd may
+    materialize the workspace on its very next poll tick, so the key MUST be
+    in the keychain first — otherwise auto-setup bakes the default unscoped
+    profile and every identity-bound *_as_agent RPC (tray claim, self-retire)
+    refuses for the helper's whole life.
 
     precheck (scope-add 6a14336c): consult the user's Enjambre toggle BEFORE
     creating anything — enabled=False refuses early with a clear message
@@ -164,8 +219,6 @@ def spawn_helper(api_key: str, project_id: str, name: str, *,
             return {"ok": False, "stage": "precheck",
                     "error_code": "swarm_disabled", "error": MSG_SWARM_DISABLED}
 
-    single_rpc_power = launch and headless is None
-
     reg = be.sb_rpc(RPC_HELPER_SPAWN, {
         "p_api_key": api_key,
         "p_project_id": project_id,
@@ -175,7 +228,7 @@ def spawn_helper(api_key: str, project_id: str, name: str, *,
         "p_role": role,
         "p_auto_retire": True,
         "p_ttl_seconds": int(ttl_seconds),
-        "p_power_on": bool(single_rpc_power),
+        "p_power_on": False,
     })
     err = _err(reg)
     if err:
@@ -199,18 +252,30 @@ def spawn_helper(api_key: str, project_id: str, name: str, *,
         out.update({k: reg[k] for k in
                     ("agent_id", "swarm_id", "parent_agent_id", "ttl_expires_at")
                     if k in reg})
-        power = reg.get("power")
+
+    # Key provisioning BEFORE power-on (ordering is the whole fix). Soft-fail:
+    # surfaced in the result, never blocks the launch.
+    prov = provision_helper_key(api_key, project_id, name, project_name)
+    out["key_provisioned"] = bool(prov.get("ok"))
+    if prov.get("ok"):
+        out["keychain_profile"] = prov.get("profile")
     else:
-        power = None
+        out["key_provision_error"] = prov.get("error")
+        log.warning("helper %s: key provisioning failed (%s) — helper will "
+                    "boot with the default key and cannot tray-claim/retire",
+                    name, prov.get("error"))
 
-    if launch and not single_rpc_power:
-        power = be.sb_rpc(RPC_AGENT_POWER, {
+    power = None
+    if launch:
+        power_params = {
             "p_api_key": api_key,
             "p_project_id": project_id,
             "p_agent": name,
             "p_state": "running",
-            "p_headless": bool(headless),
-        })
+        }
+        if headless is not None:
+            power_params["p_headless"] = bool(headless)
+        power = be.sb_rpc(RPC_AGENT_POWER, power_params)
 
     if launch:
         perr = _err(power)

{meshcode-2.11.137 → meshcode-2.11.139}/meshcode/meshcode_mcp/test_swarm.py

@@ -10,6 +10,7 @@ helper_cap_reached in BOTH register and power paths), drain semantics,
 DAG-blocked polling, ttl expiry, error budget, and the no-recycle rule
 (no code path may ever call mc_recycle*).
 """
+import sys
 import unittest
 from unittest import mock
 
@@ -47,6 +48,16 @@ class SwarmTestCase(unittest.TestCase):
         patcher.start()
         self.addCleanup(patcher.stop)
 
+    def patch_secrets(self, stored=True):
+        """Fake meshcode.secrets so provision_helper_key's keychain store is
+        offline. Returns the mock module (inspect set_api_key calls)."""
+        secrets_mod = mock.MagicMock()
+        secrets_mod.set_api_key.return_value = stored
+        patcher = mock.patch.dict(sys.modules, {"meshcode.secrets": secrets_mod})
+        patcher.start()
+        self.addCleanup(patcher.stop)
+        return secrets_mod
+
     def assert_no_recycle(self):
         """recycle_agent is DISABLED in prod — the helper lifecycle must never
         touch any mc_recycle* RPC on any path."""
@@ -55,24 +66,37 @@ class SwarmTestCase(unittest.TestCase):
 
 
 class SpawnTests(SwarmTestCase):
-    def test_spawn_single_rpc_composes_power_on(self):
-        """Default (headless unset): ONE RPC — server composes power-on."""
+    def test_spawn_two_step_key_before_power(self):
+        """task 80f62d47: register(p_power_on=false) → MINT + keychain store →
+        power. Ordering is the fix: the key must be in the keychain BEFORE
+        desired_state flips, or hostd materializes the workspace with the
+        default unscoped profile and the helper can never tray-claim/retire."""
+        secrets_mod = self.patch_secrets()
         self.rpc.script(swarm.RPC_HELPER_SPAWN,
                         {"ok": True, "agent_id": "h-1", "name": "helper-1",
                          "swarm_id": "s-1", "parent_agent_id": "p-1",
-                         "ttl_expires_at": "2026-06-10T01:00:00Z",
-                         "power": {"ok": True, "powered_by": "parent:qa",
-                                   "no_host": False}})
+                         "ttl_expires_at": "2026-06-10T01:00:00Z"})
+        self.rpc.script(swarm.RPC_HELPER_KEY_MINT,
+                        {"ok": True, "api_key": "mc_helper_secret",
+                         "key_prefix": "mc_helper_se", "rotated": False})
+        self.rpc.script(swarm.RPC_AGENT_POWER,
+                        {"ok": True, "powered_by": "parent:qa", "no_host": False})
 
         out = swarm.spawn_helper("KEY", PROJ, "helper-1",
                                  swarm_id="s-1", spawned_for_task_id="t-9",
-                                 ttl_seconds=120, precheck=False)
+                                 ttl_seconds=120, precheck=False,
+                                 project_name="myproj")
 
         self.assertTrue(out["ok"])
         self.assertEqual(out["agent_id"], "h-1")
         self.assertEqual(out["swarm_id"], "s-1")
         self.assertEqual(out["powered_by"], "parent:qa")
-        self.assertEqual(self.rpc.called_fns(), [swarm.RPC_HELPER_SPAWN])
+        self.assertTrue(out["key_provisioned"])
+        self.assertEqual(out["keychain_profile"], "mesh:myproj:helper-1")
+        # strict order: spawn → mint → power
+        self.assertEqual(self.rpc.called_fns(),
+                         [swarm.RPC_HELPER_SPAWN, swarm.RPC_HELPER_KEY_MINT,
+                          swarm.RPC_AGENT_POWER])
 
         _, params = self.rpc.calls[0]
         self.assertEqual(params["p_project_id"], PROJ)
@@ -80,9 +104,39 @@ class SpawnTests(SwarmTestCase):
         self.assertEqual(params["p_spawned_for_task_id"], "t-9")
         self.assertEqual(params["p_ttl_seconds"], 120)
         self.assertTrue(params["p_auto_retire"])
-        self.assertTrue(params["p_power_on"])
+        self.assertFalse(params["p_power_on"])  # never single-RPC anymore
+        # keychain got the MINTED key under the scoped profile
+        secrets_mod.set_api_key.assert_called_once()
+        args, kwargs = secrets_mod.set_api_key.call_args
+        self.assertEqual(args[0], "mc_helper_secret")
+        self.assertEqual(kwargs["profile"], "mesh:myproj:helper-1")
         self.assert_no_recycle()
 
+    def test_spawn_key_mint_soft_fails_never_blocks_launch(self):
+        """Mint refusal (e.g. mig 525 not applied yet) degrades, not breaks:
+        helper still powers on; result surfaces key_provision_error."""
+        self.rpc.script(swarm.RPC_HELPER_SPAWN, {"ok": True, "agent_id": "h-1"})
+        self.rpc.script(swarm.RPC_HELPER_KEY_MINT,
+                        {"ok": False, "error_code": "not_your_helper",
+                         "error": "only the spawning parent can mint"})
+        self.rpc.script(swarm.RPC_AGENT_POWER, {"ok": True})
+        out = swarm.spawn_helper("KEY", PROJ, "helper-1", precheck=False,
+                                 project_name="myproj")
+        self.assertTrue(out["ok"])
+        self.assertFalse(out["key_provisioned"])
+        self.assertIn("parent", out["key_provision_error"])
+        self.assertEqual(self.rpc.called_fns()[-1], swarm.RPC_AGENT_POWER)
+
+    def test_spawn_without_project_name_skips_mint(self):
+        """No project name → no profile to store under → skip the mint RPC
+        entirely (degraded, surfaced) instead of leaking an unstorable key."""
+        self.rpc.script(swarm.RPC_HELPER_SPAWN, {"ok": True, "agent_id": "h-1"})
+        self.rpc.script(swarm.RPC_AGENT_POWER, {"ok": True})
+        out = swarm.spawn_helper("KEY", PROJ, "helper-1", precheck=False)
+        self.assertTrue(out["ok"])
+        self.assertFalse(out["key_provisioned"])
+        self.assertNotIn(swarm.RPC_HELPER_KEY_MINT, self.rpc.called_fns())
+
     def test_spawn_omitted_swarm_id_passes_null_for_server_mint(self):
         """mig 480: p_swarm_id DEFAULT NULL — the SERVER mints the tray id and
         parent-stamps it; the SDK must NOT mint client-side."""
@@ -93,7 +147,7 @@ class SpawnTests(SwarmTestCase):
         self.assertIsNone(params["p_swarm_id"])  # server mints, never the SDK
         self.assertEqual(out["swarm_id"], "srv-minted")
 
-    def test_spawn_explicit_headless_uses_two_rpcs(self):
+    def test_spawn_explicit_headless_carries_p_headless(self):
         self.rpc.script(swarm.RPC_HELPER_SPAWN, {"ok": True, "agent_id": "h-1"})
         self.rpc.script(swarm.RPC_AGENT_POWER,
                         {"ok": True, "powered_by": "parent:qa"})
@@ -102,11 +156,21 @@ class SpawnTests(SwarmTestCase):
         self.assertTrue(out["ok"])
         _, spawn_params = self.rpc.calls[0]
         self.assertFalse(spawn_params["p_power_on"])
-        fn, power_params = self.rpc.calls[1]
+        fn, power_params = self.rpc.calls[-1]
         self.assertEqual(fn, swarm.RPC_AGENT_POWER)
         self.assertEqual(power_params["p_state"], "running")
         self.assertTrue(power_params["p_headless"])
 
+    def test_spawn_default_headless_omits_p_headless(self):
+        """headless=None → server's power default applies (no p_headless key)."""
+        self.rpc.script(swarm.RPC_HELPER_SPAWN, {"ok": True, "agent_id": "h-1"})
+        self.rpc.script(swarm.RPC_AGENT_POWER, {"ok": True})
+        out = swarm.spawn_helper("KEY", PROJ, "helper-1", precheck=False)
+        self.assertTrue(out["ok"])
+        fn, power_params = self.rpc.calls[-1]
+        self.assertEqual(fn, swarm.RPC_AGENT_POWER)
+        self.assertNotIn("p_headless", power_params)
+
     def test_spawn_tier_limit_surfaces_register_stage(self):
         self.rpc.script(swarm.RPC_HELPER_SPAWN,
                         {"ok": False, "error_code": "tier_limit",
@@ -121,9 +185,10 @@ class SpawnTests(SwarmTestCase):
         """mig 473 concurrent cap: row created, power refused — message maps to
         the user-facing UX copy (Samuel scope-add); caller can stagger/re-power."""
         self.rpc.script(swarm.RPC_HELPER_SPAWN,
-                        {"ok": True, "agent_id": "h-1", "swarm_id": "s-1",
-                         "power": {"ok": False, "error_code": "helper_cap_reached",
-                                   "error": "too many running helpers"}})
+                        {"ok": True, "agent_id": "h-1", "swarm_id": "s-1"})
+        self.rpc.script(swarm.RPC_AGENT_POWER,
+                        {"ok": False, "error_code": "helper_cap_reached",
+                         "error": "too many running helpers"})
         out = swarm.spawn_helper("KEY", PROJ, "helper-1", swarm_id="s-1",
                                  precheck=False)
         self.assertFalse(out["ok"])
@@ -163,7 +228,8 @@ class UxControlsTests(SwarmTestCase):
                         {"ok": True, "enabled": True, "max_helpers": 5,
                          "running_helpers": 1})
         self.rpc.script(swarm.RPC_HELPER_SPAWN,
-                        {"ok": True, "agent_id": "h-1", "power": {"ok": True}})
+                        {"ok": True, "agent_id": "h-1"})
+        self.rpc.script(swarm.RPC_AGENT_POWER, {"ok": True})
         out = swarm.spawn_helper("KEY", PROJ, "helper-1")
         self.assertTrue(out["ok"])
         self.assertIn(swarm.RPC_HELPER_SPAWN, self.rpc.called_fns())
@@ -203,9 +269,10 @@ class UxControlsTests(SwarmTestCase):
         path — a row created while the toggle flips off arrives stopped with
         the refusal inside `power`; same clear UX copy."""
         self.rpc.script(swarm.RPC_HELPER_SPAWN,
-                        {"ok": True, "agent_id": "h-1", "swarm_id": "s-1",
-                         "power": {"ok": False, "error_code": "swarm_disabled",
-                                   "error": "swarm_disabled"}})
+                        {"ok": True, "agent_id": "h-1", "swarm_id": "s-1"})
+        self.rpc.script(swarm.RPC_AGENT_POWER,
+                        {"ok": False, "error_code": "swarm_disabled",
+                         "error": "swarm_disabled"})
         out = swarm.spawn_helper("KEY", PROJ, "helper-1", swarm_id="s-1",
                                  precheck=False)
         self.assertFalse(out["ok"])

{meshcode-2.11.137 → meshcode-2.11.139}/meshcode/run_agent.py

@@ -352,6 +352,78 @@ def _resolve_user_projects_for_agent(agent: str) -> Optional[list]:
     return projects if isinstance(projects, list) else []
 
 
+def _declare_run_intent(agent: str, project: str) -> dict:
+    """Server-side 'human wants this agent ON' (task 01e2b5c1, mig 526).
+
+    A hand-typed `meshcode run` on a desired_state='stopped' agent used to
+    boot and die seconds later: hostd enforces 'stopped' against any session
+    it didn't bless (ghost sweep on stale heartbeat, cooperative must_exit on
+    fresh). mc_run_intent_by_api_key flips desired_state='running' and clears
+    stop_source + stale recycle/respawn flags ATOMICALLY server-side BEFORE
+    the editor launches, so hostd can never win the race.
+
+    Soft-fail: returns {ok: False, error} — caller warns loudly but never
+    blocks the launch (guests on their own box don't fight a hostd anyway).
+    """
+    try:
+        from .setup_clients import _load_supabase_env
+        import importlib
+        secrets_mod = importlib.import_module("meshcode.secrets")
+    except Exception as e:
+        return {"ok": False, "error": f"cannot load auth modules: {e}"}
+
+    scoped_profile = f"mesh:{project}:{agent}"
+    api_key = secrets_mod.get_api_key(profile=scoped_profile)
+    if not api_key:
+        profile = os.environ.get("MESHCODE_KEYCHAIN_PROFILE") or "default"
+        api_key = secrets_mod.get_api_key(profile=profile)
+    if not api_key:
+        return {"ok": False, "error": "not logged in"}
+
+    sb = _load_supabase_env()
+    try:
+        from urllib.request import Request, urlopen
+        body = json.dumps({
+            "p_api_key": api_key,
+            "p_project_name": project,
+            "p_agent_name": agent,
+        }).encode()
+        req = Request(
+            f"{sb['SUPABASE_URL']}/rest/v1/rpc/mc_run_intent_by_api_key",
+            data=body, method="POST",
+            headers={
+                "apikey": sb["SUPABASE_KEY"],
+                "Authorization": f"Bearer {sb['SUPABASE_KEY']}",
+                "Content-Type": "application/json",
+            },
+        )
+        with urlopen(req, timeout=10) as resp:
+            data = json.loads(resp.read().decode())
+    except Exception as e:
+        return {"ok": False, "error": f"run-intent RPC unreachable: {e}"}
+    if isinstance(data, dict):
+        return data
+    return {"ok": False, "error": "unexpected run-intent response shape"}
+
+
+def _preferred_keychain_profile(project: str, agent: str) -> str:
+    """Prefer the agent-scoped keychain profile mesh:<project>:<agent> when it
+    holds a key — invite guests AND enjambre helpers (task 80f62d47: helper
+    keys are minted by the parent via mc_helper_key_mint_as_agent and stored
+    under this profile BEFORE power-on). Falling back to 'default' here is
+    what used to bake the owner's unscoped key into helper workspaces, which
+    made every identity-bound *_as_agent RPC refuse (dead retire loop)."""
+    try:
+        import importlib
+        secrets_mod = importlib.import_module("meshcode.secrets")
+        scoped = f"mesh:{project}:{agent}"
+        if secrets_mod.get_api_key(profile=scoped):
+            return scoped
+    except Exception:
+        pass
+    return os.environ.get("MESHCODE_KEYCHAIN_PROFILE") or "default"
+
+
 def _try_auto_setup(agent: str, project: str) -> Optional[Tuple[Path, str]]:
     """If agent exists on the server but has no local workspace, auto-create it.
 
@@ -379,7 +451,8 @@ def _try_auto_setup(agent: str, project: str) -> Optional[Tuple[Path, str]]:
     role = match[0].get("role", "")
 
     print(f"[meshcode] Workspace recreated automatically for agent '{agent}' (project: {resolved_project})")
-    rc = setup_workspace(resolved_project, agent, role)
+    rc = setup_workspace(resolved_project, agent, role,
+                         keychain_profile=_preferred_keychain_profile(resolved_project, agent))
     if rc != 0:
         return None
 
@@ -928,7 +1001,8 @@ def run(agent: str, project: Optional[str] = None, editor_override: Optional[str
         print(f"[meshcode] .mcp.json missing from workspace — regenerating...", file=sys.stderr)
         try:
             from .setup_clients import setup_workspace
-            rc = setup_workspace(resolved_project, agent)
+            rc = setup_workspace(resolved_project, agent,
+                                 keychain_profile=_preferred_keychain_profile(resolved_project, agent))
             if rc == 0 and mcp_json_path.exists():
                 print(f"[meshcode] .mcp.json regenerated successfully.", file=sys.stderr)
             else:
@@ -1003,7 +1077,8 @@ def run(agent: str, project: Optional[str] = None, editor_override: Optional[str
         print(f"[meshcode] stop hook missing from workspace — regenerating...", file=sys.stderr)
         try:
             from .setup_clients import setup_workspace
-            rc = setup_workspace(resolved_project, agent)
+            rc = setup_workspace(resolved_project, agent,
+                                 keychain_profile=_preferred_keychain_profile(resolved_project, agent))
             if rc == 0 and hook_path.exists():
                 print(f"[meshcode] stop hook regenerated successfully.", file=sys.stderr)
             else:
@@ -1023,6 +1098,36 @@ def run(agent: str, project: Optional[str] = None, editor_override: Optional[str
     if ownership_err:
         print(f"[meshcode] ERROR: {ownership_err}", file=sys.stderr)
         return 2
+
+    # ── Run-intent: explicit human launch UN-PARKS the agent (task 01e2b5c1) ──
+    # Without this, `meshcode run` on a desired_state='stopped' agent boots and
+    # hostd kills the session seconds later ("se apagaban automáticamente").
+    # Server-side BEFORE the editor launches so hostd never wins the race.
+    # Gated OFF for hostd-spawned terminals (MESHCODE_HOSTD_SPAWN=1): hostd only
+    # spawns agents already 'running'; re-arming here would override a human
+    # Stop clicked mid-spawn (the inverse race).
+    if not dry_run and os.environ.get("MESHCODE_HOSTD_SPAWN") != "1":
+        _ri = _declare_run_intent(agent, resolved_project)
+        if _ri.get("ok"):
+            if _ri.get("unparked"):
+                print(f"[meshcode] Agent was OFF (desired_state="
+                      f"{_ri.get('prev_desired_state')}"
+                      + (f", stopped by {_ri.get('prev_stop_source')}" if _ri.get('prev_stop_source') else "")
+                      + ") — re-armed to running for this launch.", file=sys.stderr)
+            if _ri.get("cleared_stale_recycle"):
+                print("[meshcode] Cleared a stale pre-boot recycle flag "
+                      "(would have force-exited this session ~1min after boot).", file=sys.stderr)
+        elif _ri.get("error_code") == "helper_not_manual":
+            print(f"[meshcode] ERROR: {_ri.get('error')}", file=sys.stderr)
+            return 2
+        else:
+            # Soft-fail, but tell the user the REAL error + the consequence
+            # instead of a silent boot that dies seconds later.
+            print(f"[meshcode] WARNING: could not declare run intent: "
+                  f"{_ri.get('error') or _ri}", file=sys.stderr)
+            print("[meshcode]          If this agent is marked stopped on the server, "
+                  "the host daemon may close this session within seconds. "
+                  "Use the dashboard Start button or retry.", file=sys.stderr)
     server_id = f"meshcode-{resolved_project}-{agent}"
 
     editor = editor_override or _detect_editor()

{meshcode-2.11.137 → meshcode-2.11.139}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.137
+Version: 2.11.139
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT
@@ -18,8 +18,17 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
+Requires-Dist: mcp[cli]>=1.0.0
+Requires-Dist: websockets>=12.0
+Requires-Dist: realtime>=2.0.0
+Requires-Dist: keyring>=24.0
+Requires-Dist: cryptography>=41.0
 Provides-Extra: test
+Requires-Dist: pytest>=8; extra == "test"
 Provides-Extra: dev
+Requires-Dist: build>=1.0; extra == "dev"
+Requires-Dist: twine>=4; extra == "dev"
+Requires-Dist: pytest>=8; extra == "dev"
 
 # MeshCode
 

{meshcode-2.11.137 → meshcode-2.11.139}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.137"
+version = "2.11.139"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}