meshcode 2.11.144__tar.gz → 2.11.147__tar.gz

{meshcode-2.11.144 → meshcode-2.11.147}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.144
+Version: 2.11.147
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.144 → meshcode-2.11.147}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.144"
+__version__ = "2.11.147"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.144 → meshcode-2.11.147}/meshcode/hostd.py

@@ -148,13 +148,31 @@ def _maybe_self_restart_on_version_drift() -> None:
     if _has_supervisor():
         _log("supervisor present -> clean exit; launchd/systemd/schtasks relaunches on new code")
         os._exit(0)
-    # No supervisor (e.g. dev foreground run): execv is the only in-place restart. If it's blocked,
-    # do NOT self-destruct (nothing would relaunch us) — stay on old code, retry after the guard window.
+    # No supervisor (e.g. dev foreground run / sandboxed Mac terminal):
+    # try execv first (fastest, in-place); if blocked (macOS sandbox), spawn a
+    # DETACHED hostd on the new wheel and exit. The new process inherits nothing
+    # from us — clean slate on the on-disk version.
     try:
         os.execv(sys.executable, [sys.executable, "-m", "meshcode"] + sys.argv[1:])
     except Exception as e:
-        _log(f"WARN: no supervisor + execv failed ({e}); staying on {_RUNNING_VERSION}, retry after guard window")
-        return
+        _log(f"execv blocked ({e}); attempting detached self-relaunch via subprocess")
+        try:
+            argv = _hostd_run_argv()
+            if sys.platform == "win32":
+                # DETACHED_PROCESS: no console inheritance, survives our exit.
+                subprocess.Popen(argv, creationflags=subprocess.DETACHED_PROCESS,
+                                 close_fds=True, stdin=subprocess.DEVNULL,
+                                 stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+            else:
+                subprocess.Popen(argv, start_new_session=True,
+                                 close_fds=True, stdin=subprocess.DEVNULL,
+                                 stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+            _log(f"detached hostd spawned ({' '.join(argv)}); exiting old ({_RUNNING_VERSION})")
+            os._exit(0)
+        except Exception as e2:
+            _log(f"WARN: no supervisor + execv failed + detached spawn failed ({e2}); "
+                 f"staying on {_RUNNING_VERSION}, retry after guard window")
+            return
 
 STATE_DIR = Path.home() / ".meshcode"
 HOST_ID_PATH = STATE_DIR / "host_id"
@@ -516,6 +534,31 @@ def _host_cfg(api_key: str, host_id: str) -> Optional[dict]:
     return cfg
 
 
+def _agent_desired_state_fresh(api_key: str, host_id: str, target: str) -> Optional[str]:
+    """UNCACHED single-roster read of one target's current desired_state, for the
+    F1 stop-vs-respawn pre-spawn re-check (task 8d9950a7).
+
+    mc_agents_needing_respawn is read ONCE at the top of a respawn sweep; a Stop that
+    commits AFTER that read (mc_agent_power -> desired_state='stopped') is invisible to
+    the stale candidate snapshot, so hostd would re-open a terminal the user just closed
+    (ghost). This deliberately BYPASSES _host_cfg's per-sweep TTL cache (which can predate
+    the Stop) and hits mc_host_config_get directly so the re-check sees committed Stops.
+    Bounded cost: only candidates that pass every other guard reach this, capped by
+    _MAX_SPAWNS_PER_SWEEP (~2-3) per sweep.
+
+    Returns the desired_state string, or None if the roster can't be read / the agent is
+    absent — callers FAIL OPEN (the reordered stop sweep + _do_stopped_ghost_sweep are the
+    backstop; a transient roster-read error must not freeze all respawns)."""
+    cfg = _rpc("mc_host_config_get", {"p_api_key": api_key, "p_host_id": host_id})
+    if not cfg or not cfg.get("ok"):
+        return None
+    for a in (cfg.get("agents") or []):
+        proj, agent = a.get("project_name"), a.get("name")
+        if proj and agent and f"{proj}/{agent}" == target:
+            return a.get("desired_state")
+    return None
+
+
 # ------------------------------------------------------------------
 # Respawn
 # ------------------------------------------------------------------
@@ -578,6 +621,66 @@ def _validate_repo_path(rp) -> Optional[str]:
     return p
 
 
+def _default_bindir() -> str:
+    """bin/Scripts dir of hostd's own interpreter — the legacy PATH prepend."""
+    try:
+        return str(Path(sys.executable).resolve().parent)
+    except Exception:
+        return ""
+
+
+def _resolve_launch_python() -> tuple:
+    """Interpreter hostd should use to launch `meshcode run` (task 07a571f8).
+
+    THE version-split root cause: hostd's own ``sys.executable`` is whatever
+    python started the daemon — on Samuel's box that was the USER-SITE install
+    (2.11.144) while every agent's .mcp.json pinned the immutable env
+    (2.11.145). Launching ``meshcode run`` with ``sys.executable`` therefore ran
+    the STALE user-site code for the entire run-wrapper + prekill/dedup path, so
+    a perfect fix shipped to PyPI did NOTHING until user-site was manually
+    upgraded — the durable "fix exists but bug persists" trap, and the source of
+    Samuel's double-launches (stale hostd lacks the dedup fix) + loop-drop
+    (runtime != MESHCODE_EXPECTED_VERSION breaks the meshcode_* tool-bind).
+
+    Fix: resolve the SAME pinned env the agent's MCP serve already uses
+    (self_update.resolve_target_version -> ensure_versioned_env) and launch the
+    run-wrapper from THERE, so the launch path can never lag user-site.
+
+    Offline-safe fallback to ``sys.executable`` (legacy behavior) ONLY when the
+    pin cannot be resolved or built: editable/dev install, updates disabled,
+    offline (no version resolved), or env-build failure. We never hard-break a
+    spawn, but every fallback is LOGGED loudly so a silent split is impossible.
+
+    Returns ``(python_exe, bindir, pinned_version_or_None)``.
+    """
+    try:
+        from meshcode import self_update as _su
+        # Dev / opt-out installs: never repoint, keep current interpreter.
+        if _su.update_disabled() or _su.is_editable_install():
+            return sys.executable, _default_bindir(), None
+        target = _su.resolve_target_version()
+        if not target:
+            _log("launch-py: no target version resolved (offline?) -> "
+                 "sys.executable (legacy)")
+            return sys.executable, _default_bindir(), None
+        py = _su.ensure_versioned_env(target, verbose=False)
+        if py is None or not Path(py).exists():
+            _log(f"WARN: launch-py: could not build/resolve env for meshcode "
+                 f"{target} -> falling back to sys.executable ({sys.executable}); "
+                 f"possible version split until the env finalizes (hostd retries "
+                 f"on the next sweep)")
+            return sys.executable, _default_bindir(), None
+        # refuse-stale-spawn: never launch from an env that is not the target.
+        if _su._env_version(str(py)) != target:
+            _log(f"WARN: launch-py: env at {py} reports != {target} -> "
+                 f"sys.executable (legacy)")
+            return sys.executable, _default_bindir(), None
+        return str(py), str(Path(py).resolve().parent), target
+    except Exception as e:
+        _log(f"WARN: launch-py resolution failed ({e}) -> sys.executable")
+        return sys.executable, _default_bindir(), None
+
+
 def _spawn_agent(project: str, agent: str, repo_path=None) -> bool:
     """Relaunch `meshcode run <project>/<agent>` in a VISIBLE terminal window.
 
@@ -597,6 +700,16 @@ def _spawn_agent(project: str, agent: str, repo_path=None) -> bool:
     + the respawn RPC carry it.
     """
     target = f"{project}/{agent}"
+    # C3 RCE GATE (task f9f4a2d3): project/agent are interpolated into a cmd.exe '&'-chain
+    # (Windows) / POSIX shell below. Candidates originate from mc_agents_needing_respawn
+    # (DB-sourced) — a poisoned row must NEVER reach the shell. Same allowlist as the launch
+    # path; this is the sink-level backstop (covers every caller of _spawn_agent).
+    from meshcode.protocol_handler import is_valid_agent_name
+    if not (is_valid_agent_name(project) and is_valid_agent_name(agent)):
+        _log(f"WARN: refusing to spawn {target!r}: project/agent failed the "
+             f"is_valid_agent_name allowlist (shell-unsafe chars) — possible injection, "
+             f"NOT spawning. [spawn_blocked_reason=invalid_name]")
+        return False
     repo = _validate_repo_path(repo_path)
     # env hygiene (item1 RC): a stale CLAUDECODE aborts `meshcode run` (exit2). Build the terminal
     # command PER-PLATFORM (mesh-core FIX1, 0x80070002): cmd.exe uses & (NOT ';'), set "V=" to clear
@@ -606,12 +719,15 @@ def _spawn_agent(project: str, agent: str, repo_path=None) -> bool:
     # via `python -m meshcode` (NOT the .exe shim) so a bg `pip install -U` can replace meshcode.exe.
     # RELIABILITY (commander, REOPEN_PATH_bug): the VISIBLE spawn must also put the meshcode
     # console script on PATH (a8efddeb fixed only the headless branch). Without it the spawned
-    # agent + its `meshcode mcp` child die with "meshcode not on PATH". Prepend sys.executable's
-    # bin dir, mirroring the headless POSIX fix + the win32 venv-Scripts injection.
-    try:
-        _bindir = str(Path(sys.executable).resolve().parent)
-    except Exception:
-        _bindir = ""
+    # agent + its `meshcode mcp` child die with "meshcode not on PATH". Prepend the launch
+    # interpreter's bin dir, mirroring the headless POSIX fix + the win32 venv-Scripts injection.
+    # task 07a571f8: launch from the PINNED env python (not hostd's own sys.executable) so the
+    # run-wrapper can never lag user-site — _resolve_launch_python falls back to sys.executable
+    # (legacy) offline/dev/build-fail, always logging. _bindir follows the chosen interpreter so
+    # PATH + the meshcode console script match the runtime that actually serves.
+    _launch_py, _bindir, _pin_ver = _resolve_launch_python()
+    if _pin_ver:
+        _log(f"launch {target}: pinned env meshcode {_pin_ver} ({_launch_py})")
     if sys.platform == "win32":
         # repo already validated (no '"'/control chars, real dir) -> safe to double-quote.
         _repo_win = f' --repo "{repo}"' if repo else ''
@@ -622,14 +738,14 @@ def _spawn_agent(project: str, agent: str, repo_path=None) -> bool:
                # re-arming would override a human Stop clicked mid-spawn).
                f'set "MESHCODE_HOSTD_SPAWN=1" & '
                + (f'set "PATH={_bindir};%PATH%" & ' if _bindir else '')
-               + f'"{sys.executable}" -m meshcode run "{target}"{_repo_win}')
+               + f'"{_launch_py}" -m meshcode run "{target}"{_repo_win}')
     else:
         _repo_posix = f" --repo {shlex.quote(repo)}" if repo else ''
         cmd = (f"unset CLAUDECODE CLAUDE_CODE_SESSION MESHCODE_NO_UPDATE MESHCODE_NO_AUTO_UPDATE; "
                # task 01e2b5c1: see win32 branch — hostd spawns skip run-intent.
                + f"export MESHCODE_HOSTD_SPAWN=1; "
                + (f"export PATH={shlex.quote(_bindir)}:$PATH; " if _bindir else "")
-               + f"exec {shlex.quote(sys.executable)} -m meshcode run {shlex.quote(target)}{_repo_posix}")
+               + f"exec {shlex.quote(_launch_py)} -m meshcode run {shlex.quote(target)}{_repo_posix}")
     try:
         from meshcode import protocol_handler as _ph
         ok, info = _ph._spawn_terminal(cmd)
@@ -669,6 +785,10 @@ _DISCOVERY_ERR_LOGGED: set = set()
 # so the ORPHAN-CLAIM line prints once per agent instead of every ~10s sweep.
 _ORPHAN_CLAIMED_LOGGED: set = set()
 
+# C3 (task f9f4a2d3): names rejected by the is_valid_agent_name gate, logged once per
+# name per daemon session so a poisoned DB row raises a visible alert without flooding.
+_INVALID_NAME_LOGGED: set = set()
+
 
 def _do_respawns(api_key: str, host_id: str) -> int:
     """One respawn sweep. Returns number relaunched."""
@@ -722,6 +842,18 @@ def _do_respawns(api_key: str, host_id: str) -> int:
         proj, agent = c.get("project_name"), c.get("agent")
         if not proj or not agent:
             continue
+        # C3 RCE GATE (task f9f4a2d3): reject DB-sourced candidate names outside the strict
+        # allowlist BEFORE any reconcile/spawn — defense in depth with the _spawn_agent sink
+        # guard, and a clean once-per-name skip log so a poisoned row can't storm.
+        from meshcode.protocol_handler import is_valid_agent_name
+        if not (is_valid_agent_name(proj) and is_valid_agent_name(agent)):
+            _bn = f"{proj}/{agent}"
+            if _bn not in _INVALID_NAME_LOGGED:
+                _INVALID_NAME_LOGGED.add(_bn)
+                _log(f"SKIP respawn {proj!r}/{agent!r}: invalid project/agent name "
+                     f"(is_valid_agent_name allowlist) — refusing a shell-unsafe candidate. "
+                     f"[respawn_blocked_reason=invalid_name]")
+            continue
         if not c.get("respawn_allowed", True):
             # mig404: not allowed = rate-limited (<60s since last respawn) or at the cap.
             # mc_record_respawn v2 sets desired_state='crashed' ATOMICALLY at the cap, so we
@@ -1020,6 +1152,23 @@ def _do_respawns(api_key: str, host_id: str) -> int:
         # removed, task cba01de5), so this always runs for a recycle. (With the pre-spawn
         # reconciliation above this set is normally already empty — kept as backstop.)
         _old_vis_pids = _discover_agent_pids(_target) if _is_recycle else []
+        # F1 STOP-VS-RESPAWN re-check (task 8d9950a7): the candidate snapshot from
+        # mc_agents_needing_respawn was taken at the top of this sweep. Re-read
+        # desired_state FRESH (uncached) at the last moment before opening a terminal —
+        # if a Stop landed during this sweep (desired_state != 'running'), do NOT spawn:
+        # the stop/ghost sweeps own the teardown. Without this, clicking Stop in the
+        # respawn window re-opens the terminal the user just closed (ghost). Fail OPEN
+        # (None = unreadable roster) so a transient RPC error can't freeze respawns.
+        _ds_now = _agent_desired_state_fresh(api_key, host_id, _target)
+        if _ds_now is not None and _ds_now != "running":
+            _log(f"SKIP {'recycle-' if _is_recycle else ''}respawn {_target}: desired_state="
+                 f"{_ds_now} on fresh pre-spawn re-read (Stop landed during this sweep) — "
+                 f"NOT opening a terminal. [respawn_blocked_reason=stopped_mid_sweep]")
+            _log_respawn_event(api_key, host_id, c,
+                               "recycle_respawn" if _is_recycle else "respawn",
+                               "failed", "stopped_mid_sweep",
+                               detail=f"desired_state={_ds_now} at pre-spawn re-read")
+            continue
         # DEAD-WINDOW REAP (task 70ac6d25, Samuel hit it twice 2026-06-09): an
         # exit-for-respawn rotation takes THIS plain-respawn path, and the old
         # window — whose launch script predates the .119 in-script self-closer,
@@ -1754,12 +1903,66 @@ def _discover_serve_pids(target: str) -> list:
     return _discover_serve_pids_ex(target)["pids"]
 
 
+def _serve_attributable_via_ancestor(p, target: str) -> bool:
+    """Version-AGNOSTIC serve attribution (task 07a571f8 [B]).
+
+    A serve's own cmdline (`python -m meshcode.meshcode_mcp serve`) carries no
+    target, so discovery normally attributes it by the serve's ENVIRON
+    (MESHCODE_PROJECT/MESHCODE_AGENT). But across an env/version split hostd
+    frequently cannot READ that environ — psutil raises AccessDenied on a
+    process running under a DIFFERENT venv python (hostd .144 vs the .145-env
+    serve). The old code's `except: continue` then silently dropped the serve →
+    serve_pids=0 → false crash_respawn over a still-live agent → doubles +
+    loop-drop (qa verify 0a75d094).
+
+    Fallback that needs NO environ: the serve's ANCESTOR chain contains the
+    `meshcode run <target>` wrapper, whose cmdline IS attributable via the same
+    strict whole-token regex (`_run_token_rx`) + cwd foreign-guard used for
+    agent-pid discovery. Split-proof, and strict enough that a sibling agent's
+    serve can never match. Best-effort; never raises."""
+    rx = _run_token_rx(target)
+    anc = None
+    try:
+        anc = p.parent()
+    except Exception:
+        anc = None
+    hops = 0
+    while anc is not None and hops < 6:
+        hops += 1
+        try:
+            acl = " ".join(anc.cmdline() or [])
+            if rx.search(acl):
+                try:
+                    acwd = anc.cwd() or ""
+                except Exception:
+                    acwd = ""
+                if not _bare_match_is_foreign(acl, acwd, target):
+                    return True
+        except Exception:
+            pass
+        try:
+            anc = anc.parent()
+        except Exception:
+            break
+    return False
+
+
 def _discover_serve_pids_ex(target: str) -> dict:
     """Instrumented serve discovery (task 89d50a14 [B]) — same result contract as
     _discover_agent_pids_ex. psutil-missing is errored=False (degraded BY DESIGN,
     documented since 14e0760c: the session-root tree kill still covers parented
     serves); the enumeration itself raising is errored=True (empty result is
-    untrustworthy → spawn decisions fail closed)."""
+    untrustworthy → spawn decisions fail closed).
+
+    VERSION-SPLIT HARDENING (task 07a571f8 [B]): attribution is no longer purely
+    environ-based. A serve whose environ is UNREADABLE (the cross-venv
+    AccessDenied that made the .145-env serve invisible to a .144 hostd) is
+    attributed via its `meshcode run <target>` ancestor instead
+    (_serve_attributable_via_ancestor) — version-agnostic. A real meshcode_mcp
+    serve we can NEITHER confirm (env/ancestor) NOR refute (env names a
+    different agent) is treated as AMBIGUOUS → errored=True so the SPAWN-AUDIT
+    fails CLOSED (skips the respawn) rather than respawning over a possibly-live
+    session. This is the fix for "serve_pids=0 across a split → false respawn"."""
     ps = _psutil()
     if ps is None:
         return {"pids": [], "errored": False, "path": "none(psutil-missing)", "error": ""}
@@ -1768,6 +1971,7 @@ def _discover_serve_pids_ex(target: str) -> dict:
         return {"pids": [], "errored": False, "path": "psutil", "error": ""}
     own = _own_pid()
     out = []
+    ambiguous = False
     try:
         for p in ps.process_iter():
             try:
@@ -1776,14 +1980,38 @@ def _discover_serve_pids_ex(target: str) -> dict:
                 cl = " ".join(p.cmdline() or [])
                 if "meshcode" not in cl or "serve" not in cl or "meshcode_mcp" not in cl:
                     continue
-                env = p.environ() or {}
-                if env.get("MESHCODE_AGENT") == agent and \
-                        (not proj or env.get("MESHCODE_PROJECT") == proj):
+                # Precise positive attribution by the serve's own env, when readable.
+                env = None
+                try:
+                    env = p.environ()
+                except Exception:
+                    env = None  # AccessDenied (cross-venv split) — fall through.
+                if env is not None:
+                    if env.get("MESHCODE_AGENT") == agent and \
+                            (not proj or env.get("MESHCODE_PROJECT") == proj):
+                        out.append(p.pid)
+                        continue
+                    if env.get("MESHCODE_AGENT"):
+                        continue  # env names a DIFFERENT agent — definitively not ours.
+                # env unreadable (or present without MESHCODE_AGENT): version-agnostic
+                # ancestor attribution before giving up.
+                if _serve_attributable_via_ancestor(p, target):
                     out.append(p.pid)
+                    continue
+                # A real meshcode_mcp serve we could neither confirm nor refute —
+                # only when its environ was UNREADABLE (the split signature). Never
+                # treat it as silently absent: mark ambiguous → fail closed below.
+                if env is None:
+                    ambiguous = True
             except Exception:
                 continue  # process vanished / access denied — never block the sweep
     except Exception as e:
         return {"pids": [], "errored": True, "path": "psutil", "error": f"psutil: {e!r}"}
+    if ambiguous and not out:
+        return {"pids": [], "errored": True, "path": "psutil",
+                "error": ("serve matched by cmdline but environ unreadable and no "
+                          "attributable `meshcode run <target>` ancestor — attribution "
+                          "ambiguous, failing closed (task 07a571f8 [B])")}
     return {"pids": out, "errored": False, "path": "psutil", "error": ""}
 
 
@@ -2243,8 +2471,6 @@ def _do_reap(api_key: str, host_id: str) -> int:
     if not cfg or not cfg.get("ok"):
         return 0
     agents = cfg.get("agents") or []
-    if not agents:
-        return 0
 
     def _alive(p) -> bool:
         if not p:
@@ -2332,6 +2558,62 @@ def _do_reap(api_key: str, host_id: str) -> int:
         elif now - float(first) >= _REAP_ORPHAN_GRACE_SEC:
             n += _reap(target, pid, f"deleted-agent orphan; alive {int(now-float(first))}s after roster removal")
             seen.pop(target, None)
+    # (D) STALE-ENV SERVE ORPHAN (version-split fix): an MCP serve process whose interpreter
+    # lives in ~/.meshcode/envs/<old_version>/ while the active installed version is different.
+    # These are leftovers from a version split: the agent relaunched on the new env but the old
+    # serve (child of the old claude session) keeps running, potentially with stale bindings.
+    # Reap them. DRY-RUN gated like everything else.
+    # Cross-platform: posix = .../envs/<ver>/bin/python3, win = ...\envs\<ver>\Scripts\python.exe.
+    # Use os.path.normcase for case-insensitive matching on Windows.
+    try:
+        import importlib.metadata as _ilmd
+        _active_ver = _ilmd.version("meshcode")
+    except Exception:
+        _active_ver = None
+    if _active_ver:
+        _envs_prefix = os.path.normcase(str(STATE_DIR / "envs"))
+        ps = _psutil()
+        if ps:
+            try:
+                for p in ps.process_iter():
+                    try:
+                        cl = " ".join(p.cmdline() or [])
+                        if "meshcode" not in cl or "serve" not in cl or "meshcode_mcp" not in cl:
+                            continue
+                        if p.pid == _own_pid():
+                            continue
+                        # Check if the interpreter (argv[0]) is from an old env
+                        _argv = p.cmdline() or []
+                        if not _argv:
+                            continue
+                        _interp = os.path.normcase(_argv[0])
+                        if _envs_prefix not in _interp:
+                            continue  # not running from a versioned env — skip (e.g. anaconda)
+                        # Extract version from path (separator-agnostic):
+                        # posix: .../envs/2.11.140/bin/python3
+                        # win:   ...\envs\2.11.140\Scripts\python.exe
+                        _env_ver = None
+                        try:
+                            _rest = _interp[len(_envs_prefix):]
+                            # Strip leading separators (/ or \)
+                            _rest = _rest.lstrip("/").lstrip("\\")
+                            # Split on either separator to get the version component
+                            import re as _re
+                            _parts = _re.split(r"[/\\]", _rest)
+                            _env_ver = _parts[0] if _parts and _parts[0] else None
+                        except Exception:
+                            pass
+                        if _env_ver and _env_ver != _active_ver:
+                            _env_info = p.environ() or {}
+                            _s_agent = _env_info.get("MESHCODE_AGENT", "?")
+                            _s_proj = _env_info.get("MESHCODE_PROJECT", "?")
+                            _s_target = f"{_s_proj}/{_s_agent}"
+                            n += _reap(_s_target, p.pid,
+                                       f"stale-env serve: interp={_env_ver}, active={_active_ver}")
+                    except Exception:
+                        continue
+            except Exception:
+                pass
     # prune grace clocks only for targets that are BOTH gone from the roster AND have no alive recorded PID
     for t in list(seen.keys()):
         if t not in live_targets and not _alive(pids.get(t)):

{meshcode-2.11.144 → meshcode-2.11.147}/meshcode/meshcode_mcp/server.py

@@ -7339,12 +7339,17 @@ def meshcode_seed_fixture(
     ttl_seconds: int = 3600,
 ) -> Dict[str, Any]:
     """Seed a fixture row in a whitelisted table for Playwright/verify.
-    MESH-IMPROVE-7 (mig 345). Whitelist: mc_tasks, mc_messages, mc_agents.
+    MESH-IMPROVE-7 (mig 345). Whitelist: mc_tasks, mc_messages, mc_agents, mc_agent_visits.
     Auto-swept after ttl_seconds (min 60). Pair with meshcode_release_fixture.
     """
-    if table not in ("mc_tasks", "mc_messages", "mc_agents"):
+    # Single source of truth so the docstring / guard / hint can't drift apart again
+    # (task 6cc2cabc — the literal was triplicated and went stale). mc_agent_visits added
+    # to sync with mig588 (mc_sweep_stale_agent_visits) for the agent-visit e2e; the
+    # server-side mc_seed_fixture RPC whitelist must allow it too (mesh-core task 64c73406).
+    _SEEDABLE = ("mc_tasks", "mc_messages", "mc_agents", "mc_agent_visits")
+    if table not in _SEEDABLE:
         return {"error": "table not seedable",
-                "hint": "whitelist: mc_tasks, mc_messages, mc_agents"}
+                "hint": "whitelist: " + ", ".join(_SEEDABLE)}
     return be.sb_rpc("mc_seed_fixture", {
         "p_api_key": _get_api_key(),
         "p_project_id": _PROJECT_ID,

{meshcode-2.11.144 → meshcode-2.11.147}/meshcode/up.py

@@ -139,8 +139,10 @@ def _launch_cmd(project: str, agent: str) -> str:
     if platform.system() == "Windows":
         # `set X=` clears; `&` chains; spawner wraps with cmd /c + self-closing
         # epilogue (task a4001d59 — tab closes itself on graceful exit/Stop)
+        # target is allowlist-validated upstream (cmd_up); double-quote it too so a
+        # cmd.exe metacharacter can never chain even if a future caller skips the gate.
         return (f'set "CLAUDECODE="&set "CLAUDE_CODE_SESSION="&'
-                f'set "MESHCODE_NO_AUTO_UPDATE=1"&{mc} run {target}')
+                f'set "MESHCODE_NO_AUTO_UPDATE=1"&{mc} run "{target}"')
     # POSIX: inline env assignments before the command
     return (f'CLAUDECODE= CLAUDE_CODE_SESSION= MESHCODE_NO_AUTO_UPDATE=1 '
             f'{shlex.quote(mc)} run {shlex.quote(target)}')
@@ -213,6 +215,18 @@ def cmd_up(args: List[str]) -> int:
                           "error_code": "no_roster", "project": project}))
         return 1
 
+    # C3 RCE GATE (task f9f4a2d3 / security_vuln_map): project + agent names flow into
+    # _launch_cmd -> a cmd.exe '&'-chain on Windows AND are registered into mc_agents
+    # (where hostd later respawns them). Hard-reject anything outside the strict allowlist
+    # HERE, before either sink — the same boundary cmd_launch_batch + run_agent enforce.
+    from meshcode.protocol_handler import is_valid_agent_name
+    _bad = [n for n in ([project, *agents]) if not is_valid_agent_name(n)]
+    if _bad:
+        print(json.dumps({"ok": False,
+                          "error": f"invalid project/agent name(s) rejected: {_bad}",
+                          "error_code": "invalid_name"}))
+        return 1
+
     host_id = _host_id()
     rmode, rvalue = _recycle_to_mode_value(recycle_arg) if recycle_arg else (None, None)
 

{meshcode-2.11.144 → meshcode-2.11.147}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.144
+Version: 2.11.147
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.144 → meshcode-2.11.147}/meshcode.egg-info/SOURCES.txt

@@ -73,6 +73,8 @@ tests/test_esc_deaf_state.py
 tests/test_exceptions.py
 tests/test_file_upload.py
 tests/test_helper_visuals.py
+tests/test_hostd_launch_pinned_env.py
+tests/test_hostd_serve_discovery_split.py
 tests/test_hostd_zombie_sessions.py
 tests/test_init_device_code.py
 tests/test_install_guard.py

{meshcode-2.11.144 → meshcode-2.11.147}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.144"
+version = "2.11.147"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}

meshcode-2.11.147/tests/test_hostd_launch_pinned_env.py

@@ -0,0 +1,127 @@
+"""Offline unit tests for the hostd launch-path version-split fix (task 07a571f8).
+
+Stdlib only (unittest + mock), zero network, zero real env builds. Contract:
+
+  THE BUG: hostd launches `meshcode run` via its OWN sys.executable. On
+  Samuel's box hostd ran the user-site install (2.11.144) while every agent's
+  .mcp.json pinned the immutable env (2.11.145), so the run-wrapper + the
+  prekill/dedup path ran STALE code — a PyPI fix did nothing until user-site
+  was manually upgraded (double-launches + loop-drop traced here).
+
+  THE FIX (_resolve_launch_python): resolve the SAME pinned env the agent's
+  MCP serve uses and launch the wrapper from there, with an OFFLINE-SAFE,
+  ALWAYS-LOGGED fallback to sys.executable on dev/opt-out/offline/build-fail.
+
+Asserts the decision matrix of _resolve_launch_python AND that _spawn_agent's
+emitted command actually invokes the resolved interpreter (not sys.executable)
+when a pin is available.
+"""
+import sys
+import unittest
+from unittest import mock
+
+from meshcode import hostd
+
+PINNED_PY = (r"C:\Users\Usuario\.meshcode\envs\2.11.145\Scripts\python.exe"
+             if sys.platform == "win32"
+             else "/home/u/.meshcode/envs/2.11.145/bin/python3")
+TARGET = "2.11.145"
+
+
+def _fake_su(**over):
+    """Build a fake self_update module with sane 'happy path' defaults."""
+    m = mock.MagicMock(name="self_update")
+    m.update_disabled.return_value = over.get("update_disabled", False)
+    m.is_editable_install.return_value = over.get("is_editable_install", False)
+    m.resolve_target_version.return_value = over.get("resolve_target_version", TARGET)
+    m.ensure_versioned_env.return_value = over.get("ensure_versioned_env", PINNED_PY)
+    m._env_version.return_value = over.get("_env_version", TARGET)
+    return m
+
+
+class ResolveLaunchPython(unittest.TestCase):
+    def _run(self, su, py_exists=True):
+        # Patch the lazily-imported `from meshcode import self_update as _su`.
+        with mock.patch.dict(sys.modules, {"meshcode.self_update": su}), \
+             mock.patch.object(hostd.Path, "exists", lambda self: py_exists):
+            return hostd._resolve_launch_python()
+
+    def test_happy_path_uses_pinned_env(self):
+        py, bindir, ver = self._run(_fake_su())
+        self.assertEqual(py, PINNED_PY)
+        self.assertEqual(ver, TARGET)
+        self.assertTrue(bindir)  # env's Scripts/bin dir, not empty
+
+    def test_editable_install_keeps_sys_executable(self):
+        py, _bindir, ver = self._run(_fake_su(is_editable_install=True))
+        self.assertEqual(py, sys.executable)
+        self.assertIsNone(ver)
+
+    def test_update_disabled_keeps_sys_executable(self):
+        py, _bindir, ver = self._run(_fake_su(update_disabled=True))
+        self.assertEqual(py, sys.executable)
+        self.assertIsNone(ver)
+
+    def test_offline_no_version_falls_back(self):
+        py, _bindir, ver = self._run(_fake_su(resolve_target_version=None))
+        self.assertEqual(py, sys.executable)
+        self.assertIsNone(ver)
+
+    def test_env_build_failure_falls_back(self):
+        py, _bindir, ver = self._run(_fake_su(ensure_versioned_env=None))
+        self.assertEqual(py, sys.executable)
+        self.assertIsNone(ver)
+
+    def test_stale_env_version_refused(self):
+        # env exists but reports a different version -> refuse-stale-spawn.
+        py, _bindir, ver = self._run(_fake_su(_env_version="2.11.144"))
+        self.assertEqual(py, sys.executable)
+        self.assertIsNone(ver)
+
+    def test_resolution_exception_falls_back(self):
+        broken = _fake_su()
+        broken.resolve_target_version.side_effect = RuntimeError("boom")
+        py, _bindir, ver = self._run(broken)
+        self.assertEqual(py, sys.executable)
+        self.assertIsNone(ver)
+
+
+class SpawnAgentUsesResolvedInterpreter(unittest.TestCase):
+    """_spawn_agent must put the RESOLVED interpreter in the terminal command,
+    never hostd's sys.executable, when a pin is available."""
+
+    def _capture_cmd(self, resolved):
+        captured = {}
+
+        def fake_spawn(cmd):
+            captured["cmd"] = cmd
+            return True, "fake-terminal"
+
+        fake_ph = mock.MagicMock()
+        fake_ph._spawn_terminal.side_effect = fake_spawn
+        with mock.patch.object(hostd, "_resolve_launch_python", return_value=resolved), \
+             mock.patch.object(hostd, "_validate_repo_path", return_value=None), \
+             mock.patch.dict(sys.modules, {"meshcode.protocol_handler": fake_ph}):
+            ok = hostd._spawn_agent("mesh-core", "qa")
+        return ok, captured.get("cmd", "")
+
+    def test_pinned_interpreter_in_command(self):
+        ok, cmd = self._capture_cmd((PINNED_PY, "BINDIR", TARGET))
+        self.assertTrue(ok)
+        self.assertIn(PINNED_PY, cmd)
+        self.assertIn("-m meshcode run", cmd)
+        # the user-site interpreter must NOT be what launches the wrapper
+        # (only meaningful when they differ, which is the whole bug).
+        if sys.executable != PINNED_PY:
+            self.assertNotIn(f'"{sys.executable}" -m meshcode run', cmd)
+            self.assertNotIn(f"exec {sys.executable} -m meshcode run", cmd)
+
+    def test_fallback_interpreter_in_command(self):
+        ok, cmd = self._capture_cmd((sys.executable, "BINDIR", None))
+        self.assertTrue(ok)
+        self.assertIn("-m meshcode run", cmd)
+        self.assertIn(sys.executable, cmd)
+
+
+if __name__ == "__main__":
+    unittest.main()