meshcode 2.11.145__tar.gz → 2.11.147__tar.gz

{meshcode-2.11.145 → meshcode-2.11.147}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.145
+Version: 2.11.147
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.145 → meshcode-2.11.147}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.145"
+__version__ = "2.11.147"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.145 → meshcode-2.11.147}/meshcode/hostd.py

@@ -534,6 +534,31 @@ def _host_cfg(api_key: str, host_id: str) -> Optional[dict]:
     return cfg
 
 
+def _agent_desired_state_fresh(api_key: str, host_id: str, target: str) -> Optional[str]:
+    """UNCACHED single-roster read of one target's current desired_state, for the
+    F1 stop-vs-respawn pre-spawn re-check (task 8d9950a7).
+
+    mc_agents_needing_respawn is read ONCE at the top of a respawn sweep; a Stop that
+    commits AFTER that read (mc_agent_power -> desired_state='stopped') is invisible to
+    the stale candidate snapshot, so hostd would re-open a terminal the user just closed
+    (ghost). This deliberately BYPASSES _host_cfg's per-sweep TTL cache (which can predate
+    the Stop) and hits mc_host_config_get directly so the re-check sees committed Stops.
+    Bounded cost: only candidates that pass every other guard reach this, capped by
+    _MAX_SPAWNS_PER_SWEEP (~2-3) per sweep.
+
+    Returns the desired_state string, or None if the roster can't be read / the agent is
+    absent — callers FAIL OPEN (the reordered stop sweep + _do_stopped_ghost_sweep are the
+    backstop; a transient roster-read error must not freeze all respawns)."""
+    cfg = _rpc("mc_host_config_get", {"p_api_key": api_key, "p_host_id": host_id})
+    if not cfg or not cfg.get("ok"):
+        return None
+    for a in (cfg.get("agents") or []):
+        proj, agent = a.get("project_name"), a.get("name")
+        if proj and agent and f"{proj}/{agent}" == target:
+            return a.get("desired_state")
+    return None
+
+
 # ------------------------------------------------------------------
 # Respawn
 # ------------------------------------------------------------------
@@ -596,6 +621,66 @@ def _validate_repo_path(rp) -> Optional[str]:
     return p
 
 
+def _default_bindir() -> str:
+    """bin/Scripts dir of hostd's own interpreter — the legacy PATH prepend."""
+    try:
+        return str(Path(sys.executable).resolve().parent)
+    except Exception:
+        return ""
+
+
+def _resolve_launch_python() -> tuple:
+    """Interpreter hostd should use to launch `meshcode run` (task 07a571f8).
+
+    THE version-split root cause: hostd's own ``sys.executable`` is whatever
+    python started the daemon — on Samuel's box that was the USER-SITE install
+    (2.11.144) while every agent's .mcp.json pinned the immutable env
+    (2.11.145). Launching ``meshcode run`` with ``sys.executable`` therefore ran
+    the STALE user-site code for the entire run-wrapper + prekill/dedup path, so
+    a perfect fix shipped to PyPI did NOTHING until user-site was manually
+    upgraded — the durable "fix exists but bug persists" trap, and the source of
+    Samuel's double-launches (stale hostd lacks the dedup fix) + loop-drop
+    (runtime != MESHCODE_EXPECTED_VERSION breaks the meshcode_* tool-bind).
+
+    Fix: resolve the SAME pinned env the agent's MCP serve already uses
+    (self_update.resolve_target_version -> ensure_versioned_env) and launch the
+    run-wrapper from THERE, so the launch path can never lag user-site.
+
+    Offline-safe fallback to ``sys.executable`` (legacy behavior) ONLY when the
+    pin cannot be resolved or built: editable/dev install, updates disabled,
+    offline (no version resolved), or env-build failure. We never hard-break a
+    spawn, but every fallback is LOGGED loudly so a silent split is impossible.
+
+    Returns ``(python_exe, bindir, pinned_version_or_None)``.
+    """
+    try:
+        from meshcode import self_update as _su
+        # Dev / opt-out installs: never repoint, keep current interpreter.
+        if _su.update_disabled() or _su.is_editable_install():
+            return sys.executable, _default_bindir(), None
+        target = _su.resolve_target_version()
+        if not target:
+            _log("launch-py: no target version resolved (offline?) -> "
+                 "sys.executable (legacy)")
+            return sys.executable, _default_bindir(), None
+        py = _su.ensure_versioned_env(target, verbose=False)
+        if py is None or not Path(py).exists():
+            _log(f"WARN: launch-py: could not build/resolve env for meshcode "
+                 f"{target} -> falling back to sys.executable ({sys.executable}); "
+                 f"possible version split until the env finalizes (hostd retries "
+                 f"on the next sweep)")
+            return sys.executable, _default_bindir(), None
+        # refuse-stale-spawn: never launch from an env that is not the target.
+        if _su._env_version(str(py)) != target:
+            _log(f"WARN: launch-py: env at {py} reports != {target} -> "
+                 f"sys.executable (legacy)")
+            return sys.executable, _default_bindir(), None
+        return str(py), str(Path(py).resolve().parent), target
+    except Exception as e:
+        _log(f"WARN: launch-py resolution failed ({e}) -> sys.executable")
+        return sys.executable, _default_bindir(), None
+
+
 def _spawn_agent(project: str, agent: str, repo_path=None) -> bool:
     """Relaunch `meshcode run <project>/<agent>` in a VISIBLE terminal window.
 
@@ -615,6 +700,16 @@ def _spawn_agent(project: str, agent: str, repo_path=None) -> bool:
     + the respawn RPC carry it.
     """
     target = f"{project}/{agent}"
+    # C3 RCE GATE (task f9f4a2d3): project/agent are interpolated into a cmd.exe '&'-chain
+    # (Windows) / POSIX shell below. Candidates originate from mc_agents_needing_respawn
+    # (DB-sourced) — a poisoned row must NEVER reach the shell. Same allowlist as the launch
+    # path; this is the sink-level backstop (covers every caller of _spawn_agent).
+    from meshcode.protocol_handler import is_valid_agent_name
+    if not (is_valid_agent_name(project) and is_valid_agent_name(agent)):
+        _log(f"WARN: refusing to spawn {target!r}: project/agent failed the "
+             f"is_valid_agent_name allowlist (shell-unsafe chars) — possible injection, "
+             f"NOT spawning. [spawn_blocked_reason=invalid_name]")
+        return False
     repo = _validate_repo_path(repo_path)
     # env hygiene (item1 RC): a stale CLAUDECODE aborts `meshcode run` (exit2). Build the terminal
     # command PER-PLATFORM (mesh-core FIX1, 0x80070002): cmd.exe uses & (NOT ';'), set "V=" to clear
@@ -624,12 +719,15 @@ def _spawn_agent(project: str, agent: str, repo_path=None) -> bool:
     # via `python -m meshcode` (NOT the .exe shim) so a bg `pip install -U` can replace meshcode.exe.
     # RELIABILITY (commander, REOPEN_PATH_bug): the VISIBLE spawn must also put the meshcode
     # console script on PATH (a8efddeb fixed only the headless branch). Without it the spawned
-    # agent + its `meshcode mcp` child die with "meshcode not on PATH". Prepend sys.executable's
-    # bin dir, mirroring the headless POSIX fix + the win32 venv-Scripts injection.
-    try:
-        _bindir = str(Path(sys.executable).resolve().parent)
-    except Exception:
-        _bindir = ""
+    # agent + its `meshcode mcp` child die with "meshcode not on PATH". Prepend the launch
+    # interpreter's bin dir, mirroring the headless POSIX fix + the win32 venv-Scripts injection.
+    # task 07a571f8: launch from the PINNED env python (not hostd's own sys.executable) so the
+    # run-wrapper can never lag user-site — _resolve_launch_python falls back to sys.executable
+    # (legacy) offline/dev/build-fail, always logging. _bindir follows the chosen interpreter so
+    # PATH + the meshcode console script match the runtime that actually serves.
+    _launch_py, _bindir, _pin_ver = _resolve_launch_python()
+    if _pin_ver:
+        _log(f"launch {target}: pinned env meshcode {_pin_ver} ({_launch_py})")
     if sys.platform == "win32":
         # repo already validated (no '"'/control chars, real dir) -> safe to double-quote.
         _repo_win = f' --repo "{repo}"' if repo else ''
@@ -640,14 +738,14 @@ def _spawn_agent(project: str, agent: str, repo_path=None) -> bool:
                # re-arming would override a human Stop clicked mid-spawn).
                f'set "MESHCODE_HOSTD_SPAWN=1" & '
                + (f'set "PATH={_bindir};%PATH%" & ' if _bindir else '')
-               + f'"{sys.executable}" -m meshcode run "{target}"{_repo_win}')
+               + f'"{_launch_py}" -m meshcode run "{target}"{_repo_win}')
     else:
         _repo_posix = f" --repo {shlex.quote(repo)}" if repo else ''
         cmd = (f"unset CLAUDECODE CLAUDE_CODE_SESSION MESHCODE_NO_UPDATE MESHCODE_NO_AUTO_UPDATE; "
                # task 01e2b5c1: see win32 branch — hostd spawns skip run-intent.
                + f"export MESHCODE_HOSTD_SPAWN=1; "
                + (f"export PATH={shlex.quote(_bindir)}:$PATH; " if _bindir else "")
-               + f"exec {shlex.quote(sys.executable)} -m meshcode run {shlex.quote(target)}{_repo_posix}")
+               + f"exec {shlex.quote(_launch_py)} -m meshcode run {shlex.quote(target)}{_repo_posix}")
     try:
         from meshcode import protocol_handler as _ph
         ok, info = _ph._spawn_terminal(cmd)
@@ -687,6 +785,10 @@ _DISCOVERY_ERR_LOGGED: set = set()
 # so the ORPHAN-CLAIM line prints once per agent instead of every ~10s sweep.
 _ORPHAN_CLAIMED_LOGGED: set = set()
 
+# C3 (task f9f4a2d3): names rejected by the is_valid_agent_name gate, logged once per
+# name per daemon session so a poisoned DB row raises a visible alert without flooding.
+_INVALID_NAME_LOGGED: set = set()
+
 
 def _do_respawns(api_key: str, host_id: str) -> int:
     """One respawn sweep. Returns number relaunched."""
@@ -740,6 +842,18 @@ def _do_respawns(api_key: str, host_id: str) -> int:
         proj, agent = c.get("project_name"), c.get("agent")
         if not proj or not agent:
             continue
+        # C3 RCE GATE (task f9f4a2d3): reject DB-sourced candidate names outside the strict
+        # allowlist BEFORE any reconcile/spawn — defense in depth with the _spawn_agent sink
+        # guard, and a clean once-per-name skip log so a poisoned row can't storm.
+        from meshcode.protocol_handler import is_valid_agent_name
+        if not (is_valid_agent_name(proj) and is_valid_agent_name(agent)):
+            _bn = f"{proj}/{agent}"
+            if _bn not in _INVALID_NAME_LOGGED:
+                _INVALID_NAME_LOGGED.add(_bn)
+                _log(f"SKIP respawn {proj!r}/{agent!r}: invalid project/agent name "
+                     f"(is_valid_agent_name allowlist) — refusing a shell-unsafe candidate. "
+                     f"[respawn_blocked_reason=invalid_name]")
+            continue
         if not c.get("respawn_allowed", True):
             # mig404: not allowed = rate-limited (<60s since last respawn) or at the cap.
             # mc_record_respawn v2 sets desired_state='crashed' ATOMICALLY at the cap, so we
@@ -1038,6 +1152,23 @@ def _do_respawns(api_key: str, host_id: str) -> int:
         # removed, task cba01de5), so this always runs for a recycle. (With the pre-spawn
         # reconciliation above this set is normally already empty — kept as backstop.)
         _old_vis_pids = _discover_agent_pids(_target) if _is_recycle else []
+        # F1 STOP-VS-RESPAWN re-check (task 8d9950a7): the candidate snapshot from
+        # mc_agents_needing_respawn was taken at the top of this sweep. Re-read
+        # desired_state FRESH (uncached) at the last moment before opening a terminal —
+        # if a Stop landed during this sweep (desired_state != 'running'), do NOT spawn:
+        # the stop/ghost sweeps own the teardown. Without this, clicking Stop in the
+        # respawn window re-opens the terminal the user just closed (ghost). Fail OPEN
+        # (None = unreadable roster) so a transient RPC error can't freeze respawns.
+        _ds_now = _agent_desired_state_fresh(api_key, host_id, _target)
+        if _ds_now is not None and _ds_now != "running":
+            _log(f"SKIP {'recycle-' if _is_recycle else ''}respawn {_target}: desired_state="
+                 f"{_ds_now} on fresh pre-spawn re-read (Stop landed during this sweep) — "
+                 f"NOT opening a terminal. [respawn_blocked_reason=stopped_mid_sweep]")
+            _log_respawn_event(api_key, host_id, c,
+                               "recycle_respawn" if _is_recycle else "respawn",
+                               "failed", "stopped_mid_sweep",
+                               detail=f"desired_state={_ds_now} at pre-spawn re-read")
+            continue
         # DEAD-WINDOW REAP (task 70ac6d25, Samuel hit it twice 2026-06-09): an
         # exit-for-respawn rotation takes THIS plain-respawn path, and the old
         # window — whose launch script predates the .119 in-script self-closer,
@@ -1772,12 +1903,66 @@ def _discover_serve_pids(target: str) -> list:
     return _discover_serve_pids_ex(target)["pids"]
 
 
+def _serve_attributable_via_ancestor(p, target: str) -> bool:
+    """Version-AGNOSTIC serve attribution (task 07a571f8 [B]).
+
+    A serve's own cmdline (`python -m meshcode.meshcode_mcp serve`) carries no
+    target, so discovery normally attributes it by the serve's ENVIRON
+    (MESHCODE_PROJECT/MESHCODE_AGENT). But across an env/version split hostd
+    frequently cannot READ that environ — psutil raises AccessDenied on a
+    process running under a DIFFERENT venv python (hostd .144 vs the .145-env
+    serve). The old code's `except: continue` then silently dropped the serve →
+    serve_pids=0 → false crash_respawn over a still-live agent → doubles +
+    loop-drop (qa verify 0a75d094).
+
+    Fallback that needs NO environ: the serve's ANCESTOR chain contains the
+    `meshcode run <target>` wrapper, whose cmdline IS attributable via the same
+    strict whole-token regex (`_run_token_rx`) + cwd foreign-guard used for
+    agent-pid discovery. Split-proof, and strict enough that a sibling agent's
+    serve can never match. Best-effort; never raises."""
+    rx = _run_token_rx(target)
+    anc = None
+    try:
+        anc = p.parent()
+    except Exception:
+        anc = None
+    hops = 0
+    while anc is not None and hops < 6:
+        hops += 1
+        try:
+            acl = " ".join(anc.cmdline() or [])
+            if rx.search(acl):
+                try:
+                    acwd = anc.cwd() or ""
+                except Exception:
+                    acwd = ""
+                if not _bare_match_is_foreign(acl, acwd, target):
+                    return True
+        except Exception:
+            pass
+        try:
+            anc = anc.parent()
+        except Exception:
+            break
+    return False
+
+
 def _discover_serve_pids_ex(target: str) -> dict:
     """Instrumented serve discovery (task 89d50a14 [B]) — same result contract as
     _discover_agent_pids_ex. psutil-missing is errored=False (degraded BY DESIGN,
     documented since 14e0760c: the session-root tree kill still covers parented
     serves); the enumeration itself raising is errored=True (empty result is
-    untrustworthy → spawn decisions fail closed)."""
+    untrustworthy → spawn decisions fail closed).
+
+    VERSION-SPLIT HARDENING (task 07a571f8 [B]): attribution is no longer purely
+    environ-based. A serve whose environ is UNREADABLE (the cross-venv
+    AccessDenied that made the .145-env serve invisible to a .144 hostd) is
+    attributed via its `meshcode run <target>` ancestor instead
+    (_serve_attributable_via_ancestor) — version-agnostic. A real meshcode_mcp
+    serve we can NEITHER confirm (env/ancestor) NOR refute (env names a
+    different agent) is treated as AMBIGUOUS → errored=True so the SPAWN-AUDIT
+    fails CLOSED (skips the respawn) rather than respawning over a possibly-live
+    session. This is the fix for "serve_pids=0 across a split → false respawn"."""
     ps = _psutil()
     if ps is None:
         return {"pids": [], "errored": False, "path": "none(psutil-missing)", "error": ""}
@@ -1786,6 +1971,7 @@ def _discover_serve_pids_ex(target: str) -> dict:
         return {"pids": [], "errored": False, "path": "psutil", "error": ""}
     own = _own_pid()
     out = []
+    ambiguous = False
     try:
         for p in ps.process_iter():
             try:
@@ -1794,14 +1980,38 @@ def _discover_serve_pids_ex(target: str) -> dict:
                 cl = " ".join(p.cmdline() or [])
                 if "meshcode" not in cl or "serve" not in cl or "meshcode_mcp" not in cl:
                     continue
-                env = p.environ() or {}
-                if env.get("MESHCODE_AGENT") == agent and \
-                        (not proj or env.get("MESHCODE_PROJECT") == proj):
+                # Precise positive attribution by the serve's own env, when readable.
+                env = None
+                try:
+                    env = p.environ()
+                except Exception:
+                    env = None  # AccessDenied (cross-venv split) — fall through.
+                if env is not None:
+                    if env.get("MESHCODE_AGENT") == agent and \
+                            (not proj or env.get("MESHCODE_PROJECT") == proj):
+                        out.append(p.pid)
+                        continue
+                    if env.get("MESHCODE_AGENT"):
+                        continue  # env names a DIFFERENT agent — definitively not ours.
+                # env unreadable (or present without MESHCODE_AGENT): version-agnostic
+                # ancestor attribution before giving up.
+                if _serve_attributable_via_ancestor(p, target):
                     out.append(p.pid)
+                    continue
+                # A real meshcode_mcp serve we could neither confirm nor refute —
+                # only when its environ was UNREADABLE (the split signature). Never
+                # treat it as silently absent: mark ambiguous → fail closed below.
+                if env is None:
+                    ambiguous = True
             except Exception:
                 continue  # process vanished / access denied — never block the sweep
     except Exception as e:
         return {"pids": [], "errored": True, "path": "psutil", "error": f"psutil: {e!r}"}
+    if ambiguous and not out:
+        return {"pids": [], "errored": True, "path": "psutil",
+                "error": ("serve matched by cmdline but environ unreadable and no "
+                          "attributable `meshcode run <target>` ancestor — attribution "
+                          "ambiguous, failing closed (task 07a571f8 [B])")}
     return {"pids": out, "errored": False, "path": "psutil", "error": ""}
 
 

{meshcode-2.11.145 → meshcode-2.11.147}/meshcode/meshcode_mcp/server.py

@@ -7339,12 +7339,17 @@ def meshcode_seed_fixture(
     ttl_seconds: int = 3600,
 ) -> Dict[str, Any]:
     """Seed a fixture row in a whitelisted table for Playwright/verify.
-    MESH-IMPROVE-7 (mig 345). Whitelist: mc_tasks, mc_messages, mc_agents.
+    MESH-IMPROVE-7 (mig 345). Whitelist: mc_tasks, mc_messages, mc_agents, mc_agent_visits.
     Auto-swept after ttl_seconds (min 60). Pair with meshcode_release_fixture.
     """
-    if table not in ("mc_tasks", "mc_messages", "mc_agents"):
+    # Single source of truth so the docstring / guard / hint can't drift apart again
+    # (task 6cc2cabc — the literal was triplicated and went stale). mc_agent_visits added
+    # to sync with mig588 (mc_sweep_stale_agent_visits) for the agent-visit e2e; the
+    # server-side mc_seed_fixture RPC whitelist must allow it too (mesh-core task 64c73406).
+    _SEEDABLE = ("mc_tasks", "mc_messages", "mc_agents", "mc_agent_visits")
+    if table not in _SEEDABLE:
         return {"error": "table not seedable",
-                "hint": "whitelist: mc_tasks, mc_messages, mc_agents"}
+                "hint": "whitelist: " + ", ".join(_SEEDABLE)}
     return be.sb_rpc("mc_seed_fixture", {
         "p_api_key": _get_api_key(),
         "p_project_id": _PROJECT_ID,

{meshcode-2.11.145 → meshcode-2.11.147}/meshcode/up.py

@@ -139,8 +139,10 @@ def _launch_cmd(project: str, agent: str) -> str:
     if platform.system() == "Windows":
         # `set X=` clears; `&` chains; spawner wraps with cmd /c + self-closing
         # epilogue (task a4001d59 — tab closes itself on graceful exit/Stop)
+        # target is allowlist-validated upstream (cmd_up); double-quote it too so a
+        # cmd.exe metacharacter can never chain even if a future caller skips the gate.
         return (f'set "CLAUDECODE="&set "CLAUDE_CODE_SESSION="&'
-                f'set "MESHCODE_NO_AUTO_UPDATE=1"&{mc} run {target}')
+                f'set "MESHCODE_NO_AUTO_UPDATE=1"&{mc} run "{target}"')
     # POSIX: inline env assignments before the command
     return (f'CLAUDECODE= CLAUDE_CODE_SESSION= MESHCODE_NO_AUTO_UPDATE=1 '
             f'{shlex.quote(mc)} run {shlex.quote(target)}')
@@ -213,6 +215,18 @@ def cmd_up(args: List[str]) -> int:
                           "error_code": "no_roster", "project": project}))
         return 1
 
+    # C3 RCE GATE (task f9f4a2d3 / security_vuln_map): project + agent names flow into
+    # _launch_cmd -> a cmd.exe '&'-chain on Windows AND are registered into mc_agents
+    # (where hostd later respawns them). Hard-reject anything outside the strict allowlist
+    # HERE, before either sink — the same boundary cmd_launch_batch + run_agent enforce.
+    from meshcode.protocol_handler import is_valid_agent_name
+    _bad = [n for n in ([project, *agents]) if not is_valid_agent_name(n)]
+    if _bad:
+        print(json.dumps({"ok": False,
+                          "error": f"invalid project/agent name(s) rejected: {_bad}",
+                          "error_code": "invalid_name"}))
+        return 1
+
     host_id = _host_id()
     rmode, rvalue = _recycle_to_mode_value(recycle_arg) if recycle_arg else (None, None)
 

{meshcode-2.11.145 → meshcode-2.11.147}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.145
+Version: 2.11.147
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.145 → meshcode-2.11.147}/meshcode.egg-info/SOURCES.txt

@@ -73,6 +73,8 @@ tests/test_esc_deaf_state.py
 tests/test_exceptions.py
 tests/test_file_upload.py
 tests/test_helper_visuals.py
+tests/test_hostd_launch_pinned_env.py
+tests/test_hostd_serve_discovery_split.py
 tests/test_hostd_zombie_sessions.py
 tests/test_init_device_code.py
 tests/test_install_guard.py

{meshcode-2.11.145 → meshcode-2.11.147}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.145"
+version = "2.11.147"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}

meshcode-2.11.147/tests/test_hostd_launch_pinned_env.py

@@ -0,0 +1,127 @@
+"""Offline unit tests for the hostd launch-path version-split fix (task 07a571f8).
+
+Stdlib only (unittest + mock), zero network, zero real env builds. Contract:
+
+  THE BUG: hostd launches `meshcode run` via its OWN sys.executable. On
+  Samuel's box hostd ran the user-site install (2.11.144) while every agent's
+  .mcp.json pinned the immutable env (2.11.145), so the run-wrapper + the
+  prekill/dedup path ran STALE code — a PyPI fix did nothing until user-site
+  was manually upgraded (double-launches + loop-drop traced here).
+
+  THE FIX (_resolve_launch_python): resolve the SAME pinned env the agent's
+  MCP serve uses and launch the wrapper from there, with an OFFLINE-SAFE,
+  ALWAYS-LOGGED fallback to sys.executable on dev/opt-out/offline/build-fail.
+
+Asserts the decision matrix of _resolve_launch_python AND that _spawn_agent's
+emitted command actually invokes the resolved interpreter (not sys.executable)
+when a pin is available.
+"""
+import sys
+import unittest
+from unittest import mock
+
+from meshcode import hostd
+
+PINNED_PY = (r"C:\Users\Usuario\.meshcode\envs\2.11.145\Scripts\python.exe"
+             if sys.platform == "win32"
+             else "/home/u/.meshcode/envs/2.11.145/bin/python3")
+TARGET = "2.11.145"
+
+
+def _fake_su(**over):
+    """Build a fake self_update module with sane 'happy path' defaults."""
+    m = mock.MagicMock(name="self_update")
+    m.update_disabled.return_value = over.get("update_disabled", False)
+    m.is_editable_install.return_value = over.get("is_editable_install", False)
+    m.resolve_target_version.return_value = over.get("resolve_target_version", TARGET)
+    m.ensure_versioned_env.return_value = over.get("ensure_versioned_env", PINNED_PY)
+    m._env_version.return_value = over.get("_env_version", TARGET)
+    return m
+
+
+class ResolveLaunchPython(unittest.TestCase):
+    def _run(self, su, py_exists=True):
+        # Patch the lazily-imported `from meshcode import self_update as _su`.
+        with mock.patch.dict(sys.modules, {"meshcode.self_update": su}), \
+             mock.patch.object(hostd.Path, "exists", lambda self: py_exists):
+            return hostd._resolve_launch_python()
+
+    def test_happy_path_uses_pinned_env(self):
+        py, bindir, ver = self._run(_fake_su())
+        self.assertEqual(py, PINNED_PY)
+        self.assertEqual(ver, TARGET)
+        self.assertTrue(bindir)  # env's Scripts/bin dir, not empty
+
+    def test_editable_install_keeps_sys_executable(self):
+        py, _bindir, ver = self._run(_fake_su(is_editable_install=True))
+        self.assertEqual(py, sys.executable)
+        self.assertIsNone(ver)
+
+    def test_update_disabled_keeps_sys_executable(self):
+        py, _bindir, ver = self._run(_fake_su(update_disabled=True))
+        self.assertEqual(py, sys.executable)
+        self.assertIsNone(ver)
+
+    def test_offline_no_version_falls_back(self):
+        py, _bindir, ver = self._run(_fake_su(resolve_target_version=None))
+        self.assertEqual(py, sys.executable)
+        self.assertIsNone(ver)
+
+    def test_env_build_failure_falls_back(self):
+        py, _bindir, ver = self._run(_fake_su(ensure_versioned_env=None))
+        self.assertEqual(py, sys.executable)
+        self.assertIsNone(ver)
+
+    def test_stale_env_version_refused(self):
+        # env exists but reports a different version -> refuse-stale-spawn.
+        py, _bindir, ver = self._run(_fake_su(_env_version="2.11.144"))
+        self.assertEqual(py, sys.executable)
+        self.assertIsNone(ver)
+
+    def test_resolution_exception_falls_back(self):
+        broken = _fake_su()
+        broken.resolve_target_version.side_effect = RuntimeError("boom")
+        py, _bindir, ver = self._run(broken)
+        self.assertEqual(py, sys.executable)
+        self.assertIsNone(ver)
+
+
+class SpawnAgentUsesResolvedInterpreter(unittest.TestCase):
+    """_spawn_agent must put the RESOLVED interpreter in the terminal command,
+    never hostd's sys.executable, when a pin is available."""
+
+    def _capture_cmd(self, resolved):
+        captured = {}
+
+        def fake_spawn(cmd):
+            captured["cmd"] = cmd
+            return True, "fake-terminal"
+
+        fake_ph = mock.MagicMock()
+        fake_ph._spawn_terminal.side_effect = fake_spawn
+        with mock.patch.object(hostd, "_resolve_launch_python", return_value=resolved), \
+             mock.patch.object(hostd, "_validate_repo_path", return_value=None), \
+             mock.patch.dict(sys.modules, {"meshcode.protocol_handler": fake_ph}):
+            ok = hostd._spawn_agent("mesh-core", "qa")
+        return ok, captured.get("cmd", "")
+
+    def test_pinned_interpreter_in_command(self):
+        ok, cmd = self._capture_cmd((PINNED_PY, "BINDIR", TARGET))
+        self.assertTrue(ok)
+        self.assertIn(PINNED_PY, cmd)
+        self.assertIn("-m meshcode run", cmd)
+        # the user-site interpreter must NOT be what launches the wrapper
+        # (only meaningful when they differ, which is the whole bug).
+        if sys.executable != PINNED_PY:
+            self.assertNotIn(f'"{sys.executable}" -m meshcode run', cmd)
+            self.assertNotIn(f"exec {sys.executable} -m meshcode run", cmd)
+
+    def test_fallback_interpreter_in_command(self):
+        ok, cmd = self._capture_cmd((sys.executable, "BINDIR", None))
+        self.assertTrue(ok)
+        self.assertIn("-m meshcode run", cmd)
+        self.assertIn(sys.executable, cmd)
+
+
+if __name__ == "__main__":
+    unittest.main()

meshcode-2.11.147/tests/test_hostd_serve_discovery_split.py

@@ -0,0 +1,149 @@
+"""Offline unit tests for the version-split serve-discovery hardening (task 07a571f8 [B]).
+
+Stdlib only, zero network. Contract under test (qa verify 0a75d094):
+
+  Across an env/version split, hostd cannot READ the .145-env serve's environ
+  (psutil AccessDenied on a cross-venv process). The OLD discovery silently
+  dropped it → serve_pids=0 → false crash_respawn over a still-live agent →
+  doubles + loop-drop. The FIX makes serve attribution version-AGNOSTIC:
+
+    1. environ readable + names THIS agent      -> counted (precise, unchanged)
+    2. environ readable + names ANOTHER agent   -> not ours (refuted, no noise)
+    3. environ UNREADABLE + `meshcode run <target>` ancestor -> counted (split-proof)
+    4. environ UNREADABLE + no attributable ancestor -> AMBIGUOUS -> errored=True
+       (SPAWN-AUDIT fails closed; never respawns over a possibly-live session)
+"""
+import sys
+import unittest
+from unittest import mock
+
+from meshcode import hostd
+
+HOSTD_PID = 10
+TARGET = "mesh-core/qa"
+SERVE_CMD = "python -m meshcode.meshcode_mcp serve"
+WRAP_CMD = 'python -m meshcode run "mesh-core/qa"'
+
+
+class _Proc:
+    def __init__(self, table, pid, ppid, cmdline, env=None, cwd="", env_raises=False):
+        self._t = table
+        self.pid = pid
+        self._ppid = ppid
+        self._cmdline = cmdline
+        self._env = env or {}
+        self._cwd = cwd
+        self._env_raises = env_raises
+
+    def cmdline(self):
+        return self._cmdline.split() if self._cmdline else []
+
+    def cwd(self):
+        return self._cwd
+
+    def environ(self):
+        if self._env_raises:
+            raise PermissionError("AccessDenied (cross-venv)")
+        return dict(self._env)
+
+    def parent(self):
+        p = self._t.procs.get(self._ppid)
+        return p if (p and p.pid in self._t.live) else None
+
+
+class _Psutil:
+    def __init__(self):
+        self.procs = {}
+        self.live = set()
+
+    def add(self, pid, ppid, cmdline, **kw):
+        self.procs[pid] = _Proc(self, pid, ppid, cmdline, **kw)
+        self.live.add(pid)
+        return self.procs[pid]
+
+    def process_iter(self):
+        return [p for p in self.procs.values() if p.pid in self.live]
+
+
+class ServeDiscoverySplit(unittest.TestCase):
+    def setUp(self):
+        self.ps = _Psutil()
+        self._patches = [
+            mock.patch.object(hostd, "_psutil", lambda: self.ps),
+            mock.patch.object(hostd, "_own_pid", lambda: HOSTD_PID),
+        ]
+        for p in self._patches:
+            p.start()
+
+    def tearDown(self):
+        for p in self._patches:
+            p.stop()
+
+    def test_env_readable_matching_agent_counted(self):
+        self.ps.add(100, HOSTD_PID, SERVE_CMD,
+                    env={"MESHCODE_PROJECT": "mesh-core", "MESHCODE_AGENT": "qa"})
+        d = hostd._discover_serve_pids_ex(TARGET)
+        self.assertEqual(d["pids"], [100])
+        self.assertFalse(d["errored"])
+
+    def test_env_readable_other_agent_refuted(self):
+        self.ps.add(101, HOSTD_PID, SERVE_CMD,
+                    env={"MESHCODE_PROJECT": "mesh-core", "MESHCODE_AGENT": "frontend"})
+        d = hostd._discover_serve_pids_ex(TARGET)
+        self.assertEqual(d["pids"], [])
+        self.assertFalse(d["errored"])  # cleanly not-ours, no ambiguity
+
+    def test_split_env_unreadable_attributed_via_ancestor(self):
+        # The .145-env serve: environ AccessDenied, but its parent is the
+        # `meshcode run mesh-core/qa` wrapper -> split-proof attribution.
+        self.ps.add(200, HOSTD_PID, WRAP_CMD, cwd="/home/u/meshcode/mesh-core-qa")
+        self.ps.add(201, 200, SERVE_CMD, env_raises=True)
+        d = hostd._discover_serve_pids_ex(TARGET)
+        self.assertEqual(d["pids"], [201])
+        self.assertFalse(d["errored"])
+
+    def test_split_env_unreadable_no_ancestor_fails_closed(self):
+        # Orphaned serve, environ unreadable, no `run <target>` ancestor:
+        # ambiguous -> errored=True so SPAWN-AUDIT skips the respawn.
+        self.ps.add(300, HOSTD_PID, SERVE_CMD, env_raises=True)
+        d = hostd._discover_serve_pids_ex(TARGET)
+        self.assertEqual(d["pids"], [])
+        self.assertTrue(d["errored"])
+        self.assertIn("ambiguous", d["error"])
+
+    def test_ambiguous_with_a_confirmed_pid_does_not_error(self):
+        # A confirmed serve already blocks the spawn (still_alive non-empty),
+        # so an additional ambiguous serve must NOT discard the good pid.
+        self.ps.add(400, HOSTD_PID, SERVE_CMD,
+                    env={"MESHCODE_PROJECT": "mesh-core", "MESHCODE_AGENT": "qa"})
+        self.ps.add(401, HOSTD_PID, SERVE_CMD, env_raises=True)
+        d = hostd._discover_serve_pids_ex(TARGET)
+        self.assertEqual(d["pids"], [400])
+        self.assertFalse(d["errored"])
+
+    def test_sibling_wrapper_ancestor_not_matched(self):
+        # serve whose only ancestor runs a DIFFERENT agent must not be attributed
+        # to qa (strict whole-token regex) -> ambiguous (env unreadable) -> errored.
+        self.ps.add(500, HOSTD_PID, 'python -m meshcode run "mesh-core/frontend"',
+                    cwd="/home/u/meshcode/mesh-core-frontend")
+        self.ps.add(501, 500, SERVE_CMD, env_raises=True)
+        d = hostd._discover_serve_pids_ex(TARGET)
+        self.assertEqual(d["pids"], [])
+        self.assertTrue(d["errored"])
+
+    def test_non_serve_processes_ignored(self):
+        self.ps.add(600, HOSTD_PID, 'python -m meshcode run "mesh-core/qa"')  # wrapper, not a serve
+        self.ps.add(601, HOSTD_PID, "claude --foo")
+        d = hostd._discover_serve_pids_ex(TARGET)
+        self.assertEqual(d["pids"], [])
+        self.assertFalse(d["errored"])
+
+    def test_psutil_missing_degraded_not_errored(self):
+        with mock.patch.object(hostd, "_psutil", lambda: None):
+            d = hostd._discover_serve_pids_ex(TARGET)
+        self.assertEqual(d["pids"], [])
+        self.assertFalse(d["errored"])
+
+
+if __name__ == "__main__":
+    unittest.main()

{meshcode-2.11.145 → meshcode-2.11.147}/tests/test_security_regressions.py

@@ -226,3 +226,57 @@ class TestP1_4_LaunchBatchAgentNameRCE:
         assert sink is not None, "cmd_launch_batch shell-interpolation sink not found (test stale?)"
         assert guard_pos < sink.start(), \
             "SECURITY: is_valid_agent_name is checked AFTER the shell interpolation — RCE boundary broken"
+
+
+class TestC3_UpAndHostdSpawnRCE:
+    """C3 (task f9f4a2d3): two MORE sinks interpolate names into a cmd.exe '&'-chain and
+    were ungated (only cmd_launch_batch + run_agent validated):
+      - `meshcode up` -> up.cmd_up -> _launch_cmd  (PoC: `meshcode up p --agents 'a&calc'`)
+      - hostd._do_respawns -> _spawn_agent  (DB-sourced candidates from mc_agents_needing_respawn)
+    Lock the is_valid_agent_name gate at each sink + the Windows quoting so the fix can't regress."""
+
+    _UP = Path(__file__).parent.parent / "meshcode" / "up.py"
+    _HOSTD = Path(__file__).parent.parent / "meshcode" / "hostd.py"
+
+    @staticmethod
+    def _func_body(path: Path, name: str) -> str:
+        src = path.read_text(errors="replace")
+        start = src.index(f"def {name}")
+        nxt = src.find("\ndef ", start + 1)
+        return src[start:nxt if nxt > 0 else len(src)]
+
+    def test_cmd_up_validates_before_launch_and_db(self):
+        body = self._func_body(self._UP, "cmd_up")
+        assert "is_valid_agent_name" in body, \
+            "SECURITY: cmd_up does not gate names with is_valid_agent_name"
+        guard = body.index("is_valid_agent_name")
+        # must precede BOTH sinks: the shell launch AND the DB register (hostd respawns from it).
+        assert guard < body.index("_launch_cmd("), \
+            "SECURITY: cmd_up validates AFTER _launch_cmd — shell sink unprotected"
+        db = body.find("mc_host_set_agents")
+        if db != -1:
+            assert guard < db, \
+                "SECURITY: cmd_up validates AFTER registering names to mc_agents — respawn sink unprotected"
+
+    def test_launch_cmd_quotes_windows_target(self):
+        body = self._func_body(self._UP, "_launch_cmd")
+        assert 'run "{target}"' in body, \
+            "SECURITY: _launch_cmd Windows branch does not quote target — cmd.exe '&'-chain breakout"
+
+    def test_hostd_spawn_agent_validates_before_shell(self):
+        body = self._func_body(self._HOSTD, "_spawn_agent")
+        assert "is_valid_agent_name" in body, \
+            "SECURITY: _spawn_agent does not gate project/agent with is_valid_agent_name"
+        assert body.index("is_valid_agent_name") < body.index("-m meshcode run"), \
+            "SECURITY: _spawn_agent validates AFTER building the run command — RCE boundary broken"
+
+    def test_hostd_do_respawns_validates_candidates(self):
+        body = self._func_body(self._HOSTD, "_do_respawns")
+        assert "is_valid_agent_name" in body, \
+            "SECURITY: _do_respawns does not gate DB-sourced candidate names"
+
+    def test_c3_payloads_rejected_by_shared_gate(self):
+        from meshcode.protocol_handler import is_valid_agent_name
+        for payload in ('a&calc', 'x"&calc&', 'a&calc&', '-rf', '$(id)', 'a;b', 'a b'):
+            assert not is_valid_agent_name(payload), \
+                f"SECURITY: C3 payload not rejected by the shared gate: {payload!r}"

{meshcode-2.11.145 → meshcode-2.11.147}/tests/test_terminal_lifecycle.py

@@ -144,3 +144,44 @@ class TestGap3BootGrace:
             raise OSError("no ps")
         monkeypatch.setattr(hostd.subprocess, "run", boom)
         assert hostd._pid_age_s(123) >= 1e9
+
+
+class TestF1StopVsRespawn:
+    """Stop-vs-respawn race (task 8d9950a7): mc_agents_needing_respawn is read once
+    per sweep; a Stop committing during the sweep must NOT be re-opened (ghost)."""
+
+    def test_helper_reads_desired_state_uncached(self):
+        import inspect
+        src = inspect.getsource(hostd._agent_desired_state_fresh)
+        code = re.sub(r'""".*?"""', "", src, count=1, flags=re.DOTALL)
+        assert "mc_host_config_get" in code, "fresh re-read must hit the roster RPC"
+        assert "_host_cfg" not in code, (
+            "must BYPASS the per-sweep TTL cache (a Stop can post-date the cached roster)")
+        assert "desired_state" in code
+
+    def test_helper_returns_state_and_fails_open(self, monkeypatch):
+        roster = {"ok": True, "agents": [
+            {"project_name": "mesh-dev", "name": "back", "desired_state": "stopped"},
+            {"project_name": "mesh-dev", "name": "front", "desired_state": "running"}]}
+        monkeypatch.setattr(hostd, "_rpc", lambda fn, args=None: roster)
+        assert hostd._agent_desired_state_fresh("k", "h", "mesh-dev/back") == "stopped"
+        assert hostd._agent_desired_state_fresh("k", "h", "mesh-dev/front") == "running"
+        # absent agent -> None (caller fails open)
+        assert hostd._agent_desired_state_fresh("k", "h", "mesh-dev/ghost") is None
+        # errored / not-ok roster -> None (caller fails open, never freezes respawns)
+        monkeypatch.setattr(hostd, "_rpc", lambda fn, args=None: {"ok": False})
+        assert hostd._agent_desired_state_fresh("k", "h", "mesh-dev/back") is None
+
+    def test_respawn_rechecks_desired_state_before_spawn(self):
+        import inspect
+        src = inspect.getsource(hostd._do_respawns)
+        assert "_agent_desired_state_fresh" in src, (
+            "_do_respawns must re-read desired_state before opening a terminal")
+        recheck = src.index("_agent_desired_state_fresh")
+        spawn = src.index("_spawn_agent(")
+        assert recheck < spawn, "the fresh re-read must come BEFORE the spawn call"
+        # the guard must SKIP (continue) when no longer desired-running
+        guard = src[recheck:spawn]
+        assert '!= "running"' in guard and "continue" in guard, (
+            "a non-running fresh state must skip the spawn (no ghost terminal)")
+        assert "stopped_mid_sweep" in guard, "skip must be traceable in hostd.log"