meshcode 2.11.148__tar.gz → 2.11.150__tar.gz

{meshcode-2.11.148 → meshcode-2.11.150}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.148
+Version: 2.11.150
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.148 → meshcode-2.11.150}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.148"
+__version__ = "2.11.150"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.148 → meshcode-2.11.150}/meshcode/hostd.py

@@ -265,6 +265,24 @@ _RESPAWN_CONVERGE_BLOCK_TTL_S = _env_int("MESHCODE_RESPAWN_CONVERGE_BLOCK_TTL_SE
 _RESPAWN_FRESH_CLICK_S        = _env_int("MESHCODE_RESPAWN_FRESH_CLICK_SEC", 90, 30)       # spawned_age_s under this = explicit Start click
 _RESPAWN_BOOT_GRACE_S         = _env_int("MESHCODE_RESPAWN_BOOT_GRACE_SEC", 90, 30)        # gap 3: a live pid younger than this is BOOTING — a fresh Start must not kill it
 
+# ------------------------------------------------------------------
+# ABSOLUTE no-confirmed-boot cap (task c9d6b819, chief pt3 — macOS terminal
+# storm 2026-06-19: ian's screen flooded with ~40 dead Terminal windows). The
+# CONVERGENCE guard above is CLEARED by an explicit Start (_fresh_click), and the
+# server-side respawn cap RESETS when a slow agent heartbeats briefly (count->0).
+# So a target whose spawned_at keeps re-stamping (idempotent restart_requested)
+# or that briefly boots every sweep evades BOTH and keeps opening windows. macOS
+# made it worse: `open -a Terminal` returns rc==0 the instant LaunchServices
+# accepts — the window opens, the agent inside dies, the 150s sweep re-qualifies
+# it, and a NEW window opens each time. This backstop is cadence- AND
+# click-INDEPENDENT: it counts EVERY plain respawn of a target in a rolling
+# window and, past the cap, BLOCKS — and unlike convergence an explicit Start
+# does NOT clear it (a Start that merely re-storms is the exact bug). The window
+# elapsing with no further respawn = the agent finally stayed up (confirmed boot)
+# -> state resets. Hard ceiling = _RESPAWN_ABS_CAP spawns / _RESPAWN_ABS_WINDOW_S.
+_RESPAWN_ABS_CAP        = _env_int("MESHCODE_RESPAWN_ABS_CAP", 8, 3)              # max plain respawns/target before the absolute block
+_RESPAWN_ABS_WINDOW_S   = _env_int("MESHCODE_RESPAWN_ABS_WINDOW_SEC", 3600, 600)  # rolling window; elapsing with no respawn = confirmed boot -> reset
+
 # ------------------------------------------------------------------
 # WEDGE WATCHDOG (gap 4 respawn storm, task e5978f32): incident 2026-06-10 —
 # hostd sat WEDGED ~6h after a DNS failure and nothing restarted it. Root
@@ -986,6 +1004,36 @@ def _do_respawns(api_key: str, host_id: str) -> int:
         if not _is_recycle:
             _now2 = time.time()
             _st2 = _load_state()
+            # ABS-CAP CHECK (chief pt3): cadence/click-independent backstop the
+            # convergence guard + server cap both miss. Evaluated BEFORE the
+            # _fresh_click clearing below so an explicit Start can NEVER loosen it.
+            # window_start elapsing past the window with no new respawn = the agent
+            # stayed up = confirmed boot -> reset to a fresh, unblocked window.
+            _abs_all = dict(_st2.get("respawn_abs") or {})
+            _abs = dict(_abs_all.get(_target) or {})
+            _abs_start = float(_abs.get("window_start") or 0)
+            if not _abs_start or (_now2 - _abs_start) > _RESPAWN_ABS_WINDOW_S:
+                _abs = {"window_start": _now2, "count": 0}
+                _abs_all[_target] = _abs
+                _st2["respawn_abs"] = _abs_all
+                _save_state(_st2)
+            if int(_abs.get("count", 0)) >= _RESPAWN_ABS_CAP:
+                _log(f"ABS-CAP {_target}: {_abs.get('count')} respawns in <= {_RESPAWN_ABS_WINDOW_S}s "
+                     f"with no sustained boot — BLOCKING (cadence/click-independent; an explicit "
+                     f"Start does NOT clear it; resets only after the window elapses with the agent "
+                     f"staying up). [respawn_blocked_reason=respawn_abs_cap]")
+                try:  # kill the dashboard 'launching…' spinner with an actionable toast
+                    _rpc("mc_resolve_launch", {
+                        "p_api_key": api_key, "p_project_id": c.get("project_id"), "p_agent": agent,
+                        "p_status": "failed", "p_reason": "respawn_abs_cap",
+                        "p_detail": f"agent respawned {_abs.get('count')}x without staying up — auto-launch "
+                                    f"paused to stop a terminal storm; fix the boot (Claude Code login `claude` "
+                                    f"/ env), then press Start."})
+                except Exception:
+                    pass
+                _log_respawn_event(api_key, host_id, c, "respawn", "failed", "respawn_abs_cap",
+                                   detail=f"{_abs.get('count')} respawns within {_RESPAWN_ABS_WINDOW_S}s, no sustained boot — abs-cap block")
+                continue
             try:
                 _fresh_click = float(c.get("spawned_age_s")) < _RESPAWN_FRESH_CLICK_S
             except (TypeError, ValueError):
@@ -1201,6 +1249,19 @@ def _do_respawns(api_key: str, host_id: str) -> int:
                                    detail=f"stale {c.get('heartbeat_age_s')}s")
                 n += 1
                 continue
+            # ABS-CAP INCREMENT (chief pt3): count this plain respawn against the
+            # absolute, click-independent ceiling. Recycle path excluded — it
+            # `continue`d above and has its own convergence guard. Separate
+            # load/save cycle: the guard-block _st2 was already saved by now.
+            _abs_st = _load_state()
+            _abs_all2 = dict(_abs_st.get("respawn_abs") or {})
+            _abs2 = dict(_abs_all2.get(_target) or {})
+            if not _abs2.get("window_start"):
+                _abs2["window_start"] = time.time()
+            _abs2["count"] = int(_abs2.get("count", 0)) + 1
+            _abs_all2[_target] = _abs2
+            _abs_st["respawn_abs"] = _abs_all2
+            _save_state(_abs_st)
             rec = _rpc("mc_record_respawn",
                        {"p_api_key": api_key, "p_project_id": c.get("project_id"), "p_agent_name": agent})
             # gap 3 telemetry: post-record count when the RPC returns it (the candidate's
@@ -2761,7 +2822,12 @@ def _hostd_install_windows() -> int:
         'set "MESHCODE_NO_UPDATE=1"\r\n'        # var honored pre-2.11.74 (belt-and-suspenders)
         'set "MESHCODE_NO_AUTO_UPDATE=1"\r\n'   # unified var (honored 2.11.74+)
         'set "MESHCODE_HOSTD_POLL_SEC=10"\r\n'  # faster click->spawn (default 10s, floor 3)
-        f'"{mc}" hostd run\r\n',
+        # F1a (task 48c3f294): launch the SUPERVISOR, not `hostd run` directly.
+        # The supervisor owns + revives hostd on CRASH — the recovery the HKCU\Run
+        # tier (login-only) lacks (that was the dead launch button on Samuel's box).
+        # It self-singletons, so the Task-Scheduler periodic watchdog tier above
+        # can also point here without ever double-starting.
+        f'"{mc}" hostd supervise\r\n',
         encoding="utf-8",
     )
     # Register-ScheduledTask (PowerShell) — ROBUST KEEP-ALIVE (task 843f282c CRITICAL: hostd died ~15:04
@@ -3074,6 +3140,163 @@ def _acquire_hostd_singleton():
         return (None, "error")
 
 
+# ------------------------------------------------------------------
+# hostd SUPERVISOR (task 48c3f294 / F1a — Windows crash+reboot revive). The only
+# non-admin Windows persistence that works on locked-down boxes (Samuel's) is
+# HKCU\Run, which fires ONLY at login: a hostd that CRASHES mid-session is never
+# revived = the dead launch button. This supervisor is a SEPARATE, minimal
+# process that OWNS a `hostd run` child and restarts it on exit — the crash
+# recovery HKCU\Run lacks. Separate process, NOT hostd self-forking: an early
+# hostd crash (import error / startup fault) before any in-process fork would
+# otherwise never be revived. COMPOSES with hostd's in-process wedge watchdog
+# (process-STUCK self-restart via execv); this is the process-GONE half.
+# Anti-storm: the restart loop mirrors the absolute respawn cap (5618ac17) — a
+# hostd that crash-loops WITHOUT ever staying up is STOPPED after a ceiling and
+# its status written to hostd-supervisor.state, so the supervisor can never
+# become the storm it guards against. macOS (launchd KeepAlive) + Linux (systemd
+# Restart=on-failure) already get crash-revive, so this is win32-only in practice.
+# ------------------------------------------------------------------
+_SUP_LOCK_FH = None
+_SUP_STATE_PATH = STATE_DIR / "hostd-supervisor.state"
+_SUP_CONFIRMED_BOOT_S = _env_int("MESHCODE_SUP_CONFIRMED_BOOT_SEC", 120, 30)  # child up >= this = confirmed boot -> reset cap
+_SUP_ABS_CAP          = _env_int("MESHCODE_SUP_ABS_CAP", 5, 2)                # crash-restarts w/o confirmed boot before STOP
+_SUP_ABS_WINDOW_S     = _env_int("MESHCODE_SUP_ABS_WINDOW_SEC", 3600, 300)    # rolling window
+_SUP_BACKOFF_BASE_S   = _env_int("MESHCODE_SUP_BACKOFF_BASE_SEC", 5, 1)       # exp backoff base between crash restarts
+_SUP_BACKOFF_MAX_S    = _env_int("MESHCODE_SUP_BACKOFF_MAX_SEC", 300, 10)     # backoff ceiling
+_SUP_POLL_S           = _env_int("MESHCODE_SUP_POLL_SEC", 5, 1)               # poll cadence while a hostd is already alive
+
+
+def _flock_probe_held(lock_path: Path) -> bool:
+    """True if a LIVE process holds an exclusive flock/msvcrt lock on lock_path.
+    Non-destructive try-acquire-release — robust vs the informational pid inside
+    the lock file (which can be stale after a hard kill). Used to detect a live
+    hostd before the supervisor spawns one (never double-start)."""
+    try:
+        fh = open(lock_path, "a+")
+    except Exception:
+        return False  # can't evaluate -> assume free (supervisor errs toward having a hostd)
+    try:
+        if sys.platform == "win32":
+            import msvcrt
+            fh.seek(0)
+            try:
+                msvcrt.locking(fh.fileno(), msvcrt.LK_NBLCK, 1)
+            except OSError:
+                return True  # held by a live process
+            try:
+                msvcrt.locking(fh.fileno(), msvcrt.LK_UNLCK, 1)
+            except OSError:
+                pass
+            return False
+        import fcntl
+        try:
+            fcntl.flock(fh.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except OSError:
+            return True
+        fcntl.flock(fh.fileno(), fcntl.LOCK_UN)
+        return False
+    finally:
+        fh.close()
+
+
+def _acquire_supervisor_singleton():
+    """One supervisor per machine — flock/msvcrt on hostd-supervisor.lock, held
+    for the process lifetime, OS-released on ANY death (no stale-lock problem;
+    same field-tested mechanism as _acquire_hostd_singleton — addresses the
+    SPOC's 'O_EXCL leaves a stale lock after a hard kill' note). Returns the fh
+    on success, None if another live supervisor already holds it."""
+    try:
+        STATE_DIR.mkdir(parents=True, exist_ok=True)
+        fh = open(STATE_DIR / "hostd-supervisor.lock", "a+")
+    except Exception:
+        return None
+    try:
+        if sys.platform == "win32":
+            import msvcrt
+            fh.seek(0)
+            msvcrt.locking(fh.fileno(), msvcrt.LK_NBLCK, 1)
+        else:
+            import fcntl
+            fcntl.flock(fh.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+    except OSError:
+        fh.close()
+        return None
+    try:
+        fh.seek(0)
+        fh.truncate()
+        fh.write(str(os.getpid()))
+        fh.flush()
+    except Exception:
+        pass
+    return fh
+
+
+def _sup_write_state(state: str, reason: str = "", restart_count: int = 0) -> None:
+    """Persist supervisor status to hostd-supervisor.state — the data source for
+    the F1b dashboard-liveness UX (FE reads it to surface 'hostd stopped/looping'
+    instead of a silently dead daemon). Best-effort."""
+    try:
+        _SUP_STATE_PATH.write_text(json.dumps({
+            "state": state, "reason": reason, "restart_count": restart_count,
+            "pid": os.getpid(), "ts": int(time.time()),
+        }), encoding="utf-8")
+    except Exception:
+        pass
+
+
+def _hostd_supervise() -> int:
+    """Supervisor loop: own a `hostd run` child and revive it on crash, with an
+    absolute no-confirmed-boot cap so a crash-loop can't storm. See the block
+    comment above for the full rationale."""
+    fh = _acquire_supervisor_singleton()
+    if fh is None:
+        _log("hostd supervisor already running (hostd-supervisor.lock held) — exiting (singleton)")
+        return 0
+    global _SUP_LOCK_FH
+    _SUP_LOCK_FH = fh
+    _log("hostd supervisor started — owning + reviving `hostd run` (F1a)")
+    argv = _hostd_run_argv()
+    restarts: list = []  # spawn timestamps that did NOT reach a confirmed boot
+    while True:
+        # NEVER double-start: if a live hostd already holds hostd.lock (a manual
+        # `hostd run`, or an orphan that outlived a prior supervisor), don't spawn
+        # — wait for it to free. Without this, hostd's own singleton would make
+        # our child exit 0 instantly and we'd read that as a crash and loop.
+        if _flock_probe_held(STATE_DIR / "hostd.lock"):
+            _sup_write_state("running", "hostd_already_live", len(restarts))
+            time.sleep(_SUP_POLL_S)
+            continue
+        now = time.time()
+        restarts = [t for t in restarts if now - t < _SUP_ABS_WINDOW_S]
+        if len(restarts) >= _SUP_ABS_CAP:
+            _sup_write_state("stopped", "abs_cap_crash_loop", len(restarts))
+            _log(f"SUPERVISOR ABS-CAP: hostd crash-looped {len(restarts)}x in <= {_SUP_ABS_WINDOW_S}s "
+                 f"without staying up >= {_SUP_CONFIRMED_BOOT_S}s — STOPPING (a fresh `meshcode hostd "
+                 f"install` re-arms). Wrote {_SUP_STATE_PATH.name} for the dashboard.")
+            return 0
+        start = time.time()
+        restarts.append(start)
+        _sup_write_state("running", "spawning_hostd", len(restarts))
+        try:
+            proc = subprocess.Popen(argv, stdin=subprocess.DEVNULL)
+        except Exception as e:
+            backoff = min(_SUP_BACKOFF_MAX_S, _SUP_BACKOFF_BASE_S * (2 ** (len(restarts) - 1)))
+            _log(f"supervisor: failed to spawn hostd ({e}) — retry in {backoff}s")
+            time.sleep(backoff)
+            continue
+        rc = proc.wait()  # authoritative: the hostd process is GONE
+        uptime = time.time() - start
+        if uptime >= _SUP_CONFIRMED_BOOT_S:
+            restarts = []  # stayed up long enough = confirmed boot -> reset the cap
+            backoff = _SUP_BACKOFF_BASE_S
+            _log(f"hostd exited rc={rc} after {int(uptime)}s (confirmed boot) — restart in {backoff}s")
+        else:
+            backoff = min(_SUP_BACKOFF_MAX_S, _SUP_BACKOFF_BASE_S * (2 ** (len(restarts) - 1)))
+            _log(f"hostd exited rc={rc} after {int(uptime)}s (no confirmed boot, "
+                 f"{len(restarts)}/{_SUP_ABS_CAP}) — restart in {backoff}s")
+        time.sleep(backoff)
+
+
 def cmd_hostd(args: list) -> int:
     """Entry point for `meshcode hostd ...`."""
     if not args or args[0] in ("-h", "--help"):
@@ -3098,6 +3321,12 @@ def cmd_hostd(args: list) -> int:
     if sub == "uninstall":
         return _hostd_uninstall()
 
+    if sub == "supervise":
+        # F1a (task 48c3f294): own + revive `hostd run`. The Windows non-admin
+        # autostart (HKCU\Run) points here so a mid-session hostd CRASH is revived,
+        # not just a login. Not for macOS/Linux (launchd/systemd already revive).
+        return _hostd_supervise()
+
     if sub == "run":
         if not api_key:
             _log("FATAL: no api key — run `meshcode login` (key is read from the keychain)")

{meshcode-2.11.148 → meshcode-2.11.150}/meshcode/meshcode_mcp/server.py

@@ -969,15 +969,6 @@ _current_tool = ""
 _IDLE_THRESHOLD_S = 120  # seconds without tool call → IDLE
 _SLEEPING_THRESHOLD_S = 300  # seconds in waiting without activity → SLEEPING
 _WORKING_COOLDOWN_S = 60  # seconds after last tool returns before flipping to ONLINE
-
-# ── P1 heartbeat throttle (2.11.148) ──
-# When status+task haven't changed, skip the full mc_agents UPDATE and
-# write only a cheap mc_heartbeats ping.  Idle agents go from ~every 5s
-# full-row writes to ~every 15s, staying under the 20s-live / 90s-offline
-# thresholds while cutting Realtime fan-out ~3×.
-_HB_THROTTLE_S = 15.0
-_hb_last_state: "tuple[str, str] | None" = None
-_hb_last_full_write: float = 0.0
 _working_timer: Optional[_threading.Timer] = None
 
 
@@ -2573,18 +2564,8 @@ def _heartbeat_loop_inner():
             # no longer wired to a status write.
 
             # Sync current state to DB (in case realtime missed it)
-            # P1 throttle (2.11.148): skip full mc_agents UPDATE when state
-            # hasn't changed recently — write cheap mc_heartbeats only.
-            global _hb_last_state, _hb_last_full_write
-            _hb_cur = (_current_state, _current_tool)
-            _hb_now = _time.monotonic()
             try:
-                if _hb_cur == _hb_last_state and (_hb_now - _hb_last_full_write) < _HB_THROTTLE_S:
-                    be.heartbeat(_PROJECT_ID, AGENT_NAME)
-                else:
-                    be.set_status(_PROJECT_ID, AGENT_NAME, _current_state, _current_tool, api_key=_get_api_key())
-                    _hb_last_state = _hb_cur
-                    _hb_last_full_write = _hb_now
+                be.set_status(_PROJECT_ID, AGENT_NAME, _current_state, _current_tool, api_key=_get_api_key())
             except Exception as e:
                 log.warning(f"status sync failed (agent may show stale status): {e}")
             # Realtime subscription recovery: if the WebSocket is connected but
@@ -6477,19 +6458,11 @@ def meshcode_boot() -> Dict[str, Any]:
                     _overdue.append(_t)
                 else:
                     _due_today.append(_t)
-            def _compact_due(_t):
-                return {
-                    "id": str(_t.get("id", ""))[:8],
-                    "title": str(_t.get("title", ""))[:80],
-                    "due_at": _t.get("due_at"),
-                    "priority": _t.get("priority"),
-                }
-            _due_all = _due_today + _overdue
             calendar_block = {
                 "pending_due_today": len(_due_today),
                 "overdue": len(_overdue),
-                "next_due": (_compact_due(_due_all[0]) if _due_all else None),
-                "due_tasks": [_compact_due(_t) for _t in _due_all],
+                "next_due": (_due_today[0] if _due_today else (_overdue[0] if _overdue else None)),
+                "due_tasks": _due_today + _overdue,
             }
             resp["calendar_context"] = calendar_block
     except Exception:

{meshcode-2.11.148 → meshcode-2.11.150}/meshcode/protocol_handler.py

@@ -52,6 +52,8 @@ _MAX_BATCH = 32                                   # hard cap: agents spawned / c
 _LAUNCH_COOLDOWN_S = 30                            # min seconds between same-agent spawns
 _LIVE_HEARTBEAT_S = 20                             # heartbeat age < this = agent live
 _COOLDOWN_FILE = Path.home() / ".meshcode" / "launch_cooldown.json"
+_SPAWN_VERIFY_GRACE_S = 0.4                        # child must survive this long to count as launched
+_MACOS_SPAWN_MARKER_GRACE_S = 6.0                  # macOS: poll this long for the launcher's start-marker (open -a rc==0 alone proves nothing)
 
 
 def is_valid_agent_name(name: str) -> bool:
@@ -567,6 +569,7 @@ LAUNCH="$HOME/.meshcode/launchers"
 SPOOL="$LAUNCH/fleet-spool"
 LOCK="$LAUNCH/fleet-native-lock"
 ALIVE="$LAUNCH/fleet-native-alive"
+DISABLED="$LAUNCH/fleet-native-disabled"
 MYTTY="$1"
 exec >>"$LAUNCH/fleet-native.log" 2>&1
 mkdir -p "$SPOOL"
@@ -585,10 +588,29 @@ done
 trap 'rm -rf "$LOCK"; exit 0' EXIT HUP TERM INT
 echo "[watcher] $$ holds lock (tty $MYTTY)"
 N=0
+# flood fix 61e5fbf0: bound tabs opened per drain cycle so a refilled spool can
+# never burst the screen; excess entries wait for the next ~1s cycle.
+DRAIN_CAP=5
 while :; do
   date +%s > "$ALIVE"
+  # KILL-SWITCH (flood fix 61e5fbf0): honor fleet-native-disabled. A fresh
+  # disable/back-off flag STOPS the watcher entirely (clean exit via the trap),
+  # instead of looping forever draining whatever refills the spool — the STOP
+  # this path lacked during ian's terminal flood.
+  if [ -f "$DISABLED" ]; then
+    DAGE=$(( $(date +%s) - $(stat -f %m "$DISABLED" 2>/dev/null || echo 0) ))
+    if [ "$DAGE" -lt 1800 ]; then
+      echo "[watcher] fleet-native-disabled fresh (${DAGE}s) — exiting watcher (flood kill-switch)"
+      exit 0
+    fi
+  fi
+  OPENED=0
   for f in "$SPOOL"/*.cmd; do
     [ -e "$f" ] || continue
+    if [ "$OPENED" -ge "$DRAIN_CAP" ]; then
+      echo "[watcher] drain cap $DRAIN_CAP/cycle hit — deferring remaining spool to next cycle"
+      break
+    fi
     CMD="$(cat "$f")"
     BASE="${f%.cmd}"
     echo "[watcher] tab spawn: $CMD"
@@ -599,6 +621,7 @@ while :; do
       echo fallback > "$BASE.done"
     fi
     rm -f "$f"
+    OPENED=$((OPENED+1))
   done
   N=$((N+1))
   if [ $((N % 300)) -eq 0 ]; then
@@ -615,6 +638,14 @@ done
     return p["watcher"]
 
 
+def _fleet_spawn_marker(cmd: str) -> Path:
+    """Per-label start-marker for the fleet-native anchor (verified-spawn pt1,
+    task afbbb9cf). Distinct from _spawn_terminal_macos's spawn_alive_<label> so
+    the two macOS paths never clobber each other's marker. The fleet agent
+    launcher touches this as its first action; the anchor producer polls it."""
+    return Path.home() / ".meshcode" / f"spawn_alive_fleet_{_launcher_label(cmd)}"
+
+
 def _write_fleet_native_agent(cmd: str) -> Path:
     """Write the per-agent fleet command file (runs the agent inside its
     native tab; offers to become watcher; close-tab=stop; clean exits close
@@ -635,6 +666,11 @@ def _write_fleet_native_agent(cmd: str) -> Path:
     lines = [
         "#!/bin/bash",
         'cd "$HOME" 2>/dev/null || cd /',
+        # start-marker (verified-spawn pt1, task afbbb9cf): the anchor producer
+        # polls this to confirm the window/shell actually came up — `open -a
+        # Terminal` rc==0 alone proves nothing. Spooled tabs touch it too (harmless;
+        # only the anchor path consumes it).
+        f': > {shlex.quote(str(_fleet_spawn_marker(cmd)))} 2>/dev/null || true',
         rf"printf '\033]0;{title}\007\033]1;{title}\007'",
     ]
     if venv_bin:
@@ -712,10 +748,30 @@ def _spawn_fleet_native_macos(cmd: str) -> tuple[bool, str]:
                 p["pending"].touch()
             except OSError:
                 pass
+            # clear any stale start-marker so the poll below only sees a FRESH one
+            marker = _fleet_spawn_marker(cmd)
+            try:
+                marker.unlink()
+            except OSError:
+                pass
             r = subprocess.run(["open", "-a", "Terminal", str(agent_file)],
                                capture_output=True, text=True)
             if r.returncode == 0:
-                return True, "terminal(fleet-native-anchor)"
+                # VERIFIED SPAWN (pt1, task afbbb9cf): `open -a Terminal` returns
+                # rc==0 the instant LaunchServices accepts — it does NOT prove the
+                # anchor window/shell came up. Poll for the launcher's start-marker;
+                # a LaunchServices no-op now returns honest False (caller cascades to
+                # the tmux fleet bar / legacy windows) instead of a cooldown-poisoning
+                # lie. Twin of the _spawn_terminal_macos fix.
+                deadline = time.monotonic() + _MACOS_SPAWN_MARKER_GRACE_S
+                while time.monotonic() < deadline:
+                    if marker.exists():
+                        return True, "terminal(fleet-native-anchor)"
+                    time.sleep(0.1)
+                if marker.exists():
+                    return True, "terminal(fleet-native-anchor)"
+                return False, (f"fleet-native anchor: open returned 0 but window never "
+                               f"started within {_MACOS_SPAWN_MARKER_GRACE_S}s")
             return False, (r.stderr or "open failed").strip()
         # an anchor is booting — wait for its watcher before spooling
         deadline = time.time() + 25
@@ -724,8 +780,17 @@ def _spawn_fleet_native_macos(cmd: str) -> tuple[bool, str]:
         if _alive_age() > 8:
             return False, "fleet-native anchor never came alive"
 
-    sp = p["spool"] / f"{time.time_ns()}-{_launcher_label(cmd)}.cmd"
+    # DEDUP (flood fix 61e5fbf0): spool keyed by LABEL, NOT time_ns. The old
+    # `{time_ns}-{label}.cmd` minted a UNIQUE file every call, so re-Launching the
+    # same agent stacked N entries and the watcher opened N tabs with no dedup —
+    # ian's ~40-window flood (Samuel re-enabling Launch kept refilling the spool).
+    # A label key means a re-Launch OVERWRITES the single pending entry; and if an
+    # entry for this label is still pending (watcher hasn't drained it), we don't
+    # write a duplicate at all.
+    sp = p["spool"] / f"{_launcher_label(cmd)}.cmd"
     done = sp.with_suffix(".done")
+    if sp.exists():
+        return True, "fleet-native-queued (already pending — dedup)"
     try:
         sp.write_text(f"/bin/bash {shlex.quote(str(agent_file))}\n", encoding="utf-8")
     except Exception as e:
@@ -786,9 +851,19 @@ def _spawn_terminal_macos(cmd: str) -> tuple[bool, str]:
         venv_bin = ""
     # Stable launcher path (debuggable, reused across spawns; not /tmp).
     launch_dir = Path.home() / ".meshcode" / "launchers"
-    script_path = launch_dir / f"{_launcher_label(cmd)}.command"
+    _label = _launcher_label(cmd)
+    script_path = launch_dir / f"{_label}.command"
+    # SPAWN-START MARKER (fix c9d6b819, chief pt1): `open -a Terminal` returns rc==0
+    # the instant LaunchServices accepts the request — it does NOT prove the window
+    # came up or the launcher shell ran. The launcher touches this marker as its
+    # FIRST action; after `open` we poll for it, so a LaunchServices no-op becomes
+    # an honest (False, reason) instead of a cooldown-poisoning lie (the macOS twin
+    # of the Linux/Win _verified_popen fix). Cleared just before `open` so a stale
+    # marker from a prior spawn can't read as success.
+    marker_path = Path.home() / ".meshcode" / f"spawn_alive_{_label}"
     lines = ["#!/bin/bash",
-             'cd "$HOME" 2>/dev/null || cd /']   # neutral, non-TCC-protected cwd
+             'cd "$HOME" 2>/dev/null || cd /',   # neutral, non-TCC-protected cwd
+             f': > {shlex.quote(str(marker_path))} 2>/dev/null || true']  # start-marker (verified-spawn pt1)
     # HELPER VISUALS (task d8f8e325): amber background + helper: title before
     # the agent boots. Terminal.app ignores OSC 11 (title still applies);
     # iTerm2 honors both. Silent-degrade by construction (`|| true`).
@@ -859,21 +934,89 @@ def _spawn_terminal_macos(cmd: str) -> tuple[bool, str]:
         os.chmod(script_path, 0o755)
     except Exception as e:
         return False, f"could not write launcher {script_path}: {e}"
+    # Clear any stale start-marker so the poll below can only see a FRESH one
+    # written by the launcher we are about to open (verified-spawn pt1).
+    try:
+        marker_path.unlink()
+    except FileNotFoundError:
+        pass
+    except Exception:
+        pass
+
+    def _marker_came_up() -> bool:
+        # Poll for the launcher's start-marker: its presence proves the window
+        # opened and the launcher shell ran its first line (open -a rc==0 does
+        # NOT). Generous grace — `: > marker` is the shell's first action, so
+        # even a loaded box stamps it in well under a second; absence after the
+        # grace means LaunchServices accepted but no window/shell ever ran.
+        deadline = time.monotonic() + _MACOS_SPAWN_MARKER_GRACE_S
+        while time.monotonic() < deadline:
+            if marker_path.exists():
+                return True
+            time.sleep(0.1)
+        return marker_path.exists()
+
     # `open -a <App> <file>` activates the app + brings it to the FRONT (focused).
     # NEVER bare `open <file>` / `-g`: those can open in the background → looks like
     # "nothing happened" (same class of bug as the Windows `-w new` focus fix).
     r = subprocess.run(["open", "-a", app, str(script_path)],
                        capture_output=True, text=True)
-    if r.returncode == 0:
+    if r.returncode == 0 and _marker_came_up():
         return True, term
-    err = (r.stderr or "open failed").strip()
+    err = (r.stderr or "open failed").strip() if r.returncode != 0 else \
+        f"open -a {app} returned 0 but window never started within {_MACOS_SPAWN_MARKER_GRACE_S}s"
     # Last-ditch: plain `open` lets LaunchServices pick the .command handler
     # (still no AppleScript). A background window beats no window.
     r2 = subprocess.run(["open", str(script_path)], capture_output=True, text=True)
-    if r2.returncode == 0:
+    if r2.returncode == 0 and _marker_came_up():
         return True, f"{term}(open-default)"
+    r2err = (r2.stderr or "open failed").strip() if r2.returncode != 0 else \
+        f"open returned 0 but window never started within {_MACOS_SPAWN_MARKER_GRACE_S}s"
     return False, (f"open -a {app} failed ({err}); "
-                   f"open fallback failed ({(r2.stderr or '').strip()})")
+                   f"open fallback failed ({r2err})")
+
+
+def _verified_popen(argv: list, **popen_kwargs) -> tuple[bool, str]:
+    """Popen `argv`, then give the child a short grace period and report whether
+    it ACTUALLY launched — instead of the old fire-and-`return True` that lied on
+    Win/Linux (launch-reliability root cause, front diag task 1e4dba20, fix 809d3b37).
+
+    A silent spawn failure used to surface as ok=True, which poisoned the 30s
+    DEDUP-2 cooldown (stamped on the lie) and showed the user NO error: "I click
+    Start, nothing happens, and clicking again does nothing for ~30s." Verifying
+    the spawn turns those into honest skipped rows the FE already renders, and —
+    because the cooldown in cmd_launch_batch is only stamped when ok is True —
+    automatically stops a failed launch from blocking its own retry.
+
+    Outcome rules (the rc==0 case is the correctness subtlety):
+      - Popen itself raises (e.g. binary missing) -> (False, reason).
+      - child still alive after the grace -> (True, "") — a foreground terminal
+        (xterm/konsole/wt-new-window) that owns the session for its lifetime.
+      - child exits rc==0 within the grace -> (True, "") — a HAND-OFF launcher
+        that did its job and quit: gnome-terminal's client/daemon model and
+        Windows `cmd /c start` / `wt` (signals the existing fleet window) both
+        exit 0 immediately even though the window opened. Treating that as a
+        failure would false-negative every gnome-terminal/Windows launch.
+      - child exits rc!=0 within the grace -> (False, "exited rc=N") — the only
+        true spawn failure (bad terminal args, display error, no DISPLAY, ...).
+
+    stderr is intentionally NOT piped: a foreground terminal lives for the whole
+    agent session, and an unread PIPE would deadlock it once it writes >64KB of
+    warnings. rc alone is a sufficient skip reason; richer diagnostics live in
+    the per-candidate exception strings the callers already build.
+    """
+    popen_kwargs.setdefault("start_new_session", True)
+    try:
+        proc = subprocess.Popen(argv, **popen_kwargs)
+    except Exception as e:
+        return False, f"popen failed: {e}"
+    try:
+        rc = proc.wait(timeout=_SPAWN_VERIFY_GRACE_S)
+    except subprocess.TimeoutExpired:
+        return True, ""              # still alive after grace = launched
+    if rc == 0:
+        return True, ""              # clean hand-off (gnome-terminal / start / wt)
+    return False, f"exited rc={rc}"  # died immediately = real spawn failure
 
 
 def _spawn_terminal_linux(cmd: str) -> tuple[bool, str]:
@@ -895,13 +1038,18 @@ def _spawn_terminal_linux(cmd: str) -> tuple[bool, str]:
         ("xterm",          ["xterm", "-e", f"bash -lc {shlex.quote(cmd)}"]),
         ("xfce4-terminal", ["xfce4-terminal", "-e", f"bash -lc {shlex.quote(cmd)}"]),
     ]
+    last_err = ""
     for name, argv in candidates:
         if shutil.which(name):
-            try:
-                subprocess.Popen(argv, start_new_session=True)
+            # Verify the emulator actually came up: a failed Popen here used to
+            # `return True` and poison the cooldown (root-cause fix 809d3b37).
+            ok, info = _verified_popen(argv)
+            if ok:
                 return True, name
-            except Exception as e:
-                return False, f"{name}: {e}"
+            last_err = f"{name}: {info}"
+            # try the next available emulator rather than lying about success
+    if last_err:
+        return False, last_err
     return False, "no terminal emulator found (tried gnome-terminal/konsole/xterm/xfce4)"
 
 
@@ -978,6 +1126,7 @@ def _spawn_terminal_windows(cmd: str) -> tuple[bool, str]:
     # See _windows_session_launcher for the full close-path contract (and why
     # a one-liner wrapper is impossible: cmd /c outer-quote stripping).
     script = str(_windows_session_launcher(cmd))
+    wt_err = ""
     if wt:
         try:
             # FLEET TABS (task 2ac3f111, supersedes 35bee961's `-w new` AND the
@@ -1018,19 +1167,24 @@ def _spawn_terminal_windows(cmd: str) -> tuple[bool, str]:
                     _title = _hv.helper_title(label)
             except Exception:
                 pass
-            subprocess.Popen([wt, "-w", "meshcode-fleet", "nt",
+            ok, info = _verified_popen([wt, "-w", "meshcode-fleet", "nt",
                               *_helper_args,
                               "--title", _title,
                               "--suppressApplicationTitle",
                               "cmd", "/c", script.replace(";", "\\;")])
-            return True, "wt(fleet-tab)"
+            if ok:
+                return True, "wt(fleet-tab)"
+            # wt started then died (Samuel's box: the ';' split -> 0x80070002).
+            # Do NOT report success — that poisoned the 30s cooldown and showed
+            # no error (root-cause fix 809d3b37). Fall through to the cmd.exe
+            # path so the agent still gets a window instead of a silent no-op.
+            wt_err = f"wt.exe: {info}"
         except Exception as e:
-            return False, f"wt.exe: {e}"
-    try:
-        subprocess.Popen(["cmd.exe", "/c", "start", "cmd", "/c", script])
+            wt_err = f"wt.exe: {e}"
+    ok, info = _verified_popen(["cmd.exe", "/c", "start", "cmd", "/c", script])
+    if ok:
         return True, "cmd"
-    except Exception as e:
-        return False, f"cmd.exe: {e}"
+    return False, "; ".join(x for x in (wt_err, f"cmd.exe: {info}") if x)
 
 
 def _spawn_terminal(cmd: str) -> tuple[bool, str]:

{meshcode-2.11.148 → meshcode-2.11.150}/meshcode/run_agent.py

@@ -843,6 +843,78 @@ def _preflight_heartbeat(agent: str, project: str) -> None:
         print(f"[meshcode]   Pre-flight heartbeat skipped: {e}", file=sys.stderr)
 
 
+def _report_launch_failure(agent: str, project: str, reason: str, detail: str) -> None:
+    """Editor spawn failed AFTER the pre-flight heartbeat already marked the
+    agent online — revert the ghost 'online' row to offline and tell the
+    dashboard WHY (launch-reliability fix 809d3b37, factors C + H).
+
+    This replaces a broken inline block in run()'s FileNotFoundError handler
+    that referenced `api_key`/`project_id` — names that are never bound in
+    run()'s scope — so the very RPC meant to surface "claude not installed"
+    raised NameError and was swallowed by a bare `except`, leaving the agent
+    a ghost 'online' with no diagnostic. Resolving the creds here (mirroring
+    _preflight_heartbeat) makes the failure path actually report.
+
+    Best-effort: any failure is logged and swallowed — an error handler must
+    never raise.
+    """
+    try:
+        from .setup_clients import _load_supabase_env
+        import importlib
+        secrets_mod = importlib.import_module("meshcode.secrets")
+        from urllib.request import Request, urlopen
+
+        profile = os.environ.get("MESHCODE_KEYCHAIN_PROFILE") or "default"
+        api_key = secrets_mod.get_api_key(profile=profile)
+        if not api_key:
+            return
+
+        sb = _load_supabase_env()
+        headers = {
+            "apikey": sb["SUPABASE_KEY"],
+            "Authorization": f"Bearer {sb['SUPABASE_KEY']}",
+            "Content-Type": "application/json",
+            "Content-Profile": "meshcode",
+        }
+
+        resolve_body = json.dumps({"p_api_key": api_key, "p_project_name": project})
+        req = Request(
+            f"{sb['SUPABASE_URL']}/rest/v1/rpc/mc_resolve_project",
+            data=resolve_body.encode(), method="POST", headers=headers,
+        )
+        with urlopen(req, timeout=5) as resp:
+            proj_data = json.loads(resp.read().decode())
+        project_id = proj_data.get("project_id") if proj_data else None
+        if not project_id:
+            return
+
+        # 1) Tell the dashboard why the launch failed (actionable toast).
+        try:
+            from .comms_v4 import sb_rpc as _rpc_resolve
+            _rpc_resolve("mc_resolve_launch", {
+                "p_api_key": api_key, "p_project_id": project_id, "p_agent": agent,
+                "p_status": "failed", "p_reason": reason, "p_detail": detail})
+        except Exception:
+            pass
+
+        # 2) Revert the ghost 'online' the pre-flight heartbeat stamped (factor C).
+        status_body = json.dumps({
+            "p_api_key": api_key,
+            "p_project_id": project_id,
+            "p_agent_name": agent,
+            "p_status": "offline",
+            "p_task": f"launch failed: {reason}",
+        })
+        status_req = Request(
+            f"{sb['SUPABASE_URL']}/rest/v1/rpc/mc_agent_set_status_by_api_key",
+            data=status_body.encode(), method="POST", headers=headers,
+        )
+        with urlopen(status_req, timeout=5) as resp:
+            resp.read()
+    except Exception as e:
+        print(f"[meshcode]   Launch-failure report skipped: {e}", file=sys.stderr)
+
+
 # Repo-scoped launch (task 24e3dd44 / core-commander launch-diff). When `meshcode run
 # <agent> --repo <path>` is used, the agent boots with cwd=repo (not the meshcode
 # workspace), so its repo CLAUDE.md loads — we carry the boot protocol via
@@ -1543,16 +1615,15 @@ def run(agent: str, project: Optional[str] = None, editor_override: Optional[str
     except FileNotFoundError:
         print(f"[meshcode] ERROR: '{editor}' not found in PATH", file=sys.stderr)
         # task 843f282c Phase 2: tell the dashboard WHY (claude_not_installed) so the pending launch
-        # toast fires with an actionable message instead of spinning forever. Best-effort.
-        try:
-            from .comms_v4 import sb_rpc as _rpc_resolve
-            _rpc_resolve("mc_resolve_launch", {
-                "p_api_key": api_key, "p_project_id": project_id, "p_agent": agent,
-                "p_status": "failed", "p_reason": "claude_not_installed",
-                "p_detail": f"'{editor}' not found in PATH — install: npm i -g @anthropic-ai/claude-code"})
-        except Exception:
-            pass
+        # toast fires with an actionable message instead of spinning forever. Also reverts the
+        # pre-flight ghost 'online' (fix 809d3b37 H+C — the old inline block referenced unbound
+        # api_key/project_id and crashed with NameError, swallowed silently).
+        _report_launch_failure(
+            agent, resolved_project, "claude_not_installed",
+            f"'{editor}' not found in PATH — install: npm i -g @anthropic-ai/claude-code")
         return 127
     except Exception as e:
         print(f"[meshcode] ERROR launching {editor}: {e}", file=sys.stderr)
+        # Any other spawn failure also stranded a ghost 'online' (fix 809d3b37 C).
+        _report_launch_failure(agent, resolved_project, "launch_error", str(e)[:200])
         return 1

{meshcode-2.11.148 → meshcode-2.11.150}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.148
+Version: 2.11.150
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.148 → meshcode-2.11.150}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.148"
+version = "2.11.150"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}

{meshcode-2.11.148 → meshcode-2.11.150}/tests/test_helper_visuals.py

@@ -102,6 +102,9 @@ class WindowsSpawnTests(unittest.TestCase):
              mock.patch.object(ph, "_windows_session_launcher",
                                lambda c: ph.Path("C:\\u\\.meshcode\\launchers\\x.cmd")), \
              mock.patch.object(ph.subprocess, "Popen") as popen:
+            # _verified_popen (fix 809d3b37) waits a grace period; a live
+            # terminal survives it -> TimeoutExpired == launched.
+            popen.return_value.wait.side_effect = ph.subprocess.TimeoutExpired("wt", 0.4)
             ok, info = ph._spawn_terminal_windows(cmd)
         self.assertTrue(ok)
         return popen.call_args[0][0]
@@ -132,6 +135,9 @@ class LinuxSpawnTests(unittest.TestCase):
         with mock.patch.object(ph.shutil, "which",
                                lambda n: "/usr/bin/gnome-terminal" if n == "gnome-terminal" else None), \
              mock.patch.object(ph.subprocess, "Popen") as popen:
+            # _verified_popen (fix 809d3b37) waits a grace period; a live
+            # terminal survives it -> TimeoutExpired == launched.
+            popen.return_value.wait.side_effect = ph.subprocess.TimeoutExpired("gnome-terminal", 0.4)
             ok, name = ph._spawn_terminal_linux(cmd)
         self.assertTrue(ok)
         return popen.call_args[0][0]
@@ -152,10 +158,19 @@ class LinuxSpawnTests(unittest.TestCase):
 class MacLauncherTests(unittest.TestCase):
     def test_helper_command_launcher_carries_prelude(self):
         with tempfile.TemporaryDirectory() as td:
+            # _spawn_terminal_macos (fix c9d6b819) polls for a start-marker the
+            # launcher writes; a real `open` runs the .command which stamps it.
+            # Model that: the fake `open` touches the marker for the spawned script.
+            def fake_open(argv, *a, **k):
+                script = next((Path(x) for x in argv if str(x).endswith(".command")), None)
+                if script is not None:
+                    marker = Path(td) / ".meshcode" / f"spawn_alive_{script.stem}"
+                    marker.parent.mkdir(parents=True, exist_ok=True)
+                    marker.touch()
+                return mock.Mock(returncode=0, stderr="")
             with mock.patch.object(ph, "_detect_macos_terminal", lambda: "terminal"), \
                  mock.patch.object(ph.Path, "home", classmethod(lambda cls: Path(td))), \
-                 mock.patch.object(ph.subprocess, "run",
-                                   lambda *a, **k: mock.Mock(returncode=0, stderr="")):
+                 mock.patch.object(ph.subprocess, "run", fake_open):
                 ok, _ = ph._spawn_terminal_macos(
                     'exec python -m meshcode run "mesh-core/helper-scorer"')
             self.assertTrue(ok)

{meshcode-2.11.148 → meshcode-2.11.150}/tests/test_hostd_zombie_sessions.py

@@ -397,6 +397,9 @@ class FleetWindowTests(unittest.TestCase):
              mock.patch.object(ph, "_windows_session_launcher",
                                lambda c: ph.Path("C:\\u\\.meshcode\\launchers\\x.cmd")), \
              mock.patch.object(ph.subprocess, "Popen") as popen:
+            # _verified_popen (fix 809d3b37) waits a grace period; a live wt
+            # window survives it -> TimeoutExpired == launched.
+            popen.return_value.wait.side_effect = ph.subprocess.TimeoutExpired("wt", 0.4)
             ok, info = ph._spawn_terminal_windows(cmd)
         self.assertTrue(ok)
         self.assertEqual(info, "wt(fleet-tab)")