meshcode 2.11.157__tar.gz → 2.11.158__tar.gz

{meshcode-2.11.157 → meshcode-2.11.158}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.157
+Version: 2.11.158
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.157 → meshcode-2.11.158}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.157"
+__version__ = "2.11.158"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.157 → meshcode-2.11.158}/meshcode/hostd.py

@@ -1497,57 +1497,47 @@ def _terminal_window_marker(target: str) -> str:
 
 
 def _list_dead_terminal_windows(target: str) -> list:
-    """macOS: ids of Terminal windows that belonged to `target`'s launcher and
-    whose tab is NO LONGER BUSY — the '[Process completed]' orphans a rotation
-    leaves behind (task 70ac6d25). busy=false means no process runs in the tab,
-    so a live agent can never match; the marker filter keeps every non-meshcode
-    window (user shells, other apps' tabs) out of reach. The marker is built
-    from a sanitized charset ([A-Za-z0-9_.-]) so it can't inject AppleScript.
-    Returns [] on non-macOS, no Automation permission, or any error."""
-    if sys.platform != "darwin":
-        return []
-    marker = _terminal_window_marker(target)
-    if not marker:
-        return []
-    script = (
-        'set out to ""\n'
-        'tell application "Terminal"\n'
-        '  repeat with w in (every window)\n'
-        '    try\n'
-        f'      if (busy of selected tab of w) is false and (name of w contains "{marker}") then\n'
-        '        set out to out & (id of w) & linefeed\n'
-        '      end if\n'
-        '    end try\n'
-        '  end repeat\n'
-        'end tell\n'
-        'return out')
-    try:
-        out = subprocess.run(["/usr/bin/osascript", "-e", script],
-                             capture_output=True, text=True, timeout=10).stdout or ""
-        return [int(x) for x in out.split() if x.strip().isdigit()]
-    except Exception:
-        return []
+    """DISABLED no-op (macOS TCC fix, task e0465408 / Prong 1 #2).
+
+    This used to enumerate Terminal windows via `osascript -e 'tell application
+    "Terminal" ...'` to find '[Process completed]' rotation orphans (task
+    70ac6d25 / 2.11.157). That Apple Event fired from python3.11 on the hostd
+    lifecycle sweep and was RC-1 of the recurring macOS consent prompt
+    "python3.11 would like to access data from other apps"
+    (kTCCServiceAppleEvents). Because the interpreter is ad-hoc signed (bare
+    cdhash, no Designated Requirement) the grant never stuck across versions, so
+    it re-prompted on every sweep. The `.command` launcher already self-closes
+    its OWN tab on any exit (clean / recycle / crash) via a tty-targeted close
+    run from the agent's shell (see protocol_handler._write_fleet_native_agent),
+    so this hostd-side reaper was a redundant belt. Removing it takes Apple
+    Events off the python sweep path with no dead-tab regression — only
+    un-trappable SIGKILL orphans may linger, which are rare and cannot be closed
+    without Apple Events anyway. Kept as a no-op so the call sites stay harmless.
+    NEVER reintroduce osascript here — guarded by
+    tests/test_no_appleevents_on_sweep.py."""
+    return []
 
 
 def _close_dead_terminal_windows(target: str, window_ids) -> int:
-    """Close (saving no) a pre-collected set of dead launcher windows. The ids
-    come from _list_dead_terminal_windows BEFORE the fresh spawn, so the new
-    window is excluded by construction (same snapshot discipline as
-    _close_old_visible_recycle). 'every window whose id is N' no-ops harmlessly
-    if the user already closed it. Best-effort; returns count closed."""
-    n = 0
-    for wid in window_ids:
-        try:
-            r = subprocess.run(
-                ["/usr/bin/osascript", "-e",
-                 f'tell application "Terminal" to close (every window whose id is {int(wid)}) saving no'],
-                capture_output=True, text=True, timeout=10)
-            if r.returncode == 0:
-                _log(f"DEAD-WINDOW-REAP {target}: closed dead terminal window id {wid} (rotation orphan)")
-                n += 1
-        except Exception:
-            pass
-    return n
+    """DISABLED no-op (macOS TCC fix, task e0465408 / Prong 1 #2).
+
+    Previously closed dead launcher windows by firing
+    `osascript -e 'tell application "Terminal" to close ...'` from python3.11.
+    That Apple Event was RC-1 of the recurring TCC prompt
+    ("python3.11 would like to access data from other apps") — the adhoc python
+    interpreter has no stable Designated Requirement, so the kTCCServiceAppleEvents
+    grant never persists across per-version cdhash changes and re-prompts forever.
+
+    The `.command` launcher already self-closes its OWN tab on any exit
+    (clean/recycle/crash) via a tty-targeted close run from the agent's SHELL
+    (not python — different TCC attribution), so this hostd-side reaper was a
+    redundant belt. Removing it takes Apple Events off the python sweep path with
+    no dead-tab regression — only un-trappable SIGKILL orphans may linger, which
+    are rare and cannot be closed without Apple Events anyway. Kept as a no-op so
+    the call sites stay harmless.
+    NEVER reintroduce osascript here — guarded by
+    tests/test_no_appleevents_on_sweep.py."""
+    return 0
 
 
 def _spawn_rate_ok(target: str):

{meshcode-2.11.157 → meshcode-2.11.158}/meshcode/meshcode_mcp/server.py

@@ -528,6 +528,24 @@ def _try_auto_wake(from_agent: str, preview: str, urgent: bool = False) -> None:
     system = platform.system()
     try:
         if system == "Darwin":
+            # macOS TCC fix (task e0465408 / Prong 1 #3): the AppleScript
+            # keystroke fallback fires osascript from python3.11, which triggers
+            # the recurring "python3.11 would like to access data from other apps"
+            # consent prompt (kTCCServiceAppleEvents; adhoc python has no stable
+            # Designated Requirement so the grant never persists). tmux send-keys
+            # (the fast-path above) is the durable, prompt-free wake mechanism.
+            # The AppleScript fallback is OFF by default and only re-enabled by
+            # operators who explicitly opt into Apple Events:
+            #   MESHCODE_AUTOWAKE_APPLESCRIPT=1
+            # When off and tmux was unavailable/failed, we skip keystroke
+            # injection entirely (no prompt, no wake) rather than re-prompt Samuel.
+            if os.environ.get("MESHCODE_AUTOWAKE_APPLESCRIPT", "").strip().lower() \
+                    not in ("1", "true", "yes", "on"):
+                log.debug(
+                    "auto-wake: tmux unavailable and AppleScript fallback "
+                    "disabled (MESHCODE_AUTOWAKE_APPLESCRIPT off) — skipping "
+                    "keystroke injection to avoid macOS TCC prompt")
+                return
             # Sanitize app_name — TERM_PROGRAM is an env var, not DB-sourced,
             # but defense-in-depth: only allow known terminal app names.
             parent_app = os.environ.get("TERM_PROGRAM", "Terminal")

{meshcode-2.11.157 → meshcode-2.11.158}/meshcode/protocol_handler.py

@@ -356,8 +356,12 @@ def _fleet_attach_macos(tmux: str) -> tuple[bool, str]:
     ]
     try:
         launch_dir.mkdir(parents=True, exist_ok=True)
+        # macOS TCC fix (task e0465408) security guardrail: launcher dir +
+        # .command owner-only (0o700). These scripts are LaunchServices-executed
+        # via `open -a` and must never be world-readable/-writable.
+        _harden_launcher_dir(launch_dir)
         script_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
-        os.chmod(script_path, 0o755)
+        os.chmod(script_path, 0o700)
     except Exception as e:
         return False, f"could not write fleet launcher: {e}"
     r = subprocess.run(["open", "-a", "Terminal", str(script_path)],
@@ -560,6 +564,19 @@ def _spawn_fleet_tab(cmd: str) -> tuple[bool, str]:
 _FLEET_NATIVE_DISABLED_TTL_S = 1800  # back off after a watcher "fallback"
 
 
+def _harden_launcher_dir(d) -> None:
+    """macOS TCC fix (task e0465408) security guardrail: keep the launcher dir
+    owner-only (0o700). The `.command`/watcher scripts here are executed by
+    LaunchServices via `open -a` and may carry non-secret launch flags; they must
+    never be world-readable/-writable (was 0o755). Secrets are NEVER written into
+    these scripts (they come via .mcp.json / keychain / env-file). Best-effort:
+    a chmod failure must not wedge a launch."""
+    try:
+        os.chmod(str(d), 0o700)
+    except Exception:
+        pass
+
+
 def _fleet_native_paths() -> dict:
     d = Path.home() / ".meshcode" / "launchers"
     return {
@@ -713,10 +730,11 @@ while :; do
 done
 '''
     p["dir"].mkdir(parents=True, exist_ok=True)
+    _harden_launcher_dir(p["dir"])  # owner-only launcher dir (TCC fix e0465408)
     driver = p["dir"] / "fleet-native-driver.applescript"
     driver.write_text(_FLEET_NATIVE_DRIVER_AS + "\n", encoding="utf-8")
     p["watcher"].write_text(body, encoding="utf-8")
-    os.chmod(p["watcher"], 0o755)
+    os.chmod(p["watcher"], 0o700)
     return p["watcher"]
 
 
@@ -796,8 +814,9 @@ def _write_fleet_native_agent(cmd: str) -> Path:
         'esac',
     ]
     p["dir"].mkdir(parents=True, exist_ok=True)
+    _harden_launcher_dir(p["dir"])  # owner-only launcher dir (TCC fix e0465408)
     script_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
-    os.chmod(script_path, 0o755)
+    os.chmod(script_path, 0o700)
     return script_path
 
 
@@ -1022,8 +1041,9 @@ def _spawn_terminal_macos(cmd: str) -> tuple[bool, str]:
     lines.append('fi')
     try:
         launch_dir.mkdir(parents=True, exist_ok=True)
+        _harden_launcher_dir(launch_dir)  # owner-only launcher dir (TCC fix e0465408)
         script_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
-        os.chmod(script_path, 0o755)
+        os.chmod(script_path, 0o700)
     except Exception as e:
         return False, f"could not write launcher {script_path}: {e}"
     # Clear any stale start-marker so the poll below can only see a FRESH one

{meshcode-2.11.157 → meshcode-2.11.158}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.157
+Version: 2.11.158
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.157 → meshcode-2.11.158}/meshcode.egg-info/SOURCES.txt

@@ -89,6 +89,7 @@ tests/test_live_mesh_guard.py
 tests/test_mark_read_batch.py
 tests/test_marketplace_ratings.py
 tests/test_migration_integrity.py
+tests/test_no_appleevents_on_sweep.py
 tests/test_preflight_hb_gate.py
 tests/test_pretrust_claude.py
 tests/test_push_guard.py

{meshcode-2.11.157 → meshcode-2.11.158}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.157"
+version = "2.11.158"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}

meshcode-2.11.158/tests/test_no_appleevents_on_sweep.py

@@ -0,0 +1,81 @@
+"""
+No Apple Events on the python sweep path (task e0465408, Samuel P1 — TCC fix)
+============================================================================
+RC-1 of the recurring macOS consent prompt
+  "python3.11 would like to access data from other apps"
+was hostd's dead-window reaper firing `osascript -e 'tell application "Terminal"
+to close ...'` from python3.11 on every lifecycle sweep (stop/kill/respawn). The
+adhoc python interpreter has no stable Designated Requirement, so the
+kTCCServiceAppleEvents grant never persists across per-version cdhash changes and
+re-prompts forever.
+
+The fix neutralizes the reaper (the `.command` launcher already self-closes its
+OWN tab from the agent's SHELL — different TCC attribution). This guard locks the
+fix in: the two reaper functions must stay Apple-Event-free, and the macOS
+auto-wake keystroke fallback (RC-1's sibling in the MCP server) must stay gated
+behind an opt-in env var so it never fires Apple Events by default.
+
+If this test fails, someone reintroduced an Apple Event on a python code path and
+the TCC prompt is back. Do NOT "fix" the test — remove the osascript.
+"""
+import inspect
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+import meshcode.hostd as hostd
+from meshcode.meshcode_mcp import server as mcp_server
+
+
+_FORBIDDEN = ("osascript", "tell application", "AppleScript", "System Events")
+
+
+def _executable_source(fn):
+    """Function source with the docstring and comment lines removed, so a
+    forbidden token surviving in code (not just a 'NEVER reintroduce X' note)
+    is what trips the guard."""
+    src = inspect.getsource(fn)
+    doc = inspect.getdoc(fn) or ""
+    for line in doc.splitlines():
+        src = src.replace(line, "")
+    code_lines = [ln for ln in src.splitlines() if not ln.lstrip().startswith("#")]
+    return "\n".join(code_lines)
+
+
+def _scan(fn):
+    src = _executable_source(fn).lower()
+    return [tok for tok in _FORBIDDEN if tok.lower() in src]
+
+
+def test_list_dead_terminal_windows_has_no_apple_events():
+    hits = _scan(hostd._list_dead_terminal_windows)
+    assert not hits, f"_list_dead_terminal_windows reintroduced Apple Events: {hits}"
+
+
+def test_close_dead_terminal_windows_has_no_apple_events():
+    hits = _scan(hostd._close_dead_terminal_windows)
+    assert not hits, f"_close_dead_terminal_windows reintroduced Apple Events: {hits}"
+
+
+def test_list_dead_terminal_windows_returns_empty():
+    assert hostd._list_dead_terminal_windows("anything") == []
+
+
+def test_close_dead_terminal_windows_returns_zero():
+    assert hostd._close_dead_terminal_windows("anything", ["@1", "@2"]) == 0
+
+
+def test_autowake_applescript_is_env_gated():
+    """The macOS auto-wake keystroke fallback must be guarded by the opt-in
+    MESHCODE_AUTOWAKE_APPLESCRIPT env var — off by default = no Apple Events,
+    no TCC prompt. tmux send-keys is the durable wake mechanism."""
+    src = inspect.getsource(mcp_server._try_auto_wake)
+    assert "MESHCODE_AUTOWAKE_APPLESCRIPT" in src, (
+        "auto-wake AppleScript fallback is no longer gated behind "
+        "MESHCODE_AUTOWAKE_APPLESCRIPT — it will re-trigger the macOS TCC prompt")
+
+
+if __name__ == "__main__":
+    import pytest
+    sys.exit(pytest.main([__file__, "-q"]))