meshcode 2.11.27__tar.gz → 2.11.29__tar.gz

{meshcode-2.11.27 → meshcode-2.11.29}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.27
+Version: 2.11.29
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.27 → meshcode-2.11.29}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.27"
+__version__ = "2.11.29"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.27 → meshcode-2.11.29}/meshcode/meshcode_mcp/backend.py

@@ -428,10 +428,16 @@ _recording_project_id = ""
 _recording_agent_name = ""
 _recording_session_id = ""
 
-# RPCs that should NOT be recorded (internal/heartbeat/recording itself)
+# RPCs that should NOT be recorded (internal/heartbeat/recording itself).
+# M3a (SUPABASE-PROD-QUOTA-CRITICAL 2026-05-22): added mc_task_list +
+# mc_count_pending + mc_mark_message_read — these were generating 87% of
+# all session_events (~46k of 53k in last 6h) as null-tool tool_call rows
+# from the wait-loop polling. Pure infrastructure noise — no analytic
+# value. The session_events table was 1.2 GB driven mostly by these.
 _SKIP_RECORDING = {"mc_heartbeat", "mc_record_event", "mc_agent_set_status_by_api_key",
                     "mc_acquire_agent_lease", "mc_release_agent_lease",
-                    "mc_update_agent", "mc_get_agents"}
+                    "mc_update_agent", "mc_get_agents",
+                    "mc_task_list", "mc_count_pending", "mc_mark_message_read"}
 
 
 def _get_api_key() -> Optional[str]:
@@ -963,13 +969,22 @@ def read_inbox(project_id: str, agent: str, mark_read: bool = True, api_key: Opt
 
 
 def count_pending(project_id: str, agent: str, api_key: Optional[str] = None) -> int:
-    # Use SECURITY DEFINER RPC when api_key is available
+    # Use SECURITY DEFINER RPC when api_key is available.
+    # SEC-5 R-SEC5-A: call rate-limited _rl wrapper. Server-side returns
+    # cached payload on limit so Python contract stays {ok:true, count:int}.
+    # Falls back to non-rl on 404 if the wrapper isn't deployed yet.
     if api_key:
-        result = sb_rpc("mc_count_pending", {
+        result = sb_rpc("mc_count_pending_rl", {
             "p_api_key": api_key,
             "p_project_id": project_id,
             "p_agent_name": agent,
         })
+        if isinstance(result, dict) and result.get("error_code") == "404":
+            result = sb_rpc("mc_count_pending", {
+                "p_api_key": api_key,
+                "p_project_id": project_id,
+                "p_agent_name": agent,
+            })
         if isinstance(result, dict) and result.get("ok"):
             return result.get("count", 0)
         # Fall through to direct query if RPC doesn't exist yet
@@ -1242,13 +1257,24 @@ def task_list(api_key, project_id, agent, status_filter=None, include_done=False
         cached = _TASK_LIST_CACHE.get(cache_key)
         if cached and (now - cached[1]) < _TASK_LIST_MIN_INTERVAL:
             return cached[0]
-    result = sb_rpc("mc_task_list", {
+    # SEC-5 R-SEC5-A: call rate-limited _rl wrapper. Returns same shape as
+    # original (with extra rate_limited/remaining metadata Python ignores).
+    # Falls back to non-rl on 404 if wrapper isn't deployed.
+    result = sb_rpc("mc_task_list_rl", {
         "p_api_key": api_key,
         "p_project_id": project_id,
         "p_agent": agent,
         "p_status_filter": status_filter,
         "p_include_done": include_done,
     })
+    if isinstance(result, dict) and result.get("error_code") == "404":
+        result = sb_rpc("mc_task_list", {
+            "p_api_key": api_key,
+            "p_project_id": project_id,
+            "p_agent": agent,
+            "p_status_filter": status_filter,
+            "p_include_done": include_done,
+        })
     with _TASK_LIST_CACHE_LOCK:
         if len(_TASK_LIST_CACHE) >= _TASK_LIST_CACHE_MAX:
             oldest_key = min(_TASK_LIST_CACHE, key=lambda k: _TASK_LIST_CACHE[k][1])

{meshcode-2.11.27 → meshcode-2.11.29}/meshcode/meshcode_mcp/server.py

@@ -1646,6 +1646,8 @@ def _build_instructions() -> str:
 
 RULES: MCP tools only. Tasks > messages. Messages <100 tokens (long → task). No empty acks, JSON only. Thread via in_reply_to. sensitive=True for secrets. Sync vs async: for turn-based/shared-state work (chess, lock-step, "who goes first"), use meshcode_call (sync RPC, 30s) — async meshcode_send crosses ~50%/turn between same-model agents and yields-pongs.
 
+CLOSE TASKS IMMEDIATELY (#2 rule, sammybenu 2026-05-22T21:06Z): every time you finish/ship/deliver work for a claimed task, call meshcode_task_complete BEFORE re-entering wait. NO "I'll close it after one more thing." NO leaving claimed tasks lingering in_progress while you do something else — that creates phantom in-progress on the dashboard and the human gets angry. If the work needs human review, set requires_approval=true at task_create OR call meshcode_task_complete (it routes to in_review if reviewer set). The mesh dashboard reflects mc_tasks.status in real-time; stale in_progress = lying to the human.
+
 SESSION START (run NOW, don't wait for input). If tool schemas are deferred:
   ToolSearch(query="select:meshcode_set_status,meshcode_check,meshcode_tasks,meshcode_auto_wake,meshcode_status,meshcode_wait,meshcode_send,meshcode_call,meshcode_claim,meshcode_task_claim,meshcode_task_complete,meshcode_remember,meshcode_recall")
 Then: set_status(online,ready) → check() → tasks() → auto_wake() → status() → wait(). Don't ask user "what to work on" — the mesh tells you.
@@ -6104,6 +6106,18 @@ def _auto_update() -> None:
         # legitimate upgrade check. Per task 8d5eed7a.
         os.environ.pop("MESHCODE_UPDATED", None)
         return
+    # MCP-serve guard: this function runs synchronously at the top of
+    # run_server(), BEFORE FastMCP starts serving JSON-RPC. A blocking
+    # `pip install --upgrade` (timeout 60s) here easily blows Claude
+    # Code's MCP handshake window (~5s) — tools never register and the
+    # agent boots into "MCP tools not available". The CLI-side
+    # self_update.py (spawned by `meshcode go` before execv into the
+    # editor) already handles user-facing upgrades; in MCP serve context
+    # we should never block the handshake to chase a newer version.
+    # Detected via the MESHCODE_MCP_SERVE=1 sentinel set in __main__.py.
+    if os.environ.get("MESHCODE_MCP_SERVE") == "1":
+        log.debug("[meshcode] Auto-update skipped in MCP serve subprocess (CLI handles upgrades)")
+        return
 
     # Time-gate (task c0e7de87, 2026-05-19): the PyPI HEAD GET below has a 3s
     # timeout (line ~5430) and pip-install another 60s. Hammering PyPI on

{meshcode-2.11.27 → meshcode-2.11.29}/meshcode/setup_clients.py

@@ -565,6 +565,46 @@ errors when the source actually broke. Lovable build then ships the
 broken bundle.
 
 **Why:** practiced manually for weeks; codify so new FE agents inherit.
+""",
+    "mobile-first-verify.md": """# /mobile-first-verify — 3-viewport check before task_complete
+
+Before calling `meshcode_task_complete` on any UI-touching task, run
+Playwright at three viewports and attach the result in the summary.
+
+Viewports (canonical):
+- iPhone SE     375 x 667
+- iPhone 15 Pro 390 x 844
+- iPad          768 x 1024
+
+Recipe (load `mcp__playwright__browser_*` via ToolSearch first):
+
+```
+for w,h in [(375,667),(390,844),(768,1024)]:
+    browser_resize(width=w, height=h)
+    browser_navigate(url=<route>)
+    browser_take_screenshot(filename=f"verify_{w}x{h}.png")
+    browser_console_messages()  # capture errors
+```
+
+Then `meshcode_task_complete(task_id, summary=<<EOF
+verified: 3-viewport playwright
+- 375x667: <path>
+- 390x844: <path>
+- 768x1024: <path>
+console_errors: <count or "none">
+EOF)`.
+
+If the task is backend-only (DDL, RPCs, RLS, hooks, scripts — no user
+surface), skip the playwright run but state `verified: backend-only,
+no UI surface` in the summary so the auditor knows it was considered.
+
+Reopen path: Samuel reviews; if visuals are broken he calls
+`meshcode_task_reject(task_id, feedback=...)` which reopens with
+review_feedback. No new RPC needed.
+
+**Why:** MOBILE-FIRST-2 + Samuel mobile directive. Catches mobile
+breakage at the agent before it reaches Samuel as a screenshot in
+chat. Pairs with `/playwright-self-test` which covers desktop only.
 """,
 }
 
@@ -764,6 +804,134 @@ incidents from rapid-fire publish without bundling.
 """,
 }
 
+# ============================================================
+# SKILLS-6 — mobile-qa role bundle (MOBILE-FIRST-5)
+# ============================================================
+# Parallel verify lane: while front-end/front-2 ship code, a mobile-qa
+# agent independently re-renders the affected route at 3 mobile/tablet
+# viewports, captures screenshots + console errors, and reports findings
+# back to the ship-er agent + commander. Removes verify-bottleneck from
+# the coding agents and gives Samuel a second pair of eyes on every
+# UI-touching commit.
+#
+# Agent type does NOT ship code. Pure verifier.
+_MOBILE_QA_SKILLS = {
+    "mobile-qa-boot-loop.md": """# /mobile-qa-boot-loop — verify-only agent boot workflow
+
+You are a mobile-qa agent. You DO NOT ship code. Your only job is to
+re-render UI changes that other agents shipped, at three viewports,
+and report what you see.
+
+Boot sequence (after the standard meshcode boot):
+
+1. `meshcode_tasks(status_filter="open")` filter assignee == this agent
+   OR title/description mentions `needs_mobile_qa` / `verify` / `qa`.
+2. For each candidate task: claim → fetch the route or commit referenced
+   → run `/viewports-3-recipe` → assemble `/mobile-qa-report-format` →
+   `meshcode_send` the report to the original ship-er (look at
+   parent_task_id chain or claimed_by on the parent task) AND to
+   commander.
+3. `meshcode_task_complete` with the report inlined in summary.
+
+If no verify tasks are queued: `meshcode_wait` and sit.
+
+DO NOT:
+- write code into `src/`
+- propose RPC / DDL changes
+- broadcast opinions about design
+
+DO:
+- screenshot + console + network requests
+- report objective signals: layout overflow, console errors, network
+  500s, missing assets
+
+**Why:** MOBILE-FIRST-5. Parallel verify lane keeps shipping agents
+unblocked while still catching mobile regressions before Samuel does.
+""",
+    "viewports-3-recipe.md": """# /viewports-3-recipe — canonical 3-viewport playwright run
+
+Three viewports, every time, in this order:
+
+| Device         |  Width | Height |
+|----------------|-------:|-------:|
+| iPhone SE      |    375 |    667 |
+| iPhone 15 Pro  |    390 |    844 |
+| iPad           |    768 |   1024 |
+
+Recipe (load `mcp__playwright__browser_*` via ToolSearch if deferred):
+
+```python
+for w, h in [(375, 667), (390, 844), (768, 1024)]:
+    browser_resize(width=w, height=h)
+    browser_navigate(url=<route>)
+    browser_wait_for(time=2)            # let layout settle
+    browser_take_screenshot(filename=f"mqa_{w}x{h}.png")
+    console = browser_console_messages()
+    network = browser_network_requests()
+    # capture: scrollWidth > clientWidth → horizontal overflow flag
+    overflow = browser_evaluate(
+        function="() => document.documentElement.scrollWidth > "
+                 "document.documentElement.clientWidth"
+    )
+```
+
+For each viewport collect:
+- screenshot path
+- console_messages count + first-3 errors verbatim
+- network_requests with status >= 400 (path + status)
+- horizontal_overflow: bool
+
+**Why:** standard viewports make reports comparable across days /
+across agents. Console + network + overflow are the cheap signals that
+catch ~80% of mobile regressions.
+""",
+    "mobile-qa-report-format.md": """# /mobile-qa-report-format — canonical report shape
+
+Report back to ship-er + commander in this exact JSON shape so consumers
+can parse without LLM cost:
+
+```json
+{
+  "type": "mobile_qa_report",
+  "parent_task_id": "<task that requested verify>",
+  "verified_commit": "<short sha>",
+  "route": "<path verified>",
+  "viewports": [
+    {
+      "label": "iPhone SE",
+      "size": "375x667",
+      "screenshot": "<abs path>",
+      "console_errors": 0,
+      "first_errors": [],
+      "network_4xx_5xx": [],
+      "horizontal_overflow": false
+    },
+    { "label": "iPhone 15 Pro", "size": "390x844", "...": "..." },
+    { "label": "iPad",          "size": "768x1024", "...": "..." }
+  ],
+  "verdict": "pass" | "fail" | "warn",
+  "fail_reasons": [],
+  "samuel_status_line": "mobile-qa: <route> OK on 3 viewports / FAIL on iPhone SE (horizontal overflow + 2 console errors)"
+}
+```
+
+Verdict rubric:
+- **pass**: 0 console_errors AND 0 network 4xx/5xx AND 0
+  horizontal_overflow on all 3 viewports.
+- **warn**: any viewport has 1-2 console_errors that are clearly
+  third-party (analytics, etc) AND no overflow.
+- **fail**: any console error from app code, any network 4xx/5xx, any
+  horizontal_overflow, OR layout clearly visually broken.
+
+`samuel_status_line` is the 1-line summary Samuel sees in his feed;
+make it actionable.
+
+**Why:** structured reports let the FE agents auto-handle warn/fail
+without commander intervention. Free-form text needs LLM parse on
+every consumer; JSON does not.
+""",
+}
+
 
 def _write_generic_skills_bundle(ws: Path, role: str = "") -> None:
     """Write skill bundles to {ws}/.claude/skills/.
@@ -789,6 +957,8 @@ def _write_generic_skills_bundle(ws: Path, role: str = "") -> None:
     elif role_norm in ("commander", "mesh-commander", "zylo-commander",
                        "bemate-commander"):
         role_bundle = _COMMANDER_SKILLS
+    elif role_norm in ("mobile-qa", "mobile_qa", "mobileqa", "mqa"):
+        role_bundle = _MOBILE_QA_SKILLS
 
     for fname, body in role_bundle.items():
         (skills_dir / fname).write_text(body, encoding="utf-8")
@@ -1004,6 +1174,44 @@ If `meshcode_wait()` times out, call it again with a 2× longer timeout (cap 180
 - Memory: `meshcode_remember(key, value)` for reusable learnings. Don't dump
   task summaries into memory — tasks already persist.
 
+## Mobile-first UI verification (before task_complete)
+
+Before calling `meshcode_task_complete` on ANY task that touches user-visible
+UI (routes, components, layouts, styles, mobile chrome), you MUST run
+Playwright at three viewports and attach the result in the completion summary.
+
+Viewports (canonical):
+- iPhone SE     375 x 667
+- iPhone 15 Pro 390 x 844
+- iPad          768 x 1024
+
+Workflow (uses `mcp__playwright__browser_*` — load via ToolSearch if deferred):
+
+1. For each viewport: `browser_resize` → `browser_navigate(<route>)` →
+   `browser_take_screenshot(filename="verify_<W>x<H>.png")` →
+   `browser_console_messages()`.
+2. Pass the three screenshot paths + console-error count in the
+   `summary` arg of `meshcode_task_complete`:
+
+   ```
+   verified: 3-viewport playwright
+   - 375x667: <path>
+   - 390x844: <path>
+   - 768x1024: <path>
+   console_errors: <count or "none">
+   ```
+
+3. Samuel reviews the summary. If visuals are broken he calls
+   `meshcode_task_reject(task_id, feedback=...)` which reopens the task with
+   `review_feedback`. No new RPC needed — uses the existing pipeline.
+
+If the task is backend-only (DDL, RPCs, RLS, hooks, scripts — no UI surface)
+the playwright run is skipped, but state `verified: backend-only, no UI
+surface` in the summary so the rule is acknowledged.
+
+**Why:** Samuel mobile directive (MOBILE-FIRST-2). Catches mobile breakage at
+the agent before it reaches Samuel as a screenshot in chat.
+
 ## When to use sync vs async
 
 | Pattern | Tool | Why |

{meshcode-2.11.27 → meshcode-2.11.29}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.27
+Version: 2.11.29
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.27 → meshcode-2.11.29}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.27"
+version = "2.11.29"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}

{meshcode-2.11.27 → meshcode-2.11.29}/tests/test_auto_update_hardening.py

@@ -37,12 +37,18 @@ def _check_boot_version_drift_inline():
 
 
 def _auto_update_inline_skeleton():
-    """Subset of _auto_update covering the env-var gates only."""
+    """Subset of _auto_update covering the env-var gates only.
+
+    Order matters: the MCP-serve gate must fire BEFORE any network /
+    pip work so the MCP handshake window is never blocked.
+    """
     if os.environ.get("MESHCODE_AUTO_UPDATE", "1").lower() in ("0", "false", "no"):
         return "disabled"
     if os.environ.get("MESHCODE_UPDATED") == "1":
         os.environ.pop("MESHCODE_UPDATED", None)
         return "post_exec_skip"
+    if os.environ.get("MESHCODE_MCP_SERVE") == "1":
+        return "mcp_serve_skip"
     return "would_check_pypi"
 
 
@@ -114,6 +120,57 @@ def test_auto_update_disabled_case_variants(monkeypatch):
         assert _auto_update_inline_skeleton() == "disabled", f"value {val!r} failed"
 
 
+# ---------------------------------------------------------------------------
+# 3b. MCP-serve gate (added 2026-05-20 / 2.11.28)
+#
+# Symptom: right after publishing 2.11.27, commander agents booted with
+# "MCP meshcode tools are not available" — first-turn deferred-tools list
+# missing all meshcode_* tools. RC: _auto_update runs synchronously at the
+# top of run_server() and does a blocking `pip install --upgrade` (60s
+# timeout). When PyPI advertises a newer version, the install easily
+# exceeds Claude Code's ~5s MCP handshake window and tools never register.
+# Fix: skip _auto_update entirely when MESHCODE_MCP_SERVE=1; the CLI's
+# self_update.py handles user-facing upgrades before execv.
+# ---------------------------------------------------------------------------
+
+def test_mcp_serve_sentinel_skips_update(monkeypatch):
+    monkeypatch.setenv("MESHCODE_MCP_SERVE", "1")
+    monkeypatch.delenv("MESHCODE_AUTO_UPDATE", raising=False)
+    monkeypatch.delenv("MESHCODE_UPDATED", raising=False)
+    assert _auto_update_inline_skeleton() == "mcp_serve_skip"
+
+
+def test_mcp_serve_gate_runs_before_pypi(monkeypatch):
+    """MCP-serve gate must short-circuit before any 'would_check_pypi'
+    branch fires — otherwise the gate is moot because the slow path
+    runs anyway."""
+    monkeypatch.setenv("MESHCODE_MCP_SERVE", "1")
+    monkeypatch.delenv("MESHCODE_AUTO_UPDATE", raising=False)
+    monkeypatch.delenv("MESHCODE_UPDATED", raising=False)
+    assert _auto_update_inline_skeleton() != "would_check_pypi"
+
+
+def test_disabled_still_wins_over_mcp_serve(monkeypatch):
+    """Explicit MESHCODE_AUTO_UPDATE=0 must remain the highest-priority
+    opt-out — useful for CI / debugging where the user wants to be
+    100% certain no pip side-effects fire."""
+    monkeypatch.setenv("MESHCODE_AUTO_UPDATE", "0")
+    monkeypatch.setenv("MESHCODE_MCP_SERVE", "1")
+    monkeypatch.delenv("MESHCODE_UPDATED", raising=False)
+    assert _auto_update_inline_skeleton() == "disabled"
+
+
+def test_post_exec_sentinel_still_wins_over_mcp_serve(monkeypatch):
+    """If we just re-execed after an upgrade, the UPDATED sentinel
+    must still take precedence so it gets cleared (otherwise it
+    persists into subprocess children)."""
+    monkeypatch.setenv("MESHCODE_UPDATED", "1")
+    monkeypatch.setenv("MESHCODE_MCP_SERVE", "1")
+    monkeypatch.delenv("MESHCODE_AUTO_UPDATE", raising=False)
+    assert _auto_update_inline_skeleton() == "post_exec_skip"
+    assert "MESHCODE_UPDATED" not in os.environ
+
+
 # ---------------------------------------------------------------------------
 # 4. PyPI/pip behaviour matrix (mocked — covers the cells that don't need
 #    a live relaunch). Uses an inlined version of the post-gate _auto_update