meshcode 2.11.28__tar.gz → 2.11.29__tar.gz

{meshcode-2.11.28 → meshcode-2.11.29}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.28
+Version: 2.11.29
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.28 → meshcode-2.11.29}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.28"
+__version__ = "2.11.29"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.28 → meshcode-2.11.29}/meshcode/meshcode_mcp/backend.py

@@ -428,10 +428,16 @@ _recording_project_id = ""
 _recording_agent_name = ""
 _recording_session_id = ""
 
-# RPCs that should NOT be recorded (internal/heartbeat/recording itself)
+# RPCs that should NOT be recorded (internal/heartbeat/recording itself).
+# M3a (SUPABASE-PROD-QUOTA-CRITICAL 2026-05-22): added mc_task_list +
+# mc_count_pending + mc_mark_message_read — these were generating 87% of
+# all session_events (~46k of 53k in last 6h) as null-tool tool_call rows
+# from the wait-loop polling. Pure infrastructure noise — no analytic
+# value. The session_events table was 1.2 GB driven mostly by these.
 _SKIP_RECORDING = {"mc_heartbeat", "mc_record_event", "mc_agent_set_status_by_api_key",
                     "mc_acquire_agent_lease", "mc_release_agent_lease",
-                    "mc_update_agent", "mc_get_agents"}
+                    "mc_update_agent", "mc_get_agents",
+                    "mc_task_list", "mc_count_pending", "mc_mark_message_read"}
 
 
 def _get_api_key() -> Optional[str]:
@@ -963,13 +969,22 @@ def read_inbox(project_id: str, agent: str, mark_read: bool = True, api_key: Opt
 
 
 def count_pending(project_id: str, agent: str, api_key: Optional[str] = None) -> int:
-    # Use SECURITY DEFINER RPC when api_key is available
+    # Use SECURITY DEFINER RPC when api_key is available.
+    # SEC-5 R-SEC5-A: call rate-limited _rl wrapper. Server-side returns
+    # cached payload on limit so Python contract stays {ok:true, count:int}.
+    # Falls back to non-rl on 404 if the wrapper isn't deployed yet.
     if api_key:
-        result = sb_rpc("mc_count_pending", {
+        result = sb_rpc("mc_count_pending_rl", {
             "p_api_key": api_key,
             "p_project_id": project_id,
             "p_agent_name": agent,
         })
+        if isinstance(result, dict) and result.get("error_code") == "404":
+            result = sb_rpc("mc_count_pending", {
+                "p_api_key": api_key,
+                "p_project_id": project_id,
+                "p_agent_name": agent,
+            })
         if isinstance(result, dict) and result.get("ok"):
             return result.get("count", 0)
         # Fall through to direct query if RPC doesn't exist yet
@@ -1242,13 +1257,24 @@ def task_list(api_key, project_id, agent, status_filter=None, include_done=False
         cached = _TASK_LIST_CACHE.get(cache_key)
         if cached and (now - cached[1]) < _TASK_LIST_MIN_INTERVAL:
             return cached[0]
-    result = sb_rpc("mc_task_list", {
+    # SEC-5 R-SEC5-A: call rate-limited _rl wrapper. Returns same shape as
+    # original (with extra rate_limited/remaining metadata Python ignores).
+    # Falls back to non-rl on 404 if wrapper isn't deployed.
+    result = sb_rpc("mc_task_list_rl", {
         "p_api_key": api_key,
         "p_project_id": project_id,
         "p_agent": agent,
         "p_status_filter": status_filter,
         "p_include_done": include_done,
     })
+    if isinstance(result, dict) and result.get("error_code") == "404":
+        result = sb_rpc("mc_task_list", {
+            "p_api_key": api_key,
+            "p_project_id": project_id,
+            "p_agent": agent,
+            "p_status_filter": status_filter,
+            "p_include_done": include_done,
+        })
     with _TASK_LIST_CACHE_LOCK:
         if len(_TASK_LIST_CACHE) >= _TASK_LIST_CACHE_MAX:
             oldest_key = min(_TASK_LIST_CACHE, key=lambda k: _TASK_LIST_CACHE[k][1])

{meshcode-2.11.28 → meshcode-2.11.29}/meshcode/meshcode_mcp/server.py

@@ -1646,6 +1646,8 @@ def _build_instructions() -> str:
 
 RULES: MCP tools only. Tasks > messages. Messages <100 tokens (long → task). No empty acks, JSON only. Thread via in_reply_to. sensitive=True for secrets. Sync vs async: for turn-based/shared-state work (chess, lock-step, "who goes first"), use meshcode_call (sync RPC, 30s) — async meshcode_send crosses ~50%/turn between same-model agents and yields-pongs.
 
+CLOSE TASKS IMMEDIATELY (#2 rule, sammybenu 2026-05-22T21:06Z): every time you finish/ship/deliver work for a claimed task, call meshcode_task_complete BEFORE re-entering wait. NO "I'll close it after one more thing." NO leaving claimed tasks lingering in_progress while you do something else — that creates phantom in-progress on the dashboard and the human gets angry. If the work needs human review, set requires_approval=true at task_create OR call meshcode_task_complete (it routes to in_review if reviewer set). The mesh dashboard reflects mc_tasks.status in real-time; stale in_progress = lying to the human.
+
 SESSION START (run NOW, don't wait for input). If tool schemas are deferred:
   ToolSearch(query="select:meshcode_set_status,meshcode_check,meshcode_tasks,meshcode_auto_wake,meshcode_status,meshcode_wait,meshcode_send,meshcode_call,meshcode_claim,meshcode_task_claim,meshcode_task_complete,meshcode_remember,meshcode_recall")
 Then: set_status(online,ready) → check() → tasks() → auto_wake() → status() → wait(). Don't ask user "what to work on" — the mesh tells you.

{meshcode-2.11.28 → meshcode-2.11.29}/meshcode/setup_clients.py

@@ -565,6 +565,46 @@ errors when the source actually broke. Lovable build then ships the
 broken bundle.
 
 **Why:** practiced manually for weeks; codify so new FE agents inherit.
+""",
+    "mobile-first-verify.md": """# /mobile-first-verify — 3-viewport check before task_complete
+
+Before calling `meshcode_task_complete` on any UI-touching task, run
+Playwright at three viewports and attach the result in the summary.
+
+Viewports (canonical):
+- iPhone SE     375 x 667
+- iPhone 15 Pro 390 x 844
+- iPad          768 x 1024
+
+Recipe (load `mcp__playwright__browser_*` via ToolSearch first):
+
+```
+for w,h in [(375,667),(390,844),(768,1024)]:
+    browser_resize(width=w, height=h)
+    browser_navigate(url=<route>)
+    browser_take_screenshot(filename=f"verify_{w}x{h}.png")
+    browser_console_messages()  # capture errors
+```
+
+Then `meshcode_task_complete(task_id, summary=<<EOF
+verified: 3-viewport playwright
+- 375x667: <path>
+- 390x844: <path>
+- 768x1024: <path>
+console_errors: <count or "none">
+EOF)`.
+
+If the task is backend-only (DDL, RPCs, RLS, hooks, scripts — no user
+surface), skip the playwright run but state `verified: backend-only,
+no UI surface` in the summary so the auditor knows it was considered.
+
+Reopen path: Samuel reviews; if visuals are broken he calls
+`meshcode_task_reject(task_id, feedback=...)` which reopens with
+review_feedback. No new RPC needed.
+
+**Why:** MOBILE-FIRST-2 + Samuel mobile directive. Catches mobile
+breakage at the agent before it reaches Samuel as a screenshot in
+chat. Pairs with `/playwright-self-test` which covers desktop only.
 """,
 }
 
@@ -764,6 +804,134 @@ incidents from rapid-fire publish without bundling.
 """,
 }
 
+# ============================================================
+# SKILLS-6 — mobile-qa role bundle (MOBILE-FIRST-5)
+# ============================================================
+# Parallel verify lane: while front-end/front-2 ship code, a mobile-qa
+# agent independently re-renders the affected route at 3 mobile/tablet
+# viewports, captures screenshots + console errors, and reports findings
+# back to the ship-er agent + commander. Removes verify-bottleneck from
+# the coding agents and gives Samuel a second pair of eyes on every
+# UI-touching commit.
+#
+# Agent type does NOT ship code. Pure verifier.
+_MOBILE_QA_SKILLS = {
+    "mobile-qa-boot-loop.md": """# /mobile-qa-boot-loop — verify-only agent boot workflow
+
+You are a mobile-qa agent. You DO NOT ship code. Your only job is to
+re-render UI changes that other agents shipped, at three viewports,
+and report what you see.
+
+Boot sequence (after the standard meshcode boot):
+
+1. `meshcode_tasks(status_filter="open")` filter assignee == this agent
+   OR title/description mentions `needs_mobile_qa` / `verify` / `qa`.
+2. For each candidate task: claim → fetch the route or commit referenced
+   → run `/viewports-3-recipe` → assemble `/mobile-qa-report-format` →
+   `meshcode_send` the report to the original ship-er (look at
+   parent_task_id chain or claimed_by on the parent task) AND to
+   commander.
+3. `meshcode_task_complete` with the report inlined in summary.
+
+If no verify tasks are queued: `meshcode_wait` and sit.
+
+DO NOT:
+- write code into `src/`
+- propose RPC / DDL changes
+- broadcast opinions about design
+
+DO:
+- screenshot + console + network requests
+- report objective signals: layout overflow, console errors, network
+  500s, missing assets
+
+**Why:** MOBILE-FIRST-5. Parallel verify lane keeps shipping agents
+unblocked while still catching mobile regressions before Samuel does.
+""",
+    "viewports-3-recipe.md": """# /viewports-3-recipe — canonical 3-viewport playwright run
+
+Three viewports, every time, in this order:
+
+| Device         |  Width | Height |
+|----------------|-------:|-------:|
+| iPhone SE      |    375 |    667 |
+| iPhone 15 Pro  |    390 |    844 |
+| iPad           |    768 |   1024 |
+
+Recipe (load `mcp__playwright__browser_*` via ToolSearch if deferred):
+
+```python
+for w, h in [(375, 667), (390, 844), (768, 1024)]:
+    browser_resize(width=w, height=h)
+    browser_navigate(url=<route>)
+    browser_wait_for(time=2)            # let layout settle
+    browser_take_screenshot(filename=f"mqa_{w}x{h}.png")
+    console = browser_console_messages()
+    network = browser_network_requests()
+    # capture: scrollWidth > clientWidth → horizontal overflow flag
+    overflow = browser_evaluate(
+        function="() => document.documentElement.scrollWidth > "
+                 "document.documentElement.clientWidth"
+    )
+```
+
+For each viewport collect:
+- screenshot path
+- console_messages count + first-3 errors verbatim
+- network_requests with status >= 400 (path + status)
+- horizontal_overflow: bool
+
+**Why:** standard viewports make reports comparable across days /
+across agents. Console + network + overflow are the cheap signals that
+catch ~80% of mobile regressions.
+""",
+    "mobile-qa-report-format.md": """# /mobile-qa-report-format — canonical report shape
+
+Report back to ship-er + commander in this exact JSON shape so consumers
+can parse without LLM cost:
+
+```json
+{
+  "type": "mobile_qa_report",
+  "parent_task_id": "<task that requested verify>",
+  "verified_commit": "<short sha>",
+  "route": "<path verified>",
+  "viewports": [
+    {
+      "label": "iPhone SE",
+      "size": "375x667",
+      "screenshot": "<abs path>",
+      "console_errors": 0,
+      "first_errors": [],
+      "network_4xx_5xx": [],
+      "horizontal_overflow": false
+    },
+    { "label": "iPhone 15 Pro", "size": "390x844", "...": "..." },
+    { "label": "iPad",          "size": "768x1024", "...": "..." }
+  ],
+  "verdict": "pass" | "fail" | "warn",
+  "fail_reasons": [],
+  "samuel_status_line": "mobile-qa: <route> OK on 3 viewports / FAIL on iPhone SE (horizontal overflow + 2 console errors)"
+}
+```
+
+Verdict rubric:
+- **pass**: 0 console_errors AND 0 network 4xx/5xx AND 0
+  horizontal_overflow on all 3 viewports.
+- **warn**: any viewport has 1-2 console_errors that are clearly
+  third-party (analytics, etc) AND no overflow.
+- **fail**: any console error from app code, any network 4xx/5xx, any
+  horizontal_overflow, OR layout clearly visually broken.
+
+`samuel_status_line` is the 1-line summary Samuel sees in his feed;
+make it actionable.
+
+**Why:** structured reports let the FE agents auto-handle warn/fail
+without commander intervention. Free-form text needs LLM parse on
+every consumer; JSON does not.
+""",
+}
+
 
 def _write_generic_skills_bundle(ws: Path, role: str = "") -> None:
     """Write skill bundles to {ws}/.claude/skills/.
@@ -789,6 +957,8 @@ def _write_generic_skills_bundle(ws: Path, role: str = "") -> None:
     elif role_norm in ("commander", "mesh-commander", "zylo-commander",
                        "bemate-commander"):
         role_bundle = _COMMANDER_SKILLS
+    elif role_norm in ("mobile-qa", "mobile_qa", "mobileqa", "mqa"):
+        role_bundle = _MOBILE_QA_SKILLS
 
     for fname, body in role_bundle.items():
         (skills_dir / fname).write_text(body, encoding="utf-8")
@@ -1004,6 +1174,44 @@ If `meshcode_wait()` times out, call it again with a 2× longer timeout (cap 180
 - Memory: `meshcode_remember(key, value)` for reusable learnings. Don't dump
   task summaries into memory — tasks already persist.
 
+## Mobile-first UI verification (before task_complete)
+
+Before calling `meshcode_task_complete` on ANY task that touches user-visible
+UI (routes, components, layouts, styles, mobile chrome), you MUST run
+Playwright at three viewports and attach the result in the completion summary.
+
+Viewports (canonical):
+- iPhone SE     375 x 667
+- iPhone 15 Pro 390 x 844
+- iPad          768 x 1024
+
+Workflow (uses `mcp__playwright__browser_*` — load via ToolSearch if deferred):
+
+1. For each viewport: `browser_resize` → `browser_navigate(<route>)` →
+   `browser_take_screenshot(filename="verify_<W>x<H>.png")` →
+   `browser_console_messages()`.
+2. Pass the three screenshot paths + console-error count in the
+   `summary` arg of `meshcode_task_complete`:
+
+   ```
+   verified: 3-viewport playwright
+   - 375x667: <path>
+   - 390x844: <path>
+   - 768x1024: <path>
+   console_errors: <count or "none">
+   ```
+
+3. Samuel reviews the summary. If visuals are broken he calls
+   `meshcode_task_reject(task_id, feedback=...)` which reopens the task with
+   `review_feedback`. No new RPC needed — uses the existing pipeline.
+
+If the task is backend-only (DDL, RPCs, RLS, hooks, scripts — no UI surface)
+the playwright run is skipped, but state `verified: backend-only, no UI
+surface` in the summary so the rule is acknowledged.
+
+**Why:** Samuel mobile directive (MOBILE-FIRST-2). Catches mobile breakage at
+the agent before it reaches Samuel as a screenshot in chat.
+
 ## When to use sync vs async
 
 | Pattern | Tool | Why |

{meshcode-2.11.28 → meshcode-2.11.29}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.28
+Version: 2.11.29
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT

{meshcode-2.11.28 → meshcode-2.11.29}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.28"
+version = "2.11.29"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}