meshcode 2.5.3__tar.gz → 2.5.4__tar.gz

{meshcode-2.5.3 → meshcode-2.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.5.3
+Version: 2.5.4
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT
@@ -22,6 +22,7 @@ Requires-Dist: mcp[cli]>=1.0.0
 Requires-Dist: websockets>=12.0
 Requires-Dist: realtime>=2.0.0
 Requires-Dist: keyring>=24.0
+Requires-Dist: cryptography>=41.0
 
 # MeshCode
 

{meshcode-2.5.3 → meshcode-2.5.4}/meshcode/__init__.py

@@ -1,2 +1,2 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.5.3"
+__version__ = "2.5.4"

{meshcode-2.5.3 → meshcode-2.5.4}/meshcode/meshcode_mcp/backend.py

@@ -235,9 +235,46 @@ def register_agent(project: str, name: str, role: str = "") -> Dict:
     }
 
 
-def send_message(project_id: str, from_agent: str, to_agent: str, payload: Any, msg_type: str = "msg", parent_msg_id: Optional[str] = None, sensitive: bool = False) -> Dict:
+def send_message(project_id: str, from_agent: str, to_agent: str, payload: Any, msg_type: str = "msg", parent_msg_id: Optional[str] = None, sensitive: bool = False, api_key: Optional[str] = None, encrypted: bool = False) -> Dict:
     if not isinstance(payload, dict):
         payload = {"text": str(payload)}
+
+    # Encrypt payload if requested
+    actual_encrypted = False
+    if encrypted and api_key:
+        mesh_key = get_mesh_key(api_key, project_id)
+        if mesh_key:
+            encrypted_data = encrypt_payload(payload, mesh_key)
+            payload = {"_encrypted": encrypted_data}
+            actual_encrypted = True
+
+    # Use validated SECURITY DEFINER RPC when api_key is provided
+    if api_key:
+        params = {
+            "p_api_key": api_key,
+            "p_project_id": project_id,
+            "p_from_agent": from_agent,
+            "p_to_agent": to_agent,
+            "p_payload": payload,
+            "p_type": msg_type,
+        }
+        if parent_msg_id:
+            params["p_parent_msg_id"] = parent_msg_id
+        if sensitive or actual_encrypted:
+            params["p_sensitive"] = True
+        result = sb_rpc("mc_send_message", params)
+        # If RPC succeeded, return
+        if isinstance(result, dict) and result.get("ok"):
+            out = {"sent": True, "msg_id": result.get("msg_id")}
+            if actual_encrypted:
+                out["encrypted"] = True
+            return out
+        # If RPC returned an auth/validation error, propagate it
+        if isinstance(result, dict) and result.get("error") and result.get("error_code"):
+            return {"error": result["error"]}
+        # If RPC doesn't exist yet (migration not applied), fall through to direct insert
+
+    # Fallback: direct insert (tests / legacy)
     msg = {
         "project_id": project_id,
         "from_agent": from_agent,
@@ -258,15 +295,39 @@ def send_message(project_id: str, from_agent: str, to_agent: str, payload: Any,
     return {"sent": True}
 
 
-def read_inbox(project_id: str, agent: str, mark_read: bool = True) -> List[Dict]:
+def read_inbox(project_id: str, agent: str, mark_read: bool = True, api_key: Optional[str] = None) -> List[Dict]:
     messages = sb_select(
         "mc_messages",
         f"project_id=eq.{project_id}&to_agent=eq.{quote(agent)}&read=eq.false",
         order="created_at.asc",
     )
+    # Auto-decrypt encrypted messages
+    if api_key and messages:
+        mesh_key = None  # lazy-load
+        for m in messages:
+            p = m.get("payload")
+            if isinstance(p, dict) and "_encrypted" in p:
+                if mesh_key is None:
+                    mesh_key = get_mesh_key(api_key, project_id)
+                if mesh_key:
+                    decrypted = decrypt_payload(p["_encrypted"], mesh_key)
+                    if decrypted is not None:
+                        m["payload"] = decrypted
+                        m["_was_encrypted"] = True
     if mark_read and messages:
         for m in messages:
-            sb_update("mc_messages", f"id=eq.{m['id']}", {"read": True})
+            marked = False
+            if api_key:
+                result = sb_rpc("mc_mark_message_read", {
+                    "p_api_key": api_key,
+                    "p_project_id": project_id,
+                    "p_message_id": m["id"],
+                })
+                # If RPC succeeded, skip direct update
+                if isinstance(result, dict) and result.get("ok"):
+                    marked = True
+            if not marked:
+                sb_update("mc_messages", f"id=eq.{m['id']}", {"read": True})
 
         # Auto-ACK senders — but ONLY for messages older than 60s. If the
         # message was sent recently, the sender is very likely still inside
@@ -280,7 +341,6 @@ def read_inbox(project_id: str, agent: str, mark_read: bool = True) -> List[Dict
             if not ts:
                 return True
             try:
-                # Supabase returns ISO8601 with timezone
                 dt = _dt.datetime.fromisoformat(str(ts).replace("Z", "+00:00"))
                 return (now - dt).total_seconds() > 60
             except Exception:
@@ -291,14 +351,9 @@ def read_inbox(project_id: str, agent: str, mark_read: bool = True) -> List[Dict
             if m.get("type") not in ("ack", "broadcast") and _is_stale(m)
         }
         for sender in ack_targets:
-            sb_insert("mc_messages", {
-                "project_id": project_id,
-                "from_agent": agent,
-                "to_agent": sender,
-                "type": "ack",
-                "payload": {"text": f"{agent} read your message"},
-                "read": False,
-            })
+            send_message(project_id, agent, sender,
+                         {"text": f"{agent} read your message"},
+                         msg_type="ack", api_key=api_key)
     return messages
 
 
@@ -311,6 +366,63 @@ def count_pending(project_id: str, agent: str) -> int:
     return len(pending)
 
 
+# ============================================================
+# Encryption helpers for sensitive mesh messages
+# ============================================================
+
+_mesh_key_cache: Dict[str, str] = {}  # project_id -> hex key
+
+
+def get_mesh_key(api_key: str, project_id: str) -> Optional[str]:
+    """Retrieve the per-meshwork encryption key (hex-encoded AES-256 key)."""
+    if project_id in _mesh_key_cache:
+        return _mesh_key_cache[project_id]
+    result = sb_rpc("mc_get_mesh_key", {
+        "p_api_key": api_key,
+        "p_project_id": project_id,
+    })
+    if isinstance(result, dict) and result.get("ok"):
+        key = result["key"]
+        _mesh_key_cache[project_id] = key
+        return key
+    return None
+
+
+def encrypt_payload(payload: Dict, hex_key: str) -> str:
+    """Encrypt a JSON payload using AES-256-GCM. Returns base64-encoded ciphertext."""
+    import base64
+    try:
+        from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+    except ImportError:
+        raise RuntimeError("cryptography package required for encrypted messages: pip install cryptography")
+    key = bytes.fromhex(hex_key)
+    nonce = os.urandom(12)  # 96-bit nonce for GCM
+    plaintext = json.dumps(payload).encode("utf-8")
+    aesgcm = AESGCM(key)
+    ciphertext = aesgcm.encrypt(nonce, plaintext, None)
+    # Format: base64(nonce + ciphertext)
+    return base64.b64encode(nonce + ciphertext).decode("ascii")
+
+
+def decrypt_payload(encrypted_b64: str, hex_key: str) -> Optional[Dict]:
+    """Decrypt an AES-256-GCM encrypted payload. Returns None on failure."""
+    import base64
+    try:
+        from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+    except ImportError:
+        return None
+    try:
+        key = bytes.fromhex(hex_key)
+        raw = base64.b64decode(encrypted_b64)
+        nonce = raw[:12]
+        ciphertext = raw[12:]
+        aesgcm = AESGCM(key)
+        plaintext = aesgcm.decrypt(nonce, ciphertext, None)
+        return json.loads(plaintext.decode("utf-8"))
+    except Exception:
+        return None
+
+
 def get_board(project_id: str) -> List[Dict]:
     return sb_select("mc_agents", f"project_id=eq.{project_id}", order="registered_at.asc")
 

{meshcode-2.5.3 → meshcode-2.5.4}/meshcode/meshcode_mcp/realtime.py

@@ -194,7 +194,7 @@ class RealtimeListener:
             data = payload.get("data") or {}
             if data.get("type") == "INSERT":
                 record = data.get("record") or {}
-                if record.get("to_agent") == self.agent_name:
+                if record.get("to_agent") == self.agent_name and record.get("project_id") == self.project_id:
                     enriched = {
                         "from": record.get("from_agent"),
                         "type": record.get("type", "msg"),

{meshcode-2.5.3 → meshcode-2.5.4}/meshcode/meshcode_mcp/server.py

@@ -482,6 +482,8 @@ def with_working_status(func):
             _check_hot_reload()
             _capture_session()  # stash session on first tool call for silent auto-wake
             if not skip:
+                global _CONSECUTIVE_IDLE_SECONDS
+                _CONSECUTIVE_IDLE_SECONDS = 0  # any non-wait tool resets idle timer
                 _set_state("working", name)
                 _record_event_bg("tool_call", {"tool": name, "args_keys": list(kwargs.keys())})
             try:
@@ -503,6 +505,8 @@ def with_working_status(func):
             _check_hot_reload()
             _capture_session()  # stash session on first tool call for silent auto-wake
             if not skip:
+                global _CONSECUTIVE_IDLE_SECONDS
+                _CONSECUTIVE_IDLE_SECONDS = 0  # any non-wait tool resets idle timer
                 _set_state("working", name)
                 _record_event_bg("tool_call", {"tool": name, "args_keys": list(kwargs.keys())})
             try:
@@ -975,15 +979,18 @@ def _heartbeat_thread_fn():
                 # Actually in meshcode_wait right now — listening for messages
                 if _current_state != "waiting":
                     _set_state("waiting", "listening for messages")
-            elif parent_cpu > 5.0:
-                # LLM is actively generating tokens
+            elif parent_cpu > 3.0:
+                # LLM is actively generating tokens or streaming
                 if _current_state != "working":
                     _set_state("working", "generating response")
             elif _current_state == "working":
-                # LLM just stopped — brief online before sleeping
+                # LLM just stopped — transition to online (not sleeping)
                 _set_state("online", "")
-            elif _current_state in ("online", "idle") and idle_secs > 10:
-                # Not in loop, not thinking → sleeping
+            elif _current_state == "online" and idle_secs > 30:
+                # Brief idle — show as idle, not sleeping yet
+                _set_state("idle", "idle")
+            elif _current_state == "idle" and idle_secs > 90 and parent_cpu < 2.0:
+                # Extended idle + no CPU activity → sleeping
                 _set_state("sleeping", "sleeping")
 
             # Sync current state to DB (in case realtime missed it)
@@ -1112,8 +1119,8 @@ except Exception:
 @mcp.tool()
 @with_working_status
 def meshcode_send(to: str, message: Any, in_reply_to: Optional[str] = None,
-                  sensitive: bool = False) -> Dict[str, Any]:
-    """Send message. Use "agent@meshwork" for cross-mesh. sensitive=True hides from exports."""
+                  sensitive: bool = False, encrypted: bool = False) -> Dict[str, Any]:
+    """Send message. Use "agent@meshwork" for cross-mesh. sensitive=True hides from exports. encrypted=True encrypts payload with per-meshwork AES-256 key."""
     if isinstance(message, str):
         payload: Dict[str, Any] = {"text": message}
     elif isinstance(message, dict):
@@ -1124,8 +1131,8 @@ def meshcode_send(to: str, message: Any, in_reply_to: Optional[str] = None,
     # Cross-mesh routing: if 'to' contains '@', parse as agent@meshwork
     if "@" in to:
         target_agent, target_meshwork = to.split("@", 1)
-        if sensitive:
-            return {"error": "sensitive messages cannot be sent cross-mesh"}
+        if sensitive or encrypted:
+            return {"error": "sensitive/encrypted messages cannot be sent cross-mesh"}
         api_key = _get_api_key()
         return be.sb_rpc("mc_send_cross_mesh", {
             "p_api_key": api_key,
@@ -1138,7 +1145,8 @@ def meshcode_send(to: str, message: Any, in_reply_to: Optional[str] = None,
         })
 
     return be.send_message(_PROJECT_ID, AGENT_NAME, to, payload, msg_type="msg",
-                           parent_msg_id=in_reply_to, sensitive=sensitive)
+                           parent_msg_id=in_reply_to, sensitive=sensitive,
+                           api_key=_get_api_key(), encrypted=encrypted)
 
 
 @mcp.tool()
@@ -1159,7 +1167,8 @@ def meshcode_broadcast(payload: Any) -> Dict[str, Any]:
     sent = 0
     for a in agents:
         if a["name"] != AGENT_NAME:
-            be.send_message(_PROJECT_ID, AGENT_NAME, a["name"], payload, msg_type="broadcast")
+            be.send_message(_PROJECT_ID, AGENT_NAME, a["name"], payload, msg_type="broadcast",
+                               api_key=_get_api_key())
             sent += 1
     return {"broadcast": True, "agents_notified": sent}
 
@@ -1168,7 +1177,7 @@ def meshcode_broadcast(payload: Any) -> Dict[str, Any]:
 @with_working_status
 def meshcode_read(include_acks: bool = False) -> Dict[str, Any]:
     """Read and consume pending messages. Returns {messages, acks, done_signals}."""
-    raw = be.read_inbox(_PROJECT_ID, AGENT_NAME)
+    raw = be.read_inbox(_PROJECT_ID, AGENT_NAME, api_key=_get_api_key())
     normalized = [
         {
             "from": m["from_agent"],
@@ -1241,6 +1250,11 @@ def _detect_global_done(messages: List[Dict[str, Any]]) -> Optional[Dict[str, An
     return None
 
 
+# Auto-sleep: track consecutive idle timeouts to auto-sleep after threshold
+_CONSECUTIVE_IDLE_SECONDS = 0
+_AUTO_SLEEP_THRESHOLD = int(os.environ.get("MESHCODE_AUTO_SLEEP_SECONDS", "600"))  # default 10min
+
+
 @mcp.tool()
 @with_working_status
 async def meshcode_wait(timeout_seconds: int = 120, include_acks: bool = False) -> Dict[str, Any]:
@@ -1249,7 +1263,7 @@ async def meshcode_wait(timeout_seconds: int = 120, include_acks: bool = False)
     Args:
         timeout_seconds: Max wait time in seconds (default 120, hard cap 120).
     """
-    global _IN_WAIT
+    global _IN_WAIT, _CONSECUTIVE_IDLE_SECONDS
     _IN_WAIT = True
     _set_state("waiting", "listening for messages")
     # Universal hard cap: even if a caller passes a larger value (e.g. 1800),
@@ -1260,6 +1274,30 @@ async def meshcode_wait(timeout_seconds: int = 120, include_acks: bool = False)
         result = await _meshcode_wait_inner(actual_timeout=capped_timeout, include_acks=include_acks)
         if result.get("got_message"):
             _set_state("online", "")
+            _CONSECUTIVE_IDLE_SECONDS = 0  # reset on message received
+        elif result.get("timed_out"):
+            _CONSECUTIVE_IDLE_SECONDS += capped_timeout
+            if _AUTO_SLEEP_THRESHOLD > 0 and _CONSECUTIVE_IDLE_SECONDS >= _AUTO_SLEEP_THRESHOLD:
+                # Auto-sleep: set status to sleeping and signal the agent to exit
+                try:
+                    api_key = _get_api_key()
+                    if api_key:
+                        be.sb_rpc("mc_agent_set_status_by_api_key", {
+                            "p_api_key": api_key,
+                            "p_project_id": _PROJECT_ID,
+                            "p_agent_name": AGENT_NAME,
+                            "p_status": "sleeping",
+                            "p_task": f"auto-sleep after {_CONSECUTIVE_IDLE_SECONDS}s idle",
+                        })
+                except Exception:
+                    pass
+                _CONSECUTIVE_IDLE_SECONDS = 0
+                return {
+                    "auto_sleep": True,
+                    "idle_seconds": _CONSECUTIVE_IDLE_SECONDS,
+                    "threshold": _AUTO_SLEEP_THRESHOLD,
+                    "instruction": "You have been idle too long. Status set to sleeping. Exit the wait loop to save resources. You will be woken by auto_wake if a new message arrives.",
+                }
         return result
     finally:
         _IN_WAIT = False
@@ -1268,6 +1306,20 @@ async def meshcode_wait(timeout_seconds: int = 120, include_acks: bool = False)
 async def _meshcode_wait_inner(actual_timeout: int, include_acks: bool) -> Dict[str, Any]:
 
     def _return_from_buffered(buffered: List[Dict[str, Any]]) -> Optional[Dict[str, Any]]:
+        # Auto-decrypt encrypted payloads
+        _mesh_key = None
+        for msg in buffered:
+            p = msg.get("payload")
+            if isinstance(p, dict) and "_encrypted" in p:
+                if _mesh_key is None:
+                    try:
+                        _mesh_key = be.get_mesh_key(_get_api_key(), _PROJECT_ID) or ""
+                    except Exception:
+                        _mesh_key = ""
+                if _mesh_key:
+                    decrypted = be.decrypt_payload(p["_encrypted"], _mesh_key)
+                    if decrypted is not None:
+                        msg["payload"] = decrypted
         deduped = _filter_and_mark(buffered)
         if not deduped:
             return None
@@ -1328,7 +1380,8 @@ def meshcode_done(reason: str) -> Dict[str, Any]:
         name = a.get("name")
         if name and name != AGENT_NAME:
             try:
-                be.send_message(_PROJECT_ID, AGENT_NAME, name, payload, msg_type="done")
+                be.send_message(_PROJECT_ID, AGENT_NAME, name, payload, msg_type="done",
+                                    api_key=_get_api_key())
                 sent += 1
             except Exception as e:
                 log.warning(f"meshcode_done: failed to notify {name}: {e}")
@@ -1353,7 +1406,7 @@ def meshcode_check(include_acks: bool = False) -> Dict[str, Any]:
     # non-destructive peek — messages stay pending until meshcode_wait or
     # meshcode_read consumes them.
     if not deduped and pending > 0:
-        raw = be.read_inbox(_PROJECT_ID, AGENT_NAME, mark_read=False)
+        raw = be.read_inbox(_PROJECT_ID, AGENT_NAME, mark_read=False, api_key=_get_api_key())
         deduped = [
             {
                 "from": m["from_agent"],
@@ -1451,7 +1504,7 @@ def meshcode_task_create(title: str, description: str = "", assignee: str = "*",
                 "title": title,
                 "priority": priority,
                 "text": f"New {priority} task assigned to you: {title}",
-            }, msg_type="system")
+            }, msg_type="system", api_key=_get_api_key())
         except Exception:
             pass  # best-effort notification
     return result

{meshcode-2.5.3 → meshcode-2.5.4}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.5.3
+Version: 2.5.4
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT
@@ -22,6 +22,7 @@ Requires-Dist: mcp[cli]>=1.0.0
 Requires-Dist: websockets>=12.0
 Requires-Dist: realtime>=2.0.0
 Requires-Dist: keyring>=24.0
+Requires-Dist: cryptography>=41.0
 
 # MeshCode
 

{meshcode-2.5.3 → meshcode-2.5.4}/meshcode.egg-info/requires.txt

@@ -2,3 +2,4 @@ mcp[cli]>=1.0.0
 websockets>=12.0
 realtime>=2.0.0
 keyring>=24.0
+cryptography>=41.0

{meshcode-2.5.3 → meshcode-2.5.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.5.3"
+version = "2.5.4"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}
@@ -16,6 +16,7 @@ dependencies = [
     "websockets>=12.0",
     "realtime>=2.0.0",
     "keyring>=24.0",
+    "cryptography>=41.0",
 ]
 classifiers = [
     "Development Status :: 4 - Beta",