Skip to content

Security policy: 0.6.x is the supported version - #16

Merged
Siddharth-DWT merged 1 commit into
mainfrom
security-supported-versions
Oct 14, 2026
Merged

Siddharth-DWT merged 1 commit into
mainfrom
security-supported-versions

Conversation

@Siddharth-DWT

Copy link
Copy Markdown
Collaborator

SECURITY.md still listed 0.1.x as the only supported version; the current release is 0.6.0. The table now says 0.6.x, and that it moves with each minor release.

Not user-facing in the package, so no changelog entry.

@Siddharth-DWT
Siddharth-DWT merged commit a7e6d50 into main Oct 14, 2026
6 checks passed
@Siddharth-DWT
Siddharth-DWT deleted the security-supported-versions branch October 14, 2026 17:46
Siddharth-DWT pushed a commit that referenced this pull request Oct 15, 2026
Brings in the security policy update (#16); no conflicts. ruff and mypy
clean, pytest 277 passed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Siddharth-DWT added a commit that referenced this pull request Oct 15, 2026
#17)

**Title:** Follow-ups, tables, monitors in full, triggers, proposals,
sub-accounts, and four monitor MCP tools

**Branch:** `feat/web-search-agent` → `main`. Two commits: `466280c`,
this work, made from `main` after #13's squash merge; and `149f7c1`,
`main` merged in (the security policy, #16; no conflict). Against `main`
the diff is 8 files, +1,371 −71, and it merges cleanly (checked with
`git merge-tree` on 15 Oct).

**Not to be released yet.** Every call added here needs API routes that
are on Seam-be's `feat/search-agent-groundwork` and not yet on
mesharc.dev. Release it (0.7.0) once that is deployed, as
`CONTRIBUTING.md` asks.

## Why

The API gained follow-ups, tables, monitor caps and records, triggers,
proposals, the estimate, sub-accounts, saved logins and data providers.
The client and the MCP server should reach them.

## What

**Client** (`mesharc/__init__.py`)

- **The agent:**
- `agent()` takes `login_id`, `data_connections` and `proposals`, each
sent only when given;
- `AgentRun.follow_up(prompt, ...)` asks the next question in the run's
conversation;
- `conversations(q=)` and `conversation(id)` list and read
conversations;
  - `trace()` knows the `lookup` step.
- **Monitors:**
- `create` and `update` take `budget`, `alerts`, `add_to_project`,
`rows`, `destination` and `sentiment`. `{}`, `""` and `False` are sent,
so they clear a setting; only `None` is left out.
- New: `overview()`, `rows()`, `rows_page()`, `row()`, `row_events()`
and `export_rows()`.
- **`arc.agent_batches`:** `preview`, `start`, `get`, `rows`, `wait`,
`list`, `cancel` and `export`, for the agent over every row of a table.
- **Also new:** `arc.triggers`, `arc.proposals` and `estimate(kind,
schedule, ...)`.
- **Sub-accounts:**
  - `arc.sub_accounts` makes and manages them;
- `MeshArc(tenant=...)` and `as_sub_account(id)` send `X-MeshArc-Tenant`
on every request;
  - `TENANT_HEADER` names the header.
- **`arc.connections` and `arc.logins`:** the workspace's connections
(data providers among them) and its saved logins.
- **Internals:** small shared helpers (`_some`, `_agent_body`,
`_offset_rows`, `_download`); `export()` now uses `_download`.

**MCP server** (`mesharc/mcp.py`): 21 tools.

- **`create_monitor`** keeps a web search (news too) or an agent
question on a schedule:
- an agent monitor stays on its starting sites unless told otherwise, as
`run_agent` does;
  - optional monthly cap, and record-by-record following;
- its own idempotency key, made from its inputs and the ten-minute
window.
- **`list_monitors`** lists the workspace's monitors, or one with its
latest runs. Read-only.
- **`pause_monitor`** pauses or resumes one.
- **`get_monitor_rows`** reads an agent monitor's records and what
moved, within 60,000 characters. Read-only.
- **`create_project`** takes `max_credits_per_run` and
`max_credits_per_month`. On a kept crawl they are set on the project it
becomes.
- Output schemas for the new answers; the server instructions name the
new tools.

**Docs:** README (follow-ups; logins, data providers and proposals;
monitors in full; tables; triggers, proposals and the estimate;
sub-accounts; connections and logins; the MCP tool list and the
read-only split; idempotency) and CHANGELOG, under Unreleased.

## Testing

- **Checks:** `ruff` clean, `mypy` clean, `pytest` 277 passed.
- `tests/test_client_workspace.py` (20 tests) and
`tests/test_monitor_tools.py` (10 tests) are new.
- The tool lists in `test_definitions.py` and `test_mcp_http.py` now
hold 21 tools, 8 of them read-only.
- **Live, against the local API from the feature branch**, in a
throwaway Scale workspace deleted afterwards:
- an agent run and its follow-up on one thread, the conversation listed,
and a 409 for a follow-up of a message that is not the latest;
  - a two-row table: preview, run, rows and export;
- an agent monitor with caps and records: 19 records with their sources,
and the overview;
  - a trigger made, listed, previewed, paused and deleted;
- sub-accounts: made; `as_sub_account` acts inside one, its own key
works and is revoked, and a suspended one refuses the header;
  - a data-provider connection whose real test refuses a made-up key;
  - the four MCP tools and `create_project`'s caps.
- **Field names** in the docs and the MCP descriptions checked against
Seam-be: a monitor record's columns are `attrs`; a table row's are
`values`.

## Notes

- `mesharc-mcp` pins the published 0.6.0 and is unchanged. It follows
the release.
- The MCP idempotency key is per process when run locally, as for
`run_agent`.

Co-authored-by: Siddharth-DWT <smishara9120@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant