@genspark/cli 1.0.20 → 1.0.22

package/README.md

@@ -26,6 +26,7 @@
 | 📱 **Social Media** | Twitter/X, Instagram, Reddit — search posts/users, get comments, connections, and more (30 APIs) |
 | 🤖 **Agents** | Podcasts, docs, slides, deep research, fact-checking, websites, batch media generation |
 | 🔊 **Voice** | Voice cloning, voice changer |
+| 🕸️ **Mesh** | Secure SSH between your devices over a private tailnet — `gsk mesh join`, `ssh`, `scp`, `forward` |
 
 ## Table of Contents
 
@@ -45,6 +46,7 @@
   - [Stock Prices](#stock-prices)
   - [Social Media](#social-media)
   - [File Transfer](#file-transfer)
+  - [Mesh (Secure SSH)](#mesh--secure-ssh-between-your-devices)
 - [Available Models](#available-models)
 - [Configuration](#configuration)
 - [Output Conventions](#output-conventions)
@@ -876,6 +878,45 @@ export GSK_NO_AUTO_UPDATE=1
 
 This separation allows programs to parse clean JSON from stdout while humans can follow progress on stderr.
 
+## Mesh — Secure SSH Between Your Devices
+
+`gsk mesh` adds peer-to-peer encrypted networking + SSH to the CLI, powered by Genspark Mesh (Tailscale-based). It reuses your `gsk` login — no separate authentication.
+
+`gsk mesh` is a thin wrapper around the native `gsk-mesh` binary, fetched from the Genspark CDN on first use (~8 MB), verified by sha256, and cached at `~/.genspark-tool-cli/bin/gsk-mesh` (Apple-notarized on macOS, DigiCert-signed on Windows). Supported platforms: macOS (arm64/x64), Linux (x64/arm64), Windows (x64).
+
+### First Run
+
+```bash
+gsk login                    # if you haven't already
+gsk mesh join --name laptop  # downloads gsk-mesh on first use, joins the mesh
+# Joined mesh as laptop (100.64.0.5).
+```
+
+### Common Workflows
+
+```bash
+gsk mesh devices             # list devices on your tailnet
+gsk mesh ssh laptop          # SSH into another device (system ssh + ProxyCommand)
+gsk mesh scp file laptop:~/  # scp via mesh
+gsk mesh forward -L 8080:localhost:80 laptop  # port-forward
+gsk mesh status              # is the mesh service healthy?
+gsk mesh leave               # disconnect this device
+```
+
+Run `gsk mesh --help` for the full command list (served by the native binary).
+
+> `gsk mesh login` is not a separate flow — `gsk` and `gsk mesh` share one authentication. Use `gsk login`.
+
+### Upgrading
+
+```bash
+gsk mesh upgrade             # check + pull the latest gsk-mesh release
+gsk mesh upgrade --force     # reinstall even if already at the latest
+gsk mesh upgrade --prerelease  # opt into the beta channel
+```
+
+The native binary upgrades independently of `@genspark/cli`, so newer mesh features land without an `npm install -g @genspark/cli` cycle. When a binary is already installed, `gsk mesh` also checks for updates in the background on the same 4-hour cadence as the CLI's own auto-update (honoring `GSK_NO_AUTO_UPDATE` / `"auto_update": false`).
+
 ## Available Models
 
 <details>

package/dist/commands/mesh.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `gsk mesh` — thin proxy to the native gsk-mesh binary.
+ *
+ * gsk-mesh is a standalone native Rust binary (Genspark Mesh: Tailscale-based
+ * private networking + SSH). `gsk mesh <args...>` lazily downloads + verifies
+ * it on first use, then exec's it with the remaining argv. Auth is shared:
+ * gsk-mesh reads the same ~/.genspark-tool-cli/config.json `api_key` that
+ * `gsk login` writes.
+ *
+ * Why this is intercepted OUTSIDE commander (see index.ts main()): a true
+ * passthrough needs commander's `passThroughOptions`, which requires
+ * `enablePositionalOptions` on the program — and that flips global option
+ * parsing for the WHOLE CLI (`gsk web_search q --debug` would break). So we
+ * detect `mesh` by scanning argv ourselves and forward everything verbatim,
+ * leaving the rest of the CLI's parsing untouched. The stub command registered
+ * by `registerMeshCommand` exists only so `mesh` shows up in `gsk --help`.
+ */
+import { Command } from 'commander';
+/**
+ * If the invocation is `gsk [global-opts] mesh [args...]`, return the args
+ * after `mesh` (possibly empty). Otherwise return null.
+ *
+ * `argv` is process.argv.slice(2) (no node/script prefix).
+ */
+export declare function getMeshInvocation(argv: string[]): string[] | null;
+/**
+ * Handle a `gsk mesh ...` invocation end-to-end. Dispatches:
+ *   - `upgrade`        → TS-side version negotiation + download
+ *   - `login`          → redirect to `gsk login` (shared auth; no duplicate UI)
+ *   - everything else  → download-if-needed + exec the native binary verbatim
+ *     (`whoami`, `logout`, `devices`, `join`, `ssh`, `--help`, …)
+ */
+export declare function runMesh(args: string[], baseUrlOverride?: string): Promise<void>;
+/**
+ * Register the stub `mesh` command so it appears in `gsk --help`. The real
+ * handling happens in index.ts main() via getMeshInvocation/runMesh before
+ * commander parses — this action is a safety net only.
+ */
+export declare function registerMeshCommand(program: Command): void;
+//# sourceMappingURL=mesh.d.ts.map

package/dist/commands/mesh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh.d.ts","sourceRoot":"","sources":["../../src/commands/mesh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAmBnC;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAyBjE;AA6CD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCrF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAe1D"}

package/dist/commands/mesh.js

@@ -0,0 +1,164 @@
+/**
+ * `gsk mesh` — thin proxy to the native gsk-mesh binary.
+ *
+ * gsk-mesh is a standalone native Rust binary (Genspark Mesh: Tailscale-based
+ * private networking + SSH). `gsk mesh <args...>` lazily downloads + verifies
+ * it on first use, then exec's it with the remaining argv. Auth is shared:
+ * gsk-mesh reads the same ~/.genspark-tool-cli/config.json `api_key` that
+ * `gsk login` writes.
+ *
+ * Why this is intercepted OUTSIDE commander (see index.ts main()): a true
+ * passthrough needs commander's `passThroughOptions`, which requires
+ * `enablePositionalOptions` on the program — and that flips global option
+ * parsing for the WHOLE CLI (`gsk web_search q --debug` would break). So we
+ * detect `mesh` by scanning argv ourselves and forward everything verbatim,
+ * leaving the rest of the CLI's parsing untouched. The stub command registered
+ * by `registerMeshCommand` exists only so `mesh` shows up in `gsk --help`.
+ */
+import { spawn } from 'child_process';
+import { ensureMeshBinary } from '../mesh/download.js';
+import { runUpgrade } from '../mesh/upgrade.js';
+import { maybeAutoUpgradeMesh } from '../mesh/upgrade.js';
+import { info, error as logError, debug } from '../logger.js';
+// Global options (defined on `program` in index.ts) that consume the following
+// argv token as their value. Used by the argv scanner to find the command name
+// without mis-reading an option value as the command.
+const VALUE_TAKING_GLOBALS = new Set([
+    '--api-key',
+    '--base-url',
+    '--project-id',
+    '--timeout',
+    '--output',
+    '--config',
+]);
+/**
+ * If the invocation is `gsk [global-opts] mesh [args...]`, return the args
+ * after `mesh` (possibly empty). Otherwise return null.
+ *
+ * `argv` is process.argv.slice(2) (no node/script prefix).
+ */
+export function getMeshInvocation(argv) {
+    let i = 0;
+    while (i < argv.length) {
+        const tok = argv[i];
+        if (tok === '--') {
+            // End-of-options marker: the next token (if any) is the command.
+            const cmd = argv[i + 1];
+            return cmd === 'mesh' ? argv.slice(i + 2) : null;
+        }
+        if (tok.startsWith('-')) {
+            if (tok.includes('=')) {
+                i++; // --opt=value : single token
+                continue;
+            }
+            if (VALUE_TAKING_GLOBALS.has(tok)) {
+                i += 2; // skip option + its value
+                continue;
+            }
+            i++; // boolean global (--debug / --refresh / --version …)
+            continue;
+        }
+        // First bare operand is the command name.
+        return tok === 'mesh' ? argv.slice(i + 1) : null;
+    }
+    return null;
+}
+const UPGRADE_USAGE = [
+    'Usage: gsk mesh upgrade [options]',
+    '',
+    'Check for and install a newer gsk-mesh release.',
+    '',
+    'Options:',
+    '  --force        Reinstall even if already at the latest version',
+    '  --prerelease   Use the pre-release (beta) channel',
+    '  -h, --help     Show this help',
+].join('\n');
+/** Run `gsk mesh upgrade` with manually-parsed flags. */
+async function handleUpgrade(rest, baseUrlOverride) {
+    if (rest.includes('-h') || rest.includes('--help')) {
+        info(UPGRADE_USAGE);
+        process.exit(0);
+    }
+    const force = rest.includes('--force');
+    const prerelease = rest.includes('--prerelease');
+    const result = await runUpgrade({ force, prerelease, baseUrlOverride });
+    process.exit(result === 'error' ? 1 : 0);
+}
+/** Exec a resolved native binary with `args`, inheriting stdio; propagate exit/signal. */
+function spawnNative(bin, args) {
+    const child = spawn(bin, args, { stdio: 'inherit' });
+    child.on('error', err => {
+        logError(`Failed to launch gsk-mesh: ${err.message}`);
+        process.exit(1);
+    });
+    child.on('exit', (code, signal) => {
+        if (signal) {
+            // Re-raise the signal so our exit status mirrors the child's
+            // (e.g. Ctrl-C during `gsk mesh ssh`).
+            process.kill(process.pid, signal);
+        }
+        else {
+            process.exit(code ?? 1);
+        }
+    });
+    // execNative never returns normally — the process exits via the handlers.
+    return new Promise(() => { });
+}
+/**
+ * Handle a `gsk mesh ...` invocation end-to-end. Dispatches:
+ *   - `upgrade`        → TS-side version negotiation + download
+ *   - `login`          → redirect to `gsk login` (shared auth; no duplicate UI)
+ *   - everything else  → download-if-needed + exec the native binary verbatim
+ *     (`whoami`, `logout`, `devices`, `join`, `ssh`, `--help`, …)
+ */
+export async function runMesh(args, baseUrlOverride) {
+    const sub = args[0];
+    if (sub === 'upgrade') {
+        await handleUpgrade(args.slice(1), baseUrlOverride);
+        return;
+    }
+    if (sub === 'login') {
+        // `gsk` and `gsk mesh` share one authentication. Don't expose a duplicate
+        // device-flow; point users at the single login UI. Explicit message (not a
+        // silent rewrite) so someone copying `gsk-mesh login` from the native docs
+        // understands why it differs here.
+        info('`gsk` and `gsk mesh` share the same authentication — run `gsk login` instead.');
+        process.exit(0);
+    }
+    // Resolve (and if needed download/repair) the binary FIRST, so its install
+    // settles before we kick off the background currency check — otherwise both
+    // could call downloadAndInstall at once and race.
+    let bin;
+    try {
+        bin = await ensureMeshBinary();
+    }
+    catch (err) {
+        logError(err.message);
+        process.exit(1);
+    }
+    // Background, throttled currency check (never blocks this invocation). Skipped
+    // automatically when no binary is installed yet or auto-update is disabled.
+    // Safe to run now: ensureMeshBinary has finished, so no concurrent install.
+    void maybeAutoUpgradeMesh(baseUrlOverride).catch(err => debug(`mesh autorun: ${err.message}`));
+    await spawnNative(bin, args);
+}
+/**
+ * Register the stub `mesh` command so it appears in `gsk --help`. The real
+ * handling happens in index.ts main() via getMeshInvocation/runMesh before
+ * commander parses — this action is a safety net only.
+ */
+export function registerMeshCommand(program) {
+    program
+        .command('mesh')
+        .description('Genspark Mesh — secure SSH between your devices over a private tailnet. ' +
+        'Native subcommand; downloads gsk-mesh on first use. Run `gsk mesh --help` for the full command list.')
+        .allowUnknownOption(true)
+        .helpOption(false)
+        .argument('[args...]', 'forwarded verbatim to the native gsk-mesh binary')
+        .action(async (args) => {
+        // Reached only if the early intercept missed (shouldn't happen). Forward
+        // anyway so behavior stays correct.
+        await runMesh(args ?? []);
+    });
+}
+//# sourceMappingURL=mesh.js.map

package/dist/commands/mesh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh.js","sourceRoot":"","sources":["../../src/commands/mesh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAE7D,+EAA+E;AAC/E,+EAA+E;AAC/E,sDAAsD;AACtD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,WAAW;IACX,YAAY;IACZ,cAAc;IACd,WAAW;IACX,UAAU;IACV,UAAU;CACX,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,iEAAiE;YACjE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACvB,OAAO,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAClD,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,CAAC,EAAE,CAAA,CAAC,6BAA6B;gBACjC,SAAQ;YACV,CAAC;YACD,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,CAAC,IAAI,CAAC,CAAA,CAAC,0BAA0B;gBACjC,SAAQ;YACV,CAAC;YACD,CAAC,EAAE,CAAA,CAAC,qDAAqD;YACzD,SAAQ;QACV,CAAC;QACD,0CAA0C;QAC1C,OAAO,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAClD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,mCAAmC;IACnC,EAAE;IACF,iDAAiD;IACjD,EAAE;IACF,UAAU;IACV,kEAAkE;IAClE,qDAAqD;IACrD,iCAAiC;CAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ,yDAAyD;AACzD,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,eAAwB;IACnE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,aAAa,CAAC,CAAA;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAA;IACvE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,0FAA0F;AAC1F,SAAS,WAAW,CAAC,GAAW,EAAE,IAAc;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IACpD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACtB,QAAQ,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,IAAI,MAAM,EAAE,CAAC;YACX,6DAA6D;YAC7D,uCAAuC;YACvC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;QACzB,CAAC;IACH,CAAC,CAAC,CAAA;IACF,0EAA0E;IAC1E,OAAO,IAAI,OAAO,CAAQ,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,eAAwB;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAEnB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAA;QACnD,OAAM;IACR,CAAC;IAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,mCAAmC;QACnC,IAAI,CAAC,+EAA+E,CAAC,CAAA;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,gBAAgB,EAAE,CAAA;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAE,GAAa,CAAC,OAAO,CAAC,CAAA;QAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,4EAA4E;IAC5E,KAAK,oBAAoB,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CACrD,KAAK,CAAC,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CACjD,CAAA;IAED,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,0EAA0E;QACxE,sGAAsG,CACzG;SACA,kBAAkB,CAAC,IAAI,CAAC;SACxB,UAAU,CAAC,KAAK,CAAC;SACjB,QAAQ,CAAC,WAAW,EAAE,kDAAkD,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,IAAc,EAAE,EAAE;QAC/B,yEAAyE;QACzE,oCAAoC;QACpC,MAAM,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACN,CAAC"}

package/dist/commands/sb-git-clone.d.ts

@@ -36,6 +36,8 @@ export interface CloneUrlData {
  * fail with a confusing 403.
  */
 export declare function interpolateCloneUrl(template: string, apiKey: string, host: string): string;
+/** Normalize stale server templates before execute mode spawns git. */
+export declare function normalizeCloneUrlForGit(cloneUrl: string): string;
 /** Strip protocol + trailing slash from a base URL to get a bare host. */
 export declare function deriveHost(baseUrl: string): string;
 /**

package/dist/commands/sb-git-clone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sb-git-clone.d.ts","sourceRoot":"","sources":["../../src/commands/sb-git-clone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AASH,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,MAAM,CAwBR;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CAiBR;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,IAAI,EAAE,YAAY,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;CACjC,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBlB"}
+{"version":3,"file":"sb-git-clone.d.ts","sourceRoot":"","sources":["../../src/commands/sb-git-clone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AASH,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,MAAM,CAwBR;AAED,uEAAuE;AACvE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKhE;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CAiBR;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,IAAI,EAAE,YAAY,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;CACjC,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBlB"}

package/dist/commands/sb-git-clone.js

@@ -52,6 +52,10 @@ export function interpolateCloneUrl(template, apiKey, host) {
         .replace(/\$GSK_API_KEY/g, () => apiKey)
         .replace(/\$GSK_HOST/g, () => host);
 }
+/** Normalize stale server templates before execute mode spawns git. */
+export function normalizeCloneUrlForGit(cloneUrl) {
+    return cloneUrl.replace(/^(https:\/\/[^/]+)\/sb-git\//, '$1/api/second-brain/');
+}
 /** Strip protocol + trailing slash from a base URL to get a bare host. */
 export function deriveHost(baseUrl) {
     return baseUrl.replace(/^https?:\/\//, '').replace(/\/$/, '');
@@ -113,7 +117,7 @@ export async function executeCloneUrl(opts) {
     let cloneUrl;
     let dest;
     try {
-        cloneUrl = interpolateCloneUrl(data.url, apiKey, deriveHost(baseUrl));
+        cloneUrl = normalizeCloneUrlForGit(interpolateCloneUrl(data.url, apiKey, deriveHost(baseUrl)));
         dest = resolveCloneDest(data.repo, explicitDest);
     }
     catch (e) {

package/dist/commands/sb-git-clone.js.map

@@ -1 +1 @@
-{"version":3,"file":"sb-git-clone.js","sourceRoot":"","sources":["../../src/commands/sb-git-clone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACrC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ,EAAE,MAAM,cAAc,CAAA;AAUtD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,MAAc,EACd,IAAY;IAEZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAA;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CACb,oDAAoD,QAAQ,EAAE,CAC/D,CAAA;IACH,CAAC;IACD,wEAAwE;IACxE,qEAAqE;IACrE,mEAAmE;IACnE,uEAAuE;IACvE,sDAAsD;IACtD,OAAO,QAAQ;SACZ,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;SACvC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;AACvC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,QAA4B;IAE5B,kEAAkE;IAClE,oEAAoE;IACpE,oCAAoC;IACpC,MAAM,IAAI,GAAG,QAAQ;QACnB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,uCAAuC;gBACnE,yCAAyC,CAC5C,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,IAAY;IAEZ,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CACjB,KAAK,EACL,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,EACpC;YACE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;YACvC,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,mBAAmB,EAAE,GAAG;aACzB;SACF,CACF,CAAA;QACD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;QAC9C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,QAAQ,CAAC,qBAAqB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC5C,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAKrC;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,IAAI,CAAA;IACpD,IAAI,QAAgB,CAAA;IACpB,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;QACrE,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAE,CAAW,CAAC,OAAO,CAAC,CAAA;QAC9B,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAChD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAA;IAC/B,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"sb-git-clone.js","sourceRoot":"","sources":["../../src/commands/sb-git-clone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACrC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ,EAAE,MAAM,cAAc,CAAA;AAUtD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,MAAc,EACd,IAAY;IAEZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAA;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CACb,oDAAoD,QAAQ,EAAE,CAC/D,CAAA;IACH,CAAC;IACD,wEAAwE;IACxE,qEAAqE;IACrE,mEAAmE;IACnE,uEAAuE;IACvE,sDAAsD;IACtD,OAAO,QAAQ;SACZ,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;SACvC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;AACvC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,OAAO,QAAQ,CAAC,OAAO,CACrB,8BAA8B,EAC9B,sBAAsB,CACvB,CAAA;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,QAA4B;IAE5B,kEAAkE;IAClE,oEAAoE;IACpE,oCAAoC;IACpC,MAAM,IAAI,GAAG,QAAQ;QACnB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,uCAAuC;gBACnE,yCAAyC,CAC5C,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,IAAY;IAEZ,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CACjB,KAAK,EACL,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,EACpC;YACE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;YACvC,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,mBAAmB,EAAE,GAAG;aACzB;SACF,CACF,CAAA;QACD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;QAC9C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,QAAQ,CAAC,qBAAqB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC5C,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAKrC;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,IAAI,CAAA;IACpD,IAAI,QAAgB,CAAA;IACpB,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,QAAQ,GAAG,uBAAuB,CAChC,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAC3D,CAAA;QACD,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAE,CAAW,CAAC,OAAO,CAAC,CAAA;QAC9B,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAChD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAA;IAC/B,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/index.js

@@ -30,22 +30,12 @@ import { setDebugEnabled, setOutputFormat, debug, info, error as logError, outpu
 import { loadConfigFile, saveConfigFile, getConfigPath, loadToolsCache, saveToolsCache, setConfigPathOverride, } from './config.js';
 import { checkForUpdates } from './updater.js';
 import { registerDesignCommand } from './commands/design.js';
-import { executeCloneUrl } from './commands/sb-git-clone.js';
+import { registerMeshCommand, getMeshInvocation, runMesh } from './commands/mesh.js';
+import { executeCloneUrl, normalizeCloneUrlForGit, } from './commands/sb-git-clone.js';
 const require = createRequire(import.meta.url);
 const { version: VERSION } = require('../package.json');
 const DEFAULT_BASE_URL = 'https://www.genspark.ai';
 const DEFAULT_TIMEOUT = 1800000; // 30 minutes (slides/video generation can be slow)
-// Tools whose typical runtime (≥5 min p95) exceeds Claude Code's Bash
-// default 2-minute absolute timeout (cli.formatted.js:317781 —
-// setTimeout(SIGKILL, Q) is one-shot, never reset by stderr activity).
-// When detected running inside Claude Code (CLAUDECODE=1), gsk emits a
-// stderr hint and exits with code 2 so the agent retries with
-// run_in_background=true and polls via the BashOutput tool. See #30305.
-const LONG_RUNNING_TOOLS = new Set([
-    'create_task',
-    'video_generation',
-    'audio_generation',
-]);
 /**
  * Resolve a custom config path from process.env / process.argv before
  * Commander has had a chance to parse flags.  We peek at argv directly
@@ -125,42 +115,6 @@ function getGlobalOptions() {
         refresh: opts.refresh || false,
     };
 }
-/**
- * If running inside Claude Code's Bash tool (CLAUDECODE=1) and invoking a
- * known long-running tool, print a stderr hint and exit before the
- * 2-minute SIGKILL would fire. The agent reads stderr and retries with
- * run_in_background=true + BashOutput polling. Escape hatch:
- * GSK_FORCE_FOREGROUND=1 skips the check.
- */
-function adviseBackgroundIfNeeded(toolName) {
-    if (process.env.CLAUDECODE !== '1')
-        return;
-    if (!LONG_RUNNING_TOOLS.has(toolName))
-        return;
-    if (process.env.GSK_FORCE_FOREGROUND === '1')
-        return;
-    // POSIX-safe single-quote escaping: bare-safe chars unquoted; everything
-    // else wrapped in single quotes with embedded `'` rendered as `'\''`.
-    // Avoids the incomplete-sanitization trap of escaping only quotes in a
-    // double-quoted form (CodeQL js/incomplete-sanitization).
-    const shQuote = (arg) => /^[a-zA-Z0-9_\-./=:@]+$/.test(arg) ? arg : `'${arg.replace(/'/g, "'\\''")}'`;
-    const cmdLine = process.argv.slice(1).map(shQuote).join(' ');
-    // The retry command MUST carry GSK_FORCE_FOREGROUND=1. Claude Code
-    // injects CLAUDECODE=1 into every spawned child regardless of
-    // run_in_background, so without an inline override the retried gsk
-    // process would hit this same check and exit 2 again — an infinite
-    // loop. (Reported by Bugbot on PR #30760.)
-    process.stderr.write(`\n⚠️  Long-running task (typical duration: 5-30 minutes).\n\n` +
-        `Claude Code's Bash tool will SIGKILL this process at its 2-minute absolute timeout.\n` +
-        `The backend would keep running but the result would be lost.\n\n` +
-        `Please retry this command with run_in_background=true and poll the result via BashOutput:\n\n` +
-        `  Bash:\n` +
-        `    command: GSK_FORCE_FOREGROUND=1 ${cmdLine}\n` +
-        `    run_in_background: true\n\n` +
-        `Then call BashOutput repeatedly until status="completed" — the final JSON result will appear in stdout.\n\n` +
-        `(The inline GSK_FORCE_FOREGROUND=1 is required: Claude Code re-injects CLAUDECODE=1 into the retry process, so without the override this same check would fire again.)\n`);
-    process.exit(2);
-}
 function createClient() {
     const options = getGlobalOptions();
     setDebugEnabled(options.debug);
@@ -696,11 +650,6 @@ function registerToolCommand(parentProgram, tool, clientFactory, vdProjectIdDefa
                 await startAcpBridge(taskType, clientFactory().getOptions());
                 return;
             }
-            // Long-running tools under Claude Code's Bash tool get SIGKILLed at
-            // the 2-minute absolute timeout. Fail fast with a stderr hint so the
-            // agent retries with run_in_background=true and polls via BashOutput.
-            // See #30305 and adviseBackgroundIfNeeded below.
-            adviseBackgroundIfNeeded(tool.name);
             // For create_task (non-ACP): validate required params manually
             if (tool.name === 'create_task') {
                 for (const reqParam of required) {
@@ -843,12 +792,27 @@ function registerToolCommand(parentProgram, tool, clientFactory, vdProjectIdDefa
             // Resolve local file paths to uploaded URLs
             const resolvedArgs = await resolveLocalFiles(args, client);
             const result = await client.executeTool(tool.name, resolvedArgs);
+            const isSbGitCloneUrl = tool.name === 'sb-git' &&
+                resolvedArgs.action === 'clone-url';
+            if (isSbGitCloneUrl &&
+                result.status === 'ok' &&
+                result.data &&
+                typeof result.data === 'object') {
+                const data = result.data;
+                if (typeof data.url === 'string') {
+                    const before = data.url;
+                    const after = normalizeCloneUrlForGit(before);
+                    data.url = after;
+                    if (Array.isArray(data.commands)) {
+                        data.commands = data.commands.map((cmd) => typeof cmd === 'string' ? cmd.replace(before, after) : cmd);
+                    }
+                }
+            }
             // sb-git clone-url --execute: substitute placeholders + spawn
             // `git clone` locally. Backend response stays placeholder-only
             // (no secrets in stdout / logs); substitution + subprocess live
             // here because they need in-process auth + access to git.
-            if (tool.name === 'sb-git' &&
-                resolvedArgs.action === 'clone-url' &&
+            if (isSbGitCloneUrl &&
                 sbGitExecuteRequested &&
                 result.status === 'ok' &&
                 result.data &&
@@ -927,6 +891,10 @@ function registerToolCommand(parentProgram, tool, clientFactory, vdProjectIdDefa
 // Register cc-bridge design command. Static (not server-discovered)
 // because it runs entirely client-side — no API roundtrip.
 registerDesignCommand(program);
+// Register the `mesh` stub so it shows in `gsk --help`. Actual handling is an
+// early intercept in main() (see getMeshInvocation/runMesh) — commander can't
+// passthrough native-binary args without breaking global option parsing.
+registerMeshCommand(program);
 program
     .command('list-tools')
     .alias('ls')
@@ -1506,6 +1474,22 @@ addPhoneCallOptions(program
 // Dynamic Tool Registration & Startup
 // ============================================
 async function main() {
+    // `gsk mesh ...` is a native-binary passthrough — intercept it before the
+    // tool-fetch path and npm self-update gating (it needs neither). Handling it
+    // outside commander keeps the rest of the CLI's option parsing intact (see
+    // commands/mesh.ts for why).
+    const meshArgs = getMeshInvocation(process.argv.slice(2));
+    if (meshArgs !== null) {
+        program.parseOptions(process.argv);
+        setDebugEnabled(getGlobalOptions().debug);
+        // Forward an explicit `--base-url` flag only (commander leaves it at
+        // DEFAULT_BASE_URL when unset); env/config/prod-default resolution happens
+        // inside the mesh layer so it doesn't inherit gsk's localhost default.
+        const rawBase = program.opts().baseUrl;
+        const baseUrlOverride = rawBase && rawBase !== DEFAULT_BASE_URL ? rawBase : undefined;
+        await runMesh(meshArgs, baseUrlOverride);
+        return;
+    }
     // Check for updates (non-blocking — failures are silently ignored)
     try {
         await checkForUpdates(VERSION);