@log0u7/opencode-mesh 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -7,6 +7,133 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-10-14
+
+### Added
+
+- Documentation: `docs/CONFIGURATION.md` (the full options reference), and new
+  architecture and wire protocol docs detailing the process model, worker
+  lifecycle, data-dir layout, and the HTTP/mDNS/pairing protocol. The README
+  links them and documents the plugin options inline.
+- Plugin options are validated at setup. A `port` outside `[0, 65535]` or not an
+  integer, a `bind` other than `loopback`/`lan`, a non-boolean `advertise`, or an
+  empty/non-string `dataDir` now fails fast with a clear message instead of
+  surfacing later as `EADDRINUSE`, a bind on the wrong interface, or a data dir
+  at the wrong path. `tsconfig.test.json` and a `pnpm typecheck:tests` step
+  typecheck the test suite, which `tsconfig.json` (src only) never did.
+
+### Changed
+
+- `engines.node` is now `>=22.5.0` (the first release with `node:sqlite`), and
+  `@types/node` is pinned to the max Node major tested in CI (24) instead of 26.
+  `scripts/smoke-dist.mjs` now asserts the v2 (`setup`) entrypoint, and
+  `biome.json` is migrated to the 2.5.x schema.
+- `mesh_lock` is documented and advertised as local to this machine: it is
+  enforced between sessions sharing this host's data directory and is not part
+  of the wire protocol. A guard test fails the build if a lock route reappears
+  on the server.
+- Removed the Ed25519 keypair ceremony in node identity: nothing signed or
+  verified with it, so the short fingerprint is derived from `node_id`.
+  Existing node ids are preserved on upgrade; the fingerprint value changes,
+  which may require re-pairing peers.
+- Workers spawned by `mesh_spawn` run with `OPENCODE_MESH_CHILD=1` and skip the
+  server, mDNS and all mesh tools, so a pool of N workers no longer costs N
+  mesh nodes.
+- `mesh_worker_logs` reads only the tail of a worker log instead of loading the
+  whole file on the host's event loop; `mesh_status` caches `tailscale status`
+  for 60s and bounds the subprocess with a 2s timeout.
+
+### Fixed
+
+- The docs no longer claim security behaviour the code does not implement:
+  `SECURITY.md` drops the "refuses entries that look like API-key formats"
+  promise (no such filtering exists) and the umask-077 claim (the data
+  *directory* is created `0700`; the SQLite file itself is not `chmod`ed), and
+  the README drops the non-existent `"allow_tailnet"` option while updating its
+  stale install pin.
+- `mesh_pair` now rejects an empty `node_id` or `token` instead of completing a
+  pairing with a credential nobody can present (or that clobbers a peer record).
+  A partially-supplied pair (`node_id` without `token`, or vice versa) is an
+  error rather than being silently ignored.
+- The mesh server reports a body read failure as `400` (malformed request) rather
+  than `413` (too large): a client that drops the connection mid-body no longer
+  looks like an oversized payload.
+- Peer addresses that carry an IPv6 zone id (`[fe80::1%eth0]:4399`) are accepted,
+  so a link-local peer is no longer silently unreachable.
+- `defaultDataDir()` no longer resolves to a filesystem-root path
+  (`/.local/share/opencode-mesh`) when `HOME` is unset or blank: it falls back to
+  `os.homedir()`, then `os.tmpdir()`.
+- The node identity migration now finishes on disk: a `node.json` written by
+  <= 0.2.0 is rewritten without its dead Ed25519 keypair, so the stale key
+  material no longer lingers after the id is loaded. A corrupt or `node_id`-less
+  `node.json` now fails loudly with a recovery path instead of silently minting a
+  new node id, which would break every peer that recognised the node. Closes #31.
+- `mesh_lock` no longer throws a raw `UNIQUE constraint failed` error when two
+  opencode sessions sharing the same data directory race for the same path. The
+  lock claim is a single atomic `INSERT ... ON CONFLICT DO NOTHING`, and the
+  worker status transition is a single guarded `UPDATE`, so a stale
+  read-then-write can neither raise nor overwrite a concurrently finalized row.
+- The mesh database now records a schema version (`PRAGMA user_version`) and
+  creates indexes for its hot lookups (unread messages, pending pairing tokens,
+  peer tokens, running workers, expired locks).
+- On OpenCode 2.x hosts, `mesh_spawn` and `mesh_worker_remove` no longer hand the
+  raw `ctx.worktree` domain to the REST-shaped worktree client. The in-process
+  domain (which resolves payloads directly, without the v1 `{ data, error }`
+  envelope) is wrapped back into that shape, and an injected
+  `options.worktreeClient` now takes precedence. Closes #29.
+- Worktree create/remove calls on the 1.x REST client are bounded by a 15s
+  timeout. A create response with no directory, or a remove response that is
+  not a boolean, now raises a clear error instead of persisting an `undefined`
+  directory. When the 2.x domain reports only a directory (no branch), the
+  worker's branch falls back to that directory's name.
+- A spawn that fails before the child runs no longer leaks its worktree:
+  `mesh_spawn` removes the worktree and the dead registry row when the child
+  never starts or `runWorker` throws. `mesh_worker_remove` keeps the registry
+  row when the worktree was not actually removed, instead of orphaning it.
+- Node runtime support: the published package no longer calls `require()` from
+  ESM modules. The Node fallback paths (`node:sqlite` engine, `node:crypto`)
+  now use static and dynamic imports and actually run. Vitest's module runner
+  injects a `require`, which hid the `ReferenceError` from the suite, so
+  `scripts/smoke-dist.mjs` loads the built package under plain Node and is part
+  of `pnpm verify`.
+- `mesh_send` no longer derives the peer's port from the local node. Discovered
+  addresses now carry the port from the mDNS SRV record (`[ipv6]:port` for IPv6
+  literals), and a portless address is refused instead of resolving to a wrong
+  socket. Peers that fall back to an ephemeral port are now reachable.
+- Workers killed through `mesh_worker_stop` no longer orphan their own child
+  processes: workers are detached process-group leaders and a stop takes the
+  group down. The late `exit` event after a deliberate stop no longer throws;
+  a host restart reconciles `running` rows whose pid is gone.
+- A worker that fails to start (binary missing, `error` event with no `exit`)
+  is now finalized as `failed` instead of staying `running` forever with a
+  leaked live entry; a `-1` pid is never persisted. `mesh_spawn` reports the
+  failure instead of a success envelope.
+- A worker's stderr is drained into its log; a child writing more than the pipe
+  buffer (~64 KB) to stderr no longer blocks. `mesh_worker_stop` escalates
+  `SIGTERM` to `SIGKILL` after 3s so a worker ignoring the signal cannot linger.
+- Worker logs are capped at 512 KB (rotated to `<id>.log.1`) and deleted by
+  `mesh_worker_remove`, so a chatty worker cannot fill the disk.
+- A JSON line split across two stdout chunks is now reassembled before parsing,
+  so a worker's `session_id` is captured instead of silently dropping to null.
+  A session id arriving after the row is terminal is ignored.
+
+### Security
+
+- The mesh HTTP server binds to `127.0.0.1` by default. `"bind": "lan"` opts
+  into listening on all interfaces, and `mesh_status` / the `mesh_pair` offer
+  report the address actually bound instead of a hardcoded loopback string.
+- Pairing offers expire after 5 minutes, are pruned on check, and a pending
+  token alone no longer installs a permanent peer: the claimed node must
+  already be known to this host (mDNS discovery or explicit `mesh_pair`).
+  Auto-pairing a previously unknown node id is gone.
+- Discovered peers keep their hostname and fingerprint through pairing instead
+  of collapsing to `"pending"`, so `mesh_status` still shows a real identity.
+
+### Removed
+
+- `/announce` endpoint, its parser and `touchAddress` (no client ever called
+  the route).
+
 ## [0.2.0] - 2026-10-12
 
 ### Added

package/README.md

@@ -10,6 +10,8 @@ Coordination for [OpenCode](https://opencode.ai): multiple sessions working toge
 
 Each node advertises itself over mDNS, pairs with explicit operator approval (per-peer bearer tokens, deny by default), then sessions can exchange messages (`mesh_send` / `mesh_inbox`) and coordinate on shared work (`mesh_lock` / `mesh_unlock`). Tailscale IPs are picked up automatically when `tailscale status` works, for cross-subnet pools.
 
+`mesh_lock` is **local to your machine**: it is enforced between OpenCode sessions sharing this host's data directory (`~/.local/share/opencode-mesh/`). Locks are not part of the wire protocol, so a peer on another node does not see or respect them. Remote nodes coordinate through messages (`mesh_send`), not locks.
+
 ## Install
 
 Register the plugin in `opencode.json` (project or global `~/.config/opencode/opencode.json`):
@@ -24,12 +26,36 @@ Restart OpenCode. The package is installed automatically at startup into opencod
 
 ```json
 {
-  "plugin": ["@log0u7/opencode-mesh@0.1.1"]
+  "plugin": ["@log0u7/opencode-mesh@0.3.0"]
+}
+```
+
+### Configuration
+
+All options are optional; see [docs/CONFIGURATION.md](docs/CONFIGURATION.md) for the reference.
+
+On OpenCode 1.x hosts, options travel in a package-and-options tuple:
+
+```json
+{
+  "plugin": [["@log0u7/opencode-mesh", { "port": 4399, "bind": "loopback", "advertise": true }]]
+}
+```
+
+On 2.x hosts the key is `plugins` and each entry is an object:
+
+```json
+{
+  "plugins": [
+    { "package": "@log0u7/opencode-mesh", "options": { "port": 4399, "bind": "lan" } }
+  ]
 }
 ```
 
 Node identity and mailbox live under `~/.local/share/opencode-mesh/` (honors `XDG_DATA_HOME`), created with restrictive permissions.
 
+Workers spawned with `mesh_spawn` run with `OPENCODE_MESH_CHILD=1`: they skip the mesh server, mDNS and all mesh tools, so a pool of N workers costs N worktrees, not N mesh nodes.
+
 Note (npm 12): the package ships no lifecycle install scripts and needs no `allowScripts` / allowlist on install (its runtime dependency `bonjour-service` has none either).
 
 ## Usage
@@ -38,10 +64,10 @@ Same machine: start two OpenCode instances in the same repository.
 
 ```
 mesh_status()                      # local sessions + paired peers + active locks
-mesh_pair()                        # list discovered peers, approve pairing
+mesh_pair()                        # emit a pairing offer (5 min) / complete the peer's offer
 mesh_send(peer="laptop", subject="handoff", body="...")
 mesh_inbox()                       # pull new messages, ack
-mesh_lock(path="src/api.ts", ttl=300)   # claim a file before editing
+mesh_lock(path="src/api.ts", ttl=300)   # claim a file before editing (this machine only)
 mesh_unlock(path="src/api.ts")
 ```
 
@@ -50,10 +76,10 @@ mesh_unlock(path="src/api.ts")
 | Tool | Args | Description |
 |---|---|---|
 | `mesh_status` | : local session registry, own address, paired peers, active locks. |
-| `mesh_pair` | `query?` | List discovered peers; operator approves by hostname/fingerprint. |
+| `mesh_pair` | `node_id?`, `token?`, `address?` | No args: emit a pairing offer (5 min ttl). With args: complete the peer's offer. |
 | `mesh_send` | `peer`, `subject`, `body` | Deliver a message to a peer's mailbox. |
 | `mesh_inbox` | `ack?` | Fetch unread messages; ack marks them read. |
-| `mesh_lock` | `path`, `ttl?` | Exclusive claim on a file or worktree path (default ttl 600s). |
+| `mesh_lock` | `path`, `ttl?` | Exclusive claim on a file or path, enforced only between sessions on this machine (default ttl 600s). Not visible to remote peers. |
 | `mesh_unlock` | `path` | Release a claim. |
 
 ### Orchestrator
@@ -72,22 +98,29 @@ Workers run `opencode run --dir <worktree> --format json` headless with `--auto`
 
 ### Security model
 
-- Every HTTP endpoint requires a per-peer bearer token; nothing is open by default.
-- All peers, same machine or remote, pair through `mesh_pair`: one side emits a one-time token, the other completes the pairing with it.
-- mDNS TXT records carry node id + key fingerprint only, never secrets.
-- LAN-only by default; tailnet addresses are surfaced by `mesh_status` when `tailscale` runs, for cross-subnet pools (`"allow_tailnet": true` plugin option, planned).
+- The HTTP mesh server binds to `127.0.0.1` by default. Set `"bind": "lan"` in the plugin options to listen on all interfaces for a LAN pool.
+- Every endpoint requires a per-peer bearer token; nothing is open by default.
+- Pairing offers expire after 5 minutes. A pending token alone grants nothing: the claimed node must already be known to this host (discovered over mDNS, or paired out of band with `mesh_pair`). Both sides run `mesh_pair` to complete a pairing, so a leaked offer cannot install a permanent peer on its own.
+- Peer addresses always carry the advertised port; a portless address is refused instead of being completed with the local port.
+- mDNS TXT records carry node id + fingerprint only, never secrets.
+- Tailnet addresses are surfaced by `mesh_status` when `tailscale` runs, for cross-subnet pools.
+- Messages travel over plain HTTP: there is no TLS layer. Loopback and trusted networks only.
 
 ## Development
 
-Requires Node >= 22 (mise: `mise install`) and pnpm (corepack).
+Requires Node >= 22.5 (`mise install`) and pnpm (corepack).
 
 ```sh
 pnpm install
-pnpm verify      # biome + typecheck + vitest
-pnpm build:check # tsc build + pack dry-run
+pnpm verify            # biome + typecheck + vitest + Node smoke of dist/
+pnpm typecheck:tests   # typecheck the test suite (also enforced in CI)
+pnpm build:check       # tsc build + pack dry-run
+pnpm smoke:dist        # build, then load dist/ under plain Node (no vitest shims)
 ```
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) for the workflow.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the workflow, and the [docs/](docs/) folder for
+[configuration](docs/CONFIGURATION.md), [architecture](docs/ARCHITECTURE.md), and the
+wire [protocol](docs/PROTOCOL.md).
 
 ## License
 

package/dist/lib/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,MAAM,MAAM,GAAG;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,IAAI,IAAI,CAAC;CACf,CAAC;AA4CF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAW/C"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,MAAM,MAAM,GAAG;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,IAAI,IAAI,CAAC;CACf,CAAC;AAgEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAW/C"}

package/dist/lib/db.js

@@ -1,6 +1,9 @@
 import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import { openSqlite } from "./sqlite.js";
+// Bump when a schema change needs a migration step; the version anchors future
+// migrations that cannot be expressed as idempotent `CREATE ... IF NOT EXISTS`.
+const SCHEMA_VERSION = 1;
 const SCHEMA = `
 CREATE TABLE IF NOT EXISTS peers (
   node_id TEXT PRIMARY KEY,
@@ -41,7 +44,22 @@ CREATE TABLE IF NOT EXISTS workers (
   started_at INTEGER NOT NULL,
   finished_at INTEGER
 );
+CREATE INDEX IF NOT EXISTS idx_messages_status_created ON messages(status, created_at);
+CREATE INDEX IF NOT EXISTS idx_pending_tokens_created ON pending_tokens(created_at);
+CREATE INDEX IF NOT EXISTS idx_peers_token ON peers(token);
+CREATE INDEX IF NOT EXISTS idx_workers_status ON workers(status);
+CREATE INDEX IF NOT EXISTS idx_locks_expires ON locks(expires_at);
 `;
+function migrate(conn) {
+    const current = conn.get("PRAGMA user_version")?.user_version ?? 0;
+    if (current >= SCHEMA_VERSION) {
+        return;
+    }
+    // Every statement in SCHEMA is idempotent, so a version-0 database (fresh or
+    // pre-versioning) is brought up to date by re-running it.
+    conn.exec(SCHEMA);
+    conn.run(`PRAGMA user_version = ${SCHEMA_VERSION}`);
+}
 export function openMeshDb(path) {
     if (path !== ":memory:") {
         mkdirSync(dirname(path), { recursive: true });
@@ -49,7 +67,7 @@ export function openMeshDb(path) {
     const conn = openSqlite(path);
     conn.run("PRAGMA journal_mode = WAL");
     conn.run("PRAGMA busy_timeout = 5000");
-    conn.exec(SCHEMA);
+    migrate(conn);
     return { conn, close: () => conn.close() };
 }
 //# sourceMappingURL=db.js.map

package/dist/lib/db.js.map

@@ -1 +1 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAmB,MAAM,aAAa,CAAC;AAO1D,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCd,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAmB,MAAM,aAAa,CAAC;AAO1D,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6Cd,CAAC;AAEF,SAAS,OAAO,CAAC,IAAgB;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAA2B,qBAAqB,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC;IAC7F,IAAI,OAAO,IAAI,cAAc,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,IAAI,CAAC,GAAG,CAAC,yBAAyB,cAAc,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;AAC7C,CAAC"}

package/dist/lib/discovery.d.ts

@@ -21,5 +21,6 @@ export declare function browseMesh(options: {
 }): {
     close(): void;
 };
+export declare function resetTailnetCache(): void;
 export declare function tailnetAddresses(): Promise<string[]>;
 //# sourceMappingURL=discovery.d.ts.map

package/dist/lib/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/lib/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,IAAI,IAAI,CAAC;CACf,CAAC;AAIF,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,eAAe,CAalB;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF,wBAAgB,UAAU,CAAC,OAAO,EAAE;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI,CAAC;CAC9C,GAAG;IAAE,KAAK,IAAI,IAAI,CAAA;CAAE,CAoBpB;AAID,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAkB1D"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/lib/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,IAAI,IAAI,CAAC;CACf,CAAC;AAIF,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,eAAe,CAalB;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF,wBAAgB,UAAU,CAAC,OAAO,EAAE;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI,CAAC;CAC9C,GAAG;IAAE,KAAK,IAAI,IAAI,CAAA;CAAE,CAoBpB;AAsBD,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAgC1D"}

package/dist/lib/discovery.js

@@ -25,7 +25,7 @@ export function browseMesh(options) {
             node_id: id,
             hostname: service.host ?? service.name,
             fingerprint: fp,
-            addresses: service.addresses ?? [],
+            addresses: socketAddresses(service.addresses, service.port),
         });
     });
     return {
@@ -34,12 +34,33 @@ export function browseMesh(options) {
         },
     };
 }
+// An mDNS A/AAAA record is a bare IP: the peer's listening port comes from the
+// SRV record in the same service. Guessing the port from the local node is
+// wrong whenever the peer fell back to an ephemeral port, so a record without
+// a port yields no address at all rather than a wrong one.
+function socketAddresses(ips, port) {
+    if (port === undefined) {
+        return [];
+    }
+    return (ips ?? []).map((ip) => (ip.includes(":") ? `[${ip}]:${port}` : `${ip}:${port}`));
+}
 // Tailnet addresses let peers connect across subnets when tailscale runs.
-// Absent CLI = empty list, never an error.
+// Absent CLI = empty list, never an error. The result is cached: mesh_status is
+// a hot tool call and `tailscale status --json` is a subprocess we must not pay
+// on every invocation.
+const TAILNET_TTL_MS = 60_000;
+const TAILNET_TIMEOUT_MS = 2000;
+let tailnetCache = null;
+export function resetTailnetCache() {
+    tailnetCache = null;
+}
 export async function tailnetAddresses() {
+    if (tailnetCache !== null && tailnetCache.expiresAt > Date.now()) {
+        return tailnetCache.addresses;
+    }
     const { execFile } = await import("node:child_process");
-    return new Promise((resolve) => {
-        execFile("tailscale", ["status", "--json"], (error, stdout) => {
+    const addresses = await new Promise((resolve) => {
+        execFile("tailscale", ["status", "--json"], { timeout: TAILNET_TIMEOUT_MS }, (error, stdout) => {
             if (error) {
                 resolve([]);
                 return;
@@ -54,5 +75,7 @@ export async function tailnetAddresses() {
             }
         });
     });
+    tailnetCache = { addresses, expiresAt: Date.now() + TAILNET_TTL_MS };
+    return addresses;
 }
 //# sourceMappingURL=discovery.js.map

package/dist/lib/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/lib/discovery.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAMjD,uEAAuE;AACvE,8BAA8B;AAC9B,MAAM,UAAU,aAAa,CAAC,OAK7B;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QACtC,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,WAAW,EAAE;KACtD,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,UAAU,CAAC,OAG1B;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE;QAC5E,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO;QACT,CAAC;QACD,OAAO,CAAC,YAAY,CAAC;YACnB,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI;YACtC,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;SACnC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAExD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,KAAmB,EAAE,MAAc,EAAE,EAAE;YAClF,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA2C,CAAC;gBAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,EAAE,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/lib/discovery.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAMjD,uEAAuE;AACvE,8BAA8B;AAC9B,MAAM,UAAU,aAAa,CAAC,OAK7B;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QACtC,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,WAAW,EAAE;KACtD,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,UAAU,CAAC,OAG1B;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE;QAC5E,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO;QACT,CAAC;QACD,OAAO,CAAC,YAAY,CAAC;YACnB,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI;YACtC,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,2DAA2D;AAC3D,SAAS,eAAe,CAAC,GAAyB,EAAE,IAAwB;IAC1E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,0EAA0E;AAC1E,gFAAgF;AAChF,gFAAgF;AAChF,uBAAuB;AACvB,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,IAAI,YAAY,GAAsD,IAAI,CAAC;AAE3E,MAAM,UAAU,iBAAiB;IAC/B,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACjE,OAAO,YAAY,CAAC,SAAS,CAAC;IAChC,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAExD,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,EAAE;QACxD,QAAQ,CACN,WAAW,EACX,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACpB,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAC/B,CAAC,KAAmB,EAAE,MAAc,EAAE,EAAE;YACtC,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA2C,CAAC;gBAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC;gBACtC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CACnF,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,EAAE,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,YAAY,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/lib/identity.d.ts

@@ -1,15 +1,7 @@
-type Jwk = {
-    kty?: string;
-    x?: string;
-    [key: string]: unknown;
-};
 export type NodeIdentity = {
     node_id: string;
     hostname: string;
     fingerprint: string;
-    public_key: Jwk;
-    private_key: Jwk;
 };
 export declare function loadOrCreateIdentity(dataDir: string): NodeIdentity;
-export {};
 //# sourceMappingURL=identity.d.ts.map

package/dist/lib/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/lib/identity.ts"],"names":[],"mappings":"AAKA,KAAK,GAAG,GAAG;IACT,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC;IAChB,WAAW,EAAE,GAAG,CAAC;CAClB,CAAC;AASF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CASlE"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/lib/identity.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAgBlE"}

package/dist/lib/identity.js

@@ -1,58 +1,77 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { hostname as osHostname } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 export function loadOrCreateIdentity(dataDir) {
     const file = join(dataDir, "node.json");
-    const existing = tryRead(file);
+    const existing = readIdentity(file);
     if (existing) {
-        return withFingerprint(existing);
+        // A file written by <= 0.2.0 carries an Ed25519 keypair nothing ever used.
+        // Only the node_id matters, so the migration finishes by rewriting the file
+        // without the key material: the node keeps its id and its peers stay
+        // recognised, and the dead keys stop lingering on disk.
+        if (existing.migrated)
+            writeIdentity(file, existing.identity);
+        return withFingerprint(existing.identity);
     }
-    return withFingerprint(generate(dataDir, file));
+    const identity = { node_id: randomUUID(), hostname: hostName() };
+    writeIdentity(file, identity);
+    return withFingerprint(identity);
 }
-function tryRead(file) {
+function readIdentity(file) {
+    let raw;
     try {
-        const raw = JSON.parse(readFileSync(file, "utf8"));
-        if (typeof raw.node_id === "string" && raw.public_key && raw.private_key) {
-            return raw;
-        }
-        return null;
+        raw = readFileSync(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw new Error(`cannot read identity file ${file}: ${errorMessage(error)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
     }
     catch {
-        return null;
+        throw corrupt(file, "is not valid JSON");
     }
-}
-function generate(dataDir, file) {
-    // Bun implements node:crypto, so this works under OpenCode's runtime and Node.
-    const { generateKeyPairSync } = require("node:crypto");
-    const { publicKey, privateKey } = generateKeyPairSync("ed25519");
-    const publicJwk = publicKey.export({ format: "jwk" });
-    const privateJwk = privateKey.export({ format: "jwk" });
-    const identity = {
-        node_id: randomUUID(),
-        hostname: hostName(),
-        public_key: publicJwk,
-        private_key: privateJwk,
+    const record = (parsed ?? {});
+    if (typeof record.node_id !== "string" || record.node_id.length === 0) {
+        throw corrupt(file, "has no node_id");
+    }
+    return {
+        identity: { node_id: record.node_id, hostname: hostName(record.hostname) },
+        migrated: Object.keys(record).some((key) => key !== "node_id" && key !== "hostname"),
     };
-    mkdirSync(dataDir, { recursive: true, mode: 0o700 });
-    // Atomic write: temp file + rename, so a crash never leaves a truncated keypair.
+}
+// A corrupt identity file would make the node silently mint a new id, breaking
+// every peer that recognises it and orphaning queued mail. Refuse to start and
+// hand the operator a recovery path instead of reminting behind their back.
+function corrupt(file, why) {
+    return new Error(`identity file ${file} ${why}; refusing to mint a new node id. ` +
+        `Move it aside to start with a fresh identity: mv '${file}' '${file}.bak'`);
+}
+function writeIdentity(file, identity) {
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    // Atomic write: temp file + rename, so a crash never leaves a truncated record.
     const tmp = `${file}.tmp-${process.pid}`;
     writeFileSync(tmp, JSON.stringify(identity, null, 2), { mode: 0o600 });
     renameSync(tmp, file);
     chmodSync(file, 0o600);
-    return identity;
 }
+// The keypair this replaces produced a fingerprint nobody verified. Deriving it
+// from the node_id keeps the same short, operator-readable label for `mesh_status`
+// without storing or protecting key material.
 function withFingerprint(identity) {
-    const { createHash } = require("node:crypto");
-    // x is the raw public key coordinate in an Ed25519 JWK; hash it for a short
-    // operator-verifiable fingerprint.
-    const x = identity.public_key.x ?? "";
     return {
         ...identity,
-        fingerprint: createHash("sha256").update(x).digest("hex").slice(0, 16),
+        fingerprint: createHash("sha256").update(identity.node_id).digest("hex").slice(0, 16),
     };
 }
-function hostName() {
-    return osHostname();
+function hostName(recorded) {
+    return typeof recorded === "string" && recorded.length > 0 ? recorded : osHostname();
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
 }
 //# sourceMappingURL=identity.js.map

package/dist/lib/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/lib/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAuBjC,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;QACxE,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACzE,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,IAAY;IAC7C,+EAA+E;IAC/E,MAAM,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,aAAa,CAAiC,CAAC;IAEvF,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAQ,CAAC;IAC7D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAQ,CAAC;IAE/D,MAAM,QAAQ,GAAsB;QAClC,OAAO,EAAE,UAAU,EAAE;QACrB,QAAQ,EAAE,QAAQ,EAAE;QACpB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,UAAU;KACxB,CAAC;IAEF,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,iFAAiF;IACjF,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAEvB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,QAA2B;IAClD,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,aAAa,CAAiC,CAAC;IAC9E,4EAA4E;IAC5E,mCAAmC;IACnC,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO;QACL,GAAG,QAAQ;QACX,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/lib/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAU1C,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEpC,IAAI,QAAQ,EAAE,CAAC;QACb,2EAA2E;QAC3E,4EAA4E;QAC5E,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,QAAQ,CAAC,QAAQ;YAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;IACpF,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9B,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAID,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IACzD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACxC,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC1E,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,UAAU,CAAC;KACrF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW;IACxC,OAAO,IAAI,KAAK,CACd,iBAAiB,IAAI,IAAI,GAAG,oCAAoC;QAC9D,qDAAqD,IAAI,MAAM,IAAI,OAAO,CAC7E,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,QAA2B;IAC9D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,gFAAgF;IAChF,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,gFAAgF;AAChF,mFAAmF;AACnF,8CAA8C;AAC9C,SAAS,eAAe,CAAC,QAA2B;IAClD,OAAO;QACL,GAAG,QAAQ;QACX,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KACtF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,QAAkB;IAClC,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/lib/locks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"locks.d.ts","sourceRoot":"","sources":["../../src/lib/locks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,wBAAgB,OAAO,CACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9F,OAAO,CAwBT;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAM5F;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAAE,CAGpE"}
+{"version":3,"file":"locks.d.ts","sourceRoot":"","sources":["../../src/lib/locks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,wBAAgB,OAAO,CACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9F,OAAO,CAiCT;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAM5F;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAAE,CAGpE"}

package/dist/lib/locks.js

@@ -1,21 +1,29 @@
 export function tryLock(db, input) {
     const expiresAt = input.now + input.ttl_ms;
     db.conn.run("DELETE FROM locks WHERE expires_at <= ?", [input.now]);
+    // Claim atomically: a second opencode process sharing this dataDir that races
+    // for the same path loses the insert (ON CONFLICT DO NOTHING) instead of
+    // throwing a UNIQUE constraint error out of mesh_lock.
+    db.conn.run("INSERT INTO locks (path, owner_node, owner_session, expires_at) VALUES (?, ?, ?, ?) ON CONFLICT(path) DO NOTHING", [input.path, input.owner_node, input.owner_session, expiresAt]);
+    const claimed = (db.conn.get("SELECT changes() AS changes")?.changes ?? 0) > 0;
+    if (claimed) {
+        return true;
+    }
     const existing = db.conn.get("SELECT * FROM locks WHERE path = ?", [input.path]);
-    if (existing) {
-        if (existing.owner_node === input.owner_node) {
-            // Same owner refreshes its claim.
-            db.conn.run("UPDATE locks SET expires_at = ?, owner_session = ? WHERE path = ?", [
-                expiresAt,
-                input.owner_session,
-                input.path,
-            ]);
-            return true;
-        }
+    if (!existing) {
+        // Raced with a release between the insert and this read; not granted.
         return false;
     }
-    db.conn.run("INSERT INTO locks (path, owner_node, owner_session, expires_at) VALUES (?, ?, ?, ?)", [input.path, input.owner_node, input.owner_session, expiresAt]);
-    return true;
+    if (existing.owner_node === input.owner_node) {
+        // Same owner refreshes its claim.
+        db.conn.run("UPDATE locks SET expires_at = ?, owner_session = ? WHERE path = ?", [
+            expiresAt,
+            input.owner_session,
+            input.path,
+        ]);
+        return true;
+    }
+    return false;
 }
 export function releaseLock(db, input) {
     db.conn.run("DELETE FROM locks WHERE path = ? AND owner_node = ?", [

package/dist/lib/locks.js.map

@@ -1 +1 @@
-{"version":3,"file":"locks.js","sourceRoot":"","sources":["../../src/lib/locks.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,OAAO,CACrB,EAAU,EACV,KAA+F;IAE/F,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IAE3C,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpE,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAU,oCAAoC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAC7C,kCAAkC;YAClC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,mEAAmE,EAAE;gBAC/E,SAAS;gBACT,KAAK,CAAC,aAAa;gBACnB,KAAK,CAAC,IAAI;aACX,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,EAAE,CAAC,IAAI,CAAC,GAAG,CACT,qFAAqF,EACrF,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,CAC/D,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,KAA2C;IACjF,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,qDAAqD,EAAE;QACjE,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,UAAU;KACjB,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAsB,6BAA6B,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,KAAsB;IAC1D,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAU,mCAAmC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAClF,CAAC;AASD,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,aAAa;QACxB,OAAO,EAAE,GAAG,CAAC,UAAU;QACvB,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"locks.js","sourceRoot":"","sources":["../../src/lib/locks.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,OAAO,CACrB,EAAU,EACV,KAA+F;IAE/F,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IAE3C,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpE,8EAA8E;IAC9E,yEAAyE;IACzE,uDAAuD;IACvD,EAAE,CAAC,IAAI,CAAC,GAAG,CACT,kHAAkH,EAClH,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,CAC/D,CAAC;IACF,MAAM,OAAO,GACX,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAsB,6BAA6B,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACtF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAU,oCAAoC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QAC7C,kCAAkC;QAClC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,mEAAmE,EAAE;YAC/E,SAAS;YACT,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,IAAI;SACX,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,KAA2C;IACjF,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,qDAAqD,EAAE;QACjE,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,UAAU;KACjB,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAsB,6BAA6B,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,KAAsB;IAC1D,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAU,mCAAmC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAClF,CAAC;AASD,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,aAAa;QACxB,OAAO,EAAE,GAAG,CAAC,UAAU;QACvB,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC"}

package/dist/lib/peers.d.ts

@@ -1,5 +1,6 @@
 import type { MeshDb } from "./db.js";
 import type { Peer } from "../types/peer.js";
+export declare const PAIRING_TOKEN_TTL_MS: number;
 export type PeerInput = {
     node_id: string;
     hostname: string;
@@ -15,8 +16,16 @@ export declare function pairWithToken(db: MeshDb, peer: {
 }): void;
 export declare function createPairingToken(db: MeshDb): string;
 export declare function authenticateToken(db: MeshDb, token: string, from: string | null): Peer | null;
+export declare function prunePendingTokens(db: MeshDb): void;
 export declare function listPeers(db: MeshDb): Peer[];
+export declare function findPeerById(db: MeshDb, nodeId: string): Peer | null;
 export declare function findPeerByToken(db: MeshDb, token: string): Peer | null;
+export declare function findSendablePeer(db: MeshDb, query: string): {
+    node_id: string;
+    addresses: string[];
+    token: string | null;
+} | null;
+export declare function resolvePeerUrl(db: MeshDb, query: string): string | null;
 export declare function upsertDiscoveredPeer(db: MeshDb, peer: {
     node_id: string;
     hostname: string;