agent-comms 2.1.0 → 2.2.0

package/.claude-plugin/marketplace.json

@@ -15,7 +15,7 @@
         "url": "https://github.com/ExaDev/agent-comms.git"
       },
       "description": "Cross-harness LLM agent communication mesh — rooms, DMs, and presence",
-      "version": "2.1.0"
+      "version": "2.2.0"
     }
   ]
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-comms",
   "description": "Cross-harness LLM agent communication mesh — rooms, DMs, and presence",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "author": {
     "name": "ExaDev"
   },

package/README.md

@@ -2,7 +2,7 @@
 
 [![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/agent-comms)
 [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/agent-comms)
-[![version](https://img.shields.io/badge/version-2.1.0-blue)](https://github.com/ExaDev/agent-comms/releases/tag/v2.1.0)
+[![version](https://img.shields.io/badge/version-2.2.0-blue)](https://github.com/ExaDev/agent-comms/releases/tag/v2.2.0)
 [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/agent-comms/ci.yml?branch=main)](https://github.com/ExaDev/agent-comms/actions)
 
 Cross-harness communication mesh for LLM agents: rooms, DMs, presence, and visibility over TCP with zero filesystem dependencies.

package/dist/core/room-token-verification.d.ts

@@ -0,0 +1,24 @@
+/**
+ * core/room's six verifier obligations (spec/room.cddl), layered on top of verifyCapabilityToken (obligations 2, 4, and 5 -- bearer match, ordinary token-claims checks, and delegations-remaining narrowing -- already live there). This module adds the two obligations specific to room-shaped scopes: the chain must terminate at the correct root for the path's own shape (1), and the token's own scope must actually name the room the request claims to act on (3). Obligation 6 (refuse an unrecognised content-type/kind) is a message-handling concern, not a token-verification one, and belongs to the room verb router instead.
+ */
+import { type TokenVerdictReason, type VerifyCapabilityTokenOptions } from "wire-mesh-core/domain/tokens";
+import type { CapabilityToken, DeviceId, TokenClaims } from "wire-mesh-core/generated/protocol";
+export type RoomTokenVerdictReason = TokenVerdictReason | "wrong_scope_kind" | "wrong_scope_path" | "wrong_chain_root";
+export type RoomTokenVerdict = {
+    ok: true;
+    claims: TokenClaims;
+} | {
+    ok: false;
+    reason: RoomTokenVerdictReason;
+};
+export interface VerifyRoomTokenOptions extends Omit<VerifyCapabilityTokenOptions, "expectedBearer"> {
+    /** The peer identity actually authenticated on the arriving connection (obligation 2) -- never a relay-asserted or gossip-derived value. Mandatory here: every room verb requires a bearer, unlike verifyCapabilityToken's own optional field for callers presenting a token to authorise themselves rather than a specific counterparty. */
+    expectedBearer: DeviceId;
+    /** The room path this request claims to act on (obligation 3) -- must equal the token's own scope.path, and its own shape determines the chain root obligation 1 requires. */
+    roomPath: string;
+}
+/**
+ * Verifies a `room:member` capability token against all six of core/room's verifier obligations. Delegates obligations 2/4/5 to verifyCapabilityToken directly; adds obligation 3 (scope.kind/scope.path must match the room being acted on) and obligation 1 (the chain's root must be the room's own owner for a named room, or the verifying identity itself for a DM -- never either named participant directly, since a DM token minted by anyone other than the verifier would let a sender self-issue authority to message a stranger unsolicited).
+ */
+export declare function verifyRoomToken(token: CapabilityToken, options: VerifyRoomTokenOptions): Promise<RoomTokenVerdict>;
+//# sourceMappingURL=room-token-verification.d.ts.map

package/dist/core/room-token-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"room-token-verification.d.ts","sourceRoot":"","sources":["../../src/core/room-token-verification.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EAClC,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EACV,eAAe,EACf,QAAQ,EACR,WAAW,EACZ,MAAM,mCAAmC,CAAC;AAG3C,MAAM,MAAM,sBAAsB,GAC9B,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACjC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAElD,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAClD,4BAA4B,EAC5B,gBAAgB,CACjB;IACC,6UAA6U;IAC7U,cAAc,EAAE,QAAQ,CAAC;IACzB,8KAA8K;IAC9K,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CA4B3B"}

package/dist/core/room-token-verification.js

@@ -0,0 +1,35 @@
+/**
+ * core/room's six verifier obligations (spec/room.cddl), layered on top of verifyCapabilityToken (obligations 2, 4, and 5 -- bearer match, ordinary token-claims checks, and delegations-remaining narrowing -- already live there). This module adds the two obligations specific to room-shaped scopes: the chain must terminate at the correct root for the path's own shape (1), and the token's own scope must actually name the room the request claims to act on (3). Obligation 6 (refuse an unrecognised content-type/kind) is a message-handling concern, not a token-verification one, and belongs to the room verb router instead.
+ */
+import { verifyCapabilityToken, } from "wire-mesh-core/domain/tokens";
+import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
+import { parseRoomPath } from "./room-path.js";
+/**
+ * Verifies a `room:member` capability token against all six of core/room's verifier obligations. Delegates obligations 2/4/5 to verifyCapabilityToken directly; adds obligation 3 (scope.kind/scope.path must match the room being acted on) and obligation 1 (the chain's root must be the room's own owner for a named room, or the verifying identity itself for a DM -- never either named participant directly, since a DM token minted by anyone other than the verifier would let a sender self-issue authority to message a stranger unsolicited).
+ */
+export async function verifyRoomToken(token, options) {
+    const verdict = await verifyCapabilityToken(token, {
+        identity: options.identity,
+        clock: options.clock,
+        revocation: options.revocation,
+        expectedBearer: options.expectedBearer,
+    });
+    if (!verdict.ok) {
+        return verdict;
+    }
+    if (verdict.claims.scope.kind !== "room") {
+        return { ok: false, reason: "wrong_scope_kind" };
+    }
+    if (verdict.claims.scope.path !== options.roomPath) {
+        return { ok: false, reason: "wrong_scope_path" };
+    }
+    const parsed = parseRoomPath(options.roomPath);
+    const expectedRootHex = parsed.kind === "owner-named"
+        ? parsed.owner
+        : deviceIdToHex(options.identity.deviceId);
+    if (deviceIdToHex(verdict.rootIssuer) !== expectedRootHex) {
+        return { ok: false, reason: "wrong_chain_root" };
+    }
+    return { ok: true, claims: verdict.claims };
+}
+//# sourceMappingURL=room-token-verification.js.map

package/dist/core/room-token-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"room-token-verification.js","sourceRoot":"","sources":["../../src/core/room-token-verification.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,qBAAqB,GAGtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAMhE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAsB/C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAsB,EACtB,OAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE;QACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,eAAe,GACnB,MAAM,CAAC,IAAI,KAAK,aAAa;QAC3B,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,eAAe,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAC9C,CAAC"}

package/dist/test/room-token-verification.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=room-token-verification.test.d.ts.map

package/dist/test/room-token-verification.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"room-token-verification.test.d.ts","sourceRoot":"","sources":["../../src/test/room-token-verification.test.ts"],"names":[],"mappings":""}

package/dist/test/room-token-verification.test.js

@@ -0,0 +1,212 @@
+import { webcrypto } from "node:crypto";
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { createNodeIdentity } from "wire-mesh-core/adapters/node-identity";
+import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
+import { mintCapabilityToken, mintRevocationEntry, } from "wire-mesh-core/domain/tokens";
+import { createRevocationView } from "wire-mesh-core/domain/revocation-view";
+import { ownerNamedRoomPath, dmRoomPath } from "../core/room-path.js";
+import { verifyRoomToken } from "../core/room-token-verification.js";
+const ES256 = -7;
+const HOUR_MS = 3_600_000;
+function buf(bytes) {
+    return Uint8Array.from(bytes);
+}
+async function generateEs256Identity() {
+    const keyPair = await webcrypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
+    const publicKeyBytes = new Uint8Array(await webcrypto.subtle.exportKey("raw", keyPair.publicKey));
+    return createNodeIdentity(keyPair.privateKey, publicKeyBytes, ES256);
+}
+function fixedClock(atMs) {
+    return { now: () => atMs };
+}
+let issuedTokenIds = 0;
+function nextTokenId() {
+    issuedTokenIds += 1;
+    return buf([issuedTokenIds]);
+}
+const NOW_MS = 1_893_456_000_000;
+const EXPIRES_MS = NOW_MS + HOUR_MS;
+async function mintRoomMemberToken(issuer, bearer, roomPath, tokenId = nextTokenId()) {
+    const verdict = await mintCapabilityToken({
+        identity: issuer,
+        clock: fixedClock(NOW_MS),
+        tokenId,
+        bearer: bearer.deviceId,
+        capability: "room:member",
+        scope: { kind: "room", path: roomPath },
+        expires: EXPIRES_MS,
+        delegationsRemaining: 0,
+    });
+    if (!verdict.ok)
+        throw new Error(`mint failed: ${verdict.reason}`);
+    return verdict.token;
+}
+describe("verifyRoomToken", () => {
+    it("accepts a token rooted at the named room's own owner", async () => {
+        const owner = await generateEs256Identity();
+        const member = await generateEs256Identity();
+        const roomPath = ownerNamedRoomPath(deviceIdToHex(owner.deviceId), "general");
+        const token = await mintRoomMemberToken(owner, member, roomPath);
+        const verdict = await verifyRoomToken(token, {
+            identity: owner,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: member.deviceId,
+            roomPath,
+        });
+        assert.equal(verdict.ok, true);
+    });
+    it("refuses a token rooted at the wrong device for a named room", async () => {
+        const owner = await generateEs256Identity();
+        const impostor = await generateEs256Identity();
+        const member = await generateEs256Identity();
+        const roomPath = ownerNamedRoomPath(deviceIdToHex(owner.deviceId), "general");
+        // Minted by the impostor, not the room's actual owner -- rootIssuer will be the impostor's own device-id, not the path's owner.
+        const token = await mintRoomMemberToken(impostor, member, roomPath);
+        const verdict = await verifyRoomToken(token, {
+            identity: owner,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: member.deviceId,
+            roomPath,
+        });
+        assert.equal(verdict.ok, false);
+        if (!verdict.ok)
+            assert.equal(verdict.reason, "wrong_chain_root");
+    });
+    it("accepts a DM token rooted at the verifying identity itself", async () => {
+        const me = await generateEs256Identity();
+        const them = await generateEs256Identity();
+        const roomPath = dmRoomPath(deviceIdToHex(me.deviceId), deviceIdToHex(them.deviceId));
+        // I (the verifier) issue the token that lets `them` send to me.
+        const token = await mintRoomMemberToken(me, them, roomPath);
+        const verdict = await verifyRoomToken(token, {
+            identity: me,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: them.deviceId,
+            roomPath,
+        });
+        assert.equal(verdict.ok, true);
+    });
+    it("refuses a DM token rooted at neither participant nor the verifier", async () => {
+        const me = await generateEs256Identity();
+        const them = await generateEs256Identity();
+        const stranger = await generateEs256Identity();
+        const roomPath = dmRoomPath(deviceIdToHex(me.deviceId), deviceIdToHex(them.deviceId));
+        // A stranger self-issues a token for this DM path -- must never verify, since the DM path's only acceptable root is the verifier itself.
+        const token = await mintRoomMemberToken(stranger, them, roomPath);
+        const verdict = await verifyRoomToken(token, {
+            identity: me,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: them.deviceId,
+            roomPath,
+        });
+        assert.equal(verdict.ok, false);
+        if (!verdict.ok)
+            assert.equal(verdict.reason, "wrong_chain_root");
+    });
+    it("refuses a token scoped to a different room path", async () => {
+        const owner = await generateEs256Identity();
+        const member = await generateEs256Identity();
+        const actualRoomPath = ownerNamedRoomPath(deviceIdToHex(owner.deviceId), "general");
+        const otherRoomPath = ownerNamedRoomPath(deviceIdToHex(owner.deviceId), "other-room");
+        const token = await mintRoomMemberToken(owner, member, actualRoomPath);
+        const verdict = await verifyRoomToken(token, {
+            identity: owner,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: member.deviceId,
+            roomPath: otherRoomPath,
+        });
+        assert.equal(verdict.ok, false);
+        if (!verdict.ok)
+            assert.equal(verdict.reason, "wrong_scope_path");
+    });
+    it("refuses a token scoped to a non-room capability", async () => {
+        const owner = await generateEs256Identity();
+        const member = await generateEs256Identity();
+        const roomPath = ownerNamedRoomPath(deviceIdToHex(owner.deviceId), "general");
+        const verdict1 = await mintCapabilityToken({
+            identity: owner,
+            clock: fixedClock(NOW_MS),
+            tokenId: nextTokenId(),
+            bearer: member.deviceId,
+            capability: "exec:pty",
+            scope: { kind: "folder" },
+            expires: EXPIRES_MS,
+        });
+        if (!verdict1.ok)
+            throw new Error(`mint failed: ${verdict1.reason}`);
+        const verdict = await verifyRoomToken(verdict1.token, {
+            identity: owner,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: member.deviceId,
+            roomPath,
+        });
+        assert.equal(verdict.ok, false);
+        if (!verdict.ok)
+            assert.equal(verdict.reason, "wrong_scope_kind");
+    });
+    it("refuses a token bearing a different device than the authenticated connection", async () => {
+        const owner = await generateEs256Identity();
+        const member = await generateEs256Identity();
+        const impostor = await generateEs256Identity();
+        const roomPath = ownerNamedRoomPath(deviceIdToHex(owner.deviceId), "general");
+        const token = await mintRoomMemberToken(owner, member, roomPath);
+        const verdict = await verifyRoomToken(token, {
+            identity: owner,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: impostor.deviceId,
+            roomPath,
+        });
+        assert.equal(verdict.ok, false);
+        if (!verdict.ok)
+            assert.equal(verdict.reason, "bearer_mismatch");
+    });
+    it("refuses an expired token", async () => {
+        const owner = await generateEs256Identity();
+        const member = await generateEs256Identity();
+        const roomPath = ownerNamedRoomPath(deviceIdToHex(owner.deviceId), "general");
+        const token = await mintRoomMemberToken(owner, member, roomPath);
+        const verdict = await verifyRoomToken(token, {
+            identity: owner,
+            clock: fixedClock(EXPIRES_MS + HOUR_MS),
+            revocation: createRevocationView(),
+            expectedBearer: member.deviceId,
+            roomPath,
+        });
+        assert.equal(verdict.ok, false);
+        if (!verdict.ok)
+            assert.equal(verdict.reason, "expired");
+    });
+    it("refuses a revoked token", async () => {
+        const owner = await generateEs256Identity();
+        const member = await generateEs256Identity();
+        const roomPath = ownerNamedRoomPath(deviceIdToHex(owner.deviceId), "general");
+        const tokenId = nextTokenId();
+        const token = await mintRoomMemberToken(owner, member, roomPath, tokenId);
+        const revocation = createRevocationView();
+        const entry = await mintRevocationEntry({
+            identity: owner,
+            tokenId,
+            revokedAt: NOW_MS,
+        });
+        await revocation.record(entry, { identity: owner });
+        const verdict = await verifyRoomToken(token, {
+            identity: owner,
+            clock: fixedClock(NOW_MS),
+            revocation,
+            expectedBearer: member.deviceId,
+            roomPath,
+        });
+        assert.equal(verdict.ok, false);
+        if (!verdict.ok)
+            assert.equal(verdict.reason, "revoked");
+    });
+});
+//# sourceMappingURL=room-token-verification.test.js.map

package/dist/test/room-token-verification.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"room-token-verification.test.js","sourceRoot":"","sources":["../../src/test/room-token-verification.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAI7E,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC;AACjB,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B,SAAS,GAAG,CAAC,KAAqC;IAChD,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,qBAAqB;IAClC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,WAAW,CAChD,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,UAAU,CACnC,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAC3D,CAAC;IACF,OAAO,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,IAAI,cAAc,GAAG,CAAC,CAAC;AACvB,SAAS,WAAW;IAClB,cAAc,IAAI,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,MAAM,GAAG,iBAAiB,CAAC;AACjC,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpC,KAAK,UAAU,mBAAmB,CAChC,MAAoB,EACpB,MAAoB,EACpB,QAAgB,EAChB,UAAmC,WAAW,EAAE;IAEhD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;QACzB,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,QAAQ;QACvB,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvC,OAAO,EAAE,UAAU;QACnB,oBAAoB,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,kBAAkB,CACjC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC7B,SAAS,CACV,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE;YAC3C,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,kBAAkB,CACjC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC7B,SAAS,CACV,CAAC;QACF,gIAAgI;QAChI,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEpE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE;YAC3C,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,GAAG,MAAM,qBAAqB,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,UAAU,CACzB,aAAa,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC1B,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC7B,CAAC;QACF,gEAAgE;QAChE,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE5D,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE;YAC3C,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,IAAI,CAAC,QAAQ;YAC7B,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,EAAE,GAAG,MAAM,qBAAqB,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,UAAU,CACzB,aAAa,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC1B,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC7B,CAAC;QACF,yIAAyI;QACzI,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAElE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE;YAC3C,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,IAAI,CAAC,QAAQ;YAC7B,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,cAAc,GAAG,kBAAkB,CACvC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC7B,SAAS,CACV,CAAC;QACF,MAAM,aAAa,GAAG,kBAAkB,CACtC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC7B,YAAY,CACb,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QAEvE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE;YAC3C,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,QAAQ,EAAE,aAAa;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,kBAAkB,CACjC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC7B,SAAS,CACV,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;YACzC,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,WAAW,EAAE;YACtB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE;YACpD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,kBAAkB,CACjC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC7B,SAAS,CACV,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE;YAC3C,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,QAAQ,CAAC,QAAQ;YACjC,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,kBAAkB,CACjC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC7B,SAAS,CACV,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE;YAC3C,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,UAAU,CAAC,UAAU,GAAG,OAAO,CAAC;YACvC,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,kBAAkB,CACjC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC7B,SAAS,CACV,CAAC;QACF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAE1E,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC;YACtC,QAAQ,EAAE,KAAK;YACf,OAAO;YACP,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE;YAC3C,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU;YACV,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-comms",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Cross-harness communication mesh for LLM agents — rooms, DMs, presence, and real-time push delivery over TCP",
   "type": "module",
   "packageManager": "pnpm@10.33.0",
@@ -97,7 +97,7 @@
     "cbor2": "2.3.0",
     "preact": "10.29.7",
     "typebox": "1.3.6",
-    "wire-mesh-core": "1.0.1",
+    "wire-mesh-core": "1.0.2",
     "ws": "8.21.1",
     "zod": "4.4.3"
   },