claudemesh-cli 1.0.0-alpha.28 → 1.0.0-alpha.29

package/dist/entrypoints/cli.js

@@ -119,6 +119,22 @@ var init_timings = __esm(() => {
   };
 });
 
+// src/utils/url.ts
+function isInviteUrl(input) {
+  return /^https?:\/\/[^/]+\/(?:[a-z]{2}\/)?i\//.test(input) || /^https?:\/\/[^/]+\/(?:[a-z]{2}\/)?join\//.test(input) || /^ic:\/\//.test(input) || /^claudemesh:\/\//.test(input);
+}
+function normaliseInviteUrl(input, host = "claudemesh.com") {
+  const trimmed = input.trim();
+  if (trimmed.startsWith("claudemesh://")) {
+    const rest = trimmed.slice("claudemesh://".length).replace(/^\/+/, "");
+    const m = rest.match(/^(?:i|join)\/(.+)$/);
+    const tail = m ? m[1] : rest;
+    const kind = rest.startsWith("join/") ? "join" : "i";
+    return `https://${host}/${kind}/${tail}`;
+  }
+  return trimmed;
+}
+
 // src/constants/paths.ts
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -3951,16 +3967,73 @@ var init_login = __esm(() => {
   init_urls();
 });
 
-// src/commands/register.ts
-var exports_register = {};
-__export(exports_register, {
-  register: () => register2
-});
-async function register2() {
-  return login();
-}
-var init_register = __esm(() => {
-  init_login();
+// src/ui/render.ts
+var OUT, ERR, INDENT = "  ", render;
+var init_render = __esm(() => {
+  init_styles();
+  OUT = process.stdout;
+  ERR = process.stderr;
+  render = {
+    blank() {
+      OUT.write(`
+`);
+    },
+    ok(msg, detail) {
+      const d = detail ? ` ${dim("(" + detail + ")")}` : "";
+      OUT.write(`${INDENT}${green(icons.check)} ${msg}${d}
+`);
+    },
+    warn(msg, hint) {
+      OUT.write(`${INDENT}${yellow(icons.warn)} ${msg}
+`);
+      if (hint)
+        OUT.write(`${INDENT}  ${dim(hint)}
+`);
+    },
+    err(msg, hint) {
+      ERR.write(`${INDENT}${red(icons.cross)} ${msg}
+`);
+      if (hint)
+        ERR.write(`${INDENT}  ${dim(hint)}
+`);
+    },
+    info(msg) {
+      OUT.write(`${INDENT}${msg}
+`);
+    },
+    section(title) {
+      OUT.write(`
+${INDENT}${dim("—")} ${clay(title)}
+
+`);
+    },
+    heading(title) {
+      OUT.write(`${INDENT}${bold(title)}
+`);
+    },
+    kv(pairs, opts) {
+      const pad = opts?.padTo ?? Math.max(...pairs.map(([k]) => k.length)) + 2;
+      for (const [k, v] of pairs) {
+        OUT.write(`${INDENT}${dim(k.padEnd(pad, " "))}${v}
+`);
+      }
+    },
+    code(snippet) {
+      for (const line of snippet.split(`
+`)) {
+        OUT.write(`${INDENT}  ${cyan(line)}
+`);
+      }
+    },
+    link(url) {
+      OUT.write(`${INDENT}${clay(url)}
+`);
+    },
+    hint(msg) {
+      OUT.write(`${INDENT}${dim(icons.arrow + " " + msg)}
+`);
+    }
+  };
 });
 
 // src/commands/welcome.ts
@@ -3970,35 +4043,53 @@ __export(exports_welcome, {
   _stub: () => runWelcome
 });
 import { createInterface as createInterface5 } from "node:readline";
-async function runWelcome() {
-  const config = readConfig();
-  if (config.meshes.length > 0)
-    return EXIT.SUCCESS;
-  renderWelcome();
+function prompt2(q) {
   const rl = createInterface5({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
-    rl.question("  Choice [1]: ", async (answer) => {
+    rl.question(q, (a) => {
       rl.close();
-      const choice = (answer || "1").trim();
-      if (choice === "1")
-        resolve(await register2());
-      else if (choice === "2")
-        resolve(await login());
-      else if (choice === "3") {
-        console.log(`
-  Run: claudemesh join <invite-url>
-`);
-        resolve(EXIT.SUCCESS);
-      } else
-        resolve(EXIT.USER_CANCELLED);
+      resolve(a.trim());
     });
   });
 }
+async function runWelcome() {
+  const config = readConfig();
+  if (config.meshes.length > 0)
+    return EXIT.SUCCESS;
+  renderWelcome();
+  render.info("Do you already have an invite link? (y/n) [n]");
+  const hasInvite = (await prompt2("  > ")).toLowerCase().startsWith("y");
+  if (hasInvite) {
+    render.blank();
+    render.info("Paste your invite link (claudemesh.com/i/... or claudemesh://...)");
+    const raw = await prompt2("  > ");
+    if (!raw || !isInviteUrl(raw)) {
+      render.err("That doesn't look like a claudemesh invite URL.");
+      render.hint("Check your email — the link starts with https://claudemesh.com/i/");
+      return EXIT.INVALID_ARGS;
+    }
+    const normalised = normaliseInviteUrl(raw);
+    render.blank();
+    render.ok(`Joining via ${normalised}`);
+    const { runLaunch: runLaunch2 } = await Promise.resolve().then(() => (init_launch(), exports_launch));
+    await runLaunch2({
+      join: normalised,
+      name: process.env.USER ?? process.env.USERNAME ?? undefined,
+      yes: false
+    }, []);
+    return EXIT.SUCCESS;
+  }
+  render.blank();
+  render.info("Opening claudemesh.com so you can sign in and create your first mesh.");
+  render.hint("After sign-in, paste the sync token back here when prompted.");
+  render.blank();
+  return await login();
+}
 var init_welcome2 = __esm(() => {
   init_facade();
   init_welcome();
   init_login();
-  init_register();
+  init_render();
   init_exit_codes();
 });
 
@@ -4656,7 +4747,7 @@ __export(exports_delete_mesh, {
   deleteMesh: () => deleteMesh
 });
 import { createInterface as createInterface6 } from "node:readline";
-function prompt2(question) {
+function prompt3(question) {
   const rl = createInterface6({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     rl.question(question, (a) => {
@@ -4698,7 +4789,7 @@ async function deleteMesh(slug, opts = {}) {
       console.log(`    ${bold(String(i + 1) + ")")} ${m.slug} ${dim("(" + m.name + ")")}`);
     });
     console.log("");
-    const choice = await prompt2("  Choice: ");
+    const choice = await prompt3("  Choice: ");
     const idx = parseInt(choice, 10) - 1;
     if (idx < 0 || idx >= config.meshes.length) {
       console.log("  Cancelled.");
@@ -4718,7 +4809,7 @@ async function deleteMesh(slug, opts = {}) {
       console.log(`    ${bold("2)")} ${red("Delete everywhere")} ${dim("(removes for all members)")}`);
       console.log(`    ${bold("3)")} Cancel`);
       console.log("");
-      const choice = await prompt2("  Choice [1]: ") || "1";
+      const choice = await prompt3("  Choice [1]: ") || "1";
       if (choice === "3") {
         console.log("  Cancelled.");
         return EXIT.USER_CANCELLED;
@@ -4726,7 +4817,7 @@ async function deleteMesh(slug, opts = {}) {
       if (choice === "2") {
         console.log(`
   ${red("Warning:")} This will delete ${bold(slug)} for all members.`);
-        const confirm = await prompt2(`  Type "${slug}" to confirm: `);
+        const confirm = await prompt3(`  Type "${slug}" to confirm: `);
         if (confirm.toLowerCase() !== slug.toLowerCase()) {
           console.log("  Cancelled.");
           return EXIT.USER_CANCELLED;
@@ -4755,7 +4846,7 @@ async function deleteMesh(slug, opts = {}) {
     ${yellow(icons.warn)} Only the mesh owner can delete it from the server.`));
       }
       console.log("");
-      const choice = await prompt2("  Choice [1]: ") || "1";
+      const choice = await prompt3("  Choice [1]: ") || "1";
       if (choice === "2") {
         console.log("  Cancelled.");
         return EXIT.USER_CANCELLED;
@@ -5888,7 +5979,7 @@ __export(exports_invite, {
   invite: () => invite
 });
 import { createInterface as createInterface7 } from "node:readline";
-function prompt3(question) {
+function prompt4(question) {
   const rl = createInterface7({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     rl.question(question, (a) => {
@@ -5920,7 +6011,7 @@ async function invite(email, opts = {}) {
         console.log(`    ${bold(String(i + 1) + ")")} ${m.slug} ${dim("(" + m.name + ")")}`);
       });
       console.log("");
-      const choice = await prompt3("  Choice [1]: ") || "1";
+      const choice = await prompt4("  Choice [1]: ") || "1";
       const idx = parseInt(choice, 10) - 1;
       meshSlug = config.meshes[idx >= 0 && idx < config.meshes.length ? idx : 0].slug;
     }
@@ -6585,6 +6676,18 @@ var init_profile = __esm(() => {
   init_facade();
 });
 
+// src/commands/register.ts
+var exports_register = {};
+__export(exports_register, {
+  register: () => register2
+});
+async function register2() {
+  return login();
+}
+var init_register = __esm(() => {
+  init_login();
+});
+
 // src/commands/logout.ts
 var exports_logout = {};
 __export(exports_logout, {
@@ -8294,9 +8397,9 @@ __export(exports_backup, {
 });
 import { readFileSync as readFileSync11, writeFileSync as writeFileSync8, existsSync as existsSync15 } from "node:fs";
 import { createInterface as createInterface10 } from "node:readline";
-function readHidden(prompt4) {
+function readHidden(prompt5) {
   return new Promise((resolve2) => {
-    process.stdout.write(prompt4);
+    process.stdout.write(prompt5);
     const rl = createInterface10({ input: process.stdin, output: process.stdout, terminal: true });
     const stdin = process.stdin;
     const wasRaw = Boolean(stdin.isRaw);
@@ -8410,6 +8513,261 @@ var init_backup = __esm(() => {
   MAGIC = Buffer.from("CMB1", "utf-8");
 });
 
+// src/commands/upgrade.ts
+var exports_upgrade = {};
+__export(exports_upgrade, {
+  runUpgrade: () => runUpgrade
+});
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync16 } from "node:fs";
+import { dirname as dirname3, join as join8, resolve as resolve2 } from "node:path";
+async function latestAlpha() {
+  try {
+    const res = await fetch(URLS.NPM_REGISTRY, { signal: AbortSignal.timeout(8000) });
+    if (!res.ok)
+      return null;
+    const body = await res.json();
+    return body["dist-tags"]?.alpha ?? body["dist-tags"]?.latest ?? null;
+  } catch {
+    return null;
+  }
+}
+function findNpm() {
+  const portable = join8(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
+  if (existsSync16(portable)) {
+    return { npm: portable, prefix: join8(process.env.HOME ?? "", ".claudemesh") };
+  }
+  let cur = resolve2(process.argv[1] ?? ".");
+  for (let i = 0;i < 6; i++) {
+    cur = dirname3(cur);
+    const candidate = join8(cur, "bin", "npm");
+    if (existsSync16(candidate))
+      return { npm: candidate };
+  }
+  return { npm: "npm" };
+}
+async function runUpgrade(opts = {}) {
+  render.section("claudemesh upgrade");
+  render.kv([
+    ["installed", VERSION],
+    ["checking", "npm registry…"]
+  ]);
+  const latest = await latestAlpha();
+  if (!latest) {
+    render.warn("Could not reach npm registry — skipped.");
+    return EXIT.SUCCESS;
+  }
+  render.kv([["latest", latest]]);
+  if (latest === VERSION) {
+    render.blank();
+    render.ok(`Already on latest (${latest}).`);
+    return EXIT.SUCCESS;
+  }
+  if (opts.check) {
+    render.blank();
+    render.warn(`Update available: ${VERSION} → ${latest}`);
+    render.hint("Run: claudemesh upgrade");
+    return EXIT.SUCCESS;
+  }
+  const { npm, prefix } = findNpm();
+  const args = ["install", "-g"];
+  if (prefix)
+    args.push("--prefix", prefix);
+  args.push("claudemesh-cli@alpha");
+  render.blank();
+  render.info(`Updating ${VERSION} → ${latest}…`);
+  render.hint(`${npm} ${args.join(" ")}`);
+  render.blank();
+  const res = spawnSync6(npm, args, { stdio: "inherit" });
+  if (res.status !== 0) {
+    render.err(`npm exited with status ${res.status}`);
+    render.hint("Try: npm i -g claudemesh-cli@alpha");
+    return EXIT.INTERNAL_ERROR;
+  }
+  render.blank();
+  render.ok(`Upgraded to ${latest}.`);
+  return EXIT.SUCCESS;
+}
+var init_upgrade = __esm(() => {
+  init_urls();
+  init_render();
+  init_exit_codes();
+});
+
+// src/commands/grants.ts
+var exports_grants = {};
+__export(exports_grants, {
+  runRevoke: () => runRevoke,
+  runGrants: () => runGrants,
+  runGrant: () => runGrant,
+  runBlock: () => runBlock,
+  isAllowed: () => isAllowed
+});
+import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { join as join9 } from "node:path";
+function readGrants() {
+  if (!existsSync17(GRANT_FILE))
+    return {};
+  try {
+    return JSON.parse(readFileSync12(GRANT_FILE, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function writeGrants(g) {
+  const dir = join9(homedir8(), ".claudemesh");
+  if (!existsSync17(dir))
+    mkdirSync5(dir, { recursive: true });
+  writeFileSync9(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
+}
+function resolveCaps(input) {
+  if (input.includes("all"))
+    return [...ALL_CAPS];
+  return input.filter((c) => ALL_CAPS.includes(c));
+}
+async function resolvePeer(meshSlug, name) {
+  return await withMesh({ meshSlug }, async (client) => {
+    const peers = await client.listPeers();
+    const match = peers.find((p) => p.displayName === name || p.pubkey === name || p.pubkey.startsWith(name));
+    return match ? { displayName: match.displayName, pubkey: match.pubkey } : null;
+  });
+}
+function pickMesh2(slug) {
+  const cfg = readConfig();
+  if (slug)
+    return cfg.meshes.find((m) => m.slug === slug) ? slug : null;
+  return cfg.meshes[0]?.slug ?? null;
+}
+async function runGrant(peer, caps, opts = {}) {
+  if (!peer || caps.length === 0) {
+    render.err("Usage: claudemesh grant <peer> <capability...>");
+    render.hint(`Capabilities: ${ALL_CAPS.join(", ")}, all`);
+    return EXIT.INVALID_ARGS;
+  }
+  const mesh = pickMesh2(opts.mesh);
+  if (!mesh) {
+    render.err("No matching mesh — join one first.");
+    return EXIT.NOT_FOUND;
+  }
+  const resolved = await resolvePeer(mesh, peer);
+  if (!resolved) {
+    render.err(`Peer "${peer}" not found on ${mesh}.`);
+    return EXIT.NOT_FOUND;
+  }
+  const wanted = resolveCaps(caps);
+  if (wanted.length === 0) {
+    render.err(`Unknown capabilities: ${caps.join(", ")}`);
+    return EXIT.INVALID_ARGS;
+  }
+  const store = readGrants();
+  const meshGrants = store[mesh] ?? {};
+  const existing = meshGrants[resolved.pubkey] ?? DEFAULT_CAPS.slice();
+  const merged = Array.from(new Set([...existing, ...wanted]));
+  meshGrants[resolved.pubkey] = merged;
+  store[mesh] = meshGrants;
+  writeGrants(store);
+  render.ok(`Granted ${wanted.join(", ")} to ${resolved.displayName} on ${mesh}.`);
+  render.kv([["now", merged.join(", ")]]);
+  return EXIT.SUCCESS;
+}
+async function runRevoke(peer, caps, opts = {}) {
+  if (!peer || caps.length === 0) {
+    render.err("Usage: claudemesh revoke <peer> <capability...>");
+    return EXIT.INVALID_ARGS;
+  }
+  const mesh = pickMesh2(opts.mesh);
+  if (!mesh) {
+    render.err("No matching mesh.");
+    return EXIT.NOT_FOUND;
+  }
+  const resolved = await resolvePeer(mesh, peer);
+  if (!resolved) {
+    render.err(`Peer "${peer}" not found on ${mesh}.`);
+    return EXIT.NOT_FOUND;
+  }
+  const wanted = caps.includes("all") ? ALL_CAPS.slice() : resolveCaps(caps);
+  const store = readGrants();
+  const meshGrants = store[mesh] ?? {};
+  const existing = meshGrants[resolved.pubkey] ?? DEFAULT_CAPS.slice();
+  const after = existing.filter((c) => !wanted.includes(c));
+  meshGrants[resolved.pubkey] = after;
+  store[mesh] = meshGrants;
+  writeGrants(store);
+  render.ok(`Revoked ${wanted.join(", ")} from ${resolved.displayName} on ${mesh}.`);
+  render.kv([["now", after.length ? after.join(", ") : "(none)"]]);
+  return EXIT.SUCCESS;
+}
+async function runBlock(peer, opts = {}) {
+  if (!peer) {
+    render.err("Usage: claudemesh block <peer>");
+    return EXIT.INVALID_ARGS;
+  }
+  const mesh = pickMesh2(opts.mesh);
+  if (!mesh) {
+    render.err("No matching mesh.");
+    return EXIT.NOT_FOUND;
+  }
+  const resolved = await resolvePeer(mesh, peer);
+  if (!resolved) {
+    render.err(`Peer "${peer}" not found on ${mesh}.`);
+    return EXIT.NOT_FOUND;
+  }
+  const store = readGrants();
+  const meshGrants = store[mesh] ?? {};
+  meshGrants[resolved.pubkey] = [];
+  store[mesh] = meshGrants;
+  writeGrants(store);
+  render.ok(`Blocked ${resolved.displayName} on ${mesh} (all capabilities revoked).`);
+  render.hint(`Undo with: claudemesh grant ${resolved.displayName} all --mesh ${mesh}`);
+  return EXIT.SUCCESS;
+}
+async function runGrants(opts = {}) {
+  const mesh = pickMesh2(opts.mesh);
+  if (!mesh) {
+    render.err("No matching mesh.");
+    return EXIT.NOT_FOUND;
+  }
+  const store = readGrants();
+  const meshGrants = store[mesh] ?? {};
+  if (opts.json) {
+    console.log(JSON.stringify({ schema_version: "1.0", mesh, grants: meshGrants }, null, 2));
+    return EXIT.SUCCESS;
+  }
+  render.section(`grants on ${mesh}`);
+  const peerPubkeys = Object.keys(meshGrants);
+  if (peerPubkeys.length === 0) {
+    render.info("(no overrides — all peers use default caps: " + DEFAULT_CAPS.join(", ") + ")");
+    return EXIT.SUCCESS;
+  }
+  await withMesh({ meshSlug: mesh }, async (client) => {
+    const peers = await client.listPeers();
+    const byPk = new Map(peers.map((p) => [p.pubkey, p.displayName]));
+    for (const [pk, caps] of Object.entries(meshGrants)) {
+      const name = byPk.get(pk) ?? `${pk.slice(0, 10)}…`;
+      render.kv([[name, caps.length ? caps.join(", ") : "(blocked)"]]);
+    }
+  });
+  return EXIT.SUCCESS;
+}
+function isAllowed(meshSlug, peerPubkey, cap) {
+  const store = readGrants();
+  const entry = store[meshSlug]?.[peerPubkey];
+  if (entry === undefined)
+    return DEFAULT_CAPS.includes(cap);
+  return entry.includes(cap);
+}
+var ALL_CAPS, DEFAULT_CAPS, GRANT_FILE;
+var init_grants = __esm(() => {
+  init_facade();
+  init_connect();
+  init_render();
+  init_exit_codes();
+  ALL_CAPS = ["read", "dm", "broadcast", "state-read", "state-write", "file-read"];
+  DEFAULT_CAPS = ["read", "dm", "broadcast", "state-read"];
+  GRANT_FILE = join9(homedir8(), ".claudemesh", "grants.json");
+});
+
 // src/mcp/tools/definitions.ts
 var TOOLS;
 var init_definitions = __esm(() => {
@@ -9796,13 +10154,13 @@ ${peerLines.join(`
           }
         }
         try {
-          const { writeFileSync: writeFileSync9, mkdirSync: mkdirSync5, existsSync: existsSync16 } = await import("node:fs");
+          const { writeFileSync: writeFileSync10, mkdirSync: mkdirSync6, existsSync: existsSync18 } = await import("node:fs");
           const { join: joinPath } = await import("node:path");
-          const { homedir: homedir8 } = await import("node:os");
-          const dir = joinPath(homedir8(), ".claudemesh");
-          if (!existsSync16(dir))
-            mkdirSync5(dir, { recursive: true });
-          writeFileSync9(joinPath(dir, "peer-cache.json"), JSON.stringify(statusCache));
+          const { homedir: homedir9 } = await import("node:os");
+          const dir = joinPath(homedir9(), ".claudemesh");
+          if (!existsSync18(dir))
+            mkdirSync6(dir, { recursive: true });
+          writeFileSync10(joinPath(dir, "peer-cache.json"), JSON.stringify(statusCache));
         } catch {}
         return text(sections.join(`
 
@@ -10044,23 +10402,23 @@ ${lines.join(`
         const { path: filePath, name: fileName, tags, to: fileTo } = args ?? {};
         if (!filePath)
           return text("share_file: `path` required", true);
-        const { existsSync: existsSync16 } = await import("node:fs");
-        if (!existsSync16(filePath))
+        const { existsSync: existsSync18 } = await import("node:fs");
+        if (!existsSync18(filePath))
           return text(`share_file: file not found: ${filePath}`, true);
         const client = allClients()[0];
         if (!client)
           return text("share_file: not connected", true);
         if (fileTo) {
           const { encryptFile: encryptFile2, sealKeyForPeer: sealKeyForPeer2 } = await Promise.resolve().then(() => (init_file_crypto(), exports_file_crypto));
-          const { readFileSync: readFileSync12, writeFileSync: writeFileSync9, mkdtempSync: mkdtempSync2, unlinkSync: unlinkSync2, rmdirSync } = await import("node:fs");
+          const { readFileSync: readFileSync13, writeFileSync: writeFileSync10, mkdtempSync: mkdtempSync2, unlinkSync: unlinkSync2, rmdirSync } = await import("node:fs");
           const { tmpdir: tmpdir2 } = await import("node:os");
-          const { join: join8, basename } = await import("node:path");
+          const { join: join10, basename } = await import("node:path");
           const peers = await client.listPeers();
           const targetPeer = peers.find((p) => p.pubkey === fileTo || p.displayName === fileTo);
           if (!targetPeer) {
             return text(`share_file: peer not found: ${fileTo}`, true);
           }
-          const plaintext = readFileSync12(filePath);
+          const plaintext = readFileSync13(filePath);
           const { ciphertext, nonce, key } = await encryptFile2(new Uint8Array(plaintext));
           const sealedForTarget = await sealKeyForPeer2(key, targetPeer.pubkey);
           const myPubkey = client.getSessionPubkey();
@@ -10077,9 +10435,9 @@ ${lines.join(`
           combined.set(ciphertext, nonceBytes.length);
           const rawName = fileName ?? basename(filePath);
           const baseName = basename(rawName).replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 255);
-          const tmpDir = mkdtempSync2(join8(tmpdir2(), "cm-"));
-          const tmpPath = join8(tmpDir, baseName);
-          writeFileSync9(tmpPath, combined);
+          const tmpDir = mkdtempSync2(join10(tmpdir2(), "cm-"));
+          const tmpPath = join10(tmpDir, baseName);
+          writeFileSync10(tmpPath, combined);
           try {
             const fileId = await client.uploadFile(tmpPath, client.meshId, client.meshSlug, {
               name: baseName,
@@ -10154,10 +10512,10 @@ ${lines.join(`
           const plaintext = await decryptFile2(ciphertext, nonce, kf);
           if (!plaintext)
             return text(genericErr, true);
-          const { writeFileSync: writeFileSync10, mkdirSync: mkdirSync6 } = await import("node:fs");
-          const { dirname: dirname4 } = await import("node:path");
-          mkdirSync6(dirname4(save_to), { recursive: true });
-          writeFileSync10(save_to, plaintext);
+          const { writeFileSync: writeFileSync11, mkdirSync: mkdirSync7 } = await import("node:fs");
+          const { dirname: dirname5 } = await import("node:path");
+          mkdirSync7(dirname5(save_to), { recursive: true });
+          writeFileSync11(save_to, plaintext);
           return text(`Downloaded and decrypted: ${result.name} → ${save_to}`);
         }
         let res = await fetch(result.url, { signal: AbortSignal.timeout(1e4) }).catch(() => null);
@@ -10167,10 +10525,10 @@ ${lines.join(`
         }
         if (!res.ok)
           return text(`get_file: download failed (${res.status})`, true);
-        const { writeFileSync: writeFileSync9, mkdirSync: mkdirSync5 } = await import("node:fs");
-        const { dirname: dirname3 } = await import("node:path");
-        mkdirSync5(dirname3(save_to), { recursive: true });
-        writeFileSync9(save_to, Buffer.from(await res.arrayBuffer()));
+        const { writeFileSync: writeFileSync10, mkdirSync: mkdirSync6 } = await import("node:fs");
+        const { dirname: dirname4 } = await import("node:path");
+        mkdirSync6(dirname4(save_to), { recursive: true });
+        writeFileSync10(save_to, Buffer.from(await res.arrayBuffer()));
         return text(`Downloaded: ${result.name} → ${save_to}`);
       }
       case "list_files": {
@@ -10928,10 +11286,10 @@ ${lines.join(`
         const entryType = vType ?? "env";
         let plaintextBytes;
         if (entryType === "file") {
-          const { existsSync: existsSync16, readFileSync: readFileSync12 } = await import("node:fs");
-          if (!existsSync16(value))
+          const { existsSync: existsSync18, readFileSync: readFileSync13 } = await import("node:fs");
+          if (!existsSync18(value))
             return text(`vault_set: file not found: ${value}`, true);
-          plaintextBytes = new Uint8Array(readFileSync12(value));
+          plaintextBytes = new Uint8Array(readFileSync13(value));
         } else {
           plaintextBytes = new TextEncoder().encode(value);
         }
@@ -11259,6 +11617,17 @@ ${lines.join(`
         }
         const fromPubkey = msg.senderPubkey || "";
         const fromName = fromPubkey ? await resolvePeerName(client, fromPubkey) : "unknown";
+        if (fromPubkey) {
+          try {
+            const { isAllowed: isAllowed2 } = await Promise.resolve().then(() => (init_grants(), exports_grants));
+            const kindCap = msg.kind === "broadcast" ? "broadcast" : "dm";
+            if (!isAllowed2(client.meshSlug, fromPubkey, kindCap)) {
+              process.stderr.write(`[claudemesh] dropped ${kindCap} from ${fromName} (not granted)
+`);
+              return;
+            }
+          } catch {}
+        }
         if (messageMode === "inbox") {
           try {
             await server.notification({
@@ -11734,22 +12103,6 @@ function renderVersion() {
   return "  " + boldOrange("claudemesh") + " v" + VERSION;
 }
 
-// src/utils/url.ts
-function isInviteUrl(input) {
-  return /^https?:\/\/[^/]+\/(?:[a-z]{2}\/)?i\//.test(input) || /^https?:\/\/[^/]+\/(?:[a-z]{2}\/)?join\//.test(input) || /^ic:\/\//.test(input) || /^claudemesh:\/\//.test(input);
-}
-function normaliseInviteUrl(input, host = "claudemesh.com") {
-  const trimmed = input.trim();
-  if (trimmed.startsWith("claudemesh://")) {
-    const rest = trimmed.slice("claudemesh://".length).replace(/^\/+/, "");
-    const m = rest.match(/^(?:i|join)\/(.+)$/);
-    const tail = m ? m[1] : rest;
-    const kind = rest.startsWith("join/") ? "join" : "i";
-    return `https://${host}/${kind}/${tail}`;
-  }
-  return trimmed;
-}
-
 // src/entrypoints/cli.ts
 installSignalHandlers();
 installErrorHandlers();
@@ -11791,6 +12144,10 @@ Auth
 
 Security
   claudemesh verify [peer]         show ed25519 safety numbers (SAS)
+  claudemesh grant <peer> <cap>    grant capability (dm, broadcast, state-read, all)
+  claudemesh revoke <peer> <cap>   revoke capability (or 'all')
+  claudemesh block <peer>          revoke all capabilities (silent drop)
+  claudemesh grants                list per-peer overrides for current mesh
   claudemesh backup [file]         encrypt config → portable recovery file
   claudemesh restore <file>        restore config from a backup file
 
@@ -11802,6 +12159,7 @@ Setup
   claudemesh sync                  refresh mesh list from dashboard
   claudemesh completions <shell>   emit bash / zsh / fish completion script
   claudemesh url-handler install   register claudemesh:// click-to-launch
+  claudemesh upgrade               self-update to latest alpha (rustup-style)
 
 Flags
   --version, -V                    show version
@@ -12038,6 +12396,32 @@ async function main() {
       process.exit(await runRestore2(positionals[0]));
       break;
     }
+    case "upgrade":
+    case "update": {
+      const { runUpgrade: runUpgrade2 } = await Promise.resolve().then(() => (init_upgrade(), exports_upgrade));
+      process.exit(await runUpgrade2({ check: !!flags.check, yes: !!flags.y || !!flags.yes }));
+      break;
+    }
+    case "grant": {
+      const { runGrant: runGrant2 } = await Promise.resolve().then(() => (init_grants(), exports_grants));
+      process.exit(await runGrant2(positionals[0], positionals.slice(1), { mesh: flags.mesh }));
+      break;
+    }
+    case "revoke": {
+      const { runRevoke: runRevoke2 } = await Promise.resolve().then(() => (init_grants(), exports_grants));
+      process.exit(await runRevoke2(positionals[0], positionals.slice(1), { mesh: flags.mesh }));
+      break;
+    }
+    case "block": {
+      const { runBlock: runBlock2 } = await Promise.resolve().then(() => (init_grants(), exports_grants));
+      process.exit(await runBlock2(positionals[0], { mesh: flags.mesh }));
+      break;
+    }
+    case "grants": {
+      const { runGrants: runGrants2 } = await Promise.resolve().then(() => (init_grants(), exports_grants));
+      process.exit(await runGrants2({ mesh: flags.mesh, json: !!flags.json }));
+      break;
+    }
     case "mcp": {
       const { runMcp: runMcp2 } = await Promise.resolve().then(() => (init_mcp(), exports_mcp));
       await runMcp2();
@@ -12065,4 +12449,4 @@ main().catch((err) => {
   process.exit(EXIT.INTERNAL_ERROR);
 });
 
-//# debugId=35283B912CD01E3464756E2164756E21
+//# debugId=9DC7B5B7388FF04464756E2164756E21