claudemesh-cli 1.0.0-alpha.28 → 1.0.0-alpha.29

package/dist/entrypoints/mcp.js

@@ -3286,6 +3286,359 @@ var init_facade3 = __esm(() => {
   init_errors();
 });
 
+// src/commands/connect.ts
+import { hostname } from "node:os";
+import { createInterface } from "node:readline";
+async function pickMesh(meshes) {
+  console.log(`
+  Select mesh:`);
+  meshes.forEach((m, i) => {
+    console.log(`    ${i + 1}) ${m.slug}`);
+  });
+  console.log("");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    rl.question("  Choice [1]: ", (answer) => {
+      rl.close();
+      const idx = parseInt(answer || "1", 10) - 1;
+      if (idx >= 0 && idx < meshes.length) {
+        resolve(meshes[idx]);
+      } else {
+        console.error("  Invalid choice, using first mesh.");
+        resolve(meshes[0]);
+      }
+    });
+  });
+}
+async function withMesh(opts, fn) {
+  const config = readConfig();
+  if (config.meshes.length === 0) {
+    console.error("No meshes joined. Run `claudemesh join <url>` first.");
+    process.exit(1);
+  }
+  let mesh;
+  if (opts.meshSlug) {
+    const found = config.meshes.find((m) => m.slug === opts.meshSlug);
+    if (!found) {
+      console.error(`Mesh "${opts.meshSlug}" not found. Joined: ${config.meshes.map((m) => m.slug).join(", ")}`);
+      process.exit(1);
+    }
+    mesh = found;
+  } else if (config.meshes.length === 1) {
+    mesh = config.meshes[0];
+  } else {
+    mesh = await pickMesh(config.meshes);
+  }
+  const displayName = opts.displayName ?? config.displayName ?? `${hostname()}-${process.pid}`;
+  const client = new BrokerClient(mesh, { displayName });
+  try {
+    await client.connect();
+    const result = await fn(client, mesh);
+    return result;
+  } finally {
+    client.close();
+  }
+}
+var init_connect = __esm(() => {
+  init_facade3();
+  init_facade();
+});
+
+// src/ui/styles.ts
+function moveTo(row, col) {
+  return isTTY ? `\x1B[${row};${col}H` : "";
+}
+function visibleLength(s) {
+  return s.replace(/\x1b\[[^m]*m/g, "").length;
+}
+var isTTY, esc = (code) => (s) => isTTY ? `${code}${s}\x1B[0m` : s, orange, clay, amber, bold, dim, green, yellow, red, cyan, boldOrange, HIDE_CURSOR, SHOW_CURSOR, CLEAR_SCREEN, CLEAR_LINE, icons;
+var init_styles = __esm(() => {
+  isTTY = process.stdout.isTTY && !process.env.NO_COLOR && process.env.TERM !== "dumb";
+  orange = esc("\x1B[38;5;208m");
+  clay = esc("\x1B[38;5;173m");
+  amber = esc("\x1B[38;5;214m");
+  bold = esc("\x1B[1m");
+  dim = esc("\x1B[2m");
+  green = esc("\x1B[32m");
+  yellow = esc("\x1B[33m");
+  red = esc("\x1B[31m");
+  cyan = esc("\x1B[36m");
+  boldOrange = esc("\x1B[1m\x1B[38;5;208m");
+  HIDE_CURSOR = isTTY ? "\x1B[?25l" : "";
+  SHOW_CURSOR = isTTY ? "\x1B[?25h" : "";
+  CLEAR_SCREEN = isTTY ? "\x1B[2J\x1B[H" : "";
+  CLEAR_LINE = isTTY ? "\x1B[K" : "";
+  icons = {
+    check: "✔",
+    cross: "✘",
+    warn: "⚠",
+    arrow: "→",
+    bullet: "●",
+    dash: "—",
+    ellipsis: "…"
+  };
+});
+
+// src/ui/render.ts
+var OUT, ERR, INDENT = "  ", render;
+var init_render = __esm(() => {
+  init_styles();
+  OUT = process.stdout;
+  ERR = process.stderr;
+  render = {
+    blank() {
+      OUT.write(`
+`);
+    },
+    ok(msg, detail) {
+      const d = detail ? ` ${dim("(" + detail + ")")}` : "";
+      OUT.write(`${INDENT}${green(icons.check)} ${msg}${d}
+`);
+    },
+    warn(msg, hint) {
+      OUT.write(`${INDENT}${yellow(icons.warn)} ${msg}
+`);
+      if (hint)
+        OUT.write(`${INDENT}  ${dim(hint)}
+`);
+    },
+    err(msg, hint) {
+      ERR.write(`${INDENT}${red(icons.cross)} ${msg}
+`);
+      if (hint)
+        ERR.write(`${INDENT}  ${dim(hint)}
+`);
+    },
+    info(msg) {
+      OUT.write(`${INDENT}${msg}
+`);
+    },
+    section(title) {
+      OUT.write(`
+${INDENT}${dim("—")} ${clay(title)}
+
+`);
+    },
+    heading(title) {
+      OUT.write(`${INDENT}${bold(title)}
+`);
+    },
+    kv(pairs, opts) {
+      const pad = opts?.padTo ?? Math.max(...pairs.map(([k]) => k.length)) + 2;
+      for (const [k, v] of pairs) {
+        OUT.write(`${INDENT}${dim(k.padEnd(pad, " "))}${v}
+`);
+      }
+    },
+    code(snippet) {
+      for (const line of snippet.split(`
+`)) {
+        OUT.write(`${INDENT}  ${cyan(line)}
+`);
+      }
+    },
+    link(url) {
+      OUT.write(`${INDENT}${clay(url)}
+`);
+    },
+    hint(msg) {
+      OUT.write(`${INDENT}${dim(icons.arrow + " " + msg)}
+`);
+    }
+  };
+});
+
+// src/constants/exit-codes.ts
+var EXIT;
+var init_exit_codes = __esm(() => {
+  EXIT = {
+    SUCCESS: 0,
+    USER_CANCELLED: 1,
+    AUTH_FAILED: 2,
+    INVALID_ARGS: 3,
+    NETWORK_ERROR: 4,
+    NOT_FOUND: 5,
+    ALREADY_EXISTS: 6,
+    PERMISSION_DENIED: 7,
+    INTERNAL_ERROR: 8,
+    CLAUDE_MISSING: 9
+  };
+});
+
+// src/commands/grants.ts
+var exports_grants = {};
+__export(exports_grants, {
+  runRevoke: () => runRevoke,
+  runGrants: () => runGrants,
+  runGrant: () => runGrant,
+  runBlock: () => runBlock,
+  isAllowed: () => isAllowed
+});
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join2 } from "node:path";
+function readGrants() {
+  if (!existsSync2(GRANT_FILE))
+    return {};
+  try {
+    return JSON.parse(readFileSync2(GRANT_FILE, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function writeGrants(g) {
+  const dir = join2(homedir2(), ".claudemesh");
+  if (!existsSync2(dir))
+    mkdirSync2(dir, { recursive: true });
+  writeFileSync2(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
+}
+function resolveCaps(input) {
+  if (input.includes("all"))
+    return [...ALL_CAPS];
+  return input.filter((c) => ALL_CAPS.includes(c));
+}
+async function resolvePeer(meshSlug, name) {
+  return await withMesh({ meshSlug }, async (client) => {
+    const peers = await client.listPeers();
+    const match = peers.find((p) => p.displayName === name || p.pubkey === name || p.pubkey.startsWith(name));
+    return match ? { displayName: match.displayName, pubkey: match.pubkey } : null;
+  });
+}
+function pickMesh2(slug) {
+  const cfg = readConfig();
+  if (slug)
+    return cfg.meshes.find((m) => m.slug === slug) ? slug : null;
+  return cfg.meshes[0]?.slug ?? null;
+}
+async function runGrant(peer, caps, opts = {}) {
+  if (!peer || caps.length === 0) {
+    render.err("Usage: claudemesh grant <peer> <capability...>");
+    render.hint(`Capabilities: ${ALL_CAPS.join(", ")}, all`);
+    return EXIT.INVALID_ARGS;
+  }
+  const mesh = pickMesh2(opts.mesh);
+  if (!mesh) {
+    render.err("No matching mesh — join one first.");
+    return EXIT.NOT_FOUND;
+  }
+  const resolved = await resolvePeer(mesh, peer);
+  if (!resolved) {
+    render.err(`Peer "${peer}" not found on ${mesh}.`);
+    return EXIT.NOT_FOUND;
+  }
+  const wanted = resolveCaps(caps);
+  if (wanted.length === 0) {
+    render.err(`Unknown capabilities: ${caps.join(", ")}`);
+    return EXIT.INVALID_ARGS;
+  }
+  const store = readGrants();
+  const meshGrants = store[mesh] ?? {};
+  const existing = meshGrants[resolved.pubkey] ?? DEFAULT_CAPS.slice();
+  const merged = Array.from(new Set([...existing, ...wanted]));
+  meshGrants[resolved.pubkey] = merged;
+  store[mesh] = meshGrants;
+  writeGrants(store);
+  render.ok(`Granted ${wanted.join(", ")} to ${resolved.displayName} on ${mesh}.`);
+  render.kv([["now", merged.join(", ")]]);
+  return EXIT.SUCCESS;
+}
+async function runRevoke(peer, caps, opts = {}) {
+  if (!peer || caps.length === 0) {
+    render.err("Usage: claudemesh revoke <peer> <capability...>");
+    return EXIT.INVALID_ARGS;
+  }
+  const mesh = pickMesh2(opts.mesh);
+  if (!mesh) {
+    render.err("No matching mesh.");
+    return EXIT.NOT_FOUND;
+  }
+  const resolved = await resolvePeer(mesh, peer);
+  if (!resolved) {
+    render.err(`Peer "${peer}" not found on ${mesh}.`);
+    return EXIT.NOT_FOUND;
+  }
+  const wanted = caps.includes("all") ? ALL_CAPS.slice() : resolveCaps(caps);
+  const store = readGrants();
+  const meshGrants = store[mesh] ?? {};
+  const existing = meshGrants[resolved.pubkey] ?? DEFAULT_CAPS.slice();
+  const after = existing.filter((c) => !wanted.includes(c));
+  meshGrants[resolved.pubkey] = after;
+  store[mesh] = meshGrants;
+  writeGrants(store);
+  render.ok(`Revoked ${wanted.join(", ")} from ${resolved.displayName} on ${mesh}.`);
+  render.kv([["now", after.length ? after.join(", ") : "(none)"]]);
+  return EXIT.SUCCESS;
+}
+async function runBlock(peer, opts = {}) {
+  if (!peer) {
+    render.err("Usage: claudemesh block <peer>");
+    return EXIT.INVALID_ARGS;
+  }
+  const mesh = pickMesh2(opts.mesh);
+  if (!mesh) {
+    render.err("No matching mesh.");
+    return EXIT.NOT_FOUND;
+  }
+  const resolved = await resolvePeer(mesh, peer);
+  if (!resolved) {
+    render.err(`Peer "${peer}" not found on ${mesh}.`);
+    return EXIT.NOT_FOUND;
+  }
+  const store = readGrants();
+  const meshGrants = store[mesh] ?? {};
+  meshGrants[resolved.pubkey] = [];
+  store[mesh] = meshGrants;
+  writeGrants(store);
+  render.ok(`Blocked ${resolved.displayName} on ${mesh} (all capabilities revoked).`);
+  render.hint(`Undo with: claudemesh grant ${resolved.displayName} all --mesh ${mesh}`);
+  return EXIT.SUCCESS;
+}
+async function runGrants(opts = {}) {
+  const mesh = pickMesh2(opts.mesh);
+  if (!mesh) {
+    render.err("No matching mesh.");
+    return EXIT.NOT_FOUND;
+  }
+  const store = readGrants();
+  const meshGrants = store[mesh] ?? {};
+  if (opts.json) {
+    console.log(JSON.stringify({ schema_version: "1.0", mesh, grants: meshGrants }, null, 2));
+    return EXIT.SUCCESS;
+  }
+  render.section(`grants on ${mesh}`);
+  const peerPubkeys = Object.keys(meshGrants);
+  if (peerPubkeys.length === 0) {
+    render.info("(no overrides — all peers use default caps: " + DEFAULT_CAPS.join(", ") + ")");
+    return EXIT.SUCCESS;
+  }
+  await withMesh({ meshSlug: mesh }, async (client) => {
+    const peers = await client.listPeers();
+    const byPk = new Map(peers.map((p) => [p.pubkey, p.displayName]));
+    for (const [pk, caps] of Object.entries(meshGrants)) {
+      const name = byPk.get(pk) ?? `${pk.slice(0, 10)}…`;
+      render.kv([[name, caps.length ? caps.join(", ") : "(blocked)"]]);
+    }
+  });
+  return EXIT.SUCCESS;
+}
+function isAllowed(meshSlug, peerPubkey, cap) {
+  const store = readGrants();
+  const entry = store[meshSlug]?.[peerPubkey];
+  if (entry === undefined)
+    return DEFAULT_CAPS.includes(cap);
+  return entry.includes(cap);
+}
+var ALL_CAPS, DEFAULT_CAPS, GRANT_FILE;
+var init_grants = __esm(() => {
+  init_facade();
+  init_connect();
+  init_render();
+  init_exit_codes();
+  ALL_CAPS = ["read", "dm", "broadcast", "state-read", "state-write", "file-read"];
+  DEFAULT_CAPS = ["read", "dm", "broadcast", "state-read"];
+  GRANT_FILE = join2(homedir2(), ".claudemesh", "grants.json");
+});
+
 // src/mcp/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -3749,13 +4102,13 @@ ${peerLines.join(`
           }
         }
         try {
-          const { writeFileSync: writeFileSync2, mkdirSync: mkdirSync2, existsSync: existsSync2 } = await import("node:fs");
+          const { writeFileSync: writeFileSync3, mkdirSync: mkdirSync3, existsSync: existsSync3 } = await import("node:fs");
           const { join: joinPath } = await import("node:path");
-          const { homedir: homedir2 } = await import("node:os");
-          const dir = joinPath(homedir2(), ".claudemesh");
-          if (!existsSync2(dir))
-            mkdirSync2(dir, { recursive: true });
-          writeFileSync2(joinPath(dir, "peer-cache.json"), JSON.stringify(statusCache));
+          const { homedir: homedir3 } = await import("node:os");
+          const dir = joinPath(homedir3(), ".claudemesh");
+          if (!existsSync3(dir))
+            mkdirSync3(dir, { recursive: true });
+          writeFileSync3(joinPath(dir, "peer-cache.json"), JSON.stringify(statusCache));
         } catch {}
         return text(sections.join(`
 
@@ -3997,23 +4350,23 @@ ${lines.join(`
         const { path: filePath, name: fileName, tags, to: fileTo } = args ?? {};
         if (!filePath)
           return text("share_file: `path` required", true);
-        const { existsSync: existsSync2 } = await import("node:fs");
-        if (!existsSync2(filePath))
+        const { existsSync: existsSync3 } = await import("node:fs");
+        if (!existsSync3(filePath))
           return text(`share_file: file not found: ${filePath}`, true);
         const client = allClients()[0];
         if (!client)
           return text("share_file: not connected", true);
         if (fileTo) {
           const { encryptFile: encryptFile2, sealKeyForPeer: sealKeyForPeer2 } = await Promise.resolve().then(() => (init_file_crypto(), exports_file_crypto));
-          const { readFileSync: readFileSync2, writeFileSync: writeFileSync2, mkdtempSync, unlinkSync, rmdirSync } = await import("node:fs");
+          const { readFileSync: readFileSync3, writeFileSync: writeFileSync3, mkdtempSync, unlinkSync, rmdirSync } = await import("node:fs");
           const { tmpdir } = await import("node:os");
-          const { join: join2, basename } = await import("node:path");
+          const { join: join3, basename } = await import("node:path");
           const peers = await client.listPeers();
           const targetPeer = peers.find((p) => p.pubkey === fileTo || p.displayName === fileTo);
           if (!targetPeer) {
             return text(`share_file: peer not found: ${fileTo}`, true);
           }
-          const plaintext = readFileSync2(filePath);
+          const plaintext = readFileSync3(filePath);
           const { ciphertext, nonce, key } = await encryptFile2(new Uint8Array(plaintext));
           const sealedForTarget = await sealKeyForPeer2(key, targetPeer.pubkey);
           const myPubkey = client.getSessionPubkey();
@@ -4030,9 +4383,9 @@ ${lines.join(`
           combined.set(ciphertext, nonceBytes.length);
           const rawName = fileName ?? basename(filePath);
           const baseName = basename(rawName).replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 255);
-          const tmpDir = mkdtempSync(join2(tmpdir(), "cm-"));
-          const tmpPath = join2(tmpDir, baseName);
-          writeFileSync2(tmpPath, combined);
+          const tmpDir = mkdtempSync(join3(tmpdir(), "cm-"));
+          const tmpPath = join3(tmpDir, baseName);
+          writeFileSync3(tmpPath, combined);
           try {
             const fileId = await client.uploadFile(tmpPath, client.meshId, client.meshSlug, {
               name: baseName,
@@ -4107,10 +4460,10 @@ ${lines.join(`
           const plaintext = await decryptFile2(ciphertext, nonce, kf);
           if (!plaintext)
             return text(genericErr, true);
-          const { writeFileSync: writeFileSync3, mkdirSync: mkdirSync3 } = await import("node:fs");
+          const { writeFileSync: writeFileSync4, mkdirSync: mkdirSync4 } = await import("node:fs");
           const { dirname: dirname2 } = await import("node:path");
-          mkdirSync3(dirname2(save_to), { recursive: true });
-          writeFileSync3(save_to, plaintext);
+          mkdirSync4(dirname2(save_to), { recursive: true });
+          writeFileSync4(save_to, plaintext);
           return text(`Downloaded and decrypted: ${result.name} → ${save_to}`);
         }
         let res = await fetch(result.url, { signal: AbortSignal.timeout(1e4) }).catch(() => null);
@@ -4120,10 +4473,10 @@ ${lines.join(`
         }
         if (!res.ok)
           return text(`get_file: download failed (${res.status})`, true);
-        const { writeFileSync: writeFileSync2, mkdirSync: mkdirSync2 } = await import("node:fs");
+        const { writeFileSync: writeFileSync3, mkdirSync: mkdirSync3 } = await import("node:fs");
         const { dirname } = await import("node:path");
-        mkdirSync2(dirname(save_to), { recursive: true });
-        writeFileSync2(save_to, Buffer.from(await res.arrayBuffer()));
+        mkdirSync3(dirname(save_to), { recursive: true });
+        writeFileSync3(save_to, Buffer.from(await res.arrayBuffer()));
         return text(`Downloaded: ${result.name} → ${save_to}`);
       }
       case "list_files": {
@@ -4881,10 +5234,10 @@ ${lines.join(`
         const entryType = vType ?? "env";
         let plaintextBytes;
         if (entryType === "file") {
-          const { existsSync: existsSync2, readFileSync: readFileSync2 } = await import("node:fs");
-          if (!existsSync2(value))
+          const { existsSync: existsSync3, readFileSync: readFileSync3 } = await import("node:fs");
+          if (!existsSync3(value))
             return text(`vault_set: file not found: ${value}`, true);
-          plaintextBytes = new Uint8Array(readFileSync2(value));
+          plaintextBytes = new Uint8Array(readFileSync3(value));
         } else {
           plaintextBytes = new TextEncoder().encode(value);
         }
@@ -5212,6 +5565,17 @@ ${lines.join(`
         }
         const fromPubkey = msg.senderPubkey || "";
         const fromName = fromPubkey ? await resolvePeerName(client, fromPubkey) : "unknown";
+        if (fromPubkey) {
+          try {
+            const { isAllowed: isAllowed2 } = await Promise.resolve().then(() => (init_grants(), exports_grants));
+            const kindCap = msg.kind === "broadcast" ? "broadcast" : "dm";
+            if (!isAllowed2(client.meshSlug, fromPubkey, kindCap)) {
+              process.stderr.write(`[claudemesh] dropped ${kindCap} from ${fromName} (not granted)
+`);
+              return;
+            }
+          } catch {}
+        }
         if (messageMode === "inbox") {
           try {
             await server.notification({
@@ -5437,4 +5801,4 @@ startMcpServer().catch((err) => {
   process.exit(1);
 });
 
-//# debugId=A4140639E8A1CA6E64756E2164756E21
+//# debugId=342A89449EA1CD7764756E2164756E21