claudemesh-cli 1.22.0 → 1.23.0

package/dist/entrypoints/cli.js

@@ -88,7 +88,7 @@ __export(exports_urls, {
   VERSION: () => VERSION,
   URLS: () => URLS
 });
-var URLS, VERSION = "1.22.0", env;
+var URLS, VERSION = "1.23.0", env;
 var init_urls = __esm(() => {
   URLS = {
     BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
@@ -962,6 +962,13 @@ var ready = false;
 var init_keypair = () => {};
 
 // src/services/crypto/file-crypto.ts
+var exports_file_crypto = {};
+__export(exports_file_crypto, {
+  sealKeyForPeer: () => sealKeyForPeer,
+  openSealedKey: () => openSealedKey,
+  encryptFile: () => encryptFile,
+  decryptFile: () => decryptFile
+});
 async function encryptFile(plaintext) {
   const s = await ensureSodium();
   const key = s.randombytes_buf(s.crypto_secretbox_KEYBYTES);
@@ -10179,6 +10186,7 @@ __export(exports_daemon, {
 async function runDaemonCommand(sub, opts, rest = []) {
   switch (sub) {
     case undefined:
+      return printDaemonUsage();
     case "up":
     case "start":
       return runDaemon({
@@ -10187,6 +10195,10 @@ async function runDaemonCommand(sub, opts, rest = []) {
         mesh: opts.mesh,
         displayName: opts.displayName
       });
+    case "help":
+    case "--help":
+    case "-h":
+      return printDaemonUsage();
     case "status":
       return runStatus(opts);
     case "version":
@@ -10204,12 +10216,46 @@ async function runDaemonCommand(sub, opts, rest = []) {
       return runUninstallService(opts);
     default:
       process.stderr.write(`unknown daemon subcommand: ${sub}
+
 `);
-      process.stderr.write(`usage: claudemesh daemon [up|status|version|down|accept-host|outbox|install-service|uninstall-service]
-`);
+      printDaemonUsage(process.stderr);
       return 2;
   }
 }
+function printDaemonUsage(stream = process.stdout) {
+  stream.write(`claudemesh daemon — long-lived peer mesh runtime (v0.9.0)
+
+USAGE
+  claudemesh daemon <command> [options]
+
+COMMANDS
+  up | start                   start the daemon in the foreground
+  status                       show running pid + IPC health
+  version                      ipc + schema version of the running daemon
+  down | stop                  stop the running daemon (SIGTERM, then wait)
+  accept-host                  pin the current host fingerprint
+  outbox list                  list local outbox rows (newest first)
+  outbox requeue <id>          re-enqueue an aborted / dead outbox row
+  install-service --mesh <s>   write launchd (macOS) / systemd-user (Linux) unit
+  uninstall-service            remove the platform service unit
+
+OPTIONS
+  --mesh <slug>                attach to / target this mesh
+  --name <displayName>         override CLAUDEMESH_DISPLAY_NAME
+  --no-tcp                     disable the loopback TCP listener (UDS only)
+  --public-health              expose /v1/health unauthenticated on TCP
+  --json                       machine-readable output where supported
+
+OUTBOX FLAGS (for 'daemon outbox list')
+  --pending --inflight --done --failed --aborted   filter by status
+
+OUTBOX FLAGS (for 'daemon outbox requeue')
+  --new-client-id <id>         mint the new row with this client_message_id
+
+See ${"https://claudemesh.com/docs"} for the full daemon spec.
+`);
+  return 0;
+}
 async function runOutbox(rest, opts) {
   const sub = rest[0];
   switch (sub) {
@@ -12698,11 +12744,14 @@ var exports_platform_actions = {};
 __export(exports_platform_actions, {
   runWebhookList: () => runWebhookList,
   runWebhookDelete: () => runWebhookDelete,
+  runWebhookCreate: () => runWebhookCreate,
   runWatchList: () => runWatchList,
+  runWatchAdd: () => runWatchAdd,
   runVectorStore: () => runVectorStore,
   runVectorSearch: () => runVectorSearch,
   runVectorDelete: () => runVectorDelete,
   runVectorCollections: () => runVectorCollections,
+  runVaultSet: () => runVaultSet,
   runVaultList: () => runVaultList,
   runVaultDelete: () => runVaultDelete,
   runUnwatch: () => runUnwatch,
@@ -13149,6 +13198,40 @@ async function runVaultDelete(key, opts) {
     return ok ? EXIT.SUCCESS : EXIT.NOT_FOUND;
   });
 }
+async function runVaultSet(key, value, opts) {
+  if (!key || value == null) {
+    render.err("Usage: claudemesh vault set <key> <value> [--type env|file] [--mount /path] [--description ...]");
+    return EXIT.INVALID_ARGS;
+  }
+  const { encryptFile: encryptFile2, sealKeyForPeer: sealKeyForPeer2 } = await Promise.resolve().then(() => (init_file_crypto(), exports_file_crypto));
+  const { getMeshConfig: getMeshConfig2 } = await Promise.resolve().then(() => (init_facade(), exports_facade));
+  const { readConfig: readConfig2 } = await Promise.resolve().then(() => (init_facade(), exports_facade));
+  const config = readConfig2();
+  const slug = opts.mesh ?? (config.meshes.length === 1 ? config.meshes[0].slug : null);
+  if (!slug) {
+    render.err("multiple meshes joined; pass --mesh <slug>");
+    return EXIT.INVALID_ARGS;
+  }
+  const mesh = getMeshConfig2(slug);
+  if (!mesh) {
+    render.err(`not joined to mesh "${slug}"`);
+    return EXIT.NOT_FOUND;
+  }
+  const plaintext = new TextEncoder().encode(value);
+  const enc = await encryptFile2(plaintext);
+  const ciphertextB64 = Buffer.from(enc.ciphertext).toString("base64");
+  const sealed = await sealKeyForPeer2(enc.key, mesh.pubkey);
+  return await withMesh({ meshSlug: slug }, async (client) => {
+    const ok = await client.vaultSet(key, ciphertextB64, enc.nonce, sealed, opts.entryType ?? "env", opts.mountPath, opts.description);
+    if (opts.json)
+      emitJson({ key, stored: ok });
+    else if (ok)
+      render.ok(`vault[${bold(key)}] stored`, dim(`(${ciphertextB64.length}b)`));
+    else
+      render.err(`vault set failed for "${key}"`);
+    return ok ? EXIT.SUCCESS : EXIT.IO_ERROR;
+  });
+}
 async function runWatchList(opts) {
   return await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
     const watches = await client.watchList();
@@ -13171,6 +13254,34 @@ async function runWatchList(opts) {
     return EXIT.SUCCESS;
   });
 }
+async function runWatchAdd(url, opts) {
+  if (!url) {
+    render.err("Usage: claudemesh watch add <url> [--label ...] [--interval <sec>] [--extract <css>] [--notify-on changed|always]");
+    return EXIT.INVALID_ARGS;
+  }
+  return await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
+    const result = await client.watch(url, {
+      label: opts.label,
+      interval: opts.interval,
+      mode: opts.mode,
+      extract: opts.extract,
+      notify_on: opts.notifyOn
+    });
+    if (result?.error) {
+      if (opts.json)
+        emitJson({ ok: false, error: result.error });
+      else
+        render.err(`watch add failed: ${result.error}`);
+      return EXIT.IO_ERROR;
+    }
+    const id = String(result?.id ?? result?.watch_id ?? "?");
+    if (opts.json)
+      emitJson({ ok: true, id, url, ...opts.label ? { label: opts.label } : {} });
+    else
+      render.ok(`watching ${clay(url)}`, dim(id.slice(0, 8)));
+    return EXIT.SUCCESS;
+  });
+}
 async function runUnwatch(id, opts) {
   if (!id) {
     render.err("Usage: claudemesh watch remove <id>");
@@ -13207,6 +13318,32 @@ async function runWebhookList(opts) {
     return EXIT.SUCCESS;
   });
 }
+async function runWebhookCreate(name, opts) {
+  if (!name) {
+    render.err("Usage: claudemesh webhook create <name>");
+    return EXIT.INVALID_ARGS;
+  }
+  return await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
+    const created = await client.createWebhook(name);
+    if (!created) {
+      if (opts.json)
+        emitJson({ ok: false, error: "create failed (timeout or duplicate)" });
+      else
+        render.err(`webhook create "${name}" failed`);
+      return EXIT.IO_ERROR;
+    }
+    if (opts.json)
+      emitJson({ ok: true, ...created });
+    else {
+      render.ok(`created webhook ${bold(created.name)}`);
+      process.stdout.write(`  url:    ${clay(created.url)}
+`);
+      process.stdout.write(`  secret: ${dim(created.secret)} ${dim("(shown once)")}
+`);
+    }
+    return EXIT.SUCCESS;
+  });
+}
 async function runWebhookDelete(name, opts) {
   if (!name) {
     render.err("Usage: claudemesh webhook delete <name>");
@@ -13501,6 +13638,23 @@ claudemesh send "<from_name>" "..." --mesh "<mesh_slug>"
 
 If the parent Claude session was launched via \`claudemesh launch\`, an MCP push-pipe is running and holds the per-mesh WS connection. CLI invocations dial \`~/.claudemesh/sockets/<mesh-slug>.sock\` and reuse that warm connection (~200ms total round-trip including Node.js startup). If no push-pipe is running (cron, scripts, hooks fired outside a session), the CLI opens its own WS, which takes ~500-700ms cold. **You don't manage this** — every verb auto-detects and falls through.
 
+### Daemon path (v0.9.0, opt-in, fastest)
+
+\`claudemesh daemon up [--mesh <slug>]\` starts a persistent per-user runtime that holds the broker WS, a durable SQLite outbox/inbox, and listens on \`~/.claudemesh/daemon/daemon.sock\` (UDS) plus an optional loopback TCP. When the daemon socket is present, every verb routes through it first (~1ms IPC) before falling back to bridge / cold paths. The send envelope carries a caller-stable \`client_message_id\`, so a \`claudemesh send\` that started before a daemon crash survives the restart via the on-disk outbox.
+
+Lifecycle:
+
+\`\`\`bash
+claudemesh daemon up --mesh <slug>                     # foreground
+claudemesh daemon install-service --mesh <slug>        # macOS launchd / Linux systemd-user
+claudemesh daemon status [--json]                      # health + pid
+claudemesh daemon outbox list [--failed|--pending|...] # local queue inspection
+claudemesh daemon outbox requeue <id>                  # re-enqueue an aborted/dead row
+claudemesh daemon down                                 # SIGTERM + wait
+\`\`\`
+
+\`claudemesh install\` (MCP + hooks registration) and the daemon are independent — install does not start the daemon, and the daemon does not require install. Run both for the warmest path: install gives you the in-session push-pipe, daemon gives you cross-invocation persistence and a survivable outbox.
+
 ## Spawning new sessions (no wizard)
 
 \`claudemesh launch\` is the canonical way to start a new Claude Code session connected to claudemesh. Pass every required flag up front so no interactive prompt fires — that's what makes the verb scriptable from tmux send-keys, AppleScript/iTerm spawn helpers, hooks, cron, and the \`claudemesh launch\` you call from inside another session. **Always use this verb, never \`claude\` directly with hand-rolled flags** — it sets up the per-session ed25519 keypair, exports \`CLAUDEMESH_DISPLAY_NAME\`, isolates the mesh config in a tmpdir, and passes the \`--dangerously-load-development-channels server:claudemesh\` plumbing that the MCP push-pipe needs.
@@ -17428,9 +17582,9 @@ Platform
   claudemesh stream create|publish|list                pub/sub event bus
   claudemesh sql query|execute|schema                  per-mesh SQL
   claudemesh skill list|get|remove                     mesh-published skills
-  claudemesh vault list|delete                         encrypted secrets
-  claudemesh watch list|remove                         URL change watchers
-  claudemesh webhook list|delete                       outbound HTTP triggers
+  claudemesh vault set|list|delete                     encrypted secrets (set: --type env|file --mount /p)
+  claudemesh watch add|list|remove                     URL change watchers (add: --label --interval --extract)
+  claudemesh webhook create|list|delete                outbound HTTP triggers
   claudemesh file share <path> [--to peer]             upload (or local-host fast path if --to matches)
   claudemesh file get <id> [--out path]                download by id
   claudemesh file list|status|delete                   shared mesh files
@@ -17452,6 +17606,17 @@ Security
   claudemesh backup [file]         encrypt config → portable recovery file
   claudemesh restore <file>        restore config from a backup file
 
+Daemon  (long-lived peer mesh runtime, v0.9.0)
+  claudemesh daemon up             start daemon (alias: start) [--mesh <slug>] [--no-tcp]
+  claudemesh daemon status         show running pid + IPC health [--json]
+  claudemesh daemon down           stop daemon (alias: stop)
+  claudemesh daemon version        ipc + schema version of running daemon
+  claudemesh daemon outbox list    list local outbox rows [--failed|--pending|--inflight|--done]
+  claudemesh daemon outbox requeue <id>   re-enqueue an aborted/dead row [--new-client-id <id>]
+  claudemesh daemon accept-host    pin current host fingerprint
+  claudemesh daemon install-service --mesh <slug>   write launchd / systemd-user unit
+  claudemesh daemon uninstall-service               remove the unit
+
 Setup
   claudemesh install               register MCP server + hooks
   claudemesh uninstall             remove MCP server + hooks
@@ -18083,8 +18248,16 @@ async function main() {
       } else if (sub === "delete") {
         const { runVaultDelete: runVaultDelete2 } = await Promise.resolve().then(() => (init_platform_actions(), exports_platform_actions));
         process.exit(await runVaultDelete2(positionals[1] ?? "", f));
+      } else if (sub === "set") {
+        const { runVaultSet: runVaultSet2 } = await Promise.resolve().then(() => (init_platform_actions(), exports_platform_actions));
+        process.exit(await runVaultSet2(positionals[1] ?? "", positionals[2] ?? "", {
+          ...f,
+          entryType: flags.type,
+          mountPath: flags.mount,
+          description: flags.description
+        }));
       } else {
-        console.error("Usage: claudemesh vault <list|delete>  (set/get currently via MCP — needs crypto)");
+        console.error("Usage: claudemesh vault <list|set|delete>");
         process.exit(EXIT.INVALID_ARGS);
       }
       break;
@@ -18098,8 +18271,18 @@ async function main() {
       } else if (sub === "remove") {
         const { runUnwatch: runUnwatch2 } = await Promise.resolve().then(() => (init_platform_actions(), exports_platform_actions));
         process.exit(await runUnwatch2(positionals[1] ?? "", f));
+      } else if (sub === "add") {
+        const { runWatchAdd: runWatchAdd2 } = await Promise.resolve().then(() => (init_platform_actions(), exports_platform_actions));
+        process.exit(await runWatchAdd2(positionals[1] ?? "", {
+          ...f,
+          label: flags.label,
+          interval: flags.interval ? Number(flags.interval) : undefined,
+          mode: flags.mode,
+          extract: flags.extract,
+          notifyOn: flags["notify-on"]
+        }));
       } else {
-        console.error("Usage: claudemesh watch <list|remove>");
+        console.error("Usage: claudemesh watch <list|add|remove>");
         process.exit(EXIT.INVALID_ARGS);
       }
       break;
@@ -18113,8 +18296,11 @@ async function main() {
       } else if (sub === "delete") {
         const { runWebhookDelete: runWebhookDelete2 } = await Promise.resolve().then(() => (init_platform_actions(), exports_platform_actions));
         process.exit(await runWebhookDelete2(positionals[1] ?? "", f));
+      } else if (sub === "create") {
+        const { runWebhookCreate: runWebhookCreate2 } = await Promise.resolve().then(() => (init_platform_actions(), exports_platform_actions));
+        process.exit(await runWebhookCreate2(positionals[1] ?? "", f));
       } else {
-        console.error("Usage: claudemesh webhook <list|delete>");
+        console.error("Usage: claudemesh webhook <list|create|delete>");
         process.exit(EXIT.INVALID_ARGS);
       }
       break;
@@ -18426,4 +18612,4 @@ main().catch((err) => {
   process.exit(EXIT.INTERNAL_ERROR);
 });
 
-//# debugId=BA4EDB138BD2E1AE64756E2164756E21
+//# debugId=DF34DB4C8E61E91564756E2164756E21