claudemesh-cli 1.22.1 → 1.24.0

package/dist/entrypoints/cli.js

@@ -4,6 +4,7 @@ var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __toESM = (mod, isNodeMode, target) => {
   target = mod != null ? __create(__getProtoOf(mod)) : {};
@@ -16,6 +17,20 @@ var __toESM = (mod, isNodeMode, target) => {
       });
   return to;
 };
+var __moduleCache = /* @__PURE__ */ new WeakMap;
+var __toCommonJS = (from) => {
+  var entry = __moduleCache.get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function")
+    __getOwnPropNames(from).map((key) => !__hasOwnProp.call(entry, key) && __defProp(entry, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    }));
+  __moduleCache.set(from, entry);
+  return entry;
+};
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __export = (target, all) => {
   for (var name in all)
@@ -88,7 +103,7 @@ __export(exports_urls, {
   VERSION: () => VERSION,
   URLS: () => URLS
 });
-var URLS, VERSION = "1.22.1", env;
+var URLS, VERSION = "1.24.0", env;
 var init_urls = __esm(() => {
   URLS = {
     BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
@@ -962,6 +977,13 @@ var ready = false;
 var init_keypair = () => {};
 
 // src/services/crypto/file-crypto.ts
+var exports_file_crypto = {};
+__export(exports_file_crypto, {
+  sealKeyForPeer: () => sealKeyForPeer,
+  openSealedKey: () => openSealedKey,
+  encryptFile: () => encryptFile,
+  decryptFile: () => decryptFile
+});
 async function encryptFile(plaintext) {
   const s = await ensureSodium();
   const key = s.randombytes_buf(s.crypto_secretbox_KEYBYTES);
@@ -3301,44 +3323,10 @@ var init_ws_client = __esm(() => {
 });
 
 // src/services/broker/manager.ts
-async function ensureClient(mesh) {
-  const existing = clients.get(mesh.meshId);
-  if (existing)
-    return existing;
-  const isDebug2 = process.env.CLAUDEMESH_DEBUG === "1" || process.env.CLAUDEMESH_DEBUG === "true";
-  const client = new BrokerClient(mesh, { debug: isDebug2, displayName: configDisplayName });
-  clients.set(mesh.meshId, client);
-  try {
-    await client.connect();
-    for (const g of configGroups ?? []) {
-      try {
-        await client.joinGroup(g.name, g.role);
-      } catch {}
-    }
-  } catch (err) {
-    process.stderr.write(`[claudemesh] broker connect failed for ${mesh.slug}: ${err instanceof Error ? err.message : err} (will retry)
-`);
-  }
-  return client;
-}
-async function startClients(config) {
-  configDisplayName = config.displayName;
-  configGroups = config.groups ?? [];
-  await Promise.allSettled(config.meshes.map(ensureClient));
-}
-function allClients() {
-  return [...clients.values()];
-}
-function stopAll() {
-  for (const c of clients.values())
-    c.close();
-  clients.clear();
-}
-var clients, configDisplayName, configGroups;
+var clients;
 var init_manager = __esm(() => {
   init_ws_client();
   clients = new Map;
-  configGroups = [];
 });
 
 // src/services/broker/envelope.ts
@@ -3593,6 +3581,42 @@ var init_spinner = __esm(() => {
   FRAME_HEIGHT = H;
 });
 
+// src/daemon/paths.ts
+var exports_paths = {};
+__export(exports_paths, {
+  DAEMON_TCP_HOST: () => DAEMON_TCP_HOST,
+  DAEMON_TCP_DEFAULT_PORT: () => DAEMON_TCP_DEFAULT_PORT,
+  DAEMON_PATHS: () => DAEMON_PATHS
+});
+import { join as join3 } from "node:path";
+var DAEMON_PATHS, DAEMON_TCP_HOST = "127.0.0.1", DAEMON_TCP_DEFAULT_PORT = 47823;
+var init_paths2 = __esm(() => {
+  init_paths();
+  DAEMON_PATHS = {
+    get DAEMON_DIR() {
+      return join3(PATHS.CONFIG_DIR, "daemon");
+    },
+    get PID_FILE() {
+      return join3(this.DAEMON_DIR, "daemon.pid");
+    },
+    get SOCK_FILE() {
+      return join3(this.DAEMON_DIR, "daemon.sock");
+    },
+    get TOKEN_FILE() {
+      return join3(this.DAEMON_DIR, "local-token");
+    },
+    get OUTBOX_DB() {
+      return join3(this.DAEMON_DIR, "outbox.db");
+    },
+    get INBOX_DB() {
+      return join3(this.DAEMON_DIR, "inbox.db");
+    },
+    get LOG_FILE() {
+      return join3(this.DAEMON_DIR, "daemon.log");
+    }
+  };
+});
+
 // src/commands/launch.ts
 var exports_launch = {};
 __export(exports_launch, {
@@ -3602,8 +3626,41 @@ import { spawnSync as spawnSync2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { mkdtempSync, writeFileSync as writeFileSync4, rmSync, readdirSync, statSync, existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
 import { tmpdir, hostname as hostname2, homedir as homedir3 } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline";
+async function ensureDaemonRunning(meshSlug, quiet) {
+  const { DAEMON_PATHS: DAEMON_PATHS2 } = await Promise.resolve().then(() => (init_paths2(), exports_paths));
+  if (existsSync5(DAEMON_PATHS2.SOCK_FILE))
+    return;
+  if (!quiet)
+    render.info("starting claudemesh daemon…");
+  const { spawn } = await import("node:child_process");
+  const argv0 = process.argv[1] ?? "claudemesh";
+  let binary = argv0;
+  if (/\.ts$/.test(binary) || /node_modules|src\/entrypoints/.test(binary)) {
+    try {
+      const { execSync } = await import("node:child_process");
+      binary = execSync("which claudemesh", { encoding: "utf8" }).trim();
+    } catch {
+      binary = "claudemesh";
+    }
+  }
+  const child = spawn(binary, ["daemon", "up", "--mesh", meshSlug], {
+    detached: true,
+    stdio: "ignore"
+  });
+  child.unref();
+  const start = Date.now();
+  while (Date.now() - start < 1e4) {
+    if (existsSync5(DAEMON_PATHS2.SOCK_FILE)) {
+      if (!quiet)
+        render.ok("daemon ready");
+      return;
+    }
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  render.warn("daemon failed to start within 10s", "Run `claudemesh daemon up --mesh " + meshSlug + "` manually, then re-launch.");
+}
 function parseGroupsString(raw) {
   return raw.split(",").map((s) => s.trim()).filter(Boolean).map((token) => {
     const idx = token.indexOf(":");
@@ -3923,14 +3980,15 @@ async function runLaunch(flags, rawArgs) {
     for (const entry of readdirSync(tmpBase)) {
       if (!entry.startsWith("claudemesh-"))
         continue;
-      const full = join3(tmpBase, entry);
+      const full = join4(tmpBase, entry);
       const age = Date.now() - statSync(full).mtimeMs;
       if (age > 3600000)
         rmSync(full, { recursive: true, force: true });
     }
   } catch {}
+  await ensureDaemonRunning(mesh.slug, args.quiet);
   try {
-    const claudeConfigPath = join3(homedir3(), ".claude.json");
+    const claudeConfigPath = join4(homedir3(), ".claude.json");
     if (existsSync5(claudeConfigPath)) {
       const claudeConfig = JSON.parse(readFileSync4(claudeConfigPath, "utf-8"));
       const mcpServers = claudeConfig.mcpServers ?? {};
@@ -3967,7 +4025,7 @@ async function runLaunch(flags, rawArgs) {
       console.log("  (Could not fetch service catalog — mesh services won't be natively available)");
     }
   }
-  const tmpDir = mkdtempSync(join3(tmpdir(), "claudemesh-"));
+  const tmpDir = mkdtempSync(join4(tmpdir(), "claudemesh-"));
   const sessionConfig = {
     version: 1,
     meshes: [mesh],
@@ -3976,14 +4034,14 @@ async function runLaunch(flags, rawArgs) {
     ...parsedGroups.length > 0 ? { groups: parsedGroups } : {},
     messageMode
   };
-  writeFileSync4(join3(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
+  writeFileSync4(join4(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
 `, "utf-8");
   if (!args.quiet) {
     printBanner(displayName, mesh.slug, role, parsedGroups, messageMode);
   }
   const meshMcpEntries = [];
   if (serviceCatalog.length > 0) {
-    const claudeConfigPath = join3(homedir3(), ".claude.json");
+    const claudeConfigPath = join4(homedir3(), ".claude.json");
     let claudeConfig = {};
     try {
       claudeConfig = JSON.parse(readFileSync4(claudeConfigPath, "utf-8"));
@@ -4050,9 +4108,9 @@ async function runLaunch(flags, rawArgs) {
   let claudeBin = "claude";
   if (!isWindows2) {
     const candidates = [
-      join3(homedir3(), ".local", "bin", "claude"),
+      join4(homedir3(), ".local", "bin", "claude"),
       "/usr/local/bin/claude",
-      join3(homedir3(), ".claude", "bin", "claude")
+      join4(homedir3(), ".claude", "bin", "claude")
     ];
     for (const c of candidates) {
       if (existsSync5(c)) {
@@ -4064,7 +4122,7 @@ async function runLaunch(flags, rawArgs) {
   const cleanup = () => {
     if (meshMcpEntries.length > 0) {
       try {
-        const claudeConfigPath = join3(homedir3(), ".claude.json");
+        const claudeConfigPath = join4(homedir3(), ".claude.json");
         const claudeConfig = JSON.parse(readFileSync4(claudeConfigPath, "utf-8"));
         const mcpServers = claudeConfig.mcpServers ?? {};
         for (const { key } of meshMcpEntries) {
@@ -4769,7 +4827,7 @@ __export(exports_join, {
 });
 import sodium3 from "libsodium-wrappers";
 import { writeFileSync as writeFileSync5, mkdirSync as mkdirSync3 } from "node:fs";
-import { join as join4, dirname as dirname2 } from "node:path";
+import { join as join5, dirname as dirname2 } from "node:path";
 import { homedir as homedir4, hostname as hostname3 } from "node:os";
 function deriveAppBaseUrl() {
   const override = process.env.CLAUDEMESH_APP_URL;
@@ -4889,8 +4947,8 @@ async function runJoin(args) {
     joinedAt: new Date().toISOString()
   });
   writeConfig(config);
-  const configDir = env.CLAUDEMESH_CONFIG_DIR ?? join4(homedir4(), ".claudemesh");
-  const inviteFile = join4(configDir, `invite-${payload.mesh_slug}.txt`);
+  const configDir = env.CLAUDEMESH_CONFIG_DIR ?? join5(homedir4(), ".claudemesh");
+  const inviteFile = join5(configDir, `invite-${payload.mesh_slug}.txt`);
   try {
     mkdirSync3(dirname2(inviteFile), { recursive: true });
     writeFileSync5(inviteFile, link, "utf-8");
@@ -6633,12 +6691,9 @@ var init_ban = __esm(() => {
 
 // src/services/bridge/protocol.ts
 import { homedir as homedir5 } from "node:os";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 function socketPath(meshSlug) {
-  return join5(homedir5(), ".claudemesh", "sockets", `${meshSlug}.sock`);
-}
-function socketDir() {
-  return join5(homedir5(), ".claudemesh", "sockets");
+  return join6(homedir5(), ".claudemesh", "sockets", `${meshSlug}.sock`);
 }
 function frame(obj) {
   return JSON.stringify(obj) + `
@@ -6834,36 +6889,6 @@ var init_peers = __esm(() => {
   };
 });
 
-// src/daemon/paths.ts
-import { join as join6 } from "node:path";
-var DAEMON_PATHS, DAEMON_TCP_HOST = "127.0.0.1", DAEMON_TCP_DEFAULT_PORT = 47823;
-var init_paths2 = __esm(() => {
-  init_paths();
-  DAEMON_PATHS = {
-    get DAEMON_DIR() {
-      return join6(PATHS.CONFIG_DIR, "daemon");
-    },
-    get PID_FILE() {
-      return join6(this.DAEMON_DIR, "daemon.pid");
-    },
-    get SOCK_FILE() {
-      return join6(this.DAEMON_DIR, "daemon.sock");
-    },
-    get TOKEN_FILE() {
-      return join6(this.DAEMON_DIR, "local-token");
-    },
-    get OUTBOX_DB() {
-      return join6(this.DAEMON_DIR, "outbox.db");
-    },
-    get INBOX_DB() {
-      return join6(this.DAEMON_DIR, "inbox.db");
-    },
-    get LOG_FILE() {
-      return join6(this.DAEMON_DIR, "daemon.log");
-    }
-  };
-});
-
 // src/daemon/local-token.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "node:fs";
 import { dirname as dirname3 } from "node:path";
@@ -8881,7 +8906,7 @@ function makeHandler(opts) {
       respond(res, 200, {
         daemon_version: VERSION,
         ipc_api: "v1",
-        ipc_features: ["version", "health", "send", "inbox", "events", "peers", "profile"],
+        ipc_features: ["version", "health", "send", "inbox", "events", "peers", "profile", "skills"],
         schema_version: 1
       });
       return;
@@ -8911,6 +8936,42 @@ function makeHandler(opts) {
       }
       return;
     }
+    if (req.method === "GET" && url.pathname === "/v1/skills") {
+      if (!opts.broker) {
+        respond(res, 503, { error: "broker not initialised" });
+        return;
+      }
+      const query = url.searchParams.get("query") ?? undefined;
+      try {
+        const skills = await opts.broker.listSkills(query);
+        respond(res, 200, { skills });
+      } catch (e) {
+        respond(res, 502, { error: "broker_unreachable", detail: String(e) });
+      }
+      return;
+    }
+    if (req.method === "GET" && url.pathname.startsWith("/v1/skills/")) {
+      if (!opts.broker) {
+        respond(res, 503, { error: "broker not initialised" });
+        return;
+      }
+      const name = decodeURIComponent(url.pathname.slice("/v1/skills/".length));
+      if (!name) {
+        respond(res, 400, { error: "missing skill name" });
+        return;
+      }
+      try {
+        const skill = await opts.broker.getSkill(name);
+        if (!skill) {
+          respond(res, 404, { error: "skill_not_found", name });
+          return;
+        }
+        respond(res, 200, { skill });
+      } catch (e) {
+        respond(res, 502, { error: "broker_unreachable", detail: String(e) });
+      }
+      return;
+    }
     if (req.method === "POST" && url.pathname === "/v1/profile") {
       if (!opts.broker) {
         respond(res, 503, { error: "broker not initialised" });
@@ -9191,6 +9252,8 @@ class DaemonBrokerClient {
   helloTimer = null;
   pendingAcks = new Map;
   peerListResolvers = new Map;
+  skillListResolvers = new Map;
+  skillDataResolvers = new Map;
   sessionPubkey = null;
   sessionSecretKey = null;
   opens = [];
@@ -9311,6 +9374,26 @@ class DaemonBrokerClient {
           }
           return;
         }
+        if (msg.type === "skill_list") {
+          const reqId = String(msg._reqId ?? "");
+          const pending = this.skillListResolvers.get(reqId);
+          if (pending) {
+            this.skillListResolvers.delete(reqId);
+            clearTimeout(pending.timer);
+            pending.resolve(Array.isArray(msg.skills) ? msg.skills : []);
+          }
+          return;
+        }
+        if (msg.type === "skill_data") {
+          const reqId = String(msg._reqId ?? "");
+          const pending = this.skillDataResolvers.get(reqId);
+          if (pending) {
+            this.skillDataResolvers.delete(reqId);
+            clearTimeout(pending.timer);
+            pending.resolve(msg.skill ?? null);
+          }
+          return;
+        }
         if (msg.type === "push" || msg.type === "inbound") {
           this.opts.onPush?.(msg);
           return;
@@ -9393,6 +9476,44 @@ class DaemonBrokerClient {
       }
     });
   }
+  async listSkills(query, timeoutMs = 5000) {
+    if (this._status !== "open" || !this.ws)
+      return [];
+    return new Promise((resolve) => {
+      const reqId = `sl-${++this.reqCounter}`;
+      const timer = setTimeout(() => {
+        if (this.skillListResolvers.delete(reqId))
+          resolve([]);
+      }, timeoutMs);
+      this.skillListResolvers.set(reqId, { resolve, timer });
+      try {
+        this.ws.send(JSON.stringify({ type: "list_skills", query, _reqId: reqId }));
+      } catch {
+        this.skillListResolvers.delete(reqId);
+        clearTimeout(timer);
+        resolve([]);
+      }
+    });
+  }
+  async getSkill(name, timeoutMs = 5000) {
+    if (this._status !== "open" || !this.ws)
+      return null;
+    return new Promise((resolve) => {
+      const reqId = `sg-${++this.reqCounter}`;
+      const timer = setTimeout(() => {
+        if (this.skillDataResolvers.delete(reqId))
+          resolve(null);
+      }, timeoutMs);
+      this.skillDataResolvers.set(reqId, { resolve, timer });
+      try {
+        this.ws.send(JSON.stringify({ type: "get_skill", name, _reqId: reqId }));
+      } catch {
+        this.skillDataResolvers.delete(reqId);
+        clearTimeout(timer);
+        resolve(null);
+      }
+    });
+  }
   setProfile(profile) {
     if (this._status !== "open" || !this.ws)
       return;
@@ -9619,11 +9740,14 @@ async function handleBrokerPush(msg, ctx) {
   const brokerMessageId = stringOrNull(msg.messageId);
   const senderPubkey = stringOrNull(msg.senderPubkey) ?? "";
   const senderName = stringOrNull(msg.senderName) ?? senderPubkey.slice(0, 8);
+  const senderMemberPk = stringOrNull(msg.senderMemberPubkey);
   const topic = stringOrNull(msg.topic);
   const replyToId = stringOrNull(msg.replyToId);
   const ciphertext = stringOrNull(msg.ciphertext) ?? "";
   const nonce = stringOrNull(msg.nonce) ?? "";
   const createdAt = stringOrNull(msg.createdAt);
+  const priority = stringOrNull(msg.priority) ?? "next";
+  const subtype = stringOrNull(msg.subtype);
   const clientMessageId = stringOrNull(msg.client_message_id) ?? brokerMessageId ?? randomUUID5();
   const body = await decryptOrFallback({
     ciphertext,
@@ -9653,9 +9777,12 @@ async function handleBrokerPush(msg, ctx) {
     client_message_id: clientMessageId,
     broker_message_id: brokerMessageId,
     sender_pubkey: senderPubkey,
+    sender_member_pubkey: senderMemberPk,
     sender_name: senderName,
     topic,
     reply_to_id: replyToId,
+    priority,
+    ...subtype ? { subtype } : {},
     body,
     created_at: createdAt
   });
@@ -10754,6 +10881,7 @@ function installStatusLine() {
 function runInstall(args = []) {
   const skipHooks = args.includes("--no-hooks");
   const skipSkill = args.includes("--no-skill");
+  const skipService = args.includes("--no-service");
   const wantStatusLine = args.includes("--status-line");
   render.section("claudemesh install");
   const entry = resolveEntry();
@@ -10835,10 +10963,25 @@ function runInstall(args = []) {
     }
   }
   let hasMeshes = false;
+  let primaryMesh;
   try {
     const meshConfig = readConfig();
     hasMeshes = meshConfig.meshes.length > 0;
+    primaryMesh = meshConfig.meshes[0]?.slug;
   } catch {}
+  if (!skipService && hasMeshes && primaryMesh) {
+    try {
+      installDaemonService(entry, primaryMesh);
+    } catch (e) {
+      render.warn(`daemon service install failed: ${e instanceof Error ? e.message : String(e)}`, "Run `claudemesh daemon install-service --mesh <slug>` to retry.");
+    }
+  } else if (skipService) {
+    render.info(dim("· Daemon service skipped (--no-service)"));
+    render.info(dim("  MCP integration will fail at boot until you start the daemon manually:"));
+    render.info(dim("    claudemesh daemon up --mesh <slug>"));
+  } else if (!hasMeshes) {
+    render.info(dim("· Daemon service deferred — join a mesh first, then run install again."));
+  }
   render.blank();
   render.warn(`${bold("RESTART CLAUDE CODE")} ${yellow("for MCP tools to appear.")}`);
   if (!hasMeshes) {
@@ -10856,6 +10999,40 @@ function runInstall(args = []) {
   render.info(dim(`  claudemesh install --status-line # live peer count in Claude Code`));
   render.info(dim(`  claudemesh completions zsh       # shell completions`));
 }
+function installDaemonService(binaryEntry, meshSlug) {
+  const {
+    installService: installService2,
+    detectPlatform: detectPlatform2
+  } = (init_service_install(), __toCommonJS(exports_service_install));
+  const platform6 = detectPlatform2();
+  if (!platform6) {
+    render.info(dim(`· Daemon service skipped — unsupported platform: ${process.platform}`));
+    return;
+  }
+  let binary = process.argv[1] ?? binaryEntry;
+  if (!binary || /\.ts$/.test(binary) || /node_modules|src\/entrypoints/.test(binary)) {
+    try {
+      const { execSync: execSync3 } = __require("node:child_process");
+      binary = execSync3("which claudemesh", { encoding: "utf8" }).trim();
+    } catch {
+      render.warn("couldn't resolve a 'claudemesh' binary on PATH; daemon service skipped", "Install via npm/homebrew, then run `claudemesh daemon install-service --mesh " + meshSlug + "`");
+      return;
+    }
+  }
+  const r = installService2({ binaryPath: binary, meshSlug });
+  render.ok(`daemon service installed (${r.platform})`);
+  render.kv([
+    ["unit", dim(r.unitPath)],
+    ["mesh", dim(meshSlug)]
+  ]);
+  try {
+    const { execSync: execSync3 } = __require("node:child_process");
+    execSync3(r.bootCommand, { stdio: "ignore" });
+    render.ok("daemon started");
+  } catch (e) {
+    render.warn(`daemon service installed but failed to start: ${e instanceof Error ? e.message : String(e)}`, `Run manually: ${r.bootCommand}`);
+  }
+}
 function runUninstall() {
   render.section("claudemesh uninstall");
   if (removeMcpServer()) {
@@ -12737,11 +12914,14 @@ var exports_platform_actions = {};
 __export(exports_platform_actions, {
   runWebhookList: () => runWebhookList,
   runWebhookDelete: () => runWebhookDelete,
+  runWebhookCreate: () => runWebhookCreate,
   runWatchList: () => runWatchList,
+  runWatchAdd: () => runWatchAdd,
   runVectorStore: () => runVectorStore,
   runVectorSearch: () => runVectorSearch,
   runVectorDelete: () => runVectorDelete,
   runVectorCollections: () => runVectorCollections,
+  runVaultSet: () => runVaultSet,
   runVaultList: () => runVaultList,
   runVaultDelete: () => runVaultDelete,
   runUnwatch: () => runUnwatch,
@@ -13188,6 +13368,40 @@ async function runVaultDelete(key, opts) {
     return ok ? EXIT.SUCCESS : EXIT.NOT_FOUND;
   });
 }
+async function runVaultSet(key, value, opts) {
+  if (!key || value == null) {
+    render.err("Usage: claudemesh vault set <key> <value> [--type env|file] [--mount /path] [--description ...]");
+    return EXIT.INVALID_ARGS;
+  }
+  const { encryptFile: encryptFile2, sealKeyForPeer: sealKeyForPeer2 } = await Promise.resolve().then(() => (init_file_crypto(), exports_file_crypto));
+  const { getMeshConfig: getMeshConfig2 } = await Promise.resolve().then(() => (init_facade(), exports_facade));
+  const { readConfig: readConfig2 } = await Promise.resolve().then(() => (init_facade(), exports_facade));
+  const config = readConfig2();
+  const slug = opts.mesh ?? (config.meshes.length === 1 ? config.meshes[0].slug : null);
+  if (!slug) {
+    render.err("multiple meshes joined; pass --mesh <slug>");
+    return EXIT.INVALID_ARGS;
+  }
+  const mesh = getMeshConfig2(slug);
+  if (!mesh) {
+    render.err(`not joined to mesh "${slug}"`);
+    return EXIT.NOT_FOUND;
+  }
+  const plaintext = new TextEncoder().encode(value);
+  const enc = await encryptFile2(plaintext);
+  const ciphertextB64 = Buffer.from(enc.ciphertext).toString("base64");
+  const sealed = await sealKeyForPeer2(enc.key, mesh.pubkey);
+  return await withMesh({ meshSlug: slug }, async (client) => {
+    const ok = await client.vaultSet(key, ciphertextB64, enc.nonce, sealed, opts.entryType ?? "env", opts.mountPath, opts.description);
+    if (opts.json)
+      emitJson({ key, stored: ok });
+    else if (ok)
+      render.ok(`vault[${bold(key)}] stored`, dim(`(${ciphertextB64.length}b)`));
+    else
+      render.err(`vault set failed for "${key}"`);
+    return ok ? EXIT.SUCCESS : EXIT.IO_ERROR;
+  });
+}
 async function runWatchList(opts) {
   return await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
     const watches = await client.watchList();
@@ -13210,6 +13424,34 @@ async function runWatchList(opts) {
     return EXIT.SUCCESS;
   });
 }
+async function runWatchAdd(url, opts) {
+  if (!url) {
+    render.err("Usage: claudemesh watch add <url> [--label ...] [--interval <sec>] [--extract <css>] [--notify-on changed|always]");
+    return EXIT.INVALID_ARGS;
+  }
+  return await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
+    const result = await client.watch(url, {
+      label: opts.label,
+      interval: opts.interval,
+      mode: opts.mode,
+      extract: opts.extract,
+      notify_on: opts.notifyOn
+    });
+    if (result?.error) {
+      if (opts.json)
+        emitJson({ ok: false, error: result.error });
+      else
+        render.err(`watch add failed: ${result.error}`);
+      return EXIT.IO_ERROR;
+    }
+    const id = String(result?.id ?? result?.watch_id ?? "?");
+    if (opts.json)
+      emitJson({ ok: true, id, url, ...opts.label ? { label: opts.label } : {} });
+    else
+      render.ok(`watching ${clay(url)}`, dim(id.slice(0, 8)));
+    return EXIT.SUCCESS;
+  });
+}
 async function runUnwatch(id, opts) {
   if (!id) {
     render.err("Usage: claudemesh watch remove <id>");
@@ -13246,6 +13488,32 @@ async function runWebhookList(opts) {
     return EXIT.SUCCESS;
   });
 }
+async function runWebhookCreate(name, opts) {
+  if (!name) {
+    render.err("Usage: claudemesh webhook create <name>");
+    return EXIT.INVALID_ARGS;
+  }
+  return await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
+    const created = await client.createWebhook(name);
+    if (!created) {
+      if (opts.json)
+        emitJson({ ok: false, error: "create failed (timeout or duplicate)" });
+      else
+        render.err(`webhook create "${name}" failed`);
+      return EXIT.IO_ERROR;
+    }
+    if (opts.json)
+      emitJson({ ok: true, ...created });
+    else {
+      render.ok(`created webhook ${bold(created.name)}`);
+      process.stdout.write(`  url:    ${clay(created.url)}
+`);
+      process.stdout.write(`  secret: ${dim(created.secret)} ${dim("(shown once)")}
+`);
+    }
+    return EXIT.SUCCESS;
+  });
+}
 async function runWebhookDelete(name, opts) {
   if (!name) {
     render.err("Usage: claudemesh webhook delete <name>");
@@ -15860,435 +16128,194 @@ var init_member = __esm(() => {
   init_exit_codes();
 });
 
-// src/mcp/tools/definitions.ts
-var TOOLS;
-var init_definitions = __esm(() => {
-  TOOLS = [];
-});
-
-// src/services/bridge/server.ts
-import { createServer as createServer3 } from "node:net";
-import { mkdirSync as mkdirSync12, unlinkSync as unlinkSync5, existsSync as existsSync28, chmodSync as chmodSync6 } from "node:fs";
-async function resolveTarget2(client, to) {
-  if (to.startsWith("@") || to === "*" || /^[0-9a-f]{64}$/i.test(to)) {
-    return { ok: true, spec: to };
-  }
-  const peers = await client.listPeers();
-  const match = peers.find((p) => p.displayName.toLowerCase() === to.toLowerCase());
-  if (!match) {
-    return {
-      ok: false,
-      error: `peer "${to}" not found. online: ${peers.map((p) => p.displayName).join(", ") || "(none)"}`
-    };
+// src/mcp/server.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  ListToolsRequestSchema,
+  CallToolRequestSchema,
+  ListPromptsRequestSchema,
+  GetPromptRequestSchema,
+  ListResourcesRequestSchema,
+  ReadResourceRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+import { existsSync as existsSync28 } from "node:fs";
+import { request as httpRequest2 } from "node:http";
+async function daemonReady() {
+  for (let i = 0;i < DAEMON_BOOT_RETRIES; i++) {
+    if (existsSync28(DAEMON_PATHS.SOCK_FILE))
+      return true;
+    await new Promise((r) => setTimeout(r, DAEMON_BOOT_RETRY_MS));
   }
-  return { ok: true, spec: match.pubkey };
+  return false;
 }
-async function dispatch(client, req) {
-  const args = req.args ?? {};
-  try {
-    switch (req.verb) {
-      case "ping": {
-        const peers = await client.listPeers();
-        return {
-          id: req.id,
-          ok: true,
-          result: {
-            mesh: client.meshSlug,
-            ws_status: client.status,
-            peers_online: peers.length,
-            push_buffer: client.pushHistory.length
-          }
-        };
-      }
-      case "peers": {
-        const peers = await client.listPeers();
-        return { id: req.id, ok: true, result: peers };
-      }
-      case "send": {
-        const to = String(args.to ?? "");
-        const message = String(args.message ?? "");
-        const priority = args.priority ?? "next";
-        if (!to || !message) {
-          return { id: req.id, ok: false, error: "send: `to` and `message` required" };
-        }
-        const resolved = await resolveTarget2(client, to);
-        if (!resolved.ok)
-          return { id: req.id, ok: false, error: resolved.error };
-        const result = await client.send(resolved.spec, message, priority);
-        if (!result.ok) {
-          return { id: req.id, ok: false, error: result.error ?? "send failed" };
-        }
-        return {
-          id: req.id,
-          ok: true,
-          result: { messageId: result.messageId, target: resolved.spec }
-        };
-      }
-      case "summary": {
-        const text = String(args.summary ?? "");
-        if (!text)
-          return { id: req.id, ok: false, error: "summary: `summary` required" };
-        await client.setSummary(text);
-        return { id: req.id, ok: true, result: { summary: text } };
-      }
-      case "status_set": {
-        const state = String(args.status ?? "");
-        if (!["idle", "working", "dnd"].includes(state)) {
-          return { id: req.id, ok: false, error: "status_set: must be idle | working | dnd" };
-        }
-        await client.setStatus(state);
-        return { id: req.id, ok: true, result: { status: state } };
-      }
-      case "visible": {
-        const visible = Boolean(args.visible);
-        await client.setVisible(visible);
-        return { id: req.id, ok: true, result: { visible } };
-      }
-      default:
-        return { id: req.id, ok: false, error: `unknown verb: ${req.verb}` };
-    }
-  } catch (err) {
-    return {
-      id: req.id,
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
+function bailNoDaemon() {
+  process.stderr.write(`[claudemesh] daemon is not running.
+` + `  Start it:               claudemesh daemon up --mesh <slug>
+` + `  Or install as service:  claudemesh daemon install-service --mesh <slug>
+` + `  Diagnose:               claudemesh doctor
+` + `
+` + `  As of 1.24.0 the daemon is required for in-Claude-Code use of
+` + `  claudemesh. The CLI itself (claudemesh send/peer/inbox/...) still
+` + `  works without a daemon.
+`);
+  process.exit(1);
 }
-function handleConnection(socket, client) {
-  const parser = new LineParser;
-  socket.on("data", (chunk) => {
-    const lines = parser.feed(chunk);
-    for (const line of lines) {
-      if (!line.trim())
-        continue;
-      let req;
-      try {
-        req = JSON.parse(line);
-      } catch {
-        continue;
-      }
-      if (!req || typeof req !== "object" || !req.id || !req.verb)
-        continue;
-      dispatch(client, req).then((res) => {
+function daemonGet(path2) {
+  return new Promise((resolve3, reject) => {
+    const req = httpRequest2({ socketPath: DAEMON_PATHS.SOCK_FILE, path: path2, method: "GET", timeout: 5000 }, (res) => {
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("end", () => {
+        const text = Buffer.concat(chunks).toString("utf8");
+        let body = null;
         try {
-          socket.write(frame(res));
-        } catch {}
+          body = JSON.parse(text);
+        } catch {
+          body = text;
+        }
+        resolve3({ status: res.statusCode ?? 0, body });
       });
-    }
+    });
+    req.on("error", reject);
+    req.on("timeout", () => req.destroy(new Error("daemon_ipc_timeout")));
+    req.end();
   });
-  socket.on("error", () => {});
 }
-function startBridgeServer(client) {
-  const path2 = socketPath(client.meshSlug);
-  const dir = socketDir();
-  if (!existsSync28(dir)) {
-    mkdirSync12(dir, { recursive: true, mode: 448 });
-  }
-  if (existsSync28(path2)) {
-    try {
-      unlinkSync5(path2);
-    } catch {}
-  }
-  const server = createServer3((socket) => handleConnection(socket, client));
-  try {
-    server.listen(path2);
-  } catch (err) {
-    process.stderr.write(`[claudemesh] bridge: failed to bind ${path2}: ${String(err)}
+function subscribeEvents(onEvent) {
+  let active = true;
+  let req = null;
+  const connect = () => {
+    if (!active)
+      return;
+    req = httpRequest2({
+      socketPath: DAEMON_PATHS.SOCK_FILE,
+      path: "/v1/events",
+      method: "GET",
+      headers: { Accept: "text/event-stream" }
+    });
+    let buffer = "";
+    req.on("response", (res) => {
+      res.setEncoding("utf8");
+      res.on("data", (chunk) => {
+        buffer += chunk;
+        let idx;
+        while ((idx = buffer.indexOf(`
+
+`)) >= 0) {
+          const block = buffer.slice(0, idx);
+          buffer = buffer.slice(idx + 2);
+          if (!block.trim())
+            continue;
+          let kind = "message";
+          let dataLine = "";
+          for (const line of block.split(`
+`)) {
+            if (line.startsWith(":"))
+              continue;
+            if (line.startsWith("event:"))
+              kind = line.slice(6).trim();
+            else if (line.startsWith("data:"))
+              dataLine = line.slice(5).trim();
+          }
+          if (!dataLine)
+            continue;
+          try {
+            const parsed = JSON.parse(dataLine);
+            onEvent({ kind, ts: String(parsed.ts ?? ""), data: parsed });
+          } catch {}
+        }
+      });
+      res.on("end", () => {
+        if (active) {
+          process.stderr.write(`[claudemesh-mcp] sse stream ended; reconnecting in 1s
 `);
-    return null;
-  }
-  server.on("error", (err) => {
-    process.stderr.write(`[claudemesh] bridge: ${String(err)}
+          setTimeout(connect, 1000);
+        }
+      });
+      res.on("error", (err) => process.stderr.write(`[claudemesh-mcp] sse error: ${err.message}
+`));
+    });
+    req.on("error", (err) => {
+      process.stderr.write(`[claudemesh-mcp] sse connect error: ${err.message}
 `);
-  });
-  try {
-    chmodSync6(path2, 384);
-  } catch {}
-  let stopped = false;
+      if (active)
+        setTimeout(connect, 2000);
+    });
+    req.end();
+  };
+  connect();
   return {
-    path: path2,
-    stop() {
-      if (stopped)
-        return;
-      stopped = true;
-      try {
-        server.close();
-      } catch {}
+    close: () => {
+      active = false;
       try {
-        unlinkSync5(path2);
+        req?.destroy();
       } catch {}
     }
   };
 }
-var init_server2 = __esm(() => {
-  init_protocol();
-});
-
-// src/mcp/server.ts
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import {
-  ListToolsRequestSchema,
-  CallToolRequestSchema,
-  ListPromptsRequestSchema,
-  GetPromptRequestSchema,
-  ListResourcesRequestSchema,
-  ReadResourceRequestSchema
-} from "@modelcontextprotocol/sdk/types.js";
-function relativeTime(isoStr) {
-  const then = new Date(isoStr).getTime();
-  if (isNaN(then))
-    return "unknown";
-  const diffMs = Date.now() - then;
-  if (diffMs < 0)
-    return "just now";
-  const seconds = Math.floor(diffMs / 1000);
-  if (seconds < 60)
-    return `${seconds}s ago`;
-  const minutes = Math.floor(seconds / 60);
-  if (minutes < 60)
-    return `${minutes}m ago`;
-  const hours = Math.floor(minutes / 60);
-  if (hours < 24)
-    return `${hours}h ago`;
-  const days = Math.floor(hours / 24);
-  return `${days} day${days !== 1 ? "s" : ""} ago`;
-}
-async function resolvePeerName(client, pubkey) {
-  const now = Date.now();
-  if (now - peerNameCacheAge > CACHE_TTL_MS) {
-    peerNameCache.clear();
-    try {
-      const peers = await client.listPeers();
-      for (const p of peers)
-        peerNameCache.set(p.pubkey, p.displayName);
-    } catch {}
-    peerNameCacheAge = now;
-  }
-  return peerNameCache.get(pubkey) ?? `peer-${pubkey.slice(0, 8)}`;
-}
-function decryptFailedWarning(senderPubkey) {
-  const who = senderPubkey ? senderPubkey.slice(0, 12) + "…" : "unknown sender";
-  return `⚠ message from ${who} failed to decrypt (tampered or wrong keypair)`;
-}
 async function startMcpServer() {
   const serviceIdx = process.argv.indexOf("--service");
   if (serviceIdx !== -1 && process.argv[serviceIdx + 1]) {
     return startServiceProxy(process.argv[serviceIdx + 1]);
   }
-  const meshIdx = process.argv.indexOf("--mesh");
-  const onlyMesh = meshIdx !== -1 ? process.argv[meshIdx + 1] : null;
-  const config = readConfig();
-  if (onlyMesh) {
-    const available = config.meshes.map((m) => m.slug);
-    const filtered = config.meshes.filter((m) => m.slug === onlyMesh);
-    if (filtered.length === 0) {
-      process.stderr.write(`[claudemesh] --mesh "${onlyMesh}" not found in config. ` + `Joined meshes: ${available.join(", ") || "(none)"}
-`);
-      process.exit(1);
-    }
-    config.meshes = filtered;
-  }
-  const myName = config.displayName ?? "unnamed";
-  const myRole = config.role ?? process.env.CLAUDEMESH_ROLE ?? null;
-  const myGroups = (config.groups ?? []).map((g) => `@${g.name}${g.role ? ":" + g.role : ""}`).join(", ") || "none";
-  const messageMode = config.messageMode ?? "push";
-  const server = new Server({ name: "claudemesh", version: "0.3.0" }, {
-    capabilities: {
-      experimental: { "claude/channel": {} },
-      tools: {},
-      prompts: {},
-      resources: {}
-    },
-    instructions: `## Identity
-You are "${myName}"${myRole ? ` (${myRole})` : ""} — a peer in the claudemesh network. Your groups: ${myGroups}. You are one of several Claude Code sessions connected to the same mesh. No orchestrator exists — peers are equals. Your identity comes from your name and group roles, not from a central authority.
-
-## Responding to messages
-When you receive a <channel source="claudemesh" ...> message, RESPOND IMMEDIATELY. Pause your current task, reply via send_message (or \`claudemesh topic post --reply-to <message_id>\` for topic threads), then resume. Stay in character per your system prompt. Do not ignore low-priority messages — acknowledge them briefly even if you defer action.
-
-The channel attributes carry everything you need to reply — no extra lookups:
-- \`from_name\` — sender display name. Use as the \`to\` arg when replying to a DM.
-- \`from_pubkey\` / \`from_member_id\` — stable ids. Use \`from_member_id\` if the sender's display name might change.
-- \`mesh_slug\` — pass via \`--mesh\` if your default mesh differs.
-- \`priority\` — \`now\` / \`next\` / \`low\`.
-- \`message_id\` — id of THIS message. To thread a reply onto it in a topic, run \`claudemesh topic post <topic> "<text>" --reply-to <message_id>\`.
-- \`topic\` — set when the message arrived through a topic (vs DM). Reply in the same topic.
-- \`reply_to_id\` — set when the incoming message is itself a reply. Render thread context if you re-narrate.
-
-If the channel meta contains \`subtype: reminder\`, this is a scheduled reminder you set for yourself — act on it immediately (no reply needed).
-
-## Tools
-| Tool | Description |
-|------|-------------|
-| send_message(to, message, priority?) | Send to peer name, @group, or * broadcast. \`to\` accepts display name, pubkey hex, @groupname, or *. |
-| list_peers(mesh_slug?) | List connected peers with status, summary, groups, and roles. |
-| check_messages() | Drain buffered inbound messages (auto-pushed in most cases, use as fallback). |
-| set_summary(summary) | Set 1-2 sentence description of your current work, visible to all peers. |
-| set_status(status) | Override status: idle, working, or dnd. |
-| set_visible(visible) | Toggle visibility. Hidden peers skip list_peers and broadcasts; direct messages still arrive. |
-| set_profile(avatar?, title?, bio?, capabilities?) | Set public profile: emoji avatar, short title, bio, capabilities list. |
-| join_group(name, role?) | Join a @group with optional role (lead, member, observer, or any string). |
-| leave_group(name) | Leave a @group. |
-| set_state(key, value) | Write shared state; pushes change to all peers. |
-| get_state(key) | Read a shared state value. |
-| list_state() | List all state keys with values, authors, and timestamps. |
-| remember(content, tags?) | Store persistent knowledge with optional tags. |
-| recall(query) | Full-text search over mesh memory. |
-| forget(id) | Soft-delete a memory entry. |
-| claudemesh file share <path> [--to peer] [--tags a,b] | Share a file with the mesh, or DM it to a specific peer. Same-host fast path: when --to matches a peer on this machine, sends an absolute filepath instead of uploading (no MinIO round-trip). |
-| claudemesh file get <id> [--out path] | Download a shared file by id. |
-| claudemesh file list [query] | Find files shared in the mesh. |
-| claudemesh file status <id> | Check who has accessed a file. |
-| claudemesh file delete <id> | Remove a shared file from the mesh. |
-| vector_store(collection, text, metadata?) | Store embedding in per-mesh Qdrant collection. |
-| vector_search(collection, query, limit?) | Semantic search over stored embeddings. |
-| vector_delete(collection, id) | Remove an embedding. |
-| list_collections() | List vector collections in this mesh. |
-| graph_query(cypher) | Read-only Cypher query on per-mesh Neo4j. |
-| graph_execute(cypher) | Write Cypher query (CREATE, MERGE, DELETE). |
-| mesh_query(sql) | Run a SELECT query on the per-mesh shared database. |
-| mesh_execute(sql) | Run DDL/DML on the per-mesh database (CREATE TABLE, INSERT, UPDATE, DELETE). |
-| mesh_schema() | List tables and columns in the per-mesh shared database. |
-| create_stream(name) | Create a real-time data stream in the mesh. |
-| publish(stream, data) | Push data to a stream. Subscribers receive it in real-time. |
-| subscribe(stream) | Subscribe to a stream. Data pushes arrive as channel notifications. |
-| list_streams() | List active streams in the mesh. |
-| share_context(summary, files_read?, key_findings?, tags?) | Share session understanding with peers. |
-| get_context(query) | Find context from peers who explored an area. |
-| list_contexts() | See what all peers currently know. |
-| create_task(title, assignee?, priority?, tags?) | Create a work item. |
-| claim_task(id) | Claim an unclaimed task. |
-| complete_task(id, result?) | Mark task done with optional result. |
-| list_tasks(status?, assignee?) | List tasks filtered by status/assignee. |
-| schedule_reminder(message, in_seconds?, deliver_at?, to?) | Schedule a reminder to yourself (no \`to\`) or a delayed message to a peer/group. Delivered as a push with \`subtype: reminder\` in the channel meta. |
-| list_scheduled() | List pending scheduled reminders and messages. |
-| cancel_scheduled(id) | Cancel a pending scheduled item. |
-| read_peer_file(peer, path) | Read a file from another peer's project (max 1MB). |
-| list_peer_files(peer, path?, pattern?) | List files in a peer's shared directory. |
-| mesh_mcp_register(server_name, description, tools) | Register an MCP server with the mesh. Other peers can call its tools. |
-| mesh_mcp_list() | List MCP servers available in the mesh with their tools. |
-| mesh_tool_call(server_name, tool_name, args?) | Call a tool on a mesh-registered MCP server (30s timeout). |
-| mesh_mcp_remove(server_name) | Unregister an MCP server you registered. |
-
-If multiple meshes are joined, prefix \`to\` with \`<mesh-slug>:\` to disambiguate (e.g. \`dev-team:Alice\`).
-
-Multi-target: send_message accepts an array of targets for the 'to' field.
-  send_message(to: ["Alice", "@backend"], message: "sprint starts")
-Targets are deduplicated — each peer receives the message once.
-
-Targeted views: when different audiences need different details about the same event,
-send tailored messages instead of one generic broadcast:
-  send_message(to: "@frontend", message: "Auth v2: useAuth hook changed, see src/auth/")
-  send_message(to: "@backend", message: "Auth v2: new /api/auth/v2 endpoints, v1 deprecated")
-  send_message(to: "@pm", message: "Auth v2 done. 3 points, no blockers.")
-
-## Groups
-Groups are routing labels. Send to @groupname to multicast to all members. Roles are metadata that peers interpret: a "lead" gathers input before synthesizing a response, a "member" contributes when asked, an "observer" watches silently. Join and leave groups dynamically with join_group/leave_group. Check list_peers to see who belongs to which groups and their roles.
-
-## State
-Shared key-value store scoped to the mesh. Use get_state/set_state for live coordination facts (deploy frozen? current sprint? PR queue). set_state pushes the change to all connected peers. Read state before asking peers questions — the answer may already be there. State is operational, not archival.
-
-## Memory
-Persistent knowledge that survives across sessions. Use remember(content, tags?) to store lessons, decisions, and incidents. Use recall(query) to search before asking peers. New peers should recall at session start to load institutional knowledge.
-
-## File access — decision guide
-Three ways to access files. Pick the right one:
-
-1. **Local peer (same machine, [local] tag):** Read files directly via filesystem using their \`cwd\` path from list_peers. No limit, instant. This is the default for local peers.
-2. **Remote peer (different machine, [remote] tag):** Use \`read_peer_file(peer, path)\` — relays through the mesh. **1 MB limit**, base64 encoded. Use \`list_peer_files\` to browse first.
-3. **Persistent sharing (any peer):** Use \`share_file(path)\` — uploads to mesh storage (MinIO). **No size limit**. All peers can download anytime via \`get_file\`. Use for files that need to persist or be shared with multiple peers.
-
-**Rule of thumb:** local peer → filesystem. Remote peer, small file → read_peer_file. Large file or needs to persist → share_file.
-
-## Vectors
-Store and search semantic embeddings. Use vector_store to index content, vector_search to find similar content.
-
-## Graph
-Build and query entity relationship graphs. Use graph_execute for writes (CREATE, MERGE), graph_query for reads (MATCH).
-
-## Mesh Database
-Per-mesh PostgreSQL database. Use mesh_execute for DDL/DML (CREATE TABLE, INSERT), mesh_query for SELECT, mesh_schema to inspect tables. Schema auto-created on first use.
-
-## Streams
-Real-time data channels. create_stream to start one, publish to push data, subscribe to receive pushes. Use for build logs, deploy status, live metrics.
-
-## Context
-Share your session understanding with peers. Use share_context after exploring a codebase area. Check get_context before re-reading files another peer already analyzed.
-
-## Tasks
-Create and claim work items. create_task to propose work, claim_task to take ownership, complete_task when done. Prevents duplicate effort.
-
-## Priority
-- "now": interrupt immediately, even if recipient is in DND (use for urgent: broken deploy, blocking issue)
-- "next" (default): deliver when recipient goes idle (normal coordination)
-- "low": pull-only via check_messages (FYI, non-blocking context)
-
-## Coordination
-Call list_peers at session start to understand who is online, their roles, and what they are working on. If you are a group lead, gather input from members before responding to external requests — do not answer alone. If you are a member, contribute to your lead when asked. Use @group messages for team-wide questions, direct messages for 1:1 coordination. Set a meaningful summary so peers know your current focus.
-
-## Message Mode
-Your message mode is "${messageMode}".
-- push: messages arrive in real-time as channel notifications. Respond immediately.
-- inbox: messages are held. You'll see "[inbox] New message from X" notifications. Call check_messages to read them.
-- off: no message notifications. Use check_messages manually to poll.`
-  });
-  server.setRequestHandler(ListToolsRequestSchema, async () => ({
-    tools: TOOLS
-  }));
+  const ok = await daemonReady();
+  if (!ok)
+    bailNoDaemon();
+  const server = new Server({ name: "claudemesh", version: VERSION }, { capabilities: { tools: {}, prompts: {}, resources: {} } });
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [] }));
   server.setRequestHandler(ListPromptsRequestSchema, async () => {
-    const client = allClients()[0];
-    if (!client)
+    try {
+      const { status, body } = await daemonGet("/v1/skills");
+      if (status !== 200)
+        return { prompts: [] };
+      const skills = body?.skills ?? [];
+      return { prompts: skills.map((s) => ({ name: s.name, description: s.description, arguments: [] })) };
+    } catch {
       return { prompts: [] };
-    const skills = await client.listSkills();
-    return {
-      prompts: skills.map((s) => ({
-        name: s.name,
-        description: s.description,
-        arguments: []
-      }))
-    };
+    }
   });
   server.setRequestHandler(GetPromptRequestSchema, async (req) => {
-    const { name, arguments: promptArgs } = req.params;
-    const client = allClients()[0];
-    if (!client)
-      throw new Error("Not connected to any mesh");
-    const skill = await client.getSkill(name);
-    if (!skill)
+    const name = req.params.name;
+    const { status, body } = await daemonGet(`/v1/skills/${encodeURIComponent(name)}`);
+    if (status === 404)
       throw new Error(`Skill "${name}" not found in the mesh`);
+    if (status !== 200)
+      throw new Error(`daemon returned ${status} fetching skill`);
+    const skill = body.skill;
     let content = skill.instructions;
-    const manifest = skill.manifest;
-    if (manifest && typeof manifest === "object") {
+    const m = skill.manifest;
+    if (m && typeof m === "object") {
       const fm = ["---"];
-      if (manifest.description)
-        fm.push(`description: "${manifest.description}"`);
-      if (manifest.when_to_use)
-        fm.push(`when_to_use: "${manifest.when_to_use}"`);
-      if (manifest.allowed_tools?.length)
+      if (m.description)
+        fm.push(`description: "${m.description}"`);
+      if (m.when_to_use)
+        fm.push(`when_to_use: "${m.when_to_use}"`);
+      if (Array.isArray(m.allowed_tools) && m.allowed_tools.length) {
         fm.push(`allowed-tools:
-${manifest.allowed_tools.map((t) => `  - ${t}`).join(`
+${m.allowed_tools.map((t) => `  - ${t}`).join(`
 `)}`);
-      if (manifest.model)
-        fm.push(`model: ${manifest.model}`);
-      if (manifest.context)
-        fm.push(`context: ${manifest.context}`);
-      if (manifest.agent)
-        fm.push(`agent: ${manifest.agent}`);
-      if (manifest.user_invocable === false)
+      }
+      if (m.model)
+        fm.push(`model: ${m.model}`);
+      if (m.context)
+        fm.push(`context: ${m.context}`);
+      if (m.agent)
+        fm.push(`agent: ${m.agent}`);
+      if (m.user_invocable === false)
         fm.push(`user-invocable: false`);
-      if (manifest.argument_hint)
-        fm.push(`argument-hint: "${manifest.argument_hint}"`);
+      if (m.argument_hint)
+        fm.push(`argument-hint: "${m.argument_hint}"`);
       fm.push(`---
 `);
       if (fm.length > 3)
         content = fm.join(`
 `) + content;
-      if (manifest.context === "fork") {
-        const agentType = manifest.agent || "general-purpose";
-        const modelHint = manifest.model ? `, model: "${manifest.model}"` : "";
-        const toolsHint = manifest.allowed_tools?.length ? `
-Only use these tools: ${manifest.allowed_tools.join(", ")}.` : "";
+      if (m.context === "fork") {
+        const agentType = m.agent || "general-purpose";
+        const modelHint = m.model ? `, model: "${m.model}"` : "";
+        const toolsHint = m.allowed_tools?.length ? `
+Only use these tools: ${m.allowed_tools.join(", ")}.` : "";
         content = `IMPORTANT: Execute this skill in an isolated sub-agent. Use the Agent tool with subagent_type="${agentType}"${modelHint}. Pass the full instructions below as the agent prompt.${toolsHint}
 
 ` + content;
@@ -16296,273 +16323,127 @@ Only use these tools: ${manifest.allowed_tools.join(", ")}.` : "";
     }
     return {
       description: skill.description,
-      messages: [
-        {
-          role: "user",
-          content: { type: "text", text: content }
-        }
-      ]
+      messages: [{ role: "user", content: { type: "text", text: content } }]
     };
   });
   server.setRequestHandler(ListResourcesRequestSchema, async () => {
-    const client = allClients()[0];
-    if (!client)
+    try {
+      const { body } = await daemonGet("/v1/skills");
+      const skills = body?.skills ?? [];
+      return {
+        resources: skills.map((s) => ({
+          uri: `skill://claudemesh/${encodeURIComponent(s.name)}`,
+          name: s.name,
+          description: s.description,
+          mimeType: "text/markdown"
+        }))
+      };
+    } catch {
       return { resources: [] };
-    const skills = await client.listSkills();
-    return {
-      resources: skills.map((s) => ({
-        uri: `skill://claudemesh/${encodeURIComponent(s.name)}`,
-        name: s.name,
-        description: s.description,
-        mimeType: "text/markdown"
-      }))
-    };
+    }
   });
   server.setRequestHandler(ReadResourceRequestSchema, async (req) => {
-    const { uri } = req.params;
-    const match = uri.match(/^skill:\/\/claudemesh\/(.+)$/);
-    if (!match)
+    const uri = req.params.uri;
+    const m = uri.match(/^skill:\/\/claudemesh\/(.+)$/);
+    if (!m)
       throw new Error(`Unknown resource URI: ${uri}`);
-    const name = decodeURIComponent(match[1]);
-    const client = allClients()[0];
-    if (!client)
-      throw new Error("Not connected to any mesh");
-    const skill = await client.getSkill(name);
-    if (!skill)
+    const name = decodeURIComponent(m[1]);
+    const { status, body } = await daemonGet(`/v1/skills/${encodeURIComponent(name)}`);
+    if (status === 404)
       throw new Error(`Skill "${name}" not found`);
-    const manifest = skill.manifest;
-    const fmLines = ["---"];
-    fmLines.push(`name: ${skill.name}`);
-    fmLines.push(`description: "${skill.description}"`);
-    if (skill.tags.length)
-      fmLines.push(`tags: [${skill.tags.join(", ")}]`);
-    if (manifest && typeof manifest === "object") {
-      if (manifest.when_to_use)
-        fmLines.push(`when_to_use: "${manifest.when_to_use}"`);
-      if (manifest.allowed_tools?.length)
-        fmLines.push(`allowed-tools:
-${manifest.allowed_tools.map((t) => `  - ${t}`).join(`
+    if (status !== 200)
+      throw new Error(`daemon returned ${status} fetching skill`);
+    const skill = body.skill;
+    const fm = ["---"];
+    fm.push(`name: ${skill.name}`);
+    fm.push(`description: "${skill.description}"`);
+    if (skill.tags?.length)
+      fm.push(`tags: [${skill.tags.join(", ")}]`);
+    const mf = skill.manifest;
+    if (mf && typeof mf === "object") {
+      if (mf.when_to_use)
+        fm.push(`when_to_use: "${mf.when_to_use}"`);
+      if (Array.isArray(mf.allowed_tools) && mf.allowed_tools.length) {
+        fm.push(`allowed-tools:
+${mf.allowed_tools.map((t) => `  - ${t}`).join(`
 `)}`);
-      if (manifest.model)
-        fmLines.push(`model: ${manifest.model}`);
-      if (manifest.context)
-        fmLines.push(`context: ${manifest.context}`);
-      if (manifest.agent)
-        fmLines.push(`agent: ${manifest.agent}`);
-      if (manifest.user_invocable === false)
-        fmLines.push(`user-invocable: false`);
-      if (manifest.argument_hint)
-        fmLines.push(`argument-hint: "${manifest.argument_hint}"`);
-    }
-    fmLines.push(`---
+      }
+      if (mf.model)
+        fm.push(`model: ${mf.model}`);
+      if (mf.context)
+        fm.push(`context: ${mf.context}`);
+    }
+    fm.push(`---
 `);
-    const fullContent = fmLines.join(`
-`) + skill.instructions;
-    return {
-      contents: [
-        {
-          uri,
-          mimeType: "text/markdown",
-          text: fullContent
-        }
-      ]
-    };
+    return { contents: [{ uri, mimeType: "text/markdown", text: fm.join(`
+`) + skill.instructions }] };
   });
-  const transport = new StdioServerTransport;
-  await server.connect(transport);
-  const bridges = [];
-  startClients(config).then(() => {
-    wirePushHandlers().catch(() => {});
-    for (const client of allClients()) {
-      const bridge = startBridgeServer(client);
-      if (bridge)
-        bridges.push(bridge);
-    }
-  }).catch(() => {
-    wirePushHandlers().catch(() => {});
-  });
-  async function wirePushHandlers() {
-    for (const client of allClients()) {
-      client.onPush(async (msg) => {
-        if (messageMode === "off")
-          return;
-        if (msg.subtype === "system" && msg.event) {
-          const eventName = msg.event;
-          const data = msg.eventData ?? {};
-          let content2;
-          if (eventName === "tick") {
-            const tick = data.tick ?? 0;
-            const simTime = String(data.simTime ?? "").replace("T", " ").replace(/\..*/, "");
-            const speed = data.speed ?? 1;
-            content2 = `[heartbeat] tick ${tick} | sim time: ${simTime} | speed: x${speed}`;
-          } else if (eventName === "peer_joined") {
-            content2 = `[system] Peer "${data.name ?? "unknown"}" joined the mesh`;
-          } else if (eventName === "peer_returned") {
-            const peerName = String(data.name ?? "unknown");
-            const lastSeenAt = data.lastSeenAt ? relativeTime(String(data.lastSeenAt)) : "unknown";
-            const groups = Array.isArray(data.groups) ? data.groups.map((g) => g.role ? `@${g.name}:${g.role}` : `@${g.name}`).join(", ") : "";
-            const summary = data.summary ? ` Summary: "${data.summary}"` : "";
-            content2 = `[system] Welcome back, "${peerName}"! Last seen ${lastSeenAt}.${groups ? ` Restored: ${groups}` : ""}${summary}`;
-          } else if (eventName === "peer_left") {
-            content2 = `[system] Peer "${data.name ?? "unknown"}" left the mesh`;
-          } else if (eventName === "mcp_registered") {
-            const tools = Array.isArray(data.tools) ? data.tools.join(", ") : "";
-            content2 = `[system] New MCP server available: "${data.serverName}" (hosted by ${data.hostedBy}). Tools: ${tools}. Use mesh_tool_call to invoke.`;
-          } else if (eventName === "mcp_unregistered") {
-            content2 = `[system] MCP server "${data.serverName}" removed (was hosted by ${data.hostedBy})`;
-          } else if (eventName === "mcp_restored") {
-            content2 = `[system] MCP server "${data.serverName}" is back online (hosted by ${data.hostedBy})`;
-          } else if (eventName === "watch_triggered") {
-            content2 = `[WATCH] ${data.label ?? data.url}: ${data.oldValue} → ${data.newValue}`;
-          } else if (eventName === "mcp_deployed") {
-            content2 = `[SERVICE] "${data.name}" deployed (${data.tool_count} tools) by ${data.deployed_by}`;
-          } else if (eventName === "mcp_undeployed") {
-            content2 = `[SERVICE] "${data.name}" undeployed by ${data.by}`;
-          } else if (eventName === "mcp_scope_changed") {
-            content2 = `[SERVICE] "${data.name}" scope changed to ${JSON.stringify(data.scope)} by ${data.by}`;
-          } else {
-            content2 = `[system] ${eventName}: ${JSON.stringify(data)}`;
-          }
-          try {
-            await server.notification({
-              method: "notifications/claude/channel",
-              params: {
-                content: content2,
-                meta: {
-                  kind: "system",
-                  event: eventName,
-                  mesh_slug: client.meshSlug,
-                  mesh_id: client.meshId,
-                  ...Object.keys(data).length > 0 ? { eventData: JSON.stringify(data) } : {}
-                }
-              }
-            });
-            process.stderr.write(`[claudemesh] system: ${content2}
-`);
-          } catch (pushErr) {
-            process.stderr.write(`[claudemesh] system push FAILED: ${pushErr}
-`);
-          }
-          return;
-        }
-        const fromPubkey = msg.senderPubkey || "";
-        const fromName = fromPubkey ? await resolvePeerName(client, fromPubkey) : "unknown";
-        if (fromPubkey) {
-          try {
-            const { isAllowed: isAllowed2 } = await Promise.resolve().then(() => (init_grants(), exports_grants));
-            const kindCap = msg.kind === "broadcast" ? "broadcast" : "dm";
-            if (!isAllowed2(client.meshSlug, fromPubkey, kindCap)) {
-              process.stderr.write(`[claudemesh] dropped ${kindCap} from ${fromName} (not granted)
-`);
-              return;
-            }
-          } catch {}
-        }
-        if (messageMode === "inbox") {
-          try {
-            await server.notification({
-              method: "notifications/claude/channel",
-              params: {
-                content: `[inbox] New message from ${fromName}. Use check_messages to read.`,
-                meta: { kind: "inbox_notification", from_name: fromName }
-              }
-            });
-          } catch {}
-          return;
-        }
-        const body = msg.plaintext ?? decryptFailedWarning(fromPubkey);
-        const prioBadge = msg.priority === "now" ? "[URGENT] " : msg.priority === "low" ? "[low] " : "";
-        const kindBadge = msg.kind === "broadcast" ? " (broadcast)" : "";
-        const content = `${prioBadge}${fromName}${kindBadge}: ${body}`;
-        const fromMemberPubkey = msg.senderMemberPubkey ?? fromPubkey;
-        try {
-          await server.notification({
-            method: "notifications/claude/channel",
-            params: {
-              content,
-              meta: {
-                from_id: fromMemberPubkey,
-                from_pubkey: fromMemberPubkey,
-                from_session_pubkey: fromPubkey,
-                from_name: fromName,
-                ...msg.senderMemberId ? { from_member_id: msg.senderMemberId } : {},
-                mesh_slug: client.meshSlug,
-                mesh_id: client.meshId,
-                priority: msg.priority,
-                sent_at: msg.createdAt,
-                delivered_at: msg.receivedAt,
-                kind: msg.kind,
-                message_id: msg.messageId,
-                ...msg.topic ? { topic: msg.topic } : {},
-                ...msg.replyToId ? { reply_to_id: msg.replyToId } : {},
-                ...msg.subtype ? { subtype: msg.subtype } : {}
-              }
+  const sub = subscribeEvents(async (ev) => {
+    if (ev.kind === "message") {
+      const d = ev.data;
+      const fromName = String(d.sender_name ?? "unknown");
+      const fromMember = String(d.sender_member_pubkey ?? d.sender_pubkey ?? "");
+      const body = String(d.body ?? "(decrypt failed)");
+      const priority = String(d.priority ?? "next");
+      const prioBadge = priority === "now" ? "[URGENT] " : priority === "low" ? "[low] " : "";
+      const topicTag = d.topic ? ` (#${d.topic})` : "";
+      const content = `${prioBadge}${fromName}${topicTag}: ${body}`;
+      try {
+        await server.notification({
+          method: "notifications/claude/channel",
+          params: {
+            content,
+            meta: {
+              from_id: fromMember,
+              from_pubkey: fromMember,
+              from_session_pubkey: String(d.sender_pubkey ?? ""),
+              from_name: fromName,
+              mesh_slug: String(d.mesh ?? ""),
+              priority,
+              message_id: String(d.broker_message_id ?? d.id ?? ""),
+              client_message_id: String(d.client_message_id ?? ""),
+              ...d.topic ? { topic: String(d.topic) } : {},
+              ...d.reply_to_id ? { reply_to_id: String(d.reply_to_id) } : {},
+              ...d.subtype ? { subtype: String(d.subtype) } : {}
             }
-          });
-          process.stderr.write(`[claudemesh] pushed: from=${fromName} content=${body.slice(0, 60)}
-`);
-        } catch (pushErr) {
-          process.stderr.write(`[claudemesh] push FAILED: ${pushErr}
+          }
+        });
+      } catch (err) {
+        process.stderr.write(`[claudemesh-mcp] channel emit failed: ${err}
 `);
-        }
-      });
-      client.onStreamData(async (evt) => {
-        try {
-          await server.notification({
-            method: "notifications/claude/channel",
-            params: {
-              content: `[stream:${evt.stream}] from ${evt.publishedBy}: ${JSON.stringify(evt.data)}`,
-              meta: {
-                kind: "stream_data",
-                stream: evt.stream,
-                published_by: evt.publishedBy
-              }
-            }
-          });
-        } catch {}
-      });
-      client.onStateChange(async (change) => {
-        try {
-          await server.notification({
-            method: "notifications/claude/channel",
-            params: {
-              content: `[state] ${change.key} = ${JSON.stringify(change.value)} (set by ${change.updatedBy})`,
-              meta: {
-                kind: "state_change",
-                key: change.key,
-                updated_by: change.updatedBy
-              }
-            }
-          });
-        } catch {}
-      });
-    }
-    setTimeout(async () => {
-      const welcomeClient = allClients()[0];
-      if (!welcomeClient || welcomeClient.status !== "open")
-        return;
+      }
+    } else if (ev.kind === "peer_join" || ev.kind === "peer_leave" || ev.kind === "system") {
+      const d = ev.data;
+      const eventName = String(d.event ?? ev.kind);
+      let content;
+      if (ev.kind === "peer_join") {
+        content = `[system] Peer "${String(d.name ?? "unknown")}" joined the mesh`;
+      } else if (ev.kind === "peer_leave") {
+        content = `[system] Peer "${String(d.name ?? "unknown")}" left the mesh`;
+      } else {
+        content = `[system] ${eventName}: ${JSON.stringify(d).slice(0, 240)}`;
+      }
       try {
-        const peers = await welcomeClient.listPeers();
-        const peerNames = peers.filter((p) => p.displayName !== myName).map((p) => p.displayName).join(", ") || "none";
         await server.notification({
           method: "notifications/claude/channel",
           params: {
-            content: `[system] Connected as ${myName} to mesh ${welcomeClient.meshSlug}. ${peers.length} peer(s) online: ${peerNames}. Call mesh_info for full details or set_summary to announce yourself.`,
-            meta: { kind: "welcome", mesh_slug: welcomeClient.meshSlug }
+            content,
+            meta: {
+              kind: "system",
+              event: eventName,
+              mesh_slug: String(d.mesh ?? "")
+            }
           }
         });
       } catch {}
-    }, 2000);
-  }
+    }
+  });
+  const transport = new StdioServerTransport;
+  await server.connect(transport);
   const keepalive = setInterval(() => {}, 1000);
   const shutdown = () => {
     clearInterval(keepalive);
-    for (const b of bridges) {
-      try {
-        b.stop();
-      } catch {}
-    }
-    stopAll();
+    sub.close();
     process.exit(0);
   };
   process.on("SIGTERM", shutdown);
@@ -16593,9 +16474,8 @@ async function startServiceProxy(serviceName) {
     tools = fetched;
   } catch {
     const cached2 = client.serviceCatalog.find((s) => s.name === serviceName);
-    if (cached2) {
+    if (cached2)
       tools = cached2.tools;
-    }
   }
   if (tools.length === 0) {
     process.stderr.write(`[mesh:${serviceName}] no tools found — service may not be running
@@ -16620,12 +16500,7 @@ async function startServiceProxy(serviceName) {
       }
       if (client.status !== "open") {
         return {
-          content: [
-            {
-              type: "text",
-              text: `Service temporarily unavailable — broker reconnecting. Retry in a few seconds.`
-            }
-          ],
+          content: [{ type: "text", text: "Service temporarily unavailable — broker reconnecting. Retry in a few seconds." }],
           isError: true
         };
       }
@@ -16633,23 +16508,13 @@ async function startServiceProxy(serviceName) {
     try {
       const result = await client.mcpCall(serviceName, toolName, args);
       if (result.error) {
-        return {
-          content: [{ type: "text", text: `Error: ${result.error}` }],
-          isError: true
-        };
+        return { content: [{ type: "text", text: `Error: ${result.error}` }], isError: true };
       }
       const resultText = typeof result.result === "string" ? result.result : JSON.stringify(result.result, null, 2);
-      return {
-        content: [{ type: "text", text: resultText }]
-      };
+      return { content: [{ type: "text", text: resultText }] };
     } catch (e) {
       return {
-        content: [
-          {
-            type: "text",
-            text: `Call failed: ${e instanceof Error ? e.message : String(e)}`
-          }
-        ],
+        content: [{ type: "text", text: `Call failed: ${e instanceof Error ? e.message : String(e)}` }],
         isError: true
       };
     }
@@ -16665,9 +16530,7 @@ async function startServiceProxy(serviceName) {
       const newTools = push.eventData?.tools;
       if (Array.isArray(newTools)) {
         tools = newTools;
-        server.notification({
-          method: "notifications/tools/list_changed"
-        }).catch(() => {});
+        server.notification({ method: "notifications/tools/list_changed" }).catch(() => {});
       }
     }
   });
@@ -16682,13 +16545,12 @@ async function startServiceProxy(serviceName) {
   process.on("SIGTERM", shutdown);
   process.on("SIGINT", shutdown);
 }
-var peerNameCache, peerNameCacheAge = 0, CACHE_TTL_MS = 30000;
-var init_server3 = __esm(() => {
-  init_definitions();
+var DAEMON_BOOT_RETRIES = 4, DAEMON_BOOT_RETRY_MS = 500;
+var init_server2 = __esm(() => {
+  init_paths2();
+  init_urls();
   init_facade();
   init_facade8();
-  init_server2();
-  peerNameCache = new Map;
 });
 
 // src/commands/mcp.ts
@@ -16703,7 +16565,7 @@ async function runMcp() {
   process.exit(0);
 }
 var init_mcp = __esm(() => {
-  init_server3();
+  init_server2();
 });
 
 // src/commands/hook.ts
@@ -17484,9 +17346,9 @@ Platform
   claudemesh stream create|publish|list                pub/sub event bus
   claudemesh sql query|execute|schema                  per-mesh SQL
   claudemesh skill list|get|remove                     mesh-published skills
-  claudemesh vault list|delete                         encrypted secrets
-  claudemesh watch list|remove                         URL change watchers
-  claudemesh webhook list|delete                       outbound HTTP triggers
+  claudemesh vault set|list|delete                     encrypted secrets (set: --type env|file --mount /p)
+  claudemesh watch add|list|remove                     URL change watchers (add: --label --interval --extract)
+  claudemesh webhook create|list|delete                outbound HTTP triggers
   claudemesh file share <path> [--to peer]             upload (or local-host fast path if --to matches)
   claudemesh file get <id> [--out path]                download by id
   claudemesh file list|status|delete                   shared mesh files
@@ -18150,8 +18012,16 @@ async function main() {
       } else if (sub === "delete") {
         const { runVaultDelete: runVaultDelete2 } = await Promise.resolve().then(() => (init_platform_actions(), exports_platform_actions));
         process.exit(await runVaultDelete2(positionals[1] ?? "", f));
+      } else if (sub === "set") {
+        const { runVaultSet: runVaultSet2 } = await Promise.resolve().then(() => (init_platform_actions(), exports_platform_actions));
+        process.exit(await runVaultSet2(positionals[1] ?? "", positionals[2] ?? "", {
+          ...f,
+          entryType: flags.type,
+          mountPath: flags.mount,
+          description: flags.description
+        }));
       } else {
-        console.error("Usage: claudemesh vault <list|delete>  (set/get currently via MCP — needs crypto)");
+        console.error("Usage: claudemesh vault <list|set|delete>");
         process.exit(EXIT.INVALID_ARGS);
       }
       break;
@@ -18165,8 +18035,18 @@ async function main() {
       } else if (sub === "remove") {
         const { runUnwatch: runUnwatch2 } = await Promise.resolve().then(() => (init_platform_actions(), exports_platform_actions));
         process.exit(await runUnwatch2(positionals[1] ?? "", f));
+      } else if (sub === "add") {
+        const { runWatchAdd: runWatchAdd2 } = await Promise.resolve().then(() => (init_platform_actions(), exports_platform_actions));
+        process.exit(await runWatchAdd2(positionals[1] ?? "", {
+          ...f,
+          label: flags.label,
+          interval: flags.interval ? Number(flags.interval) : undefined,
+          mode: flags.mode,
+          extract: flags.extract,
+          notifyOn: flags["notify-on"]
+        }));
       } else {
-        console.error("Usage: claudemesh watch <list|remove>");
+        console.error("Usage: claudemesh watch <list|add|remove>");
         process.exit(EXIT.INVALID_ARGS);
       }
       break;
@@ -18180,8 +18060,11 @@ async function main() {
       } else if (sub === "delete") {
         const { runWebhookDelete: runWebhookDelete2 } = await Promise.resolve().then(() => (init_platform_actions(), exports_platform_actions));
         process.exit(await runWebhookDelete2(positionals[1] ?? "", f));
+      } else if (sub === "create") {
+        const { runWebhookCreate: runWebhookCreate2 } = await Promise.resolve().then(() => (init_platform_actions(), exports_platform_actions));
+        process.exit(await runWebhookCreate2(positionals[1] ?? "", f));
       } else {
-        console.error("Usage: claudemesh webhook <list|delete>");
+        console.error("Usage: claudemesh webhook <list|create|delete>");
         process.exit(EXIT.INVALID_ARGS);
       }
       break;
@@ -18493,4 +18376,4 @@ main().catch((err) => {
   process.exit(EXIT.INTERNAL_ERROR);
 });
 
-//# debugId=7D9AD4B3EA7DF68364756E2164756E21
+//# debugId=BAEC2C4FE7977E7264756E2164756E21