claudemesh-cli 1.22.1 → 1.24.0

package/dist/entrypoints/mcp.js

@@ -3,6 +3,7 @@ var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __toESM = (mod, isNodeMode, target) => {
   target = mod != null ? __create(__getProtoOf(mod)) : {};
@@ -15,6 +16,20 @@ var __toESM = (mod, isNodeMode, target) => {
       });
   return to;
 };
+var __moduleCache = /* @__PURE__ */ new WeakMap;
+var __toCommonJS = (from) => {
+  var entry = __moduleCache.get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function")
+    __getOwnPropNames(from).map((key) => !__hasOwnProp.call(entry, key) && __defProp(entry, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    }));
+  __moduleCache.set(from, entry);
+  return entry;
+};
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __export = (target, all) => {
   for (var name in all)
@@ -28,12 +43,6 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// src/mcp/tools/definitions.ts
-var TOOLS;
-var init_definitions = __esm(() => {
-  TOOLS = [];
-});
-
 // src/constants/paths.ts
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -59,6 +68,64 @@ var init_paths = __esm(() => {
   };
 });
 
+// src/daemon/paths.ts
+var exports_paths = {};
+__export(exports_paths, {
+  DAEMON_TCP_HOST: () => DAEMON_TCP_HOST,
+  DAEMON_TCP_DEFAULT_PORT: () => DAEMON_TCP_DEFAULT_PORT,
+  DAEMON_PATHS: () => DAEMON_PATHS
+});
+import { join as join2 } from "node:path";
+var DAEMON_PATHS, DAEMON_TCP_HOST = "127.0.0.1", DAEMON_TCP_DEFAULT_PORT = 47823;
+var init_paths2 = __esm(() => {
+  init_paths();
+  DAEMON_PATHS = {
+    get DAEMON_DIR() {
+      return join2(PATHS.CONFIG_DIR, "daemon");
+    },
+    get PID_FILE() {
+      return join2(this.DAEMON_DIR, "daemon.pid");
+    },
+    get SOCK_FILE() {
+      return join2(this.DAEMON_DIR, "daemon.sock");
+    },
+    get TOKEN_FILE() {
+      return join2(this.DAEMON_DIR, "local-token");
+    },
+    get OUTBOX_DB() {
+      return join2(this.DAEMON_DIR, "outbox.db");
+    },
+    get INBOX_DB() {
+      return join2(this.DAEMON_DIR, "inbox.db");
+    },
+    get LOG_FILE() {
+      return join2(this.DAEMON_DIR, "daemon.log");
+    }
+  };
+});
+
+// src/constants/urls.ts
+var exports_urls = {};
+__export(exports_urls, {
+  env: () => env,
+  VERSION: () => VERSION,
+  URLS: () => URLS
+});
+var URLS, VERSION = "1.24.0", env;
+var init_urls = __esm(() => {
+  URLS = {
+    BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
+    API_BASE: process.env.CLAUDEMESH_API_URL ?? "https://claudemesh.com",
+    DASHBOARD: "https://claudemesh.com/dashboard",
+    NPM_REGISTRY: "https://registry.npmjs.org/claudemesh-cli"
+  };
+  env = {
+    CLAUDEMESH_BROKER_URL: URLS.BROKER,
+    CLAUDEMESH_CONFIG_DIR: process.env.CLAUDEMESH_CONFIG_DIR || undefined,
+    CLAUDEMESH_DEBUG: process.env.CLAUDEMESH_DEBUG === "1" || process.env.CLAUDEMESH_DEBUG === "true"
+  };
+});
+
 // src/services/config/schemas.ts
 function emptyConfig() {
   return { version: 1, meshes: [] };
@@ -195,6 +262,13 @@ var ready = false;
 var init_keypair = () => {};
 
 // src/services/crypto/file-crypto.ts
+var exports_file_crypto = {};
+__export(exports_file_crypto, {
+  sealKeyForPeer: () => sealKeyForPeer,
+  openSealedKey: () => openSealedKey,
+  encryptFile: () => encryptFile,
+  decryptFile: () => decryptFile
+});
 async function encryptFile(plaintext) {
   const s = await ensureSodium();
   const key = s.randombytes_buf(s.crypto_secretbox_KEYBYTES);
@@ -341,17 +415,17 @@ import { randomBytes as randomBytes2 } from "node:crypto";
 function detectClaudeSessionId() {
   try {
     const { readdirSync, statSync, readFileSync: readFileSync2 } = __require("node:fs");
-    const { join: join2 } = __require("node:path");
+    const { join: join3 } = __require("node:path");
     const { homedir: homedir2 } = __require("node:os");
     const cwd = process.cwd();
-    const projectsDir = join2(homedir2(), ".claude", "projects");
+    const projectsDir = join3(homedir2(), ".claude", "projects");
     const cwdHash = cwd.replace(/\//g, "-");
     const entries = readdirSync(projectsDir);
     const projectDir = entries.find((e) => e === cwdHash || e.startsWith(cwdHash));
     if (!projectDir)
       return null;
-    const fullDir = join2(projectsDir, projectDir);
-    const jsonls = readdirSync(fullDir).filter((f) => f.endsWith(".jsonl")).map((f) => ({ name: f, mtime: statSync(join2(fullDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+    const fullDir = join3(projectsDir, projectDir);
+    const jsonls = readdirSync(fullDir).filter((f) => f.endsWith(".jsonl")).map((f) => ({ name: f, mtime: statSync(join3(fullDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
     if (jsonls.length === 0)
       return null;
     const latest = jsonls[0];
@@ -561,9 +635,9 @@ class BrokerClient {
     let nonce;
     let ciphertext;
     if (isDirectTarget(targetSpec)) {
-      const env = await encryptDirect(message, targetSpec, this.sessionSecretKey ?? this.mesh.secretKey);
-      nonce = env.nonce;
-      ciphertext = env.ciphertext;
+      const env2 = await encryptDirect(message, targetSpec, this.sessionSecretKey ?? this.mesh.secretKey);
+      nonce = env2.nonce;
+      ciphertext = env2.ciphertext;
     } else {
       nonce = randomNonce();
       ciphertext = Buffer.from(message, "utf-8").toString("base64");
@@ -1689,7 +1763,7 @@ class BrokerClient {
   }
   static MAX_FILE_SIZE = 1048576;
   async handlePeerFileRequest(msg) {
-    const { resolve, join: join2, normalize } = await import("node:path");
+    const { resolve, join: join3, normalize } = await import("node:path");
     const { readFileSync: readFileSync2, statSync, realpathSync } = await import("node:fs");
     const reqId = msg._reqId;
     const sendResponse = (content, error) => {
@@ -1714,7 +1788,7 @@ class BrokerClient {
     }
     let resolvedPath = null;
     for (const dir of this.sharedDirs) {
-      const candidate = resolve(join2(dir, msg.filePath));
+      const candidate = resolve(join3(dir, msg.filePath));
       let realCandidate;
       let realDir;
       try {
@@ -1754,7 +1828,7 @@ class BrokerClient {
     }
   }
   async handlePeerDirRequest(msg) {
-    const { resolve, join: join2, normalize, relative } = await import("node:path");
+    const { resolve, join: join3, normalize, relative } = await import("node:path");
     const { readdirSync, statSync, realpathSync } = await import("node:fs");
     const reqId = msg._reqId;
     const sendResponse = (entries, error) => {
@@ -1780,7 +1854,7 @@ class BrokerClient {
     }
     let resolvedPath = null;
     for (const dir of this.sharedDirs) {
-      const candidate = resolve(join2(dir, dirPath));
+      const candidate = resolve(join3(dir, dirPath));
       let realCandidate;
       let realDir;
       try {
@@ -1826,16 +1900,16 @@ class BrokerClient {
               break;
             if (item.name.startsWith("."))
               continue;
-            const relPath = relative(resolvedPath, join2(dir, item.name));
+            const relPath = relative(resolvedPath, join3(dir, item.name));
             const label = item.isDirectory() ? relPath + "/" : relPath;
             if (pattern && !pattern.test(item.name)) {
               if (item.isDirectory())
-                walk(join2(dir, item.name), depth + 1);
+                walk(join3(dir, item.name), depth + 1);
               continue;
             }
             entries.push(label);
             if (item.isDirectory())
-              walk(join2(dir, item.name), depth + 1);
+              walk(join3(dir, item.name), depth + 1);
           }
         } catch {}
       };
@@ -2534,44 +2608,10 @@ var init_ws_client = __esm(() => {
 });
 
 // src/services/broker/manager.ts
-async function ensureClient(mesh) {
-  const existing = clients.get(mesh.meshId);
-  if (existing)
-    return existing;
-  const isDebug = process.env.CLAUDEMESH_DEBUG === "1" || process.env.CLAUDEMESH_DEBUG === "true";
-  const client = new BrokerClient(mesh, { debug: isDebug, displayName: configDisplayName });
-  clients.set(mesh.meshId, client);
-  try {
-    await client.connect();
-    for (const g of configGroups ?? []) {
-      try {
-        await client.joinGroup(g.name, g.role);
-      } catch {}
-    }
-  } catch (err) {
-    process.stderr.write(`[claudemesh] broker connect failed for ${mesh.slug}: ${err instanceof Error ? err.message : err} (will retry)
-`);
-  }
-  return client;
-}
-async function startClients(config) {
-  configDisplayName = config.displayName;
-  configGroups = config.groups ?? [];
-  await Promise.allSettled(config.meshes.map(ensureClient));
-}
-function allClients() {
-  return [...clients.values()];
-}
-function stopAll() {
-  for (const c of clients.values())
-    c.close();
-  clients.clear();
-}
-var clients, configDisplayName, configGroups;
+var clients;
 var init_manager = __esm(() => {
   init_ws_client();
   clients = new Map;
-  configGroups = [];
 });
 
 // src/services/broker/envelope.ts
@@ -2591,1924 +2631,393 @@ var init_facade3 = __esm(() => {
   init_errors();
 });
 
-// src/services/bridge/protocol.ts
-import { homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
-function socketPath(meshSlug) {
-  return join2(homedir2(), ".claudemesh", "sockets", `${meshSlug}.sock`);
+// src/mcp/server.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  ListToolsRequestSchema,
+  CallToolRequestSchema,
+  ListPromptsRequestSchema,
+  GetPromptRequestSchema,
+  ListResourcesRequestSchema,
+  ReadResourceRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+import { existsSync as existsSync2 } from "node:fs";
+import { request as httpRequest } from "node:http";
+async function daemonReady() {
+  for (let i = 0;i < DAEMON_BOOT_RETRIES; i++) {
+    if (existsSync2(DAEMON_PATHS.SOCK_FILE))
+      return true;
+    await new Promise((r) => setTimeout(r, DAEMON_BOOT_RETRY_MS));
+  }
+  return false;
 }
-function socketDir() {
-  return join2(homedir2(), ".claudemesh", "sockets");
+function bailNoDaemon() {
+  process.stderr.write(`[claudemesh] daemon is not running.
+` + `  Start it:               claudemesh daemon up --mesh <slug>
+` + `  Or install as service:  claudemesh daemon install-service --mesh <slug>
+` + `  Diagnose:               claudemesh doctor
+` + `
+` + `  As of 1.24.0 the daemon is required for in-Claude-Code use of
+` + `  claudemesh. The CLI itself (claudemesh send/peer/inbox/...) still
+` + `  works without a daemon.
+`);
+  process.exit(1);
 }
-function frame(obj) {
-  return JSON.stringify(obj) + `
-`;
+function daemonGet(path) {
+  return new Promise((resolve, reject) => {
+    const req = httpRequest({ socketPath: DAEMON_PATHS.SOCK_FILE, path, method: "GET", timeout: 5000 }, (res) => {
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("end", () => {
+        const text = Buffer.concat(chunks).toString("utf8");
+        let body = null;
+        try {
+          body = JSON.parse(text);
+        } catch {
+          body = text;
+        }
+        resolve({ status: res.statusCode ?? 0, body });
+      });
+    });
+    req.on("error", reject);
+    req.on("timeout", () => req.destroy(new Error("daemon_ipc_timeout")));
+    req.end();
+  });
 }
-
-class LineParser {
-  buf = "";
-  feed(chunk) {
-    this.buf += typeof chunk === "string" ? chunk : chunk.toString("utf-8");
-    const lines = [];
-    let nl = this.buf.indexOf(`
+function subscribeEvents(onEvent) {
+  let active = true;
+  let req = null;
+  const connect = () => {
+    if (!active)
+      return;
+    req = httpRequest({
+      socketPath: DAEMON_PATHS.SOCK_FILE,
+      path: "/v1/events",
+      method: "GET",
+      headers: { Accept: "text/event-stream" }
+    });
+    let buffer = "";
+    req.on("response", (res) => {
+      res.setEncoding("utf8");
+      res.on("data", (chunk) => {
+        buffer += chunk;
+        let idx;
+        while ((idx = buffer.indexOf(`
+
+`)) >= 0) {
+          const block = buffer.slice(0, idx);
+          buffer = buffer.slice(idx + 2);
+          if (!block.trim())
+            continue;
+          let kind = "message";
+          let dataLine = "";
+          for (const line of block.split(`
+`)) {
+            if (line.startsWith(":"))
+              continue;
+            if (line.startsWith("event:"))
+              kind = line.slice(6).trim();
+            else if (line.startsWith("data:"))
+              dataLine = line.slice(5).trim();
+          }
+          if (!dataLine)
+            continue;
+          try {
+            const parsed = JSON.parse(dataLine);
+            onEvent({ kind, ts: String(parsed.ts ?? ""), data: parsed });
+          } catch {}
+        }
+      });
+      res.on("end", () => {
+        if (active) {
+          process.stderr.write(`[claudemesh-mcp] sse stream ended; reconnecting in 1s
 `);
-    while (nl !== -1) {
-      lines.push(this.buf.slice(0, nl));
-      this.buf = this.buf.slice(nl + 1);
-      nl = this.buf.indexOf(`
+          setTimeout(connect, 1000);
+        }
+      });
+      res.on("error", (err) => process.stderr.write(`[claudemesh-mcp] sse error: ${err.message}
+`));
+    });
+    req.on("error", (err) => {
+      process.stderr.write(`[claudemesh-mcp] sse connect error: ${err.message}
 `);
+      if (active)
+        setTimeout(connect, 2000);
+    });
+    req.end();
+  };
+  connect();
+  return {
+    close: () => {
+      active = false;
+      try {
+        req?.destroy();
+      } catch {}
     }
-    return lines;
-  }
+  };
 }
-var init_protocol = () => {};
-
-// src/services/bridge/server.ts
-import { createServer } from "node:net";
-import { mkdirSync as mkdirSync2, unlinkSync, existsSync as existsSync2, chmodSync as chmodSync2 } from "node:fs";
-async function resolveTarget(client, to) {
-  if (to.startsWith("@") || to === "*" || /^[0-9a-f]{64}$/i.test(to)) {
-    return { ok: true, spec: to };
-  }
-  const peers = await client.listPeers();
-  const match = peers.find((p) => p.displayName.toLowerCase() === to.toLowerCase());
-  if (!match) {
-    return {
-      ok: false,
-      error: `peer "${to}" not found. online: ${peers.map((p) => p.displayName).join(", ") || "(none)"}`
-    };
+async function startMcpServer() {
+  const serviceIdx = process.argv.indexOf("--service");
+  if (serviceIdx !== -1 && process.argv[serviceIdx + 1]) {
+    return startServiceProxy(process.argv[serviceIdx + 1]);
   }
-  return { ok: true, spec: match.pubkey };
-}
-async function dispatch(client, req) {
-  const args = req.args ?? {};
-  try {
-    switch (req.verb) {
-      case "ping": {
-        const peers = await client.listPeers();
-        return {
-          id: req.id,
-          ok: true,
-          result: {
-            mesh: client.meshSlug,
-            ws_status: client.status,
-            peers_online: peers.length,
-            push_buffer: client.pushHistory.length
-          }
-        };
-      }
-      case "peers": {
-        const peers = await client.listPeers();
-        return { id: req.id, ok: true, result: peers };
-      }
-      case "send": {
-        const to = String(args.to ?? "");
-        const message = String(args.message ?? "");
-        const priority = args.priority ?? "next";
-        if (!to || !message) {
-          return { id: req.id, ok: false, error: "send: `to` and `message` required" };
-        }
-        const resolved = await resolveTarget(client, to);
-        if (!resolved.ok)
-          return { id: req.id, ok: false, error: resolved.error };
-        const result = await client.send(resolved.spec, message, priority);
-        if (!result.ok) {
-          return { id: req.id, ok: false, error: result.error ?? "send failed" };
-        }
-        return {
-          id: req.id,
-          ok: true,
-          result: { messageId: result.messageId, target: resolved.spec }
-        };
-      }
-      case "summary": {
-        const text = String(args.summary ?? "");
-        if (!text)
-          return { id: req.id, ok: false, error: "summary: `summary` required" };
-        await client.setSummary(text);
-        return { id: req.id, ok: true, result: { summary: text } };
-      }
-      case "status_set": {
-        const state = String(args.status ?? "");
-        if (!["idle", "working", "dnd"].includes(state)) {
-          return { id: req.id, ok: false, error: "status_set: must be idle | working | dnd" };
-        }
-        await client.setStatus(state);
-        return { id: req.id, ok: true, result: { status: state } };
+  const ok = await daemonReady();
+  if (!ok)
+    bailNoDaemon();
+  const server = new Server({ name: "claudemesh", version: VERSION }, { capabilities: { tools: {}, prompts: {}, resources: {} } });
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [] }));
+  server.setRequestHandler(ListPromptsRequestSchema, async () => {
+    try {
+      const { status, body } = await daemonGet("/v1/skills");
+      if (status !== 200)
+        return { prompts: [] };
+      const skills = body?.skills ?? [];
+      return { prompts: skills.map((s) => ({ name: s.name, description: s.description, arguments: [] })) };
+    } catch {
+      return { prompts: [] };
+    }
+  });
+  server.setRequestHandler(GetPromptRequestSchema, async (req) => {
+    const name = req.params.name;
+    const { status, body } = await daemonGet(`/v1/skills/${encodeURIComponent(name)}`);
+    if (status === 404)
+      throw new Error(`Skill "${name}" not found in the mesh`);
+    if (status !== 200)
+      throw new Error(`daemon returned ${status} fetching skill`);
+    const skill = body.skill;
+    let content = skill.instructions;
+    const m = skill.manifest;
+    if (m && typeof m === "object") {
+      const fm = ["---"];
+      if (m.description)
+        fm.push(`description: "${m.description}"`);
+      if (m.when_to_use)
+        fm.push(`when_to_use: "${m.when_to_use}"`);
+      if (Array.isArray(m.allowed_tools) && m.allowed_tools.length) {
+        fm.push(`allowed-tools:
+${m.allowed_tools.map((t) => `  - ${t}`).join(`
+`)}`);
       }
-      case "visible": {
-        const visible = Boolean(args.visible);
-        await client.setVisible(visible);
-        return { id: req.id, ok: true, result: { visible } };
+      if (m.model)
+        fm.push(`model: ${m.model}`);
+      if (m.context)
+        fm.push(`context: ${m.context}`);
+      if (m.agent)
+        fm.push(`agent: ${m.agent}`);
+      if (m.user_invocable === false)
+        fm.push(`user-invocable: false`);
+      if (m.argument_hint)
+        fm.push(`argument-hint: "${m.argument_hint}"`);
+      fm.push(`---
+`);
+      if (fm.length > 3)
+        content = fm.join(`
+`) + content;
+      if (m.context === "fork") {
+        const agentType = m.agent || "general-purpose";
+        const modelHint = m.model ? `, model: "${m.model}"` : "";
+        const toolsHint = m.allowed_tools?.length ? `
+Only use these tools: ${m.allowed_tools.join(", ")}.` : "";
+        content = `IMPORTANT: Execute this skill in an isolated sub-agent. Use the Agent tool with subagent_type="${agentType}"${modelHint}. Pass the full instructions below as the agent prompt.${toolsHint}
+
+` + content;
       }
-      default:
-        return { id: req.id, ok: false, error: `unknown verb: ${req.verb}` };
     }
-  } catch (err) {
     return {
-      id: req.id,
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
+      description: skill.description,
+      messages: [{ role: "user", content: { type: "text", text: content } }]
     };
-  }
-}
-function handleConnection(socket, client) {
-  const parser = new LineParser;
-  socket.on("data", (chunk) => {
-    const lines = parser.feed(chunk);
-    for (const line of lines) {
-      if (!line.trim())
-        continue;
-      let req;
-      try {
-        req = JSON.parse(line);
-      } catch {
-        continue;
-      }
-      if (!req || typeof req !== "object" || !req.id || !req.verb)
-        continue;
-      dispatch(client, req).then((res) => {
-        try {
-          socket.write(frame(res));
-        } catch {}
-      });
-    }
   });
-  socket.on("error", () => {});
-}
-function startBridgeServer(client) {
-  const path = socketPath(client.meshSlug);
-  const dir = socketDir();
-  if (!existsSync2(dir)) {
-    mkdirSync2(dir, { recursive: true, mode: 448 });
-  }
-  if (existsSync2(path)) {
+  server.setRequestHandler(ListResourcesRequestSchema, async () => {
     try {
-      unlinkSync(path);
-    } catch {}
-  }
-  const server = createServer((socket) => handleConnection(socket, client));
-  try {
-    server.listen(path);
-  } catch (err) {
-    process.stderr.write(`[claudemesh] bridge: failed to bind ${path}: ${String(err)}
-`);
-    return null;
-  }
-  server.on("error", (err) => {
-    process.stderr.write(`[claudemesh] bridge: ${String(err)}
+      const { body } = await daemonGet("/v1/skills");
+      const skills = body?.skills ?? [];
+      return {
+        resources: skills.map((s) => ({
+          uri: `skill://claudemesh/${encodeURIComponent(s.name)}`,
+          name: s.name,
+          description: s.description,
+          mimeType: "text/markdown"
+        }))
+      };
+    } catch {
+      return { resources: [] };
+    }
+  });
+  server.setRequestHandler(ReadResourceRequestSchema, async (req) => {
+    const uri = req.params.uri;
+    const m = uri.match(/^skill:\/\/claudemesh\/(.+)$/);
+    if (!m)
+      throw new Error(`Unknown resource URI: ${uri}`);
+    const name = decodeURIComponent(m[1]);
+    const { status, body } = await daemonGet(`/v1/skills/${encodeURIComponent(name)}`);
+    if (status === 404)
+      throw new Error(`Skill "${name}" not found`);
+    if (status !== 200)
+      throw new Error(`daemon returned ${status} fetching skill`);
+    const skill = body.skill;
+    const fm = ["---"];
+    fm.push(`name: ${skill.name}`);
+    fm.push(`description: "${skill.description}"`);
+    if (skill.tags?.length)
+      fm.push(`tags: [${skill.tags.join(", ")}]`);
+    const mf = skill.manifest;
+    if (mf && typeof mf === "object") {
+      if (mf.when_to_use)
+        fm.push(`when_to_use: "${mf.when_to_use}"`);
+      if (Array.isArray(mf.allowed_tools) && mf.allowed_tools.length) {
+        fm.push(`allowed-tools:
+${mf.allowed_tools.map((t) => `  - ${t}`).join(`
+`)}`);
+      }
+      if (mf.model)
+        fm.push(`model: ${mf.model}`);
+      if (mf.context)
+        fm.push(`context: ${mf.context}`);
+    }
+    fm.push(`---
 `);
+    return { contents: [{ uri, mimeType: "text/markdown", text: fm.join(`
+`) + skill.instructions }] };
   });
-  try {
-    chmodSync2(path, 384);
-  } catch {}
-  let stopped = false;
-  return {
-    path,
-    stop() {
-      if (stopped)
-        return;
-      stopped = true;
+  const sub = subscribeEvents(async (ev) => {
+    if (ev.kind === "message") {
+      const d = ev.data;
+      const fromName = String(d.sender_name ?? "unknown");
+      const fromMember = String(d.sender_member_pubkey ?? d.sender_pubkey ?? "");
+      const body = String(d.body ?? "(decrypt failed)");
+      const priority = String(d.priority ?? "next");
+      const prioBadge = priority === "now" ? "[URGENT] " : priority === "low" ? "[low] " : "";
+      const topicTag = d.topic ? ` (#${d.topic})` : "";
+      const content = `${prioBadge}${fromName}${topicTag}: ${body}`;
       try {
-        server.close();
-      } catch {}
+        await server.notification({
+          method: "notifications/claude/channel",
+          params: {
+            content,
+            meta: {
+              from_id: fromMember,
+              from_pubkey: fromMember,
+              from_session_pubkey: String(d.sender_pubkey ?? ""),
+              from_name: fromName,
+              mesh_slug: String(d.mesh ?? ""),
+              priority,
+              message_id: String(d.broker_message_id ?? d.id ?? ""),
+              client_message_id: String(d.client_message_id ?? ""),
+              ...d.topic ? { topic: String(d.topic) } : {},
+              ...d.reply_to_id ? { reply_to_id: String(d.reply_to_id) } : {},
+              ...d.subtype ? { subtype: String(d.subtype) } : {}
+            }
+          }
+        });
+      } catch (err) {
+        process.stderr.write(`[claudemesh-mcp] channel emit failed: ${err}
+`);
+      }
+    } else if (ev.kind === "peer_join" || ev.kind === "peer_leave" || ev.kind === "system") {
+      const d = ev.data;
+      const eventName = String(d.event ?? ev.kind);
+      let content;
+      if (ev.kind === "peer_join") {
+        content = `[system] Peer "${String(d.name ?? "unknown")}" joined the mesh`;
+      } else if (ev.kind === "peer_leave") {
+        content = `[system] Peer "${String(d.name ?? "unknown")}" left the mesh`;
+      } else {
+        content = `[system] ${eventName}: ${JSON.stringify(d).slice(0, 240)}`;
+      }
       try {
-        unlinkSync(path);
+        await server.notification({
+          method: "notifications/claude/channel",
+          params: {
+            content,
+            meta: {
+              kind: "system",
+              event: eventName,
+              mesh_slug: String(d.mesh ?? "")
+            }
+          }
+        });
       } catch {}
     }
-  };
-}
-var init_server = __esm(() => {
-  init_protocol();
-});
-
-// src/commands/connect.ts
-import { hostname } from "node:os";
-import { createInterface } from "node:readline";
-async function pickMesh(meshes) {
-  console.log(`
-  Select mesh:`);
-  meshes.forEach((m, i) => {
-    console.log(`    ${i + 1}) ${m.slug}`);
-  });
-  console.log("");
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve) => {
-    rl.question("  Choice [1]: ", (answer) => {
-      rl.close();
-      const idx = parseInt(answer || "1", 10) - 1;
-      if (idx >= 0 && idx < meshes.length) {
-        resolve(meshes[idx]);
-      } else {
-        console.error("  Invalid choice, using first mesh.");
-        resolve(meshes[0]);
-      }
-    });
   });
+  const transport = new StdioServerTransport;
+  await server.connect(transport);
+  const keepalive = setInterval(() => {}, 1000);
+  const shutdown = () => {
+    clearInterval(keepalive);
+    sub.close();
+    process.exit(0);
+  };
+  process.on("SIGTERM", shutdown);
+  process.on("SIGINT", shutdown);
 }
-async function withMesh(opts, fn) {
+async function startServiceProxy(serviceName) {
   const config = readConfig();
   if (config.meshes.length === 0) {
-    console.error("No meshes joined. Run `claudemesh join <url>` first.");
+    process.stderr.write(`[mesh:${serviceName}] no meshes joined
+`);
     process.exit(1);
   }
-  let mesh;
-  if (opts.meshSlug) {
-    const found = config.meshes.find((m) => m.slug === opts.meshSlug);
-    if (!found) {
-      console.error(`Mesh "${opts.meshSlug}" not found. Joined: ${config.meshes.map((m) => m.slug).join(", ")}`);
-      process.exit(1);
-    }
-    mesh = found;
-  } else if (config.meshes.length === 1) {
-    mesh = config.meshes[0];
-  } else {
-    mesh = await pickMesh(config.meshes);
-  }
-  const displayName = opts.displayName ?? config.displayName ?? `${hostname()}-${process.pid}`;
-  const client = new BrokerClient(mesh, { displayName, quiet: true });
+  const mesh = config.meshes[0];
+  const client = new BrokerClient(mesh, {
+    displayName: config.displayName ?? `proxy:${serviceName}`
+  });
   try {
     await client.connect();
-    const result = await fn(client, mesh);
-    return result;
   } catch (e) {
-    if (client.terminalClose) {
-      const { code, reason } = client.terminalClose;
-      if (code === 4002) {
-        console.error(`
-  ✘ ${reason}
-`);
-      } else if (code === 4001) {
-        console.error(`
-  ✘ Kicked from this mesh. Run \`claudemesh\` to rejoin.
+    process.stderr.write(`[mesh:${serviceName}] broker connect failed: ${e instanceof Error ? e.message : String(e)}
 `);
-      } else {
-        console.error(`
-  ✘ Broker closed connection: ${reason}
+    process.exit(1);
+  }
+  await new Promise((r) => setTimeout(r, 1500));
+  let tools = [];
+  try {
+    const fetched = await client.getServiceTools(serviceName);
+    tools = fetched;
+  } catch {
+    const cached = client.serviceCatalog.find((s) => s.name === serviceName);
+    if (cached)
+      tools = cached.tools;
+  }
+  if (tools.length === 0) {
+    process.stderr.write(`[mesh:${serviceName}] no tools found — service may not be running
 `);
-      }
-      process.exit(1);
-    }
-    throw e;
-  } finally {
-    client.close();
-  }
-}
-var init_connect = __esm(() => {
-  init_facade3();
-  init_facade();
-});
-
-// src/ui/styles.ts
-function moveTo(row, col) {
-  return isTTY ? `\x1B[${row};${col}H` : "";
-}
-function visibleLength(s) {
-  return s.replace(/\x1b\[[^m]*m/g, "").length;
-}
-var isTTY, esc = (code) => (s) => isTTY ? `${code}${s}\x1B[0m` : s, orange, clay, amber, bold, dim, green, yellow, red, cyan, boldOrange, HIDE_CURSOR, SHOW_CURSOR, CLEAR_SCREEN, CLEAR_LINE, icons;
-var init_styles = __esm(() => {
-  isTTY = process.stdout.isTTY && !process.env.NO_COLOR && process.env.TERM !== "dumb";
-  orange = esc("\x1B[38;5;208m");
-  clay = esc("\x1B[38;5;173m");
-  amber = esc("\x1B[38;5;214m");
-  bold = esc("\x1B[1m");
-  dim = esc("\x1B[2m");
-  green = esc("\x1B[32m");
-  yellow = esc("\x1B[33m");
-  red = esc("\x1B[31m");
-  cyan = esc("\x1B[36m");
-  boldOrange = esc("\x1B[1m\x1B[38;5;208m");
-  HIDE_CURSOR = isTTY ? "\x1B[?25l" : "";
-  SHOW_CURSOR = isTTY ? "\x1B[?25h" : "";
-  CLEAR_SCREEN = isTTY ? "\x1B[2J\x1B[H" : "";
-  CLEAR_LINE = isTTY ? "\x1B[K" : "";
-  icons = {
-    check: "✔",
-    cross: "✘",
-    warn: "⚠",
-    arrow: "→",
-    bullet: "●",
-    dash: "—",
-    ellipsis: "…"
-  };
-});
-
-// src/ui/render.ts
-var OUT, ERR, INDENT = "  ", render;
-var init_render = __esm(() => {
-  init_styles();
-  OUT = process.stdout;
-  ERR = process.stderr;
-  render = {
-    blank() {
-      OUT.write(`
-`);
-    },
-    ok(msg, detail) {
-      const d = detail ? ` ${dim("(" + detail + ")")}` : "";
-      OUT.write(`${INDENT}${green(icons.check)} ${msg}${d}
-`);
-    },
-    warn(msg, hint) {
-      OUT.write(`${INDENT}${yellow(icons.warn)} ${msg}
-`);
-      if (hint)
-        OUT.write(`${INDENT}  ${dim(hint)}
-`);
-    },
-    err(msg, hint) {
-      ERR.write(`${INDENT}${red(icons.cross)} ${msg}
-`);
-      if (hint)
-        ERR.write(`${INDENT}  ${dim(hint)}
-`);
-    },
-    info(msg) {
-      OUT.write(`${INDENT}${msg}
-`);
-    },
-    section(title) {
-      OUT.write(`
-${INDENT}${dim("—")} ${clay(title)}
-
-`);
-    },
-    heading(title) {
-      OUT.write(`${INDENT}${bold(title)}
-`);
-    },
-    kv(pairs, opts) {
-      const pad = opts?.padTo ?? Math.max(...pairs.map(([k]) => k.length)) + 2;
-      for (const [k, v] of pairs) {
-        OUT.write(`${INDENT}${dim(k.padEnd(pad, " "))}${v}
-`);
-      }
-    },
-    code(snippet) {
-      for (const line of snippet.split(`
-`)) {
-        OUT.write(`${INDENT}  ${cyan(line)}
-`);
-      }
-    },
-    link(url) {
-      OUT.write(`${INDENT}${clay(url)}
-`);
-    },
-    hint(msg) {
-      OUT.write(`${INDENT}${dim(icons.arrow + " " + msg)}
-`);
-    }
-  };
-});
-
-// src/constants/exit-codes.ts
-var EXIT;
-var init_exit_codes = __esm(() => {
-  EXIT = {
-    SUCCESS: 0,
-    USER_CANCELLED: 1,
-    AUTH_FAILED: 2,
-    INVALID_ARGS: 3,
-    NETWORK_ERROR: 4,
-    NOT_FOUND: 5,
-    ALREADY_EXISTS: 6,
-    PERMISSION_DENIED: 7,
-    INTERNAL_ERROR: 8,
-    CLAUDE_MISSING: 9
-  };
-});
-
-// src/constants/timings.ts
-var TIMINGS;
-var init_timings = __esm(() => {
-  TIMINGS = {
-    DEVICE_CODE_POLL_MS: 1500,
-    DEVICE_CODE_TIMEOUT_MS: 5 * 60 * 1000,
-    WS_RECONNECT_BASE_MS: 1000,
-    WS_RECONNECT_MAX_MS: 30000,
-    UPDATE_CHECK_INTERVAL_MS: 24 * 60 * 60 * 1000,
-    TELEGRAM_CONNECT_TIMEOUT_MS: 5 * 60 * 1000,
-    TELEGRAM_POLL_INTERVAL_MS: 2000,
-    API_TIMEOUT_MS: 15000,
-    API_RETRY_COUNT: 2
-  };
-});
-
-// src/constants/urls.ts
-var exports_urls = {};
-__export(exports_urls, {
-  env: () => env,
-  VERSION: () => VERSION,
-  URLS: () => URLS
-});
-var URLS, VERSION = "1.22.1", env;
-var init_urls = __esm(() => {
-  URLS = {
-    BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
-    API_BASE: process.env.CLAUDEMESH_API_URL ?? "https://claudemesh.com",
-    DASHBOARD: "https://claudemesh.com/dashboard",
-    NPM_REGISTRY: "https://registry.npmjs.org/claudemesh-cli"
-  };
-  env = {
-    CLAUDEMESH_BROKER_URL: URLS.BROKER,
-    CLAUDEMESH_CONFIG_DIR: process.env.CLAUDEMESH_CONFIG_DIR || undefined,
-    CLAUDEMESH_DEBUG: process.env.CLAUDEMESH_DEBUG === "1" || process.env.CLAUDEMESH_DEBUG === "true"
-  };
-});
-
-// src/services/logger/logger.ts
-function timestamp() {
-  return new Date().toISOString();
-}
-function log(msg, ...args) {
-  if (!isQuiet)
-    console.log(msg, ...args);
-}
-function debug(msg, ...args) {
-  if (isDebug)
-    console.error(`[${timestamp()}] DEBUG ${msg}`, ...args);
-}
-function warn(msg, ...args) {
-  console.error(`⚠ ${msg}`, ...args);
-}
-var isDebug, isQuiet;
-var init_logger = __esm(() => {
-  isDebug = process.env.CLAUDEMESH_DEBUG === "1" || process.env.CLAUDEMESH_DEBUG === "true";
-  isQuiet = process.argv.includes("-q") || process.argv.includes("--quiet");
-});
-
-// src/services/logger/facade.ts
-var init_facade4 = __esm(() => {
-  init_logger();
-});
-
-// src/services/api/errors.ts
-var ApiError, NetworkError;
-var init_errors2 = __esm(() => {
-  ApiError = class ApiError extends Error {
-    status;
-    statusText;
-    body;
-    constructor(status, statusText, body) {
-      super(`API error ${status}: ${statusText}`);
-      this.status = status;
-      this.statusText = statusText;
-      this.body = body;
-      this.name = "ApiError";
-    }
-    get isUnauthorized() {
-      return this.status === 401;
-    }
-    get isNotFound() {
-      return this.status === 404;
-    }
-    get isConflict() {
-      return this.status === 409;
-    }
-    get isRateLimited() {
-      return this.status === 429;
-    }
-  };
-  NetworkError = class NetworkError extends Error {
-    url;
-    constructor(url, cause) {
-      super(`Network error reaching ${url}`);
-      this.url = url;
-      this.name = "NetworkError";
-      this.cause = cause;
-    }
-  };
-});
-
-// src/services/api/client.ts
-async function request(opts) {
-  const base = opts.baseUrl ?? URLS.API_BASE;
-  const url = `${base}${opts.path}`;
-  const method = opts.method ?? "GET";
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), opts.timeoutMs ?? TIMINGS.API_TIMEOUT_MS);
-  const headers = {
-    "Content-Type": "application/json",
-    Accept: "application/json",
-    "User-Agent": "claudemesh-cli/1.0"
-  };
-  if (opts.token)
-    headers.Authorization = `Bearer ${opts.token}`;
-  debug(`${method} ${url}`);
-  try {
-    const res = await fetch(url, {
-      method,
-      headers,
-      body: opts.body ? JSON.stringify(opts.body) : undefined,
-      signal: controller.signal
-    });
-    if (!res.ok) {
-      const text2 = await res.text();
-      let body = text2;
-      try {
-        body = JSON.parse(text2);
-      } catch {}
-      throw new ApiError(res.status, res.statusText, body);
-    }
-    const text = await res.text();
-    if (!text)
-      return;
-    return JSON.parse(text);
-  } catch (err) {
-    if (err instanceof ApiError)
-      throw err;
-    throw new NetworkError(url, err);
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-async function get(path, token) {
-  return request({ path, token });
-}
-async function post(path, body, token) {
-  return request({ path, method: "POST", body, token });
-}
-var init_client = __esm(() => {
-  init_urls();
-  init_timings();
-  init_facade4();
-  init_errors2();
-});
-
-// src/services/api/my.ts
-var exports_my = {};
-__export(exports_my, {
-  revokeSession: () => revokeSession,
-  renameMesh: () => renameMesh,
-  getProfile: () => getProfile,
-  getMeshes: () => getMeshes,
-  createMesh: () => createMesh,
-  createInvite: () => createInvite,
-  cliSync: () => cliSync
-});
-async function getProfile(token) {
-  return get("/api/my/profile", token);
-}
-async function getMeshes(token) {
-  return get("/api/my/meshes", token);
-}
-async function createMesh(token, body) {
-  return post("/api/my/meshes", body, token);
-}
-async function renameMesh(token, oldSlug, newSlug) {
-  return request({
-    path: `/api/cli/meshes/${oldSlug}`,
-    method: "PATCH",
-    body: { slug: newSlug },
-    token
-  });
-}
-async function createInvite(token, meshSlug, body) {
-  return post(`/api/my/meshes/${meshSlug}/invites`, body, token);
-}
-async function revokeSession(token) {
-  const BROKER_HTTP = (await Promise.resolve().then(() => (init_urls(), exports_urls))).URLS.BROKER.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
-  return request({
-    path: "/cli/session/revoke",
-    method: "POST",
-    body: { token },
-    baseUrl: BROKER_HTTP
-  });
-}
-async function cliSync(token) {
-  return post("/cli-sync", undefined, token);
-}
-var init_my = __esm(() => {
-  init_client();
-});
-
-// src/services/api/public.ts
-var exports_public = {};
-__export(exports_public, {
-  requestDeviceCode: () => requestDeviceCode,
-  pollDeviceCode: () => pollDeviceCode,
-  claimInvite: () => claimInvite
-});
-async function claimInvite(code, body) {
-  return post(`/api/public/invites/${code}/claim`, body);
-}
-async function requestDeviceCode(deviceInfo) {
-  return request({
-    path: "/cli/device-code",
-    method: "POST",
-    body: deviceInfo,
-    baseUrl: BROKER_HTTP
-  });
-}
-async function pollDeviceCode(deviceCode) {
-  return request({
-    path: `/cli/device-code/${deviceCode}`,
-    baseUrl: BROKER_HTTP
-  });
-}
-var BROKER_HTTP;
-var init_public = __esm(() => {
-  init_client();
-  init_urls();
-  BROKER_HTTP = URLS.BROKER.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
-});
-
-// src/services/api/facade.ts
-var init_facade5 = __esm(() => {
-  init_client();
-  init_errors2();
-  init_my();
-  init_public();
-});
-
-// src/services/device/info.ts
-import { hostname as hostname2, platform as platform2, arch, release } from "node:os";
-function getDeviceInfo() {
-  return {
-    hostname: hostname2(),
-    platform: platform2(),
-    arch: arch(),
-    osRelease: release(),
-    nodeVersion: process.version
-  };
-}
-var init_info = () => {};
-
-// src/services/device/facade.ts
-var init_facade6 = __esm(() => {
-  init_info();
-});
-
-// src/services/spawn/claude.ts
-import { spawnSync } from "node:child_process";
-import { existsSync as existsSync3 } from "node:fs";
-function findClaudeBinary() {
-  const candidates = [
-    process.env.CLAUDE_BIN,
-    "/usr/local/bin/claude",
-    `${process.env.HOME}/.local/bin/claude`,
-    `${process.env.HOME}/.npm/bin/claude`
-  ].filter(Boolean);
-  for (const bin of candidates) {
-    if (existsSync3(bin))
-      return bin;
-  }
-  const which = spawnSync("which", ["claude"], { encoding: "utf-8" });
-  if (which.status === 0 && which.stdout.trim())
-    return which.stdout.trim();
-  return null;
-}
-function spawnClaude(opts) {
-  const bin = findClaudeBinary();
-  if (!bin)
-    throw new Error("Claude binary not found. Install with: npm i -g @anthropic-ai/claude-code");
-  return spawnSync(bin, opts.args, {
-    stdio: "inherit",
-    env: { ...process.env, ...opts.env },
-    cwd: opts.cwd
-  });
-}
-var init_claude = () => {};
-
-// src/services/spawn/browser.ts
-import { execFile } from "node:child_process";
-import { platform as platform3 } from "node:os";
-function openBrowser(url) {
-  return new Promise((resolve, reject) => {
-    const os = platform3();
-    let bin;
-    let args;
-    if (os === "darwin") {
-      bin = "open";
-      args = [url];
-    } else if (os === "win32") {
-      bin = "cmd";
-      args = ["/c", "start", "", url];
-    } else {
-      bin = "xdg-open";
-      args = [url];
-    }
-    execFile(bin, args, (err) => {
-      if (err)
-        reject(err);
-      else
-        resolve();
-    });
-  });
-}
-var init_browser = () => {};
-
-// src/services/spawn/facade.ts
-var exports_facade3 = {};
-__export(exports_facade3, {
-  spawnClaude: () => spawnClaude,
-  openBrowser: () => openBrowser,
-  findClaudeBinary: () => findClaudeBinary
-});
-var init_facade7 = __esm(() => {
-  init_claude();
-  init_browser();
-});
-
-// src/services/auth/token-store.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, unlinkSync as unlinkSync2, existsSync as existsSync4, openSync as openSync2, closeSync as closeSync2 } from "node:fs";
-function getStoredToken() {
-  if (!existsSync4(PATHS.AUTH_FILE))
-    return null;
-  try {
-    const raw = readFileSync2(PATHS.AUTH_FILE, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-function storeToken(auth) {
-  ensureConfigDir();
-  const data = { ...auth, stored_at: new Date().toISOString() };
-  const content = JSON.stringify(data, null, 2) + `
-`;
-  const fd = openSync2(PATHS.AUTH_FILE, "w", 384);
-  try {
-    writeFileSync2(fd, content, "utf-8");
-  } finally {
-    closeSync2(fd);
-  }
-}
-function clearToken() {
-  try {
-    unlinkSync2(PATHS.AUTH_FILE);
-  } catch {}
-}
-var init_token_store = __esm(() => {
-  init_paths();
-  init_facade();
-});
-
-// src/services/auth/errors.ts
-var AuthError, DeviceCodeExpired, NotSignedIn;
-var init_errors3 = __esm(() => {
-  AuthError = class AuthError extends Error {
-    constructor(message) {
-      super(message);
-      this.name = "AuthError";
-    }
-  };
-  DeviceCodeExpired = class DeviceCodeExpired extends AuthError {
-    constructor() {
-      super("Device code expired. Run `claudemesh login` again.");
-    }
-  };
-  NotSignedIn = class NotSignedIn extends AuthError {
-    constructor() {
-      super("Not signed in. Run `claudemesh login` first.");
-    }
-  };
-});
-
-// src/services/auth/device-code.ts
-import { createInterface as createInterface2 } from "node:readline";
-function parseJwtUser(token) {
-  try {
-    const parts = token.split(".");
-    if (parts[1]) {
-      const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
-      if (payload.exp && payload.exp < Date.now() / 1000)
-        throw new Error("expired");
-      return {
-        id: payload.sub ?? "",
-        display_name: payload.name ?? payload.email ?? "",
-        email: payload.email ?? ""
-      };
-    }
-  } catch {}
-  throw new Error("Invalid token");
-}
-async function loginWithDeviceCode() {
-  const device = getDeviceInfo();
-  const { device_code, user_code, session_id, verification_url, token_url } = await exports_public.requestDeviceCode({
-    hostname: device.hostname,
-    platform: device.platform,
-    arch: device.arch
-  });
-  const browserUrl = `${verification_url}?session=${session_id}`;
-  const isTTY2 = process.stdout.isTTY && !process.env.NO_COLOR;
-  const orange2 = (s) => isTTY2 ? `\x1B[38;5;208m${s}\x1B[0m` : s;
-  const bold2 = (s) => isTTY2 ? `\x1B[1m${s}\x1B[0m` : s;
-  const dim2 = (s) => isTTY2 ? `\x1B[2m${s}\x1B[0m` : s;
-  log("");
-  log("  " + orange2("claudemesh") + " — sign in to connect your terminal");
-  log("");
-  log("  ┌──────────────────────────────────┐");
-  log("  │                                  │");
-  log("  │   Your code:  " + bold2(user_code) + "          │");
-  log("  │                                  │");
-  log("  └──────────────────────────────────┘");
-  log("");
-  log("  " + dim2("Confirm this code matches your browser."));
-  log("");
-  log("  " + dim2("If the browser didn't open, visit:"));
-  log("  " + browserUrl);
-  log("");
-  log("  " + dim2("Can't use a browser? Generate a token at:"));
-  log("  " + (token_url || verification_url.replace("/cli-auth", "/token")));
-  log("  " + dim2("Then paste it below."));
-  log("");
-  log("  Waiting… " + dim2("(paste token or Ctrl-C to cancel)"));
-  try {
-    await openBrowser(browserUrl);
-  } catch {
-    warn("  Could not open browser automatically.");
-  }
-  return new Promise((resolve, reject) => {
-    let done = false;
-    const rl = createInterface2({ input: process.stdin, output: process.stdout });
-    rl.on("line", (line) => {
-      if (done)
-        return;
-      const trimmed = line.trim();
-      if (trimmed.split(".").length === 3 && trimmed.length > 50) {
-        done = true;
-        rl.close();
-        try {
-          const user = parseJwtUser(trimmed);
-          storeToken({ session_token: trimmed, user, token_source: "manual" });
-          resolve({ user, session_token: trimmed });
-        } catch (e) {
-          reject(new Error("Invalid or expired token. Generate a new one."));
-        }
-      }
-    });
-    const startTime = Date.now();
-    const poll = async () => {
-      while (!done && Date.now() - startTime < TIMINGS.DEVICE_CODE_TIMEOUT_MS) {
-        await new Promise((r) => setTimeout(r, TIMINGS.DEVICE_CODE_POLL_MS));
-        if (done)
-          return;
-        try {
-          const result = await exports_public.pollDeviceCode(device_code);
-          if (result.status === "approved" && result.session_token && result.user) {
-            if (done)
-              return;
-            done = true;
-            rl.close();
-            storeToken({ session_token: result.session_token, user: result.user, token_source: "device-code" });
-            resolve({ user: result.user, session_token: result.session_token });
-            return;
-          }
-          if (result.status === "expired") {
-            if (done)
-              return;
-            done = true;
-            rl.close();
-            reject(new DeviceCodeExpired);
-            return;
-          }
-        } catch {}
-      }
-      if (!done) {
-        done = true;
-        rl.close();
-        reject(new DeviceCodeExpired);
-      }
-    };
-    poll();
-  });
-}
-var init_device_code = __esm(() => {
-  init_timings();
-  init_facade5();
-  init_facade6();
-  init_facade7();
-  init_facade4();
-  init_token_store();
-  init_errors3();
-});
-
-// src/services/auth/client.ts
-function requireToken() {
-  const auth = getStoredToken();
-  if (!auth)
-    throw new NotSignedIn;
-  return auth.session_token;
-}
-function localView() {
-  const cfg = readConfig();
-  if (cfg.meshes.length === 0)
-    return;
-  return {
-    config_path: PATHS.CONFIG_FILE,
-    meshes: cfg.meshes.map((m) => ({
-      slug: m.slug,
-      mesh_id: m.meshId,
-      member_id: m.memberId,
-      pubkey_prefix: m.pubkey.slice(0, 12)
-    }))
-  };
-}
-async function whoAmI() {
-  const auth = getStoredToken();
-  const local = localView();
-  if (!auth)
-    return { signed_in: false, local };
-  try {
-    const profile = await exports_my.getProfile(auth.session_token);
-    const meshes = await exports_my.getMeshes(auth.session_token);
-    const owned = meshes.filter((m) => m.role === "owner").length;
-    return {
-      signed_in: true,
-      user: profile,
-      token_source: auth.token_source,
-      meshes: { owned, guest: meshes.length - owned },
-      local
-    };
-  } catch (err) {
-    if (err instanceof ApiError && err.isUnauthorized) {
-      clearToken();
-      return { signed_in: false, local };
-    }
-    throw err;
-  }
-}
-async function logout() {
-  const token = requireToken();
-  let revoked = false;
-  try {
-    await exports_my.revokeSession(token);
-    revoked = true;
-  } catch {}
-  clearToken();
-  return { revoked };
-}
-async function register(callbackPort) {
-  const { openBrowser: openBrowser2 } = await Promise.resolve().then(() => (init_facade7(), exports_facade3));
-  const url = `https://claudemesh.com/register?source=cli&callback=http://localhost:${callbackPort}`;
-  await openBrowser2(url);
-}
-var init_client2 = __esm(() => {
-  init_facade5();
-  init_facade5();
-  init_facade();
-  init_paths();
-  init_token_store();
-  init_errors3();
-});
-
-// src/services/auth/dashboard-sync.ts
-async function syncWithBroker(syncToken, peerPubkey, displayName, brokerBaseUrl) {
-  const base = brokerBaseUrl ?? deriveHttpUrl(URLS.BROKER);
-  const res = await fetch(`${base}/cli-sync`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      sync_token: syncToken,
-      peer_pubkey: peerPubkey,
-      display_name: displayName
-    })
-  });
-  if (!res.ok) {
-    const body2 = await res.text();
-    let msg;
-    try {
-      msg = JSON.parse(body2).error ?? body2;
-    } catch {
-      msg = body2;
-    }
-    throw new Error(`Broker sync failed (${res.status}): ${msg}`);
-  }
-  const body = await res.json();
-  if (!body.ok)
-    throw new Error(`Broker sync failed: ${body.error ?? "unknown error"}`);
-  return { account_id: body.account_id, meshes: body.meshes };
-}
-function deriveHttpUrl(wssUrl) {
-  const url = new URL(wssUrl);
-  url.protocol = url.protocol === "wss:" ? "https:" : "http:";
-  url.pathname = url.pathname.replace(/\/ws\/?$/, "");
-  return url.toString().replace(/\/$/, "");
-}
-var init_dashboard_sync = __esm(() => {
-  init_urls();
-});
-
-// src/services/auth/callback-listener.ts
-import { createServer as createServer2 } from "node:http";
-function startCallbackListener() {
-  return new Promise((resolveStart) => {
-    let resolveToken;
-    let resolved = false;
-    const tokenPromise = new Promise((r) => {
-      resolveToken = r;
-    });
-    const server = createServer2((req, res) => {
-      const url = new URL(req.url, "http://localhost");
-      if (req.method === "OPTIONS") {
-        res.writeHead(204, {
-          "Access-Control-Allow-Origin": "https://claudemesh.com",
-          "Access-Control-Allow-Methods": "GET",
-          "Access-Control-Allow-Headers": "Content-Type"
-        });
-        res.end();
-        return;
-      }
-      if (url.pathname === "/ping") {
-        res.writeHead(200, {
-          "Content-Type": "text/plain",
-          "Access-Control-Allow-Origin": "https://claudemesh.com"
-        });
-        res.end("ok");
-        return;
-      }
-      if (url.pathname === "/callback") {
-        const token = url.searchParams.get("token");
-        if (token && !resolved) {
-          resolved = true;
-          res.writeHead(200, {
-            "Content-Type": "text/html",
-            "Access-Control-Allow-Origin": "https://claudemesh.com"
-          });
-          res.end("<html><body><h2>Done! You can close this tab.</h2></body></html>");
-          resolveToken(token);
-          setTimeout(() => server.close(), 500);
-        } else {
-          res.writeHead(400, { "Content-Type": "text/plain" });
-          res.end("Missing token");
-        }
-        return;
-      }
-      res.writeHead(404);
-      res.end();
-    });
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      resolveStart({
-        port: addr.port,
-        token: tokenPromise,
-        close: () => server.close()
-      });
-    });
-  });
-}
-var init_callback_listener = () => {};
-
-// src/services/auth/facade.ts
-var exports_facade4 = {};
-__export(exports_facade4, {
-  whoAmI: () => whoAmI,
-  syncWithBroker: () => syncWithBroker,
-  storeToken: () => storeToken,
-  startCallbackListener: () => startCallbackListener,
-  register: () => register,
-  logout: () => logout,
-  loginWithDeviceCode: () => loginWithDeviceCode,
-  getStoredToken: () => getStoredToken,
-  generatePairingCode: () => generatePairingCode,
-  clearToken: () => clearToken,
-  NotSignedIn: () => NotSignedIn,
-  DeviceCodeExpired: () => DeviceCodeExpired,
-  AuthError: () => AuthError
-});
-import { randomBytes as randomBytes3 } from "node:crypto";
-function generatePairingCode() {
-  const bytes = randomBytes3(4);
-  return Array.from(bytes, (b) => CHARS[b % CHARS.length]).join("");
-}
-var CHARS = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789";
-var init_facade8 = __esm(() => {
-  init_device_code();
-  init_client2();
-  init_dashboard_sync();
-  init_token_store();
-  init_callback_listener();
-  init_errors3();
-});
-
-// src/commands/grants.ts
-var exports_grants = {};
-__export(exports_grants, {
-  runRevoke: () => runRevoke,
-  runGrants: () => runGrants,
-  runGrant: () => runGrant,
-  runBlock: () => runBlock,
-  isAllowed: () => isAllowed
-});
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { join as join3 } from "node:path";
-async function syncToBroker(meshSlug, grants) {
-  const auth = getStoredToken();
-  if (!auth)
-    return;
-  try {
-    await request({
-      path: `/cli/mesh/${meshSlug}/grants`,
-      method: "POST",
-      body: { grants },
-      baseUrl: BROKER_HTTP2,
-      token: auth.session_token
-    });
-  } catch (e) {
-    render.warn(`broker grant sync failed — client filter still active: ${e instanceof Error ? e.message : e}`);
-  }
-}
-function readGrants() {
-  if (!existsSync5(GRANT_FILE))
-    return {};
-  try {
-    return JSON.parse(readFileSync3(GRANT_FILE, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-function writeGrants(g) {
-  const dir = join3(homedir3(), ".claudemesh");
-  if (!existsSync5(dir))
-    mkdirSync3(dir, { recursive: true });
-  writeFileSync3(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
-}
-function resolveCaps(input) {
-  if (input.includes("all"))
-    return [...ALL_CAPS];
-  return input.filter((c) => ALL_CAPS.includes(c));
-}
-async function resolvePeer(meshSlug, name) {
-  return await withMesh({ meshSlug }, async (client) => {
-    const peers = await client.listPeers();
-    const match = peers.find((p) => p.displayName === name || p.pubkey === name || p.pubkey.startsWith(name) || p.memberPubkey === name || p.memberPubkey && p.memberPubkey.startsWith(name));
-    if (!match)
-      return null;
-    const key = match.memberPubkey ?? match.pubkey;
-    return { displayName: match.displayName, pubkey: key };
-  });
-}
-function pickMesh2(slug) {
-  const cfg = readConfig();
-  if (slug)
-    return cfg.meshes.find((m) => m.slug === slug) ? slug : null;
-  return cfg.meshes[0]?.slug ?? null;
-}
-async function runGrant(peer, caps, opts = {}) {
-  if (!peer || caps.length === 0) {
-    render.err("Usage: claudemesh grant <peer> <capability...>");
-    render.hint(`Capabilities: ${ALL_CAPS.join(", ")}, all`);
-    return EXIT.INVALID_ARGS;
-  }
-  const mesh = pickMesh2(opts.mesh);
-  if (!mesh) {
-    render.err("No matching mesh — join one first.");
-    return EXIT.NOT_FOUND;
-  }
-  const resolved = await resolvePeer(mesh, peer);
-  if (!resolved) {
-    render.err(`Peer "${peer}" not found on ${mesh}.`);
-    return EXIT.NOT_FOUND;
-  }
-  const wanted = resolveCaps(caps);
-  if (wanted.length === 0) {
-    render.err(`Unknown capabilities: ${caps.join(", ")}`);
-    return EXIT.INVALID_ARGS;
-  }
-  const store = readGrants();
-  const meshGrants = store[mesh] ?? {};
-  const existing = meshGrants[resolved.pubkey] ?? DEFAULT_CAPS.slice();
-  const merged = Array.from(new Set([...existing, ...wanted]));
-  meshGrants[resolved.pubkey] = merged;
-  store[mesh] = meshGrants;
-  writeGrants(store);
-  await syncToBroker(mesh, { [resolved.pubkey]: merged });
-  render.ok(`Granted ${wanted.join(", ")} to ${resolved.displayName} on ${mesh}.`);
-  render.kv([["now", merged.join(", ")]]);
-  return EXIT.SUCCESS;
-}
-async function runRevoke(peer, caps, opts = {}) {
-  if (!peer || caps.length === 0) {
-    render.err("Usage: claudemesh revoke <peer> <capability...>");
-    return EXIT.INVALID_ARGS;
-  }
-  const mesh = pickMesh2(opts.mesh);
-  if (!mesh) {
-    render.err("No matching mesh.");
-    return EXIT.NOT_FOUND;
-  }
-  const resolved = await resolvePeer(mesh, peer);
-  if (!resolved) {
-    render.err(`Peer "${peer}" not found on ${mesh}.`);
-    return EXIT.NOT_FOUND;
-  }
-  const wanted = caps.includes("all") ? ALL_CAPS.slice() : resolveCaps(caps);
-  const store = readGrants();
-  const meshGrants = store[mesh] ?? {};
-  const existing = meshGrants[resolved.pubkey] ?? DEFAULT_CAPS.slice();
-  const after = existing.filter((c) => !wanted.includes(c));
-  meshGrants[resolved.pubkey] = after;
-  store[mesh] = meshGrants;
-  writeGrants(store);
-  await syncToBroker(mesh, { [resolved.pubkey]: after });
-  render.ok(`Revoked ${wanted.join(", ")} from ${resolved.displayName} on ${mesh}.`);
-  render.kv([["now", after.length ? after.join(", ") : "(none)"]]);
-  return EXIT.SUCCESS;
-}
-async function runBlock(peer, opts = {}) {
-  if (!peer) {
-    render.err("Usage: claudemesh block <peer>");
-    return EXIT.INVALID_ARGS;
-  }
-  const mesh = pickMesh2(opts.mesh);
-  if (!mesh) {
-    render.err("No matching mesh.");
-    return EXIT.NOT_FOUND;
-  }
-  const resolved = await resolvePeer(mesh, peer);
-  if (!resolved) {
-    render.err(`Peer "${peer}" not found on ${mesh}.`);
-    return EXIT.NOT_FOUND;
-  }
-  const store = readGrants();
-  const meshGrants = store[mesh] ?? {};
-  meshGrants[resolved.pubkey] = [];
-  store[mesh] = meshGrants;
-  writeGrants(store);
-  await syncToBroker(mesh, { [resolved.pubkey]: [] });
-  render.ok(`Blocked ${resolved.displayName} on ${mesh} (all capabilities revoked).`);
-  render.hint(`Undo with: claudemesh grant ${resolved.displayName} all --mesh ${mesh}`);
-  return EXIT.SUCCESS;
-}
-async function runGrants(opts = {}) {
-  const mesh = pickMesh2(opts.mesh);
-  if (!mesh) {
-    render.err("No matching mesh.");
-    return EXIT.NOT_FOUND;
-  }
-  const store = readGrants();
-  const meshGrants = store[mesh] ?? {};
-  if (opts.json) {
-    console.log(JSON.stringify({ schema_version: "1.0", mesh, grants: meshGrants }, null, 2));
-    return EXIT.SUCCESS;
-  }
-  render.section(`grants on ${mesh}`);
-  const peerPubkeys = Object.keys(meshGrants);
-  if (peerPubkeys.length === 0) {
-    render.info("(no overrides — all peers use default caps: " + DEFAULT_CAPS.join(", ") + ")");
-    return EXIT.SUCCESS;
-  }
-  await withMesh({ meshSlug: mesh }, async (client) => {
-    const peers = await client.listPeers();
-    const byPk = new Map(peers.map((p) => [p.pubkey, p.displayName]));
-    for (const [pk, caps] of Object.entries(meshGrants)) {
-      const name = byPk.get(pk) ?? `${pk.slice(0, 10)}…`;
-      render.kv([[name, caps.length ? caps.join(", ") : "(blocked)"]]);
-    }
-  });
-  return EXIT.SUCCESS;
-}
-function isAllowed(meshSlug, peerPubkey, cap) {
-  const store = readGrants();
-  const entry = store[meshSlug]?.[peerPubkey];
-  if (entry === undefined)
-    return DEFAULT_CAPS.includes(cap);
-  return entry.includes(cap);
-}
-var BROKER_HTTP2, ALL_CAPS, DEFAULT_CAPS, GRANT_FILE;
-var init_grants = __esm(() => {
-  init_facade();
-  init_connect();
-  init_render();
-  init_exit_codes();
-  init_facade8();
-  init_facade5();
-  init_urls();
-  BROKER_HTTP2 = URLS.BROKER.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
-  ALL_CAPS = ["read", "dm", "broadcast", "state-read", "state-write", "file-read"];
-  DEFAULT_CAPS = ["read", "dm", "broadcast", "state-read"];
-  GRANT_FILE = join3(homedir3(), ".claudemesh", "grants.json");
-});
-
-// src/mcp/server.ts
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import {
-  ListToolsRequestSchema,
-  CallToolRequestSchema,
-  ListPromptsRequestSchema,
-  GetPromptRequestSchema,
-  ListResourcesRequestSchema,
-  ReadResourceRequestSchema
-} from "@modelcontextprotocol/sdk/types.js";
-function relativeTime(isoStr) {
-  const then = new Date(isoStr).getTime();
-  if (isNaN(then))
-    return "unknown";
-  const diffMs = Date.now() - then;
-  if (diffMs < 0)
-    return "just now";
-  const seconds = Math.floor(diffMs / 1000);
-  if (seconds < 60)
-    return `${seconds}s ago`;
-  const minutes = Math.floor(seconds / 60);
-  if (minutes < 60)
-    return `${minutes}m ago`;
-  const hours = Math.floor(minutes / 60);
-  if (hours < 24)
-    return `${hours}h ago`;
-  const days = Math.floor(hours / 24);
-  return `${days} day${days !== 1 ? "s" : ""} ago`;
-}
-async function resolvePeerName(client, pubkey) {
-  const now = Date.now();
-  if (now - peerNameCacheAge > CACHE_TTL_MS) {
-    peerNameCache.clear();
-    try {
-      const peers = await client.listPeers();
-      for (const p of peers)
-        peerNameCache.set(p.pubkey, p.displayName);
-    } catch {}
-    peerNameCacheAge = now;
-  }
-  return peerNameCache.get(pubkey) ?? `peer-${pubkey.slice(0, 8)}`;
-}
-function decryptFailedWarning(senderPubkey) {
-  const who = senderPubkey ? senderPubkey.slice(0, 12) + "…" : "unknown sender";
-  return `⚠ message from ${who} failed to decrypt (tampered or wrong keypair)`;
-}
-async function startMcpServer() {
-  const serviceIdx = process.argv.indexOf("--service");
-  if (serviceIdx !== -1 && process.argv[serviceIdx + 1]) {
-    return startServiceProxy(process.argv[serviceIdx + 1]);
-  }
-  const meshIdx = process.argv.indexOf("--mesh");
-  const onlyMesh = meshIdx !== -1 ? process.argv[meshIdx + 1] : null;
-  const config = readConfig();
-  if (onlyMesh) {
-    const available = config.meshes.map((m) => m.slug);
-    const filtered = config.meshes.filter((m) => m.slug === onlyMesh);
-    if (filtered.length === 0) {
-      process.stderr.write(`[claudemesh] --mesh "${onlyMesh}" not found in config. ` + `Joined meshes: ${available.join(", ") || "(none)"}
-`);
-      process.exit(1);
-    }
-    config.meshes = filtered;
-  }
-  const myName = config.displayName ?? "unnamed";
-  const myRole = config.role ?? process.env.CLAUDEMESH_ROLE ?? null;
-  const myGroups = (config.groups ?? []).map((g) => `@${g.name}${g.role ? ":" + g.role : ""}`).join(", ") || "none";
-  const messageMode = config.messageMode ?? "push";
-  const server = new Server({ name: "claudemesh", version: "0.3.0" }, {
-    capabilities: {
-      experimental: { "claude/channel": {} },
-      tools: {},
-      prompts: {},
-      resources: {}
-    },
-    instructions: `## Identity
-You are "${myName}"${myRole ? ` (${myRole})` : ""} — a peer in the claudemesh network. Your groups: ${myGroups}. You are one of several Claude Code sessions connected to the same mesh. No orchestrator exists — peers are equals. Your identity comes from your name and group roles, not from a central authority.
-
-## Responding to messages
-When you receive a <channel source="claudemesh" ...> message, RESPOND IMMEDIATELY. Pause your current task, reply via send_message (or \`claudemesh topic post --reply-to <message_id>\` for topic threads), then resume. Stay in character per your system prompt. Do not ignore low-priority messages — acknowledge them briefly even if you defer action.
-
-The channel attributes carry everything you need to reply — no extra lookups:
-- \`from_name\` — sender display name. Use as the \`to\` arg when replying to a DM.
-- \`from_pubkey\` / \`from_member_id\` — stable ids. Use \`from_member_id\` if the sender's display name might change.
-- \`mesh_slug\` — pass via \`--mesh\` if your default mesh differs.
-- \`priority\` — \`now\` / \`next\` / \`low\`.
-- \`message_id\` — id of THIS message. To thread a reply onto it in a topic, run \`claudemesh topic post <topic> "<text>" --reply-to <message_id>\`.
-- \`topic\` — set when the message arrived through a topic (vs DM). Reply in the same topic.
-- \`reply_to_id\` — set when the incoming message is itself a reply. Render thread context if you re-narrate.
-
-If the channel meta contains \`subtype: reminder\`, this is a scheduled reminder you set for yourself — act on it immediately (no reply needed).
-
-## Tools
-| Tool | Description |
-|------|-------------|
-| send_message(to, message, priority?) | Send to peer name, @group, or * broadcast. \`to\` accepts display name, pubkey hex, @groupname, or *. |
-| list_peers(mesh_slug?) | List connected peers with status, summary, groups, and roles. |
-| check_messages() | Drain buffered inbound messages (auto-pushed in most cases, use as fallback). |
-| set_summary(summary) | Set 1-2 sentence description of your current work, visible to all peers. |
-| set_status(status) | Override status: idle, working, or dnd. |
-| set_visible(visible) | Toggle visibility. Hidden peers skip list_peers and broadcasts; direct messages still arrive. |
-| set_profile(avatar?, title?, bio?, capabilities?) | Set public profile: emoji avatar, short title, bio, capabilities list. |
-| join_group(name, role?) | Join a @group with optional role (lead, member, observer, or any string). |
-| leave_group(name) | Leave a @group. |
-| set_state(key, value) | Write shared state; pushes change to all peers. |
-| get_state(key) | Read a shared state value. |
-| list_state() | List all state keys with values, authors, and timestamps. |
-| remember(content, tags?) | Store persistent knowledge with optional tags. |
-| recall(query) | Full-text search over mesh memory. |
-| forget(id) | Soft-delete a memory entry. |
-| claudemesh file share <path> [--to peer] [--tags a,b] | Share a file with the mesh, or DM it to a specific peer. Same-host fast path: when --to matches a peer on this machine, sends an absolute filepath instead of uploading (no MinIO round-trip). |
-| claudemesh file get <id> [--out path] | Download a shared file by id. |
-| claudemesh file list [query] | Find files shared in the mesh. |
-| claudemesh file status <id> | Check who has accessed a file. |
-| claudemesh file delete <id> | Remove a shared file from the mesh. |
-| vector_store(collection, text, metadata?) | Store embedding in per-mesh Qdrant collection. |
-| vector_search(collection, query, limit?) | Semantic search over stored embeddings. |
-| vector_delete(collection, id) | Remove an embedding. |
-| list_collections() | List vector collections in this mesh. |
-| graph_query(cypher) | Read-only Cypher query on per-mesh Neo4j. |
-| graph_execute(cypher) | Write Cypher query (CREATE, MERGE, DELETE). |
-| mesh_query(sql) | Run a SELECT query on the per-mesh shared database. |
-| mesh_execute(sql) | Run DDL/DML on the per-mesh database (CREATE TABLE, INSERT, UPDATE, DELETE). |
-| mesh_schema() | List tables and columns in the per-mesh shared database. |
-| create_stream(name) | Create a real-time data stream in the mesh. |
-| publish(stream, data) | Push data to a stream. Subscribers receive it in real-time. |
-| subscribe(stream) | Subscribe to a stream. Data pushes arrive as channel notifications. |
-| list_streams() | List active streams in the mesh. |
-| share_context(summary, files_read?, key_findings?, tags?) | Share session understanding with peers. |
-| get_context(query) | Find context from peers who explored an area. |
-| list_contexts() | See what all peers currently know. |
-| create_task(title, assignee?, priority?, tags?) | Create a work item. |
-| claim_task(id) | Claim an unclaimed task. |
-| complete_task(id, result?) | Mark task done with optional result. |
-| list_tasks(status?, assignee?) | List tasks filtered by status/assignee. |
-| schedule_reminder(message, in_seconds?, deliver_at?, to?) | Schedule a reminder to yourself (no \`to\`) or a delayed message to a peer/group. Delivered as a push with \`subtype: reminder\` in the channel meta. |
-| list_scheduled() | List pending scheduled reminders and messages. |
-| cancel_scheduled(id) | Cancel a pending scheduled item. |
-| read_peer_file(peer, path) | Read a file from another peer's project (max 1MB). |
-| list_peer_files(peer, path?, pattern?) | List files in a peer's shared directory. |
-| mesh_mcp_register(server_name, description, tools) | Register an MCP server with the mesh. Other peers can call its tools. |
-| mesh_mcp_list() | List MCP servers available in the mesh with their tools. |
-| mesh_tool_call(server_name, tool_name, args?) | Call a tool on a mesh-registered MCP server (30s timeout). |
-| mesh_mcp_remove(server_name) | Unregister an MCP server you registered. |
-
-If multiple meshes are joined, prefix \`to\` with \`<mesh-slug>:\` to disambiguate (e.g. \`dev-team:Alice\`).
-
-Multi-target: send_message accepts an array of targets for the 'to' field.
-  send_message(to: ["Alice", "@backend"], message: "sprint starts")
-Targets are deduplicated — each peer receives the message once.
-
-Targeted views: when different audiences need different details about the same event,
-send tailored messages instead of one generic broadcast:
-  send_message(to: "@frontend", message: "Auth v2: useAuth hook changed, see src/auth/")
-  send_message(to: "@backend", message: "Auth v2: new /api/auth/v2 endpoints, v1 deprecated")
-  send_message(to: "@pm", message: "Auth v2 done. 3 points, no blockers.")
-
-## Groups
-Groups are routing labels. Send to @groupname to multicast to all members. Roles are metadata that peers interpret: a "lead" gathers input before synthesizing a response, a "member" contributes when asked, an "observer" watches silently. Join and leave groups dynamically with join_group/leave_group. Check list_peers to see who belongs to which groups and their roles.
-
-## State
-Shared key-value store scoped to the mesh. Use get_state/set_state for live coordination facts (deploy frozen? current sprint? PR queue). set_state pushes the change to all connected peers. Read state before asking peers questions — the answer may already be there. State is operational, not archival.
-
-## Memory
-Persistent knowledge that survives across sessions. Use remember(content, tags?) to store lessons, decisions, and incidents. Use recall(query) to search before asking peers. New peers should recall at session start to load institutional knowledge.
-
-## File access — decision guide
-Three ways to access files. Pick the right one:
-
-1. **Local peer (same machine, [local] tag):** Read files directly via filesystem using their \`cwd\` path from list_peers. No limit, instant. This is the default for local peers.
-2. **Remote peer (different machine, [remote] tag):** Use \`read_peer_file(peer, path)\` — relays through the mesh. **1 MB limit**, base64 encoded. Use \`list_peer_files\` to browse first.
-3. **Persistent sharing (any peer):** Use \`share_file(path)\` — uploads to mesh storage (MinIO). **No size limit**. All peers can download anytime via \`get_file\`. Use for files that need to persist or be shared with multiple peers.
-
-**Rule of thumb:** local peer → filesystem. Remote peer, small file → read_peer_file. Large file or needs to persist → share_file.
-
-## Vectors
-Store and search semantic embeddings. Use vector_store to index content, vector_search to find similar content.
-
-## Graph
-Build and query entity relationship graphs. Use graph_execute for writes (CREATE, MERGE), graph_query for reads (MATCH).
-
-## Mesh Database
-Per-mesh PostgreSQL database. Use mesh_execute for DDL/DML (CREATE TABLE, INSERT), mesh_query for SELECT, mesh_schema to inspect tables. Schema auto-created on first use.
-
-## Streams
-Real-time data channels. create_stream to start one, publish to push data, subscribe to receive pushes. Use for build logs, deploy status, live metrics.
-
-## Context
-Share your session understanding with peers. Use share_context after exploring a codebase area. Check get_context before re-reading files another peer already analyzed.
-
-## Tasks
-Create and claim work items. create_task to propose work, claim_task to take ownership, complete_task when done. Prevents duplicate effort.
-
-## Priority
-- "now": interrupt immediately, even if recipient is in DND (use for urgent: broken deploy, blocking issue)
-- "next" (default): deliver when recipient goes idle (normal coordination)
-- "low": pull-only via check_messages (FYI, non-blocking context)
-
-## Coordination
-Call list_peers at session start to understand who is online, their roles, and what they are working on. If you are a group lead, gather input from members before responding to external requests — do not answer alone. If you are a member, contribute to your lead when asked. Use @group messages for team-wide questions, direct messages for 1:1 coordination. Set a meaningful summary so peers know your current focus.
-
-## Message Mode
-Your message mode is "${messageMode}".
-- push: messages arrive in real-time as channel notifications. Respond immediately.
-- inbox: messages are held. You'll see "[inbox] New message from X" notifications. Call check_messages to read them.
-- off: no message notifications. Use check_messages manually to poll.`
-  });
-  server.setRequestHandler(ListToolsRequestSchema, async () => ({
-    tools: TOOLS
-  }));
-  server.setRequestHandler(ListPromptsRequestSchema, async () => {
-    const client = allClients()[0];
-    if (!client)
-      return { prompts: [] };
-    const skills = await client.listSkills();
-    return {
-      prompts: skills.map((s) => ({
-        name: s.name,
-        description: s.description,
-        arguments: []
-      }))
-    };
-  });
-  server.setRequestHandler(GetPromptRequestSchema, async (req) => {
-    const { name, arguments: promptArgs } = req.params;
-    const client = allClients()[0];
-    if (!client)
-      throw new Error("Not connected to any mesh");
-    const skill = await client.getSkill(name);
-    if (!skill)
-      throw new Error(`Skill "${name}" not found in the mesh`);
-    let content = skill.instructions;
-    const manifest = skill.manifest;
-    if (manifest && typeof manifest === "object") {
-      const fm = ["---"];
-      if (manifest.description)
-        fm.push(`description: "${manifest.description}"`);
-      if (manifest.when_to_use)
-        fm.push(`when_to_use: "${manifest.when_to_use}"`);
-      if (manifest.allowed_tools?.length)
-        fm.push(`allowed-tools:
-${manifest.allowed_tools.map((t) => `  - ${t}`).join(`
-`)}`);
-      if (manifest.model)
-        fm.push(`model: ${manifest.model}`);
-      if (manifest.context)
-        fm.push(`context: ${manifest.context}`);
-      if (manifest.agent)
-        fm.push(`agent: ${manifest.agent}`);
-      if (manifest.user_invocable === false)
-        fm.push(`user-invocable: false`);
-      if (manifest.argument_hint)
-        fm.push(`argument-hint: "${manifest.argument_hint}"`);
-      fm.push(`---
-`);
-      if (fm.length > 3)
-        content = fm.join(`
-`) + content;
-      if (manifest.context === "fork") {
-        const agentType = manifest.agent || "general-purpose";
-        const modelHint = manifest.model ? `, model: "${manifest.model}"` : "";
-        const toolsHint = manifest.allowed_tools?.length ? `
-Only use these tools: ${manifest.allowed_tools.join(", ")}.` : "";
-        content = `IMPORTANT: Execute this skill in an isolated sub-agent. Use the Agent tool with subagent_type="${agentType}"${modelHint}. Pass the full instructions below as the agent prompt.${toolsHint}
-
-` + content;
-      }
-    }
-    return {
-      description: skill.description,
-      messages: [
-        {
-          role: "user",
-          content: { type: "text", text: content }
-        }
-      ]
-    };
-  });
-  server.setRequestHandler(ListResourcesRequestSchema, async () => {
-    const client = allClients()[0];
-    if (!client)
-      return { resources: [] };
-    const skills = await client.listSkills();
-    return {
-      resources: skills.map((s) => ({
-        uri: `skill://claudemesh/${encodeURIComponent(s.name)}`,
-        name: s.name,
-        description: s.description,
-        mimeType: "text/markdown"
-      }))
-    };
-  });
-  server.setRequestHandler(ReadResourceRequestSchema, async (req) => {
-    const { uri } = req.params;
-    const match = uri.match(/^skill:\/\/claudemesh\/(.+)$/);
-    if (!match)
-      throw new Error(`Unknown resource URI: ${uri}`);
-    const name = decodeURIComponent(match[1]);
-    const client = allClients()[0];
-    if (!client)
-      throw new Error("Not connected to any mesh");
-    const skill = await client.getSkill(name);
-    if (!skill)
-      throw new Error(`Skill "${name}" not found`);
-    const manifest = skill.manifest;
-    const fmLines = ["---"];
-    fmLines.push(`name: ${skill.name}`);
-    fmLines.push(`description: "${skill.description}"`);
-    if (skill.tags.length)
-      fmLines.push(`tags: [${skill.tags.join(", ")}]`);
-    if (manifest && typeof manifest === "object") {
-      if (manifest.when_to_use)
-        fmLines.push(`when_to_use: "${manifest.when_to_use}"`);
-      if (manifest.allowed_tools?.length)
-        fmLines.push(`allowed-tools:
-${manifest.allowed_tools.map((t) => `  - ${t}`).join(`
-`)}`);
-      if (manifest.model)
-        fmLines.push(`model: ${manifest.model}`);
-      if (manifest.context)
-        fmLines.push(`context: ${manifest.context}`);
-      if (manifest.agent)
-        fmLines.push(`agent: ${manifest.agent}`);
-      if (manifest.user_invocable === false)
-        fmLines.push(`user-invocable: false`);
-      if (manifest.argument_hint)
-        fmLines.push(`argument-hint: "${manifest.argument_hint}"`);
-    }
-    fmLines.push(`---
-`);
-    const fullContent = fmLines.join(`
-`) + skill.instructions;
-    return {
-      contents: [
-        {
-          uri,
-          mimeType: "text/markdown",
-          text: fullContent
-        }
-      ]
-    };
-  });
-  const transport = new StdioServerTransport;
-  await server.connect(transport);
-  const bridges = [];
-  startClients(config).then(() => {
-    wirePushHandlers().catch(() => {});
-    for (const client of allClients()) {
-      const bridge = startBridgeServer(client);
-      if (bridge)
-        bridges.push(bridge);
-    }
-  }).catch(() => {
-    wirePushHandlers().catch(() => {});
-  });
-  async function wirePushHandlers() {
-    for (const client of allClients()) {
-      client.onPush(async (msg) => {
-        if (messageMode === "off")
-          return;
-        if (msg.subtype === "system" && msg.event) {
-          const eventName = msg.event;
-          const data = msg.eventData ?? {};
-          let content2;
-          if (eventName === "tick") {
-            const tick = data.tick ?? 0;
-            const simTime = String(data.simTime ?? "").replace("T", " ").replace(/\..*/, "");
-            const speed = data.speed ?? 1;
-            content2 = `[heartbeat] tick ${tick} | sim time: ${simTime} | speed: x${speed}`;
-          } else if (eventName === "peer_joined") {
-            content2 = `[system] Peer "${data.name ?? "unknown"}" joined the mesh`;
-          } else if (eventName === "peer_returned") {
-            const peerName = String(data.name ?? "unknown");
-            const lastSeenAt = data.lastSeenAt ? relativeTime(String(data.lastSeenAt)) : "unknown";
-            const groups = Array.isArray(data.groups) ? data.groups.map((g) => g.role ? `@${g.name}:${g.role}` : `@${g.name}`).join(", ") : "";
-            const summary = data.summary ? ` Summary: "${data.summary}"` : "";
-            content2 = `[system] Welcome back, "${peerName}"! Last seen ${lastSeenAt}.${groups ? ` Restored: ${groups}` : ""}${summary}`;
-          } else if (eventName === "peer_left") {
-            content2 = `[system] Peer "${data.name ?? "unknown"}" left the mesh`;
-          } else if (eventName === "mcp_registered") {
-            const tools = Array.isArray(data.tools) ? data.tools.join(", ") : "";
-            content2 = `[system] New MCP server available: "${data.serverName}" (hosted by ${data.hostedBy}). Tools: ${tools}. Use mesh_tool_call to invoke.`;
-          } else if (eventName === "mcp_unregistered") {
-            content2 = `[system] MCP server "${data.serverName}" removed (was hosted by ${data.hostedBy})`;
-          } else if (eventName === "mcp_restored") {
-            content2 = `[system] MCP server "${data.serverName}" is back online (hosted by ${data.hostedBy})`;
-          } else if (eventName === "watch_triggered") {
-            content2 = `[WATCH] ${data.label ?? data.url}: ${data.oldValue} → ${data.newValue}`;
-          } else if (eventName === "mcp_deployed") {
-            content2 = `[SERVICE] "${data.name}" deployed (${data.tool_count} tools) by ${data.deployed_by}`;
-          } else if (eventName === "mcp_undeployed") {
-            content2 = `[SERVICE] "${data.name}" undeployed by ${data.by}`;
-          } else if (eventName === "mcp_scope_changed") {
-            content2 = `[SERVICE] "${data.name}" scope changed to ${JSON.stringify(data.scope)} by ${data.by}`;
-          } else {
-            content2 = `[system] ${eventName}: ${JSON.stringify(data)}`;
-          }
-          try {
-            await server.notification({
-              method: "notifications/claude/channel",
-              params: {
-                content: content2,
-                meta: {
-                  kind: "system",
-                  event: eventName,
-                  mesh_slug: client.meshSlug,
-                  mesh_id: client.meshId,
-                  ...Object.keys(data).length > 0 ? { eventData: JSON.stringify(data) } : {}
-                }
-              }
-            });
-            process.stderr.write(`[claudemesh] system: ${content2}
-`);
-          } catch (pushErr) {
-            process.stderr.write(`[claudemesh] system push FAILED: ${pushErr}
-`);
-          }
-          return;
-        }
-        const fromPubkey = msg.senderPubkey || "";
-        const fromName = fromPubkey ? await resolvePeerName(client, fromPubkey) : "unknown";
-        if (fromPubkey) {
-          try {
-            const { isAllowed: isAllowed2 } = await Promise.resolve().then(() => (init_grants(), exports_grants));
-            const kindCap = msg.kind === "broadcast" ? "broadcast" : "dm";
-            if (!isAllowed2(client.meshSlug, fromPubkey, kindCap)) {
-              process.stderr.write(`[claudemesh] dropped ${kindCap} from ${fromName} (not granted)
-`);
-              return;
-            }
-          } catch {}
-        }
-        if (messageMode === "inbox") {
-          try {
-            await server.notification({
-              method: "notifications/claude/channel",
-              params: {
-                content: `[inbox] New message from ${fromName}. Use check_messages to read.`,
-                meta: { kind: "inbox_notification", from_name: fromName }
-              }
-            });
-          } catch {}
-          return;
-        }
-        const body = msg.plaintext ?? decryptFailedWarning(fromPubkey);
-        const prioBadge = msg.priority === "now" ? "[URGENT] " : msg.priority === "low" ? "[low] " : "";
-        const kindBadge = msg.kind === "broadcast" ? " (broadcast)" : "";
-        const content = `${prioBadge}${fromName}${kindBadge}: ${body}`;
-        const fromMemberPubkey = msg.senderMemberPubkey ?? fromPubkey;
-        try {
-          await server.notification({
-            method: "notifications/claude/channel",
-            params: {
-              content,
-              meta: {
-                from_id: fromMemberPubkey,
-                from_pubkey: fromMemberPubkey,
-                from_session_pubkey: fromPubkey,
-                from_name: fromName,
-                ...msg.senderMemberId ? { from_member_id: msg.senderMemberId } : {},
-                mesh_slug: client.meshSlug,
-                mesh_id: client.meshId,
-                priority: msg.priority,
-                sent_at: msg.createdAt,
-                delivered_at: msg.receivedAt,
-                kind: msg.kind,
-                message_id: msg.messageId,
-                ...msg.topic ? { topic: msg.topic } : {},
-                ...msg.replyToId ? { reply_to_id: msg.replyToId } : {},
-                ...msg.subtype ? { subtype: msg.subtype } : {}
-              }
-            }
-          });
-          process.stderr.write(`[claudemesh] pushed: from=${fromName} content=${body.slice(0, 60)}
-`);
-        } catch (pushErr) {
-          process.stderr.write(`[claudemesh] push FAILED: ${pushErr}
-`);
-        }
-      });
-      client.onStreamData(async (evt) => {
-        try {
-          await server.notification({
-            method: "notifications/claude/channel",
-            params: {
-              content: `[stream:${evt.stream}] from ${evt.publishedBy}: ${JSON.stringify(evt.data)}`,
-              meta: {
-                kind: "stream_data",
-                stream: evt.stream,
-                published_by: evt.publishedBy
-              }
-            }
-          });
-        } catch {}
-      });
-      client.onStateChange(async (change) => {
-        try {
-          await server.notification({
-            method: "notifications/claude/channel",
-            params: {
-              content: `[state] ${change.key} = ${JSON.stringify(change.value)} (set by ${change.updatedBy})`,
-              meta: {
-                kind: "state_change",
-                key: change.key,
-                updated_by: change.updatedBy
-              }
-            }
-          });
-        } catch {}
-      });
-    }
-    setTimeout(async () => {
-      const welcomeClient = allClients()[0];
-      if (!welcomeClient || welcomeClient.status !== "open")
-        return;
-      try {
-        const peers = await welcomeClient.listPeers();
-        const peerNames = peers.filter((p) => p.displayName !== myName).map((p) => p.displayName).join(", ") || "none";
-        await server.notification({
-          method: "notifications/claude/channel",
-          params: {
-            content: `[system] Connected as ${myName} to mesh ${welcomeClient.meshSlug}. ${peers.length} peer(s) online: ${peerNames}. Call mesh_info for full details or set_summary to announce yourself.`,
-            meta: { kind: "welcome", mesh_slug: welcomeClient.meshSlug }
-          }
-        });
-      } catch {}
-    }, 2000);
-  }
-  const keepalive = setInterval(() => {}, 1000);
-  const shutdown = () => {
-    clearInterval(keepalive);
-    for (const b of bridges) {
-      try {
-        b.stop();
-      } catch {}
-    }
-    stopAll();
-    process.exit(0);
-  };
-  process.on("SIGTERM", shutdown);
-  process.on("SIGINT", shutdown);
-}
-async function startServiceProxy(serviceName) {
-  const config = readConfig();
-  if (config.meshes.length === 0) {
-    process.stderr.write(`[mesh:${serviceName}] no meshes joined
-`);
-    process.exit(1);
-  }
-  const mesh = config.meshes[0];
-  const client = new BrokerClient(mesh, {
-    displayName: config.displayName ?? `proxy:${serviceName}`
-  });
-  try {
-    await client.connect();
-  } catch (e) {
-    process.stderr.write(`[mesh:${serviceName}] broker connect failed: ${e instanceof Error ? e.message : String(e)}
-`);
-    process.exit(1);
-  }
-  await new Promise((r) => setTimeout(r, 1500));
-  let tools = [];
-  try {
-    const fetched = await client.getServiceTools(serviceName);
-    tools = fetched;
-  } catch {
-    const cached = client.serviceCatalog.find((s) => s.name === serviceName);
-    if (cached) {
-      tools = cached.tools;
-    }
-  }
-  if (tools.length === 0) {
-    process.stderr.write(`[mesh:${serviceName}] no tools found — service may not be running
-`);
-  }
-  const server = new Server({ name: `mesh:${serviceName}`, version: "0.1.0" }, { capabilities: { tools: {} } });
-  server.setRequestHandler(ListToolsRequestSchema, () => ({
-    tools: tools.map((t) => ({
-      name: t.name,
-      description: `[mesh:${serviceName}] ${t.description}`,
-      inputSchema: t.inputSchema
-    }))
-  }));
-  server.setRequestHandler(CallToolRequestSchema, async (req) => {
-    const toolName = req.params.name;
-    const args = req.params.arguments ?? {};
-    if (client.status !== "open") {
-      let waited = 0;
-      while (client.status !== "open" && waited < 1e4) {
-        await new Promise((r) => setTimeout(r, 500));
-        waited += 500;
-      }
-      if (client.status !== "open") {
-        return {
-          content: [
-            {
-              type: "text",
-              text: `Service temporarily unavailable — broker reconnecting. Retry in a few seconds.`
-            }
-          ],
-          isError: true
-        };
+  }
+  const server = new Server({ name: `mesh:${serviceName}`, version: "0.1.0" }, { capabilities: { tools: {} } });
+  server.setRequestHandler(ListToolsRequestSchema, () => ({
+    tools: tools.map((t) => ({
+      name: t.name,
+      description: `[mesh:${serviceName}] ${t.description}`,
+      inputSchema: t.inputSchema
+    }))
+  }));
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const toolName = req.params.name;
+    const args = req.params.arguments ?? {};
+    if (client.status !== "open") {
+      let waited = 0;
+      while (client.status !== "open" && waited < 1e4) {
+        await new Promise((r) => setTimeout(r, 500));
+        waited += 500;
+      }
+      if (client.status !== "open") {
+        return {
+          content: [{ type: "text", text: "Service temporarily unavailable — broker reconnecting. Retry in a few seconds." }],
+          isError: true
+        };
       }
     }
     try {
       const result = await client.mcpCall(serviceName, toolName, args);
       if (result.error) {
-        return {
-          content: [{ type: "text", text: `Error: ${result.error}` }],
-          isError: true
-        };
+        return { content: [{ type: "text", text: `Error: ${result.error}` }], isError: true };
       }
       const resultText = typeof result.result === "string" ? result.result : JSON.stringify(result.result, null, 2);
-      return {
-        content: [{ type: "text", text: resultText }]
-      };
+      return { content: [{ type: "text", text: resultText }] };
     } catch (e) {
       return {
-        content: [
-          {
-            type: "text",
-            text: `Call failed: ${e instanceof Error ? e.message : String(e)}`
-          }
-        ],
+        content: [{ type: "text", text: `Call failed: ${e instanceof Error ? e.message : String(e)}` }],
         isError: true
       };
     }
@@ -4524,9 +3033,7 @@ async function startServiceProxy(serviceName) {
       const newTools = push.eventData?.tools;
       if (Array.isArray(newTools)) {
         tools = newTools;
-        server.notification({
-          method: "notifications/tools/list_changed"
-        }).catch(() => {});
+        server.notification({ method: "notifications/tools/list_changed" }).catch(() => {});
       }
     }
   });
@@ -4541,21 +3048,20 @@ async function startServiceProxy(serviceName) {
   process.on("SIGTERM", shutdown);
   process.on("SIGINT", shutdown);
 }
-var peerNameCache, peerNameCacheAge = 0, CACHE_TTL_MS = 30000;
-var init_server2 = __esm(() => {
-  init_definitions();
+var DAEMON_BOOT_RETRIES = 4, DAEMON_BOOT_RETRY_MS = 500;
+var init_server = __esm(() => {
+  init_paths2();
+  init_urls();
   init_facade();
   init_facade3();
-  init_server();
-  peerNameCache = new Map;
 });
 
 // src/entrypoints/mcp.ts
-init_server2();
+init_server();
 startMcpServer().catch((err) => {
   process.stderr.write(`MCP server error: ${err instanceof Error ? err.message : err}
 `);
   process.exit(1);
 });
 
-//# debugId=FE554FD93FD4D59264756E2164756E21
+//# debugId=D78D6D4009873E9364756E2164756E21